@camunda/e2e-test-suite 0.0.1253 → 0.0.1254

package/dist/pages/8.10/AppsPage.js

@@ -261,8 +261,12 @@ class AppsPage {
             }
         };
         for (let attempt = 0; attempt < maxRetries; attempt++) {
-            await this.clickCamundaApps();
-            await this.clickModeler();
+            // Camunda Hub (hub.*) replaced Console + Web Modeler on SaaS and has no
+            // app switcher: its home already is the Modeler home.
+            if (!new URL(this.page.url()).hostname.startsWith('hub.')) {
+                await this.clickCamundaApps();
+                await this.clickModeler();
+            }
             try {
                 await modelerReady();
                 return;

package/dist/pages/8.10/ClusterDetailsPage.d.ts

@@ -32,6 +32,7 @@ declare class ClusterDetailsPage {
     readonly createAlertButton: Locator;
     readonly createNewClientButton: Locator;
     readonly clientsList: Locator;
+    readonly clientsFilterInput: Locator;
     readonly envVarsTab: Locator;
     readonly zeebeCheckbox: Locator;
     readonly apiClientNameTextbox: Locator;
@@ -50,7 +51,7 @@ declare class ClusterDetailsPage {
     readonly restartRequiredDialog: Locator;
     readonly restartConfirmButton: Locator;
     readonly mcpTab: Locator;
-    readonly mcpTextarea: Locator;
+    readonly mcpConfigBlock: Locator;
     constructor(page: Page);
     clickAPITab(): Promise<void>;
     dismissOopsIfPresent(): Promise<void>;
@@ -64,7 +65,6 @@ declare class ClusterDetailsPage {
     clickCreateButton(): Promise<void>;
     clickCloseModalButton(): Promise<void>;
     assertAPIClientScopes(name: string): Promise<void>;
-    filterClientsList(name: string): Promise<void>;
     clickSettingsTab(): Promise<void>;
     private waitForAuthorizationsSection;
     enableAuthorizations(): Promise<void>;

package/dist/pages/8.10/ClusterDetailsPage.js

@@ -39,6 +39,7 @@ class ClusterDetailsPage {
     createAlertButton;
     createNewClientButton;
     clientsList;
+    clientsFilterInput;
     envVarsTab;
     zeebeCheckbox;
     apiClientNameTextbox;
@@ -57,7 +58,7 @@ class ClusterDetailsPage {
     restartRequiredDialog;
     restartConfirmButton;
     mcpTab;
-    mcpTextarea;
+    mcpConfigBlock;
     constructor(page) {
         this.page = page;
         this.apiTab = page.getByRole('tab', { name: 'API' });
@@ -101,7 +102,14 @@ class ClusterDetailsPage {
         this.clientCredentialsDialog = page.getByRole('dialog').filter({
             has: page.getByText('The Client Secret will not be shown again.'),
         });
-        this.closeModalButton = this.clientCredentialsDialog.getByLabel('Close');
+        // Hub's client-credentials dialog (design-system Dialog, not the old
+        // Carbon one) exposes its close affix as an accessible button named
+        // "Close" rather than via an aria-label picked up by getByLabel -- see
+        // camunda-hub's own e2e suite, ConsoleClusterDetailsPage.ts
+        // (clientCredentialsDialogCloseButton), which already uses this pattern.
+        this.closeModalButton = this.clientCredentialsDialog.getByRole('button', {
+            name: 'Close',
+        });
         this.clustersLink = page
             .getByRole('banner')
             .getByRole('link', { name: 'Clusters' });
@@ -129,6 +137,17 @@ class ClusterDetailsPage {
             name: 'Create new client',
         });
         this.clientsList = page.getByRole('row').filter({ hasNotText: 'Scopes' });
+        // The clients table paginates at ten rows and is not ordered by creation
+        // time, so on a cluster that already has clients a newly created one is
+        // usually on a page other than the one being displayed -- matching a row
+        // without filtering first reports it as missing (main's filterClientsList
+        // existed for exactly this). "Filter table" was Carbon's default
+        // TableToolbarSearch label; Hub's rebranded panel renders a plain
+        // "Search" input instead, so match either.
+        this.clientsFilterInput = page
+            .getByRole('searchbox', { name: 'Filter table' })
+            .or(page.getByRole('searchbox', { name: 'Search' }))
+            .or(page.getByPlaceholder('Search'));
         this.envVarsTab = this.clientCredentialsDialog.getByRole('tab', {
             name: 'Env Vars',
         });
@@ -179,7 +198,13 @@ class ClusterDetailsPage {
             name: 'Continue',
         });
         this.mcpTab = page.getByRole('tab', { name: 'MCP' });
-        this.mcpTextarea = page.getByRole('textbox', { name: 'Copy to clipboard' });
+        // The config text renders in a <pre> inside the MCP-labelled panel, not
+        // a textbox -- matches the already-working 8.9 sibling's locator. A live
+        // trace confirmed "Copy to clipboard" is actually the aria-label/title of
+        // an unrelated icon-only <button> positioned over that block, which is
+        // why getByRole('textbox', {name: 'Copy to clipboard'}) always found
+        // nothing here.
+        this.mcpConfigBlock = page.getByLabel('MCP', { exact: true }).locator('pre');
     }
     async clickAPITab() {
         await (0, test_1.expect)(this.apiTab).toBeVisible({ timeout: 60000 });
@@ -252,33 +277,34 @@ class ClusterDetailsPage {
     async assertAPIClientScopes(name) {
         const row = this.clientsList.filter({ hasText: name });
         const scopes = /(?=.*Orchestration)(?=.*Optimize)(?=.*Secrets)/;
-        await this.filterClientsList(name);
-        try {
-            await (0, test_1.expect)(row).toContainText(scopes, { timeout: 30000 });
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                // The table paginates and isn't ordered by creation time, so a newly
+                // created client is usually on a page other than the one displayed --
+                // filter down to it first, the same way main's filterClientsList did,
+                // rather than matching rows only on the currently rendered page.
+                await (0, test_1.expect)(this.clientsFilterInput).toBeVisible({ timeout: 60000 });
+                await this.clientsFilterInput.fill(name);
+                await (0, test_1.expect)(row).toContainText(scopes, { timeout: 60000 });
+                return;
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                // A panel that rendered before the client existed — or that failed
+                // into the "Oops ... something went wrong." state — only picks the
+                // new client up on a refetch, which is what reloading the API tab
+                // forces. A single reload isn't always enough on a nightly cluster
+                // this suite reuses across parallel test workers, so retry more
+                // than once before failing the test.
+                console.warn(`assertAPIClientScopes: "${name}" is not listed yet (attempt ${attempt}/${maxAttempts}); reloading the API tab and retrying. ${error}`);
+                await this.dismissOopsIfPresent();
+                await this.page.reload({ waitUntil: 'domcontentloaded' });
+                await this.clickAPITab();
+            }
         }
-        catch (error) {
-            // A panel that rendered before the client existed — or that failed into
-            // the "Oops ... something went wrong." state — only picks the new client
-            // up on a refetch, which is what reloading the API tab forces.
-            console.warn(`assertAPIClientScopes: "${name}" is not listed yet; reloading the API tab and retrying. ${error}`);
-            await this.dismissOopsIfPresent();
-            await this.page.reload({ waitUntil: 'domcontentloaded' });
-            await this.clickAPITab();
-            await this.filterClientsList(name);
-            await (0, test_1.expect)(row).toContainText(scopes, { timeout: 60000 });
-        }
-    }
-    // Narrows the clients table to one client through the table's own filter.
-    // The table paginates at ten rows and is not ordered by creation time, so on
-    // a cluster that already has clients a newly created one is usually on a
-    // page other than the one being displayed — matching a row without filtering
-    // first reports it as missing.
-    async filterClientsList(name) {
-        const filterInput = this.page.getByRole('searchbox', {
-            name: 'Filter table',
-        });
-        await (0, test_1.expect)(filterInput).toBeVisible({ timeout: 60000 });
-        await filterInput.fill(name);
     }
     async clickSettingsTab() {
         // Console paints the cluster-details tab list before it finishes
@@ -772,8 +798,26 @@ class ClusterDetailsPage {
         await this.mcpTab.click();
     }
     async getMcpConfigurationText() {
-        await (0, test_1.expect)(this.mcpTextarea).toBeVisible({ timeout: 60000 });
-        return await this.mcpTextarea.innerText();
+        // CI (PR #3629, "Create Agentic Orchestration Cluster") showed the MCP
+        // panel's config block still not rendered 60s after clickMCPTab()
+        // reported a successful click -- the same "click landed but the panel
+        // never switched" race already seen on the Connector Secrets tab.
+        // Re-click the tab and retry rather than failing on the first miss.
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                await (0, test_1.expect)(this.mcpConfigBlock).toBeVisible({ timeout: 60000 });
+                return await this.mcpConfigBlock.innerText();
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                console.warn(`getMcpConfigurationText: MCP panel did not render (attempt ${attempt}/${maxAttempts}); re-clicking the MCP tab and retrying. ${error}`);
+                await this.clickMCPTab();
+            }
+        }
+        throw new Error('getMcpConfigurationText: unreachable');
     }
     async createMCPClientAndReturnVariables(name, setEnvVariables = true) {
         await this.createAPIClient(name);

