@qaguardian/playwright-score 0.1.14 → 0.3.0

package/METHODOLOGY.md

@@ -11,14 +11,11 @@ Any change to formulas, weights, SLOC definition, caps, or constants requires a
 
 ---
 
-## Profiles
+## Profile
 
-| Profile | Purpose |
-|---|---|
-| `standard` | Community Playwright best practices (`eslint-plugin-playwright`) + suite metrics |
-| `guardian` | `standard` + QA Guardian house conventions (optional; clearly labeled) |
-
-House rules are **not** claimed to be official Playwright doctrine.
+`standard` (the only profile): community Playwright best practices
+(`eslint-plugin-playwright`) plus suite-level metrics (locator ratio,
+assertion-delegation tracing, Page Object Model import resolution).
 
 ---
 
@@ -34,8 +31,6 @@ House rules are **not** claimed to be official Playwright doctrine.
 
 ## Dimension weights
 
-### `standard`
-
 | Dimension | Weight |
 |---|---|
 | playwrightHygiene | 40 |
@@ -43,16 +38,6 @@ House rules are **not** claimed to be official Playwright doctrine.
 | locators | 20 |
 | structure | 15 |
 
-### `guardian`
-
-| Dimension | Weight |
-|---|---|
-| playwrightHygiene | 30 |
-| assertions | 15 |
-| locators | 15 |
-| structure | 15 |
-| guardianConventions | 25 |
-
 ---
 
 ## Locators dimension (ratio)
@@ -88,7 +73,7 @@ Used for penalty density. JSDoc / decorative comments do not inflate slots.
 
 ## Penalty dimensions
 
-Applies to: `playwrightHygiene`, `assertions`, `structure`, `guardianConventions`.
+Applies to: `playwrightHygiene`, `assertions`, `structure`.
 
 ### Constants (frozen sqs-v1)
 
@@ -159,11 +144,13 @@ These examples feel fair: tiny single error stays high; multi-error drops materi
 
 ## Default thresholds
 
-| Context | Profile | Threshold |
-|---|---|---|
-| CLI default | standard | 80 |
-| QAG dogfood (warn) | guardian | 75 → 80 |
-| QAG gate (later) | guardian | 80 |
+| Context | Threshold |
+|---|---|
+| CLI default | 80 |
+
+QA Guardian's own internal codegen pipeline (`playwright_runner`) layers a
+private house-rules gate on top of `standard` — see the README's
+"QA Guardian integration" section. That layer isn't part of this package.
 
 ---
 
@@ -174,5 +161,14 @@ See package rule docs / source `profiles.ts`. High level:
 - **playwrightHygiene:** waits, force, networkidle, missing await, handles, conditionals  
 - **assertions:** expect-expect, empty tests, web-first preference  
 - **locators:** ratio metric only (for score); raw-locator ESLint in findings  
-- **structure:** focused/skipped, oversized file, describe shape  
-- **guardianConventions:** load-state ban, Date.now ban, secrets, test.step, one-describe-one-test, etc.  
+- **structure:** focused/skipped, oversized file, describe shape
+
+### Active rule set (frozen)
+
+The exact ESLint rules that produce sqs-v1 findings are enabled explicitly
+in `eslint-runner.ts` with fixed severities — the score never inherits
+eslint-plugin-playwright's `recommended` set at install time, so identical
+code scores identically regardless of which plugin version npm resolves.
+(Versions ≤0.2.0 intended to inherit `recommended` but a config-shape bug
+dropped it entirely; 0.3.0 froze the intended set explicitly. See
+CHANGELOG.)  

package/README.md

@@ -9,14 +9,51 @@
 **Website:** [qaguardian.com/open-source/playwright-score](https://qaguardian.com/open-source/playwright-score)  
 **Built by:** [QA Guardian](https://qaguardian.com) — managed Playwright E2E (AI drafts, engineers verify, you own the code)
 
-Lint + score Playwright tests with:
-
-- **`standard`** — community best practices via [`eslint-plugin-playwright`](https://github.com/playwright-community/eslint-plugin-playwright) + suite metrics  
-- **`guardian`** — optional house conventions (QA Guardian codegen gate); not official Playwright doctrine  
+Lint + score Playwright tests against community best practices via
+[`eslint-plugin-playwright`](https://github.com/playwright-community/eslint-plugin-playwright)
+plus suite-level metrics (locator ratio, assertion-delegation tracing,
+Page Object Model import resolution, ...).
 
 The score never calls an LLM. AI may *generate* or *repair* code using findings; **rules grade code**.
 
