@globisnv/cypress-core 2.1.2 → 2.2.0

package/README.md

@@ -2,7 +2,7 @@
 
 Core building blocks for Globis Cypress E2E tests.
 
-This package holds everything that is *not* customer-specific: the shared Cypress config factory, the custom command library for the Servoy-based Globis solutions, the WebSocket-aware loading detector, the reusable data-entry blueprints, and the lint scripts. Customer repos install it, call `defineGlobisConfig()` in their `cypress.config.ts`, import `@globisnv/cypress-core/register` in their support file, and only keep their own specs and customer-specific commands locally.
+This package holds everything that is *not* customer-specific: the shared Cypress config factory, the custom command library for the Servoy-based Globis solutions, the WebSocket-aware loading detector, the reusable data-entry blueprints, and the lint plugins. Customer repos install it, call `defineGlobisConfig()` in their `cypress.config.ts`, import `@globisnv/cypress-core/register` in their support file, and only keep their own specs and customer-specific commands locally.
 
 ---
 
@@ -165,7 +165,7 @@ src/
 ├── commands/             # 6 generic command files (~128 custom commands)
 ├── apiMethods/           # IGS REST request/response helpers
 └── plugins/              # prometheusWriter — SigV4-signed remote write to AWS AMP
-scripts/                  # standalone lint rules (shipped to consumers)
+biome-plugins/            # GritQL lint rules (shipped to consumers)
 ```
 
 ### Command families
@@ -221,10 +221,10 @@ Set via Cypress env (`config.env`, `CYPRESS_*`, or `--env`) unless noted.
 | Key | Purpose |
 | --- | --- |
 | `globisUrl` | Base solution URL. `GLJ/GLS/GLT_login` rewrite the `/solution/<name>` segment off this. |
-| `portalUrl`, `formBuilderUrl`, `oktaUrl` | Entry URLs for the portal, form builder and Okta login flows. |
+| `portalUrl`, `formBuilderUrl`, `ssoUrl` | Entry URLs for the portal, form builder and Okta login flows (`ssoUrl` was `oktaUrl`). With `loginType: sso` the provider follows from it: Okta when it contains `okta`, otherwise Keycloak (default `https://auth.globis.cloud`). |
 | `username`, `username2` | Default and alternate login users. |
-| `password`, `password2`, `api_key` | Secrets — kept node-side, never exposed to the browser. |
-| `loginType`, `ownerName`, `formBuilderStandalone`, `saveData` | Login/flow switches read by the commands. |
+| `password`, `password2`, `api_key`, `otpSecret` | Secrets — kept node-side, never exposed to the browser. `otpSecret` is the base32 TOTP secret for Keycloak users with OTP. |
+| `loginType` (`default`/`servoy`/`sso`), `ownerName`, `formBuilderStandalone`, `saveData` | Login/flow switches read by the commands. |
 | `BUILD_NUMBER` | Used by `getOrCreateUuid()` to build a stable `CYP<build>` test-data prefix. |
 | `extraParams` | Object of Jenkins-passed extras; `cypressWebsocketLoader` and `cypressWebsocketDebug` (`'true'`) live here. |
 | `AMP_REMOTE_WRITE_URL`, `AMP_REGION` | Node `process.env` — Prometheus remote-write target and region. |
@@ -242,23 +242,22 @@ npm run lint           # biome check .
 npm run lint:fix       # biome check . --write
 ```
 
-Formatting is Biome ([biome.json](biome.json)): 4-space indent, single quotes, semicolons, no trailing commas, 180-column lines, LF endings. `src/types.ts` has `noUnusedVariables` disabled since it is declaration-only.
+Formatting is Biome ([biome.json](biome.json)): 4-space indent, single quotes, semicolons, no trailing commas, 180-column lines, LF endings. [src/biome.json](src/biome.json) extends it for `src/` only: it enables `noUnnecessaryWaiting` there and disables `noUnusedVariables` for `types.ts`, which is declaration-only. It lives in `src/` because consumers `extends` the root `biome.json`, and a plugin path in there would resolve against their repo.
 
-### Shipped lint scripts
+### Shipped lint plugins
 
-`scripts/` is published with the package so consumer repos can run the same rule over their specs. It's a standalone Node script (no ESLint) that reads the invoking repo's `tsconfig.json` from `process.cwd()`, using the TypeScript 7 `typescript/unstable/*` preview API — the classic in-process Compiler API that `typescript-eslint` and `ts-morph` depend on was removed in TS7, which is why those tools cap their peer range below it.
+`biome-plugins/` is published with the package so consumer repos run the same rules over their specs as Biome [GritQL plugins](https://biomejs.dev/linter/plugins/). Their diagnostics show up in `biome check`, the editor and the CI linter like any built-in rule.
 
-| Script | What it does |
+| Plugin | What it does |
 | --- | --- |
-| [check-unnecessary-waiting.mjs](scripts/check-unnecessary-waiting.mjs) | Fails on `cy.wait(<number>)`, including numeric constants/default params aliased in the enclosing scope. Exempt a call with a `// biome-ignore plugin: <reason>` comment on the line directly above — Biome's GritQL plugins have no suppression mechanism, hence the standalone script. |
+| [noUnnecessaryWaiting.grit](biome-plugins/noUnnecessaryWaiting.grit) | Fails on `cy.wait(<number>)`, including numeric constants/default params declared in an enclosing scope. Exempt a call with `// biome-ignore lint/plugin/noUnnecessaryWaiting: <reason>` on the line above. |
 
