.github/9
ISSUE_TEMPLATE/3bug_report.md config.yml feature_request.md
workflows/3ci.yml clean-clone.yml release.yml
CODEOWNERS dependabot.yml pull_request_template.md
apps/630
api/250
src/243
common/30
__tests__/3authorize.test.ts bigint-serialization.interceptor.test.ts files-limits.test.ts
filters/1all-exceptions.filter.ts
guards/3auth.guard.ts internal-service.guard.ts rate-limit.guard.ts
interceptors/2actor-context.interceptor.ts bigint-serialization.interceptor.ts
middleware/2idempotency.test.ts idempotency.ts
pipes/1zod-validation.pipe.ts
actor-context.ts audit.service.ts cache.test.ts cache.ts cookies.ts core.module.ts deprecation.ts email.service.ts errors.ts event-bus.ts log-scrubber.test.ts log-scrubber.ts logger.ts permission-cache-bridge.ts prisma.service.ts redis.service.ts trace-metadata.ts types.ts
config/1env.ts
lib/11
__tests__/5crypto.test.ts filter-builder.test.ts jwt.test.ts pagination.test.ts positions.test.ts
authorize.ts crypto.ts filter-builder.ts jwt.ts pagination.ts positions.ts
modules/197
ai/28
__tests__/4ai-writing.test.ts database-ai.test.ts generate-executor.test.ts prompts.test.ts
generator/4executor.ts generate.controller.ts generate.dto.ts generate.service.ts
ai-chat.service.ts ai-rate-limit.ts ai-writing.controller.ts ai-writing.dto.ts ai-writing.service.ts ai.controller.ts ai.module.ts ai.service.ts budget-guard.service.ts database-ai.controller.ts database-ai.dto.ts database-ai.service.ts db-prompts.ts dto.ts gateway-provider.ts ledger.service.ts prompts.ts rag.controller.ts rag.dto.ts rag.service.ts
api-keys/3api-keys.controller.ts api-keys.module.ts api-keys.service.ts
audit/2audit-log.controller.ts audit.module.ts
auth/4auth.controller.ts auth.module.ts auth.service.ts dto.ts
automations/5automations.controller.ts automations.module.ts automations.service.ts dto.ts webhook-incoming.controller.ts
blocks/5
__tests__/1batch-version-cas.test.ts
block.service.ts blocks.controller.ts blocks.module.ts dto.ts
comments/4comments.controller.ts comments.module.ts comments.service.ts dto.ts
databases/9
__tests__/3normalize-select-options.test.ts option-id-canonicalization.test.ts record-open-query-shape.test.ts
database.service.ts databases.controller.ts databases.module.ts dto.ts property-cache-schema.ts query.service.ts
docs/2docs.controller.ts docs.module.ts
files/10
__tests__/1quota.test.ts
dto.ts files.controller.ts files.module.ts files.service.ts quota.ts record.ts s3.ts uploads.controller.ts uploads.service.ts
forms/18debug.controller.ts form.dto.ts forms.controller.ts forms.module.ts forms.service.ts markdown.test.ts markdown.ts optional-auth.guard.ts public-forms.controller.ts public-forms.service.ts question.dto.ts questions.service.ts rate-limit.ts recaptcha.ts slug.ts submissions.controller.ts submissions.service.ts submit-schema.ts
health/3health.controller.ts health.module.ts health.service.ts
integrations/3integrations.controller.ts integrations.module.ts integrations.service.ts
internal/12
__tests__/2flush-query-shape.test.ts internal.endpoints.test.ts
ai-test-seam.controller.ts ai-test-seam.dto.ts ai-test-seam.service.ts internal.controller.ts internal.dto.ts internal.module.ts internal.service.ts test-seam.controller.ts test-seam.dto.ts test-seam.service.ts
notifications/3notifications.controller.ts notifications.module.ts notifications.service.ts
oauth/6
__tests__/1oauth.scopes.test.ts
oauth.controller.ts oauth.module.ts oauth.service.ts scopes.ts token-keys.ts
org/15audit.service.ts embed-preview.controller.ts guards.ts members.service.ts org-admin.controller.ts org-policy.service.ts org.module.ts overview.service.ts policy-effective.controller.ts policy.schema.ts policy.test.ts retention.service.ts totp.test.ts totp.ts two-factor.service.ts
orgs/5dto.ts orgs.controller.ts orgs.module.ts orgs.service.ts util.ts
pages/4dto.ts page.service.ts pages.controller.ts pages.module.ts
scim/15
__tests__/3email-mapping.test.ts etag.test.ts filters.test.ts
etag.ts filters.ts groups.service.ts schemas.ts scim-admin.controller.ts scim-admin.service.ts scim-auth.guard.ts scim-auth.service.ts scim-errors.ts scim.controller.ts scim.module.ts users.service.ts
search/4
__tests__/1search.service.test.ts
search.controller.ts search.module.ts search.service.ts
sessions/3sessions.controller.ts sessions.module.ts sessions.service.ts
share/3share.controller.ts share.module.ts share.service.ts
sso/16
__tests__/4enforcement.test.ts oidc.verify.test.ts provisioning.test.ts saml.validate.test.ts
enforcement.ts oidc.controller.ts oidc.service.ts oidc.ts provisioning.service.ts saml.controller.ts saml.ts schemas.ts sso-admin.controller.ts sso-admin.service.ts sso-secrets.ts sso.module.ts
teams/4dto.ts teams.controller.ts teams.module.ts teams.service.ts
users/4dto.ts users.controller.ts users.module.ts users.service.ts
webhooks/3webhooks.controller.ts webhooks.module.ts webhooks.service.ts
workspaces/4dto.ts workspaces.controller.ts workspaces.module.ts workspaces.service.ts
types/1xmldom.d.ts
app.module.ts constants.ts main.ts
_probe_rawbody.cjs .env.example Dockerfile package.json README.md tsconfig.json vitest.config.ts
realtime/33
src/17auth.ts comments.ts config.ts event-source.ts http-store.ts index.ts metrics.ts notifications.ts page-updated-source.ts presence.ts prisma-store.ts protocol.ts rate-limit.ts room-key.ts rooms.ts server.ts update-log.ts
test/11auth.test.ts config.test.ts event-source.test.ts http-store.test.ts metrics-merge.test.ts page-updated-source.test.ts presence.test.ts protocol.test.ts rate-limit.test.ts rooms.test.ts task-0094-builders.test.ts
.env.example Dockerfile package.json README.md tsconfig.json
web/255
src/244
app/45
__tests__/1theme-tokens.test.ts
(app)/26
w/25
[workspace]/25
ask/1page.tsx
databases/1
[id]/1page.tsx
favorites/1page.tsx
files/1page.tsx
notifications/1page.tsx
page/4
[id]/4
[block]/1page.tsx
share/1page.tsx
layout.tsx page.tsx
search/1page.tsx
settings/10
appearance/1page.tsx
automations/3
[id]/1page.tsx
