Waiting for http://127.0.0.1:3000/api/heartbeat ... Seeded postgres environment in 2.7s (114 pageviews on example.test) Running 271 tests using 1 worker ✓ 1 [api] › tests/api/account.spec.ts:7:3 › Account › GET /api/me returns the session user (51ms) ✓ 2 [api] › tests/api/account.spec.ts:29:3 › Account › GET /api/me identifies API key callers (16ms) ✓ 3 [api] › tests/api/account.spec.ts:37:3 › Account › GET /api/me requires authentication (25ms) ✓ 4 [api] › tests/api/account.spec.ts:58:5 › Account › API keys › POST /api/me/api-keys creates a key (40ms) ✓ 5 [api] › tests/api/account.spec.ts:77:5 › Account › API keys › POST /api/me/api-keys validates the body (25ms) ✓ 6 [api] › tests/api/account.spec.ts:87:5 › Account › API keys › POST /api/me/api-keys rejects anonymous and API key callers (31ms) ✓ 7 [api] › tests/api/account.spec.ts:95:5 › Account › API keys › GET /api/me authenticates with the new key (14ms) ✓ 8 [api] › tests/api/account.spec.ts:103:5 › Account › API keys › GET /api/me/api-keys lists the caller keys without secrets (47ms) ✓ 9 [api] › tests/api/account.spec.ts:132:5 › Account › API keys › GET /api/me/api-keys rejects anonymous and API key callers (22ms) ✓ 10 [api] › tests/api/account.spec.ts:137:5 › Account › API keys › DELETE /api/me/api-keys/{keyId} rejects unknown and foreign keys (73ms) ✓ 11 [api] › tests/api/account.spec.ts:154:5 › Account › API keys › DELETE /api/me/api-keys/{keyId} revokes the key (45ms) ✓ 12 [api] › tests/api/account.spec.ts:192:5 › Account › Password › POST /api/me/password validates the body (28ms) ✓ 13 [api] › tests/api/account.spec.ts:206:5 › Account › Password › POST /api/me/password rejects a wrong current password (100ms) ✓ 14 [api] › tests/api/account.spec.ts:215:5 › Account › Password › POST /api/me/password rejects anonymous and API key callers (42ms) ✓ 15 [api] › tests/api/account.spec.ts:222:5 › Account › Password › POST /api/me/password changes the password and invalidates the session (397ms) ✓ 16 [api] › tests/api/account.spec.ts:246:3 › Account › GET /api/me/teams lists the caller teams (41ms) ✓ 17 [api] › tests/api/account.spec.ts:263:3 › Account › GET /api/me/teams supports paging and sorting (80ms) ✓ 18 [api] › tests/api/account.spec.ts:283:3 › Account › GET /api/me/teams accepts session and API key callers only (25ms) ✓ 19 [api] › tests/api/account.spec.ts:292:3 › Account › GET /api/me/websites lists the caller websites (40ms) ✓ 20 [api] › tests/api/account.spec.ts:313:3 › Account › GET /api/me/websites supports includeTeams, paging and sorting (42ms) ✓ 21 [api] › tests/api/account.spec.ts:328:3 › Account › GET /api/me/websites accepts session and API key callers only (21ms) ✓ 22 [api] › tests/api/admin.spec.ts:8:5 › Admin › Listings › GET /api/admin/users lists every user (23ms) ✓ 23 [api] › tests/api/admin.spec.ts:36:5 › Admin › Listings › GET /api/admin/users supports search, sorting and paging (87ms) ✓ 24 [api] › tests/api/admin.spec.ts:68:5 › Admin › Listings › GET /api/admin/users requires an admin session (42ms) ✓ 25 [api] › tests/api/admin.spec.ts:81:5 › Admin › Listings › GET /api/admin/websites lists every website with its owner (22ms) ✓ 26 [api] › tests/api/admin.spec.ts:102:5 › Admin › Listings › GET /api/admin/websites supports search, sorting and paging (93ms) ✓ 27 [api] › tests/api/admin.spec.ts:134:5 › Admin › Listings › GET /api/admin/websites requires an admin session (29ms) ✓ 28 [api] › tests/api/admin.spec.ts:140:5 › Admin › Listings › GET /api/admin/teams lists every team with members (21ms) ✓ 29 [api] › tests/api/admin.spec.ts:160:5 › Admin › Listings › GET /api/admin/teams supports search, sorting and paging (58ms) ✓ 30 [api] › tests/api/admin.spec.ts:181:5 › Admin › Listings › GET /api/admin/teams requires an admin session (31ms) ✓ 31 [api] › tests/api/admin.spec.ts:196:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global validates the body (14ms) ✓ 32 [api] › tests/api/admin.spec.ts:204:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global requires an admin session (30ms) ✓ 33 [api] › tests/api/admin.spec.ts:210:5 › Admin › Global 2FA enforcement › POST /api/admin/2fa/global toggles the global requirement (92ms) ✓ 34 [api] › tests/api/admin.spec.ts:261:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa validates the body (18ms) ✓ 35 [api] › tests/api/admin.spec.ts:269:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa requires an admin session (34ms) ✓ 36 [api] › tests/api/admin.spec.ts:281:5 › Admin › Team 2FA enforcement › POST /api/admin/teams/{teamId}/2fa toggles the team requirement (68ms) ✓ 37 [api] › tests/api/admin.spec.ts:325:5 › Admin › User 2FA enforcement › GET /api/admin/users/{userId}/2fa reports whether 2FA is enabled (35ms) ✓ 38 [api] › tests/api/admin.spec.ts:336:5 › Admin › User 2FA enforcement › GET /api/admin/users/{userId}/2fa requires an admin session (28ms) ✓ 39 [api] › tests/api/admin.spec.ts:346:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa validates the body (12ms) ✓ 40 [api] › tests/api/admin.spec.ts:354:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa requires an admin session (33ms) ✓ 41 [api] › tests/api/admin.spec.ts:366:5 › Admin › User 2FA enforcement › POST /api/admin/users/{userId}/2fa toggles the user requirement (80ms) ✓ 42 [api] › tests/api/admin.spec.ts:399:5 › Admin › User 2FA enforcement › DELETE /api/admin/users/{userId}/2fa resets the user 2FA state (138ms) ✓ 43 [api] › tests/api/analytics.spec.ts:10:3 › Analytics › GET /api/websites/{websiteId}/stats returns totals for the range (51ms) ✓ 44 [api] › tests/api/analytics.spec.ts:35:3 › Analytics › GET /api/websites/{websiteId}/stats applies filters (55ms) ✓ 45 [api] › tests/api/analytics.spec.ts:51:3 › Analytics › GET /api/websites/{websiteId}/stats validates params and permissions (54ms) ✓ 46 [api] › tests/api/analytics.spec.ts:71:3 › Analytics › GET /api/websites/{websiteId}/pageviews returns pageview and session series (64ms) ✓ 47 [api] › tests/api/analytics.spec.ts:98:3 › Analytics › GET /api/websites/{websiteId}/pageviews supports compare and validates unit (31ms) ✓ 48 [api] › tests/api/analytics.spec.ts:120:3 › Analytics › GET /api/websites/{websiteId}/metrics returns session, pageview and event metrics (99ms) ✓ 49 [api] › tests/api/analytics.spec.ts:157:3 › Analytics › GET /api/websites/{websiteId}/metrics supports search, limit and offset (45ms) ✓ 50 [api] › tests/api/analytics.spec.ts:182:3 › Analytics › GET /api/websites/{websiteId}/metrics validates type and permissions (56ms) ✓ 51 [api] › tests/api/analytics.spec.ts:200:3 › Analytics › GET /api/websites/{websiteId}/metrics/expanded returns rows with breakdown totals (53ms) ✓ 52 [api] › tests/api/analytics.spec.ts:231:3 › Analytics › GET /api/websites/{websiteId}/values returns distinct values for a field (83ms) ✓ 53 [api] › tests/api/analytics.spec.ts:271:3 › Analytics › GET /api/websites/{websiteId}/values rejects unsupported types (16ms) ✓ 54 [api] › tests/api/analytics.spec.ts:285:3 › Analytics › GET /api/websites/{websiteId}/active returns the active visitor count (52ms) ✓ 55 [api] › tests/api/analytics.spec.ts:303:3 › Analytics › GET /api/websites/{websiteId}/events lists events with paging (39ms) ✓ 56 [api] › tests/api/analytics.spec.ts:334:3 › Analytics › GET /api/websites/{websiteId}/events filters custom events and validates (79ms) ✓ 57 [api] › tests/api/analytics.spec.ts:375:3 › Analytics › GET /api/websites/{websiteId}/events/series returns per-event time series (83ms) ✓ 58 [api] › tests/api/analytics.spec.ts:408:3 › Analytics › GET /api/websites/{websiteId}/events/stats returns event totals (64ms) ✓ 59 [api] › tests/api/analytics.spec.ts:434:3 › Analytics › GET /api/realtime/{websiteId} returns realtime activity (77ms) ✓ 60 [api] › tests/api/annotations.spec.ts:25:3 › Annotations › POST /api/websites/{websiteId}/annotations creates an annotation (21ms) ✓ 61 [api] › tests/api/annotations.spec.ts:46:3 › Annotations › POST /api/websites/{websiteId}/annotations validates and requires permission (54ms) ✓ 62 [api] › tests/api/annotations.spec.ts:69:3 › Annotations › GET /api/websites/{websiteId}/annotations lists annotations (111ms) ✓ 63 [api] › tests/api/annotations.spec.ts:103:3 › Annotations › GET /api/websites/{websiteId}/annotations/{annotationId} returns an annotation (48ms) ✓ 64 [api] › tests/api/annotations.spec.ts:117:3 › Annotations › POST /api/websites/{websiteId}/annotations/{annotationId} updates an annotation (52ms) ✓ 65 [api] › tests/api/annotations.spec.ts:150:3 › Annotations › DELETE /api/websites/{websiteId}/annotations/{annotationId} deletes an annotation (54ms) ✓ 66 [api] › tests/api/auth.spec.ts:5:3 › Auth › POST /api/auth/login returns a token and the user (98ms) ✓ 67 [api] › tests/api/auth.spec.ts:27:3 › Auth › POST /api/auth/login matches usernames case-insensitively (110ms) ✓ 68 [api] › tests/api/auth.spec.ts:47:3 › Auth › POST /api/auth/login rejects bad credentials (93ms) ✓ 69 [api] › tests/api/auth.spec.ts:66:3 › Auth › POST /api/auth/login validates the body (13ms) ✓ 70 [api] › tests/api/auth.spec.ts:77:3 › Auth › POST /api/auth/verify returns the current session (31ms) ✓ 71 [api] › tests/api/auth.spec.ts:98:3 › Auth › POST /api/auth/verify rejects anonymous, invalid and API key callers (25ms) ✓ 72 [api] › tests/api/auth.spec.ts:112:3 › Auth › POST /api/auth/logout acknowledges the logout (109ms) ✓ 73 [api] › tests/api/auth.spec.ts:122:3 › Auth › POST /api/auth/logout requires a session (16ms) ✓ 74 [api] › tests/api/boards.spec.ts:20:3 › Boards › POST /api/boards creates a board for the current user (21ms) ✓ 75 [api] › tests/api/boards.spec.ts:45:3 › Boards › POST /api/boards creates a board for a team (17ms) ✓ 76 [api] › tests/api/boards.spec.ts:61:3 › Boards › POST /api/boards validates the body (29ms) ✓ 77 [api] › tests/api/boards.spec.ts:87:3 › Boards › POST /api/boards requires a user that can create boards (53ms) ✓ 78 [api] › tests/api/boards.spec.ts:111:3 › Boards › GET /api/boards lists the caller own boards (52ms) ✓ 79 [api] › tests/api/boards.spec.ts:131:3 › Boards › GET /api/boards/{boardId} returns a board (74ms) ✓ 80 [api] › tests/api/boards.spec.ts:155:3 › Boards › POST /api/boards/{boardId} updates a board (56ms) ✓ 81 [api] › tests/api/boards.spec.ts:180:3 › Boards › POST /api/boards/{boardId}/clone copies a board (77ms) ✓ 82 [api] › tests/api/boards.spec.ts:208:3 › Boards › POST /api/boards/{boardId}/shares creates a share (51ms) ✓ 83 [api] › tests/api/boards.spec.ts:235:3 › Boards › GET /api/boards/{boardId}/shares lists the board shares (47ms) ✓ 84 [api] › tests/api/boards.spec.ts:256:3 › Boards › DELETE /api/boards/{boardId} deletes a board (66ms) ✓ 85 [api] › tests/api/boards.spec.ts:277:3 › Dashboard › POST /api/dashboard creates or updates the caller dashboard (50ms) ✓ 86 [api] › tests/api/boards.spec.ts:314:3 › Dashboard › GET /api/dashboard returns the caller dashboard (25ms) ✓ 87 [api] › tests/api/collection.spec.ts:28:3 › Collection › POST /api/send records a pageview and returns a cache token (13ms) ✓ 88 [api] › tests/api/collection.spec.ts:39:3 › Collection › POST /api/send continues the visit when the cache token is sent (18ms) ✓ 89 [api] › tests/api/collection.spec.ts:50:3 › Collection › POST /api/send records custom, identify and performance payloads (31ms) ✓ 90 [api] › tests/api/collection.spec.ts:79:3 › Collection › POST /api/send accepts link and pixel sources (15ms) ✓ 91 [api] › tests/api/collection.spec.ts:93:3 › Collection › POST /api/send rejects an unknown website (9ms) ✓ 92 [api] › tests/api/collection.spec.ts:100:3 › Collection › POST /api/send requires exactly one of website, link or pixel (11ms) ✓ 93 [api] › tests/api/collection.spec.ts:109:3 › Collection › POST /api/send rejects invalid payloads (14ms) ✓ 94 [api] › tests/api/collection.spec.ts:125:3 › Collection › POST /api/batch processes each payload and reports per-item errors (17ms) ✓ 95 [api] › tests/api/collection.spec.ts:146:3 › Collection › POST /api/batch validates the body (11ms) ✓ 96 [api] › tests/api/collection.spec.ts:157:3 › Collection › POST /api/record stores replay and heatmap events for a recorded visit (32ms) ✓ 97 [api] › tests/api/collection.spec.ts:204:3 › Collection › POST /api/record requires a session token (11ms) ✓ 98 [api] › tests/api/collection.spec.ts:214:3 › Collection › POST /api/record reports when the recorder is disabled (32ms) ✓ 99 [api] › tests/api/collection.spec.ts:226:3 › Collection › POST /api/record rejects invalid and oversized payloads (18ms) ✓ 100 [api] › tests/api/event-data.spec.ts:24:3 › Event data › GET /api/websites/{websiteId}/event-data lists events with their properties (102ms) ✓ 101 [api] › tests/api/event-data.spec.ts:78:3 › Event data › GET /api/websites/{websiteId}/event-data/{eventId} returns the raw rows of one event (39ms) ✓ 102 [api] › tests/api/event-data.spec.ts:111:3 › Event data › GET /api/websites/{websiteId}/event-data/events breaks properties down per value (84ms) ✓ 103 [api] › tests/api/event-data.spec.ts:158:3 › Event data › GET /api/websites/{websiteId}/event-data/fields lists the properties of an event (79ms) ✓ 104 [api] › tests/api/event-data.spec.ts:196:3 › Event data › GET /api/websites/{websiteId}/event-data/properties lists properties per event (64ms) ✓ 105 [api] › tests/api/event-data.spec.ts:226:3 › Event data › GET /api/websites/{websiteId}/event-data/stats returns totals (63ms) ✓ 106 [api] › tests/api/event-data.spec.ts:253:3 › Event data › GET /api/websites/{websiteId}/event-data/values returns value counts for a property (77ms) ✓ 107 [api] › tests/api/event-data.spec.ts:292:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot pivots event properties into columns (123ms) ✓ 108 [api] › tests/api/event-data.spec.ts:366:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/array-series expands array properties over time (72ms) ✓ 109 [api] › tests/api/event-data.spec.ts:405:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/date-series counts date properties (71ms) ✓ 110 [api] › tests/api/event-data.spec.ts:431:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/numeric-series aggregates numeric properties (107ms) ✓ 111 [api] › tests/api/event-data.spec.ts:487:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/numeric-stats summarises a numeric property (80ms) ✓ 112 [api] › tests/api/event-data.spec.ts:514:3 › Event data › GET /api/websites/{websiteId}/event-data-pivot/property-series counts property values over time (92ms) ✓ 113 [api] › tests/api/links.spec.ts:24:3 › Links › POST /api/links creates a link for the current user (20ms) ✓ 114 [api] › tests/api/links.spec.ts:44:3 › Links › POST /api/links accepts a fixed id and a team (33ms) ✓ 115 [api] › tests/api/links.spec.ts:60:3 › Links › POST /api/links validates the body and requires permission (38ms) ✓ 116 [api] › tests/api/links.spec.ts:89:3 › Links › GET /api/links lists the current user links (88ms) ✓ 117 [api] › tests/api/links.spec.ts:116:3 › Links › GET /api/links/{linkId} returns a link (71ms) ✓ 118 [api] › tests/api/links.spec.ts:133:3 › Links › POST /api/links/{linkId} updates a link (51ms) ✓ 119 [api] › tests/api/links.spec.ts:151:3 › Links › POST /api/links/{linkId}/shares creates a link share (41ms) ✓ 120 [api] › tests/api/links.spec.ts:174:3 › Links › GET /api/links/{linkId}/shares lists link shares (59ms) ✓ 121 [api] › tests/api/links.spec.ts:194:3 › Links › GET /api/links/charts returns chart data for accessible links (65ms) ✓ 122 [api] › tests/api/links.spec.ts:218:3 › Links › DELETE /api/links/{linkId} deletes a link (51ms) ✓ 123 [api] › tests/api/mcp.spec.ts:52:3 › MCP API-key authentication › rejects anonymous, invalid-key and browser-session callers without OAuth discovery (94ms) ✓ 124 [api] › tests/api/mcp.spec.ts:69:3 › MCP API-key authentication › initializes, lists read-only tools and queries seeded analytics with an API key (199ms) ✓ 125 [api] › tests/api/mcp.spec.ts:104:3 › MCP API-key authentication › enforces key-owner permissions and rejects a revoked key (114ms) ✓ 126 [api] › tests/api/pixels.spec.ts:24:3 › Pixels › POST /api/pixels creates a pixel for the current user (18ms) ✓ 127 [api] › tests/api/pixels.spec.ts:43:3 › Pixels › POST /api/pixels accepts a fixed id and a team (32ms) ✓ 128 [api] › tests/api/pixels.spec.ts:58:3 › Pixels › POST /api/pixels validates the body and requires permission (37ms) ✓ 129 [api] › tests/api/pixels.spec.ts:75:3 › Pixels › GET /api/pixels lists the current user pixels (80ms) ✓ 130 [api] › tests/api/pixels.spec.ts:102:3 › Pixels › GET /api/pixels/{pixelId} returns a pixel (69ms) ✓ 131 [api] › tests/api/pixels.spec.ts:119:3 › Pixels › POST /api/pixels/{pixelId} updates a pixel (56ms) ✓ 132 [api] › tests/api/pixels.spec.ts:133:3 › Pixels › POST /api/pixels/{pixelId}/shares creates a pixel share (41ms) ✓ 133 [api] › tests/api/pixels.spec.ts:156:3 › Pixels › GET /api/pixels/{pixelId}/shares lists pixel shares (57ms) ✓ 134 [api] › tests/api/pixels.spec.ts:180:3 › Pixels › GET /api/pixels/charts returns chart data for accessible pixels (61ms) ✓ 135 [api] › tests/api/pixels.spec.ts:204:3 › Pixels › DELETE /api/pixels/{pixelId} deletes a pixel (42ms) ✓ 136 [api] › tests/api/replays.spec.ts:32:3 › Replays › GET /api/websites/{websiteId}/replays lists recorded replays (98ms) ✓ 137 [api] › tests/api/replays.spec.ts:97:3 › Replays › GET /api/websites/{websiteId}/replays/{replayId} returns the recorded events (61ms) ✓ 138 [api] › tests/api/replays.spec.ts:148:3 › Replays › GET /api/websites/{websiteId}/replays/{replayId} truncates the events with until, chunkIndex and eventIndex (111ms) ✓ 139 [api] › tests/api/replays.spec.ts:201:3 › Replays › POST /api/websites/{websiteId}/replays/saved/{replayId} saves a replay (228ms) ✓ 140 [api] › tests/api/replays.spec.ts:279:3 › Replays › POST /api/websites/{websiteId}/replays/saved/{replayId} unsaves a replay (61ms) ✓ 141 [api] › tests/api/replays.spec.ts:299:3 › Replays › GET /api/websites/{websiteId}/sessions/{sessionId}/replays lists the replays of a session (99ms) ✓ 142 [api] › tests/api/report-migration.spec.ts:40:3 › GET journeys matches legacy journey results and access (99ms) ✓ 143 [api] › tests/api/report-migration.spec.ts:40:3 › GET retention matches legacy retention results and access (89ms) ✓ 144 [api] › tests/api/report-migration.spec.ts:40:3 › GET breakdown matches legacy breakdown results and access (94ms) ✓ 145 [api] › tests/api/report-migration.spec.ts:40:3 › GET attribution matches legacy attribution results and access (134ms) ✓ 146 [api] › tests/api/report-migration.spec.ts:40:3 › GET heatmaps matches legacy heatmap results and access (97ms) ✓ 147 [api] › tests/api/report-migration.spec.ts:40:3 › GET funnels/stats matches legacy funnel results and access (89ms) ✓ 148 [api] › tests/api/report-migration.spec.ts:40:3 › GET goals/stats matches legacy goal results and access (88ms) ✓ 149 [api] › tests/api/report-migration.spec.ts:87:3 › funnel definitions preserve IDs and scope saved stats to the website (237ms) ✓ 150 [api] › tests/api/report-migration.spec.ts:87:3 › goal definitions preserve IDs and scope saved stats to the website (263ms) ✓ 151 [api] › tests/api/report-migration.spec.ts:132:1 › performance and UTM datasets reproduce legacy aggregates (398ms) ✓ 152 [api] › tests/api/reports.spec.ts:28:3 › Saved reports › POST /api/reports creates a report (26ms) ✓ 153 [api] › tests/api/reports.spec.ts:52:3 › Saved reports › POST /api/reports validates the body (18ms) ✓ 154 [api] › tests/api/reports.spec.ts:76:3 › Saved reports › POST /api/reports requires update access to the website (58ms) ✓ 155 [api] › tests/api/reports.spec.ts:94:3 › Saved reports › GET /api/reports lists reports for a website (49ms) ✓ 156 [api] › tests/api/reports.spec.ts:117:3 › Saved reports › GET /api/reports validates websiteId and checks access (68ms) ✓ 157 [api] › tests/api/reports.spec.ts:146:3 › Saved reports › GET /api/websites/{websiteId}/reports lists the website reports (53ms) ✓ 158 [api] › tests/api/reports.spec.ts:169:3 › Saved reports › GET /api/reports/{reportId} returns a report (54ms) ✓ 159 [api] › tests/api/reports.spec.ts:187:3 › Saved reports › POST /api/reports/{reportId} updates a report (61ms) ✓ 160 [api] › tests/api/reports.spec.ts:213:3 › Saved reports › DELETE /api/reports/{reportId} deletes a report (60ms) ✓ 161 [api] › tests/api/reports.spec.ts:230:3 › Report runs › POST /api/reports/attribution returns attribution by channel (117ms) ✓ 162 [api] › tests/api/reports.spec.ts:279:3 › Report runs › POST /api/reports/breakdown returns rows grouped by field (86ms) ✓ 163 [api] › tests/api/reports.spec.ts:326:3 › Report runs › POST /api/reports/funnel returns conversion per step (78ms) ✓ 164 [api] › tests/api/reports.spec.ts:371:3 › Report runs › POST /api/reports/goal returns goal completion (81ms) ✓ 165 [api] › tests/api/reports.spec.ts:401:3 › Report runs › POST /api/reports/heatmap returns click and scroll data (76ms) ✓ 166 [api] › tests/api/reports.spec.ts:444:3 › Report runs › POST /api/reports/journey returns paths between steps (78ms) ✓ 167 [api] › tests/api/reports.spec.ts:484:3 › Report runs › POST /api/reports/performance returns web vitals (91ms) ✓ 168 [api] › tests/api/reports.spec.ts:524:3 › Report runs › POST /api/reports/retention returns cohorts by day (56ms) ✓ 169 [api] › tests/api/reports.spec.ts:551:3 › Report runs › POST /api/reports/revenue returns revenue totals (96ms) ✓ 170 [api] › tests/api/reports.spec.ts:592:3 › Report runs › POST /api/reports/utm returns views per utm parameter (69ms) ✓ 171 [api] › tests/api/reports.spec.ts:621:3 › Report runs › POST /api/reports/{type} validates the discriminator and envelope (51ms) ✓ 172 [api] › tests/api/revenue.spec.ts:22:3 › Revenue › GET /api/websites/{websiteId}/revenue/chart returns revenue per event over time (77ms) ✓ 173 [api] › tests/api/revenue.spec.ts:63:3 › Revenue › GET /api/websites/{websiteId}/revenue/metrics breaks revenue down by a dimension (137ms) ✓ 174 [api] › tests/api/revenue.spec.ts:136:3 › Revenue › GET /api/websites/{websiteId}/revenue/sessions lists sessions with revenue (113ms) ✓ 175 [api] › tests/api/revenue.spec.ts:192:3 › Revenue › GET /api/websites/{websiteId}/revenue/stats