@owlmeans/test-ui 0.1.18-rc.3 → 0.1.18-rc.30

package/README.md

@@ -58,7 +58,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.28
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/test-ui",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.499Z",
+  "version": "0.1.18-rc.30",
+  "generatedAt": "2026-09-17T08:16:11.191Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/testing-ui/SKILL.md

@@ -1,16 +1,29 @@
 ---
 name: testing-ui
-description: Category-D component-level acceptance tests for OwlMeans Common UI packages (web-panel, web-client, client-panel, client-wl, web-flow, web-wl, client, client-i18n) and new shadcn UI + Tailwind v4 packages. Run under bun test, drive a real chromium via Playwright as a library — not the Playwright runner. Auto-invoked when writing tests in those packages.
+description: Category-D component-level acceptance tests for OwlMeans Common UI packages (web-panel, web-client, web-consent, web-router, mui-panel, client-panel, client-wl, web-flow, web-wl, client, client-i18n) and shadcn UI + Tailwind v4 packages. Run under bun test, drive a real chromium via Playwright as a library — not the Playwright runner. Auto-invoked when writing tests in those packages.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # UI Acceptance Tests — Category D (bun test + Playwright as a library)
 
-Category D applies to packages that ship rendered React UI: `client`, `client-i18n`, `client-panel`, `client-wl`, `web-client`, `web-flow`, `web-panel`, `web-wl`. Tests are **component-level acceptance** — they mount one component in a real browser and assert against rendered DOM. They are **not** end-to-end tests (no router-deep navigation, no live backend).
+**Install:** `"@owlmeans/test-ui": "^0.1.18-rc.30"` in `devDependencies`
+
+`@owlmeans/test-ui` depends on `playwright`, so the browser library arrives with it; add
+`playwright` to `devDependencies` as well when a spec imports a launcher itself. The Vite harness
+below is the consuming package's own, so a package that builds one also declares `vite` and
+`@vitejs/plugin-react`, plus `@tailwindcss/vite` and `tailwindcss` for a shadcn package. A
+smoke-only package that serves a `data:` URL needs none of those.
+
+Category D applies to packages that ship a rendered surface: `client`, `client-i18n`, `client-panel`, `client-wl`, `mui-panel`, `web-client`, `web-consent`, `web-flow`, `web-panel`, `web-router`, `web-wl`. Tests are **component-level acceptance** — they mount one component in a real browser and assert against rendered DOM. They are **not** end-to-end tests (no live backend).
 
 The runner is **`bun test`** — same as categories A/B/C — kept consistent so contributors only learn one harness. Playwright is consumed as a **library** (`playwright` package, not `@playwright/test`). The `playwright` library exposes `chromium`, `firefox`, `webkit` browser launchers; specs drive them directly from inside `bun:test` blocks.
 
-Service-only "client-*" packages (`client-flow`, `client-socket`, `web-router`, `web-db`) belong to category A — they have no rendered UI.
+A client-side package that ships no component belongs to category A, however browser-flavoured its
+name — `client-config`, `client-context`, `client-entrypoint`, `client-flow`, `client-job`,
+`client-resource`, `client-route`, `client-socket`, `web-db`, `web-gtm` and
+`web-router-react-router` are all services, models and adapters. `@owlmeans/web-router` is the one
+that is not: it drives the real History API, so its routing behaviour is only observable in a
+browser and its specs mount a full harness here.
 
 Auth-related UI packages (`web-oidc-rp`, `web-oidc-provider`, `client-auth`, `client-payment`) belong to category B and use `bun test` + `@owlmeans/test-auth`, not the chromium harness.
 