new/1page.tsx
page.tsx
billing/1page.tsx
developers/1page.tsx
members/1page.tsx
permissions/1page.tsx
teams/1page.tsx
page.tsx
shared/1page.tsx
templates/1page.tsx
trash/1page.tsx
layout.tsx page.tsx
layout.tsx
(auth)/4
login/1page.tsx
register/1page.tsx
reset-password/1page.tsx
layout.tsx
api/2
metrics/1route.ts
v1/1
health/1route.ts
f/1
[slug]/1page.tsx
health/1
ready/1route.ts
org/2
[orgId]/2
admin/2
integrations/1page.tsx
page.tsx
share/1
[id]/1page.tsx
error.tsx global-error.tsx globals.css layout.tsx not-found.tsx page.tsx providers.tsx
components/118
admin/10
org-admin/8ApiKeysTab.tsx AuditTab.tsx MembersTab.tsx OverviewTab.tsx PoliciesTab.tsx RetentionTab.tsx WebhooksTab.tsx WorkspacePicker.tsx
ScimCard.tsx SsoTabs.tsx
ai/6ai-panel.tsx ask-ai-submenu.tsx db-ai-dialog.tsx generate-page-dialog.tsx writing-actions-menu.tsx writing-diff.tsx
automations/5action-editor.tsx condition-editor.tsx lib.ts run-history.tsx trigger-editor.tsx
collaboration/6CursorLayer.tsx OfflineBanner.tsx PresenceBar.tsx README.md ReviewFailedDialog.tsx StatusChip.tsx
comments/3comment-panel.tsx comment-thread.tsx mention-input.tsx
database/27
__tests__/2cell-editor.test.tsx cell-renderer.test.tsx
AiExtractDialog.tsx AiFormulaDialog.tsx AiGenerateDialog.tsx board-view.tsx buttons-panel.tsx calendar-view.tsx cell-editor.tsx cell-renderer.tsx chart-view.tsx database-page-view.tsx database-toolbar.tsx database-view-renderer.tsx db-embedded.tsx filter-builder.tsx form-builder-view.tsx formula-editor.tsx gallery-view.tsx group-builder.tsx list-view.tsx property-editor.tsx record-header.tsx record-panel.tsx sort-builder.tsx table-view.tsx timeline-view.tsx
dialogs/7
__tests__/1move-to-dialog.test.tsx
create-dialog.tsx dialog.tsx file-permissions-dialog.tsx invite-dialog.tsx move-to-dialog.tsx share-dialog.tsx
editor/19
__tests__/3code-block-text.test.ts code-block.test.tsx expandable.test.tsx
block-card.tsx block-renderer.tsx block-save-queue.ts block-toolbar.tsx context-menu.tsx expandable.tsx history-popover.tsx inline-editor.tsx insert-dialog.tsx page-canvas.tsx page-spinner.tsx page-view.tsx selection-toolbar.tsx slash-menu.tsx template-dialog.tsx type-menu.tsx
files/4FileBlock.tsx FileBrowser.tsx FilePicker.tsx PreviewModal.tsx
form/4form-field.tsx form-renderer.tsx form-responses-view.tsx form-view.tsx
layout/8
__tests__/1page-tree-icon.test.tsx
command-palette.tsx factory-logo.tsx page-tree-node.tsx sidebar.tsx theme-provider.tsx topbar.tsx workspace-shell.tsx
mentions/3
__tests__/1mention-model.test.ts
mention-model.ts MentionPopup.tsx
search/3ask-ai-search.tsx results-list.tsx search-dialog.tsx
settings/10
api-keys/4ApiKeyCreateDialog.tsx ApiKeyRevealDialog.tsx ApiKeyTable.tsx ScopesBadge.tsx
webhooks/5CurlExamples.tsx DeliveryInspector.tsx EventExplorer.tsx OverviewTab.tsx WebhooksTab.tsx
settings-shell.tsx
ui/3confirm-dialog.tsx form.tsx toaster.tsx
hooks/21
__tests__/4realtime-frame-handler.test.ts use-blocks.test.ts use-database-options.test.ts use-workspace.test.tsx
realtime-frame-handler.ts use-ai-stream.ts use-auth.ts use-blocks.ts use-database.ts use-db-ai-stream.ts use-forms.ts use-members.ts use-mention-sources.ts use-notifications.ts use-offline-status.ts use-pages.ts use-presence-announcer.ts use-presence-toasts.ts use-presence.ts use-realtime.ts use-workspace.ts
lib/50
__tests__/21ai-database.test.ts ai-generate.test.ts ai-sse.test.ts ai-writing.test.ts api-keys.test.ts api-members.test.ts auth-refresh.test.ts auth-store.test.ts batch-queue-drop.test.ts block-content.test.ts clipboard-import.test.ts code-highlight.test.ts offline-status.test.ts presence-announcer.test.ts presence-color.test.ts presence-cursor.test.ts presence-emitter.test.ts realtime-url.test.ts search.test.ts utils.test.ts writing-diff.test.ts
files/7
__tests__/2picker.test.ts upload.test.ts
api.ts picker.ts upload-store.ts upload.ts use-file-uploads.ts
ai-database.ts ai.ts api-keys.ts api.ts auth-store.ts batch-queue.ts block-content.ts clipboard-import.ts code-highlight.ts constants.ts offline-status.ts org-admin.ts presence-announcer.ts presence-color.ts presence-cursor.ts presence-editor-views.ts presence-emitter.ts query-client.ts realtime.ts search.ts types.ts utils.ts
stores/8
__tests__/1block-patch-store.test.ts
block-patch-store.ts comment-pill-store.ts database-store.ts editor-store.ts offlineQueue.ts presence-store.ts ui-store.ts
instrumentation.ts middleware.ts
.env.example Dockerfile next-env.d.ts next.config.mjs package.json postcss.config.mjs README.md tailwind.config.ts tsconfig.json tsconfig.tsbuildinfo vitest.config.ts
worker/92
src/87
__tests__/13ai-embedding.test.ts ai-request.test.ts ai-usage-budget.test.ts audit-export.test.ts email-decision.test.ts encrypt.test.ts health-search-index-lag.test.ts mime.test.ts retention.test.ts s3-sign.test.ts search-index.test.ts smtp.test.ts webhook-sign.test.ts
health/1server.ts
lib/12
__tests__/1clamav.test.ts
clamav.ts encrypt.ts job-otel.ts mime.ts notify.ts prisma.ts redis-stream.ts redis.ts s3.ts sharp.ts smtp.ts
processors/56
automations/28
__tests__/3condition-evaluator.spec.ts executors.spec.ts run-pipeline.spec.ts
executors/17assign-user.ts call-integration.ts change-status.ts classify.ts create-notification.ts create-page.ts email-cap.ts helpers.ts integration-registry.ts permission.ts record-write.ts registry.ts run-ai-action.ts send-email.ts send-webhook.ts types.ts update-record.ts
condition-evaluator.ts dead-letter.ts log.ts matcher.ts pipeline.ts run-state.ts schedule.ts watchdog.ts
files/15
__tests__/4errors.test.ts scan-gate.test.ts status.test.ts temp.test.ts
steps/4finalize.ts metadata.ts scan.ts thumbnails.ts
cleanup.ts errors.ts generateThumbs.ts processor.ts status.ts temp.ts types.ts
search-index/4builders.ts grants.ts index.ts processor.ts
ai-embedding.ts ai.processor.ts audit-export.ts automations.processor.ts email-decision.processor.ts email.processor.ts maintenance.processor.ts retention.ts webhooks.processor.ts
