@camunda/e2e-test-suite 0.0.1273 → 0.0.1275

package/dist/pages/8.7/AppsPage.js

@@ -501,10 +501,18 @@ class AppsPage {
         // Camunda Hub folded Console into the same persistent shell as
         // Modeler/home: Console's Dashboard/Clusters/Organization links are just
         // another section of the same "Main navigation" sidebar, not a separate
-        // app to switch into. Its header banner (homePage.consoleBanner) is
-        // already visible from any Hub page, so there is no navigation action
-        // needed here -- mirrors the same hostname guard in clickModeler().
+        // app to switch into -- but ONLY on routes the Hub sidebar registry marks
+        // sidebarMode 'default' ('/', '/org/:id', '/workspaces', '/environments',
+        // '/console/*'). Any '/workspaces/:wsId/...' route is sidebarMode
+        // 'workspace', whose sidebar drops the Environments/Clusters item
+        // entirely (camunda-hub features/navigation/registry.ts,
+        // use-ds-sidebar-items.tsx) -- so a caller landing there and finding
+        // "already on hub." would previously no-op onto a page that can never
+        // show homePage.clusterTab. '/workspaces' is unconditionally 'default',
+        // so navigate there directly rather than assuming the current route
+        // already has it.
         if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.page.goto('/workspaces', { waitUntil: 'domcontentloaded' });
             return;
         }
         const maxRetries = 3;

package/dist/pages/8.7/ClusterDetailsPage.d.ts

@@ -22,6 +22,7 @@ declare class ClusterDetailsPage {
     readonly clientCredentialsDialog: Locator;
     readonly clustersLink: Locator;
     readonly userTaskRestriction: Locator;
+    readonly rbaToggle: Locator;
     readonly enableRBADialog: Locator;
     readonly disableRBADialog: Locator;
     readonly rbaEnabledMessage: Locator;

