@sdods/core 0.2.1 → 0.2.2

package/dist/analyze/index.d.ts

@@ -3,5 +3,6 @@ export { analyzeProject, buildChecklist, type AnalyzeOptions } from './analyze.j
 export { proposeProject, slugify, type ProposeOptions } from './propose.js';
 export { applyProposal, importPlaywrightSpecs, type ApplyOptions, type ApplyResult, } from './apply.js';
 export { computeCoverage, parseFeatures, pomRouteSteps, type CoverageOptions } from './coverage.js';
+export { detectModules, moduleOfFile, moduleOfPath, canonicalAlias, MODULE_ALIASES, SIGNAL_WEIGHTS, type ModuleSignal, type ModuleVote, type DetectedModule, type DetectModulesOptions, type DetectModulesResult, } from './modules.js';
 export * from './detectors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/analyze/index.js

@@ -3,5 +3,6 @@ export { analyzeProject, buildChecklist } from './analyze.js';
 export { proposeProject, slugify } from './propose.js';
 export { applyProposal, importPlaywrightSpecs, } from './apply.js';
 export { computeCoverage, parseFeatures, pomRouteSteps } from './coverage.js';
+export { detectModules, moduleOfFile, moduleOfPath, canonicalAlias, MODULE_ALIASES, SIGNAL_WEIGHTS, } from './modules.js';
 export * from './detectors.js';
 //# sourceMappingURL=index.js.map

package/dist/analyze/modules.d.ts

@@ -0,0 +1,74 @@
+import type { AnalysisReport, Evidence, Layer } from '@sdods/contracts';
+/**
+ * Module detection by signal fusion.
+ *
+ * Every detector casts weighted votes for "which module owns this route/endpoint"; the
+ * resolver keeps the strongest vote per target, then drops noise, merges aliases and splits
+ * oversized modules. Replaces the two independent first-URL-segment groupers that used to
+ * live in propose.ts and mcp/tools/analyze.ts.
+ *
+ * The ordering matters more than any individual rule. Measured against
+ * cypress-realworld-app (17 routes): first-URL-segment yields 14 groups, the source-file
+ * signal alone yields 8, and `backend/auth.ts` collapses /checkAuth + /login + /logout into
+ * one module without consulting the alias table at all.
+ */
+export type ModuleSignal = 'openapi-tag' | 'workspace' | 'framework-module' | 'domain-dir' | 'source-file' | 'har' | 'route-segment' | 'alias';
+export declare const SIGNAL_WEIGHTS: Record<ModuleSignal, number>;
+export interface ModuleVote {
+    /** the thing being assigned: a route or endpoint path */
+    target: string;
+    kind: 'route' | 'endpoint';
+    module: string;
+    weight: number;
+    signal: ModuleSignal;
+    layer: Layer;
+    evidence: Evidence;
+}
+export interface DetectedModule {
+    name: string;
+    layers: Layer[];
+    routes: string[];
+    endpoints: string[];
+    testingTypes: string[];
+    tags: string[];
+    /** mean weight of the winning votes; 0..1 */
+    confidence: number;
+    signals: ModuleSignal[];
+    evidence: Evidence[];
+    /** populated by the split pass; recorded in the report, not yet emitted to yaml */
+    children?: DetectedModule[];
+}
+export interface DetectModulesOptions {
+    /** a module with more targets than this splits into children (default 12) */
+    splitAfter?: number;
+    /** a module with this many targets or fewer merges into an alias sibling (default 1) */
+    mergeBelow?: number;
+    maxModules?: number;
+}
+export interface DetectModulesResult {
+    modules: DetectedModule[];
+    votes: ModuleVote[];
+    /** targets deliberately not turned into modules, with the reason */
+    ignored: Array<{
+        target: string;
+        reason: string;
+    }>;
+}
+/**
+ * Synonyms folded onto a canonical module name. Merges only; an alias never creates a module,
+ * which is why the weight is the lowest in the table.
+ */
+export declare const MODULE_ALIASES: Record<string, string[]>;
+export declare function canonicalAlias(name: string): string | undefined;
+/** Today's rule, kept: demoted to a weak signal, and reused as the sub-module split rule. */
+export declare function moduleOfPath(path: string): string;
+/**
+ * Module name from the file that defines a route. Returns undefined when the file names a role
+ * rather than a domain (`backend/app.ts`), so a weaker signal can take over.
+ *
+ * `backend/auth.ts` -> auth; `bankaccount-routes.ts` -> bankaccount;
+ * `TransactionsContainer.tsx` -> transactions; `backend/app.ts` -> undefined.
+ */
+export declare function moduleOfFile(file: string): string | undefined;
+export declare function detectModules(report: AnalysisReport, opts?: DetectModulesOptions): DetectModulesResult;
+//# sourceMappingURL=modules.d.ts.map