config.ts events.ts index.ts logger.ts queues.ts
.env.example Dockerfile package.json README.md tsconfig.json
docs/73
api/17ai.md authentication.md automations.md blocks.md comments.md databases.md files.md forms.md openapi.yaml org-admin.md pages.md scim.md search.md sso.md versioning.md webhooks.md workspaces.md
architecture/10ai-architecture.md automation.md backend-architecture.md database-architecture.md frontend-architecture.md realtime-architecture.md search-architecture.md security-architecture.md storage.md system-architecture.md
database/2database-architecture.md redis-keys.md
development/8admin-guide.md coding-standards.md deployment.md development-guide.md files-pipeline.md perf-report.md performance.md testing.md
product/4functional-requirements.md non-functional-requirements.md product-requirements.md ux-requirements.md
requirements/1requirements-matrix.md
security/5audit-report.md files.md forms.md license-allowlist.md security-architecture.md
tasks/16phase-00-foundation.md phase-01-authentication.md phase-02-workspace.md phase-03-pages.md phase-04-editor.md phase-05-databases.md phase-06-relations.md phase-07-collaboration.md phase-08-search.md phase-09-files.md phase-10-forms.md phase-11-automation.md phase-12-ai.md phase-13-api.md phase-14-enterprise.md phase-15-production.md
ui/9ai.md automations.md design-system.md developers.md files.md forms.md org-admin.md scim.md sso.md
support-matrix.md
infrastructure/71
caddy/1Caddyfile
docker/6
init/101-extensions.sql
opensearch/1init-indices.json
.env.docker docker-compose.yml opensearch-init.sh README.md
kubernetes/40
observability/20
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1sync-sources.mjs
alertmanager.yaml grafana.yaml kustomization.yaml namespace.yaml node-exporter.yaml otel-collector.yaml prometheus.yaml
postgres/7configmap.yaml cronjob-backup.yaml cronjob-opensearch-snapshot.yaml pgbouncer.yaml replica.yaml statefulset.yaml walg-iam-policy.yaml
api.yaml configmap.yaml ingress.yaml kustomization.yaml namespace.yaml networkpolicy.yaml pdb.yaml README.md realtime.yaml redis.yaml secret.example.yaml web.yaml worker.yaml
nginx/2nginx.conf README.md
observability/14
alertmanager/1alertmanager.yaml
grafana/8
dashboards/6ai.json api-overview.json infra.json realtime.json search.json workers-queues.json
provisioning/2
dashboards/1dashboards.yaml
datasources/1datasource.yaml
prometheus/3alerts.yaml recording-rules.yaml scrape.yaml
scripts/1dashboard-completeness.mjs
README.md
terraform/8compute.tf data.tf main.tf network.tf outputs.tf README.md security.tf variables.tf
packages/289
ai/24
src/20
providers/7anthropic.ts google.ts http.ts index.ts openai-compatible.ts rag.test.ts writing.test.ts
schemas/2database.ts generate.ts
adapters.test.ts config.test.ts config.ts gateway.test.ts gateway.ts index.ts tools.test.ts tools.ts types.ts usage.test.ts usage.ts
package.json README.md tsconfig.json vitest.config.ts
auth/11
src/7index.ts passwords.test.ts passwords.ts sessions.test.ts sessions.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
collaboration/17
src/13awareness.ts codec.test.ts codec.ts index.ts lww.test.ts lww.ts mapping.ts offline.ts outbox.test.ts outbox.ts provider.test.ts provider.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
config/7
src/4eslint.base.js index.ts prettier.base.json tsconfig.base.json
package.json README.md tsconfig.json
database-client/5
src/2index.test.ts index.ts
package.json README.md tsconfig.json
database-engine/33
src/29
filter/2filter.test.ts index.ts
formula/8evaluator.ts formula.test.ts functions.ts index.ts lexer.ts parser.ts types.ts validate.ts
query/6group.ts index.ts paginate.ts pivot.ts query.test.ts sort.ts
relations/2index.ts relations.test.ts
rollups/2index.ts rollups.test.ts
values/5dates.ts index.ts registry.ts types.ts values.test.ts
views/3buttons.ts index.ts views.test.ts
index.ts
package.json README.md tsconfig.json vitest.config.ts
editor/25
src/21
marks/1highlight.ts
nodes/2equation.ts mention.ts
autosave.test.ts autosave.ts clipboard.test.ts clipboard.ts codec.test.ts codec.ts context-menu.test.ts context-menu.ts diff.test.ts diff.ts factory.ts history.test.ts history.ts index.ts positions.ts slash.test.ts slash.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
observability/20
src/16
__tests__/8db-redis-metrics.test.ts metrics.test.ts otel.test.ts pino-otel.test.ts prometheus.test.ts resource.test.ts scrubber.test.ts traceparent.test.ts
index.ts metrics.ts otel.ts pino-otel.ts prometheus.ts resource.ts scrubber.ts traceparent.ts
package.json README.md tsconfig.json vitest.config.ts
permissions/11
src/7index.ts levels.test.ts levels.ts resolve.test.ts resolve.ts rules.test.ts rules.ts
package.json README.md tsconfig.json vitest.config.ts
search/22
src/18chunking.test.ts chunking.ts client.test.ts client.ts embeddings.test.ts embeddings.ts hybrid.test.ts hybrid.ts index.ts indexer.test.ts indexer.ts mapping.test.ts mapping.ts queries.test.ts queries.ts rrf.test.ts rrf.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
shared/61
src/57
dto/17ai.dto.ts auth.dto.test.ts auth.dto.ts block.dto.ts browser-safety.test.ts comment.dto.ts database.dto.test.ts database.dto.ts file.dto.ts formula-ast.ts index.ts notification.dto.ts page.dto.ts search.dto.ts share.dto.ts webhook.dto.ts workspace.dto.ts
events/8audit-catalog.test.ts audit-catalog.ts audit-csv.test.ts audit-csv.ts audit-scope.test.ts audit-scope.ts catalog.test.ts catalog.ts
realtime/6comment-events.ts frames.test.ts frames.ts notification-policy.ts notification-prefs.ts task-0094.test.ts
automation.test.ts automation.ts constants.ts crypto.test.ts crypto.ts env.ts errors.ts events.test.ts events.ts forms.test.ts forms.ts index.ts markdown.test.ts markdown.ts mentions.test.ts mentions.ts net.test.ts net.ts positions.test.ts positions.ts presence.test.ts presence.ts security-headers.ts webhook-delivery.test.ts webhook-delivery.ts webhook-events.ts
package.json README.md tsconfig.json vitest.config.ts
