@owlmeans/test-ui 0.1.18-rc.4 → 0.1.18-rc.41

package/README.md

@@ -58,7 +58,7 @@ This package ships embedded agent skills under `agent-meta/`. After installing y
 your project's skill store (`.agents/skills/`):
 
 ```sh
-npx @owlmeans/agent-skills
+npx @owlmeans/agent-skills@^0.1.18-rc.40
 ```
 
 The embedded files are version-matched to this package release. Do not edit them

package/agent-meta/manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
   "package": "@owlmeans/test-ui",
-  "version": "0.1.18-rc.0",
-  "generatedAt": "2026-08-16T22:20:50.499Z",
+  "version": "0.1.18-rc.41",
+  "generatedAt": "2026-09-25T21:19:37.945Z",
   "canonicalRepo": "https://github.com/owlmeans/common",
   "entries": [
     {

package/agent-meta/skills/testing-ui/SKILL.md

@@ -1,16 +1,29 @@
 ---
 name: testing-ui
-description: Category-D component-level acceptance tests for OwlMeans Common UI packages (web-panel, web-client, client-panel, client-wl, web-flow, web-wl, client, client-i18n) and new shadcn UI + Tailwind v4 packages. Run under bun test, drive a real chromium via Playwright as a library — not the Playwright runner. Auto-invoked when writing tests in those packages.
+description: Category-D component-level acceptance tests for OwlMeans Common UI packages (web-panel, web-client, web-consent, web-router, mui-panel, client-panel, client-wl, web-flow, web-wl, client, client-i18n) and shadcn UI + Tailwind v4 packages. Run under bun test, drive a real chromium via Playwright as a library — not the Playwright runner. Auto-invoked when writing tests in those packages.
 ---
 <!-- AUTO-GENERATED — do not edit. Regenerate via sync-agent-meta. -->
 
 # UI Acceptance Tests — Category D (bun test + Playwright as a library)
 
-Category D applies to packages that ship rendered React UI: `client`, `client-i18n`, `client-panel`, `client-wl`, `web-client`, `web-flow`, `web-panel`, `web-wl`. Tests are **component-level acceptance** — they mount one component in a real browser and assert against rendered DOM. They are **not** end-to-end tests (no router-deep navigation, no live backend).
+**Install:** `"@owlmeans/test-ui": "^0.1.18-rc.41"` in `devDependencies`
+
+`@owlmeans/test-ui` depends on `playwright`, so the browser library arrives with it; add
+`playwright` to `devDependencies` as well when a spec imports a launcher itself. The Vite harness
+below is the consuming package's own, so a package that builds one also declares `vite` and
+`@vitejs/plugin-react`, plus `@tailwindcss/vite` and `tailwindcss` for a shadcn package. A
+smoke-only package that serves a `data:` URL needs none of those.
+
+Category D applies to packages that ship a rendered surface: `client`, `client-i18n`, `client-panel`, `client-wl`, `mui-panel`, `web-client`, `web-consent`, `web-flow`, `web-oauth`, `web-panel`, `web-router`, `web-wl`. Tests are **component-level acceptance** — they mount one component in a real browser and assert against rendered DOM. They are **not** end-to-end tests (no live backend).
 
 The runner is **`bun test`** — same as categories A/B/C — kept consistent so contributors only learn one harness. Playwright is consumed as a **library** (`playwright` package, not `@playwright/test`). The `playwright` library exposes `chromium`, `firefox`, `webkit` browser launchers; specs drive them directly from inside `bun:test` blocks.
 
-Service-only "client-*" packages (`client-flow`, `client-socket`, `web-router`, `web-db`) belong to category A — they have no rendered UI.
+A client-side package that ships no component belongs to category A, however browser-flavoured its
+name — `client-config`, `client-context`, `client-entrypoint`, `client-flow`, `client-job`,
+`client-resource`, `client-route`, `client-socket`, `web-db`, `web-gtm` and
+`web-router-react-router` are all services, models and adapters. `@owlmeans/web-router` is the one
+that is not: it drives the real History API, so its routing behaviour is only observable in a
+browser and its specs mount a full harness here.
 
 Auth-related UI packages (`web-oidc-rp`, `web-oidc-provider`, `client-auth`, `client-payment`) belong to category B and use `bun test` + `@owlmeans/test-auth`, not the chromium harness.
 
@@ -20,9 +33,9 @@ Auth-related UI packages (`web-oidc-rp`, `web-oidc-provider`, `client-auth`, `cl
 <your-package>/
 ├── src/...
 └── tests/
-    ├── harness/              # per-package: components registry + mount config
+    ├── harness/              # per-package: the app the specs drive
     │   ├── index.html        # copy of @owlmeans/test-ui/harness/index.html
-    │   └── mount.tsx         # registers components, reads ?component= and ?props=
+    │   └── mount.tsx         # boots the package's real surface into #root
     ├── context.ts            # one place that boots the harness server, exports HARNESS_URL
     └── <area>.spec.ts        # *.spec.ts only
 ```
@@ -42,9 +55,29 @@ Downloads the chromium binary the `playwright` library drives. CI installs it in
 | `launchBrowser(opts?)` | Return the shared chromium for this `bun test` process. Idempotent. |
 | `closeBrowser()` | Tear it down. Call from `afterAll`. |
 | `withPage(fn)` | Lease a fresh context+page for the duration of `fn`, dispose context on completion. |
-| `mountComponent({ url, component?, props? })` | Open a fresh context, navigate to the harness URL with `?component=` and `?props=` set, return `{ page, close }`. |
+| `mountComponent(opts)` | Open a fresh context, navigate to `opts.url`, return `Mounted` = `{ page, close }`. `component` and `props`, when given, are appended as `?component=` and `?props=`; omit them when the harness mounts a fixed root, which is what every harness here does. |
+| `MountOptions` | `{ url, component?, props?, waitUntil?, timeout? }` — `waitUntil` defaults to `domcontentloaded`, see below. |
+| `acceptConsent(page, { timeout? })` | Wait up to `timeout` (default 5s) for `[data-consent-dialog]`, accept all, wait for it to detach. Returns whether it answered one — and costs that whole wait when it does not. |
+| `saveScreenshot(page, dir, name)` | Full-page PNG to `<dir>/<name>.png`, creating `dir`. Returns the absolute path. |
 | Re-exports: `Browser`, `BrowserContext`, `Page`, `Locator` | Playwright types — no direct `playwright` import needed. |
 
+### Authenticated specs
+
+`@owlmeans/test-ui` also carries the supervisor-login helpers, so a spec can reach a screen that
+sits behind auth without hand-rolling a token:
+
+| Helper | Purpose |
+|---|---|
+| `pregenerateAuthToken(opts)` | Mint an `ED25519-BASIC-TOKEN …` bearer offline from a trusted private key — no browser, no round trip. Options: `{ userId, pk, scopes?, role?, entityId?, profileId?, source? }`. |
+| `authenticateViaSupervisorApi(opts)` | Drive the live PK supervisor flow over the backend API (init → sign → authenticate → dispatch), registering the user on first use. Options: `{ apiBaseUrl, userId, pk, paths?, fetchImpl? }`. |
+| `loginViaDispatcher(page, baseUrl, token, opts?)` | Inject a bearer through the standard `/dispatcher?token=…` route, wait for the app to navigate away, then answer marketing consent (see below). Options: `{ dispatcherPath?, waitUntil?, marketingConsent? }`. |
+| `loginViaSupervisorForm(page, opts)` | Drive the real login form end-to-end — navigate, answer consent, fill user id + key, submit, wait for the landing, then answer marketing consent (see below). Options: `{ baseUrl, userId, pk, path?, expectPath?, timeout?, waitUntil?, consent?, screenshotDir?, marketingConsent? }`. |
+| `answerMarketingConsent(page, opts?)` | Answer the `@owlmeans/web-marketing-consent` full-page step if it is shown right after login. Options: `{ accept?: 'all' \| 'none' \| 'skip', terms?: 'accept' \| 'leave', timeout? }`, default `accept: 'all'`, `terms: 'accept'`, `timeout: 30_000`. Returns whether the step was actually shown and answered — `false` means it never appeared. Throws if a Terms box could not be confirmed. |
+
+These need a project whose backend trusts the private key they sign with, so they belong to specs
+that run against a real app rather than a mounted component. See `[[supervisor-auth]]` for the
+server and web wiring they assume.
+
 ## Spec shape
 
 ```ts
@@ -52,25 +85,35 @@ import { afterAll, describe, expect, test } from 'bun:test'
 import { closeBrowser, mountComponent } from '@owlmeans/test-ui'
 import { HARNESS_URL } from './context.js'
 
+// Browser work does not fit bun's 5s default: a cold harness compiles the app on first request,
+// and the first test to run pays for the Vite boot happening in the same process.
+const TIMEOUT = 30_000
+
 afterAll(async () => { await closeBrowser() })
 