package/dist/analyze/modules.js

@@ -0,0 +1,353 @@
+import { slugify } from './propose.js';
+export const SIGNAL_WEIGHTS = {
+    'openapi-tag': 1.0,
+    workspace: 0.9,
+    'framework-module': 0.85,
+    'domain-dir': 0.8,
+    'source-file': 0.7,
+    har: 0.5,
+    'route-segment': 0.3,
+    alias: 0.2,
+};
+/** Path segments that never name a domain. */
+const RESERVED_SEGMENTS = new Set(['api', 'app', 'src', 'pages']);
+/** Basenames that name a file's role, not its domain. */
+const GENERIC_BASENAMES = new Set(['index', 'app', 'main', 'server', 'routes', 'route', 'router']);
+/** Directories that group by layer, not by domain. */
+const GENERIC_DIRS = new Set([
+    'src',
+    'backend',
+    'frontend',
+    'api',
+    'lib',
+    'app',
+    'pages',
+    'containers',
+    'views',
+    'components',
+    'routes',
+    'server',
+]);
+/** Directories that conventionally hold one subdirectory per domain. */
+const DOMAIN_DIR_RE = /(?:^|\/)(?:src\/)?(?:modules|features|domains|containers|views|pages|apps|services)\/([^/]+)\//;
+/** Route-param and route-group directories: `[id]`, `[...slug]`, `{id}`, `:id`, `(marketing)`. */
+const DYNAMIC_DIR_RE = /^(?:\[.*\]|\{.*\}|:.+|\(.*\))$/;
+/** Suffixes that describe a file's role and should be stripped before naming a module. */
+const ROLE_SUFFIX_RE = /[-_.]?(routes?|router|controller|container|service|module|handler|page|view|screen|api)$/i;
+/**
+ * Synonyms folded onto a canonical module name. Merges only; an alias never creates a module,
+ * which is why the weight is the lowest in the table.
+ */
+export const MODULE_ALIASES = {
+    auth: [
+        'login',
+        'signin',
+        'sign-in',
+        'logout',
+        'signout',
+        'sign-out',
+        'signup',
+        'sign-up',
+        'register',
+        'session',
+        'checkauth',
+        'check-auth',
+        'oauth',
+        'sso',
+        'identity',
+    ],
+    user: ['users', 'profile', 'profiles', 'me', 'account', 'accounts'],
+    admin: ['administration', 'backoffice', 'back-office'],
+    search: ['searches', 'query'],
+};
+const ALIAS_TO_CANONICAL = (() => {
+    const out = {};
+    for (const [canonical, names] of Object.entries(MODULE_ALIASES)) {
+        for (const n of names)
+            out[n] = canonical;
+    }
+    return out;
+})();
+export function canonicalAlias(name) {
+    return ALIAS_TO_CANONICAL[name];
+}
+/** Today's rule, kept: demoted to a weak signal, and reused as the sub-module split rule. */
+export function moduleOfPath(path) {
+    const first = path.split('/').filter(Boolean)[0];
+    if (!first || first.startsWith('{'))
+        return 'home';
+    const clean = first.replace(/[^a-zA-Z0-9]+/g, '-').toLowerCase();
+    return RESERVED_SEGMENTS.has(clean) ? 'core' : clean;
+}
+/**
+ * Module name from the file that defines a route. Returns undefined when the file names a role
+ * rather than a domain (`backend/app.ts`), so a weaker signal can take over.
+ *
+ * `backend/auth.ts` -> auth; `bankaccount-routes.ts` -> bankaccount;
+ * `TransactionsContainer.tsx` -> transactions; `backend/app.ts` -> undefined.
+ */
+export function moduleOfFile(file) {
+    const parts = file.replace(/\\/g, '/').split('/').filter(Boolean);
+    const base = (parts.pop() ?? '').replace(/\.[^.]+$/, '');