package/dist/pages/8.7/ClusterDetailsPage.js

@@ -28,6 +28,7 @@ class ClusterDetailsPage {
     clientCredentialsDialog;
     clustersLink;
     userTaskRestriction;
+    rbaToggle;
     enableRBADialog;
     disableRBADialog;
     rbaEnabledMessage;
@@ -160,6 +161,13 @@ class ClusterDetailsPage {
         this.rbaHeading = this.page.getByRole('heading', {
             name: 'Resource-based authorizations',
         });
+        // A nightly trace screenshot confirmed this toggle rendered as a small
+        // pill switch, not a Carbon .cds--toggle -- the class scraping this used
+        // to rely on matched 0 elements. No DOM snapshot was available to read
+        // the exact markup (page.$$ calls aren't snapshotted), but
+        // userTaskRestriction above -- on this same Settings page, still passing
+        // -- proves this page's toggle buttons carry aria-label="Switch <Label>".
+        this.rbaToggle = page.locator('button[aria-label="Switch Resource-based authorizations"]');
         this.clientCredentialsLink = (clientCredentials) => page
             .getByRole('cell', { name: clientCredentials })
             .getByText(clientCredentials);
@@ -228,73 +236,23 @@ class ClusterDetailsPage {
     }
     async enableRBA() {
         await (0, test_1.expect)(this.rbaHeading).toBeVisible({ timeout: 60000 });
-        // Locate all elements with class .cds--toggle__text
-        const toggleTextElements = await this.page.$$('.cds--toggle__text');
-        // Check if toggleTextElements has at least 2 elements
-        if (toggleTextElements.length >= 2) {
-            // Get the text content of the second toggle text element
-            const toggleText = await toggleTextElements[1].textContent();
-            // Check if the text content is 'Disabled'
-            if (toggleText === 'Disabled') {
-                // Locate all elements with class .cds--toggle__switch
-                const toggleSwitchElements = await this.page.$$('.cds--toggle__switch');
-                // Check if toggleSwitchElements has at least 2 elements
-                if (toggleSwitchElements.length >= 2) {
-                    // Click the second toggle switch element
-                    await toggleSwitchElements[1].click();
-                    console.log('Second toggle switch clicked.');
-                    await (0, test_1.expect)(this.enableRBADialog).toBeVisible({ timeout: 60000 });
-                    await this.rbaEnableButton.click();
-                    await (0, test_1.expect)(this.page.getByText('Enabling...')).not.toBeVisible({
-                        timeout: 60000,
-                    });
-                }
-                else {
-                    console.log('Second toggle switch not found or less than 2.');
-                }
-            }
-            else {
-                console.log("Second toggle text does not contain 'Disabled'.");
-            }
-        }
-        else {
-            console.log('Toggle text elements not found or less than 2.');
-        }
+        await (0, test_1.expect)(this.rbaToggle).toBeVisible({ timeout: 30000 });
+        await this.rbaToggle.click();
+        await (0, test_1.expect)(this.enableRBADialog).toBeVisible({ timeout: 60000 });
+        await this.rbaEnableButton.click();
+        await (0, test_1.expect)(this.page.getByText('Enabling...')).not.toBeVisible({
+            timeout: 60000,
+        });
     }
     async disableRBA() {
         await (0, test_1.expect)(this.rbaHeading).toBeVisible({ timeout: 60000 });
-        // Locate all elements with class .cds--toggle__text
-        const toggleTextElements = await this.page.$$('.cds--toggle__text');
-        // Check if toggleTextElements has at least 2 elements
-        if (toggleTextElements.length >= 2) {
-            // Get the text content of the second toggle text element
-            const toggleText = await toggleTextElements[1].textContent();
-            // Check if the text content is 'Enabled'
-            if (toggleText === 'Enabled') {
-                // Locate all elements with class .cds--toggle__switch
-                const toggleSwitchElements = await this.page.$$('.cds--toggle__switch');
-                // Check if toggleSwitchElements has at least 2 elements
-                if (toggleSwitchElements.length >= 2) {
-                    // Click the second toggle switch element
-                    await toggleSwitchElements[1].click();
-                    console.log('Second toggle switch clicked.');
-                    await (0, test_1.expect)(this.disableRBADialog).toBeVisible({ timeout: 60000 });
-                    await this.rbaDisableButton.click();
-                    await (0, test_1.expect)(this.page.getByText('Disabling...')).not.toBeVisible({
-                        timeout: 60000,
-                    });
-                }
-                else {
-                    console.log('Second toggle switch not found or less than 2.');
-                }
-            }
-            else {
-                console.log("Second toggle text does not contain 'Enabled'.");
-            }
-        }
-        else {
-            console.log('Toggle text elements not found or less than 2.');
-        }
+        await (0, test_1.expect)(this.rbaToggle).toBeVisible({ timeout: 30000 });
+        await this.rbaToggle.click();
+        await (0, test_1.expect)(this.disableRBADialog).toBeVisible({ timeout: 60000 });
+        await this.rbaDisableButton.click();
+        await (0, test_1.expect)(this.page.getByText('Disabling...')).not.toBeVisible({
+            timeout: 60000,
+        });
     }
     async searchAndClickClientCredentialsLink(name) {
         await (0, test_1.expect)(this.clientsList.first()).toBeVisible({ timeout: 60000 });