@@ -20,9 +33,9 @@ Auth-related UI packages (`web-oidc-rp`, `web-oidc-provider`, `client-auth`, `cl
 <your-package>/
 ├── src/...
 └── tests/
-    ├── harness/              # per-package: components registry + mount config
+    ├── harness/              # per-package: the app the specs drive
     │   ├── index.html        # copy of @owlmeans/test-ui/harness/index.html
-    │   └── mount.tsx         # registers components, reads ?component= and ?props=
+    │   └── mount.tsx         # boots the package's real surface into #root
     ├── context.ts            # one place that boots the harness server, exports HARNESS_URL
     └── <area>.spec.ts        # *.spec.ts only
 ```
@@ -42,9 +55,28 @@ Downloads the chromium binary the `playwright` library drives. CI installs it in
 | `launchBrowser(opts?)` | Return the shared chromium for this `bun test` process. Idempotent. |
 | `closeBrowser()` | Tear it down. Call from `afterAll`. |
 | `withPage(fn)` | Lease a fresh context+page for the duration of `fn`, dispose context on completion. |
-| `mountComponent({ url, component?, props? })` | Open a fresh context, navigate to the harness URL with `?component=` and `?props=` set, return `{ page, close }`. |
+| `mountComponent(opts)` | Open a fresh context, navigate to `opts.url`, return `Mounted` = `{ page, close }`. `component` and `props`, when given, are appended as `?component=` and `?props=`; omit them when the harness mounts a fixed root, which is what every harness here does. |
+| `MountOptions` | `{ url, component?, props?, waitUntil?, timeout? }` — `waitUntil` defaults to `domcontentloaded`, see below. |
+| `acceptConsent(page, { timeout? })` | Wait up to `timeout` (default 5s) for `[data-consent-dialog]`, accept all, wait for it to detach. Returns whether it answered one — and costs that whole wait when it does not. |
+| `saveScreenshot(page, dir, name)` | Full-page PNG to `<dir>/<name>.png`, creating `dir`. Returns the absolute path. |
 | Re-exports: `Browser`, `BrowserContext`, `Page`, `Locator` | Playwright types — no direct `playwright` import needed. |
 
+### Authenticated specs
+
+`@owlmeans/test-ui` also carries the supervisor-login helpers, so a spec can reach a screen that
+sits behind auth without hand-rolling a token:
+
+| Helper | Purpose |
+|---|---|
+| `pregenerateAuthToken(opts)` | Mint an `ED25519-BASIC-TOKEN …` bearer offline from a trusted private key — no browser, no round trip. Options: `{ userId, pk, scopes?, role?, entityId?, profileId?, source? }`. |
+| `authenticateViaSupervisorApi(opts)` | Drive the live PK supervisor flow over the backend API (init → sign → authenticate → dispatch), registering the user on first use. Options: `{ apiBaseUrl, userId, pk, paths?, fetchImpl? }`. |
+| `loginViaDispatcher(page, baseUrl, token, opts?)` | Inject a bearer through the standard `/dispatcher?token=…` route and wait for the app to navigate away. |
+| `loginViaSupervisorForm(page, opts)` | Drive the real login form end-to-end — navigate, answer consent, fill user id + key, submit, wait for the landing. Options: `{ baseUrl, userId, pk, path?, expectPath?, timeout?, waitUntil?, consent?, screenshotDir? }`. |
+
+These need a project whose backend trusts the private key they sign with, so they belong to specs
+that run against a real app rather than a mounted component. See `[[supervisor-auth]]` for the
+server and web wiring they assume.
+
 ## Spec shape
 
 ```ts
@@ -52,25 +84,35 @@ import { afterAll, describe, expect, test } from 'bun:test'
 import { closeBrowser, mountComponent } from '@owlmeans/test-ui'
 import { HARNESS_URL } from './context.js'
 
+// Browser work does not fit bun's 5s default: a cold harness compiles the app on first request,
+// and the first test to run pays for the Vite boot happening in the same process.
+const TIMEOUT = 30_000
+
 afterAll(async () => { await closeBrowser() })
 
+// The harness is a real app, so a spec picks its case by opening a path on it.
+const open = async (path: string) =>
+  mountComponent({ url: `${HARNESS_URL.replace(/\/$/, '')}${path}` })
+
 describe('<package> — <component>', () => {
   test('renders the SKILL.md happy-path example', async () => {
-    const { page, close } = await mountComponent({
-      url: HARNESS_URL,
-      component: 'LoginForm',
-      props: { redirect: '/' },
-    })
+    const { page, close } = await open('/login')
     try {
       expect(await page.locator('h1').textContent()).toBe('Sign in')
       expect(await page.getByRole('button', { name: /sign in/i }).isVisible()).toBe(true)
     } finally {
       await close()
     }
-  })
+  }, TIMEOUT)
 })
 ```
 
+**Every chromium test carries its own timeout** — the third argument to `test`. Bun's default is
+5s, which a cold harness blows through before the first assertion, and `bunfig.toml`'s
+`[test] timeout` does not raise it (bun 1.4.0 reads the section but ignores that key). 30s covers a
+mounted component against a Vite harness; a suite that drives a login form or a consent gate needs
+60s. `bun test --timeout=<ms>` raises a whole run from the command line.
+
 Use `bun:test`'s `expect` against awaited Playwright DOM queries (`textContent()`, `isVisible()`, `getAttribute()`). Don't import `expect` from `@playwright/test` — that would pull in the full runner and create two parallel test toolchains.
 
 ## Per-package `tests/context.ts`
@@ -93,7 +135,12 @@ export const getHarnessUrl = async (): Promise<string> => {
     configFile: false,
     root: resolve(here, './harness'),
     plugins: [react()],
+    // Pre-bundle the third-party runtime deps the mounted components pull in. A dependency
+    // discovered mid-transform makes Vite re-optimize and reload the page underneath the
+    // navigation, and the first `goto` of a cold run pays for that as a timeout.
+    optimizeDeps: { include: ['<runtime dep the components import>'] },
     server: { port: 0 },
+    logLevel: 'warn',
   })
   await server.listen()
   const local = server.resolvedUrls?.local?.[0]
@@ -105,11 +152,23 @@ export const getHarnessUrl = async (): Promise<string> => {
 export const HARNESS_URL = await getHarnessUrl()
 ```
 
