@biffo/cli 0.232.1 → 0.234.0

package/_skeletons/sibling-template/.github/workflows/ci.yml

@@ -103,6 +103,51 @@ jobs:
         # so it cannot assume a layout. Do not edit it here; edit it upstream.
         run: sh ../../scripts/js-dependency-audit.sh
 
+  e2e:
+    name: E2E (Playwright)
+    runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}
+    timeout-minutes: 20
+    # `packages: read` so pnpm can install any private @tabsii-com/* package
+    # from GitHub Packages using the workflow token. Harmless if this sibling
+    # has none.
+    permissions:
+      contents: read
+      packages: read
+    # The official Playwright image, pinned to the @playwright/test version in
+    # apps/frontend/package.json. It ships Chromium and every browser system
+    # dependency, so this needs no `--with-deps`, no apt, and no root on the
+    # self-hosted runners.
+    container:
+      image: mcr.microsoft.com/playwright:v1.61.1-noble
+    defaults:
+      run:
+        working-directory: apps/frontend
+    steps:
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5
+      - uses: pnpm/action-setup@v4
+        with:
+          version: 9.15.9
+      - uses: actions/setup-node@v4
+        with:
+          node-version: ${{ env.NODE_VERSION }}
+          cache: pnpm
+          cache-dependency-path: apps/frontend/pnpm-lock.yaml
+      - run: pnpm install --frozen-lockfile
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      # Browser system deps come from the container; this only drops the
+      # Chromium binary into the resolved cache path (a no-op if present).
+      - name: Install Chromium
+        run: pnpm exec playwright install chromium
+      # `playwright test` boots its own webServer: it builds the static export
+      # and serves it base-path aware, INCLUDING
+      # `/.well-known/biffo-identity.json`. Serving that document is what makes
+      # the harness represent the deployed app -- without it the runtime pool
+      # lookup (#403) resolves null and every spec dies on a redirect to the
+      # portal, which is how tabsii-geo's CI broke for four hours (#1208).
+      - name: E2E tests
+        run: pnpm run e2e
+
   python:
     name: Python (lint, types, test, security)
     runs-on: ${{ vars.RUNNER_LABEL || 'ubuntu-latest' }}

package/_skeletons/sibling-template/apps/frontend/e2e/fixtures.ts

@@ -0,0 +1,44 @@
+// Shared between playwright.config.ts (which builds and serves the static
+// export) and the specs.
+//
+// Every value here is read by BOTH sides, which is the point: the Cognito ids
+// the harness advertises in `/.well-known/biffo-identity.json` must be the same
+// ones `session.ts` seeds a localStorage session with, or the app resolves a
+// pool it has no session for and silently redirects to the portal. That exact
+// mismatch broke tabsii-geo's CI for four hours (#1208).
+
+export const E2E_PORT = Number(process.env['E2E_PORT'] ?? 4330)
+
+// The path CloudFront routes to this sibling, e.g. `/crm`. Read from the same
+// env var `next.config.ts` uses, so the harness cannot disagree with the build.
+export const BASE_PATH = process.env['NEXT_PUBLIC_BASE_PATH'] ?? ''
+
+// Not real credentials, and never used against a real pool — they only have to
+// be internally consistent. Shaped like the real thing so anything that parses
+// a pool id does not choke.
+export const COGNITO_USER_POOL_ID = 'us-east-1_E2ETESTPOOL'
+export const COGNITO_CLIENT_ID = 'e2etestclientid0123456789'
+
+// Injected into `next build` by the Playwright webServer.
+//
+// Deliberately NO `NEXT_PUBLIC_CORE_COGNITO_*`: a sibling resolves its pool at
+// RUNTIME from the identity document (#403), exactly as the deployed app does.
+// Baking a build-time fallback here would make the harness pass in a way the
+// real app cannot, which is the failure this scaffold exists to prevent.
+export const BUILD_ENV: Record<string, string> = {
+  NEXT_PUBLIC_BASE_PATH: BASE_PATH,
+  NEXT_PUBLIC_E2E: '1',
+  NEXT_PUBLIC_API_URL: '',
+  // LOAD-BEARING, and not obviously so. `src/app/page.tsx` only redirects a
+  // signed-out visitor `if (state.kind === 'signed_out' && CORE_PORTAL_URL)`.
+  // Leave this unset and the app has nowhere to send them, so it never
+  // redirects, so `smoke.spec.ts` passes whatever the auth wiring does —
+  // including with the identity document removed entirely.
+  //
+  // That is not hypothetical: the first draft of this scaffold omitted it, and
+  // the smoke test passed against a harness deliberately broken the same way
+  // tabsii-geo's was (#1208). A test that cannot fail is worse than no test,
+  // because it reports coverage. Verified after adding it: breaking the
+  // identity document makes the spec fail on the redirect.
+  NEXT_PUBLIC_CORE_PORTAL_URL: 'https://portal.example.test',
+}