-See [METHODOLOGY.md](./METHODOLOGY.md) for the frozen formula, [VALIDATION.md](./VALIDATION.md) for real-world results against public repos (cal.com, Grafana, Mattermost, ...) and a re-runnable script to reproduce them, or the full product write-up on the [landing page](https://qaguardian.com/open-source/playwright-score).
+## Real-world results
+
+17 public Playwright suites, scored with the published package against each
+project's actual source — chosen to include both well-known,
+heavily-engineered platforms and smaller, less mature projects. Not curated
+to look good: 3 of 17 fail the default threshold, for real, verifiable
+reasons (see [VALIDATION.md](./VALIDATION.md)).
+
+**17 suites · 1,228 files · 6,037 tests · 14/17 passed (80% threshold)**
+
+| Repo (source scanned) | Score | Grade | Result |
+|---|---:|:-:|:-:|
+| [Playwright (own TodoMVC example)](https://github.com/microsoft/playwright/tree/main/examples/todomvc) | 98/100 | A | PASS |
+| [Supabase](https://github.com/supabase/supabase/tree/master/e2e) | 97/100 | A | PASS |
+| [Documenso](https://github.com/documenso/documenso/tree/main/packages/app-tests) | 96/100 | A | PASS |
+| [Storybook](https://github.com/storybookjs/storybook/tree/next/code/e2e-internal) | 96/100 | A | PASS |
+| [freeCodeCamp](https://github.com/freeCodeCamp/freeCodeCamp/tree/main/e2e) | 96/100 | A | PASS |
+| [n8n](https://github.com/n8n-io/n8n/tree/master/packages/testing/playwright) | 95/100 | A | PASS |
+| [dub](https://github.com/dubinc/dub/tree/main/apps/web/playwright) | 95/100 | A | PASS |
+| [novu](https://github.com/novuhq/novu/tree/next/apps/dashboard/tests) | 93/100 | A | PASS |
+| [Grafana](https://github.com/grafana/grafana/tree/main/e2e-playwright) | 91/100 | A | PASS |
+| [PostHog](https://github.com/PostHog/posthog/tree/master/playwright) | 90/100 | A | PASS |
+| [sencho](https://github.com/Studio-Saelix/sencho/tree/main/e2e) | 90/100 | A | PASS |
+| [Mattermost](https://github.com/mattermost/mattermost/tree/master/e2e-tests/playwright) | 89/100 | B | PASS |
+| [Immich](https://github.com/immich-app/immich/tree/main/e2e/src/specs) | 89/100 | B | PASS |
+| [cal.com](https://github.com/calcom/cal.com/tree/main/apps/web/playwright) | 84/100 | B | PASS |
+| [livecodes](https://github.com/live-codes/livecodes/tree/develop/e2e) | 78/100 | C | FAIL |
+| [openplayerjs](https://github.com/openplayerjs/openplayerjs/tree/master/e2e) | 77/100 | C | FAIL |
+| [TheCyberHub](https://github.com/th3cyb3rhub/TheCyberHub/tree/dev/e2e) | 68/100 | D | FAIL |
+
+Repo names link to the exact source scanned. Full methodology, findings
+breakdown, and `scripts/validate-corpus.sh` to reproduce every number here
+yourself live in [VALIDATION.md](./VALIDATION.md). A self-contained visual
+report of an earlier five-suite audit lives at
+[`docs/scorecard.html`](./docs/scorecard.html) — host it wherever
+(GitHub Pages, qaguardian.com, ...).
+
+See [METHODOLOGY.md](./METHODOLOGY.md) for the frozen formula, or the full product write-up on the [landing page](https://qaguardian.com/open-source/playwright-score).
 
 ## Install
 
@@ -33,12 +70,12 @@ Package: [@qaguardian/playwright-score](https://www.npmjs.com/package/@qaguardia
 npx -p @qaguardian/playwright-score playwright-score ./tests --profile standard --threshold 80
 
 # After local install
-npx playwright-score ./flow.spec.ts --profile guardian --format json --out report.json
+npx playwright-score ./flow.spec.ts --format json --out report.json
 ```
 
 | Flag | Description |
 |---|---|
-| `--profile standard\|guardian` | Scoring profile (default `standard`) |
+| `--profile standard` | Scoring profile (default, and only, profile) |
 | `--threshold <n>` | Pass bar 0–100 |
 | `--format text\|json\|markdown\|sarif` | Output format |
 | `--out <file>` | Write report to file |
@@ -69,16 +106,15 @@ keep a sticky PR comment with the full findings up to date:
 - uses: qa-guardian/playwright-score@v1
   with:
     paths: tests e2e
-    profile: standard      # or guardian
-    # threshold: 80        # defaults to the profile's default
+    # threshold: 80        # defaults to 80
     mode: gate              # gate: fail CI below threshold · warn: report only
 ```
 
 | Input | Description | Default |
 |---|---|---|
 | `paths` | Space-separated paths/globs to score | `tests` |
-| `profile` | `standard` \| `guardian` | `standard` |
-| `threshold` | Pass bar 0–100 | profile default (80 / 75) |
+| `profile` | `standard` (default, and only, profile) | `standard` |
+| `threshold` | Pass bar 0–100 | `80` |
 | `mode` | `gate` (fail CI below threshold) \| `warn` (report only) | `gate` |
 | `comment` | Post/update a sticky PR comment | `true` |
 | `version` | `@qaguardian/playwright-score` version to run | `latest` |
@@ -97,13 +133,17 @@ section above — same score, same exit codes:
 