+    let name = base.replace(ROLE_SUFFIX_RE, '');
+    if (!name || GENERIC_BASENAMES.has(name.toLowerCase())) {
+        // File-router frameworks put the domain further up: `app/products/[id]/page.tsx` is the
+        // `products` module, not `id`. Walk past dynamic segments and route groups.
+        name = '';
+        while (parts.length) {
+            const dir = parts.pop();
+            if (DYNAMIC_DIR_RE.test(dir))
+                continue;
+            if (GENERIC_DIRS.has(dir.toLowerCase()))
+                return undefined;
+            name = dir;
+            break;
+        }
+        if (!name)
+            return undefined;
+    }
+    // split camelCase/PascalCase before slugify so TransactionsContainer -> transactions
+    const slug = slugify(name.replace(/([a-z0-9])([A-Z])/g, '$1-$2'));
+    if (!slug || slug === 'app' || GENERIC_DIRS.has(slug))
+        return undefined;
+    return slug;
+}
+/**
+ * Routes that carry no domain information and must not become modules.
+ *
+ * A path that is uninformative on its own is still fine when its defining file names a domain:
+ * `GET /{username}` in `backend/contact-routes.ts` is the `contact` module, and dropping it
+ * would lose a real module. So parameter-only and root routes are noise only when the file
+ * cannot name them either. Catch-all and optional-group routes are never valid test targets.
+ */
+function noiseReason(r) {
+    const p = r.path;
+    if (/^\/?\*/.test(p))
+        return 'catch-all route';
+    if (/\(.*\)\?/.test(p))
+        return 'optional-group route';
+    if (moduleOfFile(r.file))
+        return undefined;
+    const segs = p.split('/').filter(Boolean);
+    // a UI root path is a real, nameable screen (home); an API root carries nothing
+    if (segs.length === 0)
+        return r.kind === 'page' ? undefined : 'root route in a generic file';
+    if (segs.length === 1 && /^[{:]/.test(segs[0]))
+        return 'bare parameter route in a generic file';
+    return undefined;
+}
+function layerOf(r) {
+    return r.kind === 'api' ? 'api' : 'ui';
+}
+function longestWorkspaceMatch(file, workspaces) {
+    let best;
+    for (const w of workspaces) {
+        const prefix = w.replace(/\/?\*+$/, '').replace(/\/$/, '');
+        if (!prefix)
+            continue;
+        if (file === prefix || file.startsWith(`${prefix}/`)) {
+            if (!best || prefix.length > best.length)
+                best = prefix;
+        }
+    }
+    if (!best)
+        return undefined;
+    // the workspace dir itself is generic (packages/, apps/) - name the package under it
+    const rest = file.slice(best.length).split('/').filter(Boolean)[0];
+    return rest ? slugify(rest) : undefined;
+}
+export function detectModules(report, opts = {}) {
+    const splitAfter = opts.splitAfter ?? 12;
+    const mergeBelow = opts.mergeBelow ?? 1;
+    const maxModules = opts.maxModules ?? 30;
+    const votes = [];
+    const ignored = [];
+    const cast = (v) => {
+        if (v.module)
+            votes.push(v);
+    };
+    // S1 openapi-tag (1.0) - the authoritative API grouping when a spec exists
+    const tagged = new Set();
+    for (const spec of report.openapi) {
+        for (const e of spec.endpoints) {
+            if (!e.tag)
+                continue;
+            tagged.add(e.path);
+            cast({
