@appliqation/automation-sdk 2.5.1 → 2.8.0

package/package.json

@@ -1,9 +1,12 @@
 {
   "name": "@appliqation/automation-sdk",
-  "version": "2.5.1",
-  "description": "Appliqation Automation SDK with API key authentication, custom run titles, and framework-specific reporters",
+  "version": "2.8.0",
+  "description": "Appliqation Automation SDK for Playwright — API-key auth, scope-validated result reporting, portable storageState (setupAuth), and customer-defined login flows (defineLogin) for gated apps",
   "main": "src/index.js",
   "types": "src/index.d.ts",
+  "bin": {
+    "appq-auth-setup": "src/cli/auth-setup.js"
+  },
   "exports": {
     ".": {
       "require": "./src/index.js",
@@ -29,17 +32,14 @@
       "require": "./src/playwright/fixture.js",
       "import": "./src/playwright/fixture.js"
     },
-    "./cypress": {
-      "require": "./src/reporters/cypress/index.js",
-      "import": "./src/reporters/cypress/index.js"
-    },
-    "./jest": {
-      "require": "./src/reporters/jest/index.js",
-      "import": "./src/reporters/jest/index.js"
-    },
     "./utils": {
       "require": "./src/utils/index.js",
       "import": "./src/utils/index.js"
+    },
+    "./login": {
+      "types": "./src/login/index.d.ts",
+      "require": "./src/login/index.js",
+      "import": "./src/login/index.js"
     }
   },
   "files": [
@@ -57,9 +57,7 @@
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
     "example:basic": "node examples/basic-usage.js",
-    "example:playwright": "cd examples/playwright-basic && npx playwright test",
-    "example:cypress": "cd examples/cypress-basic && npm test",
-    "example:jest": "cd examples/jest-basic && npm test",
+    "example:playwright": "cd examples/playwright && npx playwright test",
     "docs": "echo 'Documentation generation coming soon'"
   },
   "keywords": [
@@ -68,10 +66,6 @@
     "automation",
     "test-management",
     "playwright",
-    "cypress",
-    "jest",
-    "selenium",
-    "webdriver",
     "api-key",
     "sdk",
     "test-reporting",
@@ -83,34 +77,19 @@
   "license": "MIT",
   "dependencies": {
     "axios": "^1.6.0",
-    "dotenv": "^16.3.1",
     "jsonwebtoken": "^9.0.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.40.0",
-    "cypress": "^13.0.0",
     "eslint": "^8.57.0",
     "jest": "^29.7.0",
     "playwright": "^1.40.0"
   },
   "peerDependencies": {
-    "@playwright/test": ">=1.30.0",
-    "cypress": ">=10.0.0",
-    "jest": ">=29.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@playwright/test": {
-      "optional": true
-    },
-    "cypress": {
-      "optional": true
-    },
-    "jest": {
-      "optional": true
-    }
+    "@playwright/test": ">=1.30.0"
   },
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=18.0.0"
   },
   "repository": {
     "type": "git",

package/src/AppliqationClient.js

@@ -8,7 +8,13 @@ const ProjectInfoService = require('./services/ProjectInfoService');
 const UuidValidator = require('./utils/UuidValidator');
 const PayloadBuilder = require('./utils/PayloadBuilder');
 const logger = require('./utils/logger');
-const { DEFAULT_APPLIQATION_BASE_URL } = require('./constants');
+const { ConfigurationError } = require('./utils/errors');
+const { DEFAULT_APPLIQATION_BASE_URL, AUTO_TAG_NAME } = require('./constants');
+
+// H2 — environment names must match the backend's InputValidator regex
+// (appq_mongo InputValidator). Mismatch causes a 400 mid-run; reject at
+// startup instead so misconfiguration fails immediately and obviously.
+const ENVIRONMENT_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
 
 /**
  * Main Appliqation Automation SDK Client
@@ -49,22 +55,51 @@ class AppliqationClient {
   constructor(config = {}) {
     const resolved = AppliqationClient.resolveConfig(config);
 