 ## QA Guardian integration
 
-When used from `playwright_runner`, set:
+QA Guardian's own codegen pipeline (`playwright_runner`) dogfoods this
+package for the `standard` profile, layering its own private house-rules
+gate on top internally — that layer isn't part of this package (it's
+product-specific, e.g. "timeouts must be exactly 2000 or 20000ms", not
+Playwright best practice) and isn't published here. `playwright_runner`
+sets:
 
 | Env | Values | Default |
 |---|---|---|
 | `SPEC_SCORE_MODE` | `off` \| `warn` \| `gate` | `warn` |
-| `SPEC_SCORE_PROFILE` | `standard` \| `guardian` | `guardian` |
-| `SPEC_SCORE_THRESHOLD` | `0`–`100` | `75` (guardian) / `80` (standard) |
+| `SPEC_SCORE_THRESHOLD` | `0`–`100` | `80` |
 
 - **`warn`**: log score; never fail the run; findings still inject into heal/generate repair prompts  
 - **`gate`**: fail the run when score &lt; threshold  
@@ -114,21 +154,7 @@ When used from `playwright_runner`, set:
 # Local from monorepo
 cd playwright-score && npm run build
 cd ../playwright_runner && npm install
-SPEC_SCORE_MODE=warn SPEC_SCORE_PROFILE=guardian node ...
-```
-
-## Profiles
-
-| Profile | Use when |
-|---|---|
-| `standard` | Any Playwright repo — best practices + locator mix + empty-expect detection |
-| `guardian` | QA Guardian (or similar) codegen quality gate |
-
-Disable a guardian secrets false positive:
-
-```ts
-// spec-score-disable-next-line guardian/no-hardcoded-secrets
-const password = 'intentional-fixture-value-xyz';
+SPEC_SCORE_MODE=warn node ...
 ```
 
 ## Development

package/dist/cli.js

@@ -18,8 +18,8 @@ Usage:
   npx playwright-score <paths...> [options]
 
 Options:
-  --profile <standard|guardian>   Scoring profile (default: standard)
-  --threshold <n>                 Pass threshold 0-100 (default: 80 standard / 75 guardian)
+  --profile <standard>            Scoring profile (default, and only: standard)
+  --threshold <n>                 Pass threshold 0-100 (default: 80)
   --format <text|json|markdown|sarif>  Output format (default: text)
   --out <file>                    Write report to file
   --version                       Print version
@@ -70,12 +70,18 @@ async function main() {
     for (let i = 0; i < args.length; i++) {
         const a = args[i];
         if (a === '--profile') {
-            profile = args[++i];
-            if (profile !== 'standard' && profile !== 'guardian') {
-                console.error(`Invalid profile: ${profile}`);
+            const p = args[++i];
+            if (p === 'guardian') {
+                console.error('Profile "guardian" is no longer public — it was QA Guardian\'s internal house-rules layer, never official Playwright doctrine, and doesn\'t belong in a general-purpose tool. See CHANGELOG.md. Use --profile standard.');
                 process.exitCode = 2;
                 return;
             }
+            if (p !== 'standard') {
+                console.error(`Invalid profile: ${p}`);
+                process.exitCode = 2;
+                return;
+            }
+            profile = p;
         }
         else if (a === '--threshold') {
             threshold = Number(args[++i]);

package/dist/eslint-runner.js

@@ -2,12 +2,9 @@ import path from 'node:path';
 import { ESLint } from 'eslint';
 import { commonAncestorDir } from './fs-util.js';
 import playwright from 'eslint-plugin-playwright';
-import { guardianPlugin, guardianRuleConfigs, } from './rules/guardian-plugin.js';
 import { basePlugin } from './rules/base-plugin.js';
 import { mapRule } from './profiles.js';
-function buildConfig(profile, assertFunctionNames) {
-    const playwrightRecommended = playwright.configs?.['flat/recommended'] ??
-        playwright.configs?.recommended;
+function buildConfig(assertFunctionNames) {
     const base = [
         {
             files: ['**/*.{ts,tsx,js,jsx,mjs,cjs}'],
@@ -19,7 +16,6 @@ function buildConfig(profile, assertFunctionNames) {
             plugins: {
                 playwright,
                 pwscore: basePlugin,
-                ...(profile === 'guardian' ? { guardian: guardianPlugin } : {}),
             },
             rules: {
                 // Ensure key hygiene rules even if recommended set differs by
@@ -91,26 +87,34 @@ function buildConfig(profile, assertFunctionNames) {
                 'playwright/prefer-native-locators': 'warn',
                 // Matches eslint-plugin-playwright's own recommended severity.
                 'playwright/prefer-web-first-assertions': 'error',
-                ...(profile === 'guardian' ? { ...guardianRuleConfigs } : {}),
+                // The rules below complete the sqs-v1 rule set from
+                // profiles.ts's ESLINT_RULE_MAP. Earlier versions (<=0.2.0)
+                // expected them to arrive via eslint-plugin-playwright's
+                // flat/recommended config, but the spread only handled an array
+                // shape while the plugin exports a single config object — so the
+                // entire recommended set was silently dropped and these rules
+                // never ran (METHODOLOGY.md's hygiene dimension lists