-The per-package `tests/harness/mount.tsx` reads `?component=<name>` and `?props=<json>`, dynamic-imports the component from the consumer's `src/`, and renders it via `react-dom/client` inside `<div id="root">`. Each consuming UI package wires its own providers (MUI theme for legacy packages, or Tailwind CSS + `@` alias for shadcn packages; plus i18n, router) the way the real app does — that's why mount.tsx is per-package, not in `@owlmeans/test-ui`.
+List in `optimizeDeps.include` every non-`@owlmeans` runtime package the components reach — the
+toast library, the icon set, a form library. It is the difference between a cold run that passes
+and one that times out on its first navigation for no visible reason.
+
+The per-package `tests/harness/mount.tsx` statically imports what the package ships and renders it
+via `react-dom/client` into the `<div id="root">` that `index.html` provides. It builds a real
+application — `@owlmeans/web-panel` wires a context, the framework entrypoints and a `NavLayout`
+over its screens; `@owlmeans/web-router` compiles a route tree behind the browser router plugin —
+so a spec selects its case by the path it opens rather than by naming a component. A harness that
+needs variants of one surface reads its own query string for them, the way `@owlmeans/web-consent`
+picks a locale, a category set or the policy view. `mountComponent`'s `component` and `props`
+options are the ready-made form of that convention, for a harness written to read them.
+Each consuming UI package wires its own providers (a theme provider for the `mui-*` packages, or Tailwind CSS + the `@` alias for shadcn packages; plus i18n, router) the way the real app does — that's why mount.tsx is per-package, not in `@owlmeans/test-ui`.
 
 ## Smoke-only baseline
 
-For a package that only needs to prove the bun-test + chromium pipeline works (e.g. `web-panel`'s pilot), skip the Vite harness and serve a `data:text/html` URL inline:
+For a package that only needs to prove the bun-test + chromium pipeline works, skip the Vite harness and serve a `data:text/html` URL inline. Use this for a first spec in a package that has no harness yet — `web-panel` keeps one alongside a full Vite + chromium harness (`tests/harness/` plus a `tests/context.ts` wiring the Tailwind plugin, the `@` alias and a react dedupe), and that harness is the reference to copy for any package rendering real components:
 
 ```ts
 import { afterAll, describe, expect, test } from 'bun:test'
@@ -124,10 +183,13 @@ describe('chromium smoke', () => {
     const { page, close } = await mountComponent({ url: harness })
     try { expect(await page.locator('#t').textContent()).toBe('hello') }
     finally { await close() }
-  })
+  }, 30_000)
 })
 ```
 
+A smoke spec needs the same explicit timeout as any other: bun runs every spec file of a package
+in one process, so the first test to start pays for whatever harness the sibling files boot.
+
 ## Wiring `bun test`
 
 Per-package `package.json`:
@@ -142,7 +204,7 @@ Same line as categories A/B/C. No `playwright.config.ts`, no `bun x playwright t
 
 ## Tailwind + shadcn packages
 
-For shadcn-based OwlMeans packages the `tests/context.ts` Vite config needs two additions beyond the standard setup:
+For shadcn-based OwlMeans packages the `tests/context.ts` Vite config needs three additions beyond the standard setup:
 
 ```ts
 import tailwindcss from '@tailwindcss/vite'
@@ -154,11 +216,16 @@ const server = await createServer({
   plugins: [react(), tailwindcss()],               // add Tailwind v4 Vite plugin
   resolve: {
     alias: { '@': resolve(here, '../src/@') },     // resolve @/ to the package's local copy
+    dedupe: ['react', 'react-dom'],                // one React across the workspace links
   },
+  optimizeDeps: { include: ['sonner'] },           // pre-bundle, never discover mid-navigation
   server: { port: 0 },
+  logLevel: 'warn',
 })
 ```
 
+`dedupe` is not optional in a workspace: symlinked sibling packages otherwise resolve their own React copy and every hook throws.
+
 `tests/harness/mount.tsx` imports the package CSS so components render with Tailwind styles:
 
 ```tsx
@@ -166,6 +233,15 @@ import '../../src/@/globals.css'
 // ... dynamic component mounting ...
 ```
 