-Wire it into the consumer repo:
+Wire it into the consumer repo's `biome.json` (the template already does). Biome resolves plugin paths from the consumer's root, not from an `extends`-ed config, so the path can't live in this package's `biome.json`:
 
 ```json
 {
-    "scripts": {
-        "lint:waiting": "node node_modules/@globisnv/cypress-core/scripts/check-unnecessary-waiting.mjs"
-    }
+    "extends": ["./node_modules/@globisnv/cypress-core/biome.json"],
+    "plugins": ["./node_modules/@globisnv/cypress-core/biome-plugins/noUnnecessaryWaiting.grit"]
 }
 ```
 

package/biome-plugins/noUnnecessaryWaiting.grit

@@ -0,0 +1,32 @@
+language js
+
+// A numeric `const`/`let`/`var` declared directly in this list of statements.
+pattern numeric_decl($name) {
+    some JsVariableStatement(declaration=JsVariableDeclaration(declarators=some JsVariableDeclarator(id=$name, initializer=JsInitializerClause(expression=JsNumberLiteralExpression()))))
+}
+
+// A parameter with a numeric default in this parameter list.
+pattern numeric_param($name) { JsParameters(items=some JsFormalParameter(binding=$name, initializer=JsInitializerClause(expression=JsNumberLiteralExpression()))) }
+
+// Only a scope's own statements/parameters count, so a same-named local in another function doesn't match.
+`cy.wait($ms, $...)` as $call where {
+    or {
+        $ms <: JsNumberLiteralExpression(),
+        and {
+            $ms <: JsIdentifierExpression(),
+            $ms <: r"(.*)"($name),
+            $call <: within or {
+                JsFunctionBody(statements=numeric_decl($name)),
+                JsBlockStatement(statements=numeric_decl($name)),
+                JsModule(items=numeric_decl($name)),
+                JsScript(statements=numeric_decl($name)),
+                JsFunctionDeclaration(parameters=numeric_param($name)),
+                JsFunctionExpression(parameters=numeric_param($name)),
+                JsArrowFunctionExpression(parameters=numeric_param($name)),
+                JsMethodClassMember(parameters=numeric_param($name)),
+                JsMethodObjectMember(parameters=numeric_param($name))
+            }
+        }
+    },
+    register_diagnostic(span=$call, message="Avoid arbitrary cy.wait(ms); prefer cy.intercept()/should() polling instead.")
+}

package/biome.json

@@ -1,5 +1,5 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.7/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
     "vcs": {
         "enabled": true,
         "clientKind": "git",
@@ -44,17 +44,5 @@
                 "noDoubleEquals": "error"
             }
         }
-    },
-    "overrides": [
-        {
-            "includes": ["src/types.ts"],
-            "linter": {
-                "rules": {
-                    "correctness": {
-                        "noUnusedVariables": "off"
-                    }
-                }
-            }
-        }
-    ]
+    }
 }

package/dist/blueprints/GLO_departureScheduleTimes.js

@@ -3,11 +3,11 @@ const formName = 'ng$logistic_conn_schedule_times_dtl';
 const addressFormName = 'ng$remark_dtl_logistic_conn_schedule_times';
 const detailTabsName = 'tabs_70';
 export const GLO_enterDepartureScheduleTimes = (obj) => {
-    // Data_cy has 2 inputs so we need the first one and use the raw command
+    // The times are Time-Box fields; each time zone is a field of its own, shown while Use time zones is on
     cy.GLO_addInput([formName, 'departure_time'], obj.departureTime);
-    cy.GLO_addInput([formName, 'departure_time', 1], obj.departureTimezone);
+    cy.GLO_addInput([formName, 'departure_timezone'], obj.departureTimezone);
     cy.GLO_addInput([formName, 'arrival_time'], obj.arrivalTime);
-    cy.GLO_addInput([formName, 'arrival_time', 1], obj.arrivalTimezone);
+    cy.GLO_addInput([formName, 'arrival_timezone'], obj.arrivalTimezone);
     typeIfPresent('arrival_relative_days', obj.arrivalRelativeDays);
     typeIfPresent('embark_duration', obj.embarkDuration);
     typeIfPresent('disembark_duration', obj.disembarkDuration);

package/dist/ci/sso-login.cy.js

@@ -0,0 +1,8 @@
+"use strict";
+// CI pre-step: logs in once so parallel runners on other machines can take over the SSO session (env ssoSessionFile).
+// Run it with: cypress run --spec node_modules/@globisnv/cypress-core/dist/ci/sso-login.cy.js
+describe('SSO login once', () => {
+    it('logs in and stores the IdP session for the other runners', () => {
+        cy.GLO_login();
+    });
+});

package/dist/commands/FOB_commands.d.ts

@@ -29,7 +29,7 @@ declare global {
              * @param {string} [company] - Optional parameter representing the company name.
              * @param {boolean} [formBuilderStandalone] - Optional check if test uses standalone formbuilder or not.
              */
-            FOB_oktaLogin(company?: string, formBuilderStandalone?: boolean): void;
+            FOB_ssoLogin(company?: string, formBuilderStandalone?: boolean): void;
             /**
              * Command to add a new custom view.
              *

package/dist/commands/FOB_commands.js

@@ -8,8 +8,8 @@ Cypress.Commands.add('FOB_login', (company, formBuilderStandalone) => {
         case 'servoy':
             cy.POR_servoyLogin(company, formBuilderStandalone);
             break;
-        case 'okta':
-            cy.FOB_oktaLogin(company, formBuilderStandalone);
+        case 'sso':
+            cy.FOB_ssoLogin(company, formBuilderStandalone);
             break;
         case 'default':
             cy.FOB_defaultLogin(company, formBuilderStandalone);
@@ -66,14 +66,14 @@ Cypress.Commands.add('FOB_defaultLogin', (company, formBuilderStandalone) => {
     }
     cy.get(`[data-cy="formbuilder${formBuilderStandalone ? '_standalone' : ''}.navbar_top"]`, { timeout: 120000 }).should('exist');
 });
-Cypress.Commands.add('FOB_oktaLogin', (company, formBuilderStandalone) => {
+Cypress.Commands.add('FOB_ssoLogin', (company, formBuilderStandalone) => {
     // Change the Url if necessary
     const url = Cypress.expose('formBuilderUrl');
     cy.visit(url);
-    // biome-ignore plugin: wait for okta redirect page load
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for okta redirect page load
     cy.wait(2000);
     cy.task('log', 'Redirect to okta url');
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+    cy.origin(Cypress.expose('ssoUrl'), () => {
         cy.get('.o-form-input')
             .find('[autocomplete="username"]')
             .type(Cypress.expose('username'));
@@ -133,7 +133,7 @@ Cypress.Commands.add('FOB_deleteCustomViewItem', (name) => {
 });
 Cypress.Commands.add('FOB_dragComponentItem', (dragLocation, dropLocation) => {
     cy.get(`[title="${dragLocation}"]`).realMouseDown({ button: 'left', position: 'center' }).realMouseMove(0, 10, { position: 'center' });
-    // biome-ignore plugin: wait for drag animation to settle before drop
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for drag animation to settle before drop
     cy.wait(200);
     cy.get(span).contains(dropLocation).realMouseMove(0, 0, { position: 'center' }).realMouseUp();
     cy.GLO_checkLoadingIndicator();