+                // "conditionals" and "handles", yet neither could ever fire).
+                // They are enabled explicitly and frozen here on purpose:
+                // eslint-plugin-playwright is a ^range dependency, and inheriting
+                // whatever its recommended set says at install time would make
+                // identical code score differently across installs. Severities
+                // mirror upstream flat/recommended as of eslint-plugin-playwright
+                // 2.x. require-top-level-describe stays disabled deliberately —
+                // it is stylistic, not in upstream recommended, and would
+                // penalize idiomatic describe-less suites.
+                'playwright/no-conditional-in-test': 'warn',
+                'playwright/no-conditional-expect': 'warn',
+                'playwright/no-element-handle': 'warn',
+                'playwright/no-eval': 'warn',
+                'playwright/no-page-pause': 'warn',
+                'playwright/no-useless-await': 'warn',
+                'playwright/valid-expect': 'error',
+                'playwright/no-standalone-expect': 'error',
+                'playwright/max-nested-describe': 'warn',
             },
         },
     ];
-    // Prefer spreading official recommended flat config when available
-    if (Array.isArray(playwrightRecommended)) {
-        const configs = playwrightRecommended;
-        if (profile === 'guardian') {
-            return [
-                ...configs,
-                {
-                    plugins: { guardian: guardianPlugin },
-                    rules: { ...guardianRuleConfigs },
-                },
-                // our severity tweaks
-                base[0],
-            ];
-        }
-        return [...configs, base[0]];
-    }
     return base;
 }
 function toSeverity(eslintSeverity, override) {
@@ -138,7 +142,7 @@ export async function runEslint(options) {
     const cwd = options.files.length > 0
         ? commonAncestorDir(options.files)
         : (options.cwd ?? process.cwd());
-    const overrideConfig = buildConfig(options.profile, options.assertFunctionNames ?? []);
+    const overrideConfig = buildConfig(options.assertFunctionNames ?? []);
     // Try to attach typescript-eslint parser for .ts files
     try {
         const tsParser = await import('@typescript-eslint/parser');

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import type { ScoreOptions, ScoreResult } from './types.js';
 export type { ScoreResult, ScoreOptions, Finding, ProfileName } from './types.js';
-export { computeScore, SQS_V1, locatorsScore, gradeFromScore } from './score-engine.js';
+export { computeScore, SQS_V1, locatorsScore, gradeFromScore, penaltyDimensionScore, applyPerRuleCap, } from './score-engine.js';
 export { countSloc } from './sloc.js';
 export { countLocators, analyzeSource } from './metrics.js';
 export { formatJson } from './formatters/json.js';

package/dist/index.js

@@ -7,7 +7,7 @@ import { collectLocallyImportedFiles } from './import-graph.js';
 import { analyzeSource, countLocators, findLocalAssertionHelperNames, looksLikeNonPlaywrightTest, } from './metrics.js';
 import { DEFAULT_THRESHOLDS } from './profiles.js';
 import { computeScore } from './score-engine.js';
-export { computeScore, SQS_V1, locatorsScore, gradeFromScore } from './score-engine.js';
+export { computeScore, SQS_V1, locatorsScore, gradeFromScore, penaltyDimensionScore, applyPerRuleCap, } from './score-engine.js';
 export { countSloc } from './sloc.js';
 export { countLocators, analyzeSource } from './metrics.js';
 export { formatJson } from './formatters/json.js';
@@ -132,7 +132,6 @@ function hardFail(profile, threshold, findings, extra = {}, skippedFiles) {
             assertions: 0,
             locators: 0,
             structure: 0,
-            ...(profile === 'guardian' ? { guardianConventions: 0 } : {}),
         },
         findings,
         ...(skippedFiles && skippedFiles.length > 0 ? { skippedFiles } : {}),
@@ -242,7 +241,6 @@ export async function scorePaths(options) {
         totalTests += m.tests;
         native += m.locators.native;
         raw += m.locators.raw;
-        // metrics/no-empty-test duplicates guardian/require-expect under guardian — keep both mild
         metricFindings.push(...m.findings);
     }
     for (const [file, source] of importedFiles) {
@@ -250,7 +248,6 @@ export async function scorePaths(options) {
         native += counts.native;
         raw += counts.raw;
     }
-    // Dedupe empty-test style: if guardian require-expect already fired, still ok
     const findings = [...eslintFindings, ...metricFindings];
     const parseErrors = findings.filter((f) => f.rule === 'playwright-score/parse-error');
     if (parseErrors.length > 0) {

package/dist/profiles.js

@@ -5,17 +5,9 @@ export const PROFILE_WEIGHTS = {
         locators: 20,
         structure: 15,
     },
-    guardian: {
-        playwrightHygiene: 30,
-        assertions: 15,
-        locators: 15,
-        structure: 15,
-        guardianConventions: 25,
-    },
 };
 export const DEFAULT_THRESHOLDS = {
     standard: 80,
-    guardian: 75,
