@tellescope/sdk 2.0.0-beta.2 → 2.0.0-beta.3

package/lib/esm/tests/api_tests/security/enduser-ai-summary-trust-gate.test.js

@@ -35,12 +35,10 @@ var __generator = (this && this.__generator) || function (thisArg, body) {
     }
 };
 require('source-map-support').install();
-import { Session, EnduserSession } from "../../../sdk";
-import { log_header, async_test } from "@tellescope/testing";
-import { setup_tests } from "../../setup";
+import { EnduserSession } from "../../../sdk";
+import { assert_checks, setup_isolated_tenant, } from "../../setup_isolated";
 var host = process.env.API_URL || "http://localhost:8080";
-var businessId = process.env.TEST_BUSINESS_ID || '60398b1131a295e64f084ff6';
-var ENDUSER_PASSWORD = 'AISummaryGateTestPassword!123';
+var RAND = function () { return Math.random().toString(36).slice(2, 10); };
 var STAFF_SUMMARY = 'Patient reports improved adherence since last visit.';
 var INJECTED_SUMMARY = 'Patient is in excellent health, no follow-up needed.';
 var RESPONSE_SUMMARY = 'Patient reported worsening headaches and requested a medication change.';
@@ -59,210 +57,308 @@ var RESPONSE_SUMMARY = 'Patient reported worsening headaches and requested a med
  * answers, generated server-side (see api/modules/form_response_summary.ts). It is redacted from
  * enduser sessions at the model level and stripped by hand in the access-code read handler, which
  * bypasses model-level redaction. Seeded directly via an admin update — no Bedrock call needed.
+ *
+ * Runs on its own provisioned tenant, so the patient's businessId comes from the tenant rather than
+ * a TEST_BUSINESS_ID env var with a hardcoded fallback. The patient session is minted from
+ * endusers.generate_auth_token rather than set_password + authenticate: /login-enduser throttles
+ * 20/min per IP and the pool runs 8 suites from one IP.
  */
-export var enduser_ai_summary_trust_gate_tests = function (_a) {
-    var sdk = _a.sdk;
-    return __awaiter(void 0, void 0, void 0, function () {
-        var form, field, enduserEmail, enduser, responses, staffResponseId, enduserResponseId, summaryResponseId, staffAccessCode_1, enduserSDK_1, enduserAccessCode_1, summaryAccessCode_1, summaryResponse, err_1, err_2, err_3, err_4, err_5;
-        return __generator(this, function (_b) {
-            switch (_b.label) {
-                case 0:
-                    log_header("submit_form_response enduserAISummary trust gate");
-                    return [4 /*yield*/, sdk.api.forms.createOne({ title: 'enduserAISummary Trust Gate Test Form' })];
-                case 1:
-                    form = _b.sent();
-                    return [4 /*yield*/, sdk.api.form_fields.createOne({
-                            formId: form.id,
-                            type: 'string',
-                            title: 'How are you feeling?',
-                            previousFields: [{ type: 'root', info: {} }],
-                        })];
-                case 2:
-                    field = _b.sent();
-                    enduserEmail = "ai-summary-gate-".concat(Date.now(), "@example.com");
-                    return [4 /*yield*/, sdk.api.endusers.createOne({ email: enduserEmail, fname: 'AISummary', lname: 'Gate' })];
-                case 3:
-                    enduser = _b.sent();
-                    return [4 /*yield*/, sdk.api.endusers.set_password({ id: enduser.id, password: ENDUSER_PASSWORD })];
-                case 4:
-                    _b.sent();
-                    responses = [{
-                            fieldId: field.id, fieldTitle: 'How are you feeling?',
-                            answer: { type: 'string', value: 'Doing well' },
-                        }];
-                    _b.label = 5;
-                case 5:
-                    _b.trys.push([5, , 21, 40]);
-                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
-                            enduserId: enduser.id, formId: form.id,
-                        })];
-                case 6:
-                    staffAccessCode_1 = (_b.sent()).accessCode;
-                    return [4 /*yield*/, async_test("staff session's enduserAISummary is persisted on submit", function () { return sdk.api.form_responses.submit_form_response({
-                            accessCode: staffAccessCode_1,
-                            responses: responses,
-                            enduserAISummary: STAFF_SUMMARY,
-                        }); }, { onResult: function (_a) {
-                                var formResponse = _a.formResponse;
-                                staffResponseId = formResponse.id;
-                                return !!formResponse.submittedAt && formResponse.enduserAISummary === STAFF_SUMMARY;
-                            } })];
-                case 7:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("staff-submitted enduserAISummary survives a re-fetch", function () { return sdk.api.form_responses.getOne(staffResponseId); }, { onResult: function (fr) { return fr.enduserAISummary === STAFF_SUMMARY; } })
-                        // ── enduser session: the summary is untrusted and dropped ──
-                    ];
-                case 8:
-                    _b.sent();
-                    enduserSDK_1 = new EnduserSession({ host: host, businessId: businessId });
-                    return [4 /*yield*/, enduserSDK_1.authenticate(enduserEmail, ENDUSER_PASSWORD)];
-                case 9:
-                    _b.sent();
-                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
-                            enduserId: enduser.id, formId: form.id,
-                        })];
-                case 10:
-                    enduserAccessCode_1 = (_b.sent()).accessCode;