storage/16
src/12client.test.ts client.ts index.ts keys.test.ts keys.ts mime.test.ts mime.ts presign.test.ts presign.ts thumbnails.test.ts thumbnails.ts types.ts
package.json README.md tsconfig.json vitest.config.ts
ui/37
src/33
components/19avatar.tsx badge.tsx button.tsx checkbox.tsx command.tsx context-menu.tsx dialog.tsx dropdown-menu.tsx empty-state.tsx index.ts popover.tsx separator.tsx skeleton.tsx slider.tsx spinner.tsx switch.tsx tabs.tsx toast.tsx tooltip.tsx
color.ts command-filter.test.ts command-filter.ts focus.test.ts focus.ts formatters.test.ts formatters.ts index.ts theme.test.ts theme.ts toast-store.test.ts toast-store.ts tokens.test.ts tokens.ts
package.json README.md tsconfig.json vitest.config.ts
prisma/16
migrations/13
20260927000000_init/1migration.sql
20260928000000_search_documents_content_hash/1migration.sql
20260929000000_workspace_usage_storage_bytes/1migration.sql
20260930000000_form_submitted_notification_type/1migration.sql
20261001000000_ai_phase12/1migration.sql
20261002000000_webhooks_secret_encrypted_dlq/1migration.sql
20261002111436_webhook_delivery_latency/1migration.sql
20261002120000_org_admin_2fa_retention_unique/1migration.sql
20261002215124_audit_export/1migration.sql
20261003210000_perf_indexes_hot_paths/1migration.sql
20261004004500_perf_indexes_hot_paths_2/1migration.sql
migration_lock.toml README.md
schema.prisma seed.ts verify.ts
scripts/7backup-health.ts docs-completeness.mjs generate-openapi.mjs minio-init.ts opensearch-reindex.ts storage-orphans.ts verify-clean-clone.sh
tests/169
e2e/63
.auth/1user.json
fixtures/7
files/6clip.mp4 clip.wav clip.webm hero-1400.png note.docx note.txt
realtime.ts
mocks/2oidc-issuer.ts saml-idp.ts
playwright-report/3
data/2a6557bae9c2714a658968d4eb8534195c08ebda8.png e3092d07d00a16063e46385c02a559a9054fa847.webm
index.html
reports/1files-security.json
specs/34ai-database.spec.ts ai-generate.spec.ts ai-rag.spec.ts ai-security.spec.ts ai-writing.spec.ts ai.spec.ts api-keys.spec.ts appearance-theme.spec.ts auth.spec.ts automation.spec.ts collab-two-tab.spec.ts comments.spec.ts databases.spec.ts default-workspace-alias.spec.ts developers.spec.ts editor.spec.ts files.spec.ts final-flow.spec.ts forms.spec.ts oauth.spec.ts org-admin.spec.ts pages.spec.ts performance.spec.ts presence-cursors.spec.ts qa-paste-toggle.spec.ts realtime.spec.ts scim.spec.ts search-index-lag.spec.ts search.spec.ts sharing.spec.ts sso.spec.ts task-0094-comments-notifications.spec.ts webhooks.spec.ts workspace.spec.ts
test-results-final-flow/3
final-flow-Release-v1-0-fi-6c06b-w-state-carries-sequential--chromium-desktop/2test-failed-1.png trace.zip
.last-run.json
utils/4api.ts dnd.ts search-lag.ts wait.ts
.gitignore fixtures.ts global-setup.ts package.json playwright.config.ts playwright.final-flow.config.ts README.md tsconfig.json
fixtures/1
files/1make-sparse.ts
integration/60
ai-capability/2ai-app.capability.test.ts gateway.capability.test.ts
drill/2seed-drill.mjs verify-restore.mjs
fixtures/5
files/5clip.mp4 clip.wav doc.pdf hero-1400.png note.txt
helpers/3api.ts containers.ts seed.ts
realtime/11control-channel.test.ts convergence.test.ts flush-rebase-http.test.ts handshake.test.ts heartbeat-limits.test.ts lifecycle.test.ts presence.test.ts rebase.test.ts resume.test.ts rt-helpers.ts task-0094-fanout.test.ts
ai-chat.integration.test.ts ai-database.integration.test.ts ai-generate.integration.test.ts ai-rag.integration.test.ts ai-writing.integration.test.ts api-keys.integration.test.ts audit-completeness.integration.test.ts audit-export-s3.integration.test.ts auth.integration.test.ts automation-pipeline.integration.test.ts automations.integration.test.ts blocks.integration.test.ts cache-invalidation.integration.test.ts comments.integration.test.ts databases.integration.test.ts files-lifecycle.integration.test.ts files-pipeline.integration.test.ts files-security.integration.test.ts files.integration.test.ts forms-responses.integration.test.ts forms.integration.test.ts oauth.integration.test.ts openapi.contract.test.ts org-admin.integration.test.ts package.json pages.integration.test.ts permissions.integration.test.ts README.md replica-routing.integration.test.ts retention-engine.integration.test.ts scim.integration.test.ts search.integration.test.ts sso.integration.test.ts tsconfig.json vitest.config.ts webhooks.integration.test.ts workspace.integration.test.ts
performance/28
fixtures/1search-100k.ts
helpers/2seed-100k.mjs seed-1k-load.mjs
reports/7api-load-smoke.json database-load-smoke.json editor-local.json realtime-load.json search-full.json search-last.json search-reduced.json
api-load.js api.js archive.tar database-load.js database.js editor-local.mjs extract-100k-env.mjs package.json README.md realtime-1k.js realtime-load.js realtime.js run-realtime-load.sh search-search.k6.js search-summary.json seed-100k.mjs threshold-breach-demo.js verify-zero-op-loss.mjs
security/16
helpers/1app.ts
audit-report.test.ts auth-paths.test.ts deps.test.ts formula-fuzz.test.ts gitleaks-config.test.ts headers.test.ts images.test.ts oracle.ts package.json permission-fuzz.test.ts rate-limits.test.ts README.md tsconfig.json upload-abuse.test.ts vitest.config.ts
README.md
.dockerignore .env .env.bak-task0125 .env.example .eslintrc.json .gitignore .npmrc .prettierignore .prettierrc.json AGENTS.md ARCHITECTURE.md CHANGELOG.md CONTRIBUTING.md gitleaks.toml LICENSE package.json pnpm-lock.yaml pnpm-workspace.yaml PRODUCT-SPEC.md README.md ROADMAP.md SECURITY.md tsconfig.json turbo.json
automation.test.tspackages/shared/src/automation.test.tsraw← src23,186 B← Back to the app
1/**
2 * @factory/shared/automation — unit tests (TASK-0110/0111 contract tests).
3 *
4 * Covers: cron validation matrix, status machine, condition-tree validation
5 * (depth/node caps + malformed), loop guard, webhook signature
6 * (build/verify/stale/tamper/missing), interpolation (7 families + unknown +
7 * overflow-free), truncateJson caps, run backoff schedule, key helpers.
