@appliqation/automation-sdk 2.7.0 → 2.8.0

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@appliqation/automation-sdk",
-  "version": "2.7.0",
-  "description": "Appliqation Automation SDK — API key auth, custom run titles, framework reporters, portable storageState (setupAuth), and customer-defined login flows (defineLogin) for gated apps",
+  "version": "2.8.0",
+  "description": "Appliqation Automation SDK for Playwright — API-key auth, scope-validated result reporting, portable storageState (setupAuth), and customer-defined login flows (defineLogin) for gated apps",
   "main": "src/index.js",
   "types": "src/index.d.ts",
   "bin": {
-    "appq-auth-setup": "./src/cli/auth-setup.js"
+    "appq-auth-setup": "src/cli/auth-setup.js"
   },
   "exports": {
     ".": {
@@ -32,14 +32,6 @@
       "require": "./src/playwright/fixture.js",
       "import": "./src/playwright/fixture.js"
     },
-    "./cypress": {
-      "require": "./src/reporters/cypress/index.js",
-      "import": "./src/reporters/cypress/index.js"
-    },
-    "./jest": {
-      "require": "./src/reporters/jest/index.js",
-      "import": "./src/reporters/jest/index.js"
-    },
     "./utils": {
       "require": "./src/utils/index.js",
       "import": "./src/utils/index.js"
@@ -65,9 +57,7 @@
     "lint": "eslint src/",
     "lint:fix": "eslint src/ --fix",
     "example:basic": "node examples/basic-usage.js",
-    "example:playwright": "cd examples/playwright-basic && npx playwright test",
-    "example:cypress": "cd examples/cypress-basic && npm test",
-    "example:jest": "cd examples/jest-basic && npm test",
+    "example:playwright": "cd examples/playwright && npx playwright test",
     "docs": "echo 'Documentation generation coming soon'"
   },
   "keywords": [
@@ -76,10 +66,6 @@
     "automation",
     "test-management",
     "playwright",
-    "cypress",
-    "jest",
-    "selenium",
-    "webdriver",
     "api-key",
     "sdk",
     "test-reporting",
@@ -91,31 +77,16 @@
   "license": "MIT",
   "dependencies": {
     "axios": "^1.6.0",
-    "dotenv": "^16.3.1",
     "jsonwebtoken": "^9.0.3"
   },
   "devDependencies": {
     "@playwright/test": "^1.40.0",
-    "cypress": "^13.0.0",
     "eslint": "^8.57.0",
     "jest": "^29.7.0",
     "playwright": "^1.40.0"
   },
   "peerDependencies": {
-    "@playwright/test": ">=1.30.0",
-    "cypress": ">=10.0.0",
-    "jest": ">=29.0.0"
-  },
-  "peerDependenciesMeta": {
-    "@playwright/test": {
-      "optional": true
-    },
-    "cypress": {
-      "optional": true
-    },
-    "jest": {
-      "optional": true
-    }
+    "@playwright/test": ">=1.30.0"
   },
   "engines": {
     "node": ">=18.0.0"

package/src/AppliqationClient.js

@@ -8,7 +8,13 @@ const ProjectInfoService = require('./services/ProjectInfoService');
 const UuidValidator = require('./utils/UuidValidator');
 const PayloadBuilder = require('./utils/PayloadBuilder');
 const logger = require('./utils/logger');
-const { DEFAULT_APPLIQATION_BASE_URL } = require('./constants');
+const { ConfigurationError } = require('./utils/errors');
+const { DEFAULT_APPLIQATION_BASE_URL, AUTO_TAG_NAME } = require('./constants');
+
+// H2 — environment names must match the backend's InputValidator regex
+// (appq_mongo InputValidator). Mismatch causes a 400 mid-run; reject at
+// startup instead so misconfiguration fails immediately and obviously.
+const ENVIRONMENT_NAME_PATTERN = /^[a-zA-Z0-9._-]+$/;
 