+### Testing routed UI (navigation, layouts)
+
+A spec that exercises navigation opens a **path** on the harness origin instead of a `?component=` query, and `mount.tsx` builds a real context with real entrypoints — the OwlMeans router drives the History API, so nothing about the routing may be faked. Two shapes the harness must get right, because a spec that trips them fails obscurely:
+
+- **Leave the context un-initialized** (`ready` false). The Router compiles the entrypoint tree into routes only while the context is un-initialized; a pre-readied context renders a blank page.
+- **Give every entrypoint that has children one child declared `default: true`**, or the parent's own path renders blank.
+
+Spread the framework's own `entrypoints` (exported by the panel package) into the harness list: the panel context registers the api-config middleware, which resolves one of them during init and throws before any route is compiled if they are missing.
+
 Shadcn components are plain React — no theme provider needed. Assert via `getByRole` / text as usual. To verify that Tailwind classes took visual effect, read computed styles:
 
 ```ts
@@ -182,5 +258,54 @@ See `[[shadcn-web]]` for the full `@` alias contract and `tests/context.ts` patt
 - **No mocks.** Render the real component with real client-context wiring (state, i18n, router) the way the app does. For network calls, use Playwright's `page.route(...)` to a static fixture — never point at a live backend.
 - **Cover SKILL.md and README.md cases first.** Each component the package documents gets at least one acceptance spec for its happy path.
 - **Max 3-4 tests per component**: render, primary interaction, one edge case.
+- **Always pass a timeout as `test`'s third argument.** 30s for a mounted component, 60s for a
+  suite that drives a login or a consent gate. Bun's 5s default is for in-process work, and
+  `bunfig.toml`'s `[test] timeout` is not a way to change it.
 - **Always `close()` the page and `closeBrowser()` in `afterAll`.** A leaked context blocks the bun process from exiting.
 - **Chromium only by default.** Add `firefox` or `webkit` per package only when the feature has documented cross-browser concerns — call `chromium.launch` / `firefox.launch` explicitly in that case.
+
+## `mountComponent` waits for `domcontentloaded`, not `load`
+
+Playwright's own default is `load`, and it is wrong for any page that is a real application:
+`load` waits for EVERY subresource, so one analytics beacon, long-poll or third-party pixel that
+never settles holds the navigation open until it times out — with the page fully rendered and
+working the whole time. The failure reads as "the site is down", and the first instinct is to go
+looking at the server.
+
+`mountComponent` therefore navigates with `domcontentloaded` and lets the spec wait for the
+selector it actually needs. That wait IS the assertion; the load event never was. Pass
+`waitUntil` explicitly for the rare case that wants otherwise.
+
+The rule is not `mountComponent`'s alone — **every** navigation helper here follows it, including
+`loginViaSupervisorForm` and `loginViaDispatcher`. A helper that navigates on playwright's default
+turns "someone added a tag manager" into "the whole login-driven suite times out", with the browser
+showing a working login form the entire time. Any new helper that calls `page.goto` passes
+`domcontentloaded` and takes a `waitUntil` override.
+
+`saveScreenshot(page, dir, name)` is the fastest way to see what the browser actually had on
+screen when an assertion timed out; `loginViaSupervisorForm` takes a `screenshotDir` that captures
+the filled form just before submit.
+
+## The consent dialog blocks the login form, and the failure blames the button
+
+An OwlMeans app asks for cookie consent **before** it will start an authentication flow, and the
+dialog is a modal with no dismissal — a decision is what the gate is waiting for. Until it is
+answered the overlay intercepts pointer events, so a login form renders, resolves, reports itself
+`visible, enabled and stable`, and still cannot be clicked. Playwright retries for the full timeout
+and then reports `click: Timeout … waiting for getByTestId('supervisor-submit')`, naming the
+button. Nothing is wrong with the button; read the `subtree intercepts pointer events` line, which
+names `[data-consent-dialog]`.
+
+`loginViaSupervisorForm` therefore calls `acceptConsent(page)` after navigating. `acceptConsent` is
+exported for specs that drive their own login: it waits for `[data-consent-dialog]` to become
+visible, clicks `[data-consent-accept-all]`, waits for the dialog to detach, and reports whether it
+answered one. It accepts **all** categories deliberately — a spec asserting a narrower decision must
+make that decision itself rather than inherit a silent minimum.
+
+**The `false` return costs the full wait.** It is what the visibility wait rejects into, not a cheap
+probe, so a page with no dialog pays the timeout — 5s by `acceptConsent`'s own default, but
+`loginViaSupervisorForm` passes its `timeout` straight through and that defaults to `60_000`. On an
+app that ships no consent widget the login helper therefore sits for a full minute before it fills
+the first field, with nothing on screen to explain it. Drive such an app with `consent: 'ignore'`,
+which skips the call entirely; that is also the switch a spec flips when it wants to answer the
+dialog itself.

package/build/mount.d.ts