+                target: e.path,
+                kind: 'endpoint',
+                module: slugify(e.tag),
+                weight: SIGNAL_WEIGHTS['openapi-tag'],
+                signal: 'openapi-tag',
+                layer: 'api',
+                evidence: { file: spec.file, snippet: `tag: ${e.tag}` },
+            });
+        }
+    }
+    const workspaces = report.packageManager.workspaces ?? [];
+    for (const r of report.routes) {
+        if (tagged.has(r.path))
+            continue;
+        const reason = noiseReason(r);
+        if (reason) {
+            ignored.push({ target: r.path, reason });
+            continue;
+        }
+        const kind = r.kind === 'api' ? 'endpoint' : 'route';
+        const layer = layerOf(r);
+        const ev = { file: r.file, line: r.line, snippet: r.path };
+        // S2 workspace (0.9)
+        const ws = longestWorkspaceMatch(r.file, workspaces);
+        if (ws) {
+            cast({
+                target: r.path,
+                kind,
+                module: ws,
+                weight: SIGNAL_WEIGHTS.workspace,
+                signal: 'workspace',
+                layer,
+                evidence: ev,
+            });
+        }
+        // S3 domain-dir (0.8)
+        const dd = DOMAIN_DIR_RE.exec(r.file.replace(/\\/g, '/'));
+        if (dd?.[1] && !GENERIC_DIRS.has(dd[1].toLowerCase())) {
+            cast({
+                target: r.path,
+                kind,
+                module: slugify(dd[1]),
+                weight: SIGNAL_WEIGHTS['domain-dir'],
+                signal: 'domain-dir',
+                layer,
+                evidence: ev,
+            });
+        }
+        // S4 source-file (0.7) - the primary signal
+        const mf = moduleOfFile(r.file);
+        if (mf) {
+            cast({
+                target: r.path,
+                kind,
+                module: mf,
+                weight: SIGNAL_WEIGHTS['source-file'],
+                signal: 'source-file',
+                layer,
+                evidence: ev,
+            });
+        }
+        // S5 route-segment (0.3) - today's rule, kept as the floor so nothing goes unassigned
+        cast({
+            target: r.path,
+            kind,
+            module: moduleOfPath(r.path),
+            weight: SIGNAL_WEIGHTS['route-segment'],
+            signal: 'route-segment',
+            layer,
+            evidence: ev,
+        });
+    }
+    // resolve: strongest vote per target
+    const winners = new Map();
+    for (const v of votes) {
+        const cur = winners.get(v.target);
+        if (!cur || v.weight > cur.weight)
+            winners.set(v.target, v);
+    }
+    // build modules
+    const acc = new Map();
+    for (const v of winners.values()) {
+        const m = acc.get(v.module) ?? {
+            routes: new Set(),
+            endpoints: new Set(),
+            layers: new Set(),
+            signals: new Set(),
+            evidence: [],
+            weights: [],
+            contract: false,
+        };
+        if (v.kind === 'endpoint')
+            m.endpoints.add(v.target);
+        else
+            m.routes.add(v.target);
+        m.layers.add(v.layer);
+        m.signals.add(v.signal);
+        m.weights.push(v.weight);
+        if (v.signal === 'openapi-tag')
+            m.contract = true;