 /**
  * Main Appliqation Automation SDK Client
@@ -49,22 +55,51 @@ class AppliqationClient {
   constructor(config = {}) {
     const resolved = AppliqationClient.resolveConfig(config);
 
-    // Validate — warn instead of throw
+    // H2 — fail-fast schema validation. Hard errors throw at construction so
+    // misconfiguration surfaces immediately instead of after a full test run.
+    // Soft warnings (missing apiKey, etc.) still just log so no-op mode is
+    // preserved when the user intentionally runs without reporting.
     const validation = this.validateConfig(resolved);
-    if (!validation.valid) {
-      // Log warnings but don't throw
-      for (const warning of validation.warnings) {
-        logger.warn(warning);
-      }
+    if (validation.errors.length > 0) {
+      throw new ConfigurationError(
+        `Invalid Appliqation SDK configuration:\n  - ${validation.errors.join('\n  - ')}`,
+        { errors: validation.errors }
+      );
+    }
+    for (const warning of validation.warnings) {
+      logger.warn(warning);
     }
 
-    // Determine SSL enforcement based on environment
+    // H3 — TLS enforcement. Disabling cert validation is allowed in local
+    // dev (self-signed certs) but actively dangerous in CI/production: a
+    // MITM attacker can intercept result submissions and alter verdicts.
+    // The previous behaviour only warned; we now throw to make the misuse
+    // impossible to ship. Customers who genuinely need to bypass TLS in a
+    // CI environment must explicitly set APPLIQATION_INSECURE=allow.
     const isProduction = this._isProductionEnvironment();
     let rejectUnauthorized = true;
 
     if (resolved.rejectUnauthorized !== undefined) {
       if (isProduction && resolved.rejectUnauthorized === false) {
-        logger.warn('SSL certificate verification is disabled in production environment!');
+        const overrideAllowed = process.env.APPLIQATION_INSECURE === 'allow';
+        if (!overrideAllowed) {
+          throw new ConfigurationError(
+            'rejectUnauthorized=false is not permitted in CI/production. '
+            + 'Disabling TLS verification exposes result submissions to MITM. '
+            + 'Use a properly trusted certificate, or set '
+            + 'APPLIQATION_INSECURE=allow to acknowledge the risk and override.',
+            {
+              detectedAs: 'production',
+              ci: process.env.CI,
+              nodeEnv: process.env.NODE_ENV
+            }
+          );
+        }
+        logger.warn(
+          'TLS verification is DISABLED via APPLIQATION_INSECURE=allow in a '
+          + 'production-like environment. Result submissions are vulnerable '
+          + 'to interception.'
+        );
       }
       rejectUnauthorized = resolved.rejectUnauthorized;
     }
@@ -84,10 +119,8 @@ class AppliqationClient {
         logOrphans: resolved.options?.logOrphans !== false,
         logLevel: resolved.options?.logLevel || 'info',
         autoTag: resolved.options?.autoTag !== false,
-        autoTagName: resolved.options?.autoTagName ||
-                     resolved.autoTagName ||
-                     process.env.APPLIQATION_AUTO_TAG_NAME ||
-                     'Appq_automated',
+        // Fixed, not configurable — see AUTO_TAG_NAME's doc comment.
+        autoTagName: AUTO_TAG_NAME,
         autoTagBatchSize: resolved.options?.autoTagBatchSize || 50,
         autoTagRetries: resolved.options?.autoTagRetries || 2
       }
@@ -351,6 +384,20 @@ class AppliqationClient {
     }
   }
 
+  /**
+   * Fetch the UUID membership of a Test Set, for scope validation.
+   */
+  async fetchTestSetScope(testSetId) {
+    try {
+      const response = await this.http.get(`/api/automation/testset/${testSetId}/scope`);
+      const uuids = response?.data?.data;
+      return new Set(Array.isArray(uuids) ? uuids : []);
+    } catch (error) {
+      logger.error('Failed to fetch testset scope', { error: error.message, testSetId });
+      throw error;
+    }
+  }
+
   validateUuid(uuid) {
     return UuidValidator.validate(uuid);
   }
@@ -364,36 +411,89 @@ class AppliqationClient {
   }
 