package/dist/pages/8.10/ClusterPage.js

@@ -143,10 +143,38 @@ class ClusterPage {
         this.clusterVersion = (clusterName, versionText) => this.clusterRow(clusterName).getByText(versionText, { exact: false });
     }
     async clickClusterBanner() {
-        await this.page
+        // Camunda Hub has no `banner` landmark; "Clusters" instead lives in its
+        // persistent "Main navigation" sidebar, and once the org has environments
+        // enabled that link is further renamed "Environments" (same rollout
+        // HomePage.clusterTab handles).
+        const clusterLink = this.page
             .getByRole('banner')
             .getByRole('link', { name: 'Clusters' })
-            .click({ timeout: 60000 });
+            .or(this.page
+            .getByRole('navigation', { name: 'Main navigation' })
+            .getByRole('link', { name: 'Clusters', exact: true }))
+            .or(this.page
+            .getByRole('navigation', { name: 'Main navigation' })
+            .getByRole('link', { name: 'Environments', exact: true }));
+        await clusterLink.click({ timeout: 60000 });
+        // Landing on Hub's Environments overview (see above) renders clusters as
+        // cards, not the getByRole('row') table this page's own locators expect
+        // -- route through the page's own "Clusters" tab to reach the classic
+        // route. Same fix as HomePage.clickClusters().
+        const clustersPageTab = this.page
+            .getByRole('navigation', { name: 'Environments views' })
+            .getByRole('link', { name: 'Clusters', exact: true });
+        // On Hub this tab is required -- the row-based locators callers use right
+        // after this method return nothing on the card-based Environments
+        // overview, so a slow render must not be treated as "tab doesn't exist"
+        // the way the legacy (non-Hub) shell's 5s probe is allowed to.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await (0, test_1.expect)(clustersPageTab).toBeVisible({ timeout: 30000 });
+            await clustersPageTab.click({ timeout: 15000 });
+        }
+        else if (await clustersPageTab.isVisible({ timeout: 5000 }).catch(() => false)) {
+            await clustersPageTab.click({ timeout: 15000 });
+        }
     }
     async confirmClusterDeletion() {
         await (0, test_1.expect)(this.dialog).toBeVisible({ timeout: 60000 });