package/dist/pages/8.7/ModelerCreatePage.js

@@ -6,6 +6,7 @@ const sleep_1 = require("../../utils/sleep");
 const ConnectorMarketplacePage_1 = require("./ConnectorMarketplacePage");
 const ProcessApplicationPage_1 = require("./ProcessApplicationPage");
 const modelerCluster_1 = require("../../utils/modelerCluster");
+const sessionRecovery_1 = require("../../utils/sessionRecovery");
 class ModelerCreatePage {
     page;
     processApplicationPage;
@@ -364,9 +365,16 @@ class ModelerCreatePage {
         this.copyPublicLinkButton = page.getByRole('button', {
             name: 'Copy to clipboard',
         });
+        // Legacy Carbon toast vs. the design-system's Sonner-based toast
+        // (data-sonner-toast, confirmed from a nightly DOM snapshot) -- same
+        // migration already handled for the deploy/instance-started toasts
+        // elsewhere in this file and in UtilitiesPage.ts's runProcess.
         this.formLinkedSuccessMessage = page
             .locator('.cds--toast-notification__subtitle')
-            .getByText('Form has been successfully linked.');
+            .getByText('Form has been successfully linked.')
+            .or(page
+            .locator('[data-sonner-toast]')
+            .getByText('Form has been successfully linked.'));
         this.diagramNameBreadcrumb = (diagramName) => page.locator('button[data-test="breadcrumb-diagram"]', {
             hasText: diagramName,
         });
@@ -609,13 +617,32 @@ class ModelerCreatePage {
         }
     }
     async clickDeployAndRunMainButton() {
-        // This runs straight after a navigation back to the diagram, so the
-        // modeler still has to boot and render its toolbar. The trace shows the
-        // button first resolving ~35s after that navigation, which the previous
-        // flat 30s click budget expired just short of. Wait for it to render
-        // before spending the click budget on it.
-        await (0, test_1.expect)(this.deployAndRunMainButton).toBeVisible({ timeout: 120000 });
-        await this.deployAndRunMainButton.click({ timeout: 30000 });
+        for (let attempt = 0; attempt < 2; attempt++) {
+            try {
+                // This runs straight after a navigation back to the diagram, so the
+                // modeler still has to boot and render its toolbar. The trace shows
+                // the button first resolving ~35s after that navigation, which the
+                // previous flat 30s click budget expired just short of. Wait for it
+                // to render before spending the click budget on it.
+                await (0, test_1.expect)(this.deployAndRunMainButton).toBeVisible({
+                    timeout: 120000,
+                });
+                await this.deployAndRunMainButton.click({ timeout: 30000 });
+                return;
+            }
+            catch (error) {
+                // Hub's own /login route can hang mid-wait when its session POST
+                // 5xx's, leaving the diagram (and this button) never rendering --
+                // the same session loss utils/sessionRecovery.ts already recovers
+                // from elsewhere. One retry after recovering; any other cause
+                // rethrows unchanged.
+                const recovered = await (0, sessionRecovery_1.recoverStuckModelerLogin)(this.page);
+                const restored = await (0, sessionRecovery_1.restoreSessionIfLoggedOut)(this.page);
+                if ((!recovered && !restored) || attempt === 1) {
+                    throw error;
+                }
+            }
+        }
     }
     async clickDeployAndRunSubButton() {
         await this.deployAndRunSubButton.click({ timeout: 30000 });
@@ -1953,16 +1980,31 @@ class ModelerCreatePage {
         await this.copyPublicLinkButton.click({ timeout: 60000 });
     }
     async getPublicationLink() {
+        // 'clipboard-write' must be granted BEFORE the click that copies the
+        // link -- the nightly trace showed the read always resolving empty
+        // (both attempts), with the click itself never observed to fail. The
+        // previous code only granted 'clipboard-read', after the click, which
+        // does nothing for the write the click triggers.
+        const context = this.page.context();
+        await context.grantPermissions(['clipboard-read', 'clipboard-write']);
         await this.clickPublicationTab();
         await (0, test_1.expect)(this.copyPublicLinkButton).toBeVisible({ timeout: 60000 });
         await this.clickCopyPublicLinkButton();
-        await (0, sleep_1.sleep)(1000);
-        const context = this.page.context();
-        await context.grantPermissions(['clipboard-read']);
-        const clipboardText = await this.page.evaluate(async () => {
-            return await navigator.clipboard.readText();
-        });
+        // Poll instead of one blind read after a fixed sleep -- the write is
+        // async on the page's side and has no visible completion signal to wait
+        // on directly.
+        let clipboardText = '';
+        for (let attempt = 0; attempt < 10 && !clipboardText; attempt++) {
+            await (0, sleep_1.sleep)(500);
+            clipboardText = await this.page.evaluate(async () => {
+                return await navigator.clipboard.readText();
+            });
+        }
         console.log('Captured public link:', clipboardText);
+        if (!clipboardText) {
+            throw new Error('getPublicationLink: clipboard read empty after clicking Copy to ' +
+                'clipboard -- the copy never reached the clipboard.');
+        }
         return clipboardText;
     }
     async assertFormEmbedded() {

package/dist/pages/8.7/PlayPage.js

@@ -29,7 +29,18 @@ class PlayPage {
             .or(page
             .getByRole('tablist', { name: 'List of modes' })
             .getByRole('tab', { name: 'Test', exact: true }));
-        this.completeJobButton = this.diagram.getByLabel('Complete job');
+        // Not getByLabel(): a DevTools capture during camunda-hub#29604's
+        // investigation showed this button rendering with NO aria-label
+        // attribute at all, yet still carrying a
+        // `<span class="sr-only">Complete job</span>` that gives it a perfectly
+        // valid accessible name from content. getByLabel() only resolves via
+        // aria-label/aria-labelledby/<label> association, so it can't see that
+        // span -- getByRole's name option does the full ARIA accessible-name
+        // computation (including visually-hidden content), so it matches this
+        // button regardless of whether the aria-label attribute itself is set.
+        this.completeJobButton = this.diagram.getByRole('button', {
+            name: 'Complete job',
+        });
         // Newer Modeler Play UI: the "Configure Scenario" floating card hosts a
         // primary "Start" Carbon button (variants: "Start", "Start with
         // variables", "Start with a form"). Source:

package/dist/pages/8.7/SettingsPage.js

@@ -7,8 +7,21 @@ class SettingsPage {
     logoutButton;
     constructor(page) {
         this.page = page;
-        this.openSettingsButton = page.getByLabel('Open Settings');
-        this.logoutButton = page.getByRole('button', { name: 'Log out' });
+        // DS shell renders a `User menu, <full name>` button; the legacy Carbon
+        // shell renders useCamundaTools' `Open Settings` button. Both still ship.
+        this.openSettingsButton = page
+            .getByLabel('Open Settings')
+            .or(page.getByRole('button', { name: /^User menu,/ }))
+            .first();
+        // DS shell's user-menu dropdown renders items via Radix, which sets
+        // role="menuitem" (confirmed in camunda-hub's nav-shell-ds.spec.saas.tsx);
+        // the legacy Carbon panel renders a plain role="button". .first() avoids
+        // a strict-mode violation if both shells' triggers are ever present at
+        // once (SM-8.10's SettingsPage uses the same guard for this union).
+        this.logoutButton = page
+            .getByRole('button', { name: 'Log out' })
+            .or(page.getByRole('menuitem', { name: 'Log out' }))
+            .first();
     }
     async clickOpenSettingsButton(retries = 3) {
         for (let i = 0; i < retries; i++) {

package/dist/pages/8.7/UtilitiesPage.js

@@ -34,6 +34,28 @@ async function suppressOnboardingTour(page) {
     }, '^hub\\.onboarding\\..*\\.seen\\.');
 }
 async function loginWithRetry(page, loginPage, testUser, timeout, maxRetries = 5, skipOrgAssertion = false) {
+    // Fail fast on a testUser missing credentials instead of burning the full
+    // exponential-backoff retry budget (~8-13 min across 5 attempts)
+    // resubmitting a login Auth0 rejects with "Password is required" every
+    // time, then surfacing the generic "Login failed after N attempts" with no
+    // mention of which credential was empty. test-setup.spec.ts's per-user
+    // loop and requireTestUser() already guard this for specs that reach a
+    // numbered credential slot directly -- callers that pass testUsers.mainUser
+    // or another named user straight through (e.g. "Create AWS Cluster") had no
+    // such guard, and hit exactly this failure when C8_USERNAME/C8_PASSWORD
+    // (the org owner) came back unset.
+    if (!testUser.username || !testUser.password) {
+        const missing = [
+            testUser.username ? null : 'username',
+            testUser.password ? null : 'password',
+        ]
+            .filter(Boolean)
+            .join(' and ');
+        throw new Error(`Cannot log in as ${testUser.username || '(unknown user)'}: ${missing} ` +
+            'not configured -- this SaaS org was created without that ' +
+            "user's credentials. See scripts/flakiness-saas-create-org.sh, " +
+            'which sizes the org from the slots each spec names.');
+    }
     await suppressOnboardingTour(page);
     // Callers derive `timeout` as (workerIndex + 1) * 1000, so it's a stable
     // per-worker identifier: a Playwright worker is a long-lived process that

package/dist/pages/8.8/AppsPage.d.ts

@@ -18,8 +18,10 @@ declare class AppsPage {
     readonly consoleLink: Locator;
     readonly camundaComponentsButton: Locator;
     readonly camundaAppsButton: Locator;
+    readonly hubSidebar: Locator;
     constructor(page: Page);
     clickCluster(component: Locator, name: string): Promise<void>;
+    private clickHubClusterApp;
     clickModeler(): Promise<void>;
     /**
      * Waits for the Modeler app to actually render, and recovers the one landing