package/_skeletons/sibling-template/apps/frontend/e2e/session.ts

@@ -0,0 +1,90 @@
+// Put the browser in a signed-in state without touching Cognito (crm#65 M1).
+//
+// `src/lib/auth.ts` reads its session through amazon-cognito-identity-js, whose
+// storage keys are derived from the **Client ID only** — deliberately, so the
+// portal's session carries over to this sibling on the same origin (ADR-0007;
+// see the comment in auth.ts). `fixtures.ts`'s `COGNITO_CLIENT_ID` pins that
+// Client ID to a fixed test value, so the key names are deterministic and can
+// be written before first paint — and it is the SAME value
+// `static-server.mjs` advertises in the `/.well-known/biffo-identity.json`
+// document auth.ts now resolves the pool from at runtime (#403), so the pool
+// this seeded session's keys are stored under is the one the app actually
+// builds.
+//
+// Once the pool resolves, the library validates the cached session
+// **locally**: `getCurrentUser()` reads `LastAuthUser`, `getSession()` reads
+// the three token keys, and `CognitoUserSession.isValid()` compares
+// `payload.exp` against now. Nothing is verified cryptographically, so an
+// unsigned JWT with a future `exp` is sufficient.
+//
+// Deliberately NOT a second test-only route. The map harness
+// (`src/app/e2e/map/page.tsx`) mounts a component in isolation, which is the
+// gap #65 exists to close — these specs drive the real `/crm/` app shell.
+
+import type { Page } from '@playwright/test'
+import { COGNITO_CLIENT_ID } from './fixtures'
+
+const USERNAME = 'user@e2e.test'
+
+/** base64url, without padding — the JWT segment encoding. */
+function b64url(value: string): string {
+  return Buffer.from(value)
+    .toString('base64')
+    .replace(/\+/g, '-')
+    .replace(/\//g, '_')
+    .replace(/=+$/, '')
+}
+
+/**
+ * A structurally valid, unsigned JWT.
+ *
+ * The signature segment is the literal `e2e` — it is never checked here, and
+ * making it obviously fake is the point: nothing in this file should look like
+ * a credential that might work somewhere real.
+ */
+function token(extraClaims: Record<string, unknown>): string {
+  const now = Math.floor(Date.now() / 1000)
+  const payload = {
+    sub: 'e2e-sub',
+    email: USERNAME,
+    'cognito:username': USERNAME,
+    aud: COGNITO_CLIENT_ID,
+    token_use: 'id',
+    auth_time: now,
+    iat: now,
+    exp: now + 60 * 60,
+    ...extraClaims,
+  }
+  return `${b64url(JSON.stringify({ alg: 'none', typ: 'JWT' }))}.${b64url(JSON.stringify(payload))}.e2e`
+}
+
+/**
+ * Seed the Cognito session keys before any app code runs.
+ *
+ * `addInitScript` runs on every navigation in the context, ahead of the page's
+ * own scripts — which matters because `page.tsx` calls `getCurrentSession()` in
+ * its first effect, and that now resolves the pool asynchronously (a fetch to
+ * `/.well-known/biffo-identity.json`, #403) before it ever reads localStorage.
+ * Writing localStorage after `goto` would race that and land on the signed-out
+ * screen intermittently.
+ */
+export async function signIn(page: Page): Promise<void> {
+  const prefix = `CognitoIdentityServiceProvider.${COGNITO_CLIENT_ID}`
+  const entries: Record<string, string> = {
+    [`${prefix}.LastAuthUser`]: USERNAME,
+    [`${prefix}.${USERNAME}.idToken`]: token({ token_use: 'id' }),
+    [`${prefix}.${USERNAME}.accessToken`]: token({ token_use: 'access' }),
+    // Present but unused: `getSession` only reaches for it when the cached
+    // session has expired, which it has not.
+    [`${prefix}.${USERNAME}.refreshToken`]: 'e2e-refresh',
+    [`${prefix}.${USERNAME}.clockDrift`]: '0',
+  }
+
+  await page.addInitScript((items: Record<string, string>) => {
+    for (const [k, v] of Object.entries(items)) window.localStorage.setItem(k, v)
+  }, entries)
+}
+
+/** Every request the app has made to the fixture API, in order. */
+
+/** Drop recorded requests and any units created by an earlier test. */