package/dist/pages/8.10/ClusterSecretsPage.js

@@ -56,15 +56,46 @@ class ClusterSecretsPage {
             name: 'Cancel',
             exact: true,
         });
-        this.bulkImportErrorBanner = this.dialog.getByText(/Imported \d+ secrets?, \d+ failed/);
-        this.secretsSearchBox = page.getByRole('searchbox', { name: 'Filter table' });
+        // Hub's Import secrets dialog reports partial failures as "Imported X of
+        // Y secrets. Not imported: <key> — a secret with this key already
+        // exists; ..." -- confirmed from the PR #3629 CI trace screenshot for
+        // "Create AWS Cluster". This page object is also still exercised on the
+        // legacy Console under IS_PROD (that shell reports "Imported X secrets, Y
+        // failed" instead), so match either rather than assuming every env has
+        // rolled Hub out.
+        this.bulkImportErrorBanner = this.dialog
+            .getByText(/Imported \d+ of \d+ secrets?\./)
+            .or(this.dialog.getByText(/Imported \d+ secrets?, \d+ failed/));
+        // "Filter table" was Carbon's default TableToolbarSearch label. Camunda
+        // Hub's rebranded panel renders a plain "Search" input instead, so the
+        // old exact-name match never resolves and assertSecretsOrCreate falls
+        // through to (re-)creating secrets that may already exist. Match either
+        // (see the 8.9 sibling fix, confirmed via a live trace).
+        this.secretsSearchBox = page
+            .getByRole('searchbox', { name: 'Filter table' })
+            .or(page.getByRole('searchbox', { name: 'Search' }))
+            .or(page.getByPlaceholder('Search'));
+        // Camunda Hub has no `banner` landmark; "Clusters" instead lives in its
+        // persistent "Main navigation" sidebar, and once the org has environments
+        // enabled that link is further renamed "Environments" (same rollout
+        // HomePage.clusterTab handles).
         this.clusterBanner = this.page
             .getByRole('banner')
-            .getByRole('link', { name: 'Clusters' });
+            .getByRole('link', { name: 'Clusters' })
+            .or(this.page
+            .getByRole('navigation', { name: 'Main navigation' })
+            .getByRole('link', { name: 'Clusters', exact: true }))
+            .or(this.page
+            .getByRole('navigation', { name: 'Main navigation' })
+            .getByRole('link', { name: 'Environments', exact: true }));
         this.clusterLink = (name) => page.getByRole('link', { name: name });
-        this.clusterSecretTab = this.page.getByRole('tab', {
-            name: 'Connector Secrets',
-        });
+        // Some environments render this tab as "Cluster secrets" rather than
+        // "Connector Secrets" -- match either (see ClusterPage's identical
+        // connectorSecretsTab fallback; this page object has its own separate
+        // locator and was missing it).
+        this.clusterSecretTab = this.page
+            .getByRole('tab', { name: 'Cluster secrets' })
+            .or(this.page.getByRole('tab', { name: 'Connector Secrets' }));
         this.confirmDeleteInput = page.getByRole('textbox', {
             name: 'Type the word DELETE to confirm',
         });
@@ -106,17 +137,55 @@ class ClusterSecretsPage {
     async clickCreateNewSecretButton(cluster) {
         try {
             await this.createNewSecretButton.click({ timeout: 60000 });
+            return;
         }
         catch (error) {
+            // fall through to the recovery path below
+        }
+        // CI (PR #3629, "Create Default Cluster" / "Create AWS Cluster") showed
+        // the "Connector Secrets" tab still not rendered 30s after navigating
+        // back to the cluster -- a single recovery attempt isn't always enough
+        // once the page is this slow to settle, so retry the whole
+        // banner->cluster->tab sequence rather than failing on the first miss.
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
             await this.clickClusterBanner();
             await this.clickCluster(cluster);
-            await this.clusterSecretTab.click({ timeout: 30000 });
-            await this.createNewSecretButton.click({ timeout: 30000 });
+            try {
+                await this.clusterSecretTab.click({ timeout: 30000 });
+                await this.createNewSecretButton.click({ timeout: 30000 });
+                return;
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                console.warn(`clickCreateNewSecretButton: recovery attempt ${attempt}/${maxAttempts} failed; retrying. ${error}`);
+            }
         }
     }
     async clickClusterBanner() {
         await (0, test_1.expect)(this.clusterBanner).toBeVisible({ timeout: 30000 });
         await this.clusterBanner.click({ timeout: 60000 });
+        // Landing on Hub's Environments overview (see clusterBanner above) renders
+        // clusters as cards, not the getByRole('link') the clusterLink() locator
+        // below expects to find directly -- route through the page's own
+        // "Clusters" tab to reach the classic route. Same fix as
+        // HomePage.clickClusters().
+        const clustersPageTab = this.page
+            .getByRole('navigation', { name: 'Environments views' })
+            .getByRole('link', { name: 'Clusters', exact: true });
+        // On Hub this tab is required -- clickCluster()'s row-based clusterLink
+        // resolves nothing on the card-based Environments overview, so a slow
+        // render must not be treated as "tab doesn't exist" the way the legacy
+        // (non-Hub) shell's 5s probe is allowed to.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await (0, test_1.expect)(clustersPageTab).toBeVisible({ timeout: 30000 });
+            await clustersPageTab.click({ timeout: 15000 });
+        }
+        else if (await clustersPageTab.isVisible({ timeout: 5000 }).catch(() => false)) {
+            await clustersPageTab.click({ timeout: 15000 });
+        }
     }
     async clickCluster(name) {
         await (0, test_1.expect)(this.clusterLink(name)).toBeVisible({ timeout: 30000 });
@@ -171,9 +240,72 @@ class ClusterSecretsPage {
         await (0, test_1.expect)(this.page.getByText('Creating...')).not.toBeVisible({
             timeout: 60000,
         });
-        await (0, test_1.expect)(this.createNewSecretButton).toBeVisible({
-            timeout: 60000,
+        const secretRow = this.page.getByRole('row', {
+            name: new RegExp(`^${key}\\b`, 'i'),
         });
+        // Two separate CI runs (35854706213 with 7 secrets, and 36011511221 with
+        // 13) each showed 100% of secrets taking the reload path on attempt 1 --
+        // not an occasional race, and not even "near-universal": zero exceptions
+        // across 20 samples. A wait on the unreloaded panel was therefore never
+        // going to pay off, so reload unconditionally before the first check
+        // instead of probing a state that has never once been the real one.
+        await this.page.reload({ waitUntil: 'domcontentloaded' });
+        await this.clickClusterBanner();
+        await this.clickCluster(cluster);
+        await this.clusterSecretTab.click({ timeout: 30000 });
+        const maxAttempts = 3;
+        for (let attempt = 1; attempt <= maxAttempts; attempt++) {
+            try {
+                await (0, test_1.expect)(this.createNewSecretButton).toBeVisible({
+                    timeout: 60000,
+                });
+                // The button reappearing only proves the panel re-rendered, not that
+                // this specific secret was created -- a failed create request can
+                // leave the panel in the same state. Verify the row before
+                // returning: CI showed the row can lag briefly behind the button on
+                // a slow reload.
+                //
+                // Filter down to this key first: a live CI trace (run 36001802609,
+                // "Create Default Cluster") showed the unfiltered check time out on
+                // both attempts even though the key was confirmed present -- the
+                // create POST itself returned 409 (already exists) and the API's own
+                // list included it -- because the cluster's shared, reused secret set
+                // had grown past what the alphabetically-sorted table renders without
+                // narrowing it, the same "off-screen in a long list" pattern
+                // documented for Hub's other list views. assertSecretsOrCreate
+                // already searches before deciding a secret is missing; do the same
+                // here before concluding the create failed.
+                await (0, test_1.expect)(this.secretsSearchBox).toBeVisible({ timeout: 10000 });
+                await this.secretsSearchBox.fill(key);
+                await (0, test_1.expect)(secretRow).toBeVisible({ timeout: 60000 });
+                return;
+            }
+            catch (error) {
+                if (attempt === maxAttempts) {
+                    throw error;
+                }
+                // The secrets panel can land in a Carbon "Oops ... something went
+                // wrong." state after a background request fails post-create, which
+                // never recovers on its own and only clears on a reload. Reload
+                // unconditionally rather than gating on an "Oops" heading: PR#3627's
+                // CI hit this same timeout with no Oops heading ever rendered, and
+                // the panel still only recovered on a reload -- the same
+                // unconditional reload bulkImportSecrets() already uses on this
+                // identical panel. A single retry wasn't always enough either on
+                // this suite's shared, reused cluster, so retry more than once.
+                console.warn(`createNewSecret: "${key}" was created but the secrets list did not re-render (attempt ${attempt}/${maxAttempts}); reloading and retrying. ${error}`);
+                await this.page.reload({ waitUntil: 'domcontentloaded' });
+                // The reload lands back on the cluster's default Overview tab, not
+                // Connector Secrets -- a CI failure screenshot confirmed the page
+                // stuck there with the secrets panel never reached, so
+                // createNewSecretButton was never going to reappear on the next
+                // attempt regardless of whether the reload fixed the underlying
+                // render issue. Re-navigate to the tab before retrying.
+                await this.clickClusterBanner();
+                await this.clickCluster(cluster);
+                await this.clusterSecretTab.click({ timeout: 30000 });
+            }
+        }
     }
     async createSetOfSecrets(cluster, secrets) {
         await this.bulkImportSecrets(secrets);