+// The harness is a real app, so a spec picks its case by opening a path on it.
+const open = async (path: string) =>
+  mountComponent({ url: `${HARNESS_URL.replace(/\/$/, '')}${path}` })
+
 describe('<package> — <component>', () => {
   test('renders the SKILL.md happy-path example', async () => {
-    const { page, close } = await mountComponent({
-      url: HARNESS_URL,
-      component: 'LoginForm',
-      props: { redirect: '/' },
-    })
+    const { page, close } = await open('/login')
     try {
       expect(await page.locator('h1').textContent()).toBe('Sign in')
       expect(await page.getByRole('button', { name: /sign in/i }).isVisible()).toBe(true)
     } finally {
       await close()
     }
-  })
+  }, TIMEOUT)
 })
 ```
 
+**Every chromium test carries its own timeout** — the third argument to `test`. Bun's default is
+5s, which a cold harness blows through before the first assertion, and `bunfig.toml`'s
+`[test] timeout` does not raise it (bun 1.4.0 reads the section but ignores that key). 30s covers a
+mounted component against a Vite harness; a suite that drives a login form or a consent gate needs
+60s. `bun test --timeout=<ms>` raises a whole run from the command line.
+
 Use `bun:test`'s `expect` against awaited Playwright DOM queries (`textContent()`, `isVisible()`, `getAttribute()`). Don't import `expect` from `@playwright/test` — that would pull in the full runner and create two parallel test toolchains.
 
 ## Per-package `tests/context.ts`
@@ -93,7 +136,12 @@ export const getHarnessUrl = async (): Promise<string> => {
     configFile: false,
     root: resolve(here, './harness'),
     plugins: [react()],
+    // Pre-bundle the third-party runtime deps the mounted components pull in. A dependency
+    // discovered mid-transform makes Vite re-optimize and reload the page underneath the
+    // navigation, and the first `goto` of a cold run pays for that as a timeout.
+    optimizeDeps: { include: ['<runtime dep the components import>'] },
     server: { port: 0 },
+    logLevel: 'warn',
   })
   await server.listen()
   const local = server.resolvedUrls?.local?.[0]
@@ -105,11 +153,23 @@ export const getHarnessUrl = async (): Promise<string> => {
 export const HARNESS_URL = await getHarnessUrl()
 ```
 
-The per-package `tests/harness/mount.tsx` reads `?component=<name>` and `?props=<json>`, dynamic-imports the component from the consumer's `src/`, and renders it via `react-dom/client` inside `<div id="root">`. Each consuming UI package wires its own providers (MUI theme for legacy packages, or Tailwind CSS + `@` alias for shadcn packages; plus i18n, router) the way the real app does — that's why mount.tsx is per-package, not in `@owlmeans/test-ui`.
+List in `optimizeDeps.include` every non-`@owlmeans` runtime package the components reach — the
+toast library, the icon set, a form library. It is the difference between a cold run that passes
+and one that times out on its first navigation for no visible reason.
+
+The per-package `tests/harness/mount.tsx` statically imports what the package ships and renders it
+via `react-dom/client` into the `<div id="root">` that `index.html` provides. It builds a real
+application — `@owlmeans/web-panel` wires a context, the framework entrypoints and a `NavLayout`
+over its screens; `@owlmeans/web-router` compiles a route tree behind the browser router plugin —
+so a spec selects its case by the path it opens rather than by naming a component. A harness that
+needs variants of one surface reads its own query string for them, the way `@owlmeans/web-consent`
+picks a locale, a category set or the policy view. `mountComponent`'s `component` and `props`
+options are the ready-made form of that convention, for a harness written to read them.
+Each consuming UI package wires its own providers (a theme provider for the `mui-*` packages, or Tailwind CSS + the `@` alias for shadcn packages; plus i18n, router) the way the real app does — that's why mount.tsx is per-package, not in `@owlmeans/test-ui`.
 
 ## Smoke-only baseline
 
-For a package that only needs to prove the bun-test + chromium pipeline works (e.g. `web-panel`'s pilot), skip the Vite harness and serve a `data:text/html` URL inline:
+For a package that only needs to prove the bun-test + chromium pipeline works, skip the Vite harness and serve a `data:text/html` URL inline. Use this for a first spec in a package that has no harness yet — `web-panel` keeps one alongside a full Vite + chromium harness (`tests/harness/` plus a `tests/context.ts` wiring the Tailwind plugin, the `@` alias and a react dedupe), and that harness is the reference to copy for any package rendering real components:
 
 ```ts
 import { afterAll, describe, expect, test } from 'bun:test'
@@ -124,10 +184,13 @@ describe('chromium smoke', () => {
     const { page, close } = await mountComponent({ url: harness })
     try { expect(await page.locator('#t').textContent()).toBe('hello') }
     finally { await close() }
-  })
+  }, 30_000)
 })
 ```
 
+A smoke spec needs the same explicit timeout as any other: bun runs every spec file of a package
+in one process, so the first test to start pays for whatever harness the sibling files boot.
+
 ## Wiring `bun test`
 
 Per-package `package.json`:
@@ -142,7 +205,7 @@ Same line as categories A/B/C. No `playwright.config.ts`, no `bun x playwright t
 
 ## Tailwind + shadcn packages
 
-For shadcn-based OwlMeans packages the `tests/context.ts` Vite config needs two additions beyond the standard setup:
+For shadcn-based OwlMeans packages the `tests/context.ts` Vite config needs three additions beyond the standard setup:
 
 ```ts
 import tailwindcss from '@tailwindcss/vite'
@@ -154,11 +217,16 @@ const server = await createServer({
   plugins: [react(), tailwindcss()],               // add Tailwind v4 Vite plugin
   resolve: {
     alias: { '@': resolve(here, '../src/@') },     // resolve @/ to the package's local copy
+    dedupe: ['react', 'react-dom'],                // one React across the workspace links
   },
+  optimizeDeps: { include: ['sonner'] },           // pre-bundle, never discover mid-navigation
   server: { port: 0 },
+  logLevel: 'warn',
 })
 ```
 
+`dedupe` is not optional in a workspace: symlinked sibling packages otherwise resolve their own React copy and every hook throws.
+
 `tests/harness/mount.tsx` imports the package CSS so components render with Tailwind styles:
 
 ```tsx
@@ -166,6 +234,15 @@ import '../../src/@/globals.css'
 // ... dynamic component mounting ...
 ```
 