   /**
-   * Validate client configuration — returns warnings instead of throwing.
+   * Validate client configuration.
+   *
+   * Hard errors (returned in `errors`) cause the constructor to throw
+   * ConfigurationError. They cover misconfiguration that would otherwise
+   * fail silently or mid-run: malformed URL, non-positive numerics, invalid
+   * environment name format. Soft warnings (returned in `warnings`) are
+   * logged but don't block construction — missing apiKey, etc.
+   *
    * @private
-   * @returns {{ valid: boolean, warnings: string[] }}
+   * @returns {{ errors: string[], warnings: string[] }}
    */
   validateConfig(config) {
+    const errors = [];
     const warnings = [];
 
     if (!config) {
-      warnings.push('[Appliqation] No configuration provided');
-      return { valid: false, warnings };
+      errors.push('No configuration object provided');
+      return { errors, warnings };
     }
 
+    // apiKey — warn only (no-op mode is intentional behaviour)
     if (!config.apiKey) {
       warnings.push('[Appliqation] API key required. Set APPLIQATION_API_KEY in .env');
+    } else if (typeof config.apiKey !== 'string' || config.apiKey.trim() === '') {
+      errors.push(`apiKey must be a non-empty string (got: ${typeof config.apiKey})`);
     }
 
-    if (!config.projectKey) {
-      // Not an error — will be auto-discovered
-      logger.debug('projectKey not set — will auto-discover from API key');
-    }
-
+    // baseUrl — hard error on malformed URL (silent failure otherwise:
+    // every HTTP call fails with a cryptic axios error mid-run).
     if (config.baseUrl) {
       try {
-        new URL(config.baseUrl);
+        const url = new URL(config.baseUrl);
+        if (!['http:', 'https:'].includes(url.protocol)) {
+          errors.push(`baseUrl must use http or https (got: "${url.protocol}")`);
+        }
       } catch (error) {
-        warnings.push(`[Appliqation] Invalid baseUrl format: "${config.baseUrl}"`);
+        errors.push(`Invalid baseUrl: "${config.baseUrl}" is not a valid URL`);
+      }
+    }
+
+    // environment — hard error on invalid format (backend rejects 400 mid-run)
+    if (config.environment !== undefined && config.environment !== null && config.environment !== '') {
+      if (typeof config.environment !== 'string') {
+        errors.push(`environment must be a string (got: ${typeof config.environment})`);
+      } else if (!ENVIRONMENT_NAME_PATTERN.test(config.environment)) {
+        errors.push(
+          `environment "${config.environment}" contains invalid characters. `
+          + 'Allowed: letters, digits, dot, underscore, hyphen.'
+        );
+      }
+    }
+
+    // options.timeout — must be a positive integer if specified
+    if (config.options && config.options.timeout !== undefined) {
+      const t = config.options.timeout;
+      if (!Number.isInteger(t) || t <= 0) {
+        errors.push(`options.timeout must be a positive integer (got: ${t})`);
+      }
+    }
+
+    // options.retries — must be a non-negative integer if specified
+    if (config.options && config.options.retries !== undefined) {
+      const r = config.options.retries;
+      if (!Number.isInteger(r) || r < 0) {
+        errors.push(`options.retries must be a non-negative integer (got: ${r})`);
+      }
+    }
+
+    // options.batchSize / options.autoTagBatchSize — must be positive integers
+    for (const field of ['batchSize', 'autoTagBatchSize']) {
+      if (config.options && config.options[field] !== undefined) {
+        const v = config.options[field];
+        if (!Number.isInteger(v) || v <= 0) {
+          errors.push(`options.${field} must be a positive integer (got: ${v})`);
+        }
       }
     }
 