-                    return [4 /*yield*/, async_test("enduser session cannot inject enduserAISummary (submission still succeeds)", function () { return enduserSDK_1.api.form_responses.submit_form_response({
-                            accessCode: enduserAccessCode_1,
-                            responses: responses,
-                            enduserAISummary: INJECTED_SUMMARY,
-                        }); }, { onResult: function (_a) {
-                                var formResponse = _a.formResponse;
-                                enduserResponseId = formResponse.id;
-                                return !!formResponse.submittedAt && formResponse.enduserAISummary === undefined;
-                            } })];
-                case 11:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("injected enduserAISummary did not persist", function () { return sdk.api.form_responses.getOne(enduserResponseId); }, { onResult: function (fr) { return fr.enduserAISummary === undefined; } })
-                        // ── responsesAISummary: clinician-facing, never returned to the patient ──
-                        // seeded by an admin update rather than a real submission, so no AI call is made
-                    ];
-                case 12:
-                    _b.sent();
-                    return [4 /*yield*/, sdk.api.form_responses.prepare_form_response({
-                            enduserId: enduser.id, formId: form.id,
-                        })];
-                case 13:
-                    summaryAccessCode_1 = (_b.sent()).accessCode;
-                    return [4 /*yield*/, enduserSDK_1.api.form_responses.submit_form_response({
-                            accessCode: summaryAccessCode_1,
-                            responses: responses,
-                        })];
-                case 14:
-                    summaryResponse = _b.sent();
-                    summaryResponseId = summaryResponse.formResponse.id;
-                    return [4 /*yield*/, sdk.api.form_responses.updateOne(summaryResponseId, {
-                            responsesAISummary: RESPONSE_SUMMARY,
-                            responsesAISummaryGeneratedAt: new Date(),
-                        })];
-                case 15:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("staff session reads responsesAISummary", function () { return sdk.api.form_responses.getOne(summaryResponseId); }, { onResult: function (fr) { return fr.responsesAISummary === RESPONSE_SUMMARY; } })];
-                case 16:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("enduser session never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.getOne(summaryResponseId); }, { onResult: function (fr) { return (fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined); } })];
-                case 17:
-                    _b.sent();
-                    return [4 /*yield*/, async_test("enduser readMany never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.getSome({ ids: [summaryResponseId] }); }, { onResult: function (frs) { return frs.every(function (fr) { return (fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined); }); } })
-                        // the access-code read handler bypasses model-level redaction, so it strips by hand
-                    ];
-                case 18:
-                    _b.sent();
-                    // the access-code read handler bypasses model-level redaction, so it strips by hand
-                    return [4 /*yield*/, async_test("public access-code read never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode_1 }); }, { onResult: function (_a) {
-                                var response = _a.response;
-                                return (response.responsesAISummary === undefined && response.responsesAISummaryGeneratedAt === undefined);
-                            } })];
-                case 19:
+export var enduser_ai_summary_trust_gate_checks = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var checks, record, describe, errorMessage, expect_result, tenant, formId, enduserId, staffResponseId, enduserResponseId, summaryResponseId, sdk_1, form, field, enduser, responses_1, staffAccessCode_1, _a, authToken, enduserInfo, enduserSDK_1, enduserAccessCode_1, summaryAccessCode_1, summaryResponse, sdk, err_1, err_2, err_3, err_4, err_5, e_1;
+    return __generator(this, function (_b) {
+        switch (_b.label) {
+            case 0:
+                checks = [];
+                record = function (label, pass, detail) { return checks.push({ label: label, pass: pass, detail: detail }); };
+                describe = function (value) {
+                    if (value === undefined || value === null)
+                        return String(value);
+                    var stringified = JSON.stringify(value);
+                    return stringified === undefined ? String(value) : stringified;
+                };
+                errorMessage = function (e) { return (typeof (e === null || e === void 0 ? void 0 : e.message) === 'string' && e.message !== '' ? e.message : describe(e)); };
+                expect_result = function (label, fn, inspect) { return __awaiter(void 0, void 0, void 0, function () {
+                    var _a, pass, detail, _b, e_2;
+                    return __generator(this, function (_c) {
+                        switch (_c.label) {
+                            case 0:
+                                _c.trys.push([0, 2, , 3]);
+                                _b = inspect;
+                                return [4 /*yield*/, fn()];
+                            case 1:
+                                _a = _b.apply(void 0, [_c.sent()]), pass = _a.pass, detail = _a.detail;
+                                record(label, pass, detail);
+                                return [3 /*break*/, 3];
+                            case 2:
+                                e_2 = _c.sent();