8 */
9import { describe, expect, it } from "vitest";
10import { createHmac } from "node:crypto";
11import {
12  AUTOMATION_MAX_DEPTH,
13  AUTOMATION_STATUS_TRANSITIONS,
14  buildWebhookSignature,
15  cronCheck,
16  dedupeKey,
17  emailCapKey,
18  generateWebhookSecret,
19  interpolate,
20  isValidAutomationTransition,
21  loopGuard,
22  normalizeConditionValue,
23  runBackoffSeconds,
24  truncateJson,
25  validateActionDto,
26  validateConditionTree,
27  validateTriggerConfig,
28  verifyWebhookSignature,
29  webhookSecretHash,
30  ActionConfigSchemas
31} from "./automation.js";
32 
33// ---------------------------------------------------------------------------
34// Cron
35// ---------------------------------------------------------------------------
36 
37describe("cronCheck", () => {
38  it("accepts standard 5-field expressions", () => {
39    for (const expr of ["* * * * *", "0 9 * * *", "*/5 * * * *", "0 0 * * 1", "30 4 1 1 *"]) {
40      const r = cronCheck(expr);
41      expect(r.ok, expr).toBe(true);
42      expect(r.nextFire).toBeInstanceOf(Date);
43    }
44  });
45 
46  it("accepts 6-field (seconds) expressions at ≥ 60 s intervals", () => {
47    expect(cronCheck("0 * * * * *").ok).toBe(true); // every minute (seconds field present)
48    expect(cronCheck("0 */30 * * * *").ok).toBe(true); // every 30 MINUTES (field 2 = minutes)
49  });
50 
51  it("rejects 4-field expressions (CRON_INVALID)", () => {
52    expect(cronCheck("* * * *").code).toBe("CRON_INVALID");
53  });
54 
55  it("accepts */30 minutes (5-field, 30-min interval)", () => {
56    expect(cronCheck("*/30 * * * *").ok).toBe(true);
57  });
58 
59  it("rejects intervals < 60 s (CRON_TOO_FREQUENT)", () => {
60    // 6-field (seconds) expressions firing sub-minute; the 5-field
61    // "0 */30 * * * *" (every 30 MINUTES) is valid and covered above.
62    for (const expr of ["*/30 * * * * *", "0,30 * * * * *", "* * * * * *"]) {
63      const r = cronCheck(expr);
64      expect(r.ok, expr).toBe(false);
65      expect(r.code, expr).toBe("CRON_TOO_FREQUENT");
66    }
67  });
68 
69  it("rejects invalid expressions (CRON_INVALID)", () => {
70    for (const expr of ["", "not a cron", "* * * *", "61 * * * *", "*/0 * * * *", "a b c d e"]) {
71      const r = cronCheck(expr);
72      expect(r.ok, expr).toBe(false);
73      expect(r.code, expr).toBe("CRON_INVALID");
74    }
75  });
76});
77 
78// ---------------------------------------------------------------------------
79// Status machine
80// ---------------------------------------------------------------------------
81 
82describe("automation status machine", () => {
83  it("accepts the 6 valid transitions", () => {
84    expect(isValidAutomationTransition("DRAFT", "ACTIVE")).toBe(true);
85    expect(isValidAutomationTransition("ACTIVE", "PAUSED")).toBe(true);
86    expect(isValidAutomationTransition("PAUSED", "ACTIVE")).toBe(true);
87    expect(isValidAutomationTransition("ACTIVE", "ARCHIVED")).toBe(true);
88    expect(isValidAutomationTransition("PAUSED", "ARCHIVED")).toBe(true);
89    expect(isValidAutomationTransition("ARCHIVED", "ACTIVE")).toBe(true);
90  });
91 
92  it("rejects invalid pairs (incl. DRAFT→PAUSED/ARCHIVED, all no-ops)", () => {
93    // DRAFT→ARCHIVED is NOT a status transition (spec §2: DRAFT rows are
94    // removed via the DELETE endpoint, which archives as a separate
95    // operation). The 6 valid transitions are the ONLY valid ones.
96    expect(isValidAutomationTransition("DRAFT", "PAUSED")).toBe(false);
97    expect(isValidAutomationTransition("DRAFT", "ARCHIVED")).toBe(false);
98    expect(isValidAutomationTransition("ACTIVE", "DRAFT")).toBe(false);
99    expect(isValidAutomationTransition("PAUSED", "DRAFT")).toBe(false);
100    expect(isValidAutomationTransition("ARCHIVED", "PAUSED")).toBe(false);
101    expect(isValidAutomationTransition("ARCHIVED", "DRAFT")).toBe(false);
102    // no-ops (from === to) are always invalid (client bug).
103    expect(isValidAutomationTransition("DRAFT", "DRAFT")).toBe(false);
104    expect(isValidAutomationTransition("ARCHIVED", "ARCHIVED")).toBe(false);
105    expect(isValidAutomationTransition("PAUSED", "PAUSED")).toBe(false);
106    expect(isValidAutomationTransition("ACTIVE", "ACTIVE")).toBe(false);
107  });
108 
109  it("exposes the transition table", () => {
110    expect(AUTOMATION_STATUS_TRANSITIONS.ACTIVE).toEqual(expect.arrayContaining(["PAUSED", "ARCHIVED"]));
111    expect(AUTOMATION_STATUS_TRANSITIONS.ARCHIVED).toEqual(["ACTIVE"]);
112  });
113});
114 
115// ---------------------------------------------------------------------------
116// Trigger config validation
117// ---------------------------------------------------------------------------
118 
119describe("validateTriggerConfig", () => {
120  it("accepts valid configs per type", () => {
121    expect(validateTriggerConfig("RECORD_CREATED", { databaseId: "db_0000000000001" }).ok).toBe(true);
122    expect(validateTriggerConfig("RECORD_CREATED", {}).ok).toBe(true);
123    expect(validateTriggerConfig("PROPERTY_CHANGED", { properties: ["Priority"] }).ok).toBe(true);
124    expect(validateTriggerConfig("SCHEDULE", { cron: "0 9 * * *" }).ok).toBe(true);
125    expect(validateTriggerConfig("MANUAL", {}).ok).toBe(true);
126    expect(validateTriggerConfig("WEBHOOK", {}).ok).toBe(true);
127  });
128 
129  it("rejects PROPERTY_CHANGED without properties", () => {
130    expect(validateTriggerConfig("PROPERTY_CHANGED", {}).ok).toBe(false);
131  });
132 
133  it("rejects SCHEDULE with too-frequent cron (CRON_TOO_FREQUENT surfaced)", () => {
134    const r = validateTriggerConfig("SCHEDULE", { cron: "*/30 * * * * *" }); // 6-field: every 30 s
135    expect(r.ok).toBe(false);
136  });
137 
138  it("rejects SCHEDULE with invalid cron", () => {
139    expect(validateTriggerConfig("SCHEDULE", { cron: "garbage" }).ok).toBe(false);
140  });
141 
142  it("rejects unknown extra keys on strict schemas", () => {
143    expect(validateTriggerConfig("MANUAL", { foo: 1 }).ok).toBe(false);
144  });
145});
146 
