@vellumai/assistant 0.7.3 → 0.8.1

package/src/__tests__/oauth-connect-routes.test.ts

@@ -41,6 +41,49 @@ mock.module("../util/logger.js", () => ({
     }),
 }));
 
+// ── Mock oauth-store so handleOAuthConnectStart can run without a seeded DB ──
+type MockProviderRow = {
+  authorizeUrl?: string;
+  requiresClientSecret?: boolean;
+  [key: string]: unknown;
+};
+
+const DEFAULT_PROVIDER: MockProviderRow = {
+  authorizeUrl: "https://accounts.google.com/o/oauth2/auth",
+  requiresClientSecret: false,
+};
+
+let mockGetProvider: (service: string) => MockProviderRow | undefined = () =>
+  DEFAULT_PROVIDER;
+let mockGetAppByProviderAndClientId: (
+  service: string,
+  clientId: string,
+) => Record<string, unknown> | undefined = (_service, clientId) => ({
+  id: "test-app-id",
+  provider: "google",
+  clientId,
+});
+let mockGetMostRecentAppByProvider: (
+  service: string,
+) => Record<string, unknown> | undefined = () => ({
+  id: "test-app-id",
+  provider: "google",
+  clientId: "default-client-id",
+});
+let mockGetAppClientSecret: (
+  row: Record<string, unknown>,
+) => Promise<string | undefined> = async () => undefined;
+
+mock.module("../oauth/oauth-store.js", () => ({
+  getProvider: (service: string) => mockGetProvider(service),
+  getAppByProviderAndClientId: (service: string, clientId: string) =>
+    mockGetAppByProviderAndClientId(service, clientId),
+  getMostRecentAppByProvider: (service: string) =>
+    mockGetMostRecentAppByProvider(service),
+  getAppClientSecret: (row: Record<string, unknown>) =>
+    mockGetAppClientSecret(row),
+}));
+
 // NOTE: Do NOT mock oauth-connect-state — use the real module so we can
 // verify state transitions via getOAuthConnectState.
 
@@ -65,6 +108,23 @@ function findRoute(operationId: string) {
 // ── Tests ──────────────────────────────────────────────────────────────────────
 
 describe("oauth-connect-routes", () => {
+  beforeEach(() => {
+    // Reset oauth-store mocks to permissive defaults so every test starts
+    // from a clean baseline regardless of what the previous test set.
+    mockGetProvider = () => DEFAULT_PROVIDER;
+    mockGetAppByProviderAndClientId = (_service, clientId) => ({
+      id: "test-app-id",
+      provider: "google",
+      clientId,
+    });
+    mockGetMostRecentAppByProvider = () => ({
+      id: "test-app-id",
+      provider: "google",
+      clientId: "default-client-id",
+    });
+    mockGetAppClientSecret = async () => undefined;
+  });
+
   describe("POST internal/oauth/connect/start", () => {
     beforeEach(() => {
       capturedOnDeferredComplete = undefined;
@@ -109,17 +169,6 @@ describe("oauth-connect-routes", () => {
       ).rejects.toBeInstanceOf(BadRequestError);
     });
 