-    // Validate — warn instead of throw
+    // H2 — fail-fast schema validation. Hard errors throw at construction so
+    // misconfiguration surfaces immediately instead of after a full test run.
+    // Soft warnings (missing apiKey, etc.) still just log so no-op mode is
+    // preserved when the user intentionally runs without reporting.
     const validation = this.validateConfig(resolved);
-    if (!validation.valid) {
-      // Log warnings but don't throw
-      for (const warning of validation.warnings) {
-        logger.warn(warning);
-      }
+    if (validation.errors.length > 0) {
+      throw new ConfigurationError(
+        `Invalid Appliqation SDK configuration:\n  - ${validation.errors.join('\n  - ')}`,
+        { errors: validation.errors }
+      );
+    }
+    for (const warning of validation.warnings) {
+      logger.warn(warning);
     }
 
-    // Determine SSL enforcement based on environment
+    // H3 — TLS enforcement. Disabling cert validation is allowed in local
+    // dev (self-signed certs) but actively dangerous in CI/production: a
+    // MITM attacker can intercept result submissions and alter verdicts.
+    // The previous behaviour only warned; we now throw to make the misuse
+    // impossible to ship. Customers who genuinely need to bypass TLS in a
+    // CI environment must explicitly set APPLIQATION_INSECURE=allow.
     const isProduction = this._isProductionEnvironment();
     let rejectUnauthorized = true;
 
     if (resolved.rejectUnauthorized !== undefined) {
       if (isProduction && resolved.rejectUnauthorized === false) {
-        logger.warn('SSL certificate verification is disabled in production environment!');
+        const overrideAllowed = process.env.APPLIQATION_INSECURE === 'allow';
+        if (!overrideAllowed) {
+          throw new ConfigurationError(
+            'rejectUnauthorized=false is not permitted in CI/production. '
+            + 'Disabling TLS verification exposes result submissions to MITM. '
+            + 'Use a properly trusted certificate, or set '
+            + 'APPLIQATION_INSECURE=allow to acknowledge the risk and override.',
+            {
+              detectedAs: 'production',
+              ci: process.env.CI,
+              nodeEnv: process.env.NODE_ENV
+            }
+          );
+        }
+        logger.warn(
+          'TLS verification is DISABLED via APPLIQATION_INSECURE=allow in a '
+          + 'production-like environment. Result submissions are vulnerable '
+          + 'to interception.'
+        );
       }
       rejectUnauthorized = resolved.rejectUnauthorized;
     }
@@ -84,10 +119,8 @@ class AppliqationClient {
         logOrphans: resolved.options?.logOrphans !== false,
         logLevel: resolved.options?.logLevel || 'info',
         autoTag: resolved.options?.autoTag !== false,
-        autoTagName: resolved.options?.autoTagName ||
-                     resolved.autoTagName ||
-                     process.env.APPLIQATION_AUTO_TAG_NAME ||
-                     'Appq_automated',
+        // Fixed, not configurable — see AUTO_TAG_NAME's doc comment.
+        autoTagName: AUTO_TAG_NAME,
         autoTagBatchSize: resolved.options?.autoTagBatchSize || 50,
         autoTagRetries: resolved.options?.autoTagRetries || 2
       }
@@ -351,6 +384,20 @@ class AppliqationClient {
     }
   }
 
+  /**
+   * Fetch the UUID membership of a Test Set, for scope validation.
+   */
+  async fetchTestSetScope(testSetId) {
+    try {
+      const response = await this.http.get(`/api/automation/testset/${testSetId}/scope`);
+      const uuids = response?.data?.data;
+      return new Set(Array.isArray(uuids) ? uuids : []);
+    } catch (error) {
+      logger.error('Failed to fetch testset scope', { error: error.message, testSetId });
+      throw error;
+    }
+  }
+
   validateUuid(uuid) {
     return UuidValidator.validate(uuid);
   }
@@ -364,36 +411,89 @@ class AppliqationClient {
   }
 
   /**
-   * Validate client configuration — returns warnings instead of throwing.
+   * Validate client configuration.
+   *
+   * Hard errors (returned in `errors`) cause the constructor to throw
+   * ConfigurationError. They cover misconfiguration that would otherwise
+   * fail silently or mid-run: malformed URL, non-positive numerics, invalid
+   * environment name format. Soft warnings (returned in `warnings`) are
+   * logged but don't block construction — missing apiKey, etc.
+   *
    * @private
-   * @returns {{ valid: boolean, warnings: string[] }}
+   * @returns {{ errors: string[], warnings: string[] }}
    */
   validateConfig(config) {
+    const errors = [];
     const warnings = [];
 
     if (!config) {
-      warnings.push('[Appliqation] No configuration provided');
-      return { valid: false, warnings };
+      errors.push('No configuration object provided');
+      return { errors, warnings };
     }
 