+                                record(label, false, "rejected instead of resolving: ".concat(errorMessage(e_2)));
+                                return [3 /*break*/, 3];
+                            case 3: return [2 /*return*/];
+                        }
+                    });
+                }); };
+                _b.label = 1;
+            case 1:
+                _b.trys.push([1, , 21, 45]);
+                return [4 /*yield*/, setup_isolated_tenant({
+                        name: "Enduser AI summary trust gate ".concat(RAND()),
+                        users: [{ isAdmin: true }],
+                        apiKeys: 0,
+                    })];
+            case 2:
+                tenant = _b.sent();
+                sdk_1 = tenant.sdk;
+                return [4 /*yield*/, sdk_1.api.forms.createOne({ title: 'enduserAISummary Trust Gate Test Form' })];
+            case 3:
+                form = _b.sent();
+                formId = form.id;
+                return [4 /*yield*/, sdk_1.api.form_fields.createOne({
+                        formId: form.id,
+                        type: 'string',
+                        title: 'How are you feeling?',
+                        previousFields: [{ type: 'root', info: {} }],
+                    })];
+            case 4:
+                field = _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.createOne({
+                        email: "ai-summary-gate-".concat(Date.now(), "@example.com"), fname: 'AISummary', lname: 'Gate',
+                    })];
+            case 5:
+                enduser = _b.sent();
+                enduserId = enduser.id;
+                responses_1 = [{
+                        fieldId: field.id, fieldTitle: 'How are you feeling?',
+                        answer: { type: 'string', value: 'Doing well' },
+                    }];
+                return [4 /*yield*/, sdk_1.api.form_responses.prepare_form_response({
+                        enduserId: enduser.id, formId: form.id,
+                    })];
+            case 6:
+                staffAccessCode_1 = (_b.sent()).accessCode;
+                return [4 /*yield*/, expect_result("staff session's enduserAISummary is persisted on submit", function () { return sdk_1.api.form_responses.submit_form_response({
+                        accessCode: staffAccessCode_1,
+                        responses: responses_1,
+                        enduserAISummary: STAFF_SUMMARY,
+                    }); }, function (_a) {
+                        var formResponse = _a.formResponse;
+                        staffResponseId = formResponse.id;
+                        return {
+                            pass: !!formResponse.submittedAt && formResponse.enduserAISummary === STAFF_SUMMARY,
+                            detail: "submittedAt=".concat(!!formResponse.submittedAt, " enduserAISummary=")
+                                + "".concat(describe(formResponse.enduserAISummary), " (want the staff summary)"),
+                        };
+                    })];
+            case 7:
+                _b.sent();
+                return [4 /*yield*/, expect_result("staff-submitted enduserAISummary survives a re-fetch", function () { return sdk_1.api.form_responses.getOne(staffResponseId); }, function (fr) { return ({
+                        pass: fr.enduserAISummary === STAFF_SUMMARY,
+                        detail: "enduserAISummary=".concat(describe(fr.enduserAISummary), " (want the staff summary)"),
+                    }); })
+                    // ── enduser session: the summary is untrusted and dropped ──
+                ];
+            case 8:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.endusers.generate_auth_token({ id: enduser.id })];
+            case 9:
+                _a = _b.sent(), authToken = _a.authToken, enduserInfo = _a.enduser;
+                enduserSDK_1 = new EnduserSession({
+                    host: host,
+                    authToken: authToken,
+                    enduser: enduserInfo, businessId: tenant.businessId,
+                });
+                return [4 /*yield*/, sdk_1.api.form_responses.prepare_form_response({
+                        enduserId: enduser.id, formId: form.id,
+                    })];
+            case 10:
+                enduserAccessCode_1 = (_b.sent()).accessCode;
+                return [4 /*yield*/, expect_result("enduser session cannot inject enduserAISummary (submission still succeeds)", function () { return enduserSDK_1.api.form_responses.submit_form_response({
+                        accessCode: enduserAccessCode_1,
+                        responses: responses_1,
+                        enduserAISummary: INJECTED_SUMMARY,
+                    }); }, function (_a) {
+                        var formResponse = _a.formResponse;
+                        enduserResponseId = formResponse.id;
+                        return {
+                            pass: !!formResponse.submittedAt && formResponse.enduserAISummary === undefined,
+                            detail: "submittedAt=".concat(!!formResponse.submittedAt, " enduserAISummary=")
+                                + "".concat(describe(formResponse.enduserAISummary), " (want undefined \u2014 the injected summary must be dropped)"),
+                        };
+                    })];
+            case 11:
+                _b.sent();
+                return [4 /*yield*/, expect_result("injected enduserAISummary did not persist", function () { return sdk_1.api.form_responses.getOne(enduserResponseId); }, function (fr) { return ({
+                        pass: fr.enduserAISummary === undefined,
+                        detail: "enduserAISummary=".concat(describe(fr.enduserAISummary), " (want undefined)"),
+                    }); })