-    test("missing clientId throws BadRequestError", async () => {
-      await expect(
-        findRoute("internal_oauth_connect_start").handler({
-          body: {
-            service: "google",
-            callbackTransport: "gateway",
-          },
-        }),
-      ).rejects.toBeInstanceOf(BadRequestError);
-    });
-
     test("missing service throws BadRequestError", async () => {
       await expect(
         findRoute("internal_oauth_connect_start").handler({
@@ -183,6 +232,120 @@ describe("oauth-connect-routes", () => {
         }),
       ).rejects.toBeInstanceOf(InternalError);
     });
+
+    test("unknown provider throws NotFoundError", async () => {
+      mockGetProvider = () => undefined;
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "made-up-service",
+            clientId: "my-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(NotFoundError);
+    });
+
+    test("manual-token provider rejected even when clientId is explicitly supplied", async () => {
+      // Codex/Devin finding on PR #30251: the manual-token check used to live
+      // inside `if (!clientId)`, so callers passing `--client-id` for a
+      // manual-token provider (e.g. slack_channel, telegram) bypassed it.
+      mockGetProvider = () => ({
+        authorizeUrl: "urn:manual-token",
+        requiresClientSecret: false,
+      });
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "slack_channel",
+            clientId: "any-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("manual-token provider rejected when no clientId is supplied", async () => {
+      mockGetProvider = () => ({
+        authorizeUrl: "urn:manual-token",
+        requiresClientSecret: false,
+      });
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "slack_channel",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("explicit clientId with no registered app throws NotFoundError", async () => {
+      // Devin finding on PR #30251: the explicit-clientId branch used to
+      // silently continue when getAppByProviderAndClientId returned null,
+      // letting orchestrateOAuthConnect fail later with a less helpful error.
+      mockGetAppByProviderAndClientId = () => undefined;
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            clientId: "unregistered-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(NotFoundError);
+    });
+
+    test("no clientId and no registered app throws BadRequestError", async () => {
+      mockGetMostRecentAppByProvider = () => undefined;
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "google",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("missing client_secret when provider requiresClientSecret throws BadRequestError", async () => {
+      // Devin finding on PR #30251: requiresClientSecret was only checked
+      // inside the `!clientId` branch. Hoisting it ensures explicit-clientId
+      // callers also fail fast with an actionable error.
+      mockGetProvider = () => ({
+        authorizeUrl: "https://accounts.example.com/o/oauth2/auth",
+        requiresClientSecret: true,
+      });
+      mockGetAppClientSecret = async () => undefined;
+      await expect(
+        findRoute("internal_oauth_connect_start").handler({
+          body: {
+            service: "github",
+            clientId: "explicit-client-id",
+            callbackTransport: "gateway",
+          },
+        }),
+      ).rejects.toBeInstanceOf(BadRequestError);
+    });
+
+    test("explicit clientId + stored secret succeeds without caller-supplied secret", async () => {
+      mockGetProvider = () => ({
+        authorizeUrl: "https://accounts.example.com/o/oauth2/auth",
+        requiresClientSecret: true,
+      });
+      mockGetAppClientSecret = async () => "stored-secret-from-keyring";
+      const result = await findRoute("internal_oauth_connect_start").handler({
+        body: {
+          service: "github",
+          clientId: "explicit-client-id",
+          callbackTransport: "gateway",
+        },
+      });
+      expect(result).toMatchObject({
+        auth_url: "https://accounts.google.com/o/oauth2/auth?client_id=test",
+        state: "test-state-uuid-abc123",
+      });
+    });
   });
 
   describe("GET internal/oauth/connect/status/:state", () => {

package/src/__tests__/oauth-providers-routes.test.ts

@@ -245,22 +245,26 @@ describe("GET /v1/oauth/providers/:providerKey", () => {
     );
 
     expect(status).toBe(200);
+    // The GET-by-key endpoint uses `serializeProviderFull`, which intentionally
+    // emits camelCase keys (see provider-serializer.ts). The list endpoint
+    // uses `serializeProviderSummary` and emits snake_case — these are
+    // separate wire formats by design.
     const { provider } = body as {
       provider: {
-        provider_key: string;
-        display_name: string | null;
+        providerKey: string;
+        displayName: string | null;
         description: string | null;
-        dashboard_url: string | null;
-        client_id_placeholder: string | null;
-        requires_client_secret: boolean;
-        supports_managed_mode: boolean;
+        dashboardUrl: string | null;
+        clientIdPlaceholder: string | null;
+        requiresClientSecret: boolean;
+        supportsManagedMode: boolean;
       };
     };
 