package/_skeletons/sibling-template/apps/frontend/e2e/smoke.spec.ts

@@ -0,0 +1,51 @@
+import { expect, test } from '@playwright/test'
+import { BASE_PATH } from './fixtures'
+import { signIn } from './session'
+
+/**
+ * The one E2E every sibling starts with: **the app boots, and a signed-in
+ * session stays signed in.**
+ *
+ * ## Why this specific assertion
+ *
+ * It is the regression that actually happened. On 2026-08-03 `tabsii-geo`
+ * merged a change moving Cognito pool resolution to runtime (#403), its
+ * Playwright harness did not serve `/.well-known/biffo-identity.json`, so
+ * `getCurrentSession()` resolved null and the app redirected to the portal.
+ * Every spec died on *"Execution context was destroyed, most likely because of
+ * a navigation"*. `tabsii-crm` needed the identical fix for the identical
+ * reason. The branch stayed red for four hours (#1208).
+ *
+ * A sibling that renders its own base path while holding a session is a sibling
+ * whose build, base path, static export, identity document and auth wiring all
+ * agree. Almost every scaffolding mistake breaks one of those, and this catches
+ * it in about a second.
+ *
+ * ## Keep it, then add to it
+ *
+ * This is a floor, not a suite. Add specs for what your sibling actually does —
+ * `tabsii-crm` has brand, FDD and automation flows beside this. But do not
+ * delete it: it is the only test that fails loudly when the harness itself
+ * stops representing the deployed app, which is the failure mode that costs
+ * hours rather than minutes.
+ *
+ * **Make `E2E (Playwright)` a required status check on `dev`.** `tabsii-geo`
+ * had five E2E files and did not require them, so the regression above merged
+ * green — coverage that cannot block a merge is documentation.
+ */
+
+test('a signed-in session renders the app without redirecting to the portal', async ({ page }) => {
+  // Seed the session BEFORE the first navigation. `identity.ts` fetches the
+  // identity document and reads localStorage during hydration, so writing the
+  // session after `goto` races that and lands on the signed-out path.
+  await signIn(page)
+
+  await page.goto(`${BASE_PATH}/`)
+
+  // Still here — not bounced to the portal.
+  await expect(page).toHaveURL(new RegExp(`${BASE_PATH}/?$`))
+
+  // And something actually rendered, rather than an empty shell that merely
+  // failed to redirect.
+  await expect(page.locator('body')).not.toBeEmpty()
+})