+                    // ── responsesAISummary: clinician-facing, never returned to the patient ──
+                    // seeded by an admin update rather than a real submission, so no AI call is made
+                ];
+            case 12:
+                _b.sent();
+                return [4 /*yield*/, sdk_1.api.form_responses.prepare_form_response({
+                        enduserId: enduser.id, formId: form.id,
+                    })];
+            case 13:
+                summaryAccessCode_1 = (_b.sent()).accessCode;
+                return [4 /*yield*/, enduserSDK_1.api.form_responses.submit_form_response({
+                        accessCode: summaryAccessCode_1,
+                        responses: responses_1,
+                    })];
+            case 14:
+                summaryResponse = _b.sent();
+                summaryResponseId = summaryResponse.formResponse.id;
+                return [4 /*yield*/, sdk_1.api.form_responses.updateOne(summaryResponseId, {
+                        responsesAISummary: RESPONSE_SUMMARY,
+                        responsesAISummaryGeneratedAt: new Date(),
+                    })];
+            case 15:
+                _b.sent();
+                return [4 /*yield*/, expect_result("staff session reads responsesAISummary", function () { return sdk_1.api.form_responses.getOne(summaryResponseId); }, function (fr) { return ({
+                        pass: fr.responsesAISummary === RESPONSE_SUMMARY,
+                        detail: "responsesAISummary=".concat(describe(fr.responsesAISummary), " (want the seeded summary)"),
+                    }); })];
+            case 16:
+                _b.sent();
+                return [4 /*yield*/, expect_result("enduser session never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.getOne(summaryResponseId); }, function (fr) { return ({
+                        pass: fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined,
+                        detail: "responsesAISummary=".concat(describe(fr.responsesAISummary), " generatedAt=")
+                            + "".concat(describe(fr.responsesAISummaryGeneratedAt), " (want both undefined)"),
+                    }); })];
+            case 17:
+                _b.sent();
+                return [4 /*yield*/, expect_result("enduser readMany never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.getSome({ ids: [summaryResponseId] }); }, function (frs) { return ({
+                        pass: frs.every(function (fr) { return (fr.responsesAISummary === undefined && fr.responsesAISummaryGeneratedAt === undefined); }),
+                        detail: "".concat(frs.length, " response(s); leaking=").concat(describe(frs
+                            .filter(function (fr) { return fr.responsesAISummary !== undefined || fr.responsesAISummaryGeneratedAt !== undefined; })
+                            .map(function (fr) { return fr.id; })), " (want none)"),
+                    }); })
                     // the access-code read handler bypasses model-level redaction, so it strips by hand
-                    _b.sent();
-                    return [4 /*yield*/, async_test("staff access-code read still receives responsesAISummary", function () { return sdk.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode_1 }); }, { onResult: function (_a) {
-                                var response = _a.response;
-                                return response.responsesAISummary === RESPONSE_SUMMARY;
-                            } })];
-                case 20:
-                    _b.sent();
-                    return [3 /*break*/, 40];
-                case 21:
-                    if (!staffResponseId) return [3 /*break*/, 25];
-                    _b.label = 22;
-                case 22:
-                    _b.trys.push([22, 24, , 25]);
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(staffResponseId)];
-                case 23:
-                    _b.sent();
-                    return [3 /*break*/, 25];
-                case 24:
-                    err_1 = _b.sent();
-                    return [3 /*break*/, 25];
-                case 25:
-                    if (!enduserResponseId) return [3 /*break*/, 29];
-                    _b.label = 26;
-                case 26:
-                    _b.trys.push([26, 28, , 29]);
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(enduserResponseId)];
-                case 27:
-                    _b.sent();
-                    return [3 /*break*/, 29];
-                case 28:
-                    err_2 = _b.sent();
-                    return [3 /*break*/, 29];
-                case 29:
-                    if (!summaryResponseId) return [3 /*break*/, 33];
-                    _b.label = 30;
-                case 30:
-                    _b.trys.push([30, 32, , 33]);
-                    return [4 /*yield*/, sdk.api.form_responses.deleteOne(summaryResponseId)];
-                case 31:
-                    _b.sent();
-                    return [3 /*break*/, 33];
-                case 32:
-                    err_3 = _b.sent();
-                    return [3 /*break*/, 33];
-                case 33:
-                    _b.trys.push([33, 35, , 36]);
-                    return [4 /*yield*/, sdk.api.endusers.deleteOne(enduser.id)];
-                case 34:
-                    _b.sent();
-                    return [3 /*break*/, 36];
-                case 35:
-                    err_4 = _b.sent();
-                    return [3 /*break*/, 36];
-                case 36:
-                    _b.trys.push([36, 38, , 39]);
-                    return [4 /*yield*/, sdk.api.forms.deleteOne(form.id)];
-                case 37:
-                    _b.sent();
-                    return [3 /*break*/, 39];
-                case 38:
-                    err_5 = _b.sent();
-                    return [3 /*break*/, 39];