@@ -18,6 +18,19 @@ export interface MountOptions {
      * URL as `?props=<json>` for the harness's `mount.tsx` to read.
      */
     props?: Record<string, unknown>;
+    /**
+     * What counts as "arrived". Defaults to `domcontentloaded`.
+     *
+     * NOT `load`, which is playwright's own default and is wrong for any page that is a real
+     * application: `load` waits for EVERY subresource, and an analytics beacon, a long-poll or a
+     * third-party pixel that never settles holds it open until the navigation times out — with the
+     * page fully rendered and working the whole time. The failure reads as "the site is down".
+     *
+     * A spec waits for the selector it actually needs; that is the assertion, not the load event.
+     */
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
+    /** Navigation timeout in ms. */
+    timeout?: number;
 }
 export interface Mounted {
     page: Page;

package/build/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,0EAA0E;IAC1E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,SAAgB,YAAY,KAAG,OAAO,CAAC,OAAO,CASxE,CAAA"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;IAClE,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,0EAA0E;IAC1E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,SAAgB,YAAY,KAAG,OAAO,CAAC,OAAO,CAYxE,CAAA"}

package/build/mount.js

@@ -27,7 +27,10 @@ export const mountComponent = async (opts) => {
     const browser = await launchBrowser();
     const context = await browser.newContext();
     const page = await context.newPage();
-    await page.goto(buildUrl(opts));
+    await page.goto(buildUrl(opts), {
+        waitUntil: opts.waitUntil ?? 'domcontentloaded',
+        ...(opts.timeout != null ? { timeout: opts.timeout } : {}),
+    });
     return {
         page,
         close: async () => { await context.close(); },

package/build/mount.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AA6B5C,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAU,EAAE;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAoB,EAAE;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/B,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC;KAC7C,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AA0C5C,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAU,EAAE;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAoB,EAAE;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC;KAC7C,CAAA;AACH,CAAC,CAAA"}

package/build/supervisor.d.ts

@@ -34,6 +34,7 @@ export declare const pregenerateAuthToken: (opts: PregenerateAuthTokenOptions) =
  */
 export declare const loginViaDispatcher: (page: Page, baseUrl: string, token: string, opts?: {
     dispatcherPath?: string;
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
 }) => Promise<void>;
 export interface SupervisorApiAuthOptions {
     /** Auth-manager API base URL (the backend serving /authentication/* and /authenticate). */
@@ -78,9 +79,43 @@ export interface SupervisorFormLoginOptions {
     /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
     expectPath?: string;
     timeout?: number;
+    /**
+     * What counts as "arrived" for the initial navigation. Defaults to `domcontentloaded`.
+     *
+     * See the note on `MountOptions.waitUntil`: `load` is playwright's default and is wrong for a
+     * real application, because it waits for every subresource — a tag manager, an analytics beacon
+     * or any pixel that never settles holds it open until the navigation times out, with the login
+     * form rendered and fillable the whole time.
+     */
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
+    /**
+     * What to do about a cookie-consent dialog covering the form. Defaults to `accept`, because an
+     * OwlMeans app will not start an authentication flow until consent is answered — see
+     * {@link acceptConsent}. Pass `ignore` only in a spec that answers the dialog itself.
+     */
+    consent?: 'accept' | 'ignore';
     /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
     screenshotDir?: string;
 }
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export declare const acceptConsent: (page: Page, opts?: {
+    timeout?: number;
+}) => Promise<boolean>;
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the

package/build/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AASrE,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,SAAgB,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAe5F,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,IAAI,WAAW,MAAM,SAAS,MAAM,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7E,OAAO,CAAC,IAAI,CAOd,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,SACjC,wBAAwB,KAC7B,OAAO,CAAC,MAAM,CAkChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAM1F,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAC3B,IAAI,QAAQ,0BAA0B,KAC3C,OAAO,CAAC,IAAI,CAmBd,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AASrE,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,SAAgB,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAe5F,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,IAAI,WAAW,MAAM,SAAS,MAAM,SACnC;IAAE,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;CAAE,KACrG,OAAO,CAAC,IAAI,CAQd,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,SACjC,wBAAwB,KAC7B,OAAO,CAAC,MAAM,CAkChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAM1F,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;IAClE;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7B,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SAClB,IAAI,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KACtC,OAAO,CAAC,OAAO,CAajB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAC3B,IAAI,QAAQ,0BAA0B,KAC3C,OAAO,CAAC,IAAI,CAiCd,CAAA"}