+### Testing routed UI (navigation, layouts)
+
+A spec that exercises navigation opens a **path** on the harness origin instead of a `?component=` query, and `mount.tsx` builds a real context with real entrypoints — the OwlMeans router drives the History API, so nothing about the routing may be faked. Two shapes the harness must get right, because a spec that trips them fails obscurely:
+
+- **Leave the context un-initialized** (`ready` false). The Router compiles the entrypoint tree into routes only while the context is un-initialized; a pre-readied context renders a blank page.
+- **Give every entrypoint that has children one child declared `default: true`**, or the parent's own path renders blank.
+
+Spread the framework's own `entrypoints` (exported by the panel package) into the harness list: the panel context registers the api-config middleware, which resolves one of them during init and throws before any route is compiled if they are missing.
+
 Shadcn components are plain React — no theme provider needed. Assert via `getByRole` / text as usual. To verify that Tailwind classes took visual effect, read computed styles:
 
 ```ts
@@ -182,5 +259,108 @@ See `[[shadcn-web]]` for the full `@` alias contract and `tests/context.ts` patt
 - **No mocks.** Render the real component with real client-context wiring (state, i18n, router) the way the app does. For network calls, use Playwright's `page.route(...)` to a static fixture — never point at a live backend.
 - **Cover SKILL.md and README.md cases first.** Each component the package documents gets at least one acceptance spec for its happy path.
 - **Max 3-4 tests per component**: render, primary interaction, one edge case.
+- **Always pass a timeout as `test`'s third argument.** 30s for a mounted component, 60s for a
+  suite that drives a login or a consent gate. Bun's 5s default is for in-process work, and
+  `bunfig.toml`'s `[test] timeout` is not a way to change it.
 - **Always `close()` the page and `closeBrowser()` in `afterAll`.** A leaked context blocks the bun process from exiting.
 - **Chromium only by default.** Add `firefox` or `webkit` per package only when the feature has documented cross-browser concerns — call `chromium.launch` / `firefox.launch` explicitly in that case.
+
+## `mountComponent` waits for `domcontentloaded`, not `load`
+
+Playwright's own default is `load`, and it is wrong for any page that is a real application:
+`load` waits for EVERY subresource, so one analytics beacon, long-poll or third-party pixel that
+never settles holds the navigation open until it times out — with the page fully rendered and
+working the whole time. The failure reads as "the site is down", and the first instinct is to go
+looking at the server.
+
+`mountComponent` therefore navigates with `domcontentloaded` and lets the spec wait for the
+selector it actually needs. That wait IS the assertion; the load event never was. Pass
+`waitUntil` explicitly for the rare case that wants otherwise.
+
+The rule is not `mountComponent`'s alone — **every** navigation helper here follows it, including
+`loginViaSupervisorForm` and `loginViaDispatcher`. A helper that navigates on playwright's default
+turns "someone added a tag manager" into "the whole login-driven suite times out", with the browser
+showing a working login form the entire time. Any new helper that calls `page.goto` passes
+`domcontentloaded` and takes a `waitUntil` override.
+
+`saveScreenshot(page, dir, name)` is the fastest way to see what the browser actually had on
+screen when an assertion timed out; `loginViaSupervisorForm` takes a `screenshotDir` that captures
+the filled form just before submit.
+
+## The consent dialog blocks the login form, and the failure blames the button
+
+An OwlMeans app asks for cookie consent **before** it will start an authentication flow, and the
+dialog is a modal with no dismissal — a decision is what the gate is waiting for. Until it is
+answered the overlay intercepts pointer events, so a login form renders, resolves, reports itself
+`visible, enabled and stable`, and still cannot be clicked. Playwright retries for the full timeout
+and then reports `click: Timeout … waiting for getByTestId('supervisor-submit')`, naming the
+button. Nothing is wrong with the button; read the `subtree intercepts pointer events` line, which
+names `[data-consent-dialog]`.
+
+`loginViaSupervisorForm` therefore calls `acceptConsent(page)` after navigating. `acceptConsent` is
+exported for specs that drive their own login: it waits for `[data-consent-dialog]` to become
+visible, clicks `[data-consent-accept-all]`, waits for the dialog to detach, and reports whether it
+answered one. It accepts **all** categories deliberately — a spec asserting a narrower decision must
+make that decision itself rather than inherit a silent minimum.
+
+**The `false` return costs the full wait.** It is what the visibility wait rejects into, not a cheap
+probe, so a page with no dialog pays the timeout — 5s by `acceptConsent`'s own default, but
+`loginViaSupervisorForm` passes its `timeout` straight through and that defaults to `60_000`. On an
+app that ships no consent widget the login helper therefore sits for a full minute before it fills
+the first field, with nothing on screen to explain it. Drive such an app with `consent: 'ignore'`,
+which skips the call entirely; that is also the switch a spec flips when it wants to answer the
+dialog itself.
+
+## `answerMarketingConsent` — cheap absence detection, unlike the cookie dialog
+
+`loginViaSupervisorForm` and `loginViaDispatcher` both call `answerMarketingConsent(page, { accept:
+'all', timeout })` right after they confirm the app has navigated away from login/dispatch, passing
+their **own** `timeout` through explicitly rather than relying on this helper's internal default —
+both of them already budget more than one round trip (login + terms + items) into the value they
+pick. Both also default `marketingConsent` (their own option, not `answerMarketingConsent`'s) to
+`'save'` — pass `'ignore'` to skip the call in a spec that drives the step itself.
+`@owlmeans/web-marketing-consent` renders a full-page step, when shown, with `[data-marketing-consent]`
+(root, carrying `data-state="loading"` while its status read is outstanding and `"ready"` once it can
+render), `[data-marketing-consent-terms]` (the Terms checkbox, Terms mode only, with `data-version`),
+`[data-marketing-consent-terms-error]` (Terms record failed — the person stays and retries),
+`[data-marketing-consent-all]` (select-all, never ticks Terms), `[data-marketing-consent-item="<key>"]`
+(per-consent), `[data-marketing-consent-save]`, `[data-marketing-consent-skip]` (shown whenever the
+step is optional-only — i.e. `!loading && !terms.needed` — not only after a failed save),
+`[data-marketing-consent-skip-note]`, `[data-marketing-consent-signout]` (shown while a Terms box or
+the loading state is up) and `[data-marketing-consent-error]`.
+
+Unlike `acceptConsent`, whose `false` return deliberately costs the full wait (see above),
+`answerMarketingConsent` does NOT pay the full `timeout` (default `30_000`) when the step is absent.
+The screen is opt-in per app and most applications and environments don't have it wired in yet, and this helper
+is called unconditionally by both login helpers — a full-timeout tax on every login, on every app,
+whether or not the screen exists, would be an unacceptable regression to every existing suite. It
+instead races `[data-marketing-consent]` against the generic "the app has already landed" /
+"still on the login screen" markers the login helpers themselves already rely on (`#app-prompt`,
+`[data-login-method]`) via the same `locator('a, b, c').first().waitFor({ state: 'visible' })` idiom
+`loginViaSupervisorForm` uses for its own dialog-vs-form race. By the time a login helper calls this,
+one of those markers has typically already rendered, so on an app without the screen the race
+resolves as soon as it does — no fixed sleep, and no meaningful added latency over what the login
+helper already paid to get there.
+
+Once the step's root is present, it may still be `data-state="loading"` (its own status read is
+outstanding) — the helper races that attribute clearing against the whole root detaching on its own
+(nothing was pending, so it auto-continued while this waited), via two `page.waitForSelector` calls
+rather than an in-page `waitForFunction`/`evaluate` (this package's `tsconfig` has no `lib: dom`, so
+no TS runs inside the browser context here). An older `web-marketing-consent` that predates
+`data-state` entirely satisfies the "not loading" selector immediately, so this costs nothing there.
+
+When a Terms box is present, `opts.terms` (default `'accept'`) ticks it before saving; `'leave'`
+keeps it unticked, for a spec that means to exercise the blocked state itself — the confirm click
+still fires (with `{ force: true }`, since the control is never natively `disabled`), and the helper
+then *expects* the box to still be up afterward. `opts.accept` (default `'all'`) additionally clicks
+select-all when present, `'none'` saves with every item unchecked, and `'skip'` clicks
+`[data-marketing-consent-skip]` instead of saving — valid only when no Terms box is on screen.
+
+Returns `false` when the step never appeared. Otherwise it **throws** in two cases rather than
+silently swallowing them: a `[data-marketing-consent-terms-error]` after attempting to confirm
+Terms, and a Terms box still on screen after a failed/blocked confirm (Skip is never offered there
+on purpose, so there is no fallback and no honest way to report success). Short of those, it returns
+`true` whether the save succeeded outright or fell back to clicking
+`[data-marketing-consent-skip]` after a save error on an optional-only screen (logged as a console
+warning, never thrown) — the step is "answered" either way, so a spec is never permanently blocked
+behind a flaky save.

package/build/index.d.ts

@@ -1,4 +1,5 @@
 export * from './browser.js';
+export * from './marketing-consent.js';
 export * from './mount.js';
 export * from './supervisor.js';
 export type { Browser, BrowserContext, Locator, Page } from 'playwright';

package/build/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA;AAC/B,YAAY,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA"}

package/build/index.js

@@ -1,4 +1,5 @@
 export * from './browser.js';
+export * from './marketing-consent.js';
 export * from './mount.js';
 export * from './supervisor.js';
