Waiting for http://127.0.0.1:3000/api/heartbeat ... Seeded postgres environment in 2.8s (114 pageviews on example.test) Running 271 tests using 1 worker ✓ 1 [api] › tests/api/account.spec.ts:7:3 › Account › GET /api/me returns the session user (52ms) ✓ 2 [api] › tests/api/account.spec.ts:29:3 › Account › GET /api/me identifies API key callers (15ms) ✓ 3 [api] › tests/api/account.spec.ts:37:3 › Account › GET /api/me requires authentication (23ms) ✓ 4 [api] › tests/api/account.spec.ts:58:5 › Account › API keys › POST /api/me/api-keys creates a key (27ms) ✓ 5 [api] › tests/api/account.spec.ts:77:5 › Account › API keys › POST /api/me/api-keys validates the body (23ms) ✓ 6 [api] › tests/api/account.spec.ts:87:5 › Account › API keys › POST /api/me/api-keys rejects anonymous and API key callers (27ms) ✓ 7 [api] › tests/api/account.spec.ts:95:5 › Account › API keys › GET /api/me authenticates with the new key (12ms) ✓ 8 [api] › tests/api/account.spec.ts:103:5 › Account › API keys › GET /api/me/api-keys lists the caller keys without secrets (45ms) ✓ 9 [api] › tests/api/account.spec.ts:132:5 › Account › API keys › GET /api/me/api-keys rejects anonymous and API key callers (19ms) ✓ 10 [api] › tests/api/account.spec.ts:137:5 › Account › API keys › DELETE /api/me/api-keys/{keyId} rejects unknown and foreign keys (58ms) ✓ 11 [api] › tests/api/account.spec.ts:154:5 › Account › API keys › DELETE /api/me/api-keys/{keyId} revokes the key (51ms) ✓ 12 [api] › tests/api/account.spec.ts:192:5 › Account › Password › POST /api/me/password validates the body (35ms) ✓ 13 [api] › tests/api/account.spec.ts:206:5 › Account › Password › POST /api/me/password rejects a wrong current password (99ms) ✓ 14 [api] › tests/api/account.spec.ts:215:5 › Account › Password › POST /api/me/password rejects anonymous and API key callers (35ms) ✓ 15 [api] › tests/api/account.spec.ts:222:5 › Account › Password › POST /api/me/password changes the password and invalidates the session (406ms) ✓ 16 [api] › tests/api/account.spec.ts:246:3 › Account › GET /api/me/teams lists the caller teams (42ms) ✓ 17 [api] › tests/api/account.spec.ts:263:3 › Account › GET /api/me/teams supports paging and sorting (85ms) ✓ 18 [api] › tests/api/account.spec.ts:283:3 › Account › GET /api/me/teams accepts session and API key callers only (36ms) ✓ 19 [api] › tests/api/account.spec.ts:292:3 › Account › GET /api/me/websites lists the caller websites (47ms) ✓ 20 [api] › tests/api/account.spec.ts:313:3 › Account › GET /api/me/websites supports includeTeams, paging and sorting (52ms) ✓ 21 [api] › tests/api/account.spec.ts:328:3 › Account › GET /api/me/websites accepts session and API key callers only (25ms) ✓ 22 [api] › tests/api/admin.spec.ts:8:5 › Admin › Listings › GET /api/admin/users lists every user (25ms) ✓ 23 [api] › tests/api/admin.spec.ts:36:5 › Admin › Listings › GET /api/admin/users supports search, sorting and paging (100ms) ✓ 24 [api] › tests/api/admin.spec.ts:68:5 › Admin › Listings › GET /api/admin/users requires an admin session (49ms) ✓ 25 [api] › tests/api/admin.spec.ts:81:5 › Admin › Listings › GET /api/admin/websites lists every website with its owner (25ms) ✓ 26 [api] › tests/api/admin.spec.ts:102:5 › Admin › Listings › GET /api/admin/websites supports search, sorting and paging (103ms) ✓ 27 [api] › tests/api/admin.spec.ts:134:5 › Admin › Listings › GET /api/admin/websites requires an admin session (40ms) ✓ 28 [api] › tests/api/admin.spec.ts:140:5 › Admin › Listings › GET /api/admin/teams lists every team with members (23ms) ✓ 29 [api] › tests/api/admin.spec.ts:160:5 › Admin › Listings › GET /api/admin/teams supports search, sorting and paging (58ms) ✓ 30 [api] › tests/api/admin.spec.ts:181:5 › Admin › Listings › GET /api/admin/teams requires an admin session (31ms) ✓ 31 [api] › tests/api/admin.spec.ts:196:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global validates the body (16ms) ✓ 32 [api] › tests/api/admin.spec.ts:204:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global requires an admin session (32ms) ✓ 33 [api] › tests/api/admin.spec.ts:210:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global toggles the global requirement (89ms) ✓ 34 [api] › tests/api/admin.spec.ts:261:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa validates the body (18ms) ✓ 35 [api] › tests/api/admin.spec.ts:269:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa requires an admin session (32ms) ✓ 36 [api] › tests/api/admin.spec.ts:281:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa toggles the team requirement (69ms) ✓ 37 [api] › tests/api/admin.spec.ts:325:5 › Admin › User 2FA enforcement › GET /api/admin/users/{userId}/2fa reports whether 2FA is enabled (35ms) ✓ 38 [api] › tests/api/admin.spec.ts:336:5 › Admin › User 2FA enforcement › GET /api/admin/users/{userId}/2fa requires an admin session (31ms) ✓ 39 [api] › tests/api/admin.spec.ts:346:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa validates the body (13ms) ✓ 40 [api] › tests/api/admin.spec.ts:354:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa requires an admin session (34ms) ✓ 41 [api] › tests/api/admin.spec.ts:366:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa toggles the user requirement (95ms) ✓ 42 [api] › tests/api/admin.spec.ts:399:5 › Admin › User 2FA enforcement › DELETE /api/admin/users/{userId}/2fa resets the user 2FA state (158ms) ✓ 43 [api] › tests/api/analytics.spec.ts:10:3 › Analytics › GET /api/websites/{websiteId}/stats returns totals for the range (56ms) ✓ 44 [api] › tests/api/analytics.spec.ts:35:3 › Analytics › GET /api/websites/{websiteId}/stats applies filters (59ms) ✓ 45 [api] › tests/api/analytics.spec.ts:51:3 › Analytics › GET /api/websites/{websiteId}/stats validates params and permissions (55ms) ✓ 46 [api] › tests/api/analytics.spec.ts:71:3 › Analytics › GET /api/websites/{websiteId}/pageviews returns pageview and session series (71ms) ✓ 47 [api] › tests/api/analytics.spec.ts:98:3 › Analytics › GET /api/websites/{websiteId}/pageviews supports compare and validates unit (33ms) ✓ 48 [api] › tests/api/analytics.spec.ts:120:3 › Analytics › GET /api/websites/{websiteId}/metrics returns session, pageview and event metrics (126ms) ✓ 49 [api] › tests/api/analytics.spec.ts:157:3 › Analytics › GET /api/websites/{websiteId}/metrics supports search, limit and offset (56ms) ✓ 50 [api] › tests/api/analytics.spec.ts:182:3 › Analytics › GET /api/websites/{websiteId}/metrics validates type and permissions (70ms) ✓ 51 [api] › tests/api/analytics.spec.ts:200:3 › Analytics › GET /api/websites/{websiteId}/metrics/expanded returns rows with breakdown totals (60ms) ✓ 52 [api] › tests/api/analytics.spec.ts:231:3 › Analytics › GET /api/websites/{websiteId}/values returns distinct values for a field (95ms) ✓ 53 [api] › tests/api/analytics.spec.ts:271:3 › Analytics › GET /api/websites/{websiteId}/values rejects unsupported types (18ms) ✓ 54 [api] › tests/api/analytics.spec.ts:285:3 › Analytics › GET /api/websites/{websiteId}/active returns the active visitor count (56ms) ✓ 55 [api] › tests/api/analytics.spec.ts:303:3 › Analytics › GET /api/websites/{websiteId}/events lists events with paging (43ms) ✓ 56 [api] › tests/api/analytics.spec.ts:334:3 › Analytics › GET /api/websites/{websiteId}/events filters custom events and validates (90ms) ✓ 57 [api] › tests/api/analytics.spec.ts:375:3 › Analytics › GET /api/websites/{websiteId}/events/series returns per-event time series (88ms) ✓ 58 [api] › tests/api/analytics.spec.ts:408:3 › Analytics › GET /api/websites/{websiteId}/events/stats returns event totals (59ms) ✓ 59 [api] › tests/api/analytics.spec.ts:434:3 › Analytics › GET /api/realtime/{websiteId} returns realtime activity (86ms) ✓ 60 [api] › tests/api/annotations.spec.ts:25:3 › Annotations › POST /api/websites/{websiteId}/annotations creates an annotation (24ms) ✓ 61 [api] › tests/api/annotations.spec.ts:46:3 › Annotations › POST /api/websites/{websiteId}/annotations validates and requires permission (62ms) ✓ 62 [api] › tests/api/annotations.spec.ts:69:3 › Annotations › GET /api/websites/{websiteId}/annotations lists annotations (120ms) ✓ 63 [api] › tests/api/annotations.spec.ts:103:3 › Annotations › GET /api/websites/{websiteId}/annotations/{annotationId} returns an annotation (54ms) ✓ 64 [api] › tests/api/annotations.spec.ts:117:3 › Annotations › POST /api/websites/{websiteId}/annotations/{annotationId} updates an annotation (62ms) ✓ 65 [api] › tests/api/annotations.spec.ts:150:3 › Annotations › DELETE /api/websites/{websiteId}/annotations/{annotationId} deletes an annotation (60ms) ✓ 66 [api] › tests/api/auth.spec.ts:5:3 › Auth › POST /api/auth/login returns a token and the user (98ms) ✓ 67 [api] › tests/api/auth.spec.ts:27:3 › Auth › POST /api/auth/login matches usernames case-insensitively (109ms) ✓ 68 [api] › tests/api/auth.spec.ts:47:3 › Auth › POST /api/auth/login