@sdods/core 0.2.2 → 0.3.1

package/dist/analyze/detectors.js

@@ -1,10 +1,54 @@
-import { basename, dirname } from 'node:path';
+import { existsSync, readFileSync } from 'node:fs';
+import { basename, dirname, join, parse as parsePath } from 'node:path';
 import { parse as parseYaml } from 'yaml';
 const SOURCE_EXT = new Set(['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs', '.vue', '.svelte']);
 const TEMPLATE_EXT = new Set(['.tsx', '.jsx', '.vue', '.svelte', '.html', '.htm', '.ts', '.js']);
 function ev(file, line, snippet) {
     return { file, line, snippet: snippet?.trim().slice(0, 160) };
 }
+const PM_LOCKFILES = [
+    ['bun.lock', 'bun'],
+    ['bun.lockb', 'bun'],
+    ['pnpm-lock.yaml', 'pnpm'],
+    ['yarn.lock', 'yarn'],
+    ['package-lock.json', 'npm'],
+];
+/**
+ * Nearest ancestor of `from` that looks like a JS workspace root: it holds a lockfile, or a
+ * package.json declaring `workspaces`, or a pnpm-workspace.yaml.
+ *
+ * Scanning a workspace MEMBER (`analyze apps/sat`) is the normal case on a monorepo, and the
+ * member has none of those files — the root above it does. Without this walk the whole scan
+ * reports `packageManager: unknown` and `monorepo: false` for a repo that is plainly neither.
+ * Returns undefined rather than guessing when nothing is found before the filesystem root.
+ */
+function findWorkspaceRootAbove(from) {
+    const stopAt = parsePath(from).root;
+    let dir = dirname(from);
+    // Bounded so a pathological path cannot spin; 12 is far beyond any real nesting depth.
+    for (let i = 0; i < 12 && dir && dir !== stopAt; i++) {
+        if (PM_LOCKFILES.some(([f]) => existsSync(join(dir, f))))
+            return dir;
+        if (existsSync(join(dir, 'pnpm-workspace.yaml')))
+            return dir;
+        const pkgPath = join(dir, 'package.json');
+        if (existsSync(pkgPath)) {
+            try {
+                const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'));
+                if (pkg.workspaces)
+                    return dir;
+            }
+            catch {
+                /* an unparseable package.json is not a workspace root */
+            }
+        }
+        const next = dirname(dir);
+        if (next === dir)
+            break;
+        dir = next;
+    }
+    return undefined;
+}
 export function detectPackageManager(scan) {
     const evidence = [];
     let name = 'unknown';
@@ -17,13 +61,7 @@ export function detectPackageManager(scan) {
             evidence.push(ev('package.json', undefined, `packageManager: ${pm}`));
         }
     }
-    const lockfiles = [
-        ['bun.lock', 'bun'],
-        ['bun.lockb', 'bun'],
-        ['pnpm-lock.yaml', 'pnpm'],
-        ['yarn.lock', 'yarn'],
-        ['package-lock.json', 'npm'],
-    ];
+    const lockfiles = PM_LOCKFILES;
     for (const [file, pmName] of lockfiles) {
         if (scan.has(file)) {
             if (name === 'unknown')
@@ -65,10 +103,41 @@ export function detectPackageManager(scan) {
         if (scan.has(f))
             evidence.push(ev(f, undefined, 'monorepo tooling'));
     }
-    const monorepo = workspaces.length > 0 ||
+    let monorepo = workspaces.length > 0 ||
         scan.has('lerna.json') ||
         scan.has('nx.json') ||
         scan.has('turbo.json');
+    // A workspace member has no lockfile and no `workspaces` key of its own — those live in the
+    // root above it. Scanning a member directly is the normal monorepo case, so resolve upwards
+    // rather than reporting `unknown` / `monorepo: false` for a repo that is neither.