package/dist/pages/8.10/HomePage.d.ts

@@ -12,6 +12,8 @@ declare class HomePage {
     readonly appSwitcher: Locator;
     readonly openOrganizationButton: Locator;
     readonly consoleBanner: Locator;
+    readonly hubHeader: Locator;
+    readonly hubSidebar: Locator;
     readonly modelerBanner: Locator;
     readonly gettingStartedHeading: Locator;
     readonly buttonSkipCustomization: Locator;

package/dist/pages/8.10/HomePage.js

@@ -15,16 +15,35 @@ class HomePage {
     appSwitcher;
     openOrganizationButton;
     consoleBanner;
+    hubHeader;
+    hubSidebar;
     modelerBanner;
     gettingStartedHeading;
     buttonSkipCustomization;
     constructor(page) {
         this.page = page;
+        // Camunda Hub replaces Console on SaaS: an app header (only carrying the
+        // user menu once authenticated) plus a sidebar whose Console section
+        // links to /org/<id>/clusters and /org/<id>/management.
+        this.hubHeader = page
+            .locator('header[data-slot="app-header"]')
+            .filter({ has: page.locator('[data-slot="user-menu-trigger"]') });
+        this.hubSidebar = page.locator('nav[data-slot="app-sidebar"]');
         this.dashboardTab = page.getByRole('link', { name: 'Dashboard' });
+        // Once an org has environmentsEnabled, camunda-hub's
+        // use-ds-sidebar-items.tsx replaces the sidebar's Clusters link with one
+        // labelled "Environments" whose href is '/environments', not
+        // '/clusters' -- accept both hrefs so this resolves either way.
         this.clusterTab = page
             .getByRole('banner')
-            .getByRole('link', { name: 'Clusters' });
-        this.organizationTab = page.getByRole('link', { name: 'Organization' });
+            .getByRole('link', { name: 'Clusters' })
+            .or(this.hubSidebar.locator('a[href$="/clusters"]'))
+            .or(this.hubSidebar.locator('a[href$="/environments"]'))
+            .first();
+        this.organizationTab = page
+            .getByRole('link', { name: 'Organization' })
+            .or(this.hubSidebar.locator('a[href$="/management"]'))
+            .first();
         this.organizationViewTitle = page.getByText('Organization Management');
         this.welcomeMessage = page.getByText('Welcome to Camunda!').first();
         this.informationDialog = page.getByRole('button', {
@@ -58,6 +77,25 @@ class HomePage {
             await this.closeInformationDialog();
         }
         await this.clusterTab.click({ timeout: 15000 });
+        // Landing on Hub's Environments overview (see clusterTab above) doesn't
+        // put us on the classic row-based cluster list ClusterPage.ts expects --
+        // that page renders clusters as cards. Its own header renders a separate
+        // "Clusters" tab (camunda-hub EnvironmentsPageHeader.tsx, href /clusters)
+        // that does.
+        const clustersPageTab = this.page
+            .getByRole('navigation', { name: 'Environments views' })
+            .getByRole('link', { name: 'Clusters', exact: true });
+        // On Hub this tab is required -- the row-based locators callers use right
+        // after this method return nothing on the card-based Environments
+        // overview, so a slow render must not be treated as "tab doesn't exist"
+        // the way the legacy (non-Hub) shell's 5s probe is allowed to.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await (0, test_1.expect)(clustersPageTab).toBeVisible({ timeout: 30000 });
+            await clustersPageTab.click({ timeout: 15000 });
+        }
+        else if (await clustersPageTab.isVisible({ timeout: 5000 }).catch(() => false)) {
+            await clustersPageTab.click({ timeout: 15000 });
+        }
     }
     async clickDashboard() {
         await this.dashboardTab.click({ timeout: 90000 });

package/dist/pages/8.10/LoginPage.d.ts

@@ -26,6 +26,7 @@ declare class LoginPage {
     clickContinueButton(): Promise<void>;
     fillPassword(password: string): Promise<void>;
     clickLoginButton(): Promise<void>;
+    private throwIfCredentialsRejected;
     login(credentials?: {
         username?: string;
         password?: string;

package/dist/pages/8.10/LoginPage.js

@@ -4,6 +4,7 @@ exports.LoginPage = void 0;
 const test_1 = require("@playwright/test");
 const UtilitiesPage_1 = require("./UtilitiesPage");
 const authErrorClassification_1 = require("../../utils/authErrorClassification");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 const userNameInputValidInputSchema = {
     _schema: {
         maxlength: 254,
@@ -75,14 +76,33 @@ class LoginPage {
     async clickLoginButton() {
         await this.loginButton.click({ timeout: 60000 });
     }
+    // Auth0 responds to a rejected password by re-rendering the same password
+    // step with an error message rather than navigating anywhere, so success
+    // and failure aren't told apart by a URL or element one side has and the
+    // other doesn't. Without this check, a permanently wrong password falls
+    // through into assertTestUsesCorrectOrganization's generic ~120s wait for a
+    // Console/Hub shell that is never coming, and loginWithRetry then spends
+    // its remaining attempts resubmitting the exact same doomed credentials.
+    async throwIfCredentialsRejected(username) {
+        const message = await (0, authErrorClassification_1.classifyLoginRejection)(this.page, username);
+        if (message) {
+            throw new Error(message);
+        }
+    }
     async login(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
+        // The Hub bearer-token cache in consoleApiHelpers.ts is keyed by Page for
+        // the tab's whole lifetime; without clearing it here, a flow that logs a
+        // different user into the same page could have getUserToken() return the
+        // PREVIOUS user's token.
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         await (0, test_1.expect)(this.usernameInput.locator).toBeVisible({ timeout: 200000 });
         await this.fillUsername(username);
         await this.clickContinueButton();
         await this.fillPassword(password);
         await (0, test_1.expect)(this.loginButton).toBeVisible({ timeout: 120000 });
         await this.clickLoginButton();
+        await this.throwIfCredentialsRejected(username);
         await (0, UtilitiesPage_1.assertTestUsesCorrectOrganization)(this.page);
     }
     // The identity provider's email step submits through client-side JS, so a
@@ -128,6 +148,10 @@ class LoginPage {
     }
     async loginWithTestUser(credentials = {}) {
         const { username = process.env.C8_USERNAME_TEST, password = process.env.C8_PASSWORD_TEST, } = credentials;
+        // See login() above: this re-authenticates the same page and must clear
+        // the Hub bearer-token cache too, or getUserToken() can return the
+        // previous user's cached token.
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         // Skip navigation if the auth0 login page is already loaded — re-navigating
         // to '/' when already on auth0 undoes the redirect and causes a 60-second
         // waitForURL race. This is the common case when called from loginWithRetry,
@@ -158,6 +182,7 @@ class LoginPage {
         await this.fillPassword(password);
         await (0, test_1.expect)(this.loginButton).toBeVisible({ timeout: 120000 });
         await this.clickLoginButton();
+        await this.throwIfCredentialsRejected(username);
         await (0, UtilitiesPage_1.assertTestUsesCorrectOrganization)(this.page);
     }
     async loginFailAssertion() {
@@ -170,6 +195,10 @@ class LoginPage {
     }
     async loginWithoutOrgAssertion(credentials = {}) {
         const { username = process.env.C8_USERNAME, password = process.env.C8_PASSWORD, } = credentials;
+        // See login() above: this re-authenticates the same page and must clear
+        // the Hub bearer-token cache too, or getUserToken() can return the
+        // previous user's cached token.
+        (0, consoleApiHelpers_1.resetHubBearerToken)(this.page);
         await (0, test_1.expect)(this.usernameInput.locator).toBeVisible({ timeout: 180000 });
         await this.fillUsername(username);
         await this.clickContinueButton();