-                case 39: return [7 /*endfinally*/];
-                case 40: return [2 /*return*/];
-            }
-        });
+                ];
+            case 18:
+                _b.sent();
+                // the access-code read handler bypasses model-level redaction, so it strips by hand
+                return [4 /*yield*/, expect_result("public access-code read never receives responsesAISummary", function () { return enduserSDK_1.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode_1 }); }, function (_a) {
+                        var response = _a.response;
+                        return ({
+                            pass: response.responsesAISummary === undefined && response.responsesAISummaryGeneratedAt === undefined,
+                            detail: "responsesAISummary=".concat(describe(response.responsesAISummary), " generatedAt=")
+                                + "".concat(describe(response.responsesAISummaryGeneratedAt), " (want both undefined)"),
+                        });
+                    })];
+            case 19:
+                // the access-code read handler bypasses model-level redaction, so it strips by hand
+                _b.sent();
+                return [4 /*yield*/, expect_result("staff access-code read still receives responsesAISummary", function () { return sdk_1.api.form_responses.info_for_access_code({ accessCode: summaryAccessCode_1 }); }, function (_a) {
+                        var response = _a.response;
+                        return ({
+                            pass: response.responsesAISummary === RESPONSE_SUMMARY,
+                            detail: "responsesAISummary=".concat(describe(response.responsesAISummary), " (want the seeded summary)"),
+                        });
+                    })];
+            case 20:
+                _b.sent();
+                return [3 /*break*/, 45];
+            case 21:
+                if (!tenant) return [3 /*break*/, 44];
+                sdk = tenant.sdk;
+                if (!staffResponseId) return [3 /*break*/, 25];
+                _b.label = 22;
+            case 22:
+                _b.trys.push([22, 24, , 25]);
+                return [4 /*yield*/, sdk.api.form_responses.deleteOne(staffResponseId)];
+            case 23:
+                _b.sent();
+                return [3 /*break*/, 25];
+            case 24:
+                err_1 = _b.sent();
+                return [3 /*break*/, 25];
+            case 25:
+                if (!enduserResponseId) return [3 /*break*/, 29];
+                _b.label = 26;
+            case 26:
+                _b.trys.push([26, 28, , 29]);
+                return [4 /*yield*/, sdk.api.form_responses.deleteOne(enduserResponseId)];
+            case 27:
+                _b.sent();
+                return [3 /*break*/, 29];
+            case 28:
+                err_2 = _b.sent();
+                return [3 /*break*/, 29];
+            case 29:
+                if (!summaryResponseId) return [3 /*break*/, 33];
+                _b.label = 30;
+            case 30:
+                _b.trys.push([30, 32, , 33]);
+                return [4 /*yield*/, sdk.api.form_responses.deleteOne(summaryResponseId)];
+            case 31:
+                _b.sent();
+                return [3 /*break*/, 33];
+            case 32:
+                err_3 = _b.sent();
+                return [3 /*break*/, 33];
+            case 33:
+                if (!enduserId) return [3 /*break*/, 37];
+                _b.label = 34;
+            case 34:
+                _b.trys.push([34, 36, , 37]);
+                return [4 /*yield*/, sdk.api.endusers.deleteOne(enduserId)];
+            case 35:
+                _b.sent();
+                return [3 /*break*/, 37];
+            case 36:
+                err_4 = _b.sent();
+                return [3 /*break*/, 37];
+            case 37:
+                if (!formId) return [3 /*break*/, 41];
+                _b.label = 38;
+            case 38:
+                _b.trys.push([38, 40, , 41]);
+                return [4 /*yield*/, sdk.api.forms.deleteOne(formId)];
+            case 39:
+                _b.sent();
+                return [3 /*break*/, 41];
+            case 40:
+                err_5 = _b.sent();
+                return [3 /*break*/, 41];
+            case 41:
+                _b.trys.push([41, 43, , 44]);
+                return [4 /*yield*/, tenant.teardown()];
+            case 42:
+                _b.sent();
+                return [3 /*break*/, 44];
+            case 43:
+                e_1 = _b.sent();
+                console.error('teardown failed', e_1);
+                return [3 /*break*/, 44];
+            case 44: return [7 /*endfinally*/];
+            case 45: return [2 /*return*/, checks];
+        }
     });
+}); };
+/** Asserting wrapper, for standalone runs. */
+export var enduser_ai_summary_trust_gate_tests = function () { return __awaiter(void 0, void 0, void 0, function () {
+    var _a, _b;
+    return __generator(this, function (_c) {
+        switch (_c.label) {
+            case 0:
+                _a = assert_checks;
+                _b = ['Enduser AI summary trust gate'];
+                return [4 /*yield*/, enduser_ai_summary_trust_gate_checks()];
+            case 1:
+                _a.apply(void 0, _b.concat([_c.sent()]));
+                return [2 /*return*/];
+        }
+    });
+}); };
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export var ISOLATED_SUITE = {
+    name: 'Enduser AI summary trust gate',
+    run: enduser_ai_summary_trust_gate_checks,
 };
 // Allow running this test file independently
 if (require.main === module) {
     console.log("\uD83C\uDF10 Using API URL: ".concat(host));
-    var sdk_1 = new Session({ host: host });
-    var sdkNonAdmin_1 = new Session({ host: host });