rejects bad credentials (93ms) ✓ 69 [api] › tests/api/auth.spec.ts:66:3 › Auth › POST /api/auth/login validates the body (15ms) ✓ 70 [api] › tests/api/auth.spec.ts:77:3 › Auth › POST /api/auth/verify returns the current session (33ms) ✓ 71 [api] › tests/api/auth.spec.ts:98:3 › Auth › POST /api/auth/verify rejects anonymous, invalid and API key callers (30ms) ✓ 72 [api] › tests/api/auth.spec.ts:112:3 › Auth › POST /api/auth/logout acknowledges the logout (117ms) ✓ 73 [api] › tests/api/auth.spec.ts:122:3 › Auth › POST /api/auth/logout requires a session (19ms) ✓ 74 [api] › tests/api/boards.spec.ts:20:3 › Boards › POST /api/boards creates a board for the current user (25ms) ✓ 75 [api] › tests/api/boards.spec.ts:45:3 › Boards › POST /api/boards creates a board for a team (20ms) ✓ 76 [api] › tests/api/boards.spec.ts:61:3 › Boards › POST /api/boards validates the body (40ms) ✓ 77 [api] › tests/api/boards.spec.ts:87:3 › Boards › POST /api/boards requires a user that can create boards (68ms) ✓ 78 [api] › tests/api/boards.spec.ts:111:3 › Boards › GET /api/boards lists the caller own boards (58ms) ✓ 79 [api] › tests/api/boards.spec.ts:131:3 › Boards › GET /api/boards/{boardId} returns a board (85ms) ✓ 80 [api] › tests/api/boards.spec.ts:155:3 › Boards › POST /api/boards/{boardId} updates a board (58ms) ✓ 81 [api] › tests/api/boards.spec.ts:180:3 › Boards › POST /api/boards/{boardId}/clone copies a board (84ms) ✓ 82 [api] › tests/api/boards.spec.ts:208:3 › Boards › POST /api/boards/{boardId}/shares creates a share (54ms) ✓ 83 [api] › tests/api/boards.spec.ts:235:3 › Boards › GET /api/boards/{boardId}/shares lists the board shares (52ms) ✓ 84 [api] › tests/api/boards.spec.ts:256:3 › Boards › DELETE /api/boards/{boardId} deletes a board (80ms) ✓ 85 [api] › tests/api/boards.spec.ts:277:3 › Dashboard › POST /api/dashboard creates or updates the caller dashboard (53ms) ✓ 86 [api] › tests/api/boards.spec.ts:314:3 › Dashboard › GET /api/dashboard returns the caller dashboard (26ms) ✓ 87 [api] › tests/api/collection.spec.ts:28:3 › Collection › POST /api/send records a pageview and returns a cache token (17ms) ✓ 88 [api] › tests/api/collection.spec.ts:39:3 › Collection › POST /api/send continues the visit when the cache token is sent (18ms) ✓ 89 [api] › tests/api/collection.spec.ts:50:3 › Collection › POST /api/send records custom, identify and performance payloads (31ms) ✓ 90 [api] › tests/api/collection.spec.ts:79:3 › Collection › POST /api/send accepts link and pixel sources (37ms) ✓ 91 [api] › tests/api/collection.spec.ts:93:3 › Collection › POST /api/send rejects an unknown website (21ms) ✓ 92 [api] › tests/api/collection.spec.ts:100:3 › Collection › POST /api/send requires exactly one of website, link or pixel (13ms) ✓ 93 [api] › tests/api/collection.spec.ts:109:3 › Collection › POST /api/send rejects invalid payloads (16ms) ✓ 94 [api] › tests/api/collection.spec.ts:125:3 › Collection › POST /api/batch processes each payload and reports per-item errors (19ms) ✓ 95 [api] › tests/api/collection.spec.ts:146:3 › Collection › POST /api/batch validates the body (11ms) ✓ 96 [api] › tests/api/collection.spec.ts:157:3 › Collection › POST /api/record stores replay and heatmap events for a recorded visit (31ms) ✓ 97 [api] › tests/api/collection.spec.ts:204:3 › Collection › POST /api/record requires a session token (8ms) ✓ 98 [api] › tests/api/collection.spec.ts:214:3 › Collection › POST /api/record reports when the recorder is disabled (21ms) ✓ 99 [api] › tests/api/collection.spec.ts:226:3 › Collection › POST /api/record rejects invalid and oversized payloads (17ms) ✓ 100 [api] › tests/api/event-data.spec.ts:24:3 › Event data › GET /api/websites/{websiteId}/event-data lists events with their properties (101ms) ✓ 101 [api] › tests/api/event-data.spec.ts:78:3 › Event data › GET /api/websites/{websiteId}/event-data/{eventId} returns the raw rows of one event (35ms) ✓ 102 [api] › tests/api/event-data.spec.ts:111:3 › Event data › GET /api/websites/{websiteId}/event-data/events breaks properties down per value (83ms) ✓ 103 [api] › tests/api/event-data.spec.ts:158:3 › Event data › GET /api/websites/{websiteId}/event-data/fields lists the properties of an event (84ms) ✓ 104 [api] › tests/api/event-data.spec.ts:196:3 › Event data › GET /api/websites/{websiteId}/event-data/properties lists properties per event (69ms) ✓ 105 [api] › tests/api/event-data.spec.ts:226:3 › Event data › GET /api/websites/{websiteId}/event-data/stats returns totals (61ms) ✓ 106 [api] › tests/api/event-data.spec.ts:253:3 › Event data › GET /api/websites/{websiteId}/event-data/values returns value counts for a property (82ms) ✓ 107 [api] › tests/api/event-data.spec.ts:292:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot pivots event properties into columns (134ms) ✓ 108 [api] › tests/api/event-data.spec.ts:366:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/array-series expands array properties over time (93ms) ✓ 109 [api] › tests/api/event-data.spec.ts:405:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/date-series counts date properties (77ms) ✓ 110 [api] › tests/api/event-data.spec.ts:431:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/numeric-series aggregates numeric properties (115ms) ✓ 111 [api] › tests/api/event-data.spec.ts:487:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/numeric-stats summarises a numeric property (82ms) ✓ 112 [api] › tests/api/event-data.spec.ts:514:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/property-series counts property values over time (91ms) ✓ 113 [api] › tests/api/links.spec.ts:24:3 › Links › POST /api/links creates a link for the current user (20ms) ✓ 114 [api] › tests/api/links.spec.ts:44:3 › Links › POST /api/links accepts a fixed id and a team (35ms) ✓ 115 [api] › tests/api/links.spec.ts:60:3 › Links › POST /api/links validates the body and requires permission (39ms) ✓ 116 [api] › tests/api/links.spec.ts:89:3 › Links › GET /api/links lists the current user links (85ms) ✓ 117 [api] › tests/api/links.spec.ts:116:3 › Links › GET /api/links/{linkId} returns a link (72ms) ✓ 118 [api] › tests/api/links.spec.ts:133:3 › Links › POST /api/links/{linkId} updates a link (52ms) ✓ 119 [api] › tests/api/links.spec.ts:151:3 › Links › POST /api/links/{linkId}/shares creates a link share (41ms) ✓ 120 [api] › tests/api/links.spec.ts:174:3 › Links › GET /api/links/{linkId}/shares lists link shares (65ms) ✓ 121 [api] › tests/api/links.spec.ts:194:3 › Links › GET /api/links/charts returns chart data for accessible links (68ms) ✓ 122 [api] › tests/api/links.spec.ts:218:3 › Links › DELETE /api/links/{linkId} deletes a link (42ms) ✓ 123 [api] › tests/api/mcp.spec.ts:52:3 › MCP API-key authentication › rejects anonymous, invalid-key and browser-session callers without OAuth discovery (79ms) ✓ 124 [api] › tests/api/mcp.spec.ts:69:3 › MCP API-key authentication › initializes, lists read-only tools and queries seeded analytics with an API key (203ms) ✓ 125 [api] › tests/api/mcp.spec.ts:104:3 › MCP API-key authentication › enforces key-owner permissions and rejects a revoked key (114ms) ✓ 126 [api] › tests/api/pixels.spec.ts:24:3 › Pixels › POST /api/pixels creates a pixel for the current user (19ms) ✓ 127 [api] › tests/api/pixels.spec.ts:43:3 › Pixels › POST /api/pixels accepts a fixed id and a team (33ms) ✓ 128 [api] › tests/api/pixels.spec.ts:58:3 › Pixels › POST /api/pixels validates the body and requires permission (41ms) ✓ 129 [api] › tests/api/pixels.spec.ts:75:3 › Pixels › GET /api/pixels lists the current user pixels (90ms) ✓ 130 [api] › tests/api/pixels.spec.ts:102:3 › Pixels › GET /api/pixels/{pixelId} returns a pixel (61ms) ✓ 131 [api] › tests/api/pixels.spec.ts:119:3 › Pixels › POST /api/pixels/{pixelId} updates a pixel (47ms) ✓ 132 [api] › tests/api/pixels.spec.ts:133:3 › Pixels › POST /api/pixels/{pixelId}/shares creates a pixel share (41ms) ✓ 133 [api] › tests/api/pixels.spec.ts:156:3 › Pixels › GET /api/pixels/{pixelId}/shares lists pixel shares (56ms) ✓ 134 [api] › tests/api/pixels.spec.ts:180:3 › Pixels › GET /api/pixels/charts returns chart data for accessible pixels (57ms) ✓ 135 [api] › tests/api/pixels.spec.ts:204:3 › Pixels › DELETE /api/pixels/{pixelId} deletes a pixel (40ms) ✓ 136 [api] › tests/api/replays.spec.ts:32:3 › Replays › GET /api/websites/{websiteId}/replays lists recorded replays (107ms) ✓ 137 [api] › tests/api/replays.spec.ts:97:3 › Replays › GET /api/websites/{websiteId}/replays/{replayId} returns the recorded events (62ms) ✓ 138 [api] › tests/api/replays.spec.ts:148:3 › Replays › GET /api/websites/{websiteId}/replays/{replayId} truncates the events with until, chunkIndex and eventIndex (112ms) ✓ 139 [api] › tests/api/replays.spec.ts:201:3 › Replays › POST /api/websites/{websiteId}/replays/saved/{replayId} saves a replay (196ms) ✓ 140 [api] › tests/api/replays.spec.ts:279:3 › Replays › POST /api/websites/{websiteId}/replays/saved/{replayId} unsaves a replay (53ms) ✓ 141 [api] › tests/api/replays.spec.ts:299:3 › Replays › GET /api/websites/{websiteId}/sessions/{sessionId}/replays lists the replays of a session (90ms) ✓ 142 [api] › tests/api/report-migration.spec.ts:40:3 › GET journeys matches legacy journey results and access (92ms) ✓ 143 [api] › tests/api/report-migration.spec.ts:40:3 › GET retention matches legacy retention results and access (95ms) ✓ 144 [api] › tests/api/report-migration.spec.ts:40:3 › GET breakdown matches legacy breakdown results and access (89ms) ✓ 145 [api] › tests/api/report-migration.spec.ts:40:3 › GET attribution matches legacy attribution results and access (124ms) ✓ 146 [api] › tests/api/report-migration.spec.ts:40:3 › GET heatmaps matches legacy heatmap results and access (85ms) ✓ 147 [api] › tests/api/report-migration.spec.ts:40:3 › GET funnels/stats matches legacy funnel results and access (89ms) ✓ 148 [api] › tests/api/report-migration.spec.ts:40:3 › GET goals/stats matches legacy goal results and access (83ms) ✓ 149 [api] › tests/api/report-migration.spec.ts:87:3 › funnel definitions preserve IDs and scope saved stats to the website (222ms) ✓ 150 [api] › tests/api/report-migration.spec.ts:87:3 › goal definitions preserve IDs and scope saved stats to the website (209ms) ✓ 151 [api] › tests/api/report-migration.spec.ts:132:1 › performance and UTM datasets reproduce legacy aggregates (353ms) ✓ 152 [api] › tests/api/reports.spec.ts:28:3 › Saved reports › POST /api/reports creates a report (22ms) ✓ 153 [api] › tests/api/reports.spec.ts:52:3 › Saved reports › POST /api/reports validates the body (14ms) ✓ 154 [api] › tests/api/reports.spec.ts:76:3 › Saved reports › POST /api/reports requires update access to the website (60ms) ✓ 155 [api] › tests/api/reports.spec.ts:94:3 › Saved reports › GET /api/reports lists reports for a website (49ms) ✓ 156 [api] › tests/api/reports.spec.ts:117:3 › Saved reports › GET /api/reports validates websiteId and checks access (63ms) ✓ 157 [api] › tests/api/reports.spec.ts:146:3 › Saved reports › GET /api/websites/{websiteId}/reports lists the website reports (54ms) ✓ 158 [api] › tests/api/reports.spec.ts:169:3 › Saved reports › GET /api/reports/{reportId} returns a report (55ms) ✓ 159 [api] › tests/api/reports.spec.ts:187:3 › Saved reports › POST /api/reports/{reportId} updates a report (58ms) ✓ 160 [api] › tests/api/reports.spec.ts:213:3 › Saved reports › DELETE /api/reports/{reportId} deletes a report (56ms) ✓ 161 [api] › tests/api/reports.spec.ts:230:3 › Report runs › POST /api/reports/attribution returns attribution by channel (112ms) ✓ 162 [api] › tests/api/reports.spec.ts:279:3 › Report runs › POST /api/reports/breakdown returns rows grouped by field (83ms) ✓ 163 [api] › tests/api/reports.spec.ts:326:3 › Report runs › POST /api/reports/funnel returns conversion per step (63ms) ✓ 164 [api] › tests/api/reports.spec.ts:371:3 › Report runs › POST /api/reports/goal returns goal completion (79ms) ✓ 165 [api] › tests/api/reports.spec.ts:401:3 › Report runs › POST /api/reports/heatmap returns click and scroll data (74ms) ✓ 166 [api] › tests/api/reports.spec.ts:444:3 › Report runs › POST /api/reports/journey returns paths between steps (71ms) ✓ 167 [api] › tests/api/reports.spec.ts:484:3 › Report runs › POST /api/reports/performance returns web vitals (81ms) ✓ 168 [api] › tests/api/reports.spec.ts:524:3 › Report runs › POST /api/reports/retention returns cohorts by day (53ms) ✓ 169 [api] › tests/api/reports.spec.ts:551:3 › Report runs › POST /api/reports/revenue returns revenue totals (86ms) ✓ 170 [api] › tests/api/reports.spec.ts:592:3 › Report runs › POST /api/reports/utm returns views per utm parameter (59ms) ✓ 171 [api] › tests/api/reports.spec.ts:621:3 › Report runs › POST /api/reports/{type} validates the discriminator and envelope (40ms) ✓ 172 [api] › tests/api/revenue.spec.ts:22:3 › Revenue › GET /api/websites/{websiteId}/revenue/chart returns revenue per event over time (90ms) ✓ 173 [api] › tests/api/revenue.spec.ts:63:3 › Revenue › GET /api/websites/{websiteId}/revenue/metrics breaks revenue down by a dimension (163ms) ✓ 174 [api] › tests/api/revenue.spec.ts:136:3 › Revenue › GET /api/websites/{websiteId}/revenue/sessions lists sessions with revenue (112ms) ✓ 175 [api] › tests/api/revenue.spec.ts:192:3 › Revenue › GET /api/websites/{websiteId}/revenue/stats returns