returns revenue totals (90ms) ✓ 176 [api] › tests/api/segments.spec.ts:35:3 › Segments › POST /api/websites/{websiteId}/segments creates a segment (25ms) ✓ 177 [api] › tests/api/segments.spec.ts:52:3 › Segments › POST /api/websites/{websiteId}/segments creates a cohort (19ms) ✓ 178 [api] › tests/api/segments.spec.ts:66:3 › Segments › POST /api/websites/{websiteId}/segments validates and requires permission (58ms) ✓ 179 [api] › tests/api/segments.spec.ts:93:3 › Segments › GET /api/websites/{websiteId}/segments lists segments by type (87ms) ✓ 180 [api] › tests/api/segments.spec.ts:127:3 › Segments › GET /api/websites/{websiteId}/segments/{segmentId} returns a segment (50ms) ✓ 181 [api] › tests/api/segments.spec.ts:141:3 › Segments › POST /api/websites/{websiteId}/segments/{segmentId} updates a segment (57ms) ✓ 182 [api] › tests/api/segments.spec.ts:171:3 › Segments › GET /api/websites/{websiteId}/stats accepts a segment filter (44ms) ✓ 183 [api] › tests/api/segments.spec.ts:189:3 › Segments › DELETE /api/websites/{websiteId}/segments/{segmentId} deletes a segment (76ms) ✓ 184 [api] › tests/api/session-data.spec.ts:23:3 › Session data › GET /api/websites/{websiteId}/session-data-pivot pivots session properties into columns (117ms) ✓ 185 [api] › tests/api/session-data.spec.ts:96:3 › Session data › GET /api/websites/{websiteId}/session-data/array-series expands array properties over time (72ms) ✓ 186 [api] › tests/api/session-data.spec.ts:134:3 › Session data › GET /api/websites/{websiteId}/session-data/date-series counts date properties (102ms) ✓ 187 [api] › tests/api/session-data.spec.ts:160:3 › Session data › GET /api/websites/{websiteId}/session-data/numeric-series aggregates numeric properties (107ms) ✓ 188 [api] › tests/api/session-data.spec.ts:205:3 › Session data › GET /api/websites/{websiteId}/session-data/numeric-stats summarises a numeric property (64ms) ✓ 189 [api] › tests/api/session-data.spec.ts:232:3 › Session data › GET /api/websites/{websiteId}/session-data/property-series counts property values over time (65ms) ✓ 190 [api] › tests/api/session-data.spec.ts:264:3 › Session data › GET /api/websites/{websiteId}/session-data/stats aggregates activity per property value (66ms) ✓ 191 [api] › tests/api/session-data.spec.ts:299:3 › Session data › GET /api/websites/{websiteId}/session-data/properties lists session properties (83ms) ✓ 192 [api] › tests/api/session-data.spec.ts:346:3 › Session data › GET /api/websites/{websiteId}/session-data/values returns value counts for a property (81ms) ✓ 193 [api] › tests/api/sessions.spec.ts:24:3 › Sessions › GET /api/websites/{websiteId}/sessions lists sessions with paging (71ms) ✓ 194 [api] › tests/api/sessions.spec.ts:52:3 › Sessions › GET /api/websites/{websiteId}/sessions filters by distinctId and search (90ms) ✓ 195 [api] › tests/api/sessions.spec.ts:87:3 › Sessions › GET /api/websites/{websiteId}/sessions validates params and permissions (48ms) ✓ 196 [api] › tests/api/sessions.spec.ts:107:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId} returns a session (91ms) ✓ 197 [api] › tests/api/sessions.spec.ts:142:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId}/activity returns the event log (66ms) ✓ 198 [api] › tests/api/sessions.spec.ts:178:3 › Sessions › GET /api/websites/{websiteId}/sessions/{sessionId}/properties returns session data (45ms) ✓ 199 [api] › tests/api/sessions.spec.ts:206:3 › Sessions › GET /api/websites/{websiteId}/sessions/stats returns session totals (60ms) ✓ 200 [api] › tests/api/sessions.spec.ts:236:3 › Sessions › GET /api/websites/{websiteId}/sessions/weekly returns a 7x24 grid (108ms) ✓ 201 [api] › tests/api/sessions.spec.ts:306:5 › Sessions › DELETE /api/websites/{websiteId}/sessions/{sessionId} › DELETE /api/websites/{websiteId}/sessions/{sessionId} deletes a session (124ms) ✓ 202 [api] › tests/api/shares.spec.ts:32:3 › Shares › POST /api/share creates a share for an entity (20ms) ✓ 203 [api] › tests/api/shares.spec.ts:57:3 › Shares › POST /api/share generates a slug when omitted (52ms) ✓ 204 [api] › tests/api/shares.spec.ts:71:3 › Shares › POST /api/share validates the body and checks entity access (52ms) ✓ 205 [api] › tests/api/shares.spec.ts:111:3 › Shares › GET /api/share/{slug} publicly resolves a share to a token (22ms) ✓ 206 [api] › tests/api/shares.spec.ts:129:3 › Shares › GET /api/share/id/{shareId} returns a share (47ms) ✓ 207 [api] › tests/api/shares.spec.ts:140:3 › Shares › POST /api/share/id/{shareId} updates a share (77ms) ✓ 208 [api] › tests/api/shares.spec.ts:172:3 › Shares › GET /api/websites/{websiteId}/shares lists website shares (82ms) ✓ 209 [api] › tests/api/shares.spec.ts:200:3 › Shares › POST /api/websites/{websiteId}/shares creates a website share (35ms) ✓ 210 [api] › tests/api/shares.spec.ts:221:3 › Shares › share parameters gate which sections a share token may access (51ms) ✓ 211 [api] › tests/api/shares.spec.ts:258:3 › Shares › DELETE /api/share/id/{shareId} deletes a share (35ms) ✓ 212 [api] › tests/api/system.spec.ts:4:3 › System › GET /api/heartbeat responds without authentication (7ms) ✓ 213 [api] › tests/api/system.spec.ts:11:3 › System › GET /api/config reports the runtime feature flags (10ms) ✓ 214 [api] › tests/api/system.spec.ts:25:3 › System › GET /api/scripts/telemetry serves a javascript response (9ms) ✓ 215 [api] › tests/api/teams.spec.ts:17:3 › Teams › POST /api/teams creates a team owned by the caller (27ms) ✓ 216 [api] › tests/api/teams.spec.ts:28:3 › Teams › POST /api/teams validates the body and requires authentication (19ms) ✓ 217 [api] › tests/api/teams.spec.ts:36:3 › Teams › GET /api/teams lists the caller teams (35ms) ✓ 218 [api] › tests/api/teams.spec.ts:46:3 › Teams › GET /api/teams/{teamId} returns the team (41ms) ✓ 219 [api] › tests/api/teams.spec.ts:59:3 › Teams › POST /api/teams/{teamId} updates the team (36ms) ✓ 220 [api] › tests/api/teams.spec.ts:72:3 › Teams › POST /api/teams/join adds the caller to a team (48ms) ✓ 221 [api] › tests/api/teams.spec.ts:84:3 › Teams › GET /api/teams/{teamId}/users lists the members (47ms) ✓ 222 [api] › tests/api/teams.spec.ts:99:3 › Teams › GET /api/teams/{teamId}/users/{userId} returns a member (33ms) ✓ 223 [api] › tests/api/teams.spec.ts:113:3 › Teams › POST /api/teams/{teamId}/users/{userId} updates a member role (45ms) ✓ 224 [api] › tests/api/teams.spec.ts:134:3 › Teams › DELETE /api/teams/{teamId}/users/{userId} removes a member (36ms) ✓ 225 [api] › tests/api/teams.spec.ts:143:3 › Teams › POST /api/teams/{teamId}/users adds a member (49ms) ✓ 226 [api] › tests/api/teams.spec.ts:168:3 › Teams › GET /api/teams/{teamId}/websites|boards|links|pixels list team resources (150ms) ✓ 227 [api] › tests/api/teams.spec.ts:196:3 › Teams › DELETE /api/teams/{teamId} deletes the team (42ms) ✓ 228 [api] › tests/api/two-factor.spec.ts:42:3 › Two-factor authentication › GET /api/2fa/status reports the initial state (38ms) ✓ 229 [api] › tests/api/two-factor.spec.ts:61:3 › Two-factor authentication › POST /api/2fa/setup/confirm rejects invalid bodies and missing setups (45ms) ✓ 230 [api] › tests/api/two-factor.spec.ts:80:3 › Two-factor authentication › POST /api/2fa/setup/initiate returns a secret and QR code (65ms) ✓ 231 [api] › tests/api/two-factor.spec.ts:100:3 › Two-factor authentication › POST /api/2fa/setup/cancel discards the pending setup (57ms) ✓ 232 [api] › tests/api/two-factor.spec.ts:119:3 › Two-factor authentication › POST /api/2fa/setup/initiate can be repeated and rejects wrong codes (64ms) ✓ 233 [api] › tests/api/two-factor.spec.ts:138:3 › Two-factor authentication › POST /api/2fa/setup/confirm enables 2FA and returns backup codes (858ms) ✓ 234 [api] › tests/api/two-factor.spec.ts:166:3 › Two-factor authentication › POST /api/2fa/setup/initiate rejects users with 2FA enabled (19ms) ✓ 235 [api] › tests/api/two-factor.spec.ts:174:3 › Two-factor authentication › POST /api/auth/login returns a partial token when 2FA is enabled (95ms) ✓ 236 [api] › tests/api/two-factor.spec.ts:187:3 › Two-factor authentication › POST /api/2fa/verify rejects missing, invalid and non-partial tokens (42ms) ✓ 237 [api] › tests/api/two-factor.spec.ts:207:3 › Two-factor authentication › POST /api/2fa/verify validates the body (62ms) ✓ 238 [api] › tests/api/two-factor.spec.ts:222:3 › Two-factor authentication › POST /api/2fa/verify rejects a code that was already used (19ms) ✓ 239 [api] › tests/api/two-factor.spec.ts:233:3 › Two-factor authentication › POST /api/2fa/verify completes the login with a TOTP code (6.3s) ✓ 240 [api] › tests/api/two-factor.spec.ts:253:3 › Two-factor authentication › POST /api/2fa/verify accepts a backup code once (1.0s) ✓ 241 [api] › tests/api/two-factor.spec.ts:273:3 › Two-factor authentication › POST /api/2fa/disable validates the body and password (130ms) ✓ 242 [api] › tests/api/two-factor.spec.ts:297:3 › Two-factor authentication › POST /api/2fa/disable