147// ---------------------------------------------------------------------------
148// Condition tree validation (TASK-0111 caps)
149// ---------------------------------------------------------------------------
150 
151const pred = (field: string, operator: string, value?: unknown): Record<string, unknown> =>
152  value === undefined ? { field: { ref: "property", name: field }, operator } : { field: { ref: "property", name: field }, operator, value };
153 
154describe("validateConditionTree", () => {
155  it("accepts a bare predicate", () => {
156    expect(validateConditionTree(pred("Priority", "eq", "High")).ok).toBe(true);
157  });
158 
159  it("accepts empty tree (always true)", () => {
160    expect(validateConditionTree(null).ok).toBe(true);
161    expect(validateConditionTree(undefined).ok).toBe(true);
162  });
163 
164  it("accepts an AND of two predicates", () => {
165    const tree = { op: "AND", children: [pred("a", "eq", 1), pred("b", "is_empty")] };
166    expect(validateConditionTree(tree).ok).toBe(true);
167  });
168 
169  it("requires value for non-empty operators", () => {
170    expect(validateConditionTree(pred("a", "eq")).ok).toBe(false);
171    expect(validateConditionTree(pred("a", "is_empty")).ok).toBe(true);
172    expect(validateConditionTree(pred("a", "is_not_empty")).ok).toBe(true);
173  });
174 
175  it("rejects AND/OR with < 2 children and NOT with != 1", () => {
176    expect(validateConditionTree({ op: "AND", children: [pred("a", "is_empty")]}).ok).toBe(false);
177    expect(validateConditionTree({ op: "OR", children: [] }).ok).toBe(false);
178    expect(validateConditionTree({ op: "NOT", child: pred("a", "is_empty") }).ok).toBe(true);
179    expect(validateConditionTree({ op: "NOT" }).ok).toBe(false); // missing child
180    expect(validateConditionTree({ op: "NOT", children: [pred("a", "is_empty")] }).ok).toBe(false); // old shape rejected
181  });
182 
183  it("rejects unknown operators", () => {
184    expect(validateConditionTree({ field: { ref: "property", name: "a" }, operator: "like", value: "x" }).ok).toBe(false);
185  });
186 
187  it("rejects depth 6 groups (depth 5 ok)", () => {
188    let depth5 = pred("a", "is_empty");
189    let depth6 = pred("a", "is_empty");
190    for (let i = 0; i < 5; i++) depth5 = { op: "NOT", child: depth5 };
191    for (let i = 0; i < 6; i++) depth6 = { op: "NOT", child: depth6 };
192    const r5 = validateConditionTree(depth5);
193    expect(r5.ok).toBe(true);
194    expect(r5.depth).toBe(5);
195    const r6 = validateConditionTree(depth6);
196    expect(r6.ok).toBe(false);
197    expect(r6.code).toBe("CONDITION_TOO_COMPLEX");
198  });
199 
200  it("enforces the 100-node cap (wide trees, depth 2)", () => {
201    // A 2-level tree stays at depth 2 while the node count grows:
202    //   AND( [AND(10 leaves)] × 8, AND(k leaves) ) = 1 + 8 + 80 + 1 + k = 90 + k.
203    // k=10 → 100 nodes (ok); k=11 → 101 nodes (CONDITION_TOO_COMPLEX).
204    const leaf = () => pred("a", "is_empty");
205    const wide = (k: number): unknown => ({
206      op: "AND",
207      children: [
208        ...Array.from({ length: 8 }, () => ({ op: "AND", children: Array.from({ length: 10 }, leaf) })),
209        { op: "AND", children: Array.from({ length: k }, leaf) }
210      ]
211    });
212    const r100 = validateConditionTree(wide(10));
213    expect(r100.ok).toBe(true);
214    expect(r100.nodes).toBe(100);
215    const r101 = validateConditionTree(wide(11));
216    expect(r101.ok).toBe(false);
217    expect(r101.code).toBe("CONDITION_TOO_COMPLEX");
218    expect(r101.nodes).toBe(101);
219  });
220 
221  it("rejects malformed nodes (missing field, bad ref)", () => {
222    expect(validateConditionTree({ operator: "eq", value: 1 }).ok).toBe(false);
223    expect(validateConditionTree({ field: { ref: "nope", name: "a" }, operator: "eq", value: 1 }).ok).toBe(false);
224    expect(validateConditionTree("just a string").ok).toBe(false);
225  });
226});
227 
228describe("normalizeConditionValue", () => {
229  const opts = { options: [{ id: "o1", name: "High" }, { id: "o2", name: "Low" }] };
230  it("SELECT/STATUS → option name", () => {
231    expect(normalizeConditionValue("SELECT", opts, "o1")).toBe("High");
232    expect(normalizeConditionValue("STATUS", opts, "o2")).toBe("Low");
233    expect(normalizeConditionValue("SELECT", opts, null)).toBeNull();
234  });
235  it("MULTI_SELECT → sorted name array", () => {
236    expect(normalizeConditionValue("MULTI_SELECT", opts, ["o2", "o1"])).toEqual(["High", "Low"]);
237  });
238  it("PERSON → user-id array", () => {
239    expect(normalizeConditionValue("PERSON", null, ["u1", "u2"])).toEqual(["u1", "u2"]);
240  });
241  it("DATE range → start..end string", () => {
242    expect(normalizeConditionValue("DATE", null, { start: "2026-01-01", end: "2026-01-31" })).toBe("2026-01-01..2026-01-31");
243  });
244  it("NUMBER/CHECKBOX passthrough (typed)", () => {
245    expect(normalizeConditionValue("NUMBER", null, 42)).toBe(42);
246    expect(normalizeConditionValue("CHECKBOX", null, true)).toBe(true);
247  });
248});
249 
250// ---------------------------------------------------------------------------
251// Action config validation (all 9 types)
252// ---------------------------------------------------------------------------
253 
254describe("validateActionDto", () => {
255  const base = { retries: 3, timeoutMs: 30_000 } as const;
256  const call = (type: string, config: Record<string, unknown>, extra: Record<string, unknown> = {}) =>
257    validateActionDto({ type: type as never, config, ...base, ...extra });
258 
259  it("UPDATE_RECORD: valid + documented invalids", () => {
260    expect(call("UPDATE_RECORD", { recordId: "from_trigger", propertyValues: { Status: "In Progress" } }).ok).toBe(true);
261    expect(call("UPDATE_RECORD", { propertyValues: {} }).ok).toBe(false); // empty
262    const twentyOne: Record<string, string> = Object.fromEntries(Array.from({ length: 21 }, (_, i) => [`p${i}`, "x"]));
263    expect(call("UPDATE_RECORD", { propertyValues: twentyOne }).ok).toBe(false); // > 20