revenue totals (96ms) ✓ 176 [api] › tests/api/segments.spec.ts:35:3 › Segments › POST /api/websites/{websiteId}/segments creates a segment (27ms) ✓ 177 [api] › tests/api/segments.spec.ts:52:3 › Segments › POST /api/websites/{websiteId}/segments creates a cohort (20ms) ✓ 178 [api] › tests/api/segments.spec.ts:66:3 › Segments › POST /api/websites/{websiteId}/segments validates and requires permission (67ms) ✓ 179 [api] › tests/api/segments.spec.ts:93:3 › Segments › GET /api/websites/{websiteId}/segments lists segments by type (97ms) ✓ 180 [api] › tests/api/segments.spec.ts:127:3 › Segments › GET /api/websites/{websiteId}/segments/{segmentId} returns a segment (52ms) ✓ 181 [api] › tests/api/segments.spec.ts:141:3 › Segments › POST /api/websites/{websiteId}/segments/{segmentId} updates a segment (56ms) ✓ 182 [api] › tests/api/segments.spec.ts:171:3 › Segments › GET /api/websites/{websiteId}/stats accepts a segment filter (43ms) ✓ 183 [api] › tests/api/segments.spec.ts:189:3 › Segments › DELETE /api/websites/{websiteId}/segments/{segmentId} deletes a segment (74ms) ✓ 184 [api] › tests/api/session-data.spec.ts:23:3 › Session data › GET /api/websites/{websiteId}/session-data-pivot pivots session properties into columns (123ms) ✓ 185 [api] › tests/api/session-data.spec.ts:96:3 › Session data › GET /api/websites/{websiteId}/session-data/array-series expands array properties over time (74ms) ✓ 186 [api] › tests/api/session-data.spec.ts:134:3 › Session data › GET /api/websites/{websiteId}/session-data/date-series counts date properties (71ms) ✓ 187 [api] › tests/api/session-data.spec.ts:160:3 › Session data › GET /api/websites/{websiteId}/session-data/numeric-series aggregates numeric properties (112ms) ✓ 188 [api] › tests/api/session-data.spec.ts:205:3 › Session data › GET /api/websites/{websiteId}/session-data/numeric-stats summarises a numeric property (67ms) ✓ 189 [api] › tests/api/session-data.spec.ts:232:3 › Session data › GET /api/websites/{websiteId}/session-data/property-series counts property values over time (68ms) ✓ 190 [api] › tests/api/session-data.spec.ts:264:3 › Session data › GET /api/websites/{websiteId}/session-data/stats aggregates activity per property value (100ms) ✓ 191 [api] › tests/api/session-data.spec.ts:299:3 › Session data › GET /api/websites/{websiteId}/session-data/properties lists session properties (86ms) ✓ 192 [api] › tests/api/session-data.spec.ts:346:3 › Session data › GET /api/websites/{websiteId}/session-data/values returns value counts for a property (90ms) ✓ 193 [api] › tests/api/sessions.spec.ts:24:3 › Sessions › GET /api/websites/{websiteId}/sessions lists sessions with paging (70ms) ✓ 194 [api] › tests/api/sessions.spec.ts:52:3 › Sessions › GET /api/websites/{websiteId}/sessions filters by distinctId and search (93ms) ✓ 195 [api] › tests/api/sessions.spec.ts:87:3 › Sessions › GET /api/websites/{websiteId}/sessions validates params and permissions (51ms) ✓ 196 [api] › tests/api/sessions.spec.ts:107:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId} returns a session (93ms) ✓ 197 [api] › tests/api/sessions.spec.ts:142:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId}/activity returns the event log (71ms) ✓ 198 [api] › tests/api/sessions.spec.ts:178:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId}/properties returns session data (47ms) ✓ 199 [api] › tests/api/sessions.spec.ts:206:3 › Sessions › GET /api/websites/{websiteId}/sessions/stats returns session totals (68ms) ✓ 200 [api] › tests/api/sessions.spec.ts:236:3 › Sessions › GET /api/websites/{websiteId}/sessions/weekly returns a 7x24 grid (108ms) ✓ 201 [api] › tests/api/sessions.spec.ts:306:5 › Sessions › DELETE /api/websites/{websiteId}/sessions/{sessionId} › DELETE /api/websites/{websiteId}/sessions/{sessionId} deletes a session (163ms) ✓ 202 [api] › tests/api/shares.spec.ts:32:3 › Shares › POST /api/share creates a share for an entity (19ms) ✓ 203 [api] › tests/api/shares.spec.ts:57:3 › Shares › POST /api/share generates a slug when omitted (30ms) ✓ 204 [api] › tests/api/shares.spec.ts:71:3 › Shares › POST /api/share validates the body and checks entity access (49ms) ✓ 205 [api] › tests/api/shares.spec.ts:111:3 › Shares › GET /api/share/{slug} publicly resolves a share to a token (25ms) ✓ 206 [api] › tests/api/shares.spec.ts:129:3 › Shares › GET /api/share/id/{shareId} returns a share (41ms) ✓ 207 [api] › tests/api/shares.spec.ts:140:3 › Shares › POST /api/share/id/{shareId} updates a share (62ms) ✓ 208 [api] › tests/api/shares.spec.ts:172:3 › Shares › GET /api/websites/{websiteId}/shares lists website shares (75ms) ✓ 209 [api] › tests/api/shares.spec.ts:200:3 › Shares › POST /api/websites/{websiteId}/shares creates a website share (47ms) ✓ 210 [api] › tests/api/shares.spec.ts:221:3 › Shares › share parameters gate which sections a share token may access (55ms) ✓ 211 [api] › tests/api/shares.spec.ts:258:3 › Shares › DELETE /api/share/id/{shareId} deletes a share (41ms) ✓ 212 [api] › tests/api/system.spec.ts:4:3 › System › GET /api/heartbeat responds without authentication (8ms) ✓ 213 [api] › tests/api/system.spec.ts:11:3 › System › GET /api/config reports the runtime feature flags (10ms) ✓ 214 [api] › tests/api/system.spec.ts:25:3 › System › GET /api/scripts/telemetry serves a javascript response (10ms) ✓ 215 [api] › tests/api/teams.spec.ts:17:3 › Teams › POST /api/teams creates a team owned by the caller (19ms) ✓ 216 [api] › tests/api/teams.spec.ts:28:3 › Teams › POST /api/teams validates the body and requires authentication (19ms) ✓ 217 [api] › tests/api/teams.spec.ts:36:3 › Teams › GET /api/teams lists the caller teams (37ms) ✓ 218 [api] › tests/api/teams.spec.ts:46:3 › Teams › GET /api/teams/{teamId} returns the team (43ms) ✓ 219 [api] › tests/api/teams.spec.ts:59:3 › Teams › POST /api/teams/{teamId} updates the team (35ms) ✓ 220 [api] › tests/api/teams.spec.ts:72:3 › Teams › POST /api/teams/join adds the caller to a team (49ms) ✓ 221 [api] › tests/api/teams.spec.ts:84:3 › Teams › GET /api/teams/{teamId}/users lists the members (49ms) ✓ 222 [api] › tests/api/teams.spec.ts:99:3 › Teams › GET /api/teams/{teamId}/users/{userId} returns a member (31ms) ✓ 223 [api] › tests/api/teams.spec.ts:113:3 › Teams › POST /api/teams/{teamId}/users/{userId} updates a member role (47ms) ✓ 224 [api] › tests/api/teams.spec.ts:134:3 › Teams › DELETE /api/teams/{teamId}/users/{userId} removes a member (34ms) ✓ 225 [api] › tests/api/teams.spec.ts:143:3 › Teams › POST /api/teams/{teamId}/users adds a member (49ms) ✓ 226 [api] › tests/api/teams.spec.ts:168:3 › Teams › GET /api/teams/{teamId}/websites|boards|links|pixels list team resources (134ms) ✓ 227 [api] › tests/api/teams.spec.ts:196:3 › Teams › DELETE /api/teams/{teamId} deletes the team (42ms) ✓ 228 [api] › tests/api/two-factor.spec.ts:42:3 › Two-factor authentication › GET /api/2fa/status reports the initial state (53ms) ✓ 229 [api] › tests/api/two-factor.spec.ts:61:3 › Two-factor authentication › POST /api/2fa/setup/confirm rejects invalid bodies and missing setups (55ms) ✓ 230 [api] › tests/api/two-factor.spec.ts:80:3 › Two-factor authentication › POST /api/2fa/setup/initiate returns a secret and QR code (84ms) ✓ 231 [api] › tests/api/two-factor.spec.ts:100:3 › Two-factor authentication › POST /api/2fa/setup/cancel discards the pending setup (73ms) ✓ 232 [api] › tests/api/two-factor.spec.ts:119:3 › Two-factor authentication › POST /api/2fa/setup/initiate can be repeated and rejects wrong codes (65ms) ✓ 233 [api] › tests/api/two-factor.spec.ts:138:3 › Two-factor authentication › POST /api/2fa/setup/confirm enables 2FA and returns backup codes (4.2s) ✓ 234 [api] › tests/api/two-factor.spec.ts:166:3 › Two-factor authentication › POST /api/2fa/setup/initiate rejects users with 2FA enabled (31ms) ✓ 235 [api] › tests/api/two-factor.spec.ts:174:3 › Two-factor authentication › POST /api/auth/login returns a partial token when 2FA is enabled (112ms) ✓ 236 [api] › tests/api/two-factor.spec.ts:187:3 › Two-factor authentication › POST /api/2fa/verify rejects missing, invalid and non-partial tokens (62ms) ✓ 237 [api] › tests/api/two-factor.spec.ts:207:3 › Two-factor authentication › POST /api/2fa/verify validates the body (76ms) ✓ 238 [api] › tests/api/two-factor.spec.ts:222:3 › Two-factor authentication › POST /api/2fa/verify rejects a code that was already used (19ms) ✓ 239 [api] › tests/api/two-factor.spec.ts:233:3 › Two-factor authentication › POST /api/2fa/verify completes the login with a TOTP code (28.3s) ✓ 240 [api] › tests/api/two-factor.spec.ts:253:3 › Two-factor authentication › POST /api/2fa/verify accepts a backup code once (1.0s) ✓ 241 [api] › tests/api/two-factor.spec.ts:273:3 › Two-factor authentication › POST /api/2fa/disable validates the body and password (144ms) ✓ 242 [api] › tests/api/two-factor.spec.ts:297:3 › Two-factor authentication › POST /api/2fa/disable