 //# sourceMappingURL=index.js.map

package/build/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,wBAAwB,CAAA;AACtC,cAAc,YAAY,CAAA;AAC1B,cAAc,iBAAiB,CAAA"}

package/build/marketing-consent.d.ts

@@ -0,0 +1,43 @@
+import type { Page } from 'playwright';
+export interface AnswerMarketingConsentOptions {
+    /**
+     * Which choice to save when the step is shown. `'all'` (the default) ticks the "select all"
+     * checkbox (every consent, and the Terms row while it is up — see {@link terms} for what is left
+     * of that) before saving; `'none'` saves with every item left unchecked, which is a valid,
+     * fully-compliant state on its own; `'skip'` clicks "Skip for now" instead of saving anything —
+     * only valid when a Terms box is not on screen (nothing calls it there; see {@link terms}).
+     */
+    accept?: 'none' | 'all' | 'skip';
+    /**
+     * When a Terms row is on screen (`appendMarketingConsent({ terms: 'step' })`), `'accept'` (the
+     * default) ends with it ticked. `'leave'` ends with it unticked, even after a select-all — for a
+     * spec that means to drive the blocked state itself; the confirm click below still fires (with `{ force: true }`, since
+     * the control is never truly `disabled`), and this helper then EXPECTS the box to still be up
+     * afterward rather than treating that as a failure.
+     */
+    terms?: 'accept' | 'leave';
+    timeout?: number;
+}
+/**
+ * Answer the marketing-consent full-page step (`@owlmeans/web-marketing-consent`) if it is shown
+ * right after login, so a spec driving {@link loginViaSupervisorForm} or {@link loginViaDispatcher}
+ * is never blocked behind it.
+ *
+ * The screen is opt-in per app, and most apps/environments will not have it wired in — that makes
+ * detecting its ABSENCE cheaply the whole point. A plain `waitFor` on `[data-marketing-consent]`
+ * alone would cost the full `timeout` on every login of every app that never renders it (the same
+ * caveat `acceptConsent` documents for the cookie dialog). Instead this races the step's own root
+ * against the generic OwlMeans "the app has already landed" / "still on the login screen" markers
+ * this file's own login helpers already wait on (`#app-prompt`, `[data-login-method]`) — by the
+ * time a login helper calls this, one of those has typically already rendered, so the race resolves
+ * as soon as it does: no fixed sleep, and in the common "step absent" case, no material added
+ * latency over what the login helper already paid to get here.
+ *
+ * @returns whether the step was actually shown and answered (including the error/skip fallback
+ * below); `false` when it never appeared within `timeout`, which is the expected result everywhere
+ * the screen is not yet configured or the visitor already has saved consents.
+ * @throws if a Terms box could not be confirmed (a `[data-marketing-consent-terms-error]`, or the
+ * box is still up with nowhere left to go — Skip is never offered there on purpose).
+ */
+export declare const answerMarketingConsent: (page: Page, opts?: AnswerMarketingConsentOptions) => Promise<boolean>;
+//# sourceMappingURL=marketing-consent.d.ts.map

package/build/marketing-consent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketing-consent.d.ts","sourceRoot":"","sources":["../src/marketing-consent.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAEtC,MAAM,WAAW,6BAA6B;IAC5C;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;IAChC;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAA;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAID;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,eAAO,MAAM,sBAAsB,SAC3B,IAAI,SAAS,6BAA6B,KAC/C,OAAO,CAAC,OAAO,CA2FjB,CAAA"}

package/build/marketing-consent.js

@@ -0,0 +1,107 @@
+const DEFAULT_MARKETING_CONSENT_TIMEOUT = 30_000;
+/**
+ * Answer the marketing-consent full-page step (`@owlmeans/web-marketing-consent`) if it is shown
+ * right after login, so a spec driving {@link loginViaSupervisorForm} or {@link loginViaDispatcher}
+ * is never blocked behind it.
+ *
+ * The screen is opt-in per app, and most apps/environments will not have it wired in — that makes
+ * detecting its ABSENCE cheaply the whole point. A plain `waitFor` on `[data-marketing-consent]`
+ * alone would cost the full `timeout` on every login of every app that never renders it (the same
+ * caveat `acceptConsent` documents for the cookie dialog). Instead this races the step's own root
+ * against the generic OwlMeans "the app has already landed" / "still on the login screen" markers
+ * this file's own login helpers already wait on (`#app-prompt`, `[data-login-method]`) — by the
+ * time a login helper calls this, one of those has typically already rendered, so the race resolves
+ * as soon as it does: no fixed sleep, and in the common "step absent" case, no material added
+ * latency over what the login helper already paid to get here.
+ *
+ * @returns whether the step was actually shown and answered (including the error/skip fallback
+ * below); `false` when it never appeared within `timeout`, which is the expected result everywhere
+ * the screen is not yet configured or the visitor already has saved consents.
+ * @throws if a Terms box could not be confirmed (a `[data-marketing-consent-terms-error]`, or the
+ * box is still up with nowhere left to go — Skip is never offered there on purpose).
+ */
+export const answerMarketingConsent = async (page, opts) => {
+    const timeout = opts?.timeout ?? DEFAULT_MARKETING_CONSENT_TIMEOUT;
+    const step = page.locator('[data-marketing-consent]');
+    try {
+        await page.locator('[data-marketing-consent], #app-prompt, [data-login-method]')
+            .first().waitFor({ state: 'visible', timeout });
+    }
+    catch {
+        return false;
+    }
+    if (await step.count() === 0)
+        return false;
+    // The step's own status read may still be outstanding (`data-state="loading"`) — wait past it,
+    // OR notice it already auto-continued (nothing was pending) and detached on its own. An older
+    // `web-marketing-consent` that predates `data-state` entirely satisfies the first selector
+    // immediately (a missing attribute is never `"loading"`), so this costs nothing there.
+    await Promise.race([
+        page.waitForSelector('[data-marketing-consent]:not([data-state="loading"])', { timeout }),
+        page.waitForSelector('[data-marketing-consent]', { state: 'detached', timeout }),
+    ]).catch(() => undefined);
+    // Nothing was pending — it already auto-continued while this waited.
+    if (await step.count() === 0)
+        return true;
+    const terms = page.locator('[data-marketing-consent-terms]');
+    const hasTerms = await terms.count() > 0;
+    if (!hasTerms && opts?.accept === 'skip') {
+        await page.locator('[data-marketing-consent-skip]').click();
+        await step.waitFor({ state: 'detached', timeout });
+        return true;
+    }
+    if ((opts?.accept ?? 'all') === 'all') {
+        // The step draws "Select all" only when there is more than one row to select; a lone consent
+        // is ticked itself. Select all speaks for the Terms row too while it is up, which the choice
+        // below then settles either way.
+        const all = page.locator('[data-marketing-consent-all]');
+        if (await all.count() > 0) {
+            await all.click();
+        }
+        else {
+            for (const item of await page.locator('[data-marketing-consent-item]').all()) {
+                await item.check();
+            }
+        }
+    }
+    // 'none' leaves every item unchecked and clicks nothing else before saving.
+    if (hasTerms) {
+        const wanted = (opts?.terms ?? 'accept') === 'accept';
+        if (wanted && !(await terms.isChecked())) {
+            await terms.check();
+        }
+        else if (!wanted && await terms.isChecked()) {
+            await terms.uncheck();
+        }
+    }
+    // `{ force: true }`: the confirm is never the native `disabled` — only `aria-disabled` while a
+    // Terms box is unticked, or merely styled muted with nothing changed yet — and Playwright's own
+    // actionability check honours `aria-disabled`, which this helper deliberately does not.
+    await page.locator('[data-marketing-consent-save]').click({ force: true });
+    const outcome = await Promise.race([
+        step.waitFor({ state: 'detached', timeout }).then(() => 'saved'),
+        page.locator('[data-marketing-consent-error]').waitFor({ state: 'visible', timeout })
+            .then(() => 'error'),
+        page.locator('[data-marketing-consent-terms-error]').waitFor({ state: 'visible', timeout })
+            .then(() => 'terms-error'),
+    ]).catch(() => 'error');
+    if (outcome === 'terms-error') {
+        throw new Error('[@owlmeans/test-ui] the marketing-consent step could not confirm the Terms');
+    }
+    if (outcome !== 'saved') {
+        const skip = page.locator('[data-marketing-consent-skip]');
+        if (await skip.count() > 0) {
+            console.warn('[@owlmeans/test-ui] marketing consent save did not complete; using the skip link instead');
+            await skip.click();
+            await step.waitFor({ state: 'detached', timeout }).catch(() => undefined);
+        }
+        else if (await terms.count() > 0) {
+            // No Skip is ever offered while the Terms box is up — a failed/blocked confirm here has no
+            // fallback, and silently returning would hide a caller stuck behind a real requirement.
+            throw new Error('[@owlmeans/test-ui] the marketing-consent step is still showing its Terms box');
+        }
+    }
+    // Answered either way: saved, or skipped past a flaky save. Never leaves the caller blocked.
+    return true;
+};
+//# sourceMappingURL=marketing-consent.js.map

