@sdods/core 0.2.1 → 0.2.2

package/dist/config/playwright.js

@@ -0,0 +1,262 @@
+import { existsSync } from 'node:fs';
+import { join, resolve as resolvePath } from 'node:path';
+import { devices } from '@playwright/test';
+import { cucumberReporter, defineBddConfig } from 'playwright-bdd';
+import { pwProjectName, runFiles } from '@sdods/contracts';
+import { coreStepsGlob } from '../steps/glob.js';
+import { combineTagExpr, normalizeTagExpr } from './tags.js';
+const DEVICE_FOR_BROWSER = {
+    chromium: 'Desktop Chrome',
+    firefox: 'Desktop Firefox',
+    webkit: 'Desktop Safari',
+    'mobile-chrome': 'Pixel 7',
+    'mobile-safari': 'iPhone 15',
+};
+export const DASHBOARD_REPORTER = '@sdods/core/reporters/dashboard';
+/** Convenience for `playwright.config.ts`: read the selection from SDODS_* env vars. */
+export function selectionFromEnv(env = process.env) {
+    const list = (v) => v
+        ? v
+            .split(',')
+            .map((s) => s.trim())
+            .filter(Boolean)
+        : undefined;
+    return {
+        project: env.SDODS_PROJECT || undefined,
+        env: env.SDODS_ENV || undefined,
+        layers: list(env.SDODS_LAYERS),
+        browsers: list(env.SDODS_BROWSERS),
+        tags: normalizeTagExpr(env.SDODS_TAGS),
+        runId: env.SDODS_RUN_ID || undefined,
+        lint: env.SDODS_LINT === '1',
+        allure: env.SDODS_ALLURE === '1',
+        reporters: list(env.SDODS_REPORTERS),
+        reporterMode: env.SDODS_REPORTER_MODE || 'default',
+    };
+}
+/** Names (and identity) of the Playwright projects a selection would produce, without side effects. */
+export function listGeneratedProjects(registry, sel) {
+    const out = [];
+    for (const entry of sel.project ? [registry.entry(sel.project)] : registry.entriesList()) {
+        const p = entry.config;
+        const layers = (sel.layers?.length ? p.layers.filter((l) => sel.layers.includes(l)) : p.layers);
+        const browsers = (sel.browsers?.length
+            ? p.browsers.filter((b) => sel.browsers.includes(b))
+            : p.browsers);
+        for (const layer of layers) {
+            if (layer === 'api') {
+                out.push({ name: pwProjectName({ project: p.slug, layer }), project: p.slug, layer });
+                continue;
+            }
+            if (layer === 'recorded' && !existsSync(join(entry.root, 'recorded')))
+                continue;
+            for (const browser of browsers) {
+                out.push({
+                    name: pwProjectName({ project: p.slug, layer, browser }),
+                    project: p.slug,
+                    layer,
+                    browser,
+                });
+            }
+        }
+    }
+    return out;
+}
+/**
+ * Build the Playwright config for a selection of projects × layers × browsers.
+ * One `defineBddConfig` per project × layer; browsers reuse the generated testDir.
+ */
+export function buildPlaywrightConfig(registry, sel = {}) {
+    const entries = sel.project ? [registry.entry(sel.project)] : registry.entriesList();
+    const projects = [];
+    let first;
+    let bddConfigs = 0;
+    const cliOverrides = sel.runId ? { runId: sel.runId } : undefined;
+    for (const entry of entries) {
+        const cfg = registry.resolve(entry.slug, sel.env, cliOverrides ? { ...parseEnvOverrides(), ...cliOverrides } : undefined);
+        first ??= cfg;
+        const p = cfg.project;
+        const layers = (sel.layers?.length ? p.layers.filter((l) => sel.layers.includes(l)) : p.layers);
+        const browsers = (sel.browsers?.length
+            ? p.browsers.filter((b) => sel.browsers.includes(b))
+            : p.browsers);
+        const envUse = {
+            locale: cfg.env.use.locale,
+            timezoneId: cfg.env.use.timezoneId,
+            geolocation: cfg.env.use.geolocation,
+            permissions: cfg.env.use.permissions,
+            colorScheme: cfg.env.use.colorScheme,
+            ignoreHTTPSErrors: cfg.env.use.ignoreHTTPSErrors,
+            extraHTTPHeaders: cfg.env.use.extraHTTPHeaders,
+            httpCredentials: cfg.env.use.httpCredentials,
+        };
+        for (const k of Object.keys(envUse))
+            if (envUse[k] === undefined)
+                delete envUse[k];
+        for (const layer of layers) {
+            if (layer === 'recorded') {
+                const recordedDir = join(p.root, 'recorded');
+                if (!existsSync(recordedDir))
+                    continue;
+                for (const browser of browsers) {
+                    projects.push({
+                        name: pwProjectName({ project: p.slug, layer, browser }),
+                        testDir: recordedDir,
+                        testMatch: '**/*.spec.ts',
+                        snapshotPathTemplate: join(p.root, 'features', '__screenshots__', '{projectName}', '{platform}', '{arg}{ext}'),
+                        use: {
+                            ...devices[DEVICE_FOR_BROWSER[browser]],
+                            ...(p.channel && (browser === 'chromium' || browser === 'mobile-chrome')
+                                ? { channel: p.channel }
+                                : {}),
+                            baseURL: cfg.env.ui.baseUrl,
+                            testIdAttribute: p.testIdAttribute,
+                            ...envUse,
+                            sdods: { project: p.slug, layer, browser },
+                        },
+                    });
+                }
+                continue;
+            }
+            const testDir = defineBddConfig({
+                features: `${toPosix(p.root)}/features/**/*.feature`,
+                steps: [
+                    coreStepsGlob(),
+                    `${toPosix(p.root)}/steps/**/*.ts`,
+                    `${toPosix(p.root)}/pages/**/*.ts`,
+                ],
+                // Each run generates into its own dir (cleaned by `sdods run`), lint/export into `.lint`,