package/dist/commands/GLO_commands.d.ts

@@ -65,15 +65,6 @@ declare global {
              * If provided, the specified company will be selected during login.
              */
             GLO_defaultloginExtraUser(usernameENV: string, passwordENV: string, company?: string): void;
-            /**
-             * Command to perform a login using Okta authentication.
-             *
-             * @param {string} [company] - Optional parameter representing the company name.
-             * If provided, it selects the specified company after login.
-             * @param {urlTypeType} [urlType] - This optional parameter is used to change the url solution parameter from 'online' to something else, e.g. 'pos'.
-             * @param {skipCheckFlag} [skipNavCheck] - This optional parameter is used to skip the navbar validation. Only use this in rare cases
-             */
-            GLO_oktaLogin(company?: string, urlType?: urlTypeType, skipNavCheck?: skipCheckFlag): void;
             /**
              * Command to perform a logout.
              */

package/dist/commands/GLO_commands.js

@@ -88,14 +88,14 @@ Cypress.Commands.add('GLO_login', (company, urlType) => {
         case 'servoy':
             cy.GLO_servoyLogin(company);
             break;
-        case 'okta':
-            cy.GLO_oktaLogin(company, urlType);
+        case 'sso':
+            ssoLogin(company, urlType);
             break;
         case 'default':
             cy.GLO_defaultlogin(company, undefined, undefined, urlType);
             break;
         default:
-            throw new Error('Incorrect type for GLO_login. Available types: servoy, okta, default');
+            throw new Error('Incorrect type for GLO_login. Available types: servoy, sso, default');
     }
 });
 Cypress.Commands.add('GLO_defaultlogin', (company, usernameENV = 'username', passwordENV = 'password', urlType) => {
@@ -119,7 +119,7 @@ Cypress.Commands.add('GLO_defaultlogin', (company, usernameENV = 'username', pas
     cy.GLO_checkLoadingIndicator();
     cy.get('body').then(($body) => {
         if ($body.find('.svy-message-dialog.active .window-title').text() === 'Locked record') {
-            // biome-ignore plugin: wait for locked record dialog choice to register
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for locked record dialog choice to register
             cy.wait(15000);
             cy.GLO_dialogChoice('!globis.label.yes!');
         }
@@ -164,8 +164,12 @@ Cypress.Commands.add('GLO_defaultloginExtraUser', (usernameENV, passwordENV, com
     }
     cy.get('[data-cy="ng$main_form2.navbar_top"]', { timeout: 120000 }).should('exist');
 });
-const waitForWebSocketAfterOkta = () => {
-    cy.url({ timeout: 60000 }).should('not.include', new URL(Cypress.expose('oktaUrl')).hostname);
+// loginType sso: the URL of the identity provider, Globis Online's own Keycloak is the default
+const ssoUrl = () => Cypress.expose('ssoUrl') || 'https://auth.globis.cloud';
+// The provider follows from the URL. ponytail: add a provider here when a third one is supported
+const ssoProvider = () => (new URL(ssoUrl()).hostname.includes('okta') ? 'okta' : 'keycloak');
+const waitForWebSocketAfterSso = (idp = ssoUrl()) => {
+    cy.url({ timeout: 60000 }).should('not.include', new URL(idp).hostname);
     cy.window({ timeout: 60000 }).should((win) => {
         const w = win;
         if (!w.wsMessages)
@@ -177,20 +181,8 @@ const waitForWebSocketAfterOkta = () => {
         cy.task('log', `WebSocket spy confirmed connected, ${win.wsMessages?.messages.length} messages captured so far`);
     });
 };
-Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
-    // Change the Url if necessary
-    let url = Cypress.expose('globisUrl');
-    if (urlType) {
-        const target = globisUrlTypes.includes(urlType) ? 'globis_online' : 'online';
-        url = url.replace(target, urlType);
-    }
-    // Stateless Okta login redirects server side before any Servoy client boots, so there is no
-    // websocket to wait for on the first visit — the connection is only asserted after the Okta
-    // round trip (see waitForWebSocketAfterOkta). The spy itself is attached globally on every
-    // AUT page load (see websocketDetector.ts), which covers this server-side redirect too.
-    cy.visit(url);
-    cy.task('log', 'Redirect to okta url');
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+const oktaIdpLogin = () => {
+    cy.origin(ssoUrl(), () => {
         cy.get('.o-form-input', { timeout: 60000 })
             .find('[autocomplete="username"]')
             .clear()
@@ -205,11 +197,96 @@ Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
         cy.task('log', 'Filled in password');
         cy.get('[type="submit"]').click();
     });
+};
+// Keycloak: username page, password page, then a one-time code page when the user has OTP (otpSecret is set)
+const keycloakIdpLogin = () => {
+    // The code is made outside cy.origin: a task that waits for a free OTP window times out after 4s inside it.
+    // It is claimed right before the IdP pages, so it is still fresh when typed.
+    cy.env(['otpSecret']).then(({ otpSecret }) => {
+        if (otpSecret)
+            cy.task('totp', otpSecret, { log: false, timeout: 200000 }).then((code) => keycloakOrigin(code));
+        else
+            keycloakOrigin(undefined);
+    });
+};
+const keycloakOrigin = (code) => {
+    cy.origin(ssoUrl(), { args: { code } }, ({ code }) => {
+        cy.get('input[name="username"]', { timeout: 60000 })
+            .clear()
+            .type(Cypress.expose('username'));
+        cy.task('log', 'Filled in username');
+        cy.get('#kc-login').click();
+        cy.env(['password']).then(({ password }) => {
+            cy.get('input[name="password"]', { timeout: 20000 }).type(password, { log: false });
+            cy.task('log', 'Filled in password');
+            cy.get('#kc-login').click();
+            if (code) {
+                cy.get('input[name="otp"]', { timeout: 20000 }).should('be.visible');
+                cy.get('input[name="otp"]').type(code, { log: false });
+                cy.task('log', 'Filled in one-time code');
+                cy.get('#kc-login').click();
+            }
+        });
+    });
+};
+// One IdP login per run (cy.session, also across specs): every later call only revisits the app,
+// which the IdP signs in silently, so no password/OTP is asked again.
+// ponytail: no `validate` — an expired IdP session shows up as a login page, add a validate if that happens
+const ssoLogin = (company, urlType, skipvNavCheck) => {
+    const provider = ssoProvider();
+    // Change the Url if necessary
+    let url = Cypress.expose('globisUrl');
+    if (urlType) {
+        const target = globisUrlTypes.includes(urlType) ? 'globis_online' : 'online';
+        url = url.replace(target, urlType);
+    }
+    cy.session(['sso', provider, Cypress.expose('username'), ssoUrl(), url], () => {
+        const file = Cypress.expose('ssoSessionFile');
+        const idpHost = new URL(ssoUrl()).hostname;
+        const isIdpCookie = (c) => idpHost === c.domain.replace(/^\./, '') || idpHost.endsWith(`.${c.domain.replace(/^\./, '')}`);
+        const login = () => {
+            // Stateless SSO login redirects server side before any Servoy client boots, so there is no
+            // websocket to wait for on the first visit — the connection is only asserted after the IdP
+            // round trip (see waitForWebSocketAfterSso). The spy itself is attached globally on every
+            // AUT page load (see websocketDetector.ts), which covers this server-side redirect too.
+            cy.visit(url);
+            cy.task('log', `Redirect to ${provider} url`);
+            if (provider === 'okta')
+                oktaIdpLogin();