package/dist/pages/8.8/AppsPage.js

@@ -23,6 +23,7 @@ class AppsPage {
     consoleLink;
     camundaComponentsButton;
     camundaAppsButton;
+    hubSidebar;
     constructor(page) {
         this.page = page;
         this.modelerLink = page.getByRole('link', { name: 'Modeler', exact: true });
@@ -34,6 +35,11 @@ class AppsPage {
         this.consoleLink = page.getByRole('link', { name: 'Console', exact: true });
         this.camundaComponentsButton = page.getByLabel('Camunda components');
         this.camundaAppsButton = page.getByLabel('Camunda apps');
+        // Camunda Hub's persistent "Main navigation" sidebar lists each cluster
+        // with its own apps (Operate/Tasklist/Optimize/Identity) as child links
+        // -- there is no per-app switcher panel to open on Hub (see
+        // clickCamundaApps below). Ported from pages/8.9/AppsPage.ts.
+        this.hubSidebar = page.getByRole('navigation', { name: 'Main navigation' });
         this.tasklistListItem = this.page
             .getByRole('listitem')
             .filter({ hasText: 'Tasklist' });
@@ -67,7 +73,83 @@ class AppsPage {
         await (0, test_1.expect)(cluster).toBeVisible({ timeout: 60000 });
         await cluster.click();
     }
+    // Camunda Hub's sidebar groups by cluster, not by app: each cluster row
+    // expands to reveal its own per-app child links (Operate/Tasklist/...).
+    // camunda-hub's own nav-shell-ds.spec.saas.tsx documents the shape: the
+    // design system splits the group row into a label control and a chevron
+    // control, both labelled by the cluster name; either one opens it -- and
+    // the child links do not exist in the DOM at all until expanded (not just
+    // hidden), and are not nested under any container matchable by cluster
+    // name once expanded. So: find the toggle by the cluster's own name
+    // (`.first()` because both controls share that name), click it, then look
+    // up the app link sidebar-wide rather than scoped to a "group" container
+    // that doesn't reliably exist. Ported from pages/8.9/AppsPage.ts, where
+    // this shape is already nightly-proven.
+    async clickHubClusterApp(clusterName, appName) {
+        // When the sidebar is collapsed (the default on a fresh session), the
+        // group toggle opens a Radix popover -- a role="dialog" labelled with the
+        // cluster name and portalled OUTSIDE the "Main navigation" <nav> -- so a
+        // sidebar-scoped lookup finds nothing there. Look in that popover first;
+        // keep the sidebar-scoped lookup for the expanded-sidebar layout, where
+        // the links render inline. Not exact: the rendered accessible name
+        // carries more than the bare app name (e.g. "Operate in <cluster>
+        // (opens in a new tab)").
+        const appLink = this.page
+            .getByRole('dialog', { name: clusterName, exact: true })
+            .getByRole('link', { name: appName })
+            .or(this.hubSidebar.getByRole('link', { name: appName }))
+            .first();
+        // Decide whether to expand from clusterName's OWN toggle state, not from
+        // whether "some" appLink is already visible sidebar-wide: in a
+        // multi-cluster org another cluster's group can already be expanded with
+        // the same app name, and the click would then fire on the wrong
+        // cluster's link.
+        const collapsedToggle = this.hubSidebar
+            .getByRole('button', { name: clusterName, expanded: false })
+            .first();
+        if (await collapsedToggle.isVisible({ timeout: 5000 }).catch(() => false)) {
+            await collapsedToggle.click({ timeout: 10000 });
+        }
+        await (0, test_1.expect)(appLink).toBeVisible({ timeout: 30000 });
+        // Hub's cluster-app links carry target="_blank", so clicking them opens
+        // the app in a new tab while every caller keeps asserting on this.page.
+        // Follow the href in the current tab instead, matching the same-tab
+        // navigation the Console app switcher gave these callers.
+        const href = await appLink.getAttribute('href');
+        if (href) {
+            await this.page.goto(new URL(href, this.page.url()).toString());
+            return;
+        }
+        await appLink.click({ timeout: 10000 });
+    }
     async clickModeler() {
+        // Camunda Hub (hub.*) replaced Console + Web Modeler on SaaS and has no
+        // app switcher. Its home is the Modeler/Workspaces home, but a hostname
+        // check alone can't tell whether we're already there -- Hub's cluster
+        // pages are on the same hub.* hostname, and a no-op here would leave a
+        // caller that reaches clickModeler() from a cluster/API-client page