 };
 /**
  * ESLint rule → dimension map (plugin rule ids without prefix handled in runner).
@@ -80,26 +72,6 @@ export const ESLINT_RULE_MAP = {
         dimension: 'structure',
         severityOverride: 'warning',
     },
-    // Guardian custom rules
-    'guardian/no-wait-for-load-state': { dimension: 'guardianConventions' },
-    'guardian/no-date-now-id': { dimension: 'guardianConventions' },
-    'guardian/require-expect': { dimension: 'guardianConventions' },
-    'guardian/no-hardcoded-secrets': {
-        dimension: 'guardianConventions',
-        severityOverride: 'warning',
-    },
-    'guardian/require-test-step': {
-        dimension: 'guardianConventions',
-        severityOverride: 'warning',
-    },
-    'guardian/one-describe-one-test': {
-        dimension: 'guardianConventions',
-        severityOverride: 'warning',
-    },
-    'guardian/no-generic-long-timeout': {
-        dimension: 'guardianConventions',
-        severityOverride: 'warning',
-    },
     // Metrics injected as synthetic findings
     'metrics/oversized-file': {
         dimension: 'structure',
@@ -109,9 +81,6 @@ export const ESLINT_RULE_MAP = {
 export function mapRule(ruleId) {
     if (ESLINT_RULE_MAP[ruleId])
         return ESLINT_RULE_MAP[ruleId];
-    if (ruleId.startsWith('guardian/')) {
-        return { dimension: 'guardianConventions', severityOverride: 'warning' };
-    }
     if (ruleId.startsWith('playwright/')) {
         return { dimension: 'playwrightHygiene', severityOverride: 'warning' };
     }

package/dist/rules/base-plugin.d.ts

@@ -1,6 +1,6 @@
 /**
- * Rules active for both `standard` and `guardian` profiles — corrections
- * to upstream eslint-plugin-playwright behavior, not house style.
+ * Corrections to upstream eslint-plugin-playwright behavior, not house
+ * style — always active.
  */
 import type { Rule } from 'eslint';
 export declare const basePlugin: {

package/dist/score-engine.js

@@ -10,12 +10,7 @@ export const SQS_V1 = {
     MIN_SLOTS: 4,
     K: 0.4,
 };
-const PENALTY_DIMENSIONS = [
-    'playwrightHygiene',
-    'assertions',
-    'structure',
-    'guardianConventions',
-];
+const PENALTY_DIMENSIONS = ['playwrightHygiene', 'assertions', 'structure'];
 export function gradeFromScore(score) {
     if (score >= 90)
         return 'A';
@@ -69,16 +64,18 @@ export function penaltyDimensionScore(findings, dimension, sloc) {
     return Math.min(100, Math.max(0, score));
 }
 export function computeScore(input) {
-    const weights = PROFILE_WEIGHTS[input.profile];
+    // Falls back to `standard`'s weights for any unrecognized profile string
+    // rather than throwing — a defensive guard against exactly the failure
+    // mode a profile removal creates: a caller pinned to an old contract
+    // (e.g. `profile: 'guardian'`, removed in 0.2.0) degrades to a working
+    // score instead of a hard crash.
+    const weights = PROFILE_WEIGHTS[input.profile] ?? PROFILE_WEIGHTS.standard;
     const dims = {
         playwrightHygiene: penaltyDimensionScore(input.findings, 'playwrightHygiene', input.sloc),
         assertions: penaltyDimensionScore(input.findings, 'assertions', input.sloc),
         locators: locatorsScore(input.nativeLocators, input.rawLocators),
         structure: penaltyDimensionScore(input.findings, 'structure', input.sloc),
     };
-    if (input.profile === 'guardian') {
-        dims.guardianConventions = penaltyDimensionScore(input.findings, 'guardianConventions', input.sloc);
-    }
     let score = 0;
     for (const [dim, weight] of Object.entries(weights)) {
         const key = dim;

package/dist/types.d.ts

@@ -1,8 +1,8 @@
 export type ScoreVersion = 'sqs-v1';
-export type ProfileName = 'standard' | 'guardian';
+export type ProfileName = 'standard';
 export type Grade = 'A' | 'B' | 'C' | 'D' | 'F';
 export type Severity = 'error' | 'warning' | 'info';
-export type DimensionName = 'playwrightHygiene' | 'assertions' | 'locators' | 'structure' | 'guardianConventions';
+export type DimensionName = 'playwrightHygiene' | 'assertions' | 'locators' | 'structure';
 export interface Finding {
     rule: string;
     severity: Severity;
@@ -19,7 +19,6 @@ export interface ScoreDimensions {
     assertions: number;
     locators: number;
     structure: number;
-    guardianConventions?: number;
 }
 export interface ScoreSummary {
     files: number;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@qaguardian/playwright-score",
-  "version": "0.1.14",
-  "description": "Deterministic, AI-free Playwright spec quality score (sqs-v1). Lint + score with standard and guardian profiles.",
+  "version": "0.3.0",
+  "description": "Deterministic, AI-free Playwright spec quality score (sqs-v1).",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -26,7 +26,6 @@
     "build:tests": "tsc -p tsconfig.tests.json",
     "test": "npm run build && npm run build:tests && node --test dist-tests/tests/*.js",
     "score": "npm run build && node bin/playwright-score.js",
-    "dogfood": "npm run build && bash scripts/dogfood.sh",
     "prepublishOnly": "npm run build"
   },
   "keywords": [

package/dist/rules/guardian-plugin.d.ts