+    // apiKey — warn only (no-op mode is intentional behaviour)
     if (!config.apiKey) {
       warnings.push('[Appliqation] API key required. Set APPLIQATION_API_KEY in .env');
+    } else if (typeof config.apiKey !== 'string' || config.apiKey.trim() === '') {
+      errors.push(`apiKey must be a non-empty string (got: ${typeof config.apiKey})`);
     }
 
-    if (!config.projectKey) {
-      // Not an error — will be auto-discovered
-      logger.debug('projectKey not set — will auto-discover from API key');
-    }
-
+    // baseUrl — hard error on malformed URL (silent failure otherwise:
+    // every HTTP call fails with a cryptic axios error mid-run).
     if (config.baseUrl) {
       try {
-        new URL(config.baseUrl);
+        const url = new URL(config.baseUrl);
+        if (!['http:', 'https:'].includes(url.protocol)) {
+          errors.push(`baseUrl must use http or https (got: "${url.protocol}")`);
+        }
       } catch (error) {
-        warnings.push(`[Appliqation] Invalid baseUrl format: "${config.baseUrl}"`);
+        errors.push(`Invalid baseUrl: "${config.baseUrl}" is not a valid URL`);
+      }
+    }
+
+    // environment — hard error on invalid format (backend rejects 400 mid-run)
+    if (config.environment !== undefined && config.environment !== null && config.environment !== '') {
+      if (typeof config.environment !== 'string') {
+        errors.push(`environment must be a string (got: ${typeof config.environment})`);
+      } else if (!ENVIRONMENT_NAME_PATTERN.test(config.environment)) {
+        errors.push(
+          `environment "${config.environment}" contains invalid characters. `
+          + 'Allowed: letters, digits, dot, underscore, hyphen.'
+        );
+      }
+    }
+
+    // options.timeout — must be a positive integer if specified
+    if (config.options && config.options.timeout !== undefined) {
+      const t = config.options.timeout;
+      if (!Number.isInteger(t) || t <= 0) {
+        errors.push(`options.timeout must be a positive integer (got: ${t})`);
+      }
+    }
+
+    // options.retries — must be a non-negative integer if specified
+    if (config.options && config.options.retries !== undefined) {
+      const r = config.options.retries;
+      if (!Number.isInteger(r) || r < 0) {
+        errors.push(`options.retries must be a non-negative integer (got: ${r})`);
+      }
+    }
+
+    // options.batchSize / options.autoTagBatchSize — must be positive integers
+    for (const field of ['batchSize', 'autoTagBatchSize']) {
+      if (config.options && config.options[field] !== undefined) {
+        const v = config.options[field];
+        if (!Number.isInteger(v) || v <= 0) {
+          errors.push(`options.${field} must be a positive integer (got: ${v})`);
+        }
       }
     }
 
-    return { valid: warnings.length === 0, warnings };
+    if (!config.projectKey) {
+      logger.debug('projectKey not set — will auto-discover from API key');
+    }
+
+    return { errors, warnings };
   }
 