-    expect(provider.provider_key).toBe("google");
-    expect(provider.display_name).toBe("Google");
-    expect(provider.supports_managed_mode).toBe(true);
-    expect(provider.requires_client_secret).toBe(true);
+    expect(provider.providerKey).toBe("google");
+    expect(provider.displayName).toBe("Google");
+    expect(provider.supportsManagedMode).toBe(true);
+    expect(provider.requiresClientSecret).toBe(true);
   });
 
   test("returns 404 for unknown provider", async () => {

package/src/__tests__/openai-responses-cutover-guard.test.ts

@@ -13,8 +13,9 @@ import { describe, expect, test } from "bun:test";
  *
  * These guards fail CI if:
  * 1. The Responses provider file contains `chat.completions.create(` calls.
- * 2. The provider registry wires `openai` to anything other than
- *    `OpenAIResponsesProvider`.
+ * 2. The adapter factory wires `openai` to anything other than
+ *    `OpenAIResponsesProvider`. (Catalog-driven adapter construction lives
+ *    in `inference/adapter-factory.ts`; `registry.ts` only orchestrates it.)
  * 3. A new file appears in `providers/openai/` that introduces
  *    `chat.completions.create(` calls.
  *
@@ -40,6 +41,11 @@ import { describe, expect, test } from "bun:test";
 
 const PROVIDERS_DIR = join(import.meta.dir, "..", "providers");
 const OPENAI_PROVIDERS_DIR = join(PROVIDERS_DIR, "openai");
+const ADAPTER_FACTORY_PATH = join(
+  PROVIDERS_DIR,
+  "inference",
+  "adapter-factory.ts",
+);
 
 describe("OpenAI Responses API cutover guard", () => {
   test("responses-provider.ts does not contain chat.completions.create() calls", () => {
@@ -60,32 +66,34 @@ describe("OpenAI Responses API cutover guard", () => {
     ).toBe(false);
   });
 
-  test("registry.ts wires the 'openai' provider to OpenAIResponsesProvider", () => {
-    const source = readFileSync(join(PROVIDERS_DIR, "registry.ts"), "utf-8");
+  test("adapter-factory.ts wires the 'openai' provider to OpenAIResponsesProvider", () => {
+    // Catalog-driven adapter construction lives in `adapter-factory.ts`.
+    // `registry.ts` only orchestrates and wraps the adapter; the only place
+    // that names a provider class for the "openai" id is the factory table.
+    const source = readFileSync(ADAPTER_FACTORY_PATH, "utf-8");
 
-    // The registry should import OpenAIResponsesProvider
+    // The factory must import OpenAIResponsesProvider.
     expect(
       source.includes("OpenAIResponsesProvider"),
-      "registry.ts must import OpenAIResponsesProvider for the openai provider.",
+      "adapter-factory.ts must import OpenAIResponsesProvider for the openai provider.",
     ).toBe(true);
 
-    // The registry should instantiate OpenAIResponsesProvider for the "openai" key.
-    // Look for `new OpenAIResponsesProvider(` near the openai registration block.
+    // The factory must instantiate OpenAIResponsesProvider.
     const hasResponsesInstantiation = source.includes(
       "new OpenAIResponsesProvider(",
     );
     expect(
       hasResponsesInstantiation,
       [
-        "registry.ts must instantiate OpenAIResponsesProvider for the 'openai' provider.",
+        "adapter-factory.ts must instantiate OpenAIResponsesProvider for the 'openai' provider.",
         "OpenAI inference uses the Responses API, not chat completions.",
       ].join("\n"),
     ).toBe(true);
 
-    // The registry should NOT instantiate OpenAIChatCompletionsProvider or
+    // The factory must NOT instantiate OpenAIChatCompletionsProvider or
     // OpenAIProvider (the backward-compatible alias) for the "openai" key.
     // Chat-completions classes may appear in imports but should not be
-    // instantiated in the openai registration block.
+    // instantiated in the openai factory entry.
     const chatCompletionsInstantiations = [
       ...source.matchAll(/new\s+OpenAIChatCompletionsProvider\s*\(/g),
       ...source.matchAll(/new\s+OpenAIProvider\s*\(/g),
@@ -93,10 +101,23 @@ describe("OpenAI Responses API cutover guard", () => {
     expect(
       chatCompletionsInstantiations.length,
       [
-        "registry.ts must NOT instantiate OpenAIChatCompletionsProvider or",
+        "adapter-factory.ts must NOT instantiate OpenAIChatCompletionsProvider or",
         "OpenAIProvider (legacy alias). Use OpenAIResponsesProvider for openai.",
       ].join("\n"),
     ).toBe(0);
+
+    // The factory's "openai" entry must specifically map to OpenAIResponsesProvider.
+    // Match `openai:` followed (within ~400 chars) by `new OpenAIResponsesProvider(`
+    // to confirm wiring at the entry level, not just an unrelated reference.
+    const openaiEntryWiring =
+      /openai\s*:\s*\([^)]*\)\s*=>\s*[\s\S]{0,400}?new\s+OpenAIResponsesProvider\s*\(/;
+    expect(
+      openaiEntryWiring.test(source),
+      [
+        "adapter-factory.ts ADAPTER_FACTORIES['openai'] entry must construct",
+        "OpenAIResponsesProvider. If the factory shape changed, update this guard.",
+      ].join("\n"),
+    ).toBe(true);
   });
 