+    if (name === 'unknown' || !monorepo) {
+        const wsRoot = findWorkspaceRootAbove(scan.root);
+        if (wsRoot) {
+            monorepo = true;
+            if (name === 'unknown') {
+                for (const [file, pmName] of PM_LOCKFILES) {
+                    if (existsSync(join(wsRoot, file))) {
+                        name = pmName;
+                        evidence.push(ev(file, undefined, `workspace root ${wsRoot}`));
+                        break;
+                    }
+                }
+                if (name === 'unknown') {
+                    try {
+                        const pkg = JSON.parse(readFileSync(join(wsRoot, 'package.json'), 'utf8'));
+                        const m = /^(npm|pnpm|yarn|bun)@/.exec(pkg.packageManager ?? '');
+                        if (m) {
+                            name = m[1];
+                            evidence.push(ev('package.json', undefined, `workspace root ${wsRoot}: ${pkg.packageManager}`));
+                        }
+                    }
+                    catch {
+                        /* no readable manifest at the workspace root */
+                    }
+                }
+            }
+        }
+    }
     return { name, monorepo, workspaces: [...new Set(workspaces)], evidence };
 }
 // ── frameworks ────────────────────────────────────────────────────────────────
@@ -202,6 +271,8 @@ export function detectRoutes(scan, frameworks) {
     if (names.has('Next.js') ||
         scan.files.some((f) => /(^|\/)app\/.*page\.(tsx|jsx|ts|js)$/.test(f.rel))) {
         for (const f of scan.files) {
+            if (isNotShippedCode(f.rel))
+                continue;
             const m = /(?:^|\/)(?:src\/)?app\/(.*?)(?:^|\/)?(page|route)\.(tsx|jsx|ts|js)$/.exec(f.rel);
             if (!m)
                 continue;
@@ -237,9 +308,19 @@ export function detectRoutes(scan, frameworks) {
             }
         }
         for (const f of scan.files) {
+            if (isNotShippedCode(f.rel))
+                continue;
             const m = /(?:^|\/)(?:src\/)?pages\/(.+)\.(tsx|jsx|ts|js)$/.exec(f.rel);
             if (!m)
                 continue;
+            // A directory called `pages` is not automatically the Pages Router.
+            // `app/api/intranet/pages/[id]/route.ts` is an App Router ROUTE HANDLER
+            // inside a resource that happens to be named "pages" — and it was being
+            // read as a Pages Router PAGE at `/{id}/route`: wrong kind, wrong source,
+            // and a path that had lost every parent segment. Anything under an `app/`
+            // segment belongs to the App Router loop above, which already handled it.
+            if (/(?:^|\/)(?:src\/)?app\//.test(f.rel))
+                continue;
             const rel = m[1];
             if (/^_app$|^_document$|^_error$|^404$|^500$/.test(rel))
                 continue;
@@ -256,6 +337,15 @@ export function detectRoutes(scan, frameworks) {
             });
         }
     }
+    /**
+     * Colocated tests, stories and type declarations sit next to the code they
+     * cover and match every route filename pattern. `route.test.ts` was being
+     * reported as a route named `id-publish-route-test`, which then became a key in
+     * the generated `routes:` map — an address that resolves to nothing.
+     */
+    function isNotShippedCode(rel) {
+        return /\.(test|spec|stories|story|bench|d)\.(tsx|jsx|ts|js|mts|cts)$/.test(rel);
+    }
     // React Router
     if (names.has('React Router')) {
         for (const f of scan.byExt('.tsx', '.jsx', '.ts', '.js')) {
@@ -664,13 +754,35 @@ export function detectAuth(scan, routes) {
     }
     if (pages.length)
         votes.form += 0.5;
-    let strategyGuess = 'none';
-    let best = 0;
-    for (const [k, v] of Object.entries(votes)) {
-        if (v > best) {
-            best = v;
-            strategyGuess = k;
-        }
+    // Ranked, not object-key order. `if (v > best)` over `Object.entries` resolves a TIE by
+    // whichever key happens to be declared first — so a repo scoring form 1.6 and token 1.6 got
+    // `form` for no reason a reader could see, and adding a library could silently flip it.
+    // Ties are now broken by this explicit precedence and, more importantly, are REPORTED: an
+    // ambiguous guess a human must confirm is not the same result as a confident one.
+    const TIE_ORDER = [
+        'sso',
+        'oauth-client-credentials',
+        'token',
+        'form',
+        'none',
+    ];
+    // Epsilon, not `===`. These scores are sums of decimal weights, so a "tie" is almost never
+    // exact: passport-local + express-session is 0.8 + 0.5 = 1.3000000000000000, while
+    // jsonwebtoken + @nestjs/jwt is 0.6 + 0.7 = 1.2999999999999998. Exact equality would report
+    // those as a clear win for `form` by 2e-16 — which is precisely the invisible, weight-order
+    // -dependent decision this fix exists to remove.