package/dist/pages/8.10/ModelerHomePage.d.ts

@@ -1,6 +1,7 @@
 import { Page, Locator } from '@playwright/test';
 declare class ModelerHomePage {
     private defaultFolderName;
+    private defaultClusterName;
     private defaultNewProjectName;
     private page;
     private processApplicationPage;
@@ -8,6 +9,11 @@ declare class ModelerHomePage {
     private processApplicationName?;
     readonly modelerPageBanner: Locator;
     readonly createNewProjectButton: Locator;
+    readonly createWorkspaceButton: Locator;
+    readonly workspaceWizardNameInput: Locator;
+    readonly workspaceWizardSubmitButton: Locator;
+    readonly workspaceWizardMembersStep: Locator;
+    readonly workspaceWizardEnvironmentsHeading: Locator;
     readonly projectNameInput: Locator;
     readonly formNameInput: Locator;
     readonly chooseBpmnTemplateButton: Locator;
@@ -62,11 +68,13 @@ declare class ModelerHomePage {
     returnToResourceContainer(): Promise<void>;
     startBlankBpmnDiagram(): Promise<void>;
     private becameVisible;
+    private createWorkspaceViaWizard;
     clickHomeBreadcrumb(): Promise<void>;
     clickOpenOrganizationsButton(): Promise<void>;
     createForm(formName: string): Promise<void>;
     clickCreateIdpApplicationButton(): Promise<void>;
     clickCrossComponentProjectFolder(): Promise<void>;
+    private waitForCrossComponentProjectFolder;
     createCrossComponentProjectFolder(): Promise<void>;
     clickManageButton(retries?: number): Promise<void>;
     clickUploadFilesButton(): Promise<void>;