package/build/marketing-consent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"marketing-consent.js","sourceRoot":"","sources":["../src/marketing-consent.ts"],"names":[],"mappings":"AAsBA,MAAM,iCAAiC,GAAG,MAAM,CAAA;AAEhD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAoC,EAC9B,EAAE;IACpB,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,IAAI,iCAAiC,CAAA;IAClE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,0BAA0B,CAAC,CAAA;IAErD,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,4DAA4D,CAAC;aAC7E,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAE1C,+FAA+F;IAC/F,8FAA8F;IAC9F,2FAA2F;IAC3F,uFAAuF;IACvF,MAAM,OAAO,CAAC,IAAI,CAAC;QACjB,IAAI,CAAC,eAAe,CAAC,sDAAsD,EAAE,EAAE,OAAO,EAAE,CAAC;QACzF,IAAI,CAAC,eAAe,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC;KACjF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IAEzB,qEAAqE;IACrE,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEzC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAA;IAC5D,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAExC,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QACzC,MAAM,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,KAAK,EAAE,CAAA;QAC3D,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAA;QAElD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACtC,6FAA6F;QAC7F,6FAA6F;QAC7F,iCAAiC;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAA;QACxD,IAAI,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,GAAG,CAAC,KAAK,EAAE,CAAA;QACnB,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,MAAM,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC;gBAC7E,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YACpB,CAAC;QACH,CAAC;IACH,CAAC;IACD,4EAA4E;IAE5E,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,KAAK,IAAI,QAAQ,CAAC,KAAK,QAAQ,CAAA;QACrD,IAAI,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,SAAS,EAAE,CAAC,EAAE,CAAC;YACzC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAA;QACrB,CAAC;aAAM,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC;YAC9C,MAAM,KAAK,CAAC,OAAO,EAAE,CAAA;QACvB,CAAC;IACH,CAAC;IAED,+FAA+F;IAC/F,gGAAgG;IAChG,wFAAwF;IACxF,MAAM,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAA;IAE1E,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;QACjC,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAgB,CAAC;QACzE,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aAClF,IAAI,CAAC,GAAG,EAAE,CAAC,OAAgB,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;aACxF,IAAI,CAAC,GAAG,EAAE,CAAC,aAAsB,CAAC;KACtC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAgB,CAAC,CAAA;IAEhC,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAA;IAC/F,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAA;QAC1D,IAAI,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YAC3B,OAAO,CAAC,IAAI,CAAC,0FAA0F,CAAC,CAAA;YACxG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAA;YAClB,MAAM,IAAI,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;QAC3E,CAAC;aAAM,IAAI,MAAM,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;YACnC,2FAA2F;YAC3F,wFAAwF;YACxF,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAA;QAClG,CAAC;IACH,CAAC;IAED,6FAA6F;IAC7F,OAAO,IAAI,CAAA;AACb,CAAC,CAAA"}

package/build/mount.d.ts

@@ -18,6 +18,19 @@ export interface MountOptions {
      * URL as `?props=<json>` for the harness's `mount.tsx` to read.
      */
     props?: Record<string, unknown>;
+    /**
+     * What counts as "arrived". Defaults to `domcontentloaded`.
+     *
+     * NOT `load`, which is playwright's own default and is wrong for any page that is a real
+     * application: `load` waits for EVERY subresource, and an analytics beacon, a long-poll or a
+     * third-party pixel that never settles holds it open until the navigation times out — with the
+     * page fully rendered and working the whole time. The failure reads as "the site is down".
+     *
+     * A spec waits for the selector it actually needs; that is the assertion, not the load event.
+     */
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
+    /** Navigation timeout in ms. */
+    timeout?: number;
 }
 export interface Mounted {
     page: Page;

package/build/mount.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,0EAA0E;IAC1E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,SAAgB,YAAY,KAAG,OAAO,CAAC,OAAO,CASxE,CAAA"}
+{"version":3,"file":"mount.d.ts","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AAGtC,MAAM,WAAW,YAAY;IAC3B;;;;;;OAMG;IACH,GAAG,EAAE,MAAM,CAAA;IACX;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B;;;;;;;;;OASG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;IAClE,gCAAgC;IAChC,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAA;IACV,0EAA0E;IAC1E,KAAK,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3B;AAYD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,cAAc,SAAgB,YAAY,KAAG,OAAO,CAAC,OAAO,CAYxE,CAAA"}

package/build/mount.js

@@ -27,7 +27,10 @@ export const mountComponent = async (opts) => {
     const browser = await launchBrowser();
     const context = await browser.newContext();
     const page = await context.newPage();
-    await page.goto(buildUrl(opts));
+    await page.goto(buildUrl(opts), {
+        waitUntil: opts.waitUntil ?? 'domcontentloaded',
+        ...(opts.timeout != null ? { timeout: opts.timeout } : {}),
+    });
     return {
         page,
         close: async () => { await context.close(); },

package/build/mount.js.map

@@ -1 +1 @@
-{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AA6B5C,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAU,EAAE;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAoB,EAAE;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAA;IAC/B,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC;KAC7C,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"mount.js","sourceRoot":"","sources":["../src/mount.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AA0C5C,MAAM,QAAQ,GAAG,CAAC,IAAkB,EAAU,EAAE;IAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAA;IACpC,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;IACnE,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI;QAAE,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAA;IACvE,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAA;IAC5B,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC,GAAG,CAAA;IAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAA;IAC9C,OAAO,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,GAAG,EAAE,EAAE,CAAA;AACjC,CAAC,CAAA;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAkB,EAAoB,EAAE;IAC3E,MAAM,OAAO,GAAG,MAAM,aAAa,EAAE,CAAA;IACrC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAA;IAC1C,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,EAAE,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAC9B,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB;QAC/C,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3D,CAAC,CAAA;IACF,OAAO;QACL,IAAI;QACJ,KAAK,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,CAAA,CAAC,CAAC;KAC7C,CAAA;AACH,CAAC,CAAA"}

package/build/supervisor.d.ts

@@ -34,6 +34,13 @@ export declare const pregenerateAuthToken: (opts: PregenerateAuthTokenOptions) =
  */
 export declare const loginViaDispatcher: (page: Page, baseUrl: string, token: string, opts?: {
     dispatcherPath?: string;
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
+    /**
+     * Answer the marketing-consent step if it is shown right after the dispatcher navigates away.
+     * Defaults to `'save'` (select-all and save) — see {@link answerMarketingConsent}. Pass
+     * `'ignore'` to skip the call entirely, e.g. in a spec that answers the step itself.
+     */
+    marketingConsent?: 'save' | 'ignore';
 }) => Promise<void>;
 export interface SupervisorApiAuthOptions {
     /** Auth-manager API base URL (the backend serving /authentication/* and /authenticate). */
@@ -78,9 +85,49 @@ export interface SupervisorFormLoginOptions {
     /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
     expectPath?: string;
     timeout?: number;
+    /**
+     * What counts as "arrived" for the initial navigation. Defaults to `domcontentloaded`.
+     *
+     * See the note on `MountOptions.waitUntil`: `load` is playwright's default and is wrong for a
+     * real application, because it waits for every subresource — a tag manager, an analytics beacon
+     * or any pixel that never settles holds it open until the navigation times out, with the login
+     * form rendered and fillable the whole time.
+     */
+    waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle';
+    /**
+     * What to do about a cookie-consent dialog covering the form. Defaults to `accept`, because an
+     * OwlMeans app will not start an authentication flow until consent is answered — see
+     * {@link acceptConsent}. Pass `ignore` only in a spec that answers the dialog itself.
+     */
+    consent?: 'accept' | 'ignore';
     /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
     screenshotDir?: string;
+    /**
+     * Answer the marketing-consent step if it is shown right after landing. Defaults to `'save'`
+     * (select-all and save) — see {@link answerMarketingConsent}. Pass `'ignore'` to skip the call
+     * entirely, e.g. in a spec that answers the step itself.
+     */
+    marketingConsent?: 'save' | 'ignore';
 }
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export declare const acceptConsent: (page: Page, opts?: {
+    timeout?: number;
+}) => Promise<boolean>;
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the

package/build/supervisor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AASrE,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,SAAgB,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAe5F,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,IAAI,WAAW,MAAM,SAAS,MAAM,SAAS;IAAE,cAAc,CAAC,EAAE,MAAM,CAAA;CAAE,KAC7E,OAAO,CAAC,IAAI,CAOd,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,SACjC,wBAAwB,KAC7B,OAAO,CAAC,MAAM,CAkChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAM1F,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAID;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAC3B,IAAI,QAAQ,0BAA0B,KAC3C,OAAO,CAAC,IAAI,CAmBd,CAAA"}
+{"version":3,"file":"supervisor.d.ts","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAA;AACtC,OAAO,KAAK,EAAyB,QAAQ,EAAE,MAAM,gBAAgB,CAAA;AAUrE,MAAM,WAAW,2BAA2B;IAC1C,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAA;IACd;;;;OAIG;IACH,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;IACjB,IAAI,CAAC,EAAE,QAAQ,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,iFAAiF;IACjF,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,SAAgB,2BAA2B,KAAG,OAAO,CAAC,MAAM,CAe5F,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,kBAAkB,SACvB,IAAI,WAAW,MAAM,SAAS,MAAM,SACnC;IACL,cAAc,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;IAC3F;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;CACrC,KACA,OAAO,CAAC,IAAI,CAYd,CAAA;AAED,MAAM,WAAW,wBAAwB;IACvC,2FAA2F;IAC3F,UAAU,EAAE,MAAM,CAAA;IAClB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,EAAE,EAAE,MAAM,CAAA;IACV,kDAAkD;IAClD,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACnE,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAgBD;;;;;;;;GAQG;AACH,eAAO,MAAM,4BAA4B,SACjC,wBAAwB,KAC7B,OAAO,CAAC,MAAM,CAkChB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,cAAc,SAAgB,IAAI,OAAO,MAAM,QAAQ,MAAM,KAAG,OAAO,CAAC,MAAM,CAM1F,CAAA;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAA;IACf,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAA;IACd,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAA;IACV,6DAA6D;IAC7D,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kGAAkG;IAClG,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;;OAOG;IACH,SAAS,CAAC,EAAE,QAAQ,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAA;IAClE;;;;OAIG;IACH,OAAO,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAA;IAC7B,2FAA2F;IAC3F,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAA;CACrC;AAID;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,aAAa,SAClB,IAAI,SAAS;IAAE,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,KACtC,OAAO,CAAC,OAAO,CAajB,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,SAC3B,IAAI,QAAQ,0BAA0B,KAC3C,OAAO,CAAC,IAAI,CAuCd,CAAA"}