264  });
265 
266  it("SEND_WEBHOOK: http:// rejected (https only)", () => {
267    expect(call("SEND_WEBHOOK", { url: "http://example.com/hook" }).ok).toBe(false);
268    expect(call("SEND_WEBHOOK", { url: "https://example.com/hook" }).ok).toBe(true);
269    expect(call("SEND_WEBHOOK", { url: "https://example.com/hook", payload: Object.fromEntries(Array.from({ length: 70_000 }, (_, i) => [`k${i}`, "x"])) }).ok).toBe(false); // > 64 KB payload
270  });
271 
272  it("SEND_EMAIL: to must be email or token; cc ≤ 5", () => {
273    expect(call("SEND_EMAIL", { to: "a@b.co", subject: "s", body: "b" }).ok).toBe(true);
274    expect(call("SEND_EMAIL", { to: "not-an-email", subject: "s", body: "b" }).ok).toBe(false);
275    expect(call("SEND_EMAIL", { to: "a@b.co", subject: "s", body: "b", cc: ["1@x.co", "2@x.co", "3@x.co", "4@x.co", "5@x.co", "6@x.co"] }).ok).toBe(false);
276  });
277 
278  it("CHANGE_STATUS / ASSIGN_USER shapes (propertyId per spec TASK-0112)", () => {
279    const prop = "cp12345678901234567890123456789";
280    expect(call("CHANGE_STATUS", { recordId: "from_trigger", propertyId: prop, value: "Done" }).ok).toBe(true);
281    expect(call("ASSIGN_USER", { propertyId: prop, userId: "trigger_user" }).ok).toBe(true);
282    expect(call("ASSIGN_USER", { propertyId: prop }).ok).toBe(false); // userId required
283    expect(call("ASSIGN_USER", { propertyId: "not-a-cuid", userId: "u1" }).ok).toBe(false);
284  });
285 
286  it("CREATE_PAGE title 1..200 + interpolation depth 4 rejected", () => {
287    expect(call("CREATE_PAGE", { title: "Page {{record.Name}}" }).ok).toBe(true);
288    expect(call("CREATE_PAGE", { title: "x".repeat(201) }).ok).toBe(false);
289    expect(call("CREATE_PAGE", { title: "{{a.b.c.d}}" }).ok).toBe(false);
290  });
291 
292  it("CREATE_NOTIFICATION link must be an internal path", () => {
293    expect(call("CREATE_NOTIFICATION", { to: "automation_creator", type: "AUTOMATION", body: "hi", link: "/w/x/db" }).ok).toBe(true);
294    expect(call("CREATE_NOTIFICATION", { to: "automation_creator", type: "AUTOMATION", body: "hi", link: "https://x.co" }).ok).toBe(false);
295  });
296 
297  it("stubs validate config (CALL_INTEGRATION / RUN_AI_ACTION)", () => {
298    expect(call("CALL_INTEGRATION", { integrationId: "c1234567890abc", operation: "sync" }).ok).toBe(true);
299    expect(call("CALL_INTEGRATION", { integrationId: "x", operation: "sync" }).ok).toBe(false);
300    expect(call("RUN_AI_ACTION", { prompt: "sum {{record.Title}}", task: "summarize" }).ok).toBe(true);
301    expect(call("RUN_AI_ACTION", { prompt: "x", task: "nope" }).ok).toBe(false);
302  });
303 
304  it("retries 1..8 + timeoutMs 1000..300000 enforced", () => {
305    expect(call("CREATE_PAGE", { title: "t" }, { retries: 0 }).ok).toBe(false);
306    expect(call("CREATE_PAGE", { title: "t" }, { retries: 9 }).ok).toBe(false);
307    expect(call("CREATE_PAGE", { title: "t" }, { retries: 1 }).ok).toBe(true);
308    expect(call("CREATE_PAGE", { title: "t" }, { retries: 8 }).ok).toBe(true);
309    expect(call("CREATE_PAGE", { title: "t" }, { timeoutMs: 500 }).ok).toBe(false);
310    expect(call("CREATE_PAGE", { title: "t" }, { timeoutMs: 300_001 }).ok).toBe(false);
311    expect(call("CREATE_PAGE", { title: "t" }, { timeoutMs: 300_000 }).ok).toBe(true);
312  });
313 
314  it("unknown action type rejected", () => {
315    expect(call("SEND_SMS", {}).ok).toBe(false);
316  });
317 
318  it("exposes the 9 config schemas", () => {
319    expect(Object.keys(ActionConfigSchemas)).toHaveLength(9);
320  });
321});
322 
323// ---------------------------------------------------------------------------
324// Loop guard (TASK-0113 contract)
325// ---------------------------------------------------------------------------
326 
327describe("loopGuard", () => {
328  it("allows events without automation context (depth 0)", () => {
329    expect(loopGuard(null, "a1")).toEqual({ blocked: false });
330    expect(loopGuard({}, "a1")).toEqual({ blocked: false });
331  });
332 
333  it("blocks self-trigger (same automationId)", () => {
334    expect(loopGuard({ automationId: "a1", depth: 0 }, "a1").blocked).toBe(true);
335    expect(loopGuard({ automationId: "a1", depth: 4 }, "a1")).toEqual({ blocked: true, reason: "self_trigger", depth: 4 });
336  });
337 
338  it("allows other automations' events within the budget", () => {
339    expect(loopGuard({ automationId: "a2", depth: 1 }, "a1").blocked).toBe(false);
340    expect(loopGuard({ automationId: "a2", depth: 4 }, "a1").blocked).toBe(false);
341  });
342 
343  it("blocks depth >= 5", () => {
344    expect(AUTOMATION_MAX_DEPTH).toBe(5);
345    expect(loopGuard({ automationId: "a2", depth: 5 }, "a1")).toEqual({ blocked: true, reason: "depth_limit", depth: 5 });
346    expect(loopGuard({ automationId: "a2", depth: 99 }, "a1")).toEqual({ blocked: true, reason: "depth_limit", depth: 99 });
347  });
348 
349  it("self-trigger wins over depth (both true → self_trigger)", () => {
350    const d = loopGuard({ automationId: "a1", depth: 99 }, "a1");
351    expect(d.blocked).toBe(true);
352    if (d.blocked) expect(d.reason).toBe("self_trigger");
353  });
354});
355 
356// ---------------------------------------------------------------------------
357// Webhook signature (TASK-0110 §5)
358// ---------------------------------------------------------------------------
359 
360describe("webhook signature", () => {
361  const secret = generateWebhookSecret();
362  const body = JSON.stringify({ hello: "world" });
363 
364  it("secret format: whsec_ + 64 hex", () => {
365    expect(secret).toMatch(/^whsec_[0-9a-f]{64}$/);
366    expect(webhookSecretHash(secret)).toMatch(/^[0-9a-f]{64}$/);
367  });
368 
369  it("build → verify round-trip", () => {
370    const t = Math.floor(Date.now() / 1000);
371    const header = buildWebhookSignature(secret, t, body);
372    expect(verifyWebhookSignature(secret, header, body, t * 1000)).toBeNull();
373  });
374 
375  it("tampered body → WEBHOOK_SIGNATURE_INVALID", () => {
376    const t = Math.floor(Date.now() / 1000);