package/build/supervisor.js

@@ -19,7 +19,7 @@ export const pregenerateAuthToken = async (opts) => {
         token: createIdOfLength(32),
         userId: opts.userId,
         profileId: opts.profileId ?? opts.userId,
-        entityId: opts.entityId,
+        entitySlug: opts.entityId,
         scopes: opts.scopes ?? ['*'],
         role: opts.role ?? Role.User,
         type: AuthroizationType.Ed25519BasicToken,
@@ -39,7 +39,8 @@ export const loginViaDispatcher = async (page, baseUrl, token, opts) => {
     const path = opts?.dispatcherPath ?? '/dispatcher';
     const url = new URL(path, baseUrl);
     url.searchParams.set('token', token);
-    await page.goto(url.toString());
+    // `domcontentloaded`, not playwright's `load` default — see the note on `MountOptions.waitUntil`.
+    await page.goto(url.toString(), { waitUntil: opts?.waitUntil ?? 'domcontentloaded' });
     // Wait until the dispatcher has navigated away (token consumed).
     await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 });
 };
@@ -106,6 +107,36 @@ export const saveScreenshot = async (page, dir, name) => {
     return file;
 };
 const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor';
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export const acceptConsent = async (page, opts) => {
+    const dialog = page.locator('[data-consent-dialog]');
+    try {
+        await dialog.waitFor({ state: 'visible', timeout: opts?.timeout ?? 5_000 });
+    }
+    catch {
+        return false;
+    }
+    // Accept-all rather than essential-only: a test asserting a narrower decision should make that
+    // decision itself, and silently choosing the minimum here would hide it from the spec.
+    await page.locator('[data-consent-accept-all]').click();
+    await dialog.waitFor({ state: 'detached', timeout: opts?.timeout ?? 5_000 });
+    return true;
+};
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the
@@ -115,13 +146,26 @@ const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor';
 export const loginViaSupervisorForm = async (page, opts) => {
     const path = opts.path ?? DEFAULT_SUPERVISOR_PATH;
     const timeout = opts.timeout ?? 60_000;
-    await page.goto(new URL(path, opts.baseUrl).toString());
-    await page.getByTestId('supervisor-user-id').fill(opts.userId);
-    await page.getByTestId('supervisor-pk').fill(opts.pk);
+    await page.goto(new URL(path, opts.baseUrl).toString(), {
+        waitUntil: opts.waitUntil ?? 'domcontentloaded', timeout
+    });
+    // Wait for the app to MOUNT before deciding whether there is a dialog to answer. `domcontentloaded`
+    // returns while the SPA is still booting, and on a dev server that boot is occasionally tens of
+    // seconds — so a short consent probe reports "no dialog", the dialog then mounts over the form,
+    // and the fill below waits out its own timeout on a field that is present but covered. Either
+    // marker proves the app is up: the dialog, or the form itself when consent was already given.
+    await page.locator('[data-consent-dialog], [data-testid="supervisor-user-id"]')
+        .first().waitFor({ state: 'visible', timeout });
+    if (opts.consent !== 'ignore')
+        await acceptConsent(page, { timeout });
+    // The form renders only AFTER the dialog is dismissed, so these carry the caller's budget rather
+    // than playwright's 30s default — the whole point of accepting an explicit `timeout` here.
+    await page.getByTestId('supervisor-user-id').fill(opts.userId, { timeout });
+    await page.getByTestId('supervisor-pk').fill(opts.pk, { timeout });
     if (opts.screenshotDir != null) {
         await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form');
     }
-    await page.getByTestId('supervisor-submit').click();
+    await page.getByTestId('supervisor-submit').click({ timeout });
     if (opts.expectPath != null) {
         await page.waitForURL(url => url.toString().includes(opts.expectPath), { timeout });
     }

package/build/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EACL,iBAAiB,EAAE,QAAQ,IAAI,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,EAChF,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAmBhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAiC,EAAmB,EAAE;IAC/F,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;QACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC5B,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EAAE,OAAe,EAAE,KAAa,EAAE,IAAkC,EAC/D,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,IAAI,aAAa,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/B,iEAAiE;IACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/E,CAAC,CAAA;AAcD,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EAAE,GAAW,EAAE,IAAa,EACrC,EAAE;IAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,OAAO,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,IAA8B,EACb,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,sBAAsB,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,8BAA8B,CAAA;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,eAAe,CAAA;IAE5D,kEAAkE;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE;QAC/D,IAAI,EAAE,kBAAkB,CAAC,UAAU;KACpC,CAA0B,CAAA;IAE3B