package/build/supervisor.js

@@ -5,6 +5,7 @@ import { makeKeyPairModel } from '@owlmeans/basic-keys';
 import { createIdOfLength } from '@owlmeans/basic-ids';
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope';
 import { makeBearer } from '@owlmeans/test-auth';
+import { answerMarketingConsent } from './marketing-consent.js';
 /**
  * Mint a ready-to-use `ED25519-BASIC-TOKEN ...` bearer offline, reusing
  * `@owlmeans/test-auth`'s `makeBearer`. This is the "set a token directly"
@@ -19,7 +20,7 @@ export const pregenerateAuthToken = async (opts) => {
         token: createIdOfLength(32),
         userId: opts.userId,
         profileId: opts.profileId ?? opts.userId,
-        entityId: opts.entityId,
+        entitySlug: opts.entityId,
         scopes: opts.scopes ?? ['*'],
         role: opts.role ?? Role.User,
         type: AuthroizationType.Ed25519BasicToken,
@@ -39,9 +40,13 @@ export const loginViaDispatcher = async (page, baseUrl, token, opts) => {
     const path = opts?.dispatcherPath ?? '/dispatcher';
     const url = new URL(path, baseUrl);
     url.searchParams.set('token', token);
-    await page.goto(url.toString());
+    // `domcontentloaded`, not playwright's `load` default — see the note on `MountOptions.waitUntil`.
+    await page.goto(url.toString(), { waitUntil: opts?.waitUntil ?? 'domcontentloaded' });
     // Wait until the dispatcher has navigated away (token consumed).
     await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 });
+    if (opts?.marketingConsent !== 'ignore') {
+        await answerMarketingConsent(page, { accept: 'all', timeout: 30_000 });
+    }
 };
 const postJson = async (fetchImpl, url, body) => {
     const res = await fetchImpl(url, {
@@ -106,6 +111,36 @@ export const saveScreenshot = async (page, dir, name) => {
     return file;
 };
 const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor';
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export const acceptConsent = async (page, opts) => {
+    const dialog = page.locator('[data-consent-dialog]');
+    try {
+        await dialog.waitFor({ state: 'visible', timeout: opts?.timeout ?? 5_000 });
+    }
+    catch {
+        return false;
+    }
+    // Accept-all rather than essential-only: a test asserting a narrower decision should make that
+    // decision itself, and silently choosing the minimum here would hide it from the spec.
+    await page.locator('[data-consent-accept-all]').click();
+    await dialog.waitFor({ state: 'detached', timeout: opts?.timeout ?? 5_000 });
+    return true;
+};
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the
@@ -115,18 +150,37 @@ const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor';
 export const loginViaSupervisorForm = async (page, opts) => {
     const path = opts.path ?? DEFAULT_SUPERVISOR_PATH;
     const timeout = opts.timeout ?? 60_000;
-    await page.goto(new URL(path, opts.baseUrl).toString());
-    await page.getByTestId('supervisor-user-id').fill(opts.userId);
-    await page.getByTestId('supervisor-pk').fill(opts.pk);
+    await page.goto(new URL(path, opts.baseUrl).toString(), {
+        waitUntil: opts.waitUntil ?? 'domcontentloaded', timeout
+    });
+    // Wait for the app to MOUNT before deciding whether there is a dialog to answer. `domcontentloaded`
+    // returns while the SPA is still booting, and on a dev server that boot is occasionally tens of
+    // seconds — so a short consent probe reports "no dialog", the dialog then mounts over the form,
+    // and the fill below waits out its own timeout on a field that is present but covered. Either
+    // marker proves the app is up: the dialog, or the form itself when consent was already given.
+    await page.locator('[data-consent-dialog], [data-testid="supervisor-user-id"]')
+        .first().waitFor({ state: 'visible', timeout });
+    if (opts.consent !== 'ignore')
+        await acceptConsent(page, { timeout });
+    // The form renders only AFTER the dialog is dismissed, so these carry the caller's budget rather
+    // than playwright's 30s default — the whole point of accepting an explicit `timeout` here.
+    await page.getByTestId('supervisor-user-id').fill(opts.userId, { timeout });
+    await page.getByTestId('supervisor-pk').fill(opts.pk, { timeout });
     if (opts.screenshotDir != null) {
         await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form');
     }
-    await page.getByTestId('supervisor-submit').click();
+    await page.getByTestId('supervisor-submit').click({ timeout });
     if (opts.expectPath != null) {
         await page.waitForURL(url => url.toString().includes(opts.expectPath), { timeout });
     }
     else {
         await page.waitForURL(url => !url.pathname.startsWith(path), { timeout });
     }
+    // Carries the CALLER's own budget rather than the helper's smaller internal default — a slow
+    // cold environment (vite re-optimizing, a stage pod still warming) can easily spend most of a
+    // short fixed timeout just getting here, leaving too little for the two extra POSTs (terms, then
+    // items) a Terms-mode step now makes.
+    if (opts.marketingConsent !== 'ignore')
+        await answerMarketingConsent(page, { accept: 'all', timeout });
 };
 //# sourceMappingURL=supervisor.js.map

package/build/supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EACL,iBAAiB,EAAE,QAAQ,IAAI,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,EAChF,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAmBhD;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAiC,EAAmB,EAAE;IAC/F,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;QACxC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC5B,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EAAE,OAAe,EAAE,KAAa,EAAE,IAAkC,EAC/D,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,IAAI,aAAa,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC/B,iEAAiE;IACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;AAC/E,CAAC,CAAA;AAcD,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EAAE,GAAW,EAAE,IAAa,EACrC,EAAE;IAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,OAAO,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,IAA8B,EACb,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,sBAAsB,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,8BAA8B,CAAA;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,eAAe,CAAA;IAE5D,kEAAkE;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE;QAC/D,IAAI,EAAE,kBAAkB,CAAC,UAAU;KACpC,CAA0B,CAAA;IAE3B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAS,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9C,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAoB;QACnC,IAAI,EAAE,kBAAkB,CAAC,UAAU;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACd,CAAA;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,WAAW,CAAsB,CAAA;IAEjG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAsB,CAAA;IAEhH,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAU,EAAE,GAAW,EAAE,IAAY,EAAmB,EAAE;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAiBD,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAgC,EAC7B,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAA;IAEvD,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAC9D,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IAErD,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,KAAK,EAAE,CAAA;IAEnD,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;AACH,CAAC,CAAA"}
+{"version":3,"file":"supervisor.js","sourceRoot":"","sources":["../src/supervisor.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACxC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGzC,OAAO,EACL,iBAAiB,EAAE,QAAQ,IAAI,IAAI,EAAE,kBAAkB,EAAE,sBAAsB,EAChF,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAA;AACtD,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAmB/D;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,KAAK,EAAE,IAAiC,EAAmB,EAAE;IAC/F,MAAM,IAAI,GAAS;QACjB,KAAK,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC3B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;QACxC,UAAU,EAAE,IAAI,CAAC,QAAQ;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,CAAC;QAC5B,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI;QAC5B,IAAI,EAAE,iBAAiB,CAAC,iBAAiB;QACzC,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;QACzB,MAAM,EAAE,IAAI;QACZ,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAA;IAED,OAAO,UAAU,CAAC,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAA;AACpD,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,KAAK,EACrC,IAAU,EAAE,OAAe,EAAE,KAAa,EAC1C,IAQC,EACc,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,EAAE,cAAc,IAAI,aAAa,CAAA;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAClC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;IACpC,kGAAkG;IAClG,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,IAAI,kBAAkB,EAAE,CAAC,CAAA;IACrF,iEAAiE;IACjE,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IAE7E,IAAI,IAAI,EAAE,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,sBAAsB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;AACH,CAAC,CAAA;AAcD,MAAM,QAAQ,GAAG,KAAK,EACpB,SAAuB,EAAE,GAAW,EAAE,IAAa,EACrC,EAAE;IAChB,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAA;IACF,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,OAAO,GAAG,CAAC,MAAM,IAAI,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAA;IAC/F,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC,CAAA;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,KAAK,EAC/C,IAA8B,EACb,EAAE;IACnB,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,IAAI,sBAAsB,CAAA;IAC3D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,8BAA8B,CAAA;