+                // so concurrent runs and tooling never race on generated specs.
+                outputDir: `${toPosix(join(cfg.runtime.repoRoot, '.features-gen', sel.lint ? '.lint' : (sel.runId ?? 'adhoc'), p.slug, layer))}`,
+                featuresRoot: `${toPosix(p.root)}/features`,
+                // Explicit: scenarios that only use core steps cannot let bddgen guess the project test instance.
+                importTestFrom: `${toPosix(p.root)}/steps/fixtures.ts`,
+                disableWarnings: { importTestFrom: true },
+                tags: combineTagExpr(`@${layer}`, sel.tags),
+                examplesTitleFormat: 'Example #<_index_>',
+                missingSteps: sel.lint ? 'fail-on-gen' : 'fail-on-run',
+                aiFix: { promptAttachment: true },
+                quotes: 'single',
+            });
+            bddConfigs++;
+            if (layer === 'api') {
+                projects.push({
+                    name: pwProjectName({ project: p.slug, layer }),
+                    testDir,
+                    use: { sdods: { project: p.slug, layer } },
+                });
+                continue;
+            }
+            for (const browser of browsers) {
+                projects.push({
+                    name: pwProjectName({ project: p.slug, layer, browser }),
+                    testDir,
+                    // Baselines live with the project (generated specs are per-run and deleted):
+                    // projects/<slug>/features/__screenshots__/<pw project>/<platform>/<name>.png
+                    snapshotPathTemplate: join(p.root, 'features', '__screenshots__', '{projectName}', '{platform}', '{arg}{ext}'),
+                    use: {
+                        ...devices[DEVICE_FOR_BROWSER[browser]],
+                        ...(p.channel && (browser === 'chromium' || browser === 'mobile-chrome')
+                            ? { channel: p.channel }
+                            : {}),
+                        baseURL: cfg.env.ui.baseUrl,
+                        testIdAttribute: p.testIdAttribute,
+                        viewport: browser.startsWith('mobile') ? undefined : p.screenshots.viewport,
+                        ...envUse,
+                        sdods: { project: p.slug, layer, browser },
+                    },
+                });
+            }
+        }
+    }
+    const runDir = first?.runtime.runDir ?? resolvePath('.sdods/runs/adhoc');
+    const timeouts = first?.project.timeouts ?? {
+        test: 60_000,
+        expect: 10_000,
+        action: 15_000,
+        navigation: 30_000,
+        api: 15_000,
+    };
+    const workers = first?.runtime.workers;
+    const retries = first?.runtime.retries ?? 0;
+    const reporterMode = sel.reporterMode ?? 'default';
+    const reporter = [];
+    // `--reporter <name[=outputFile]>` ADDS reporters (e.g. `blob` for sharded CI) to the SDODS
+    // defaults, so the NDJSON, dashboard and HTML report always exist. Path-less `blob`/`json`/`junit`
+    // land inside the run directory.
+    const extra = (sel.reporters ?? []).map((r) => {
+        const [name, file] = r.split('=');
+        if (file)
+            return [name, name === 'blob' ? { outputDir: file } : { outputFile: file }];
+        if (name === 'blob')
+            return ['blob', { outputDir: join(runDir, 'blob-report') }];
+        if (name === 'json')
+            return ['json', { outputFile: join(runDir, 'pw-results.extra.json') }];
+        if (name === 'junit')
+            return ['junit', { outputFile: join(runDir, runFiles.junit) }];
+        return [name];
+    });
+    {
+        reporter.push(reporterMode === 'server' ? ['line'] : reporterMode === 'quiet' ? ['dot'] : ['list']);
+        reporter.push(['html', { outputFolder: join(runDir, runFiles.pwReport), open: 'never' }]);
+        // The cucumber reporter throws when no defineBddConfig() ran (recorded-only selections).
+        if (bddConfigs > 0)
+            reporter.push(cucumberReporter('message', {
+                outputFile: join(runDir, runFiles.messages),
+            }));
+        reporter.push([DASHBOARD_REPORTER, { outputDir: join(runDir, runFiles.dashboard) }]);
+        if (projects.some((p) => String(p.name).includes('--recorded--'))) {
+            reporter.push(['json', { outputFile: join(runDir, runFiles.pwResults) }]);
+        }
+        if (first?.project.reports.junit || first?.runtime.ci)
+            reporter.push(['junit', { outputFile: join(runDir, runFiles.junit) }]);
+        if (first?.project.reports.cucumberHtml)
+            reporter.push(cucumberReporter('html', {
+                outputFile: join(runDir, 'cucumber-report.html'),
+            }));
+        if (sel.allure || first?.project.reports.allure)
+            reporter.push(['allure-playwright', { resultsDir: join(runDir, 'allure-results') }]);
+    }
+    for (const r of extra) {
+        if (reporter.some((d) => d[0] === r[0]))
+            continue; // already emitted by defaults (e.g. junit in CI)
+        reporter.push(r);
+    }
+    return {
+        timeout: timeouts.test,
+        expect: { timeout: timeouts.expect },
+        retries,
+        workers,
+        fullyParallel: true,
+        outputDir: join(runDir, runFiles.pwOutput),
+        reporter,
+        use: {
+            screenshot: 'off',
+            video: 'retain-on-failure',
+            trace: 'on-first-retry',
+            actionTimeout: timeouts.action,
+            navigationTimeout: timeouts.navigation,
+        },
+        projects,
+        metadata: {
+            sdodsRunId: first?.runtime.runId,
+            sdodsEnv: first?.env.name,
+            sdodsRunDir: runDir,
+        },
+    };
+}
+function parseEnvOverrides() {
+    const raw = process.env.SDODS_CLI_OVERRIDES;
+    if (!raw)
+        return {};
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return {};
+    }
+}
+function toPosix(p) {
+    return p.replace(/\\/g, '/');
+}
+//# sourceMappingURL=playwright.js.map