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAS,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9C,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAoB;QACnC,IAAI,EAAE,kBAAkB,CAAC,UAAU;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACd,CAAA;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,WAAW,CAAsB,CAAA;IAEjG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAsB,CAAA;IAEhH,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAU,EAAE,GAAW,EAAE,IAAY,EAAmB,EAAE;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAiBD,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAgC,EAC7B,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEvD,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAA;IAEnD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EACL,iBAAiB,EAAE,QAAQ,IAAI,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,EAChF,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAmBhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAiC,EAAmB,EAAE;IAC/F,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;QACxC,UAAU,EAAE,IAAI,CAAC,QAAQ;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC5B,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EAAE,OAAe,EAAE,KAAa,EAC1C,IAAsG,EACvF,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,IAAI,aAAa,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,kGAAkG;IAClG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAA;IACrF,iEAAiE;IACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/E,CAAC,CAAA;AAcD,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EAAE,GAAW,EAAE,IAAa,EACrC,EAAE;IAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,OAAO,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,IAA8B,EACb,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,sBAAsB,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,8BAA8B,CAAA;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,eAAe,CAAA;IAE5D,kEAAkE;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE;QAC/D,IAAI,EAAE,kBAAkB,CAAC,UAAU;KACpC,CAA0B,CAAA;IAE3B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAS,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9C,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAoB;QACnC,IAAI,EAAE,kBAAkB,CAAC,UAAU;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACd,CAAA;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,WAAW,CAAsB,CAAA;IAEjG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAsB,CAAA;IAEhH,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAU,EAAE,GAAW,EAAE,IAAY,EAAmB,EAAE;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAgCD,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,IAAU,EAAE,IAA2B,EACrB,EAAE;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,+FAA+F;IAC/F,uFAAuF;IACvF,MAAM,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAA;IACvD,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAgC,EAC7B,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,EAAE,OAAO;KACzD,CAAC,CAAA;IAEF,oGAAoG;IACpG,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC;SAC5E,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IAEjD,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAErE,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAElE,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9D,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-ui",
-  "version": "0.1.18-rc.3",
+  "version": "0.1.18-rc.30",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,12 +22,12 @@
     "./harness": "./harness/index.html"
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.3",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.3",
-    "@owlmeans/basic-ids": "^0.1.18-rc.3",
-    "@owlmeans/basic-keys": "^0.1.18-rc.3",
-    "@owlmeans/test": "^0.1.18-rc.3",
-    "@owlmeans/test-auth": "^0.1.18-rc.3",
+    "@owlmeans/auth": "^0.1.18-rc.27",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.28",
+    "@owlmeans/basic-ids": "^0.1.18-rc.26",
+    "@owlmeans/basic-keys": "^0.1.18-rc.30",
+    "@owlmeans/test": "^0.1.18-rc.24",
+    "@owlmeans/test-auth": "^0.1.18-rc.28",
     "playwright": "^1.61.1"
   },
   "peerDependencies": {
@@ -43,8 +43,8 @@
     }
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "^0.1.18-rc.3",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/dep-config": "^0.1.18-rc.6",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/mount.ts

@@ -20,6 +20,19 @@ export interface MountOptions {
    * URL as `?props=<json>` for the harness's `mount.tsx` to read.
    */
   props?: Record<string, unknown>
+  /**
+   * What counts as "arrived". Defaults to `domcontentloaded`.
+   *
+   * NOT `load`, which is playwright's own default and is wrong for any page that is a real
+   * application: `load` waits for EVERY subresource, and an analytics beacon, a long-poll or a
+   * third-party pixel that never settles holds it open until the navigation times out — with the
+   * page fully rendered and working the whole time. The failure reads as "the site is down".
+   *
+   * A spec waits for the selector it actually needs; that is the assertion, not the load event.
+   */
+  waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle'
+  /** Navigation timeout in ms. */
+  timeout?: number
 }
 
 export interface Mounted {
@@ -54,7 +67,10 @@ export const mountComponent = async (opts: MountOptions): Promise<Mounted> => {
   const browser = await launchBrowser()
   const context = await browser.newContext()
   const page = await context.newPage()
-  await page.goto(buildUrl(opts))