   /**

package/src/cli/auth-setup.js

@@ -0,0 +1,308 @@
+#!/usr/bin/env node
+/**
+ * appq-auth-setup — populate Playwright storageState for an Appliqation
+ * project's role by dynamic-importing the customer's login.ts file
+ * and running it with role-specific creds from env vars.
+ *
+ *   npx appq-auth-setup --project-id 126 --role manager
+ *
+ * Customer setup (one-time, per project):
+ *   1. Configure roles in Appliqation Project Settings → Auth Config
+ *   2. Write `tests/automan/auth/login.ts` in their repo (default path;
+ *      configurable in Project Settings):
+ *
+ *      import { defineLogin } from '@appliqation/automation-sdk/login';
+ *      export default defineLogin(async (page, { username, password }) => {
+ *        await page.goto('/login');
+ *        await page.getByLabel('Email').fill(username);
+ *        await page.getByLabel('Password').fill(password);
+ *        await page.getByRole('button', { name: 'Sign in' }).click();
+ *        await page.waitForURL('**\/dashboard');
+ *      });
+ *
+ *   3. Download the .env template from Project Settings, fill in
+ *      values, drop into CI secrets
+ *   4. Add to CI yaml (one line per role used by their tests):
+ *      - run: npx appq-auth-setup --project-id 126 --role default
+ *      - run: npx playwright test
+ *
+ * What this CLI does:
+ *   1. Read APPQ_PROJECT_<id>_<ROLE>_USERNAME / _PASSWORD from env
+ *   2. Dynamic-import the customer's login.ts (path discoverable via
+ *      --login-file flag, env var, or convention)
+ *   3. Launch Chromium, run customer's login function with creds +
+ *      baseURL from APPLIQATION_SUT_BASE_URL env var
+ *   4. Save resulting Playwright storageState to the canonical path
+ *      from setupAuth({ project_id, role })
+ *
+ * Tests then load via:
+ *   test.use({ storageState: setupAuth({ project_id, role }) })
+ *
+ * Usage in CI: run BEFORE `playwright test`. Idempotent — fast on
+ * cache hit (~3s for the login flow), faster on no-op.
+ */
+
+const fs = require('fs');
+const path = require('path');
+const {
+  authStatePath,
+  envVarNames,
+  sanitizeRole,
+} = require('../utils/setupAuth');
+
+const FATAL_EXIT = 1;
+const DEFAULT_LOGIN_FILE = 'tests/automan/auth/login.ts';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const arg = argv[i];
+    if (!arg.startsWith('--')) continue;
+    const key = arg.slice(2);
+    const next = argv[i + 1];
+    if (next && !next.startsWith('--')) {
+      args[key] = next;
+      i++;
+    } else {
+      args[key] = true;
+    }
+  }
+  return args;
+}
+
+function fail(message) {
+  console.error(`✗ ${message}`);
+  process.exit(FATAL_EXIT);
+}
+
+/**
+ * Resolve the customer's login.ts path. Priority:
+ *   1. --login-file CLI flag (explicit override)
+ *   2. APPQ_LOGIN_FILE env var (CI override without changing CLI args)
+ *   3. Convention: tests/automan/auth/login.ts relative to CWD
+ *
+ * Throws clearly if the resolved path doesn't exist — customers who
+ * haven't created the file yet need a path-specific error, not a
+ * cryptic dynamic-import failure.
+ */
+// H4 — only allow loading login scripts written in JS or TS. Blocks an
+// attacker from convincing the CLI to require() arbitrary file types
+// (.json with prototype pollution, .node native addons, .yaml via a
+// custom hook, etc).
+const ALLOWED_LOGIN_FILE_EXTENSIONS = new Set([
+  '.ts', '.tsx', '.mts', '.cts',
+  '.js', '.mjs', '.cjs', '.jsx'
+]);
+
+function resolveLoginFile(args) {
+  const candidate = args['login-file']
+    || process.env.APPQ_LOGIN_FILE
+    || DEFAULT_LOGIN_FILE;
+  const absolute = path.isAbsolute(candidate)
+    ? candidate
+    : path.resolve(process.cwd(), candidate);
+
+  // H4 — directory-traversal guard. The CLI loads the resolved file via
+  // require() / dynamic import(), so a path outside the project root is
+  // an arbitrary-code-execution vector in a compromised CI environment
+  // (malicious PR, supply chain). Require the login file to live inside
+  // the current working directory tree.
+  const projectRoot = process.cwd();
+  const rootWithSep = projectRoot.endsWith(path.sep) ? projectRoot : projectRoot + path.sep;
+  // Realpath to defeat symlink escapes; fall back to absolute if the
+  // file doesn't exist yet so the existence error below still fires
+  // with the user's intended path.
+  let canonical;
+  try {
+    canonical = fs.realpathSync(absolute);
+  } catch (e) {
+    canonical = absolute;
+  }
+  if (canonical !== projectRoot && !canonical.startsWith(rootWithSep)) {
+    fail(
+      `Login file must live inside the project directory.\n`
+      + `  Project root: ${projectRoot}\n`
+      + `  Login file:   ${canonical}\n`
+      + `\n`
+      + `  Resolving outside the project tree would let any process that\n`
+      + `  controls --login-file or APPQ_LOGIN_FILE load arbitrary code\n`
+      + `  through this CLI. Move the file under the project root.`
+    );
+  }
+
+  // H4 — extension allowlist.
+  const ext = path.extname(canonical).toLowerCase();
+  if (!ALLOWED_LOGIN_FILE_EXTENSIONS.has(ext)) {
+    fail(
+      `Login file extension "${ext}" is not allowed.\n`
+      + `  Allowed: ${Array.from(ALLOWED_LOGIN_FILE_EXTENSIONS).join(', ')}\n`
+      + `  Got:     ${canonical}`
+    );
+  }
+
+  if (!fs.existsSync(canonical)) {
+    fail(
+      `Login file not found: ${canonical}\n`
+      + `  Create it (default path: ${DEFAULT_LOGIN_FILE}) and export your login flow as a default export:\n`
+      + `\n`
+      + `    import { defineLogin } from '@appliqation/automation-sdk/login';\n`
+      + `    export default defineLogin(async (page, { username, password, baseURL }) => {\n`