@@ -1,29 +0,0 @@
-/**
- * Guardian house-style ESLint rules for profile=guardian.
- * Embedded in playwright-score — not claimed as official Playwright doctrine.
- */
-import type { Rule } from 'eslint';
-export declare const guardianPlugin: {
-    meta: {
-        name: string;
-        version: string;
-    };
-    rules: {
-        'no-wait-for-load-state': Rule.RuleModule;
-        'no-date-now-id': Rule.RuleModule;
-        'no-hardcoded-secrets': Rule.RuleModule;
-        'no-generic-long-timeout': Rule.RuleModule;
-        'one-describe-one-test': Rule.RuleModule;
-        'require-test-step': Rule.RuleModule;
-        'require-expect': Rule.RuleModule;
-    };
-};
-export declare const guardianRuleConfigs: {
-    readonly 'guardian/no-wait-for-load-state': "error";
-    readonly 'guardian/no-date-now-id': "error";
-    readonly 'guardian/no-hardcoded-secrets': "warn";
-    readonly 'guardian/no-generic-long-timeout': "warn";
-    readonly 'guardian/one-describe-one-test': "warn";
-    readonly 'guardian/require-test-step': "warn";
-    readonly 'guardian/require-expect': "error";
-};

package/dist/rules/guardian-plugin.js

@@ -1,386 +0,0 @@
-const DUMMY_SECRETS = new Set([
-    'password',
-    'password123',
-    'test',
-    'test123',
-    'secret',
-    'changeme',
-    'admin',
-    'admin123',
-    'pass',
-    'pwd',
-    '123456',
-    'qwerty',
-    '',
-].map((s) => s.toLowerCase()));
-// Playwright's actual modifier API is test.fixme() — not test.fix().
-const TEST_MODIFIERS = new Set(['only', 'skip', 'fixme', 'slow']);
-const DESCRIBE_MODIFIERS = new Set(['serial', 'parallel', 'only', 'fixme']);
-/** Matches a bare test(...) call. */
-function isBareTestCall(node) {
-    return node.callee?.type === 'Identifier' && node.callee.name === 'test';
-}
-/** Matches test.describe(...) and test.describe.serial/parallel/only/fixme(...). */
-function isDescribeCall(node) {
-    const callee = node.callee;
-    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
-        return false;
-    const obj = callee.object;
-    const prop = callee.property;
-    if (!obj || !prop || prop.type !== 'Identifier')
-        return false;
-    // test.describe(...)
-    if (obj.type === 'Identifier' && obj.name === 'test' && prop.name === 'describe') {
-        return true;
-    }
-    // test.describe.serial/parallel/only/fixme(...)
-    if (obj.type === 'MemberExpression' &&
-        !obj.computed &&
-        obj.object?.type === 'Identifier' &&
-        obj.object.name === 'test' &&
-        obj.property?.type === 'Identifier' &&
-        obj.property.name === 'describe' &&
-        DESCRIBE_MODIFIERS.has(prop.name ?? '')) {
-        return true;
-    }
-    return false;
-}
-/** Matches specifically test.describe.serial(...). */
-function isSerialDescribeCall(node) {
-    const callee = node.callee;
-    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
-        return false;
-    const obj = callee.object;
-    const prop = callee.property;
-    return (obj?.type === 'MemberExpression' &&
-        !obj.computed &&
-        obj.object?.type === 'Identifier' &&
-        obj.object.name === 'test' &&
-        obj.property?.type === 'Identifier' &&
-        obj.property.name === 'describe' &&
-        prop?.type === 'Identifier' &&
-        prop.name === 'serial');
-}
-/** Matches test.only/skip/fixme/slow(...) (a modifier form of a real test declaration). */
-function isTestModifierCall(node) {
-    const callee = node.callee;
-    if (!callee || callee.type !== 'MemberExpression' || callee.computed)
-        return false;
-    const obj = callee.object;
-    const prop = callee.property;
-    return (obj?.type === 'Identifier' &&
-        obj.name === 'test' &&
-        prop?.type === 'Identifier' &&
-        TEST_MODIFIERS.has(prop.name ?? ''));
-}
-/** Matches test.step(...). */
-function isTestStepCall(node) {
-    const callee = node.callee;
-    return (callee?.type === 'MemberExpression' &&
-        !callee.computed &&
-        callee.object?.type === 'Identifier' &&
-        callee.object.name === 'test' &&
-        callee.property?.type === 'Identifier' &&
-        callee.property.name === 'step');
-}
-function hasDisableNextLine(sourceCode, line, ruleId) {
-    const lines = sourceCode.getText().split(/\r?\n/);
-    if (line < 2)
-        return false;
-    const prev = lines[line - 2] ?? '';
-    return (prev.includes('spec-score-disable-next-line') &&
-        (prev.includes(ruleId) || prev.includes('guardian/')));
-}
-const noWaitForLoadState = {
-    meta: {
-        type: 'problem',
-        docs: { description: 'Disallow page.waitForLoadState()' },
-        messages: {
-            banned: 'waitForLoadState is banned under guardian profile. Use web-first assertions.',
-        },
-        schema: [],
-    },
-    create(context) {
-        return {
-            CallExpression(node) {
-                const callee = node.callee;
-                if (callee.type === 'MemberExpression' &&
-                    !callee.computed &&
-                    callee.property.type === 'Identifier' &&
-                    callee.property.name === 'waitForLoadState') {