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,EAAE,QAAQ,IAAI,eAAe,CAAA;IAE5D,kEAAkE;IAClE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE;QAC/D,IAAI,EAAE,kBAAkB,CAAC,UAAU;KACpC,CAA0B,CAAA;IAE3B,2EAA2E;IAC3E,MAAM,YAAY,GAAG,iBAAiB,CAAS,SAAS,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAA;IACtF,MAAM,IAAI,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAA;IACjC,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9C,IAAI,CAAC,sBAAsB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAA;IAEhE,MAAM,WAAW,GAAoB;QACnC,IAAI,EAAE,kBAAkB,CAAC,UAAU;QACnC,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,MAAM,EAAE,CAAC,GAAG,CAAC;KACd,CAAA;IAED,uDAAuD;IACvD,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,QAAQ,EAAE,WAAW,CAAsB,CAAA;IAEjG,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,YAAY,EAAE,EAAE,KAAK,EAAE,YAAY,CAAC,KAAK,EAAE,CAAsB,CAAA;IAEhH,OAAO,KAAK,CAAC,KAAK,CAAA;AACpB,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,EAAE,IAAU,EAAE,GAAW,EAAE,IAAY,EAAmB,EAAE;IAC7F,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAA;IAC3B,MAAM,KAAK,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,CAAA;IACxC,MAAM,IAAI,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAA;IACrD,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAsCD,MAAM,uBAAuB,GAAG,qCAAqC,CAAA;AAErE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,KAAK,EAChC,IAAU,EAAE,IAA2B,EACrB,EAAE;IACpB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACpD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;IAC7E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;IACD,+FAA+F;IAC/F,uFAAuF;IACvF,MAAM,IAAI,CAAC,OAAO,CAAC,2BAA2B,CAAC,CAAC,KAAK,EAAE,CAAA;IACvD,MAAM,MAAM,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAA;IAE5E,OAAO,IAAI,CAAA;AACb,CAAC,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,KAAK,EACzC,IAAU,EAAE,IAAgC,EAC7B,EAAE;IACjB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,uBAAuB,CAAA;IACjD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,MAAM,CAAA;IACtC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE;QACtD,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,kBAAkB,EAAE,OAAO;KACzD,CAAC,CAAA;IAEF,oGAAoG;IACpG,gGAAgG;IAChG,gGAAgG;IAChG,8FAA8F;IAC9F,8FAA8F;IAC9F,MAAM,IAAI,CAAC,OAAO,CAAC,2DAA2D,CAAC;SAC5E,KAAK,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,CAAA;IAEjD,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,MAAM,aAAa,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAErE,iGAAiG;IACjG,2FAA2F;IAC3F,MAAM,IAAI,CAAC,WAAW,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAElE,IAAI,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,uBAAuB,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,CAAC,WAAW,CAAC,mBAAmB,CAAC,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC,CAAA;IAE9D,IAAI,IAAI,CAAC,UAAU,IAAI,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAW,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IACtF,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;IAC3E,CAAC;IAED,6FAA6F;IAC7F,8FAA8F;IAC9F,iGAAiG;IACjG,sCAAsC;IACtC,IAAI,IAAI,CAAC,gBAAgB,KAAK,QAAQ;QAAE,MAAM,sBAAsB,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;AACxG,CAAC,CAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@owlmeans/test-ui",
-  "version": "0.1.18-rc.4",
+  "version": "0.1.18-rc.41",
   "license": "MIT",
   "type": "module",
   "scripts": {
@@ -22,12 +22,12 @@
     "./harness": "./harness/index.html"
   },
   "dependencies": {
-    "@owlmeans/auth": "^0.1.18-rc.4",
-    "@owlmeans/basic-envelope": "^0.1.18-rc.4",
-    "@owlmeans/basic-ids": "^0.1.18-rc.4",
-    "@owlmeans/basic-keys": "^0.1.18-rc.4",
-    "@owlmeans/test": "^0.1.18-rc.4",
-    "@owlmeans/test-auth": "^0.1.18-rc.4",
+    "@owlmeans/auth": "^0.1.18-rc.36",
+    "@owlmeans/basic-envelope": "^0.1.18-rc.38",
+    "@owlmeans/basic-ids": "^0.1.18-rc.33",
+    "@owlmeans/basic-keys": "^0.1.18-rc.40",
+    "@owlmeans/test": "^0.1.18-rc.32",
+    "@owlmeans/test-auth": "^0.1.18-rc.38",
     "playwright": "^1.61.1"
   },
   "peerDependencies": {
@@ -43,8 +43,8 @@
     }
   },
   "devDependencies": {
-    "@owlmeans/dep-config": "^0.1.18-rc.4",
-    "@types/bun": "^1.3.14",
+    "@owlmeans/dep-config": "^0.1.18-rc.6",
+    "@types/bun": "^1.4.0",
     "@types/react": "^19.2.17",
     "nodemon": "^3.1.14",
     "typescript": "^7.0.2"

package/src/index.ts

@@ -1,4 +1,5 @@
 export * from './browser.js'
+export * from './marketing-consent.js'
 export * from './mount.js'
 export * from './supervisor.js'
 export type { Browser, BrowserContext, Locator, Page } from 'playwright'

package/src/marketing-consent.ts

@@ -0,0 +1,139 @@
+import type { Page } from 'playwright'
+
+export interface AnswerMarketingConsentOptions {
+  /**
+   * Which choice to save when the step is shown. `'all'` (the default) ticks the "select all"
+   * checkbox (every consent, and the Terms row while it is up — see {@link terms} for what is left
+   * of that) before saving; `'none'` saves with every item left unchecked, which is a valid,
+   * fully-compliant state on its own; `'skip'` clicks "Skip for now" instead of saving anything —
+   * only valid when a Terms box is not on screen (nothing calls it there; see {@link terms}).
+   */
+  accept?: 'none' | 'all' | 'skip'
+  /**
+   * When a Terms row is on screen (`appendMarketingConsent({ terms: 'step' })`), `'accept'` (the
+   * default) ends with it ticked. `'leave'` ends with it unticked, even after a select-all — for a
+   * spec that means to drive the blocked state itself; the confirm click below still fires (with `{ force: true }`, since
+   * the control is never truly `disabled`), and this helper then EXPECTS the box to still be up
+   * afterward rather than treating that as a failure.
+   */
+  terms?: 'accept' | 'leave'
+  timeout?: number
+}
+
+const DEFAULT_MARKETING_CONSENT_TIMEOUT = 30_000
+
+/**
+ * Answer the marketing-consent full-page step (`@owlmeans/web-marketing-consent`) if it is shown
+ * right after login, so a spec driving {@link loginViaSupervisorForm} or {@link loginViaDispatcher}
+ * is never blocked behind it.
+ *
+ * The screen is opt-in per app, and most apps/environments will not have it wired in — that makes
+ * detecting its ABSENCE cheaply the whole point. A plain `waitFor` on `[data-marketing-consent]`
+ * alone would cost the full `timeout` on every login of every app that never renders it (the same
+ * caveat `acceptConsent` documents for the cookie dialog). Instead this races the step's own root
+ * against the generic OwlMeans "the app has already landed" / "still on the login screen" markers
+ * this file's own login helpers already wait on (`#app-prompt`, `[data-login-method]`) — by the
+ * time a login helper calls this, one of those has typically already rendered, so the race resolves
+ * as soon as it does: no fixed sleep, and in the common "step absent" case, no material added
+ * latency over what the login helper already paid to get here.
+ *
+ * @returns whether the step was actually shown and answered (including the error/skip fallback
+ * below); `false` when it never appeared within `timeout`, which is the expected result everywhere
+ * the screen is not yet configured or the visitor already has saved consents.
+ * @throws if a Terms box could not be confirmed (a `[data-marketing-consent-terms-error]`, or the
+ * box is still up with nowhere left to go — Skip is never offered there on purpose).
+ */
+export const answerMarketingConsent = async (
+  page: Page, opts?: AnswerMarketingConsentOptions
+): Promise<boolean> => {
+  const timeout = opts?.timeout ?? DEFAULT_MARKETING_CONSENT_TIMEOUT
+  const step = page.locator('[data-marketing-consent]')
+
+  try {
+    await page.locator('[data-marketing-consent], #app-prompt, [data-login-method]')
+      .first().waitFor({ state: 'visible', timeout })
+  } catch {
+    return false
+  }
+
+  if (await step.count() === 0) return false
+
+  // The step's own status read may still be outstanding (`data-state="loading"`) — wait past it,
+  // OR notice it already auto-continued (nothing was pending) and detached on its own. An older
+  // `web-marketing-consent` that predates `data-state` entirely satisfies the first selector
+  // immediately (a missing attribute is never `"loading"`), so this costs nothing there.
+  await Promise.race([
+    page.waitForSelector('[data-marketing-consent]:not([data-state="loading"])', { timeout }),
+    page.waitForSelector('[data-marketing-consent]', { state: 'detached', timeout }),
+  ]).catch(() => undefined)
+
+  // Nothing was pending — it already auto-continued while this waited.
+  if (await step.count() === 0) return true
+
+  const terms = page.locator('[data-marketing-consent-terms]')
+  const hasTerms = await terms.count() > 0
+
+  if (!hasTerms && opts?.accept === 'skip') {
+    await page.locator('[data-marketing-consent-skip]').click()
+    await step.waitFor({ state: 'detached', timeout })
+
+    return true
+  }
+
+  if ((opts?.accept ?? 'all') === 'all') {
+    // The step draws "Select all" only when there is more than one row to select; a lone consent
+    // is ticked itself. Select all speaks for the Terms row too while it is up, which the choice
+    // below then settles either way.
+    const all = page.locator('[data-marketing-consent-all]')
+    if (await all.count() > 0) {
+      await all.click()
+    } else {
+      for (const item of await page.locator('[data-marketing-consent-item]').all()) {
+        await item.check()
+      }
+    }
+  }
+  // 'none' leaves every item unchecked and clicks nothing else before saving.
+
+  if (hasTerms) {
+    const wanted = (opts?.terms ?? 'accept') === 'accept'
+    if (wanted && !(await terms.isChecked())) {
+      await terms.check()
+    } else if (!wanted && await terms.isChecked()) {
+      await terms.uncheck()
+    }
+  }
+
+  // `{ force: true }`: the confirm is never the native `disabled` — only `aria-disabled` while a
+  // Terms box is unticked, or merely styled muted with nothing changed yet — and Playwright's own
+  // actionability check honours `aria-disabled`, which this helper deliberately does not.
+  await page.locator('[data-marketing-consent-save]').click({ force: true })
+
+  const outcome = await Promise.race([
+    step.waitFor({ state: 'detached', timeout }).then(() => 'saved' as const),
+    page.locator('[data-marketing-consent-error]').waitFor({ state: 'visible', timeout })
+      .then(() => 'error' as const),
+    page.locator('[data-marketing-consent-terms-error]').waitFor({ state: 'visible', timeout })
+      .then(() => 'terms-error' as const),