+            else
+                keycloakIdpLogin();
+            // Let the app finish its login callback, then keep only the IdP cookies: the app's own client session
+            // does not survive a restore, so every call starts a fresh app client that the IdP signs in silently.
+            if (cypressWebsocketLoader)
+                waitForWebSocketAfterSso(ssoUrl());
+            else
+                cy.url({ timeout: 60000 }).should('not.include', idpHost);
+            cy.getAllCookies({ log: false }).then((all) => {
+                for (const c of all)
+                    if (!isIdpCookie(c))
+                        cy.clearCookie(c.name, { domain: c.domain, log: false });
+                if (file)
+                    cy.task('ssoSessionWrite', { file, cookies: all.filter(isIdpCookie) }, { log: false });
+            });
+            cy.clearAllSessionStorage({ log: false });
+        };
+        // ssoSessionFile: another machine already logged in (CI pre-step), so take over its IdP cookies, no password/OTP here
+        if (!file)
+            return login();
+        cy.task('ssoSessionRead', file, { log: false }).then((saved) => {
+            if (!saved)
+                return login();
+            for (const c of saved) {
+                cy.setCookie(c.name, c.value, { domain: c.domain, path: c.path, secure: c.secure, httpOnly: c.httpOnly, sameSite: c.sameSite, expiry: c.expiry, log: false });
+            }
+        });
+    }, { cacheAcrossSpecs: true });
+    cy.visit(url);
     if (company) {
         cy.GLO_selectCompany(company);
     }
     if (cypressWebsocketLoader)
-        waitForWebSocketAfterOkta();
+        waitForWebSocketAfterSso(ssoUrl());
     cy.task('log', 'Start navbar check');
     if (!skipvNavCheck) {
         const navbarSelectors = {
@@ -223,12 +300,12 @@ Cypress.Commands.add('GLO_oktaLogin', (company, urlType, skipvNavCheck) => {
     }
     else {
         // This is in case the check is instable
-        // biome-ignore plugin: wait in case the check is instable
+        // biome-ignore lint/plugin/noUnnecessaryWaiting: wait in case the check is instable
         cy.wait(5000);
         cy.GLO_checkLoadingIndicator();
     }
     cy.task('log', 'End navbar check');
-});
+};
 Cypress.Commands.add('GLO_logout', () => {
     cy.document({ log: false }).then((doc) => {
         cy.GLO_getElement(['ng$main_form2', 'navbar_top']).find('.lucide-LogOut').click();
@@ -401,7 +478,7 @@ const waitForProgressBar = () => {
                 reject(new Error(`Timed out after ${Math.round((maxAttempts * pollInterval) / 1000)}s waiting for the progress bar to disappear`));
                 return;
             }
-            // biome-ignore plugin: wait for next poll interval before checking again
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for next poll interval before checking again
             cy.wait(pollInterval, { log: false }).then(() => {
                 log.set({ message: `Still waiting for the progress bar ${attempts}/${maxAttempts}` });
                 checkStatus(resolve, reject);
@@ -418,7 +495,7 @@ Cypress.Commands.add('GLO_checkLoadingIndicator', () => {
         cy.WS_loadingCheck();
     }
     else {
-        // biome-ignore plugin: wait before checking loading indicator
+        // biome-ignore lint/plugin/noUnnecessaryWaiting: wait before checking loading indicator
         cy.wait(1000);
         cy.get('loading-indicator', { timeout: loadingCheckTimeout }).should('not.exist');
         waitForProgressBar();
@@ -723,16 +800,22 @@ Cypress.Commands.add('GLO_closeDashboard', () => {
 Cypress.Commands.add('GLO_selectTab', (selector, tabName, openOrClose) => {
     cy.GLO_getElement(selector)
         .contains('[tabcontainer] .tab', tabName)
-        .then(($tab) => {
+        // The tab header is a div, so Cypress's `:disabled` actionability check doesn't apply: the click goes through
+        // and the server silently ignores it. Closing a disabled tab that is open fails too, because the close request
+        // goes through the same click on the same disabled tab, which the server ignores the same way. A tab can also
+        // be disabled only transiently (e.g. right after selecting a parent record), so this retries like any other
+        // Cypress assertion instead of failing on the first check.
+        .should(($tab) => {
         const isOpenAttr = $tab[0].getAttribute('open'); // Attribute is a string 'true' or missing -> null
         const isOpen = isOpenAttr === 'true'; // Convert to boolean
+        if (openOrClose !== isOpen && $tab[0].hasAttribute('disabled')) {
+            throw new Error(`Tab "${tabName}" in ${selector.join('.')} is disabled and cannot be ${openOrClose ? 'opened' : 'closed'}`);
+        }
+    })
+        .then(($tab) => {
+        const isOpenAttr = $tab[0].getAttribute('open');
+        const isOpen = isOpenAttr === 'true';
         if (openOrClose !== isOpen) {
-            // The tab header is a div, so Cypress's `:disabled` actionability check doesn't apply: the click goes through
-            // and the server silently ignores it. Closing a disabled tab that is open fails too, because the close request
-            // goes through the same click on the same disabled tab, which the server ignores the same way.
-            if ($tab[0].hasAttribute('disabled')) {
-                throw new Error(`Tab "${tabName}" in ${selector.join('.')} is disabled and cannot be ${openOrClose ? 'opened' : 'closed'}`);
-            }
             const action = openOrClose ? 'Opening' : 'Closing';
             cy.log(`${action} tab ${tabName}`);
             cy.wrap($tab).click();
@@ -804,7 +887,7 @@ Cypress.Commands.add('GLO_closeProgram', (topBottom, programName, tabNumber) =>
     cy.GLO_log(` - Closed program tab ${programName}`);
 });
 Cypress.Commands.add('GLO_dialogChoice', (confirmation) => {
-    // biome-ignore plugin: wait for dialog choice body to render
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for dialog choice body to render
     cy.wait(500);
     cy.get('body').then(($body) => {
         let CSSSearchStr;
@@ -994,21 +1077,44 @@ Cypress.Commands.add('GLO_filterGrid', (colId, selector, text, exactMatch = noEq
         }
     });
     if (filterType) {
+        // The typed value needs to sync into the grid's filter model before the operator
+        // menu opens, or the menu's own value field still reads empty and the operator
+        // picker starts from a stale/default state (reproduced manually: opening the menu
+        // too soon after typing shows the filter value field blank).
+        cy.GLO_checkLoadingIndicator();
         cy.get('@filterHeaderCell').find('button').click();
-        cy.get('.ag-filter-menu .ag-filter-select .ag-picker-field-display').click();
-        // biome-ignore plugin: special dropdown for filter, doesn't work without small wait
-        cy.wait(250); // Special dropdown for filter, doesn't work without small wait..
-        cy.get('.ag-filter-menu .ag-picker-expanded')
-            .invoke('attr', 'aria-controls')
-            .then((dropDownId) => {
-            cy.get(`[id="${dropDownId}"]`)
-                .should('be.visible')
-                .within(() => {
-                cy.get('.ag-list-item').contains(filterType).should('be.visible').parent().click();
+        // Selecting the operator in this popup is occasionally flaky in Cypress (the click
+        // registers but the picker display doesn't update to the new operator - reproduced
+        // manually in the live app and ruled out as a wrong-popup/stale-aria-controls issue;
+        // the open+select sequence itself is correct). Self-heal by reopening and reselecting
+        // instead of guessing at the exact cause of the dropped click.