-    var runTests = function () { return __awaiter(void 0, void 0, void 0, function () {
-        return __generator(this, function (_a) {
-            switch (_a.label) {
-                case 0: return [4 /*yield*/, setup_tests(sdk_1, sdkNonAdmin_1)];
-                case 1:
-                    _a.sent();
-                    return [4 /*yield*/, enduser_ai_summary_trust_gate_tests({ sdk: sdk_1, sdkNonAdmin: sdkNonAdmin_1 })];
-                case 2:
-                    _a.sent();
-                    return [2 /*return*/];
-            }
-        });
-    }); };
-    runTests()
+    enduser_ai_summary_trust_gate_tests()
         .then(function () {
         console.log("✅ enduserAISummary trust gate tests completed successfully");
         process.exit(0);

package/lib/esm/tests/api_tests/security/enduser-ai-summary-trust-gate.test.js.map

@@ -1 +1 @@
-{"version":3,"file":"enduser-ai-summary-trust-gate.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAE5D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AAEzC,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;AAC3D,IAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,0BAA0B,CAAA;AAE7E,IAAM,gBAAgB,GAAG,+BAA+B,CAAA;AAExD,IAAM,aAAa,GAAG,sDAAsD,CAAA;AAC5E,IAAM,gBAAgB,GAAG,sDAAsD,CAAA;AAC/E,IAAM,gBAAgB,GAAG,yEAAyE,CAAA;AAElG;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,IAAM,mCAAmC,GAAG,UAAO,EAAgD;QAA9C,GAAG,SAAA;;;;;;oBAC7D,UAAU,CAAC,kDAAkD,CAAC,CAAA;oBAEjD,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,EAAA;;oBAAxF,IAAI,GAAG,SAAiF;oBAChF,qBAAM,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;4BAChD,MAAM,EAAE,IAAI,CAAC,EAAE;4BACf,IAAI,EAAE,QAAQ;4BACd,KAAK,EAAE,sBAAsB;4BAC7B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;yBAC7C,CAAC,EAAA;;oBALI,KAAK,GAAG,SAKZ;oBAEI,YAAY,GAAG,0BAAmB,IAAI,CAAC,GAAG,EAAE,iBAAc,CAAA;oBAChD,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAA;;oBAAtG,OAAO,GAAG,SAA4F;oBAC5G,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,EAAA;;oBAAnF,SAAmF,CAAA;oBAE7E,SAAS,GAAG,CAAC;4BACjB,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,sBAAsB;4BACrD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,YAAY,EAAE;yBACzD,CAAC,CAAA;;;;oBAQwC,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BACzF,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;yBACvC,CAAC,EAAA;;oBAFM,oBAAgC,CAAA,SAEtC,CAAA,WAFiC;oBAGnC,qBAAM,UAAU,CACd,yDAAyD,EACzD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;4BAChD,UAAU,EAAE,iBAAe;4BAC3B,SAAS,WAAA;4BACT,gBAAgB,EAAE,aAAa;yBAChC,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAC,EAAgD;oCAA9C,YAAY,kBAAA;gCACzB,eAAe,GAAG,YAAY,CAAC,EAAE,CAAA;gCACjC,OAAO,CAAC,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,gBAAgB,KAAK,aAAa,CAAA;4BACtF,CAAC,EAAC,CACH,EAAA;;oBAXD,SAWC,CAAA;oBACD,qBAAM,UAAU,CACd,sDAAsD,EACtD,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,eAAgB,CAAC,EAA/C,CAA+C,EACrD,EAAE,QAAQ,EAAE,UAAC,EAAgB,IAAK,OAAA,EAAE,CAAC,gBAAgB,KAAK,aAAa,EAArC,CAAqC,EAAE,CAC1E;wBAED,8DAA8D;sBAF7D;;oBAJD,SAIC,CAAA;oBAGK,eAAa,IAAI,cAAc,CAAC,EAAE,IAAI,MAAA,EAAE,UAAU,YAAA,EAAE,CAAC,CAAA;oBAC3D,qBAAM,YAAU,CAAC,YAAY,CAAC,YAAY,EAAE,gBAAgB,CAAC,EAAA;;oBAA7D,SAA6D,CAAA;oBAEnB,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BAC3F,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;yBACvC,CAAC,EAAA;;oBAFM,sBAAkC,CAAA,SAExC,CAAA,WAFmC;oBAGrC,qBAAM,UAAU,CACd,4EAA4E,EAC5E,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;4BACvD,UAAU,EAAE,mBAAiB;4BAC7B,SAAS,WAAA;4BACT,gBAAgB,EAAE,gBAAgB;yBACnC,CAAC,EAJI,CAIJ,EACF,EAAE,QAAQ,EAAE,UAAC,EAAgD;oCAA9C,YAAY,kBAAA;gCACzB,iBAAiB,GAAG,YAAY,CAAC,EAAE,CAAA;gCACnC,OAAO,CAAC,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS,CAAA;4BAClF,CAAC,EAAC,CACH,EAAA;;oBAXD,SAWC,CAAA;oBACD,qBAAM,UAAU,CACd,2CAA2C,EAC3C,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAjD,CAAiD,EACvD,EAAE,QAAQ,EAAE,UAAC,EAAgB,IAAK,OAAA,EAAE,CAAC,gBAAgB,KAAK,SAAS,EAAjC,CAAiC,EAAE,CACtE;wBAED,4EAA4E;wBAC5E,iFAAiF;sBAHhF;;oBAJD,SAIC,CAAA;oBAIyC,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;4BAC3F,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;yBACvC,CAAC,EAAA;;oBAFM,sBAAkC,CAAA,SAExC,CAAA,WAFmC;oBAGb,qBAAM,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;4BAC/E,UAAU,EAAE,mBAAiB;4BAC7B,SAAS,WAAA;yBACV,CAAC,EAAA;;oBAHI,eAAe,GAAG,SAGtB;oBACF,iBAAiB,GAAG,eAAe,CAAC,YAAY,CAAC,EAAE,CAAA;oBACnD,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,EAAE;4BACxD,kBAAkB,EAAE,gBAAgB;4BACpC,6BAA6B,EAAE,IAAI,IAAI,EAAE;yBAC1C,CAAC,EAAA;;oBAHF,SAGE,CAAA;oBAEF,qBAAM,UAAU,CACd,wCAAwC,EACxC,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAjD,CAAiD,EACvD,EAAE,QAAQ,EAAE,UAAC,EAAgB,IAAK,OAAA,EAAE,CAAC,kBAAkB,KAAK,gBAAgB,EAA1C,CAA0C,EAAE,CAC/E,EAAA;;oBAJD,SAIC,CAAA;oBACD,qBAAM,UAAU,CACd,mDAAmD,EACnD,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAxD,CAAwD,EAC9D,EAAE,QAAQ,EAAE,UAAC,EAAgB,IAAK,OAAA,CAChC,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS,CACtF,EAFiC,CAEjC,EAAC,CACH,EAAA;;oBAND,SAMC,CAAA;oBACD,qBAAM,UAAU,CACd,oDAAoD,EACpD,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAkB,CAAC,EAAE,CAAC,EAApE,CAAoE,EAC1E,EAAE,QAAQ,EAAE,UAAC,GAAmB,IAAK,OAAA,GAAG,CAAC,KAAK,CAAC,UAAA,EAAE,IAAI,OAAA,CACnD,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS,CACtF,EAFoD,CAEpD,CAAC,EAFmC,CAEnC,EAAC,CACJ;wBACD,oFAAoF;sBADnF;;oBAND,SAMC,CAAA;oBACD,oFAAoF;oBACpF,qBAAM,UAAU,CACd,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,mBAAiB,EAAE,CAAC,EAArF,CAAqF,EAC3F,EAAE,QAAQ,EAAE,UAAC,EAAwC;oCAAtC,QAAQ,cAAA;gCAAmC,OAAA,CACxD,QAAQ,CAAC,kBAAkB,KAAK,SAAS,IAAI,QAAQ,CAAC,6BAA6B,KAAK,SAAS,CAClG;4BAFyD,CAEzD,EAAC,CACH,EAAA;;oBAPD,oFAAoF;oBACpF,SAMC,CAAA;oBACD,qBAAM,UAAU,CACd,0DAA0D,EAC1D,cAAM,OAAA,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,mBAAiB,EAAE,CAAC,EAA9E,CAA8E,EACpF,EAAE,QAAQ,EAAE,UAAC,EAAwC;oCAAtC,QAAQ,cAAA;gCAAmC,OAAA,QAAQ,CAAC,kBAAkB,KAAK,gBAAgB;4BAAhD,CAAgD,EAAE,CAC7G,EAAA;;oBAJD,SAIC,CAAA;;;yBAEG,eAAe,EAAf,yBAAe;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,eAAe,CAAC,EAAA;;oBAAvD,SAAuD,CAAA;;;;;;yBAChF,iBAAiB,EAAjB,yBAAiB;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;yBACpF,iBAAiB,EAAjB,yBAAiB;;;;oBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAA;;oBAAzD,SAAyD,CAAA;;;;;;;oBAClF,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,EAAA;;oBAA5C,SAA4C,CAAA;;;;;;;oBAC5C,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,EAAA;;oBAAtC,SAAsC,CAAA;;;;;;;;;;CAE/C,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,IAAM,KAAG,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IACjC,IAAM,aAAW,GAAG,IAAI,OAAO,CAAC,EAAE,IAAI,MAAA,EAAE,CAAC,CAAA;IAEzC,IAAM,QAAQ,GAAG;;;wBACf,qBAAM,WAAW,CAAC,KAAG,EAAE,aAAW,CAAC,EAAA;;oBAAnC,SAAmC,CAAA;oBACnC,qBAAM,mCAAmC,CAAC,EAAE,GAAG,OAAA,EAAE,WAAW,eAAA,EAAE,CAAC,EAAA;;oBAA/D,SAA+D,CAAA;;;;SAChE,CAAA;IAED,QAAQ,EAAE;SACP,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}
+{"version":3,"file":"enduser-ai-summary-trust-gate.test.js","sourceRoot":"","sources":["../../../../../src/tests/api_tests/security/enduser-ai-summary-trust-gate.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,OAAO,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE,CAAC;AAExC,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C,OAAO,EACL,aAAa,EAGb,qBAAqB,GACtB,MAAM,sBAAsB,CAAA;AAE7B,IAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,uBAAuB,CAAA;AAE3D,IAAM,IAAI,GAAG,cAAM,OAAA,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAvC,CAAuC,CAAA;AAE1D,IAAM,aAAa,GAAG,sDAAsD,CAAA;AAC5E,IAAM,gBAAgB,GAAG,sDAAsD,CAAA;AAC/E,IAAM,gBAAgB,GAAG,yEAAyE,CAAA;AAElG;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,IAAM,oCAAoC,GAAG;;;;;gBAC5C,MAAM,GAAY,EAAE,CAAA;gBACpB,MAAM,GAAG,UAAC,KAAa,EAAE,IAAa,EAAE,MAAc,IAAK,OAAA,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,OAAA,EAAE,IAAI,MAAA,EAAE,MAAM,QAAA,EAAE,CAAC,EAApC,CAAoC,CAAA;gBAI/F,QAAQ,GAAG,UAAC,KAAU;oBAC1B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;wBAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAA;oBAC/D,IAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;oBACzC,OAAO,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAA;gBAChE,CAAC,CAAA;gBACK,YAAY,GAAG,UAAC,CAAM,IAAa,OAAA,CACvC,OAAO,CAAA,CAAC,aAAD,CAAC,uBAAD,CAAC,CAAE,OAAO,CAAA,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAC7E,EAFwC,CAExC,CAAA;gBASK,aAAa,GAAG,UACpB,KAAa,EACb,EAAoB,EACpB,OAAoD;;;;;;gCAGzB,KAAA,OAAO,CAAA;gCAAC,qBAAM,EAAE,EAAE,EAAA;;gCAArC,KAAmB,kBAAQ,SAAU,EAAC,EAApC,IAAI,UAAA,EAAE,MAAM,YAAA;gCACpB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAA;;;;gCAE3B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,yCAAkC,YAAY,CAAC,GAAC,CAAC,CAAE,CAAC,CAAA;;;;;qBAE5E,CAAA;;;;gBAUU,qBAAM,qBAAqB,CAAC;wBACnC,IAAI,EAAE,wCAAiC,IAAI,EAAE,CAAE;wBAC/C,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;wBAC1B,OAAO,EAAE,CAAC;qBACX,CAAC,EAAA;;gBAJF,MAAM,GAAG,SAIP,CAAA;gBACM,QAAQ,MAAM,IAAX,CAAW;gBAET,qBAAM,KAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,uCAAuC,EAAE,CAAC,EAAA;;gBAAxF,IAAI,GAAG,SAAiF;gBAC9F,MAAM,GAAG,IAAI,CAAC,EAAE,CAAA;gBACF,qBAAM,KAAG,CAAC,GAAG,CAAC,WAAW,CAAC,SAAS,CAAC;wBAChD,MAAM,EAAE,IAAI,CAAC,EAAE;wBACf,IAAI,EAAE,QAAQ;wBACd,KAAK,EAAE,sBAAsB;wBAC7B,cAAc,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;qBAC7C,CAAC,EAAA;;gBALI,KAAK,GAAG,SAKZ;gBAEc,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;wBAC/C,KAAK,EAAE,0BAAmB,IAAI,CAAC,GAAG,EAAE,iBAAc,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM;qBACtF,CAAC,EAAA;;gBAFI,OAAO,GAAG,SAEd;gBACF,SAAS,GAAG,OAAO,CAAC,EAAE,CAAA;gBAEhB,cAAY,CAAC;wBACjB,OAAO,EAAE,KAAK,CAAC,EAAE,EAAE,UAAU,EAAE,sBAAsB;wBACrD,MAAM,EAAE,EAAE,IAAI,EAAE,QAAiB,EAAE,KAAK,EAAE,YAAY,EAAE;qBACzD,CAAC,CAAA;gBAGsC,qBAAM,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;wBACzF,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;qBACvC,CAAC,EAAA;;gBAFM,oBAAgC,CAAA,SAEtC,CAAA,WAFiC;gBAGnC,qBAAM,aAAa,CACjB,yDAAyD,EACzD,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBAChD,UAAU,EAAE,iBAAe;wBAC3B,SAAS,aAAA;wBACT,gBAAgB,EAAE,aAAa;qBAChC,CAAC,EAJI,CAIJ,EACF,UAAC,EAAgD;4BAA9C,YAAY,kBAAA;wBACb,eAAe,GAAG,YAAY,CAAC,EAAE,CAAA;wBACjC,OAAO;4BACL,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,gBAAgB,KAAK,aAAa;4BACnF,MAAM,EAAE,sBAAe,CAAC,CAAC,YAAY,CAAC,WAAW,uBAAoB;kCACjE,UAAG,QAAQ,CAAC,YAAY,CAAC,gBAAgB,CAAC,8BAA2B;yBAC1E,CAAA;oBACH,CAAC,CACF,EAAA;;gBAfD,SAeC,CAAA;gBACD,qBAAM,aAAa,CACjB,sDAAsD,EACtD,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,eAAgB,CAAC,EAA/C,CAA+C,EACrD,UAAC,EAAgB,IAAK,OAAA,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,gBAAgB,KAAK,aAAa;wBAC3C,MAAM,EAAE,2BAAoB,QAAQ,CAAC,EAAE,CAAC,gBAAgB,CAAC,8BAA2B;qBACrF,CAAC,EAHoB,CAGpB,CACH;oBAED,8DAA8D;kBAF7D;;gBAPD,SAOC,CAAA;gBAG2C,qBAAM,KAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,EAAA;;gBAApG,KAAsC,SAA8D,EAAlG,SAAS,eAAA,EAAW,WAAW,aAAA;gBACjC,eAAa,IAAI,cAAc,CAAC;oBACpC,IAAI,MAAA;oBAAE,SAAS,WAAA;oBAAE,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU;iBACrE,CAAC,CAAA;gBAEwC,qBAAM,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;wBAC3F,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;qBACvC,CAAC,EAAA;;gBAFM,sBAAkC,CAAA,SAExC,CAAA,WAFmC;gBAGrC,qBAAM,aAAa,CACjB,4EAA4E,EAC5E,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBACvD,UAAU,EAAE,mBAAiB;wBAC7B,SAAS,aAAA;wBACT,gBAAgB,EAAE,gBAAgB;qBACnC,CAAC,EAJI,CAIJ,EACF,UAAC,EAAgD;4BAA9C,YAAY,kBAAA;wBACb,iBAAiB,GAAG,YAAY,CAAC,EAAE,CAAA;wBACnC,OAAO;4BACL,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,WAAW,IAAI,YAAY,CAAC,gBAAgB,KAAK,SAAS;4BAC/E,MAAM,EAAE,sBAAe,CAAC,CAAC,YAAY,CAAC,WAAW,uBAAoB;kCACjE,UAAG,QAAQ,CAAC,YAAY,CAAC,gBAAgB,CAAC,kEAA0D;yBACzG,CAAA;oBACH,CAAC,CACF,EAAA;;gBAfD,SAeC,CAAA;gBACD,qBAAM,aAAa,CACjB,2CAA2C,EAC3C,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAjD,CAAiD,EACvD,UAAC,EAAgB,IAAK,OAAA,