package/_skeletons/sibling-template/apps/frontend/e2e/static-server.mjs

@@ -0,0 +1,122 @@
+// Minimal static file server for the Next.js static export (output: 'export').
+//
+// The export is built with the sibling's basePath, so every emitted asset URL is
+// prefixed with /crm — but the files themselves live at the `out/` ROOT (Next
+// does not nest the export under the basePath directory). In production the
+// parent CloudFront distribution syncs `out/` into the sibling's S3 prefix; here we
+// reproduce the same effect by stripping the leading the base path from each request
+// path before resolving it against `out/`.
+import { createServer } from 'node:http'
+
+import { readFile, stat } from 'node:fs/promises'
+import { join, extname, normalize } from 'node:path'
+import { fileURLToPath } from 'node:url'
+
+const ROOT = fileURLToPath(new URL('../out/', import.meta.url))
+const BASE_PATH = process.env.E2E_BASE_PATH || process.env.NEXT_PUBLIC_BASE_PATH || ''
+const PORT = Number(process.env.E2E_PORT || 4321)
+
+// The document the CORE portal publishes at runtime (#403/#400) — auth.ts's
+// identity.ts resolves the Cognito pool from this instead of a baked
+// NEXT_PUBLIC_CORE_COGNITO_* build var. Real deployments serve it same-origin
+// from the portal's own bucket; here it stands in for that, sourced from the
+// SAME E2E_COGNITO_* values playwright.config.ts derives from e2e/fixtures.ts,
+// so the pool/client id this document advertises always matches the one
+// e2e/session.ts used to seed the localStorage session.
+const IDENTITY_DOCUMENT_PATH = '/.well-known/biffo-identity.json'
+const IDENTITY_DOCUMENT = JSON.stringify({
+  userPoolId: process.env.E2E_COGNITO_USER_POOL_ID || '',
+  clientId: process.env.E2E_COGNITO_CLIENT_ID || '',
+})
+
+const CONTENT_TYPES = {
+  '.html': 'text/html; charset=utf-8',
+  '.js': 'text/javascript; charset=utf-8',
+  '.mjs': 'text/javascript; charset=utf-8',
+  '.css': 'text/css; charset=utf-8',
+  '.json': 'application/json; charset=utf-8',
+  '.geojson': 'application/json; charset=utf-8',
+  '.svg': 'image/svg+xml',
+  '.png': 'image/png',
+  '.jpg': 'image/jpeg',
+  '.ico': 'image/x-icon',
+  '.txt': 'text/plain; charset=utf-8',
+  '.woff2': 'font/woff2',
+  '.woff': 'font/woff',
+  '.map': 'application/json; charset=utf-8',
+}
+
+async function resolveFile(urlPath) {
+  // Strip the sibling base path: the files live at out/ root.
+  let p = urlPath
+  if (p === BASE_PATH) p = '/'
+  else if (p.startsWith(`${BASE_PATH}/`)) p = p.slice(BASE_PATH.length)
+  if (p.endsWith('/')) p += 'index.html'
+
+  // Block path traversal, then resolve against ROOT.
+  const rel = normalize(p).replace(/^(\.\.[/\\])+/, '')
+  let filePath = join(ROOT, rel)
+
+  let s = await stat(filePath).catch(() => null)
+  if (s?.isDirectory()) {
+    filePath = join(filePath, 'index.html')
+    s = await stat(filePath).catch(() => null)
+  }
+  if (!s) {
+    // Extensionless route (trailingSlash export also emits foo/index.html).
+    const alt = `${filePath}.html`
+    if (await stat(alt).catch(() => null)) return alt
+    return null
+  }
+  return filePath
+}
+
+/** Read a JSON request body, tolerating an empty one. */
+
+const server = createServer((req, res) => {
+  void (async () => {
+    try {
+      const url = new URL(req.url, 'http://localhost')
+      const urlPath = decodeURIComponent(url.pathname)
+
+      // The core identity document, served ROOT-relative and same-origin —
+      // NOT under BASE_PATH, matching how the real portal publishes it and
+      // how identity.ts fetches it (an absolute `/.well-known/...` path).
+      if (urlPath === IDENTITY_DOCUMENT_PATH) {
+        res.writeHead(200, {
+          'content-type': 'application/json; charset=utf-8',
+          'cache-control': 'no-store',
+        })
+        res.end(IDENTITY_DOCUMENT)
+        return
+      }
+
+      // Where a sibling's Core-API fixtures go, if it needs them. Under E2E
+      // `NEXT_PUBLIC_API_URL` is '', so the app's Core-API calls are
+      // same-origin relative paths and arrive here. Add an `api-fixtures.mjs`
+      // beside this file and dispatch to it before the static fallback below —
+      // tabsii-crm's is the worked example. A sibling with no BFF calls needs
+      // nothing here.
+
+      const filePath = await resolveFile(urlPath)
+      if (!filePath) {
+        res.writeHead(404, { 'content-type': 'text/plain' })
+        res.end('Not found')
+        return
+      }
+      const body = await readFile(filePath)
+      res.writeHead(200, {
+        'content-type': CONTENT_TYPES[extname(filePath)] || 'application/octet-stream',
+        'cache-control': 'no-store',
+      })
+      res.end(body)
+    } catch (err) {
+      res.writeHead(500, { 'content-type': 'text/plain' })
+      res.end(String(err))
+    }
+  })()
+})
+
+server.listen(PORT, '127.0.0.1', () => {
+  process.stdout.write(`static-server: http://127.0.0.1:${PORT}${BASE_PATH}/ (root: ${ROOT})\n`)
+})

package/_skeletons/sibling-template/apps/frontend/package.json

@@ -9,7 +9,8 @@
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "typecheck": "tsc --noEmit",
-    "test": "vitest run"
+    "test": "vitest run",
+    "e2e": "playwright test"
   },
   "dependencies": {
     "amazon-cognito-identity-js": "^6.3.12",
@@ -19,6 +20,7 @@
   },
   "devDependencies": {
     "@eslint/eslintrc": "^3.2.0",
+    "@playwright/test": "^1.61.1",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.2",