+        if (m.evidence.length < 5)
+            m.evidence.push(v.evidence);
+        acc.set(v.module, m);
+    }
+    // alias merge - folds signin/signup (generic App.tsx) into auth (backend/auth.ts)
+    for (const [name, m] of [...acc.entries()]) {
+        const canonical = canonicalAlias(name);
+        const size = m.routes.size + m.endpoints.size;
+        if (canonical && canonical !== name && acc.has(canonical)) {
+            const t = acc.get(canonical);
+            for (const r of m.routes)
+                t.routes.add(r);
+            for (const e of m.endpoints)
+                t.endpoints.add(e);
+            for (const l of m.layers)
+                t.layers.add(l);
+            t.signals.add('alias');
+            t.weights.push(...m.weights);
+            for (const e of m.evidence)
+                if (t.evidence.length < 5)
+                    t.evidence.push(e);
+            acc.delete(name);
+        }
+        else if (size <= mergeBelow && !canonical && acc.size > 1) {
+            // a singleton that nothing claims stays put rather than inventing a bucket;
+            // it is the caller's job (detect.ignore) to drop it if it is noise.
+        }
+    }
+    let modules = [...acc.entries()].map(([name, m]) => {
+        const testingTypes = ['functional', 'smoke', 'regression'];
+        if (m.contract)
+            testingTypes.push('contract');
+        if (canonicalAlias(name) === 'auth' || name === 'auth')
+            testingTypes.push('data-driven');
+        const targets = [...m.routes, ...m.endpoints];
+        const mod = {
+            name,
+            layers: [...m.layers],
+            routes: [...m.routes],
+            endpoints: [...m.endpoints],
+            testingTypes,
+            tags: [`@${name}`],
+            confidence: m.weights.length ? m.weights.reduce((a, b) => a + b, 0) / m.weights.length : 0,
+            signals: [...m.signals],
+            evidence: m.evidence,
+        };
+        // split pass: reuse the old first-segment rule where it is actually correct
+        if (targets.length > splitAfter) {
+            const groups = new Map();
+            for (const t of targets) {
+                const k = moduleOfPath(t);
+                groups.set(k, [...(groups.get(k) ?? []), t]);
+            }
+            if (groups.size > 1) {
+                mod.children = [...groups.entries()].map(([childName, ts]) => ({
+                    name: childName,
+                    layers: mod.layers,
+                    routes: ts.filter((t) => m.routes.has(t)),
+                    endpoints: ts.filter((t) => m.endpoints.has(t)),
+                    testingTypes: mod.testingTypes,
+                    tags: [`@${name}`, `@${name}/${childName}`],
+                    confidence: mod.confidence,
+                    signals: ['route-segment'],
+                    evidence: [],
+                }));
+            }
+        }
+        return mod;
+    });
+    modules.sort((a, b) => b.confidence - a.confidence ||
+        b.routes.length + b.endpoints.length - (a.routes.length + a.endpoints.length) ||
+        a.name.localeCompare(b.name));
+    if (modules.length > maxModules)
+        modules = modules.slice(0, maxModules);
+    return { modules, votes, ignored };
+}
+//# sourceMappingURL=modules.js.map