+  ]).catch(() => 'error' as const)
+
+  if (outcome === 'terms-error') {
+    throw new Error('[@owlmeans/test-ui] the marketing-consent step could not confirm the Terms')
+  }
+
+  if (outcome !== 'saved') {
+    const skip = page.locator('[data-marketing-consent-skip]')
+    if (await skip.count() > 0) {
+      console.warn('[@owlmeans/test-ui] marketing consent save did not complete; using the skip link instead')
+      await skip.click()
+      await step.waitFor({ state: 'detached', timeout }).catch(() => undefined)
+    } else if (await terms.count() > 0) {
+      // No Skip is ever offered while the Terms box is up — a failed/blocked confirm here has no
+      // fallback, and silently returning would hide a caller stuck behind a real requirement.
+      throw new Error('[@owlmeans/test-ui] the marketing-consent step is still showing its Terms box')
+    }
+  }
+
+  // Answered either way: saved, or skipped past a flaky save. Never leaves the caller blocked.
+  return true
+}

package/src/mount.ts

@@ -20,6 +20,19 @@ export interface MountOptions {
    * URL as `?props=<json>` for the harness's `mount.tsx` to read.
    */
   props?: Record<string, unknown>
+  /**
+   * What counts as "arrived". Defaults to `domcontentloaded`.
+   *
+   * NOT `load`, which is playwright's own default and is wrong for any page that is a real
+   * application: `load` waits for EVERY subresource, and an analytics beacon, a long-poll or a
+   * third-party pixel that never settles holds it open until the navigation times out — with the
+   * page fully rendered and working the whole time. The failure reads as "the site is down".
+   *
+   * A spec waits for the selector it actually needs; that is the assertion, not the load event.
+   */
+  waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle'
+  /** Navigation timeout in ms. */
+  timeout?: number
 }
 
 export interface Mounted {
@@ -54,7 +67,10 @@ export const mountComponent = async (opts: MountOptions): Promise<Mounted> => {
   const browser = await launchBrowser()
   const context = await browser.newContext()
   const page = await context.newPage()
-  await page.goto(buildUrl(opts))
+  await page.goto(buildUrl(opts), {
+    waitUntil: opts.waitUntil ?? 'domcontentloaded',
+    ...(opts.timeout != null ? { timeout: opts.timeout } : {}),
+  })
   return {
     page,
     close: async () => { await context.close() },

package/src/supervisor.ts

@@ -9,6 +9,7 @@ import { makeKeyPairModel } from '@owlmeans/basic-keys'
 import { createIdOfLength } from '@owlmeans/basic-ids'
 import { EnvelopeKind, makeEnvelopeModel } from '@owlmeans/basic-envelope'
 import { makeBearer } from '@owlmeans/test-auth'
+import { answerMarketingConsent } from './marketing-consent.js'
 
 export interface PregenerateAuthTokenOptions {
   /** Target user id / email the token represents. */
@@ -41,7 +42,7 @@ export const pregenerateAuthToken = async (opts: PregenerateAuthTokenOptions): P
     token: createIdOfLength(32),
     userId: opts.userId,
     profileId: opts.profileId ?? opts.userId,
-    entityId: opts.entityId,
+    entitySlug: opts.entityId,
     scopes: opts.scopes ?? ['*'],
     role: opts.role ?? Role.User,
     type: AuthroizationType.Ed25519BasicToken,
@@ -60,14 +61,28 @@ export const pregenerateAuthToken = async (opts: PregenerateAuthTokenOptions): P
  * (e.g. to force an external IdP) should use {@link loginViaSupervisorForm}.
  */
 export const loginViaDispatcher = async (
-  page: Page, baseUrl: string, token: string, opts?: { dispatcherPath?: string }
+  page: Page, baseUrl: string, token: string,
+  opts?: {
+    dispatcherPath?: string, waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle'
+    /**
+     * Answer the marketing-consent step if it is shown right after the dispatcher navigates away.
+     * Defaults to `'save'` (select-all and save) — see {@link answerMarketingConsent}. Pass
+     * `'ignore'` to skip the call entirely, e.g. in a spec that answers the step itself.
+     */
+    marketingConsent?: 'save' | 'ignore'
+  }
 ): Promise<void> => {
   const path = opts?.dispatcherPath ?? '/dispatcher'
   const url = new URL(path, baseUrl)
   url.searchParams.set('token', token)
-  await page.goto(url.toString())
+  // `domcontentloaded`, not playwright's `load` default — see the note on `MountOptions.waitUntil`.
+  await page.goto(url.toString(), { waitUntil: opts?.waitUntil ?? 'domcontentloaded' })
   // Wait until the dispatcher has navigated away (token consumed).
   await page.waitForURL(u => !u.pathname.startsWith(path), { timeout: 30_000 })
+
+  if (opts?.marketingConsent !== 'ignore') {
+    await answerMarketingConsent(page, { accept: 'all', timeout: 30_000 })
+  }
 }
 
 export interface SupervisorApiAuthOptions {
@@ -168,12 +183,66 @@ export interface SupervisorFormLoginOptions {
   /** Predicate/URL fragment that signals a successful landing (default: leaving the login path). */
   expectPath?: string
   timeout?: number
+  /**
+   * What counts as "arrived" for the initial navigation. Defaults to `domcontentloaded`.
+   *
+   * See the note on `MountOptions.waitUntil`: `load` is playwright's default and is wrong for a
+   * real application, because it waits for every subresource — a tag manager, an analytics beacon
+   * or any pixel that never settles holds it open until the navigation times out, with the login
+   * form rendered and fillable the whole time.
+   */
+  waitUntil?: 'commit' | 'domcontentloaded' | 'load' | 'networkidle'
+  /**
+   * What to do about a cookie-consent dialog covering the form. Defaults to `accept`, because an
+   * OwlMeans app will not start an authentication flow until consent is answered — see
+   * {@link acceptConsent}. Pass `ignore` only in a spec that answers the dialog itself.
+   */
+  consent?: 'accept' | 'ignore'
   /** When set, capture the filled login form (`supervisor-login-form.png`) before submit. */
   screenshotDir?: string
+  /**
+   * Answer the marketing-consent step if it is shown right after landing. Defaults to `'save'`
+   * (select-all and save) — see {@link answerMarketingConsent}. Pass `'ignore'` to skip the call
+   * entirely, e.g. in a spec that answers the step itself.
+   */
+  marketingConsent?: 'save' | 'ignore'
 }
 
 const DEFAULT_SUPERVISOR_PATH = '/authentication/login/pk-supervisor'
 
+/**
+ * Answer the cookie-consent dialog if one is up, so the page underneath can be driven.
+ *
+ * An OwlMeans app asks for consent BEFORE it will start an authentication flow, and the dialog is
+ * a modal with no dismissal — by design, since a decision is what the gate is waiting for. For a
+ * test that means the login form renders, resolves, reports itself "visible, enabled and stable"
+ * and still cannot be clicked, because the overlay intercepts the pointer. Playwright retries for
+ * the full timeout and then blames the button, which is the most misleading failure in this file:
+ * nothing is wrong with the form.
+ *
+ * Accepting is the honest default for a login helper — the flow it is about to drive is exactly
+ * what the dialog is gating — but it is best-effort: an app without the widget, or one where the
+ * visitor already decided, simply has no dialog and this returns at once.
+ *
+ * @returns whether a dialog was actually answered.
+ */
+export const acceptConsent = async (
+  page: Page, opts?: { timeout?: number }
+): Promise<boolean> => {
+  const dialog = page.locator('[data-consent-dialog]')
+  try {
+    await dialog.waitFor({ state: 'visible', timeout: opts?.timeout ?? 5_000 })
+  } catch {
+    return false
+  }
+  // Accept-all rather than essential-only: a test asserting a narrower decision should make that
+  // decision itself, and silently choosing the minimum here would hide it from the spec.
+  await page.locator('[data-consent-accept-all]').click()
+  await dialog.waitFor({ state: 'detached', timeout: opts?.timeout ?? 5_000 })
+
+  return true
+}
+
 /**
  * Drive the PK-based supervisor login FORM end-to-end (the faithful path that
  * exercises the real supervisor plugin + registration): navigate to the
@@ -185,20 +254,40 @@ export const loginViaSupervisorForm = async (
 ): Promise<void> => {
   const path = opts.path ?? DEFAULT_SUPERVISOR_PATH
   const timeout = opts.timeout ?? 60_000
-  await page.goto(new URL(path, opts.baseUrl).toString())
+  await page.goto(new URL(path, opts.baseUrl).toString(), {
+    waitUntil: opts.waitUntil ?? 'domcontentloaded', timeout
+  })
+
+  // Wait for the app to MOUNT before deciding whether there is a dialog to answer. `domcontentloaded`
+  // returns while the SPA is still booting, and on a dev server that boot is occasionally tens of
+  // seconds — so a short consent probe reports "no dialog", the dialog then mounts over the form,
+  // and the fill below waits out its own timeout on a field that is present but covered. Either
+  // marker proves the app is up: the dialog, or the form itself when consent was already given.
+  await page.locator('[data-consent-dialog], [data-testid="supervisor-user-id"]')
+    .first().waitFor({ state: 'visible', timeout })
 
-  await page.getByTestId('supervisor-user-id').fill(opts.userId)
-  await page.getByTestId('supervisor-pk').fill(opts.pk)
+  if (opts.consent !== 'ignore') await acceptConsent(page, { timeout })
+
+  // The form renders only AFTER the dialog is dismissed, so these carry the caller's budget rather
+  // than playwright's 30s default — the whole point of accepting an explicit `timeout` here.
+  await page.getByTestId('supervisor-user-id').fill(opts.userId, { timeout })
+  await page.getByTestId('supervisor-pk').fill(opts.pk, { timeout })
 
   if (opts.screenshotDir != null) {
     await saveScreenshot(page, opts.screenshotDir, 'supervisor-login-form')
   }
 
-  await page.getByTestId('supervisor-submit').click()
+  await page.getByTestId('supervisor-submit').click({ timeout })
 
   if (opts.expectPath != null) {
     await page.waitForURL(url => url.toString().includes(opts.expectPath!), { timeout })
   } else {
     await page.waitForURL(url => !url.pathname.startsWith(path), { timeout })
   }
+
+  // Carries the CALLER's own budget rather than the helper's smaller internal default — a slow
+  // cold environment (vite re-optimizing, a stage pod still warming) can easily spend most of a
+  // short fixed timeout just getting here, leaving too little for the two extra POSTs (terms, then
+  // items) a Terms-mode step now makes.
+  if (opts.marketingConsent !== 'ignore') await answerMarketingConsent(page, { accept: 'all', timeout })
 }