+        // A compound AND/OR filter always has a second condition row scaffolded in (even
+        // when unused), each with its own operator picker - scope to .first() throughout so
+        // this always targets the primary condition's picker instead of matching 2 elements.
+        const selectFilterType = (attemptsLeft) => {
+            cy.get('.ag-filter-menu .ag-filter-select .ag-picker-field-display').first().click();
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: special dropdown for filter, doesn't work without small wait
+            cy.wait(250);
+            cy.get('.ag-filter-menu .ag-picker-expanded')
+                .invoke('attr', 'aria-controls')
+                .then((dropDownId) => {
+                cy.get(`[id="${dropDownId}"]`)
+                    .should('be.visible')
+                    .within(() => {
+                    cy.get('.ag-list-item').contains(filterType).should('be.visible').parent().click();
+                });
             });
-        });
-        cy.GLO_checkAGLoader();
-        cy.get('.ag-filter-menu .ag-filter-select .ag-picker-field-display').should('contain.text', filterType);
+            cy.GLO_checkAGLoader();
+            cy.get('.ag-filter-menu .ag-filter-select .ag-picker-field-display')
+                .first()
+                .then(($el) => {
+                if ($el.text().trim() !== filterType && attemptsLeft > 0) {
+                    selectFilterType(attemptsLeft - 1);
+                }
+            });
+        };
+        selectFilterType(2);
+        cy.get('.ag-filter-menu .ag-filter-select .ag-picker-field-display').first().should('contain.text', filterType);
         cy.press(Cypress.Keyboard.Keys.ESC); // Close the filter menu
     }
     cy.GLO_checkLoadingIndicator();
@@ -1057,13 +1163,13 @@ const selectYear = (targetYear) => {
         const currentYear = Number(currentDate.split(' ')[1]);
         if (currentYear < targetYear) {
             cy.GLO_getVisible('i.dx-icon.dx-icon-chevronright').last().click();
-            // biome-ignore plugin: wait for year navigation click to register
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for year navigation click to register
             cy.wait(500);
             selectYear(targetYear);
         }
         else if (currentYear > targetYear) {
             cy.GLO_getVisible('i.dx-icon.dx-icon-chevronleft').last().click();
-            // biome-ignore plugin: wait for year navigation click to register
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for year navigation click to register
             cy.wait(500);
             selectYear(targetYear);
         }
@@ -1083,13 +1189,13 @@ const selectMonth = (targetMonth) => {
             throw new Error('Given month is invalid');
         if (currenMonthNumber < targetMonth) {
             cy.GLO_getVisible('i.dx-icon.dx-icon-chevronright').last().click();
-            // biome-ignore plugin: wait for month navigation click to register
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for month navigation click to register
             cy.wait(500);
             selectMonth(targetMonth);
         }
         else if (currenMonthNumber > targetMonth) {
             cy.GLO_getVisible('i.dx-icon.dx-icon-chevronleft').last().click();
-            // biome-ignore plugin: wait for month navigation click to register
+            // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for month navigation click to register
             cy.wait(500);
             selectMonth(targetMonth);
         }
@@ -1452,8 +1558,8 @@ Cypress.Commands.add('GLO_validateCheckbox', (selector, value) => {
  * It ensures that the AG Grid has finished loading.
  */
 Cypress.Commands.add('GLO_checkAGLoader', () => {
-    // biome-ignore plugin: wait because AGLoader is not instant
-    cy.wait(1000); // Wait because AGLoader is not instant
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait because AGLoader is not instant
+    cy.wait(1000);
     cy.get('.ag-loading', { timeout: 600000 }).should('not.exist');
 });
 Cypress.Commands.add('GLO_log', (logValue) => {
@@ -1629,7 +1735,7 @@ Cypress.Commands.add('GLO_checkNumberOfRowsInGrid', (selector, numberToValidate,
                     reject(new Error(`Timed out after ${Math.round((maxAttempts * pollInterval) / 100) / 10}s: row count was ${actual}, expected "${lengthCondition} ${numberToValidate}"`));
                     return;
                 }
-                // biome-ignore plugin: wait for next poll interval before checking again
+                // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for next poll interval before checking again
                 cy.wait(pollInterval, { log: false }).then(() => {
                     log.set({ message: `Still polling ${actual} to ${lengthCondition} ${numberToValidate} ${attempts}/${maxAttempts}` });
                     checkStatus(resolve, reject);
@@ -1825,7 +1931,8 @@ Cypress.Commands.add('GLO_fillInfieldInGrid', (selector, rowFilter, columnId, va
             .some((cell) => cell.textContent?.trim() === rowFilter))
             .find(`[col-id="${columnId}"]`)
             .click();
-        cy.wait(500); // Else both click and dblclick fire too fast
+        // biome-ignore lint/plugin/noUnnecessaryWaiting: else both click and dblclick fire too fast
+        cy.wait(500);
         cy.GLO_getAllRowsInGrid()
             .filter((_, el) => Cypress.$(el)
             .find('[role="gridcell"]')
@@ -1838,7 +1945,8 @@ Cypress.Commands.add('GLO_fillInfieldInGrid', (selector, rowFilter, columnId, va
         cy.GLO_getElement(selector).within(() => {
             cy.GLO_clickRowInGrid(rowFilter, columnId);
         });
-        cy.wait(500); // Else both click and dblclick fire too fast
+        // biome-ignore lint/plugin/noUnnecessaryWaiting: else both click and dblclick fire too fast
+        cy.wait(500);
         cy.GLO_dblClickRowInGrid(row, selector, rowFilter, columnId, skipCheck);
     }
     cy.get(gridInputType === 'aggrid-texteditor-without-enter' ? gridInput : gridInputType, { timeout: 1000 }).should('exist');
@@ -1935,15 +2043,15 @@ Cypress.Commands.add('GLO_clickButtonInGrid', { prevSubject: ['optional', 'eleme
 });
 Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
     cy.GLO_logout();
-    // biome-ignore plugin: wait for Okta to process logout
-    cy.wait(10000); // Wait for Okta to process logout
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for Okta to process logout
+    cy.wait(10000);
     if (cypressWebsocketLoader) {
         cy.on('window:before:load', (win) => {
             attachWebSocketSpy(win);
         });
     }
     if (altUser) {
-        cy.origin(Cypress.expose('oktaUrl'), () => {
+        cy.origin(ssoUrl(), () => {
             cy.get('.okta-container', { timeout: 120000 });
             cy.get('.o-form-input', { timeout: 60000 })
                 .find('[autocomplete="username"]')
@@ -1962,7 +2070,7 @@ Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
         cy.GLO_log(`Logged in as ${Cypress.expose('username2')}`);
     }
     else {
-        cy.origin(Cypress.expose('oktaUrl'), () => {
+        cy.origin(ssoUrl(), () => {
             cy.get('.okta-container', { timeout: 120000 });
             cy.get('.o-form-input', { timeout: 60000 })
                 .find('[autocomplete="username"]')
@@ -1981,7 +2089,7 @@ Cypress.Commands.add('GLO_oktaAlternativeLogin', (altUser, company) => {
         cy.GLO_log(`Logged in as ${Cypress.expose('username')}`);
     }
     if (cypressWebsocketLoader)
-        waitForWebSocketAfterOkta();
+        waitForWebSocketAfterSso();
     cy.get('[data-cy$="ng$main_form2.navbar_top"]', { timeout: 120000 }).should('exist');
     if (company)
         cy.GLO_checkAndSelectCompany(company);