package/dist/pages/8.10/ModelerHomePage.js

@@ -8,6 +8,11 @@ const randomName_1 = require("../../utils/randomName");
 const ProcessApplicationPage_1 = require("./ProcessApplicationPage");
 class ModelerHomePage {
     defaultFolderName = 'Cross Component Test Project';
+    // The default cluster test-setup.spec.ts's "Create Default Cluster" test
+    // provisions for the whole suite -- assigned to the shared workspace's
+    // Environments step so downstream specs can deploy to it without a manual
+    // assignment step first.
+    defaultClusterName = 'Test Cluster';
     // The name hub gives a project on create, before the inline rename commits.
     defaultNewProjectName = 'New project';
     page;
@@ -26,6 +31,11 @@ class ModelerHomePage {
     processApplicationName;
     modelerPageBanner;
     createNewProjectButton;
+    createWorkspaceButton;
+    workspaceWizardNameInput;
+    workspaceWizardSubmitButton;
+    workspaceWizardMembersStep;
+    workspaceWizardEnvironmentsHeading;
     projectNameInput;
     formNameInput;
     chooseBpmnTemplateButton;
@@ -61,12 +71,17 @@ class ModelerHomePage {
         // Hub's design-system shell renders the app header as a role=banner with no
         // accessible name after the Camunda Hub rebrand, so the classic
         // name-matched banner no longer resolves; the Modeler logo link inside it
-        // still carries "Camunda Modeler home". Keep the legacy named-banner branch
-        // for shells where the rename has not shipped yet.
+        // carries "Camunda Hub home" when the org has workspacesEnabled, else
+        // "Camunda Modeler home" (camunda-hub NavShellDs.common.tsx) -- match
+        // either. Keep the legacy named-banner branch for shells where the rename
+        // has not shipped yet.
         this.modelerPageBanner = page
             .getByRole('banner', {
             name: 'Camunda Modeler',
         })
+            .or(page
+            .getByRole('link', { name: 'Camunda Hub home' })
+            .and(page.locator(':not([href$="/login"])')))
             .or(page
             .getByRole('link', { name: 'Camunda Modeler home' })
             .and(page.locator(':not([href$="/login"])')))
@@ -83,6 +98,24 @@ class ModelerHomePage {
             name: 'Create project',
             exact: true,
         }));
+        // Camunda Hub, which replaced Console + Web Modeler on SaaS, tops the
+        // hierarchy with a Workspaces overview whose "Create workspace" CTA opens a
+        // wizard (General -> Members) that names the workspace up front. Same
+        // hooks as pages/SM-8.10/ModelerHomePage.ts. exact:true keeps the split
+        // button's options chevron out of the match.
+        this.createWorkspaceButton = page.getByRole('button', {
+            name: 'Create workspace',
+            exact: true,
+        });
+        this.workspaceWizardNameInput = page.locator('#workspace-name');
+        this.workspaceWizardSubmitButton = page.locator('[data-test="workspace-wizard-submit"]');
+        this.workspaceWizardMembersStep = page.locator('[data-test="step-members"]');
+        // When the org has environments enabled, an "Assign environments" step is
+        // inserted after Members -- camunda-hub's own
+        // e2e-playwright/pages/CreateWorkspacePage.ts detects it the same way.
+        this.workspaceWizardEnvironmentsHeading = page.getByRole('heading', {
+            name: 'Assign environments',
+        });
         this.projectNameInput = page.locator('[data-test="editable-input"]');
         this.formNameInput = page.locator('[data-test="editable-input"]');
         this.idpApplicationNameInput = page.getByPlaceholder('New IDP Application');
@@ -121,10 +154,13 @@ class ModelerHomePage {
         // than one project with this name — an unscoped by-title match throws a
         // strict-mode violation the moment a duplicate exists, which fails every
         // later run in that org rather than just the run that created it.
+        // On the Camunda Hub Workspaces overview the folder is a workspace tile
+        // whose "Open workspace <name>" button navigates into it.
         this.crossComponentProjectFolder = page
-            .getByTitle(this.defaultFolderName, {
+            .getByRole('button', { name: `Open workspace ${this.defaultFolderName}` })
+            .or(page.getByTitle(this.defaultFolderName, {
             exact: true,
-        })
+        }))
             .first();
         this.rows = page.getByRole('row');
         this.uploadFilesButton = page.getByRole('menuitem', { name: 'Upload files' });
@@ -582,7 +618,83 @@ class ModelerHomePage {
             .then(() => true)
             .catch(() => false);
     }
+    // Drives Camunda Hub's workspace-creation wizard. The name is entered on
+    // the General step, which enables "Next"; the same submit button then
+    // relabels itself through the remaining steps and finally reads "Create
+    // workspace" once it creates the workspace and routes the creator into its
+    // projects listing. Gate the Members-step click on that step becoming
+    // active so the shared submit button is not clicked twice while still on
+    // General.
+    async createWorkspaceViaWizard(name) {
+        await this.dismissOverlays();
+        await this.createWorkspaceButton.click({ timeout: 60000 });
+        await this.workspaceWizardNameInput.fill(name, { timeout: 60000 });
+        await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        await (0, test_1.expect)(this.workspaceWizardMembersStep).toHaveAttribute('data-state', 'active', { timeout: 30000 });
+        await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        // When the org has environments enabled, this only advances the wizard
+        // into an "Assign environments" step instead of submitting. Assign the
+        // suite's default cluster here rather than submitting with an empty
+        // selection -- otherwise this shared workspace starts with no
+        // environments and every downstream spec that deploys to it needs its
+        // own manual assignment first. Each card's accessible name is
+        // "Select <cluster name>" before it is picked (camunda-hub's own
+        // create-workspace-environments.spec.tsx asserts the same pattern).
+        // isVisible() only samples the current state -- if the wizard's step
+        // transition hasn't rendered yet at that exact instant, this would
+        // wrongly conclude the org has no environments step and immediately
+        // wait for the post-submit URL while the wizard is actually still open
+        // (mid-transition), timing out every workspace creation. Give the step
+        // transition a bounded wait instead of an instantaneous probe.
+        if (await this.becameVisible(this.workspaceWizardEnvironmentsHeading, 5000)) {
+            // "Create Default Cluster" runs in parallel with this flow
+            // (test-setup.spec.ts's mode: 'parallel'), so the cluster this picker
+            // lists may still be provisioning -- wait for it a generous 90s rather
+            // than sampling once. If it genuinely never appears (the cluster
+            // failed rather than just being slow), don't fail the whole shared
+            // workspace's setup over it: Hub's own recovery copy for this step
+            // ("Could not load environments. You can finish creating the
+            // workspace and assign them later.") confirms submitting unassigned
+            // is a supported, recoverable path, not a broken one.
+            const clusterOption = this.page.getByRole('button', {
+                name: new RegExp(`^Select ${this.defaultClusterName}`),
+            });
+            if (await this.becameVisible(clusterOption, 90000)) {
+                await clusterOption.click({ timeout: 10000 });
+            }
+            else {
+                console.warn(`"${this.defaultClusterName}" was not selectable on the Environments step; creating the workspace without it.`);
+            }
+            await this.workspaceWizardSubmitButton.click({ timeout: 60000 });
+        }
+        await this.page.waitForURL(/\/workspaces?\/[^/]+\/projects/, {
+            timeout: 120000,
+        });
+    }
     async clickHomeBreadcrumb() {
+        // Camunda Hub has no Modeler home breadcrumb: its home is the Workspaces
+        // overview, reached through the header logo link so the SPA keeps its
+        // in-memory session (a full navigation re-runs the whole Auth0 hand-off).
+        // The link's accessible name is "Camunda Hub home" when the org has
+        // workspacesEnabled, else "Camunda Modeler home" (camunda-hub
+        // NavShellDs.common.tsx) -- match either.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            // The authenticated header can still expose this same link with its
+            // href pointed at /login while the header is mid-update (same race
+            // modelerPageBanner already guards against) -- clicking it then sends
+            // the flow back through Auth0 and drops the session.
+            await this.page
+                .locator('header[data-slot="app-header"]')
+                .getByRole('link', { name: 'Camunda Hub home' })