is forbidden while 2FA is required (72ms) ✓ 243 [api] › tests/api/two-factor.spec.ts:324:3 › Two-factor authentication › POST /api/2fa/disable turns 2FA off (29.6s) ✓ 244 [api] › tests/api/users.spec.ts:19:3 › Users › POST /api/users creates a user (99ms) ✓ 245 [api] › tests/api/users.spec.ts:33:3 › Users › POST /api/users rejects duplicates and invalid bodies (30ms) ✓ 246 [api] › tests/api/users.spec.ts:52:3 › Users › POST /api/users requires an admin session (34ms) ✓ 247 [api] › tests/api/users.spec.ts:61:3 › Users › GET /api/users/{userId} returns a user (141ms) ✓ 248 [api] › tests/api/users.spec.ts:75:3 › Users › POST /api/users/{userId} lets admins update role, username and password (378ms) ✓ 249 [api] › tests/api/users.spec.ts:95:3 › Users › POST /api/users/{userId} ignores role changes from non-admins (19ms) ✓ 250 [api] › tests/api/users.spec.ts:102:3 › Users › POST /api/users/{userId} rejects unknown users and other users (31ms) ✓ 251 [api] › tests/api/users.spec.ts:113:3 › Users › GET /api/users/{userId}/websites lists a user websites (57ms) ✓ 252 [api] › tests/api/users.spec.ts:132:3 › Users › GET /api/users/{userId}/teams lists a user teams (52ms) ✓ 253 [api] › tests/api/users.spec.ts:148:3 › Users › DELETE /api/users/{userId} deletes a user (79ms) ✓ 254 [api] › tests/api/websites.spec.ts:37:3 › Websites › POST /api/websites creates a website for the current user (18ms) ✓ 255 [api] › tests/api/websites.spec.ts:48:3 › Websites › POST /api/websites creates a website for a team (18ms) ✓ 256 [api] › tests/api/websites.spec.ts:61:3 › Websites › POST /api/websites accepts a fixed id (46ms) ✓ 257 [api] › tests/api/websites.spec.ts:75:3 › Websites › POST /api/websites validates the body (11ms) ✓ 258 [api] › tests/api/websites.spec.ts:84:3 › Websites › POST /api/websites requires a user that can create websites (27ms) ✓ 259 [api] › tests/api/websites.spec.ts:92:3 › Websites › GET /api/websites lists the current user websites (55ms) ✓ 260 [api] › tests/api/websites.spec.ts:104:3 › Websites › GET /api/websites?includeTeams includes team websites (19ms) ✓ 261 [api] › tests/api/websites.spec.ts:111:3 › Websites › GET /api/websites/{websiteId} returns a website (67ms) ✓ 262 [api] › tests/api/websites.spec.ts:131:3 › Websites › POST /api/websites/{websiteId} updates name and domain (37ms) ✓ 263 [api] › tests/api/websites.spec.ts:142:3 › Websites › POST /api/websites/{websiteId} manages the legacy share id (35ms) ✓ 264 [api] › tests/api/websites.spec.ts:152:3 › Websites › POST /api/websites/{websiteId} updates the recorder config (50ms) ✓ 265 [api] › tests/api/websites.spec.ts:173:3 › Websites › GET /api/websites/{websiteId}/recorder is public and CORS enabled (8ms) ✓ 266 [api] › tests/api/websites.spec.ts:181:3 › Websites › GET /api/websites/charts returns chart data for accessible websites (45ms) ✓ 267 [api] › tests/api/websites.spec.ts:202:3 › Websites › GET /api/websites/{websiteId}/daterange returns the data window (52ms) ✓ 268 [api] › tests/api/websites.spec.ts:221:3 › Websites › GET /api/websites/{websiteId}/export returns a zip archive (79ms) ✓ 269 [api] › tests/api/websites.spec.ts:241:3 › Websites › POST /api/websites/{websiteId}/reset clears the website data (74ms) ✓ 270 [api] › tests/api/websites.spec.ts:261:3 › Websites › POST /api/websites/{websiteId}/transfer moves a website between owners (66ms) ✓ 271 [api] › tests/api/websites.spec.ts:281:3 › Websites › DELETE /api/websites/{websiteId} deletes a website (70ms) 271 passed (1.5m) API coverage: 179/179 operations (177 covered, 2 allowlisted, 0 uncovered) Calls that did not match any documented operation: DELETE /api/reports/00000000-0000-4000-8000-000000000000 DELETE /api/reports/e1f4395d-4523-479c-9808-f4bd82bdbf97 GET /api/reports GET /api/reports/00000000-0000-4000-8000-000000000000 GET /api/reports/258f6732-5be0-4555-a55a-91ca92e37b1e GET /api/reports/8cd6aeac-1ffc-41f6-ab0d-d2d336b7030b GET /api/reports/e1f4395d-4523-479c-9808-f4bd82bdbf97 GET /api/websites/1e5a0000-0000-4000-8000-000000000001/reports POST /api/reports POST /api/reports/00000000-0000-4000-8000-000000000000 POST /api/reports/attribution POST /api/reports/breakdown POST /api/reports/e1f4395d-4523-479c-9808-f4bd82bdbf97 POST /api/reports/funnel POST /api/reports/goal POST /api/reports/heatmap POST /api/reports/journey POST /api/reports/performance POST /api/reports/retention POST /api/reports/revenue POST /api/reports/utm POST /mcp