package/dist/commands/POR_commands.js

@@ -12,9 +12,9 @@ Cypress.Commands.add('POR_checkPortalSideMenuCorrect', (menuItems) => {
 });
 Cypress.Commands.add('POR_portalLogin', () => {
     cy.visit(Cypress.expose('portalUrl'));
-    // biome-ignore plugin: wait for portal login redirect
+    // biome-ignore lint/plugin/noUnnecessaryWaiting: wait for portal login redirect
     cy.wait(2000);
-    cy.origin(Cypress.expose('oktaUrl'), () => {
+    cy.origin(Cypress.expose('ssoUrl'), () => {
         cy.get('.o-form-input')
             .find('[autocomplete="username"]')
             .type(Cypress.expose('username'));

package/dist/config.js

@@ -45,7 +45,7 @@ export function defineGlobisConfig(overrides = {}) {
             ...overrides.e2e,
             setupNodeEvents(on, config) {
                 // Sensitive keys never get exposed to the browser via config.expose.
-                const sensitiveEnvKeys = new Set(['password', 'password2', 'api_key', 'QLIKURLS', 'S3_KEY', 'S3_SECRET']);
+                const sensitiveEnvKeys = new Set(['password', 'password2', 'api_key', 'QLIKURLS', 'S3_KEY', 'S3_SECRET', 'otpSecret']);
                 for (const [key, val] of Object.entries(config.env)) {
                     if (!sensitiveEnvKeys.has(key))
                         config.expose[key] = val;
@@ -92,6 +92,18 @@ export function defineGlobisConfig(overrides = {}) {
                         });
                         return result;
                     },
+                    // IdP session handed from one machine to the others (CI stashes the file), see ssoLogin in GLO_commands
+                    async ssoSessionRead(file) {
+                        return (await import('./ssoSessionFile.js')).readSsoSession(file);
+                    },
+                    async ssoSessionWrite({ file, cookies }) {
+                        (await import('./ssoSessionFile.js')).writeSsoSession(file, cookies);
+                        return null;
+                    },
+                    async totp(secret) {
+                        const { nextTotp } = await import('./totp.js');
+                        return nextTotp(secret);
+                    },
                     ...overrides.extraTasks
                 });
                 on('before:browser:launch', (browser, launchOptions) => {

package/dist/ssoSessionFile.d.ts

@@ -0,0 +1,2 @@
+export declare const readSsoSession: (file: string) => unknown[] | null;
+export declare const writeSsoSession: (file: string, cookies: unknown[]) => void;