+                .and(this.page.locator(':not([href$="/login"])'))
+                .or(this.page
+                .locator('header[data-slot="app-header"]')
+                .getByRole('link', { name: 'Camunda Modeler home' })
+                .and(this.page.locator(':not([href$="/login"])')))
+                .first()
+                .click({ timeout: 30000 });
+            return;
+        }
         try {
             await this.homeBreadcrumb.click();
         }
@@ -649,38 +761,112 @@ class ModelerHomePage {
             },
         });
     }
-    async createCrossComponentProjectFolder() {
-        await this.dismissOverlays();
-        // The projects list renders asynchronously, so an instantaneous
-        // isVisible() reports "missing" whenever the list is still loading — and
-        // this method then creates a SECOND project with the same name. Those
-        // duplicates are permanent and break every subsequent run for that user,
-        // so wait for the folder to actually show up before concluding it is
-        // absent (this also replaces the blind 15s sleep the check relied on).
-        const folderExists = await this.crossComponentProjectFolder
-            .waitFor({ state: 'visible', timeout: 60000 })
-            .then(() => true)
-            .catch(() => false);
-        if (folderExists) {
-            console.log('Cross Component Project folder already exists. Clicking into it');
-            await this.clickCrossComponentProjectFolder();
-            return;
+    // Hub's "Create workspace" CTA is a persistent toolbar button, rendered
+    // regardless of whether the existing-workspaces list has finished loading
+    // -- so a single slow or failed list fetch must not be read as "no
+    // workspace exists yet". Retry the wait once after a reload before
+    // concluding the folder is genuinely absent, since creating one when it
+    // already exists (just hadn't rendered) leaves a permanent duplicate that
+    // breaks every later run for that user.
+    async waitForCrossComponentProjectFolder() {
+        for (let attempt = 0; attempt < 2; attempt++) {
+            const found = await this.crossComponentProjectFolder
+                .waitFor({ state: 'visible', timeout: 60000 })
+                .then(() => true)
+                .catch(() => false);
+            if (found)
+                return true;
+            if (attempt === 0) {
+                await this.page.reload();
+                await this.page.waitForLoadState('networkidle').catch(() => { });
+            }
         }
-        await this.clickCreateNewProjectButton();
-        await this.enterNewProjectName(this.defaultFolderName);
-        // Both branches must leave the browser inside the workspace: the callers
-        // go straight on to clickDiagramTypeDropdown(), whose create control only
-        // exists there. Creating normally navigates into the new project, but when
-        // hub leaves the browser on the projects list the rename happens in the row
-        // and no navigation follows.
-        //
-        // Keyed on "New project", which hub renders only on the projects list and
-        // never inside an open project, so it answers which view we are on
-        // directly. The folder tile is the wrong signal: on a slow list render it
-        // is still absent, which would read as "already inside" and skip a hop
-        // that was needed.
-        if (await this.becameVisible(this.createNewProjectButton, 5000)) {
-            await this.clickCrossComponentProjectFolder();
+        return false;
+    }
+    // Retries the whole detect-or-create sequence, not just its individual
+    // steps. Up to 27 test-user workers race to create/open this one shared
+    // workspace concurrently, and a losing worker can land on a workspace-root
+    // page that never finishes rendering (neither the folder tile nor a create
+    // control ever becomes visible) for reasons the per-step probes/reloads
+    // below cannot resolve on their own -- each step bounds itself, but their
+    // sum does not bound the whole method, and a single unlucky pass used to
+    // run long enough to hit the 12-minute test timeout outright (run
+    // 36110457453 lost 6 "Create Project Folder" tests this way, pending
+    // inside a reload with no error of its own -- the test timeout fired
+    // first). Mirrors the 8.9 sibling's outer retry loop, which this method
+    // lost when it grew its own per-step reload-retries in place of it.
+    async createCrossComponentProjectFolder() {
+        const maxAttempts = 3;
+        for (let attempt = 0; attempt < maxAttempts; attempt++) {
+            await this.dismissOverlays();
+            // The projects list renders asynchronously, so an instantaneous
+            // isVisible() reports "missing" whenever the list is still loading — and
+            // this method then creates a SECOND project with the same name. Those
+            // duplicates are permanent and break every subsequent run for that user,
+            // so wait for the folder to actually show up before concluding it is
+            // absent (this also replaces the blind 15s sleep the check relied on).
+            // Re-checked on every attempt: a sibling worker may finish creating the
+            // folder while this one is retrying.
+            const folderExists = await this.waitForCrossComponentProjectFolder();
+            if (folderExists) {
+                console.log('Cross Component Project folder already exists. Clicking into it');
+                await this.clickCrossComponentProjectFolder();
+                return;
+            }
+            try {
+                // Same joint-probe pattern as clickCreateProcessApplication above: a
+                // single ORed probe with a generous timeout settles which shell
+                // actually rendered (Hub's "Create workspace" empty state vs. the
+                // legacy "New project" / "Create project" button) before a short
+                // confirmation decides the branch. A live CI trace showed probing
+                // createWorkspaceButton alone for 5s racing Hub's slower loads under
+                // worker contention: the probe reported "absent" on a workspaces
+                // overview that was merely still loading, sending the flow down the
+                // legacy branch -- which that overview never renders.
+                const rootLoaded = await this.becameVisible(this.createWorkspaceButton.or(this.createNewProjectButton).first(), 60000);
+                if (!rootLoaded) {
+                    // Mirrors clickCreateProcessApplication's own reload-retry: a reload
+                    // gives one more 60s window in case the root was still loading
+                    // rather than genuinely absent, instead of committing to the wrong
+                    // branch.
+                    await this.page.reload();
+                    await this.page.waitForLoadState('domcontentloaded');
+                    await this.becameVisible(this.createWorkspaceButton.or(this.createNewProjectButton).first(), 60000);
+                }
+                if (await this.becameVisible(this.createWorkspaceButton, 5000)) {
+                    await this.createWorkspaceViaWizard(this.defaultFolderName);
+                    return;
+                }
+                await this.clickCreateNewProjectButton();
+                await this.enterNewProjectName(this.defaultFolderName);
+                // Both branches must leave the browser inside the workspace: the
+                // callers go straight on to clickDiagramTypeDropdown(), whose create
+                // control only exists there. Creating normally navigates into the new
+                // project, but when hub leaves the browser on the projects list the
+                // rename happens in the row and no navigation follows.
+                //
+                // Keyed on "New project", which hub renders only on the projects list
+                // and never inside an open project, so it answers which view we are
+                // on directly. The folder tile is the wrong signal: on a slow list
+                // render it is still absent, which would read as "already inside" and
+                // skip a hop that was needed.
+                if (await this.becameVisible(this.createNewProjectButton, 5000)) {
+                    await this.clickCrossComponentProjectFolder();
+                }
+                return;
+            }
+            catch (error) {
+                if (attempt >= maxAttempts - 1) {
+                    throw error;
+                }
+                // The stuck-root case above, or a wizard/rename step that threw, can
+                // leave the browser on a half-loaded or errored page that retrying
+                // in place cannot recover from. Return Home so the next attempt's
+                // existence check starts clean, instead of retrying against the same
+                // stuck page.
+                await this.clickHomeBreadcrumb().catch(() => { });
+                console.log(`createCrossComponentProjectFolder attempt ${attempt + 1} failed; retrying...`);
+            }
         }
     }
     async clickManageButton(retries = 3) {