package/_skeletons/sibling-template/apps/frontend/playwright.config.ts

@@ -0,0 +1,45 @@
+import { defineConfig, devices } from '@playwright/test'
+import {
+  BASE_PATH,
+  BUILD_ENV,
+  COGNITO_CLIENT_ID,
+  COGNITO_USER_POOL_ID,
+  E2E_PORT,
+} from './e2e/fixtures'
+
+// Browser E2E harness for this sibling's static-export frontend.
+//
+// The webServer builds the export and serves it base-path aware on a local
+// port, including `/.well-known/biffo-identity.json` — the document the app
+// resolves its Cognito pool from at runtime (#403). Serving it is not optional:
+// without it `getCurrentSession()` resolves null, the app redirects to the
+// portal, and every spec dies on a navigation. That is precisely how
+// tabsii-geo's CI broke for four hours (#1208).
+const baseURL = `http://127.0.0.1:${E2E_PORT}`
+const isCI = !!process.env['CI']
+
+export default defineConfig({
+  testDir: './e2e',
+  // Only *.spec.ts are tests; fixtures.ts / session.ts / static-server.mjs are helpers.
+  testMatch: /.*\.spec\.ts/,
+  fullyParallel: true,
+  forbidOnly: isCI,
+  retries: isCI ? 1 : 0,
+  ...(isCI ? { workers: 1 } : {}),
+  reporter: isCI ? [['github'], ['list']] : 'list',
+  use: { baseURL, trace: 'on-first-retry' },
+  projects: [{ name: 'chromium', use: { ...devices['Desktop Chrome'] } }],
+  webServer: {
+    command: 'pnpm run build && node e2e/static-server.mjs',
+    url: `${baseURL}${BASE_PATH}/`,
+    reuseExistingServer: !isCI,
+    timeout: 180_000,
+    env: {
+      ...BUILD_ENV,
+      E2E_PORT: String(E2E_PORT),
+      E2E_BASE_PATH: BASE_PATH,
+      E2E_COGNITO_USER_POOL_ID: COGNITO_USER_POOL_ID,
+      E2E_COGNITO_CLIENT_ID: COGNITO_CLIENT_ID,
+    },
+  },
+})

package/_skeletons/sibling-template/apps/frontend/pnpm-lock.yaml

@@ -18,7 +18,7 @@ importers:
         version: 6.3.18
       next:
         specifier: ^15.5.22
-        version: 15.5.22(@babel/core@7.29.7)(@types/node@22.20.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
+        version: 15.5.22(@babel/core@7.29.7)(@playwright/test@1.62.1)(@types/node@22.20.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7)
       react:
         specifier: ^19.0.0
         version: 19.2.7
@@ -29,6 +29,9 @@ importers:
       '@eslint/eslintrc':
         specifier: ^3.2.0
         version: 3.3.5
+      '@playwright/test':
+        specifier: ^1.61.1
+        version: 1.62.1
       '@testing-library/dom':
         specifier: ^10.4.1
         version: 10.4.1
@@ -705,6 +708,11 @@ packages:
     resolution: {integrity: sha512-nn5ozdjYQpUCZlWGuxcJY/KpxkWQs4DcbMCmKojjyrYDEAGy4Ce19NN4v5MduafTwJlbKc99UA8YhSVqq9yPZA==}
     engines: {node: '>=12.4.0'}
 
+  '@playwright/test@1.62.1':
+    resolution: {integrity: sha512-DTcUc8qii+cpHvtOwggMtBRMjKZHXYWdw8syRYu2vtzuq4Wxphqq4NfCs5Zt44L6mA8rfDfj+PHnxFc/FeK6mQ==}
+    engines: {node: '>=20'}
+    hasBin: true
+
   '@rolldown/pluginutils@1.0.0-beta.27':
     resolution: {integrity: sha512-+d0F4MKMCbeVUJwG96uQ4SgAznZNSq93I3V+9NHA4OpvqG8mRCpGdKmK8l/dl02h2CCDHwW2FqilnTyDcAnqjA==}
 
@@ -1610,6 +1618,11 @@ packages:
     resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
     engines: {node: '>= 0.4'}
 
+  fsevents@2.3.2:
+    resolution: {integrity: sha512-xiqMQR4xAeHTuB9uWm+fFRcIOgKBMiOBP+eXiyT7jsgVCq1bkVygt00oASowB7EdtpOHaaPgKt812P9ab+DDKA==}
+    engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
+    os: [darwin]
+
   fsevents@2.3.3:
     resolution: {integrity: sha512-5xoDfX+fL7faATnagmWPpbFtwh/R77WmMMqqHGS65C3vvB0YHrgF+B1YmZ3441tMj5n63k0212XNoJwzlhffQw==}
     engines: {node: ^8.16.0 || ^10.6.0 || >=11.0.0}
@@ -2104,6 +2117,16 @@ packages:
     resolution: {integrity: sha512-RvwwcruNjI1ncT5xRakeyS9Lf8lcItv34KD+aif+VH9kduAyfYBipGh12274xtenIPZ119/R9BdTBa8gAwSh0A==}
     engines: {node: '>=12'}
 