   test("no files in providers/openai/ introduce chat.completions.create() calls", () => {

package/src/__tests__/openai-responses-provider.test.ts

@@ -677,6 +677,23 @@ describe("OpenAIResponsesProvider", () => {
     expect(lastStreamParams!.text).toEqual({ verbosity: "high" });
   });
 
+  test("verbosity is forwarded for GPT-5 fine-tune IDs", async () => {
+    const ftProvider = new OpenAIResponsesProvider(
+      "sk-test",
+      "ft:gpt-5.2:acme::abc123",
+    );
+    fakeStreamEvents = [textDeltaEvent("OK"), completedEvent(10, 2)];
+
+    await ftProvider.sendMessage(
+      [{ role: "user", content: [{ type: "text", text: "Hi" }] }],
+      undefined,
+      undefined,
+      { config: { verbosity: "low" } },
+    );
+
+    expect(lastStreamParams!.text).toEqual({ verbosity: "low" });
+  });
+
   // -----------------------------------------------------------------------
   // Model override
   // -----------------------------------------------------------------------

package/src/__tests__/plugin-bootstrap.test.ts

@@ -70,15 +70,43 @@ const fakeCtx: DaemonContext = {
   assistantVersion: "9.9.9-test",
 };
 
+/**
+ * Test helper. Accepts the new `hooks` bag and ALSO legacy top-level
+ * `init` / `onShutdown` for ergonomics — the helper merges them into a
+ * single `hooks` field that matches the runtime Plugin shape. This keeps
+ * the test call sites compact without leaking the old contract.
+ */
 function buildPlugin(
   name: string,
-  extras: Partial<Omit<Plugin, "manifest">> = {},
+  extras: Partial<Omit<Plugin, "manifest" | "hooks">> & {
+    hooks?: Plugin["hooks"];
+    init?: (ctx: PluginInitContext) => Promise<void>;
+    onShutdown?: () => Promise<void>;
+  } = {},
   options: {
     requires?: Record<string, string>;
     requiresCredential?: string[];
     requiresFlag?: string[];
   } = {},
 ): Plugin {
+  const {
+    init: legacyInit,
+    onShutdown: legacyOnShutdown,
+    hooks: explicitHooks,
+    ...rest
+  } = extras;
+  const mergedHooks: Plugin["hooks"] | undefined =
+    legacyInit !== undefined ||
+    legacyOnShutdown !== undefined ||
+    explicitHooks !== undefined
+      ? {
+          ...(explicitHooks ?? {}),
+          ...(legacyInit !== undefined ? { init: legacyInit } : {}),
+          ...(legacyOnShutdown !== undefined
+            ? { shutdown: legacyOnShutdown }
+            : {}),
+        }
+      : undefined;
   return {
     manifest: {
       name,
@@ -89,7 +117,8 @@ function buildPlugin(
         : {}),
       ...(options.requiresFlag ? { requiresFlag: options.requiresFlag } : {}),
     },
-    ...extras,
+    ...rest,
+    ...(mergedHooks ? { hooks: mergedHooks } : {}),
   };
 }
 

package/src/__tests__/plugin-route-contribution.test.ts

@@ -53,7 +53,7 @@ import {
   registerPlugin,
   resetPluginRegistryForTests,
 } from "../plugins/registry.js";
-import type { Plugin } from "../plugins/types.js";
+import type { Plugin, PluginInitContext } from "../plugins/types.js";
 import {
   matchSkillRoute,
   resetSkillRoutesForTests,
@@ -76,17 +76,45 @@ const fakeCtx: DaemonContext = {
 };
 