package/dist/pages/8.10/UtilitiesPage.js

@@ -10,6 +10,7 @@ const authErrorClassification_1 = require("../../utils/authErrorClassification")
 const LoginPage_1 = require("./LoginPage");
 const fileUpload_1 = require("../../utils/fileUpload");
 const mailSlurpClient_1 = require("../../utils/mailSlurpClient");
+const consoleApiHelpers_1 = require("../../utils/consoleApiHelpers");
 async function clearWebStorage(page) {
     await page
         .evaluate(() => {
@@ -101,6 +102,27 @@ async function waitForLoginForm(page, loginPage, totalTimeout = 90000, roundTime
 // stagger sleep below, so a worker only pays it once per process lifetime
 // rather than on every call -- see the comment at the call site.
 const staggeredWorkerTimeouts = new Set();
+const onboardingTourSuppressed = new WeakSet();
+// Mirrors camunda-hub@452978f: pre-seed the onboarding tour's "seen" localStorage flag
+// (SEEN_KEY_PREFIX in .../tour-dialog/use-onboarding-seen.ts) so it never auto-opens. The
+// "Welcome to Camunda Hub" tour mounts app-wide -- Console included, not just Modeler -- and
+// hides the post-login shell from the accessibility tree until dismissed, which times out
+// assertTestUsesCorrectOrganization's banner check. addInitScript runs before any page
+// script on every navigation/reload, so there's no login-response race to lose; the flag is
+// matched by prefix since the user id isn't known ahead of login.
+async function suppressOnboardingTour(page) {
+    if (onboardingTourSuppressed.has(page)) {
+        return;
+    }
+    onboardingTourSuppressed.add(page);
+    await page.addInitScript((prefixPattern) => {
+        const pattern = new RegExp(prefixPattern);
+        const originalGetItem = Storage.prototype.getItem;
+        Storage.prototype.getItem = function (key) {
+            return pattern.test(key) ? 'true' : originalGetItem.call(this, key);
+        };
+    }, '^hub\\.onboarding\\..*\\.seen\\.');
+}
 async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5) {
     // A blank credential is not something retrying can fix, and from inside the
     // browser it does not look like a credential problem at all: the form takes
@@ -131,6 +153,7 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
             '"Skip output ... since it may contain secret" warning on the ' +
             'matching C8_*_PASSWORD output.');
     }
+    await suppressOnboardingTour(page);
     let lastError;
     // `timeout` is a stable per-worker identifier (derived from workerIndex),
     // and a worker is a long-lived process across every test/repeat it runs, so
@@ -142,6 +165,11 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
     for (let attempt = 0; attempt < maxRetries; attempt++) {
         try {
             await page.context().clearCookies();
+            // The Hub bearer-token cache in consoleApiHelpers.ts is keyed by Page
+            // for the tab's whole lifetime; without clearing it here alongside
+            // cookies/storage, a flow that logs a different user into the same
+            // page could have getUserToken() return the PREVIOUS user's token.
+            (0, consoleApiHelpers_1.resetHubBearerToken)(page);
             await page.goto('about:blank');
             await page
                 .evaluate(() => {
@@ -196,6 +224,17 @@ async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5
         }
         catch (error) {
             lastError = error;
+            // A rejected password or a blocked account is a credential/
+            // provisioning-level failure, not a transient one: every attempt
+            // resubmits the same env-supplied credentials, so retrying just
+            // reproduces the same rejection up to maxRetries times (observed:
+            // ~6 minutes burned across 5 identical "Wrong email or password"
+            // cycles for one seeded user). Fail on the first rejection instead.
+            if (String(error).includes(authErrorClassification_1.AUTH0_INVALID_CREDENTIALS) ||
+                String(error).includes(authErrorClassification_1.AUTH0_ACCOUNT_BLOCKED)) {
+                console.error(lastError);
+                throw lastError;
+            }
             if (attempt < maxRetries - 1) {
                 const rateLimited = String(error).includes(authErrorClassification_1.AUTH0_RATE_LIMIT);
                 console.warn(`Attempt ${attempt + 1} failed for logging in. Retrying with clean session...`, error);
@@ -731,8 +770,12 @@ async function assertTestUsesCorrectOrganization(page) {
     const homePage = new HomePage_1.HomePage(page);
     if (page.url().includes('?code=') || page.url().includes('&state=')) {
         console.log('OAuth callback detected, waiting for redirect...');
+        // Camunda Hub (which replaced Console on SaaS) only exchanges the code
+        // once its SPA has booted, and on CI runners that boot alone was measured
+        // at ~45s past /login-callback -- a 30s wait aborted the exchange on every
+        // attempt.
         await page.waitForURL((url) => !url.toString().includes('?code='), {
-            timeout: 30000,
+            timeout: 120000,
         });
         await (0, sleep_1.sleep)(5000);
     }
@@ -742,7 +785,20 @@ async function assertTestUsesCorrectOrganization(page) {
         await (0, test_1.expect)(homePage.modelerBanner).toBeVisible({ timeout: 30000 });
     }
     else {
-        await (0, test_1.expect)(homePage.consoleBanner).toBeVisible({ timeout: 60000 });
+        await (0, test_1.expect)(homePage.consoleBanner.or(homePage.hubHeader)).toBeVisible({
+            timeout: 60000,
+        });
+    }
+    // Camunda Hub replaces Console on SaaS (8.10 release notes), and the Hub
+    // shell has neither the "Camunda logo Console" link nor the "Open
+    // Organizations" switcher, and lands on /workspaces without the org id in
+    // the URL. Its sidebar scopes the Clusters/Organization links to the active
+    // org, so assert the expected org id there instead.
+    if (await homePage.hubHeader.isVisible()) {
+        await (0, test_1.expect)(homePage.hubSidebar
+            .locator(`a[href*="/org/${process.env.ORG_ID}/"]`)
+            .first()).toBeVisible({ timeout: 180000 });
+        return;
     }
     await (0, test_1.expect)(homePage.openOrganizationButton).toBeVisible({ timeout: 180000 });
     try {

package/dist/tests/8.10/test-setup.spec.js

@@ -18,7 +18,8 @@ _8_10_1.test.describe('Cluster Setup Tests', () => {
         await (0, _setup_1.captureScreenshot)(page, testInfo);
         await (0, _setup_1.captureFailureVideo)(page, testInfo);
     });
-    (0, _8_10_1.test)('Enable Alpha Features', async ({ page, loginPage, consoleOrganizationsPage, homePage, }, testInfo) => {
+    // Skipped due to bug #29346: https://github.com/camunda/camunda-hub/issues/29346
+    _8_10_1.test.skip('Enable Alpha Features', async ({ page, loginPage, consoleOrganizationsPage, homePage, }, testInfo) => {
         _8_10_1.test.skip(process.env.IS_PROD === 'true', 'Skipping test because not required on PROD test org');
         _8_10_1.test.skip(process.env.IS_AG === 'true', 'Skipping test because not required when IS_AG is true');
         await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, users_1.testUsers.mainUser, (testInfo.workerIndex + 1) * 1000);
@@ -165,7 +166,9 @@ _8_10_1.test.describe('Cluster Setup Tests', () => {
                 await (0, UtilitiesPage_1.loginWithRetry)(page, loginPage, user, Math.min((testInfo.workerIndex + 1) * 5000, 60000));
             });
             await _8_10_1.test.step('Navigate to Web Modeler', async () => {
-                await (0, test_1.expect)(homePage.camundaComponentsButton).toBeVisible({
+                // Camunda Hub replaced Console + Web Modeler on SaaS: it lands on the
+                // Modeler home directly and has no app switcher to wait for.
+                await (0, test_1.expect)(homePage.camundaComponentsButton.or(homePage.hubHeader)).toBeVisible({
                     timeout: 120000,
                 });
                 await appsPage.openModelerWithRetry(modelerHomePage.modelerPageBanner, 180000, 3, undefined, () => modelerHomePage.dismissBlockingDialog());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@camunda/e2e-test-suite",
-  "version": "0.0.1253",
+  "version": "0.0.1254",
   "description": "End-to-end test helpers for Camunda 8",
   "repository": {
     "type": "git",