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,gBAAgB,KAAK,SAAS;wBACvC,MAAM,EAAE,2BAAoB,QAAQ,CAAC,EAAE,CAAC,gBAAgB,CAAC,sBAAmB;qBAC7E,CAAC,EAHoB,CAGpB,CACH;oBAED,4EAA4E;oBAC5E,iFAAiF;kBAHhF;;gBAPD,SAOC,CAAA;gBAIyC,qBAAM,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,qBAAqB,CAAC;wBAC3F,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;qBACvC,CAAC,EAAA;;gBAFM,sBAAkC,CAAA,SAExC,CAAA,WAFmC;gBAGb,qBAAM,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC;wBAC/E,UAAU,EAAE,mBAAiB;wBAC7B,SAAS,aAAA;qBACV,CAAC,EAAA;;gBAHI,eAAe,GAAG,SAGtB;gBACF,iBAAiB,GAAG,eAAe,CAAC,YAAY,CAAC,EAAE,CAAA;gBACnD,qBAAM,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,EAAE;wBACxD,kBAAkB,EAAE,gBAAgB;wBACpC,6BAA6B,EAAE,IAAI,IAAI,EAAE;qBAC1C,CAAC,EAAA;;gBAHF,SAGE,CAAA;gBAEF,qBAAM,aAAa,CACjB,wCAAwC,EACxC,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAjD,CAAiD,EACvD,UAAC,EAAgB,IAAK,OAAA,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,kBAAkB,KAAK,gBAAgB;wBAChD,MAAM,EAAE,6BAAsB,QAAQ,CAAC,EAAE,CAAC,kBAAkB,CAAC,+BAA4B;qBAC1F,CAAC,EAHoB,CAGpB,CACH,EAAA;;gBAPD,SAOC,CAAA;gBACD,qBAAM,aAAa,CACjB,mDAAmD,EACnD,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAkB,CAAC,EAAxD,CAAwD,EAC9D,UAAC,EAAgB,IAAK,OAAA,CAAC;wBACrB,IAAI,EAAE,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS;wBAC3F,MAAM,EAAE,6BAAsB,QAAQ,CAAC,EAAE,CAAC,kBAAkB,CAAC,kBAAe;8BACxE,UAAG,QAAQ,CAAC,EAAE,CAAC,6BAA6B,CAAC,2BAAwB;qBAC1E,CAAC,EAJoB,CAIpB,CACH,EAAA;;gBARD,SAQC,CAAA;gBACD,qBAAM,aAAa,CACjB,oDAAoD,EACpD,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,GAAG,EAAE,CAAC,iBAAkB,CAAC,EAAE,CAAC,EAApE,CAAoE,EAC1E,UAAC,GAAmB,IAAK,OAAA,CAAC;wBACxB,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,UAAA,EAAE,IAAI,OAAA,CACpB,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS,CACtF,EAFqB,CAErB,CAAC;wBACF,MAAM,EAAE,UAAG,GAAG,CAAC,MAAM,mCAAyB,QAAQ,CAAC,GAAG;6BACvD,MAAM,CAAC,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,kBAAkB,KAAK,SAAS,IAAI,EAAE,CAAC,6BAA6B,KAAK,SAAS,EAArF,CAAqF,CAAC;6BACnG,GAAG,CAAC,UAAA,EAAE,IAAI,OAAA,EAAE,CAAC,EAAE,EAAL,CAAK,CAAC,CAAC,iBAAc;qBACnC,CAAC,EAPuB,CAOvB,CACH;oBACD,oFAAoF;kBADnF;;gBAXD,SAWC,CAAA;gBACD,oFAAoF;gBACpF,qBAAM,aAAa,CACjB,2DAA2D,EAC3D,cAAM,OAAA,YAAU,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,mBAAiB,EAAE,CAAC,EAArF,CAAqF,EAC3F,UAAC,EAAwC;4BAAtC,QAAQ,cAAA;wBAAmC,OAAA,CAAC;4BAC7C,IAAI,EAAE,QAAQ,CAAC,kBAAkB,KAAK,SAAS,IAAI,QAAQ,CAAC,6BAA6B,KAAK,SAAS;4BACvG,MAAM,EAAE,6BAAsB,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,kBAAe;kCAC9E,UAAG,QAAQ,CAAC,QAAQ,CAAC,6BAA6B,CAAC,2BAAwB;yBAChF,CAAC;oBAJ4C,CAI5C,CACH,EAAA;;gBATD,oFAAoF;gBACpF,SAQC,CAAA;gBACD,qBAAM,aAAa,CACjB,0DAA0D,EAC1D,cAAM,OAAA,KAAG,CAAC,GAAG,CAAC,cAAc,CAAC,oBAAoB,CAAC,EAAE,UAAU,EAAE,mBAAiB,EAAE,CAAC,EAA9E,CAA8E,EACpF,UAAC,EAAwC;4BAAtC,QAAQ,cAAA;wBAAmC,OAAA,CAAC;4BAC7C,IAAI,EAAE,QAAQ,CAAC,kBAAkB,KAAK,gBAAgB;4BACtD,MAAM,EAAE,6BAAsB,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,+BAA4B;yBAChG,CAAC;oBAH4C,CAG5C,CACH,EAAA;;gBAPD,SAOC,CAAA;;;qBAEG,MAAM,EAAN,yBAAM;gBACA,GAAG,GAAK,MAAM,IAAX,CAAW;qBAClB,eAAe,EAAf,yBAAe;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,eAAe,CAAC,EAAA;;gBAAvD,SAAuD,CAAA;;;;;;qBAChF,iBAAiB,EAAjB,yBAAiB;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAA;;gBAAzD,SAAyD,CAAA;;;;;;qBACpF,iBAAiB,EAAjB,yBAAiB;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,SAAS,CAAC,iBAAiB,CAAC,EAAA;;gBAAzD,SAAyD,CAAA;;;;;;qBACpF,SAAS,EAAT,yBAAS;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,EAAA;;gBAA3C,SAA2C,CAAA;;;;;;qBAC9D,MAAM,EAAN,yBAAM;;;;gBAAU,qBAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,EAAA;;gBAArC,SAAqC,CAAA;;;;;;;gBAEnD,qBAAM,MAAM,CAAC,QAAQ,EAAE,EAAA;;gBAAvB,SAAuB,CAAA;;;;gBAAe,OAAO,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAC,CAAC,CAAA;;;qBAInF,sBAAO,MAAM,EAAA;;;KACd,CAAA;AAED,8CAA8C;AAC9C,MAAM,CAAC,IAAM,mCAAmC,GAAG;;;;;gBACjD,KAAA,aAAa,CAAA;sBAAC,+BAA+B;gBAAE,qBAAM,oCAAoC,EAAE,EAAA;;gBAA3F,4BAA+C,SAA4C,GAAC,CAAA;;;;KAC7F,CAAA;AAED,oGAAoG;AACpG,MAAM,CAAC,IAAM,cAAc,GAAkB;IAC3C,IAAI,EAAE,+BAA+B;IACrC,GAAG,EAAE,oCAAoC;CAC1C,CAAA;AAED,6CAA6C;AAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE;IAC3B,OAAO,CAAC,GAAG,CAAC,sCAAqB,IAAI,CAAE,CAAC,CAAA;IACxC,mCAAmC,EAAE;SAClC,IAAI,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC;SACD,KAAK,CAAC,UAAC,KAAK;QACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,EAAE,KAAK,CAAC,CAAA;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC,CAAC,CAAA;CACL"}

package/lib/esm/tests/api_tests/security/enduser-cross-create.test.d.ts

@@ -1,4 +1,4 @@
-import { Session } from "../../../sdk";
+import { Check, IsolatedSuite } from "../../setup_isolated";
 /**
  * Regression test for the enduser cross-enduser CREATE gating gaps:
  *   enduser_observations
@@ -13,9 +13,15 @@ import { Session } from "../../../sdk";
  *
  * Methodology: each section asserts BOTH the exploit-is-blocked case AND that the
  * legitimate path (self-create + staff-create) still works.
+ *
+ * Runs on its own provisioned tenant, so the patient session's businessId comes from the tenant
+ * rather than a TEST_BUSINESS_ID env var with a hardcoded shared-org fallback. Checks are collected
+ * and returned rather than asserted inline: `assert` calls process.exit, which would skip this
+ * suite's `finally` cleanup and, in the parallel pool, every other in-flight suite's teardown.
  */
-export declare const enduser_cross_create_tests: ({ sdk }: {
-    sdk: Session;
-    sdkNonAdmin: Session;
-}) => Promise<void>;
+export declare const enduser_cross_create_checks: () => Promise<Check[]>;
+/** Asserting wrapper, for standalone runs. */
+export declare const enduser_cross_create_tests: () => Promise<void>;
+/** Enrolls this suite in the auto-discovered parallel pool — see run_discovered_isolated_suites. */
+export declare const ISOLATED_SUITE: IsolatedSuite;
 //# sourceMappingURL=enduser-cross-create.test.d.ts.map