-    return { valid: warnings.length === 0, warnings };
+    if (!config.projectKey) {
+      logger.debug('projectKey not set — will auto-discover from API key');
+    }
+
+    return { errors, warnings };
   }
 
   /**

package/src/cli/auth-setup.js

@@ -8,7 +8,8 @@
  *
  * Customer setup (one-time, per project):
  *   1. Configure roles in Appliqation Project Settings → Auth Config
- *   2. Write `tests/appliqation/auth/login.ts` in their repo:
+ *   2. Write `tests/automan/auth/login.ts` in their repo (default path;
+ *      configurable in Project Settings):
  *
  *      import { defineLogin } from '@appliqation/automation-sdk/login';
  *      export default defineLogin(async (page, { username, password }) => {
@@ -50,7 +51,7 @@ const {
 } = require('../utils/setupAuth');
 
 const FATAL_EXIT = 1;
-const DEFAULT_LOGIN_FILE = 'tests/appliqation/auth/login.ts';
+const DEFAULT_LOGIN_FILE = 'tests/automan/auth/login.ts';
 
 function parseArgs(argv) {
   const args = {};
@@ -78,12 +79,21 @@ function fail(message) {
  * Resolve the customer's login.ts path. Priority:
  *   1. --login-file CLI flag (explicit override)
  *   2. APPQ_LOGIN_FILE env var (CI override without changing CLI args)
- *   3. Convention: tests/appliqation/auth/login.ts relative to CWD
+ *   3. Convention: tests/automan/auth/login.ts relative to CWD
  *
  * Throws clearly if the resolved path doesn't exist — customers who
  * haven't created the file yet need a path-specific error, not a
  * cryptic dynamic-import failure.
  */
+// H4 — only allow loading login scripts written in JS or TS. Blocks an
+// attacker from convincing the CLI to require() arbitrary file types
+// (.json with prototype pollution, .node native addons, .yaml via a
+// custom hook, etc).
+const ALLOWED_LOGIN_FILE_EXTENSIONS = new Set([
+  '.ts', '.tsx', '.mts', '.cts',
+  '.js', '.mjs', '.cjs', '.jsx'
+]);
+
 function resolveLoginFile(args) {
   const candidate = args['login-file']
     || process.env.APPQ_LOGIN_FILE
@@ -91,9 +101,48 @@ function resolveLoginFile(args) {
   const absolute = path.isAbsolute(candidate)
     ? candidate
     : path.resolve(process.cwd(), candidate);
-  if (!fs.existsSync(absolute)) {
+
+  // H4 — directory-traversal guard. The CLI loads the resolved file via
+  // require() / dynamic import(), so a path outside the project root is
+  // an arbitrary-code-execution vector in a compromised CI environment
+  // (malicious PR, supply chain). Require the login file to live inside
+  // the current working directory tree.
+  const projectRoot = process.cwd();
+  const rootWithSep = projectRoot.endsWith(path.sep) ? projectRoot : projectRoot + path.sep;
+  // Realpath to defeat symlink escapes; fall back to absolute if the
+  // file doesn't exist yet so the existence error below still fires
+  // with the user's intended path.
+  let canonical;
+  try {
+    canonical = fs.realpathSync(absolute);
+  } catch (e) {
+    canonical = absolute;
+  }
+  if (canonical !== projectRoot && !canonical.startsWith(rootWithSep)) {
     fail(
-      `Login file not found: ${absolute}\n`
+      `Login file must live inside the project directory.\n`
+      + `  Project root: ${projectRoot}\n`
+      + `  Login file:   ${canonical}\n`
+      + `\n`
+      + `  Resolving outside the project tree would let any process that\n`
+      + `  controls --login-file or APPQ_LOGIN_FILE load arbitrary code\n`
+      + `  through this CLI. Move the file under the project root.`
+    );
+  }
+
+  // H4 — extension allowlist.
+  const ext = path.extname(canonical).toLowerCase();
+  if (!ALLOWED_LOGIN_FILE_EXTENSIONS.has(ext)) {
+    fail(
+      `Login file extension "${ext}" is not allowed.\n`
+      + `  Allowed: ${Array.from(ALLOWED_LOGIN_FILE_EXTENSIONS).join(', ')}\n`
+      + `  Got:     ${canonical}`
+    );
+  }
+
+  if (!fs.existsSync(canonical)) {
+    fail(
+      `Login file not found: ${canonical}\n`
       + `  Create it (default path: ${DEFAULT_LOGIN_FILE}) and export your login flow as a default export:\n`
       + `\n`
       + `    import { defineLogin } from '@appliqation/automation-sdk/login';\n`
@@ -103,7 +152,7 @@ function resolveLoginFile(args) {
       + `    });\n`
     );
   }
-  return absolute;
+  return canonical;
 }
 