package/dist/ssoSessionFile.js

@@ -0,0 +1,43 @@
+import fs from 'node:fs';
+import path from 'node:path';
+const MAX_AGE_MS = 8 * 3600 * 1000;
+const NOFOLLOW = fs.constants.O_NOFOLLOW ?? 0;
+// The file name comes from an env value, so its real location (parent symlinks resolved) must stay inside the
+// project (cwd). The file itself is opened with O_NOFOLLOW so it can not be a symlink either.
+const safePath = (file) => {
+    const resolved = path.resolve(file);
+    const parent = fs.realpathSync(path.dirname(resolved));
+    const target = path.join(parent, path.basename(resolved));
+    const relative = path.relative(fs.realpathSync(process.cwd()), target);
+    if (!relative || relative.startsWith('..') || path.isAbsolute(relative))
+        throw new Error(`ssoSessionFile must be a file inside the project, got: ${file}`);
+    // no O_NOFOLLOW (Windows): reject a symlinked file up front instead
+    if (!NOFOLLOW && fs.lstatSync(target, { throwIfNoEntry: false })?.isSymbolicLink())
+        throw new Error('ssoSessionFile must not be a symlink');
+    return target;
+};
+export const readSsoSession = (file) => {
+    const target = safePath(file);
+    try {
+        const fd = fs.openSync(target, fs.constants.O_RDONLY | NOFOLLOW);
+        try {
+            const saved = JSON.parse(fs.readFileSync(fd, 'utf8'));
+            return Date.now() - saved.savedAt < MAX_AGE_MS ? saved.cookies : null;
+        }
+        finally {
+            fs.closeSync(fd);
+        }
+    }
+    catch {
+        return null;
+    }
+};
+export const writeSsoSession = (file, cookies) => {
+    const fd = fs.openSync(safePath(file), fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_TRUNC | NOFOLLOW, 0o600);
+    try {
+        fs.writeSync(fd, JSON.stringify({ savedAt: Date.now(), cookies }));
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+};

package/dist/totp.d.ts

@@ -0,0 +1,2 @@
+export declare const totp: (secret: string, timeMs?: number) => string;
+export declare const nextTotp: (secret: string) => Promise<string>;

package/dist/totp.js

@@ -0,0 +1,54 @@
+import { createHash, createHmac } from 'node:crypto';
+import fs from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+// RFC 6238: HMAC-SHA1, 6 digits, 30 second period (Keycloak defaults, identical in every realm)
+const PERIOD_MS = 30000;
+const BASE32 = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ234567';
+const base32Decode = (secret) => {
+    const bytes = [];
+    let bits = 0;
+    let value = 0;
+    for (const char of secret.replace(/[\s=]/g, '').toUpperCase()) {
+        const index = BASE32.indexOf(char);
+        if (index < 0)
+            throw new Error('otpSecret is not valid base32');
+        value = (value << 5) | index;
+        bits += 5;
+        if (bits >= 8) {
+            bytes.push((value >>> (bits - 8)) & 255);
+            bits -= 8;
+        }
+    }
+    return Buffer.from(bytes);
+};
+export const totp = (secret, timeMs = Date.now()) => {
+    const counter = Buffer.alloc(8);
+    counter.writeBigUInt64BE(BigInt(Math.floor(timeMs / PERIOD_MS)));
+    const hash = createHmac('sha1', base32Decode(secret)).update(counter).digest();
+    const offset = hash[hash.length - 1] & 15;
+    const code = (hash.readUInt32BE(offset) & 0x7fffffff) % 1_000_000;
+    return String(code).padStart(6, '0');
+};
+// Keycloak refuses a code twice. Parallel runners are separate processes, so a window is claimed with an
+// exclusive marker file in the temp dir (atomic): a runner that finds its window taken waits for the next one.
+// ponytail: same machine only, runners on other machines (CI agents) still need staggering
+const claimWindow = (secret, window) => {
+    const id = createHash('sha256').update(secret).digest('hex').slice(0, 12);
+    try {
+        fs.writeFileSync(join(tmpdir(), `globis-otp-${id}-${window}`), '', { flag: 'wx' });
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+export const nextTotp = async (secret) => {
+    for (let attempt = 0; attempt < 6; attempt++) {
+        const window = Math.floor(Date.now() / PERIOD_MS);
+        if (claimWindow(secret, window))
+            return totp(secret);
+        await new Promise((resolve) => setTimeout(resolve, (window + 1) * PERIOD_MS - Date.now() + 500));
+    }
+    throw new Error('No free OTP window after 6 tries, too many runners share this user');
+};

package/dist/websocketDetector.js

@@ -492,7 +492,7 @@ Cypress.Commands.add('WS_loadingCheck', (options) => {
         }
         win.lockedRecordRetries = retries + 1;
         debugLog(`🔍 Locked record dialog detected (attempt ${win.lockedRecordRetries}/3), waiting 60s before handling`);
-        // biome-ignore plugin: <internal> Cypress wait for locked record dialog handling
+        // biome-ignore lint/plugin/noUnnecessaryWaiting: <internal> Cypress wait for locked record dialog handling
         cy.wait(LOCKED_RECORD_WAIT_MS).then(() => {
             if (!lockedRecordDialogHandled) {
                 lockedRecordDialogHandled = true;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@globisnv/cypress-core",
-    "version": "2.1.2",
+    "version": "2.2.0",
     "description": "Core building blocks for Globis Cypress E2E tests",
     "license": "UNLICENSED",
     "type": "module",
@@ -33,7 +33,7 @@
     },
     "files": [
         "dist",
-        "scripts",
+        "biome-plugins",
         "bin",
         "template",
         "biome.json"
@@ -57,7 +57,7 @@
         "uuid": "^14.0.1"
     },
     "devDependencies": {
-        "@biomejs/biome": "^2.5.7",
+        "@biomejs/biome": "^2.5.15",
         "@types/node": "^26.1.2",
         "cypress": "^16.1.0",
         "cypress-real-events": "^1.15.1",

package/template/biome.json

@@ -1,6 +1,7 @@
 {
-    "$schema": "https://biomejs.dev/schemas/2.5.7/schema.json",
+    "$schema": "https://biomejs.dev/schemas/2.5.15/schema.json",
     "extends": ["./node_modules/@globisnv/cypress-core/biome.json"],
+    "plugins": ["./node_modules/@globisnv/cypress-core/biome-plugins/noUnnecessaryWaiting.grit"],
     "files": {
         "includes": ["!cypress/screenshots", "!cypress/videos", "!cypress/downloads", "!cypress/reports", "!cypress.env*.json"]
     }

package/template/cypress.env.json.example

@@ -2,14 +2,15 @@
 // Delete these comments
 
 {
-    "loginType": "<default/servoy/okta>",
+    "loginType": "<default/servoy/sso>",
     "username": "<enter your username here>",
     "password": "<enter your password here>",
     "username2": "<optional - alternate login user, used by tests that switch users>",
     "password2": "<optional - password for username2>",
 