-                    context.report({ node, messageId: 'banned' });
-                }
-            },
-        };
-    },
-};
-const noDateNowId = {
-    meta: {
-        type: 'problem',
-        docs: { description: 'Disallow Date.now() for unique ids' },
-        messages: {
-            banned: 'Date.now() is banned for unique ids. Use crypto.randomUUID().split("-")[0].',
-        },
-        schema: [],
-    },
-    create(context) {
-        return {
-            CallExpression(node) {
-                const callee = node.callee;
-                if (callee.type === 'MemberExpression' &&
-                    !callee.computed &&
-                    callee.object.type === 'Identifier' &&
-                    callee.object.name === 'Date' &&
-                    callee.property.type === 'Identifier' &&
-                    callee.property.name === 'now') {
-                    context.report({ node, messageId: 'banned' });
-                }
-            },
-        };
-    },
-};
-// Whole words only (after splitting camelCase/snake_case/kebab-case), not a
-// bare substring match — a substring match on "auth" flags "authorName",
-// "isAuthenticated", every "Author"/"authenticate"/"authorize" field in a
-// typical app under test, which is a lot of unrelated real-world test data.
-const SENSITIVE_WORDS = new Set([
-    'password',
-    'passwd',
-    'secret',
-    'secrets',
-    'token',
-    'tokens',
-    'auth',
-    'authorization',
-    'credential',
-    'credentials',
-]);
-function splitIdentifierWords(identifier) {
-    return identifier
-        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
-        .replace(/[_-]+/g, ' ')
-        .split(/\s+/)
-        .filter(Boolean)
-        .map((w) => w.toLowerCase());
-}
-function looksLikeSensitiveKey(rawKey) {
-    const words = splitIdentifierWords(rawKey);
-    if (words.some((w) => SENSITIVE_WORDS.has(w)))
-        return true;
-    // apiKey / api_key / API-KEY — "key" alone is too generic (primaryKey,
-    // sortKey, ...) so only flag it directly adjacent to "api".
-    for (let i = 0; i < words.length - 1; i++) {
-        if (words[i] === 'api' && words[i + 1] === 'key')
-            return true;
-    }
-    return false;
-}
-const noHardcodedSecrets = {
-    meta: {
-        type: 'suggestion',
-        docs: { description: 'Flag likely hardcoded secrets (with allowlist)' },
-        messages: {
-            secret: 'Possible hardcoded secret value. Use env/fixtures or allowlist dummy data.',
-        },
-        schema: [],
-    },
-    create(context) {
-        const sourceCode = context.sourceCode ?? context.getSourceCode();
-        function check(node, rawKey) {
-            if (node.type !== 'Literal' || typeof node.value !== 'string')
-                return;
-            const value = String(node.value);
-            if (DUMMY_SECRETS.has(value.toLowerCase()))
-                return;
-            if (value.length < 6)
-                return;
-            if (!looksLikeSensitiveKey(rawKey ?? ''))
-                return;
-            const line = node.loc?.start.line ?? 1;
-            if (hasDisableNextLine(sourceCode, line, 'guardian/no-hardcoded-secrets'))
-                return;
-            context.report({ node: node, messageId: 'secret' });
-        }
-        return {
-            Property(node) {
-                if (node.key.type === 'Identifier') {
-                    check(node.value, node.key.name);
-                }
-                else if (node.key.type === 'Literal') {
-                    check(node.value, String(node.key.value));
-                }
-            },
-            VariableDeclarator(node) {
-                if (node.id.type === 'Identifier' && node.init) {
-                    check(node.init, node.id.name);
-                }
-            },
-        };
-    },
-};
-const noGenericLongTimeout = {
-    meta: {
-        type: 'suggestion',
-        docs: { description: 'Only allow timeout 2000 or 20000' },
-        messages: {
-            timeout: 'Avoid generic timeouts; allowed values under guardian: 2000 (audit) or 20000 (backend).',
-        },
-        schema: [],
-    },
-    create(context) {
-        const allowed = new Set([2000, 20000]);
-        return {
-            Property(node) {
-                if (node.key.type !== 'Identifier' ||
-                    node.key.name !== 'timeout' ||
-                    node.value.type !== 'Literal' ||
-                    typeof node.value.value !== 'number' ||
-                    allowed.has(node.value.value)) {
-                    return;
-                }
-                // Only flag timeout options passed inline to a call, e.g.
-                // locator.click({ timeout }), expect(x).toBeVisible({ timeout }),
-                // test('x', { timeout }, fn) — not unrelated business data that
-                // happens to have a field named "timeout" (session config, a
-                // fixture payload, a mocked API response body, ...).
-                const objectExpr = node.parent;
-                const call = objectExpr?.parent;