377    const header = buildWebhookSignature(secret, t, body);
378    expect(verifyWebhookSignature(secret, header, body + "x", t * 1000)).toBe("WEBHOOK_SIGNATURE_INVALID");
379  });
380 
381  it("stale timestamp (> 5 min) → WEBHOOK_TIMESTAMP_STALE", () => {
382    const t = Math.floor(Date.now() / 1000) - 10 * 60; // 10 min old
383    const header = buildWebhookSignature(secret, t, body);
384    expect(verifyWebhookSignature(secret, header, body, Date.now())).toBe("WEBHOOK_TIMESTAMP_STALE");
385  });
386 
387  it("timestamp within ±5 min is accepted", () => {
388    const t = Math.floor(Date.now() / 1000) - 4 * 60;
389    const header = buildWebhookSignature(secret, t, body);
390    expect(verifyWebhookSignature(secret, header, body, Date.now())).toBeNull();
391  });
392 
393  it("wrong secret → WEBHOOK_SIGNATURE_INVALID", () => {
394    const t = Math.floor(Date.now() / 1000);
395    const header = buildWebhookSignature(secret, t, body);
396    expect(verifyWebhookSignature(generateWebhookSecret(), header, body, t * 1000)).toBe("WEBHOOK_SIGNATURE_INVALID");
397  });
398 
399  it("missing/malformed header → WEBHOOK_SIGNATURE_INVALID", () => {
400    expect(verifyWebhookSignature(secret, undefined, body)).toBe("WEBHOOK_SIGNATURE_INVALID");
401    expect(verifyWebhookSignature(secret, "garbage", body)).toBe("WEBHOOK_SIGNATURE_INVALID");
402    expect(verifyWebhookSignature(secret, "t=123,v1=zzz", body)).toBe("WEBHOOK_SIGNATURE_INVALID");
403  });
404 
405  it("verification is over t.rawBody (not parsed JSON)", () => {
406    const t = Math.floor(Date.now() / 1000);
407    const raw = '{"a":1,  "b": 2 }'; // non-canonical spacing
408    const expected = createHmac("sha256", secret).update(`${t}.${raw}`).digest("hex");
409    const header = `t=${t},v1=${expected}`;
410    expect(verifyWebhookSignature(secret, header, raw, t * 1000)).toBeNull();
411    expect(verifyWebhookSignature(secret, header, '{"a":1,"b":2}', t * 1000)).toBe("WEBHOOK_SIGNATURE_INVALID");
412  });
413});
414 
415// ---------------------------------------------------------------------------
416// Interpolation (TASK-0112 §9)
417// ---------------------------------------------------------------------------
418 
419describe("interpolate", () => {
420  const vars = {
421    record: { id: "r1", Title: "My Record", Priority: "High" },
422    event: { type: "record.created", payload: { category: "bug", deep: { x: 1 } } },
423    input: { note: "hello" },
424    automation: { id: "a1", name: "Auto" },
425    run: { id: "run1" }
426  };
427 
428  it("resolves all 7 key families", () => {
429    const { value } = interpolate(
430      "{{record.Title}}|{{record.id}}|{{event.type}}|{{event.payload.category}}|{{input.note}}|{{automation.id}}|{{run.id}}",
431      vars
432    );
433    expect(value).toBe("My Record|r1|record.created|bug|hello|a1|run1");
434  });
435 
436  it("unknown key → empty string + warning", () => {
437    const { value, warnings } = interpolate("{{missing.thing}}", vars);
438    expect(value).toBe("");
439    expect(warnings).toEqual(["unknown interpolation key: {{missing.thing}}"]);
440  });
441 
442  it("no warnings for known families with missing leaves", () => {
443    const { value, warnings } = interpolate("[{{record.Absent}}]", vars);
444    expect(value).toBe("[]");
445    expect(warnings).toEqual([]);
446  });
447 
448  it("object values JSON-stringified", () => {
449    const { value } = interpolate("{{record}}", vars);
450    expect(value).toBe(JSON.stringify(vars.record));
451  });
452 
453  it("leaves non-token text intact", () => {
454    expect(interpolate("no tokens here", vars).value).toBe("no tokens here");
455  });
456});
457 
458// ---------------------------------------------------------------------------
459// Truncation + backoff + keys
460// ---------------------------------------------------------------------------
461 
462describe("truncateJson", () => {
463  it("passes small values through untouched", () => {
464    const r = truncateJson({ a: 1 }, 1024);
465    expect(r.truncated).toBe(false);
466    expect(r.value).toEqual({ a: 1 });
467  });
468 
469  it("truncates oversized objects with a flag", () => {
470    const big = { small: 1, big: "x".repeat(10_000) };
471    const r = truncateJson(big, 512);
472    expect(r.truncated).toBe(true);
473    const obj = r.value as Record<string, unknown>;
474    expect(obj.truncated).toBe(true);
475    expect(obj.small).toBe(1);
476    expect(obj.big).toBe("[truncated]");
477    expect(new TextEncoder().encode(JSON.stringify(obj)).length).toBeLessThanOrEqual(512 + 64); // flag overhead tolerance
478  });
479 
480  it("truncates oversized non-objects to a capped string", () => {
481    const r = truncateJson("y".repeat(10_000), 512);
482    expect(r.truncated).toBe(true);
483    expect(typeof r.value).toBe("string");
484    expect((r.value as string).endsWith("…[truncated]")).toBe(true);
485    expect(new TextEncoder().encode(r.value as string).length).toBeLessThanOrEqual(512);
486  });
487 
488  it("handles null", () => {
489    expect(truncateJson(null, 16).value).toBeNull();
490  });
491});
492 
493describe("runBackoffSeconds", () => {
494  it("schedule: 2^(n-1) capped at 600 s", () => {
495    const expected = [1, 2, 4, 8, 16, 32, 64, 128];
496    for (let n = 1; n <= 8; n++) expect(runBackoffSeconds(n)).toBe(expected[n - 1]);
497    expect(runBackoffSeconds(10)).toBe(512); // 2^9
498    expect(runBackoffSeconds(11)).toBe(600); // 2^10 = 1024 → capped
499    expect(runBackoffSeconds(20)).toBe(600);
500  });
501 
502  it("attempt 0 / invalid → 0", () => {
503    expect(runBackoffSeconds(0)).toBe(0);
504    expect(runBackoffSeconds(-3)).toBe(0);
505  });
506});
507 
508describe("key helpers", () => {
509  it("dedupe key = auto:dedupe:{automationId}:{eventId}", () => {
510    expect(dedupeKey("a1", "e1")).toBe("auto:dedupe:a1:e1");
511  });
512  it("email cap key includes UTC date", () => {
513    expect(emailCapKey("ws1", new Date("2026-09-30T00:00:00Z"))).toBe("auto:email:ws1:2026-09-30");
514  });
515});
516