+  playwright-core@1.62.1:
+    resolution: {integrity: sha512-wPYSwEBJY9GHraISXqyqtx0na0LpO3XEX7jNDhntbex7tzUS7kLnZsOlFruFJB4Hi/rhDMjXGqHewDZ68nYZVw==}
+    engines: {node: '>=20'}
+    hasBin: true
+
+  playwright@1.62.1:
+    resolution: {integrity: sha512-0M+L3LAD8/nm554LOla9Ayx0j0tmFZ0FBcoQ7F1VuVHpM/XpiC8RcDzBQB8W5+hA8L22THxELzeF+2WcUzvcLg==}
+    engines: {node: '>=20'}
+    hasBin: true
+
   possible-typed-array-names@1.1.0:
     resolution: {integrity: sha512-/+5VFTchJDoVj3bhoqi6UeymcD00DAwb1nJwamzPvHEszJ4FpF6SNNbUbOS8yI56qHzdV8eK0qEfOSiodkTdxg==}
     engines: {node: '>= 0.4'}
@@ -3123,6 +3146,10 @@ snapshots:
 
   '@nolyfill/is-core-module@1.0.39': {}
 
+  '@playwright/test@1.62.1':
+    dependencies:
+      playwright: 1.62.1
+
   '@rolldown/pluginutils@1.0.0-beta.27': {}
 
   '@rollup/rollup-android-arm-eabi@4.62.2':
@@ -4188,6 +4215,9 @@ snapshots:
     dependencies:
       is-callable: 1.2.7
 
+  fsevents@2.3.2:
+    optional: true
+
   fsevents@2.3.3:
     optional: true
 
@@ -4568,7 +4598,7 @@ snapshots:
 
   natural-compare@1.4.0: {}
 
-  next@15.5.22(@babel/core@7.29.7)(@types/node@22.20.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
+  next@15.5.22(@babel/core@7.29.7)(@playwright/test@1.62.1)(@types/node@22.20.0)(react-dom@19.2.7(react@19.2.7))(react@19.2.7):
     dependencies:
       '@next/env': 15.5.22
       '@swc/helpers': 0.5.15
@@ -4586,6 +4616,7 @@ snapshots:
       '@next/swc-linux-x64-musl': 15.5.22
       '@next/swc-win32-arm64-msvc': 15.5.22
       '@next/swc-win32-x64-msvc': 15.5.22
+      '@playwright/test': 1.62.1
       sharp: 0.35.3(@types/node@22.20.0)
     transitivePeerDependencies:
       - '@babel/core'
@@ -4694,6 +4725,14 @@ snapshots:
 
   picomatch@4.0.5: {}
 
+  playwright-core@1.62.1: {}
+
+  playwright@1.62.1:
+    dependencies:
+      playwright-core: 1.62.1
+    optionalDependencies:
+      fsevents: 2.3.2
+
   possible-typed-array-names@1.1.0: {}
 
   postcss@8.5.23:

package/dist/index.js

@@ -1370,6 +1370,7 @@ var DEFAULT_STATUS_CHECKS = [
   "Secret Scan",
   "Terraform Validate & Security"
 ];
+var SIBLING_STATUS_CHECKS = [...DEFAULT_STATUS_CHECKS, "E2E (Playwright)"];
 var REPO_MERGE_SETTINGS = {
   allow_auto_merge: true,
   delete_branch_on_merge: true
@@ -6602,7 +6603,7 @@ async function configureSiblingGithub(github, config, coreConfig, session, coreI
   await github.createBranch(org, repo, "staging", "dev");
   await github.createBranch(org, repo, "main", "dev");
   await github.setDefaultBranch(org, repo, "dev");
-  await github.configureBranchProtection(config);
+  await github.configureBranchProtection(config, void 0, SIBLING_STATUS_CHECKS);
   await github.createEnvironments(config);
   await github.sealBranchProtection(org, repo);
   await github.enableVulnerabilityAlerts(org, repo);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@biffo/cli",
-  "version": "0.232.1",
+  "version": "0.234.0",
   "description": "Biffo project scaffolding CLI",
   "license": "MIT",
   "type": "module",