package/dist/analyze/propose.js

@@ -1,7 +1,7 @@
 import { basename } from 'node:path';
 import { stringify as toYaml } from 'yaml';
+import { detectModules } from './modules.js';
 import { ProjectConfigSchema, } from '@sdods/contracts';
-const RESERVED_SEGMENTS = new Set(['api', 'app', 'src', 'pages']);
 export function slugify(input) {
     const s = input
         .toLowerCase()
@@ -24,13 +24,6 @@ function routeName(path) {
         .toLowerCase();
     return name || 'home';
 }
-function moduleOfPath(path) {
-    const first = path.split('/').filter(Boolean)[0];
-    if (!first || first.startsWith('{'))
-        return 'home';
-    const clean = first.replace(/[^a-zA-Z0-9]+/g, '-').toLowerCase();
-    return RESERVED_SEGMENTS.has(clean) ? 'core' : clean;
-}
 function pathToConcrete(path) {
     return path.replace(/\{[^}]+\}/g, '1');
 }
@@ -76,48 +69,26 @@ export function proposeProject(report, opts = {}) {
     }
     if (hasUi && !routes.home)
         routes.home = '/';
-    // modules: UI by first path segment, API by openapi tag or first segment
+    // modules: signal fusion over route-defining files, workspaces, domain dirs and OpenAPI tags.
+    // See analyze/modules.ts - first-URL-segment grouping is kept only as the weakest signal.
+    const detected = detectModules(report);
+    const nameOfPath = new Map();
+    for (const [key, path] of Object.entries(routes))
+        if (!nameOfPath.has(path))
+            nameOfPath.set(path, key);
     const modules = new Map();
-    const ensure = (m, layer) => {
-        const key = slugify(m);
-        const mod = modules.get(key) ?? {
-            name: key,
-            layers: [],
-            routes: [],
-            endpoints: [],
-            testingTypes: ['functional', 'smoke', 'regression'],
-            tags: [`@${key}`],
-        };
-        if (!mod.layers.includes(layer))
-            mod.layers.push(layer);
-        modules.set(key, mod);
-        return mod;
-    };
-    for (const [key, path] of Object.entries(routes)) {
-        const mod = ensure(moduleOfPath(path), 'ui');
-        if (!mod.routes.includes(key))
-            mod.routes.push(key);
-    }
-    const endpointSet = new Set();
-    for (const e of openapiEndpoints) {
-        const mod = ensure(e.tag ?? moduleOfPath(e.path), 'api');
-        if (!mod.endpoints.includes(e.path))
-            mod.endpoints.push(e.path);
-        if (!mod.testingTypes.includes('contract'))
-            mod.testingTypes.push('contract');
-        endpointSet.add(e.path);
-    }
-    for (const r of apiRoutes) {
-        if (endpointSet.has(r.path))
-            continue;
-        const mod = ensure(moduleOfPath(r.path.replace(/^\/api\//, '/')), 'api');
-        if (!mod.endpoints.includes(r.path))
-            mod.endpoints.push(r.path);
-        endpointSet.add(r.path);
+    for (const m of detected.modules) {
+        modules.set(m.name, {
+            name: m.name,
+            layers: m.layers,
+            // module.routes are route NAMES (keys of the project `routes` map), not paths
+            routes: [...new Set(m.routes.map((p) => nameOfPath.get(p) ?? routeName(p)))],
+            endpoints: m.endpoints,
+            testingTypes: m.testingTypes,
+            tags: m.tags,
+        });
     }
-    const authModule = [...modules.values()].find((m) => /auth|login|account|session/.test(m.name));
-    if (authModule && !authModule.testingTypes.includes('data-driven'))
-        authModule.testingTypes.push('data-driven');
+    const endpointSet = new Set(detected.modules.flatMap((m) => m.endpoints));
     // envs
     const detectedEnvNames = [
         ...new Set(report.envs.map((e) => e.name).filter((n) => n !== 'example')),
@@ -283,6 +254,15 @@ export function proposeProject(report, opts = {}) {
         coverageMap,
         checklist,
         notes,
+        detectedModules: detected.modules.map((m) => ({
+            name: m.name,
+            confidence: m.confidence,
+            signals: m.signals,
+            routes: m.routes.length,
+            endpoints: m.endpoints.length,
+            evidence: m.evidence,
+        })),
+        ignoredTargets: detected.ignored,
     };
 }
 function titleCase(s) {

package/dist/auth/capture.js

@@ -148,7 +148,8 @@ export async function captureAuth(opts) {
                 const token = await strategy.token({ config, user });
                 if (token) {
                     const file = tokenFileFor(config, user);
-                    writeFileSync(file, JSON.stringify({ token, capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2));
+                    // Owner-only: this holds a usable API token for the application under test.
+                    writeFileSync(file, JSON.stringify({ token, capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2), { mode: 0o600 });
                     result.tokenFile = file;
                 }
             }