 /**
@@ -220,7 +269,13 @@ async function main() {
   }
 
   const targetPath = authStatePath({ project_id, role });
-  fs.mkdirSync(path.dirname(targetPath), { recursive: true });
+  // H1 — restrict the auth-state directory to owner-only. Playwright's
+  // storageState file contains cookies, localStorage, and sessionStorage
+  // — equivalent to a live authenticated browser session. Default
+  // mkdir permissions inherit the umask (typically 0755 / world-readable
+  // on shared CI runners and developer machines); force 0700 so no
+  // other local user can read peer sessions.
+  fs.mkdirSync(path.dirname(targetPath), { recursive: true, mode: 0o700 });
 
   console.log(`→ Launching Chromium for login as role "${role}" against ${baseURL}`);
   const browser = await chromium.launch({ headless: true });
@@ -233,7 +288,15 @@ async function main() {
   try {
     await loginFn(page, { username, password, role, baseURL });
     await context.storageState({ path: targetPath });
-    console.log(`✓ Auth state saved to ${targetPath}`);
+    // H1 — Playwright writes storageState with umask-inherited
+    // permissions (typically 0644). Tighten to 0600 so even other
+    // local users on the same machine cannot read it.
+    try {
+      fs.chmodSync(targetPath, 0o600);
+    } catch (chmodErr) {
+      console.warn(`⚠️  Could not tighten permissions on ${targetPath}: ${chmodErr.message}`);
+    }
+    console.log(`✓ Auth state saved to ${targetPath} (mode 0600)`);
     console.log(`  Tests using setupAuth({ project_id: ${project_id}, role: '${role}' }) will pick this up.`);
   } catch (err) {
     fail(`Login failed: ${err.message}`);

package/src/constants.js

@@ -204,6 +204,23 @@ const DEFAULT_OS = 'Unknown';
  */
 const DEFAULT_APPLIQATION_BASE_URL = 'https://appq.appliqation.io';
 
+// ============================================================================
+// Auto-Tagging Configuration
+// ============================================================================
+
+/**
+ * Tag applied to a test case the first time the SDK submits an accepted
+ * result for it. Marks the test case as automation-covered.
+ *
+ * Fixed, not configurable — appq's own backend (AutomationResultManager's
+ * autoTagScenario/autoTagTestset) writes this exact literal when it
+ * auto-tags at run creation. A configurable client-side name would let the
+ * SDK and backend disagree and produce two different tags for the same
+ * "automated" signal.
+ * @constant {string}
+ */
+const AUTO_TAG_NAME = 'Appq_Auto';
+
 // ============================================================================
 // Exports
 // ============================================================================
@@ -251,5 +268,8 @@ module.exports = {
   DEFAULT_OS,
 