package/dist/config/runner.js

@@ -236,6 +236,9 @@ export function buildRunnerConfig(registry, sel = {}) {
             trace: 'on-first-retry',
             actionTimeout: timeouts.action,
             navigationTimeout: timeouts.navigation,
+            // Playwright's own `--headed` flag still wins on the CLI; this is what makes the documented
+            // SDODS_HEADED env var and the --headed CliOverride reach the browser at all.
+            headless: !first?.runtime.headed,
         },
         projects,
         metadata: {

package/dist/fixtures/auth.d.ts

@@ -39,7 +39,15 @@ export declare class AuthStateCache {
     private readState;
     /** Return a fresh storageState path for the user, capturing it with the strategy when needed. */
     ensure(user: PoolUserLike, auth: AuthStrategy, browser: Browser): Promise<string | undefined>;
-    /** Atomic save: temp file + rename, sidecar written last. */
+    /**
+     * Atomic save: temp file + rename, sidecar written last.
+     *
+     * Written owner-only. This file is a live session for the application under test — cookies and
+     * localStorage, replayable as-is — and it used to land world-readable (0644 in a 0755
+     * directory), so any other account on the machine could lift it. Encryption is not the control
+     * here: the state has to be decryptable to be replayed, so a key would have to sit on the same
+     * disk. Restricting access is what actually protects it.
+     */
     save(user: PoolUserLike, state: Record<string, unknown>): string;
     /** Apply a cached state to a live context/page (step path: cookies + localStorage). */
     apply(args: {