 /** Build a minimal valid plugin with optional route contributions. */
+/**
+ * Test helper. Accepts the new `hooks` bag and ALSO legacy top-level
+ * `init` / `onShutdown` for ergonomics — the helper merges them into a
+ * single `hooks` field that matches the runtime Plugin shape.
+ */
 function buildPlugin(
   name: string,
-  extras: Partial<Omit<Plugin, "manifest">> = {},
+  extras: Partial<Omit<Plugin, "manifest" | "hooks">> & {
+    hooks?: Plugin["hooks"];
+    init?: (ctx: PluginInitContext) => Promise<void>;
+    onShutdown?: () => Promise<void>;
+  } = {},
 ): Plugin {
+  const {
+    init: legacyInit,
+    onShutdown: legacyOnShutdown,
+    hooks: explicitHooks,
+    ...rest
+  } = extras;
+  const mergedHooks: Plugin["hooks"] | undefined =
+    legacyInit !== undefined ||
+    legacyOnShutdown !== undefined ||
+    explicitHooks !== undefined
+      ? {
+          ...(explicitHooks ?? {}),
+          ...(legacyInit !== undefined ? { init: legacyInit } : {}),
+          ...(legacyOnShutdown !== undefined
+            ? { shutdown: legacyOnShutdown }
+            : {}),
+        }
+      : undefined;
   return {
     manifest: {
       name,
       version: "0.0.1",
       requires: { pluginRuntime: "v1" },
     },
-    ...extras,
+    ...rest,
+    ...(mergedHooks ? { hooks: mergedHooks } : {}),
   };
 }
 

package/src/__tests__/plugin-tool-contribution.test.ts

@@ -48,7 +48,7 @@ import {
   registerPlugin,
   resetPluginRegistryForTests,
 } from "../plugins/registry.js";
-import type { Plugin } from "../plugins/types.js";
+import type { Plugin, PluginInitContext } from "../plugins/types.js";
 import type { ToolDefinition } from "../providers/types.js";
 import {
   __clearRegistryForTesting,
@@ -99,17 +99,45 @@ function makeFakeTool(name: string, extras: Partial<Tool> = {}): Tool {
   };
 }
 
+/**
+ * Test helper. Accepts the new `hooks` bag and ALSO legacy top-level
+ * `init` / `onShutdown` for ergonomics — the helper merges them into a
+ * single `hooks` field that matches the runtime Plugin shape.
+ */
 function buildPlugin(
   name: string,
-  extras: Partial<Omit<Plugin, "manifest">> = {},
+  extras: Partial<Omit<Plugin, "manifest" | "hooks">> & {
+    hooks?: Plugin["hooks"];
+    init?: (ctx: PluginInitContext) => Promise<void>;
+    onShutdown?: () => Promise<void>;
+  } = {},
 ): Plugin {
+  const {
+    init: legacyInit,
+    onShutdown: legacyOnShutdown,
+    hooks: explicitHooks,
+    ...rest
+  } = extras;
+  const mergedHooks: Plugin["hooks"] | undefined =
+    legacyInit !== undefined ||
+    legacyOnShutdown !== undefined ||
+    explicitHooks !== undefined
+      ? {
+          ...(explicitHooks ?? {}),
+          ...(legacyInit !== undefined ? { init: legacyInit } : {}),
+          ...(legacyOnShutdown !== undefined
+            ? { shutdown: legacyOnShutdown }
+            : {}),
+        }
+      : undefined;
   return {
     manifest: {
       name,
       version: "0.0.1",
       requires: { pluginRuntime: "v1" },
     },
-    ...extras,
+    ...rest,
+    ...(mergedHooks ? { hooks: mergedHooks } : {}),
   };
 }
 