+  await page.goto(buildUrl(opts), {
+    waitUntil: opts.waitUntil ?? 'domcontentloaded',
+    ...(opts.timeout != null ? { timeout: opts.timeout } : {}),
+  })
   return {
     page,
     close: async () => { await context.close() },

package/src/supervisor.ts

@@ -41,7 +41,7 @@ export const pregenerateAuthToken = async (opts: PregenerateAuthTokenOptions): P
     token: createIdOfLength(32),
     userId: opts.userId,
     profileId: opts.profileId ?? opts.userId,
-    entityId: opts.entityId,
+    entitySlug: opts.entityId,
     scopes: opts.scopes ?? ['*'],
     role: opts.role ?? Role.User,
     type: AuthroizationType.Ed25519BasicToken,
@@ -60,12 +60,14 @@ export const pregenerateAuthToken = async (opts: PregenerateAuthTokenOptions): P
  * (e.g. to force an external IdP) should use {@link loginViaSupervisorForm}.
  */
 export const loginViaDispatcher = async (
-  page: Page, baseUrl: string, token: string, opts?: { dispatcherPath?: string }
+  page: Page, baseUrl: string, token: string,
+  opts?: { dispatcherPath?: string, waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle' }
 ): Promise<void> => {
   const path = opts?.dispatcherPath ?? '/dispatcher'
   const url = new URL(path, baseUrl)
   url.searchParams.set('token', token)
-  await page.goto(url.toString())
+  // `domcontentloaded`, not playwright's `load` default — see the note on `MountOptions.waitUntil`.
+  await page.goto(url.toString(), { waitUntil: opts?.waitUntil ?? 'domcontentloaded' })
   // Wait until the dispatcher has navigated away (token consumed).
   await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 })
 }
@@ -168,12 +170,60 @@ export interface SupervisorFormLoginOptions {
   /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
   expectPath?: string
   timeout?: number
+  /**
+   * What counts as "arrived" for the initial navigation. Defaults to `domcontentloaded`.
+   *
+   * See the note on `MountOptions.waitUntil`: `load` is playwright's default and is wrong for a
+   * real application, because it waits for every subresource — a tag manager, an analytics beacon
+   * or any pixel that never settles holds it open until the navigation times out, with the login
+   * form rendered and fillable the whole time.
+   */
+  waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle'
+  /**
+   * What to do about a cookie-consent dialog covering the form. Defaults to `accept`, because an
+   * OwlMeans app will not start an authentication flow until consent is answered — see
+   * {@link acceptConsent}. Pass `ignore` only in a spec that answers the dialog itself.
+   */
+  consent?: 'accept' | 'ignore'
   /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
   screenshotDir?: string
 }
 
 const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor'
 
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export const acceptConsent = async (
+  page: Page, opts?: { timeout?: number }
+): Promise<boolean> => {
+  const dialog = page.locator('[data-consent-dialog]')
+  try {
+    await dialog.waitFor({ state: 'visible', timeout: opts?.timeout ?? 5_000 })
+  } catch {
+    return false
+  }
+  // Accept-all rather than essential-only: a test asserting a narrower decision should make that
+  // decision itself, and silently choosing the minimum here would hide it from the spec.
+  await page.locator('[data-consent-accept-all]').click()
+  await dialog.waitFor({ state: 'detached', timeout: opts?.timeout ?? 5_000 })
+
+  return true
+}
+
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the
@@ -185,16 +235,30 @@ export const loginViaSupervisorForm = async (
 ): Promise<void> => {
   const path = opts.path ?? DEFAULT_SUPERVISOR_PATH
   const timeout = opts.timeout ?? 60_000
-  await page.goto(new URL(path, opts.baseUrl).toString())
+  await page.goto(new URL(path, opts.baseUrl).toString(), {
+    waitUntil: opts.waitUntil ?? 'domcontentloaded', timeout
+  })
+
+  // Wait for the app to MOUNT before deciding whether there is a dialog to answer. `domcontentloaded`
+  // returns while the SPA is still booting, and on a dev server that boot is occasionally tens of
+  // seconds — so a short consent probe reports "no dialog", the dialog then mounts over the form,
+  // and the fill below waits out its own timeout on a field that is present but covered. Either
+  // marker proves the app is up: the dialog, or the form itself when consent was already given.
+  await page.locator('[data-consent-dialog], [data-testid="supervisor-user-id"]')
+    .first().waitFor({ state: 'visible', timeout })
+
+  if (opts.consent !== 'ignore') await acceptConsent(page, { timeout })
 
-  await page.getByTestId('supervisor-user-id').fill(opts.userId)
-  await page.getByTestId('supervisor-pk').fill(opts.pk)
+  // The form renders only AFTER the dialog is dismissed, so these carry the caller's budget rather
+  // than playwright's 30s default — the whole point of accepting an explicit `timeout` here.
+  await page.getByTestId('supervisor-user-id').fill(opts.userId, { timeout })
+  await page.getByTestId('supervisor-pk').fill(opts.pk, { timeout })
 
   if (opts.screenshotDir != null) {
     await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form')
   }
 
-  await page.getByTestId('supervisor-submit').click()
+  await page.getByTestId('supervisor-submit').click({ timeout })
 
   if (opts.expectPath != null) {
     await page.waitForURL(url => url.toString().includes(opts.expectPath!), { timeout })