   // Base URL
-  DEFAULT_APPLIQATION_BASE_URL
+  DEFAULT_APPLIQATION_BASE_URL,
+
+  // Auto-Tagging
+  AUTO_TAG_NAME
 };

package/src/core/AuthManager.js

@@ -180,6 +180,11 @@ class AuthManager {
 
   parseJwtExpiry(token) {
     try {
+      // Signature not verified — token is issued by the Appliqation API server
+      // we just authenticated against, so origin is trusted. We only decode
+      // the payload to read `exp` for refresh scheduling. Verifying the HMAC
+      // here would require the server-side signing secret, which the SDK
+      // does not (and must not) hold.
       const payload = JSON.parse(Buffer.from(token.split('.')[1], 'base64').toString());
       // Convert to milliseconds and subtract 5 minutes for safety margin
       return (payload.exp * 1000) - (5 * 60 * 1000);

package/src/index.d.ts

@@ -1,8 +1,20 @@
 /**
  * TypeScript definitions for @appliqation/automation-sdk
- * @version 2.1.0
+ * @version 2.8.0
  */
 
+/**
+ * Scope-mismatch resolution strategy (audit finding C5).
+ *
+ * When `scenarioId` or `testSetId` is set in config and the executed
+ * suite contains UUIDs outside that scope, the SDK applies one of
+ * these strategies before submitting results.
+ *   'cancel' — fail fast, submit nothing, exit 1 (default in CI)
+ *   'adhoc'  — override config, create an ad-hoc run, submit everything
+ *   'filter' — submit only in-scope results, drop the rest locally
+ */
+export type ScopeMismatchStrategy = 'cancel' | 'adhoc' | 'filter';
+
 // ============================================================================
 // Core Types
 // ============================================================================
@@ -49,10 +61,16 @@ export interface AppliqationConfig {
   /** Project key */
   projectKey?: string;
 
-  /** Username for legacy CSRF authentication */
+  /**
+   * @deprecated Legacy CSRF authentication. Slated for removal in a
+   * future major version (audit finding D4). Use `apiKey` instead.
+   */
   username?: string;
 
-  /** Password for legacy CSRF authentication */
+  /**
+   * @deprecated Legacy CSRF authentication. Slated for removal in a
+   * future major version (audit finding D4). Use `apiKey` instead.
+   */
   password?: string;
 
   /** Scenario ID (optional, 0 for generic automation runs) */
@@ -88,9 +106,25 @@ export interface AppliqationConfig {
   /** Batch size for result submission */
   batchSize?: number;
 
-  /** SSL certificate verification (default: true) */
+  /**
+   * SSL certificate verification (default: true).
+   *
+   * H3 — setting this to `false` in a production-like environment
+   * (`CI=true`, `NODE_ENV=production`/`prod`/`staging`, or any well-known
+   * CI env var) will throw `ConfigurationError` at client construction.
+   * Explicit override via `APPLIQATION_INSECURE=allow` for the rare case
+   * where a customer genuinely needs to bypass TLS in CI.
+   */
   rejectUnauthorized?: boolean;
 
+  /**
+   * C5 — scope-mismatch resolution strategy. Applied when the executed
+   * suite contains UUIDs outside the configured `scenarioId`/`testSetId`.
+   * Also settable via `APPLIQATION_ON_SCOPE_MISMATCH` env var.
+   * Defaults to 'cancel' in CI (fail safe), interactive prompt in TTY.
+   */
+  onScopeMismatch?: ScopeMismatchStrategy;
+
   /** Additional options */
   options?: {
     /** Request timeout in milliseconds (default: 30000) */
@@ -232,9 +266,16 @@ export class AppliqationClient {
   constructor(config: AppliqationConfig);
 
   /**
-   * Create a new automation run
+   * Create a new automation run.
+   *
+   * The optional `uuids` field (C4 / E3) pre-populates the run
+   * document's `data[]` array so the UI grid and orphan detector know
+   * which TCs belong to the run before any result lands. Pass plain
+   * string UUIDs matching PR appq/#532's schema (not `{uuid}` objects).
    */
-  createRun(config?: Partial<AppliqationConfig>): Promise<RunMatrixResponse>;
+  createRun(
+    config?: Partial<AppliqationConfig> & { uuids?: string[] }
+  ): Promise<RunMatrixResponse>;
 