package/dist/auth/index.js

@@ -1,3 +1,5 @@
+import { mkdirSync } from 'node:fs';
+import { join } from 'node:path';
 /**
  * Define the project's auth strategy. `form` uses `auth.form` selectors from the project yaml
  * unless a custom `login` is provided.
@@ -71,16 +73,52 @@ export async function formLogin(page, config, user) {
     if (!form) {
         throw new Error('auth.strategy is "form" but auth.form selectors are missing in sdods.project.yaml.');
     }
-    await page.goto(form.loginPath);
-    await page.locator(form.usernameSelector).fill(user.username);
-    await page.locator(form.passwordSelector).fill(user.password);
-    await page.locator(form.submitSelector).click();
-    if (form.readySelector)
-        await page.locator(form.readySelector).first().waitFor({ state: 'visible' });
-    else if (form.readyUrl)
-        await page.waitForURL(`**${form.readyUrl}*`);
-    else
-        await page.waitForLoadState('domcontentloaded');
+    try {
+        await page.goto(form.loginPath);
+        await page.locator(form.usernameSelector).fill(user.username);
+        await page.locator(form.passwordSelector).fill(user.password);
+        await page.locator(form.submitSelector).click();
+        if (form.readySelector)
+            await page.locator(form.readySelector).first().waitFor({ state: 'visible' });
+        else if (form.readyUrl)
+            await page.waitForURL(`**${form.readyUrl}*`);
+        else
+            await page.waitForLoadState('domcontentloaded');
+    }
+    catch (cause) {
+        throw await describeLoginFailure(page, config, user, cause);
+    }
+}
+/**
+ * The form login runs in its own context (see `defineAuth`), so Playwright's video/trace/screenshot
+ * settings never attach to it — a failure here would otherwise surface as a bare locator timeout
+ * with no artifact. Name the page we actually landed on, and leave a screenshot behind.
+ */
+async function describeLoginFailure(page, config, user, cause) {
+    let where = '';
+    let shot = '';
+    try {
+        const url = page.url();
+        const title = await page.title();
+        where = ` at ${url}${title ? ` (title: ${JSON.stringify(title)})` : ''}`;
+    }
+    catch {
+        // page already closed or crashed — the original error is still worth reporting
+    }
+    try {
+        const dir = join(config.runtime.runDir, 'auth');
+        mkdirSync(dir, { recursive: true });
+        const file = join(dir, `login-failed-${user.role}-${user.username}.png`.replace(/\s+/g, '_'));
+        await page.screenshot({ path: file, fullPage: true });
+        shot = `\nScreenshot: ${file}`;
+    }
+    catch {
+        // screenshotting is best effort
+    }
+    const reason = cause instanceof Error ? cause.message : String(cause);
+    return new Error(`Form login for ${user.username} (${user.role}) failed${where}.\n${reason}` +
+        `\nIs the application under test running at ${config.env.ui.baseUrl}, and does that page ` +
+        `use the auth.form selectors in sdods.project.yaml?${shot}`, { cause });
 }
 export const noopAuth = defineAuth({ strategy: 'none' });
 //# sourceMappingURL=index.js.map

package/dist/config/playwright.d.ts

@@ -0,0 +1,37 @@
+import { type PlaywrightTestConfig } from '@playwright/test';
+import { type BrowserName, type Layer } from '@sdods/contracts';
+import type { ProjectRegistry } from './registry.js';
+export interface PlaywrightSelection {
+    project?: string;
+    env?: string;
+    layers?: string[];
+    browsers?: string[];
+    tags?: string;
+    runId?: string;
+    lint?: boolean;
+    allure?: boolean;
+    reporters?: string[];
+    reporterMode?: 'default' | 'server' | 'quiet';
+}
+export interface SdodsUseOption {
+    project: string;
+    layer: Layer;
+    browser?: BrowserName;
+}
+export declare const DASHBOARD_REPORTER = "@sdods/core/reporters/dashboard";
+/** Convenience for `playwright.config.ts`: read the selection from SDODS_* env vars. */
+export declare function selectionFromEnv(env?: NodeJS.ProcessEnv): PlaywrightSelection;
+export interface GeneratedProject {
+    name: string;
+    project: string;
+    layer: Layer;
+    browser?: BrowserName;
+}
+/** Names (and identity) of the Playwright projects a selection would produce, without side effects. */
+export declare function listGeneratedProjects(registry: ProjectRegistry, sel: PlaywrightSelection): GeneratedProject[];
+/**
+ * Build the Playwright config for a selection of projects × layers × browsers.
+ * One `defineBddConfig` per project × layer; browsers reuse the generated testDir.
+ */
+export declare function buildPlaywrightConfig(registry: ProjectRegistry, sel?: PlaywrightSelection): PlaywrightTestConfig;
+//# sourceMappingURL=playwright.d.ts.map