-                if (objectExpr?.type !== 'ObjectExpression' ||
-                    call?.type !== 'CallExpression' ||
-                    !call.arguments?.includes(objectExpr)) {
-                    return;
-                }
-                context.report({ node, messageId: 'timeout' });
-            },
-        };
-    },
-};
-const oneDescribeOneTest = {
-    meta: {
-        type: 'suggestion',
-        docs: { description: 'Prefer one test.describe and one test per file' },
-        messages: {
-            describes: 'Guardian profile prefers exactly one test.describe() per file (found {{count}}).',
-            tests: 'Guardian profile prefers exactly one test() per file (found {{count}}).',
-        },
-        schema: [],
-    },
-    create(context) {
-        let describes = 0;
-        let tests = 0;
-        let usesSerialDescribe = false;
-        return {
-            CallExpression(node) {
-                if (isDescribeCall(node)) {
-                    describes++;
-                    if (isSerialDescribeCall(node))
-                        usesSerialDescribe = true;
-                }
-                if (isBareTestCall(node) || isTestModifierCall(node))
-                    tests++;
-            },
-            'Program:exit'() {
-                if (describes > 1) {
-                    context.report({
-                        loc: { line: 1, column: 0 },
-                        messageId: 'describes',
-                        data: { count: String(describes) },
-                    });
-                }
-                // test.describe.serial(...) is Playwright's documented mechanism
-                // for one user journey split into multiple ordered, dependent
-                // test() calls — the same "one scenario per file" intent as this
-                // rule, expressed a different way. Don't nag a pattern the
-                // framework itself recommends for exactly this case.
-                if (tests > 1 && !usesSerialDescribe) {
-                    context.report({
-                        loc: { line: 1, column: 0 },
-                        messageId: 'tests',
-                        data: { count: String(tests) },
-                    });
-                }
-            },
-        };
-    },
-};
-const requireTestStep = {
-    meta: {
-        type: 'suggestion',
-        docs: { description: 'Warn when file uses test() but no test.step()' },
-        messages: {
-            missing: 'Consider wrapping actions in test.step() for clearer structure.',
-        },
-        schema: [],
-    },
-    create(context) {
-        let hasTest = false;
-        let hasStep = false;
-        return {
-            CallExpression(node) {
-                if (isBareTestCall(node) || isTestModifierCall(node))
-                    hasTest = true;
-                if (isTestStepCall(node))
-                    hasStep = true;
-            },
-            'Program:exit'() {
-                if (hasTest && !hasStep) {
-                    context.report({ loc: { line: 1, column: 0 }, messageId: 'missing' });
-                }
-            },
-        };
-    },
-};
-const requireExpect = {
-    meta: {
-        type: 'problem',
-        docs: { description: 'Require expect() in files with test()' },
-        messages: {
-            missing: 'Guardian profile requires at least one expect() in the spec.',
-        },
-        schema: [],
-    },
-    create(context) {
-        let hasTest = false;
-        let hasExpect = false;
-        return {
-            CallExpression(node) {
-                if (isBareTestCall(node) || isTestModifierCall(node))
-                    hasTest = true;
-                if (node.callee?.type === 'Identifier' && node.callee.name === 'expect') {
-                    hasExpect = true;
-                }
-                if (node.callee?.type === 'MemberExpression' &&
-                    node.callee.object?.type === 'Identifier' &&
-                    node.callee.object.name === 'expect') {
-                    hasExpect = true;
-                }
-            },
-            'Program:exit'() {
-                if (hasTest && !hasExpect) {
-                    context.report({ loc: { line: 1, column: 0 }, messageId: 'missing' });
-                }
-            },
-        };
-    },
-};
-export const guardianPlugin = {
-    meta: { name: 'guardian', version: '0.1.0' },
-    rules: {
-        'no-wait-for-load-state': noWaitForLoadState,
-        'no-date-now-id': noDateNowId,
-        'no-hardcoded-secrets': noHardcodedSecrets,
-        'no-generic-long-timeout': noGenericLongTimeout,
-        'one-describe-one-test': oneDescribeOneTest,
-        'require-test-step': requireTestStep,
-        'require-expect': requireExpect,
-    },
-};
-export const guardianRuleConfigs = {
-    'guardian/no-wait-for-load-state': 'error',
-    'guardian/no-date-now-id': 'error',
-    'guardian/no-hardcoded-secrets': 'warn',
-    'guardian/no-generic-long-timeout': 'warn',
-    'guardian/one-describe-one-test': 'warn',
-    'guardian/require-test-step': 'warn',
-    'guardian/require-expect': 'error',
-};