+      + `      await page.goto('/login');\n`
+      + `      // ... your login flow\n`
+      + `    });\n`
+    );
+  }
+  return canonical;
+}
+
+/**
+ * Dynamic-import the login file and return the default export. Handles
+ * both ESM (`export default ...`) and CommonJS (`module.exports = ...`)
+ * — the SDK's defineLogin is identity, so customers writing either
+ * style end up with a function we can call.
+ *
+ * For .ts files, requires the customer's repo to have a TS loader
+ * registered (tsx, ts-node, esbuild-node-loader). Most Playwright
+ * projects do via @playwright/test which transpiles TS on the fly,
+ * but the auth-setup CLI runs OUTSIDE the Playwright runner so we
+ * need the loader explicitly. We try `tsx` first (lightweight, the
+ * most common choice), then `ts-node`, then fail with a clear hint.
+ */
+async function loadLoginFunction(filePath) {
+  const ext = path.extname(filePath).toLowerCase();
+  if (ext === '.ts' || ext === '.tsx' || ext === '.mts' || ext === '.cts') {
+    let registered = false;
+    try {
+      require('tsx/cjs');
+      registered = true;
+    } catch {
+      try {
+        require('ts-node/register/transpile-only');
+        registered = true;
+      } catch { /* fall through */ }
+    }
+    if (!registered) {
+      fail(
+        `Login file is TypeScript (${path.basename(filePath)}) but no TS loader was found.\n`
+        + `  Install one as a dev dependency:\n`
+        + `    npm install --save-dev tsx\n`
+        + `  Or rename your login file to .js (CommonJS) / .mjs (ESM).`
+      );
+    }
+  }
+
+  let mod;
+  try {
+    mod = require(filePath);
+  } catch (requireErr) {
+    // ESM fallback — `require` of an ESM file throws ERR_REQUIRE_ESM.
+    try {
+      mod = await import(filePath);
+    } catch (importErr) {
+      fail(
+        `Failed to load ${filePath}:\n`
+        + `  CommonJS error: ${requireErr.message}\n`
+        + `  ESM error: ${importErr.message}`
+      );
+    }
+  }
+
+  const fn = mod && (mod.default || mod);
+  if (typeof fn !== 'function') {
+    fail(
+      `${filePath} did not default-export a function.\n`
+      + `  Expected:\n`
+      + `    export default defineLogin(async (page, ctx) => { ... });\n`
+      + `  Got: ${typeof fn}`
+    );
+  }
+  return fn;
+}
+
+async function main() {
+  const args = parseArgs(process.argv);
+
+  const project_id = args['project-id']
+    || process.env.APPLIQATION_PROJECT_KEY
+    || null;
+  const role = sanitizeRole(args.role || 'default');
+
+  if (!project_id) {
+    fail(
+      'Missing --project-id. Pass it as a flag or set APPLIQATION_PROJECT_KEY '
+      + 'in your env (the downloaded .env from your project settings includes it).'
+    );
+  }
+
+  const baseURL = (process.env.APPLIQATION_SUT_BASE_URL || '').replace(/\/$/, '');
+  if (!baseURL) {
+    fail(
+      'APPLIQATION_SUT_BASE_URL env var is not set. This is your SUT (System Under Test) URL '
+      + '— e.g. https://staging.acme.com — that the login flow runs against. Add it to your .env / CI secrets.'
+    );
+  }
+
+  const { username: userVar, password: pwdVar } = envVarNames({ project_id, role });
+  const username = process.env[userVar];
+  const password = process.env[pwdVar];
+  if (!username || !password) {
+    fail(
+      `Missing credential env vars: ${userVar} and/or ${pwdVar}.\n`
+      + `  Download the .env template from your project settings in Appliqation,\n`
+      + `  fill in the values, and add them to your CI secrets.`
+    );
+  }
+
+  const loginFile = resolveLoginFile(args);
+  console.log(`→ Loading login flow from ${path.relative(process.cwd(), loginFile)}`);
+  const loginFn = await loadLoginFunction(loginFile);
+
+  // Lazy-require playwright — it's a peer dep, not always installed.
+  let chromium;
+  try {
+    ({ chromium } = require('playwright'));
+  } catch {
+    fail(
+      'Playwright is not installed. Run `npm install --save-dev playwright` '
+      + '(or @playwright/test) and try again.'
+    );
+  }
+
+  const targetPath = authStatePath({ project_id, role });
+  // H1 — restrict the auth-state directory to owner-only. Playwright's
+  // storageState file contains cookies, localStorage, and sessionStorage
+  // — equivalent to a live authenticated browser session. Default
+  // mkdir permissions inherit the umask (typically 0755 / world-readable
+  // on shared CI runners and developer machines); force 0700 so no
+  // other local user can read peer sessions.
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 });
+
+  console.log(`→ Launching Chromium for login as role "${role}" against ${baseURL}`);
+  const browser = await chromium.launch({ headless: true });
+  const context = await browser.newContext({
+    baseURL,
+    ignoreHTTPSErrors: true,
+  });
+  const page = await context.newPage();
+
+  try {
+    await loginFn(page, { username, password, role, baseURL });
+    await context.storageState({ path: targetPath });
+    // H1 — Playwright writes storageState with umask-inherited
+    // permissions (typically 0644). Tighten to 0600 so even other
+    // local users on the same machine cannot read it.
+    try {
+      fs.chmodSync(targetPath, 0o600);
+    } catch (chmodErr) {
+      console.warn(`⚠️  Could not tighten permissions on ${targetPath}: ${chmodErr.message}`);
+    }
+    console.log(`✓ Auth state saved to ${targetPath} (mode 0600)`);
+    console.log(`  Tests using setupAuth({ project_id: ${project_id}, role: '${role}' }) will pick this up.`);
+  } catch (err) {
+    fail(`Login failed: ${err.message}`);
+  } finally {
+    await browser.close();
+  }
+}
+
+main().catch((err) => fail(err.message || String(err)));