+        // stranded with the next locator running against the wrong page.
+        // Navigate home through the header logo link instead, same as
+        // ModelerHomePage.clickHomeBreadcrumb -- clicking it when already on the
+        // Modeler home is a harmless in-SPA no-op.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            const header = this.page.locator('header[data-slot="app-header"]');
+            // The href stays literally "/login" until the client's auth state
+            // catches up just after login (camunda-hub NavShellDs.common.tsx) --
+            // clicking it in that window would log the test out instead of
+            // navigating home, so exclude that href and wait for the authenticated
+            // one rather than racing it.
+            const homeLink = header
+                .getByRole('link', { name: 'Camunda Modeler home' })
+                .and(this.page.locator(':not([href$="/login"])'))
+                .or(header
+                .getByRole('link', { name: 'Camunda Hub home' })
+                .and(this.page.locator(':not([href$="/login"])')))
+                .first();
+            await (0, test_1.expect)(homeLink).toBeVisible({ timeout: 30000 });
+            await homeLink.click({ timeout: 30000 });
+            return;
+        }
         const maxRetries = 5;
         // If the click is already done and we are sitting on Modeler, return
         // immediately — observed in failing runs where the banner role lookup
@@ -148,6 +230,10 @@ class AppsPage {
         }
     }
     async clickTasklist(clusterName) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.clickHubClusterApp(clusterName, 'Tasklist');
+            return;
+        }
         const maxRetries = 5;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -185,6 +271,14 @@ class AppsPage {
         throw new Error(`Failed to click the tasklist link after ${maxRetries} attempts.`);
     }
     async clickIdentity(clusterName) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            // Non-anchored, matching the substring lookup clickHubClusterApp uses
+            // for Operate/Tasklist/Optimize -- an anchored pattern fails the same
+            // way an exact-string match did for those apps if the rendered link's
+            // accessible name carries any extra content (icon/badge).
+            await this.clickHubClusterApp(clusterName, /Admin|Identity/);
+            return;
+        }
         const maxRetries = 5;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -251,6 +345,10 @@ class AppsPage {
         await this.clickCluster(this.optimizeListItem, clusterName);
     }
     async clickOperate(clusterName) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.clickHubClusterApp(clusterName, 'Operate');
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -287,6 +385,10 @@ class AppsPage {
         throw new Error(`Failed to click the operate link after ${maxRetries} attempts.`);
     }
     async clickOptimize(clusterName) {
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            await this.clickHubClusterApp(clusterName, 'Optimize');
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {
@@ -373,6 +475,13 @@ class AppsPage {
         }
     }
     async clickCamundaApps(maxRetries = 3) {
+        // Camunda Hub's rewritten shells have no app-switcher button to open --
+        // Modeler is already Hub's home area and the other apps are reached
+        // per-cluster via the persistent sidebar, not through a global switcher
+        // panel. Mirrors the same hostname guard in clickModeler() above.
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            return;
+        }
         await (0, sleep_1.sleep)(2000);
         const appButtons = [
             this.camundaComponentsButton,
@@ -420,6 +529,19 @@ class AppsPage {
             .catch(() => { });
     }
     async clickConsoleLink() {
+        // Camunda Hub replaced Console on SaaS: there is no "Console" entry in a
+        // switcher, and the org-scoped Console area is the sidebar's
+        // Clusters/Environments section. Going there is what callers assert on
+        // (HomePage.consoleBanner resolves to Hub's authenticated header).
+        if (new URL(this.page.url()).hostname.startsWith('hub.')) {
+            const consoleArea = this.hubSidebar
+                .locator('a[href$="/clusters"]')
+                .or(this.hubSidebar.locator('a[href$="/environments"]'))
+                .first();
+            await (0, test_1.expect)(consoleArea).toBeVisible({ timeout: 30000 });
+            await consoleArea.click({ timeout: 30000 });
+            return;
+        }
         const maxRetries = 3;
         for (let retries = 0; retries < maxRetries; retries++) {
             try {