     "globisUrl": "<enter your globisUrl here>",
-    "oktaUrl": "<optional - only used when loginType is okta>",
+    "ssoUrl": "<optional - IdP URL, only used when loginType is sso: Okta when it contains okta, otherwise Keycloak. Default https://auth.globis.cloud>",
+    "otpSecret": "<optional - base32 TOTP secret, only used when loginType is sso with Keycloak and the user has OTP>",
     "ownerName": "<optional - only used for a local Servoy instance>",
 
     "api_key": "<optional - only used when a command needs an API key>",

package/template/package.json

@@ -9,13 +9,13 @@
         "typescript": "^7.0.2"
     },
     "devDependencies": {
-        "@biomejs/biome": "^2.5.7",
+        "@biomejs/biome": "^2.5.15",
         "@types/node": "^26.1.2",
         "cypress": "^16.0.0"
     },
     "scripts": {
-        "lint": "biome check . && node node_modules/@globisnv/cypress-core/scripts/check-unnecessary-waiting.mjs",
-        "lint:fix": "biome check . --write && node node_modules/@globisnv/cypress-core/scripts/check-unnecessary-waiting.mjs",
+        "lint": "biome check .",
+        "lint:fix": "biome check . --write",
         "typescript": "tsc --noEmit --skipLibCheck",
         "open": "cypress open --e2e --browser chrome",
         "record": "node ./cypress/support/record.mjs"

package/scripts/check-unnecessary-waiting.mjs

@@ -1,119 +0,0 @@
-#!/usr/bin/env node
-// Standalone replacement for the biome-plugins/no-unnecessary-waiting.grit plugin.
-//
-// Biome's GritQL plugins (2.5.7) have no suppression mechanism - a
-// register_diagnostic() call either fires or it doesn't, with no per-line
-// ignore comment support (confirmed: `biome lint --suppress` writes nothing
-// for plugin-sourced diagnostics). Blocking on cy.wait(<number>) while still
-// allowing a documented exception needs code that can check for a preceding
-// comment itself, so this is a plain AST walk instead of a Grit plugin.
-//
-// Flags cy.wait(<number literal>[, options]) unless the line directly above
-// the call has a `// biome-ignore plugin: <reason>` comment.
-
-import path from 'node:path';
-import * as ts from 'typescript/unstable/ast';
-import { API } from 'typescript/unstable/sync';
-
-const ROOT = process.cwd(); // invoking repo's root, not this script's install location
-const TSCONFIG = 'tsconfig.json';
-const IGNORE_COMMENT = /^\s*\/\/\s*biome-ignore\s+plugin:/;
-
-function walkAll(node, visit) {
-    visit(node);
-    node.forEachChild((child) => walkAll(child, visit));
-}
-
-function isIgnored(sourceFile, node) {
-    const line = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line;
-    if (line === 0) return false;
-    const lineStarts = sourceFile.getLineStarts();
-    const prevLineText = sourceFile.text.slice(lineStarts[line - 1], lineStarts[line]);
-    return IGNORE_COMMENT.test(prevLineText);
-}
-
-// A cy.wait(x) call is just as arbitrary when x is a const/default-param alias for a
-// numeric literal (e.g. `const serverTimeout = 5000`) as when it's inlined. Resolve by
-// walking up to the nearest enclosing block/function and looking for a declaration of
-// that name among its statements/parameters - not a file-wide name search, since two
-// unrelated functions can each declare their own same-named local (e.g. `pollInterval`).
-function resolveNumericAlias(identifier) {
-    const name = identifier.text;
-    for (let scope = identifier.parent; scope; scope = scope.parent) {
-        if (ts.isFunctionLikeDeclaration(scope)) {
-            for (const param of scope.parameters) {
-                if (ts.isIdentifier(param.name) && param.name.text === name && param.initializer && ts.isNumericLiteral(param.initializer)) {
-                    return param.initializer.text;
-                }
-            }
-        }
-        if (ts.isBlock(scope) || ts.isSourceFile(scope)) {
-            const statements = scope.statements;
-            for (const statement of statements) {
-                if (!ts.isVariableStatement(statement)) continue;
-                for (const decl of statement.declarationList.declarations) {
-                    if (ts.isIdentifier(decl.name) && decl.name.text === name && decl.initializer && ts.isNumericLiteral(decl.initializer)) {
-                        return decl.initializer.text;
-                    }
-                }
-            }
-        }
-    }
-    return undefined;
-}
-
-function checkSourceFile(sourceFile) {
-    const violations = [];
-    walkAll(sourceFile, (node) => {
-        if (!ts.isCallExpression(node)) return;
-        const callee = node.expression;
-        if (!ts.isPropertyAccessExpression(callee) || !ts.isIdentifier(callee.expression) || callee.expression.text !== 'cy') return;
-        if (callee.name.text !== 'wait') return;
-
-        const msArg = node.arguments[0];
-        if (!msArg) return;
-        const isDirectLiteral = ts.isNumericLiteral(msArg);
-        const isNumericAlias = ts.isIdentifier(msArg) && resolveNumericAlias(msArg) !== undefined;
-        if (!isDirectLiteral && !isNumericAlias) return;
-        if (isIgnored(sourceFile, node)) return;
-
-        violations.push({
-            file: sourceFile.fileName,
-            line: sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1
-        });
-    });
-    return violations;
-}
-
-function main() {
-    const api = new API({ cwd: ROOT });
-    try {
-        const snapshot = api.updateSnapshot({ openProjects: [TSCONFIG] });
-        const project = snapshot.getProject(TSCONFIG);
-
-        const cypressRoot = path.join(ROOT, 'cypress') + path.sep;
-        const fileNames = project.rootFiles.filter((f) => f.startsWith(cypressRoot) && f.endsWith('.ts') && !f.endsWith('.d.ts'));
-
-        const allViolations = [];
-        for (const fileName of fileNames) {
-            const sourceFile = project.program.getSourceFile(fileName);
-            if (!sourceFile) continue;
-            allViolations.push(...checkSourceFile(sourceFile));
-        }
-
-        for (const v of allViolations) {
-            console.log(
-                `${path.relative(ROOT, v.file)}:${v.line} Avoid arbitrary cy.wait(ms); prefer cy.intercept()/should() polling instead. (add "// biome-ignore plugin: <reason>" above the line if intentional)`
-            );
-        }
-
-        if (allViolations.length > 0) {
-            console.log(`\n${allViolations.length} unguarded cy.wait(ms) call(s) found.`);
-            process.exit(1);
-        }
-    } finally {
-        api.close();
-    }
-}
-
-main();