   /**
    * Submit a single test result
@@ -299,6 +340,61 @@ export class PayloadBuilder {
     status: TestStatus,
     options?: { comment?: string; attachments?: string[]; metadata?: Record<string, any> }
   ): TestResult;
+
+  /**
+   * S8 — validate a fully assembled automation result payload against
+   * backend shape constraints (InputValidator regexes + status enum).
+   * Runs client-side immediately before submission so schema drift is
+   * caught with a precise field-path error instead of a generic 400.
+   */
+  static validateAutomationResultPayload(payload: {
+    run_id?: unknown;
+    test_case_uuid?: unknown;
+    status?: unknown;
+    source?: unknown;
+    browser?: unknown;
+    environment?: unknown;
+    duration?: unknown;
+    timestamp?: unknown;
+    [key: string]: unknown;
+  }): { valid: boolean; errors: string[] };
+}
+
+/**
+ * C5 — Pre-execution scope validator. Verifies UUIDs about to execute
+ * match the configured scenarioId/testSetId; applies cancel/adhoc/filter
+ * strategy on mismatch. Wired automatically by AppliqationReporter in
+ * `onBegin`; exposed for programmatic use.
+ */
+export class ScopeValidator {
+  constructor(options: {
+    scenarioId?: number | string;
+    testSetId?: number | string;
+    strategy?: ScopeMismatchStrategy;
+    fetchTestSetScope?: (testSetId: number | string) => Promise<Set<string> | string[]>;
+  });
+
+  static readonly STRATEGY: {
+    CANCEL: 'cancel';
+    ADHOC: 'adhoc';
+    FILTER: 'filter';
+  };
+
+  isScoped(): boolean;
+  extractUuidsFromSuite(suite: unknown): string[];
+  validate(uuids: string[]): Promise<{
+    hasMismatch: boolean;
+    inScope: string[];
+    outOfScope: Array<{ uuid: string; actualScenarioId?: number }>;
+    reason: 'scenario' | 'testset' | null;
+  }>;
+  resolve(validation: unknown): Promise<{
+    action: 'cancel' | 'adhoc' | 'filter' | 'pass';
+    submitUuids: string[];
+    droppedUuids: string[];
+    overrideToAdhoc: boolean;
+    message: string;
+  }>;
 }
 
 export const logger: {

package/src/login/index.d.ts

@@ -1,7 +1,8 @@
 /**
  * TypeScript definitions for @appliqation/automation-sdk/login.
  *
- * Customers writing `tests/appliqation/auth/login.ts` import these
+ * Customers writing `tests/automan/auth/login.ts` (default path;
+ * configurable in Project Settings) import these
  * types for autocomplete + compile-time checking on the login flow
  * function shape. Same file gets imported (untyped, dynamically) by
  * the Appliqation executor's LoginHelper and the appq-auth-setup CLI.

package/src/login/index.js

@@ -3,7 +3,8 @@
  * supplied login flows.
  *
  * Customers define their SUT's login flow as a Playwright function in
- * their own repo (canonical path: `tests/appliqation/auth/login.ts`).
+ * their own repo (canonical path: `tests/automan/auth/login.ts`, default;
+ * configurable in Project Settings).
  * The function is imported by:
  *   1. Appliqation's executor (LoginHelper) — pulled from MongoDB
  *      after a GitHub-webhook upsert into automan_canonical_scripts

package/src/playwright/fixture.js

@@ -9,7 +9,10 @@ try {
 }
 
 const JwtBrowserAuth = require('./JwtBrowserAuth');
-require('dotenv').config();
+// L3 — dotenv removed from the fixture. In enterprise CI, env vars are
+// injected by the platform (GitHub Actions, Jenkins, GitLab); a stray
+// committed .env file would otherwise silently override them. Env var
+// loading is the customer's responsibility in playwright.config.ts.
 const { DEFAULT_APPLIQATION_BASE_URL } = require('../constants');
 
 /**