package/src/constants.js

@@ -204,6 +204,23 @@ const DEFAULT_OS = 'Unknown';
  */
 const DEFAULT_APPLIQATION_BASE_URL = 'https://appq.appliqation.io';
 
+// ============================================================================
+// Auto-Tagging Configuration
+// ============================================================================
+
+/**
+ * Tag applied to a test case the first time the SDK submits an accepted
+ * result for it. Marks the test case as automation-covered.
+ *
+ * Fixed, not configurable — appq's own backend (AutomationResultManager's
+ * autoTagScenario/autoTagTestset) writes this exact literal when it
+ * auto-tags at run creation. A configurable client-side name would let the
+ * SDK and backend disagree and produce two different tags for the same
+ * "automated" signal.
+ * @constant {string}
+ */
+const AUTO_TAG_NAME = 'Appq_Auto';
+
 // ============================================================================
 // Exports
 // ============================================================================
@@ -251,5 +268,8 @@ module.exports = {
   DEFAULT_OS,
 
   // Base URL
-  DEFAULT_APPLIQATION_BASE_URL
+  DEFAULT_APPLIQATION_BASE_URL,
+
+  // Auto-Tagging
+  AUTO_TAG_NAME
 };

package/src/core/AuthManager.js

@@ -180,6 +180,11 @@ class AuthManager {
 
   parseJwtExpiry(token) {
     try {
+      // Signature not verified — token is issued by the Appliqation API server
+      // we just authenticated against, so origin is trusted. We only decode
+      // the payload to read `exp` for refresh scheduling. Verifying the HMAC
+      // here would require the server-side signing secret, which the SDK
+      // does not (and must not) hold.
       const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
       // Convert to milliseconds and subtract 5 minutes for safety margin
       return (payload.exp * 1000) - (5 * 60 * 1000);