package/src/__tests__/plugin-types.test.ts

@@ -228,17 +228,19 @@ describe("plugin core types", () => {
 
     const plugin = {
       manifest,
-      async init(ctx: PluginInitContext) {
-        // Touch every field so refactors that rename any of them break here.
-        void ctx.config;
-        void ctx.credentials;
-        void ctx.logger;
-        void ctx.pluginStorageDir;
-        void ctx.assistantVersion;
-        void ctx.apiVersions;
-      },
-      async onShutdown() {
-        // no-op
+      hooks: {
+        async init(ctx: PluginInitContext) {
+          // Touch every field so refactors that rename any of them break here.
+          void ctx.config;
+          void ctx.credentials;
+          void ctx.logger;
+          void ctx.pluginStorageDir;
+          void ctx.assistantVersion;
+          void ctx.apiVersions;
+        },
+        async shutdown() {
+          // no-op
+        },
       },
       tools: [sampleTool],
       routes: [

package/src/__tests__/process-message-background-slack.test.ts

@@ -30,6 +30,14 @@ mock.module("../memory/conversation-disk-view.js", () => ({
   updateMetaFile: () => {},
 }));
 
+const broadcastMessages: unknown[] = [];
+
+mock.module("../runtime/assistant-event-hub.js", () => ({
+  broadcastMessage: (msg: unknown) => {
+    broadcastMessages.push(msg);
+  },
+}));
+
 mock.module("../runtime/confirmation-request-guardian-bridge.js", () => ({
   bridgeConfirmationRequestToGuardian: () => {},
 }));
@@ -240,6 +248,7 @@ describe("processMessageInBackground Slack option propagation", () => {
   beforeEach(() => {
     activeConversation = makeConversation();
     mergeConversationOptionsMock.mockClear();
+    broadcastMessages.length = 0;
   });
 
   test("passes Slack inbound metadata to persistence and exposes the runtime notice during the loop", async () => {
@@ -309,6 +318,43 @@ describe("processMessageInBackground Slack option propagation", () => {
     expect(activeConversation.__clientSenders).toHaveLength(2);
   });
 
+  test("observes live agent events without replacing the broadcast emitter", async () => {
+    const observedMessages: unknown[] = [];
+
+    const processing = processMessage(
+      "conv-background-slack",
+      "Reply from Slack",
+      undefined,
+      {
+        onEvent: (msg) => {
+          observedMessages.push(msg);
+        },
+      },
+      "slack",
+      "slack",
+    );
+
+    await waitForRunAgentLoopCall();
+
+    const loopOnEvent = activeConversation.runAgentLoop.mock.calls[0][2] as
+      | ((msg: unknown) => void)
+      | undefined;
+    const delta = {
+      type: "assistant_text_delta",
+      text: "Working on it.",
+      conversationId: "conv-background-slack",
+    };
+    loopOnEvent?.(delta);
+
+    expect(broadcastMessages).toEqual([delta]);
+    expect(observedMessages).toEqual([delta]);
+
+    activeConversation.__loopDeferred.resolve();
+    await expect(processing).resolves.toEqual({
+      messageId: "persisted-user-message-id",
+    });
+  });
+
   test("leaves non-Slack background persistence metadata absent", async () => {
     await processMessageInBackground(
       "conv-background-slack",

package/src/__tests__/profile-entry-status.test.ts

@@ -0,0 +1,43 @@
+import { describe, expect, test } from "bun:test";
+
+import { ProfileEntry } from "../config/schemas/llm.js";
+
+describe("ProfileEntry status field", () => {
+  test("parses a profile with status: disabled", () => {
+    const result = ProfileEntry.safeParse({
+      status: "disabled",
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.status).toBe("disabled");
+    }
+  });
+
+  test("parses a profile without status — status is undefined (treated as active)", () => {
+    const result = ProfileEntry.safeParse({
+      provider: "anthropic",
+      model: "claude-opus-4-7",
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.status).toBeUndefined();
+    }
+  });
+
+  test("parses a profile with status: active", () => {
+    const result = ProfileEntry.safeParse({
+      status: "active",
+    });
+    expect(result.success).toBe(true);
+    if (result.success) {
+      expect(result.data.status).toBe("active");
+    }
+  });
+
+  test("rejects an invalid status value", () => {
+    const result = ProfileEntry.safeParse({
+      status: "hidden",
+    });
+    expect(result.success).toBe(false);
+  });
+});