package/dist/pages/8.8/ClusterDetailsPage.d.ts

@@ -40,6 +40,7 @@ declare class ClusterDetailsPage {
     readonly orchestrationClusterCheckbox: Locator;
     readonly clientCredentialsLink: (clientCredentials: string) => Locator;
     readonly clientRow: (name: string) => Locator;
+    readonly clientRowByDom: (name: string) => Locator;
     readonly clientRowDeleteButton: (name: string) => Locator;
     readonly reviewUpdateButton: Locator;
     readonly selectTargetVersionDialog: Locator;

package/dist/pages/8.8/ClusterDetailsPage.js

@@ -46,6 +46,7 @@ class ClusterDetailsPage {
     orchestrationClusterCheckbox;
     clientCredentialsLink;
     clientRow;
+    clientRowByDom;
     clientRowDeleteButton;
     reviewUpdateButton;
     selectTargetVersionDialog;
@@ -78,9 +79,6 @@ class ClusterDetailsPage {
             .locator('label')
             .filter({ hasText: /^Administration API - Resource: Secrets$/ });
         this.createButton = page.getByRole('button', { name: 'Create', exact: true });
-        this.closeModalButton = page
-            .getByRole('dialog', { name: 'Client credentials', exact: true })
-            .getByLabel('Close');
         this.createClientButton = page.getByRole('button', {
             name: 'Create new Client',
         });
@@ -98,9 +96,18 @@ class ClusterDetailsPage {
         this.createClientCredentialsDialog = page.getByRole('dialog', {
             name: 'Create new client credentials',
         });
-        this.clientCredentialsDialog = page.getByRole('dialog', {
-            name: 'Client credentials',
-            exact: true,
+        // Use a content-based locator so the test stays robust if the dialog
+        // title is ever renamed in the Console UI.
+        this.clientCredentialsDialog = page.getByRole('dialog').filter({
+            has: page.getByText('The Client Secret will not be shown again.'),
+        });
+        // Hub's client-credentials dialog (design-system Dialog, not the old
+        // Carbon one) exposes its close affix as an accessible button named
+        // "Close" rather than via an aria-label picked up by getByLabel -- see
+        // camunda-hub's own e2e suite, ConsoleClusterDetailsPage.ts
+        // (clientCredentialsDialogCloseButton), which already uses this pattern.
+        this.closeModalButton = this.clientCredentialsDialog.getByRole('button', {
+            name: 'Close',
         });
         this.clustersLink = page
             .getByRole('banner')
@@ -154,10 +161,22 @@ class ClusterDetailsPage {
         this.orchestrationClusterCheckbox = page
             .locator('label')
             .filter({ hasText: /^Orchestration Cluster API$/ });
+        // Camunda Hub's data table renders the client name as a link-styled
+        // <button data-slot="button"> rather than an <a>. The cell also holds a
+        // pointer-events-none row-overlay button with the same accessible name,
+        // so match the visible one by its data-slot.
         this.clientCredentialsLink = (clientCredentials) => page
             .getByRole('cell', { name: clientCredentials })
-            .getByText(clientCredentials);
+            .locator('a, button[data-slot="button"]')
+            .first();
         this.clientRow = (name) => this.clientsList.filter({ hasText: name });
+        // Same row, matched through the DOM instead of the accessibility tree.
+        // Hub's client-credentials dialog is a Radix dialog: while it is open the
+        // whole app shell behind it carries aria-hidden/inert, so `getByRole`
+        // resolves nothing there and the post-create scope check below can never
+        // pass. `locator('tr')` is unaffected. The client name is unique per run,
+        // so matching page-wide cannot pick up another table's row.
+        this.clientRowByDom = (name) => page.locator('tr').filter({ hasText: name });
         this.clientRowDeleteButton = (name) => this.clientRow(name).getByRole('button', { name: 'Delete' });
         this.reviewUpdateButton = page.getByRole('button', { name: 'Review Update' });
         this.selectTargetVersionDialog = page
@@ -609,9 +628,9 @@ class ClusterDetailsPage {
         }
         await (0, test_1.expect)(this.clientCredentialsDialog.getByText('The Client Secret will not be shown again.')).toBeVisible({ timeout: 30000 });
         // The clients table behind the dialog re-fetches after the create, and
-        // renders a skeleton (no `row` roles at all) until that GET resolves — so
-        // the default 5s expect timeout can expire before the new row exists.
-        await (0, test_1.expect)(this.clientsList.filter({ hasText: name })).toContainText(/(?=.*Orchestration)(?=.*Optimize)(?=.*Secrets)/, { timeout: 60000 });
+        // renders a skeleton (no rows at all) until that GET resolves — so the
+        // default 5s expect timeout can expire before the new row exists.
+        await (0, test_1.expect)(this.clientRowByDom(name)).toContainText(/(?=.*Orchestration)(?=.*Optimize)(?=.*Secrets)/, { timeout: 60000 });
     }
     async clickEnvVarsButton() {
         await (0, test_1.expect)(this.envVarsTab).toBeVisible({ timeout: 40000 });