package/dist/fixtures/auth.js

@@ -92,15 +92,23 @@ export class AuthStateCache {
             return this.save(user, state);
         });
     }
-    /** Atomic save: temp file + rename, sidecar written last. */
+    /**
+     * Atomic save: temp file + rename, sidecar written last.
+     *
+     * Written owner-only. This file is a live session for the application under test — cookies and
+     * localStorage, replayable as-is — and it used to land world-readable (0644 in a 0755
+     * directory), so any other account on the machine could lift it. Encryption is not the control
+     * here: the state has to be decryptable to be replayed, so a key would have to sit on the same
+     * disk. Restricting access is what actually protects it.
+     */
     save(user, state) {
-        mkdirSync(this.dir, { recursive: true });
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         const file = this.fileFor(user);
         const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2, 8)}.tmp`;
-        writeFileSync(tmp, JSON.stringify(state, null, 2));
+        writeFileSync(tmp, JSON.stringify(state, null, 2), { mode: 0o600 });
         renameSync(tmp, file);
         const sideTmp = `${this.sidecarFor(user)}.${process.pid}.tmp`;
-        writeFileSync(sideTmp, JSON.stringify({ capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2));
+        writeFileSync(sideTmp, JSON.stringify({ capturedAt: new Date().toISOString(), user: user.username, role: user.role }, null, 2), { mode: 0o600 });
         renameSync(sideTmp, this.sidecarFor(user));
         return file;
     }
@@ -147,7 +155,7 @@ export class AuthStateCache {
      * LOCK_STALE_MS is treated as abandoned by a crashed worker.
      */
     async withLock(user, fn) {
-        mkdirSync(this.dir, { recursive: true });
+        mkdirSync(this.dir, { recursive: true, mode: 0o700 });
         const lock = this.lockFor(user);
         const deadline = Date.now() + LOCK_STALE_MS * 2;
         for (;;) {

package/dist/fixtures/scenario.js

@@ -37,7 +37,10 @@ export class ScenarioMeta {
             pickleLine: init.pickleLine,
             exampleIndex: null,
             tags,
-            module: moduleForFeature(config.project, init.featureUri)?.name,
+            // `featureUri`, not `init.featureUri`: playwright-bdd hands us a repo-root-relative path,
+            // and moduleForFeature resolves its argument against project.root, so passing the raw
+            // value yields projects/<slug>/projects/<slug>/... and matches no module.
+            module: moduleForFeature(config.project, featureUri)?.name,
             process: process.env.SDODS_PROCESS || undefined,
             retry: testInfo.retry,
             workerIndex: testInfo.workerIndex,

package/dist/har/api-har.d.ts

@@ -63,6 +63,7 @@ export interface HarFile {
         entries: SdodsHarEntry[];
     };
 }
+export declare const SECRET_HEADER: RegExp;
 export declare function normalizeUrl(url: string): string;
 export declare function bodyHash(body: unknown): string;
 export declare function harKey(method: string, url: string, body?: unknown): string;

package/dist/har/api-har.js

@@ -3,7 +3,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
 import { dirname } from 'node:path';
 import { redact } from '../logger.js';
 import { VERSION } from '../version.js';
-const SECRET_HEADER = /^(authorization|cookie|set-cookie|x-api-key|proxy-authorization)$/i;
+export const SECRET_HEADER = /^(authorization|cookie|set-cookie|x-api-key|proxy-authorization)$/i;
 const VOLATILE_QUERY = /^(_|t|ts|timestamp|nonce|cb|cache)$/i;
 export function normalizeUrl(url) {
     let u;

package/dist/har/index.d.ts

@@ -1,4 +1,5 @@
 export * from './paths.js';
 export * from './api-har.js';
 export * from './hooks.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/har/index.js

@@ -1,4 +1,5 @@
 export * from './paths.js';
 export * from './api-har.js';
 export * from './hooks.js';
+export * from './scrub.js';
 //# sourceMappingURL=index.js.map

package/dist/har/scrub.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Strip credentials out of a HAR recorded by the browser.
+ *
+ * The API layer builds its own HAR and redacts secret headers as it goes. The browser layer does
+ * not: Playwright's `routeFromHAR({ update: true })` writes the file itself, verbatim, including
+ * the `Cookie`, `Set-Cookie` and `Authorization` headers of the application under test. HARs are
+ * meant to be committed — the demo project's are in git — so recording against a real application
+ * while signed in wrote a live session into a tracked file.
+ *
+ * Values are replaced rather than the headers removed, so replay still matches on their presence.
+ */
+export declare function scrubHar(har: unknown): {
+    changed: number;
+};
+/** Scrub a HAR file in place. Returns how many values were replaced, or -1 if it is not readable. */
+export declare function scrubHarFile(file: string): number;
+//# sourceMappingURL=scrub.d.ts.map