is forbidden while 2FA is required (61ms) ✓ 243 [api] › tests/api/two-factor.spec.ts:324:3 › Two-factor authentication › POST /api/2fa/disable turns 2FA off (29.6s) ✓ 244 [api] › tests/api/users.spec.ts:19:3 › Users › POST /api/users creates a user (107ms) ✓ 245 [api] › tests/api/users.spec.ts:33:3 › Users › POST /api/users rejects duplicates and invalid bodies (27ms) ✓ 246 [api] › tests/api/users.spec.ts:52:3 › Users › POST /api/users requires an admin session (30ms) ✓ 247 [api] › tests/api/users.spec.ts:61:3 › Users › GET /api/users/{userId} returns a user (138ms) ✓ 248 [api] › tests/api/users.spec.ts:75:3 › Users › POST /api/users/{userId} lets admins update role, username and password (384ms) ✓ 249 [api] › tests/api/users.spec.ts:95:3 › Users › POST /api/users/{userId} ignores role changes from non-admins (22ms) ✓ 250 [api] › tests/api/users.spec.ts:102:3 › Users › POST /api/users/{userId} rejects unknown users and other users (33ms) ✓ 251 [api] › tests/api/users.spec.ts:113:3 › Users › GET /api/users/{userId}/websites lists a user websites (54ms) ✓ 252 [api] › tests/api/users.spec.ts:132:3 › Users › GET /api/users/{userId}/teams lists a user teams (50ms) ✓ 253 [api] › tests/api/users.spec.ts:148:3 › Users › DELETE /api/users/{userId} deletes a user (77ms) ✓ 254 [api] › tests/api/websites.spec.ts:37:3 › Websites › POST /api/websites creates a website for the current user (17ms) ✓ 255 [api] › tests/api/websites.spec.ts:48:3 › Websites › POST /api/websites creates a website for a team (16ms) ✓ 256 [api] › tests/api/websites.spec.ts:61:3 › Websites › POST /api/websites accepts a fixed id (49ms) ✓ 257 [api] › tests/api/websites.spec.ts:75:3 › Websites › POST /api/websites validates the body (14ms) ✓ 258 [api] › tests/api/websites.spec.ts:84:3 › Websites › POST /api/websites requires a user that can create websites (32ms) ✓ 259 [api] › tests/api/websites.spec.ts:92:3 › Websites › GET /api/websites lists the current user websites (60ms) ✓ 260 [api] › tests/api/websites.spec.ts:104:3 › Websites › GET /api/websites?includeTeams includes team websites (20ms) ✓ 261 [api] › tests/api/websites.spec.ts:111:3 › Websites › GET /api/websites/{websiteId} returns a website (87ms) ✓ 262 [api] › tests/api/websites.spec.ts:131:3 › Websites › POST /api/websites/{websiteId} updates name and domain (42ms) ✓ 263 [api] › tests/api/websites.spec.ts:142:3 › Websites › POST /api/websites/{websiteId} manages the legacy share id (43ms) ✓ 264 [api] › tests/api/websites.spec.ts:152:3 › Websites › POST /api/websites/{websiteId} updates the recorder config (52ms) ✓ 265 [api] › tests/api/websites.spec.ts:173:3 › Websites › GET /api/websites/{websiteId}/recorder is public and CORS enabled (9ms) ✓ 266 [api] › tests/api/websites.spec.ts:181:3 › Websites › GET /api/websites/charts returns chart data for accessible websites (56ms) ✓ 267 [api] › tests/api/websites.spec.ts:202:3 › Websites › GET /api/websites/{websiteId}/daterange returns the data window (58ms) ✓ 268 [api] › tests/api/websites.spec.ts:221:3 › Websites › GET /api/websites/{websiteId}/export returns a zip archive (91ms) ✓ 269 [api] › tests/api/websites.spec.ts:241:3 › Websites › POST /api/websites/{websiteId}/reset clears the website data (82ms) ✓ 270 [api] › tests/api/websites.spec.ts:261:3 › Websites › POST /api/websites/{websiteId}/transfer moves a website between owners (69ms) ✓ 271 [api] › tests/api/websites.spec.ts:281:3 › Websites › DELETE /api/websites/{websiteId} deletes a website (69ms) 271 passed (1.1m) API coverage: 179/179 operations (177 covered, 2 allowlisted, 0 uncovered) Calls that did not match any documented operation: DELETE /api/reports/00000000-0000-4000-8000-000000000000 DELETE /api/reports/e1726b0d-0b93-4846-90e0-3fbd19267e65 GET /api/reports GET /api/reports/00000000-0000-4000-8000-000000000000 GET /api/reports/e1726b0d-0b93-4846-90e0-3fbd19267e65 GET /api/reports/e5bdf021-ce7c-46f2-a2f4-6f29cc5ebc4d GET /api/reports/f664201f-af75-4c8b-88cd-8ae7c18bb800 GET /api/websites/1e5a0000-0000-4000-8000-000000000001/reports POST /api/reports POST /api/reports/00000000-0000-4000-8000-000000000000 POST /api/reports/attribution POST /api/reports/breakdown POST /api/reports/e1726b0d-0b93-4846-90e0-3fbd19267e65 POST /api/reports/funnel POST /api/reports/goal POST /api/reports/heatmap POST /api/reports/journey POST /api/reports/performance POST /api/reports/retention POST /api/reports/revenue POST /api/reports/utm POST /mcp