package/dist/har/scrub.js

@@ -0,0 +1,60 @@
+import { readFileSync, writeFileSync } from 'node:fs';
+import { SECRET_HEADER } from './api-har.js';
+/**
+ * Strip credentials out of a HAR recorded by the browser.
+ *
+ * The API layer builds its own HAR and redacts secret headers as it goes. The browser layer does
+ * not: Playwright's `routeFromHAR({ update: true })` writes the file itself, verbatim, including
+ * the `Cookie`, `Set-Cookie` and `Authorization` headers of the application under test. HARs are
+ * meant to be committed — the demo project's are in git — so recording against a real application
+ * while signed in wrote a live session into a tracked file.
+ *
+ * Values are replaced rather than the headers removed, so replay still matches on their presence.
+ */
+export function scrubHar(har) {
+    let changed = 0;
+    const entries = har?.log?.entries;
+    if (!Array.isArray(entries))
+        return { changed };
+    for (const entry of entries) {
+        for (const side of ['request', 'response']) {
+            const headers = entry[side]?.headers;
+            if (!Array.isArray(headers))
+                continue;
+            for (const h of headers) {
+                if (h && typeof h.name === 'string' && SECRET_HEADER.test(h.name) && h.value !== '***') {
+                    h.value = '***';
+                    changed++;
+                }
+            }
+        }
+        // Playwright also records cookies as structured arrays alongside the headers.
+        for (const side of ['request', 'response']) {
+            const cookies = entry[side]?.cookies;
+            if (!Array.isArray(cookies))
+                continue;
+            for (const c of cookies) {
+                if (c && typeof c.value === 'string' && c.value !== '***') {
+                    c.value = '***';
+                    changed++;
+                }
+            }
+        }
+    }
+    return { changed };
+}
+/** Scrub a HAR file in place. Returns how many values were replaced, or -1 if it is not readable. */
+export function scrubHarFile(file) {
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(file, 'utf8'));
+    }
+    catch {
+        return -1;
+    }
+    const { changed } = scrubHar(parsed);
+    if (changed > 0)
+        writeFileSync(file, `${JSON.stringify(parsed, null, 2)}\n`);
+    return changed;
+}
+//# sourceMappingURL=scrub.js.map

package/dist/shots/hooks.js

@@ -1,3 +1,4 @@
+import { attachmentNames } from '@sdods/contracts';
 import { AfterScenario, AfterStep, BeforeScenario, BeforeStep } from '../fixtures/test.js';
 /**
  * Screenshot narrative hooks. Tag-filtered so API scenarios never instantiate a page.
@@ -32,5 +33,14 @@ AfterScenario({ name: 'sdods:finalize' }, async ({ scenario, apiContext, heal, $
         apiCalls: apiContext.history.length,
         heals: heal.events.length,
     });
+    // Publish the scenario identity to the report. Ingest already understands this attachment
+    // (parseAttachmentName -> kind 'meta') and prefers its `module` over the directory guess in
+    // moduleFromUri(), which is wrong whenever a module's `path` differs from its `name` -
+    // demo-shop's `posts-api` lives in features/api/, so the guess yields "api" and never joins
+    // to modules.name. Without this attach the meta branch only ever fired in tests.
+    await $testInfo.attach(attachmentNames.meta, {
+        body: JSON.stringify(scenario.data),
+        contentType: 'application/json',
+    });
 });
 //# sourceMappingURL=hooks.js.map

package/dist/version.d.ts

@@ -1,2 +1,2 @@
-export declare const VERSION = "0.2.1";
+export declare const VERSION = "0.2.2";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -1,2 +1,2 @@
-export const VERSION = '0.2.1';
+export const VERSION = '0.2.2';
 //# sourceMappingURL=version.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sdods/core",
-  "version": "0.2.1",
+  "version": "0.2.2",
   "description": "SDODS runtime: configuration, project registry, fixtures, step libraries, data providers, screenshot narratives and self-healing locators.",
   "license": "Apache-2.0",
   "author": "SDODS <admin@sdods.com>",
@@ -42,7 +42,7 @@
     "playwright-bdd": ">=9"
   },
   "dependencies": {
-    "@sdods/contracts": "0.2.1",
+    "@sdods/contracts": "0.2.2",
     "@cucumber/gherkin": "^42.0.1",
     "@cucumber/messages": "^34.2.1",
     "@faker-js/faker": "^10.6.0",
@@ -59,7 +59,7 @@
     "ts-morph": "^28.0.0",
     "yaml": "^2.9.0",
     "zod": "^4.5.4",
-    "@sdods/db": "0.2.1"
+    "@sdods/db": "0.2.2"
   },
   "homepage": "https://sdods.com",
   "bugs": {