+    const TIE_EPSILON = 1e-9;
+    const ranked = Object.entries(votes).sort((a, b) => (Math.abs(b[1] - a[1]) < TIE_EPSILON ? 0 : b[1] - a[1]) ||
+        TIE_ORDER.indexOf(a[0]) - TIE_ORDER.indexOf(b[0]));
+    const [top, second] = ranked;
+    const best = top?.[1] ?? 0;
+    const strategyGuess = best > 0 ? top[0] : 'none';
+    if (second && best > 0 && Math.abs(second[1] - best) < TIE_EPSILON) {
+        const tied = ranked
+            .filter(([, v]) => Math.abs(v - best) < TIE_EPSILON)
+            .map(([k]) => k)
+            .join(', ');
+        evidence.push(ev('package.json', undefined, `ambiguous auth: ${tied} all scored ${best.toFixed(2)} — picked ${strategyGuess}, confirm before relying on it`));
     }
     return {
         pages: [...new Set(pages)],
@@ -682,30 +794,115 @@ export function detectAuth(scan, routes) {
 }
 // ── envs and base urls ────────────────────────────────────────────────────────
 const URL_VAR = /(BASE_?URL|API_?URL|APP_?URL|PUBLIC_URL|SITE_URL|HOST|ORIGIN|ENDPOINT)/i;
+/** Framework prefixes that expose a variable to the browser but say nothing about its meaning. */
+const PUBLIC_PREFIX = /^(NEXT_PUBLIC_|VITE_|REACT_APP_|NUXT_PUBLIC_|PUBLIC_|GATSBY_|EXPO_PUBLIC_)/;
+const CANONICAL_URL_KEYS = new Set([
+    'API_URL',
+    'API_BASE_URL',
+    'BASE_URL',
+    'APP_URL',
+    'APP_BASE_URL',
+    'SITE_URL',
+    'PUBLIC_URL',
+    'ORIGIN',
+    'HOST',
+]);
+/**
+ * How strongly a variable NAME claims to be *the* base URL of its kind.
+ *
+ * The old rule was `apiBaseUrl ??= raw` — first match in file order wins. On a real repo that
+ * means `SIM_AGENT_API_URL`, declared 39 lines above `NEXT_PUBLIC_API_URL`, becomes the API base
+ * URL for the whole generated project, and every generated API scenario then talks to a service
+ * that is not the application. A vendor- or service-prefixed name is the LEAST likely to be the
+ * app's own base URL, so specificity has to beat position.
+ */
+function urlKeyScore(key) {
+    const bare = key.toUpperCase().replace(PUBLIC_PREFIX, '');
+    if (CANONICAL_URL_KEYS.has(bare))
+        return 3;
+    if (/^[A-Z0-9]+_(API_URL|BASE_URL|APP_URL)$/.test(bare))
+        return 1;
+    return 2;
+}
+/**
+ * A deliberately small `.gitignore` reader, scoped to the `.env` family only.
+ *
+ * Full gitignore semantics (negation, directory-only, nested files, precedence) are not needed
+ * to answer the one question asked here — "is this .env file deliberately untracked?" — and a
+ * partial implementation of the full spec would be worse than an honest narrow one. Patterns
+ * that do not concern `.env*` are ignored outright.
+ */
+function gitIgnoredEnvMatcher(scan) {
+    const patterns = [];
+    for (const candidate of ['.gitignore', '.git/info/exclude']) {
+        const text = scan.read(candidate);
+        if (!text)
+            continue;
+        for (const raw of text.split(/\r?\n/)) {
+            const line = raw.trim();
+            if (!line || line.startsWith('#') || line.startsWith('!'))
+                continue;
+            const body = line.replace(/^\/+/, '').replace(/\/+$/, '');
+            if (!body.includes('.env'))
+                continue;
+            patterns.push(new RegExp(`^${body
+                .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+                .replace(/\*/g, '[^/]*')
+                .replace(/\?/g, '[^/]')}$`));
+        }
+    }
+    if (!patterns.length)
+        return () => false;
+    return (rel) => {
+        const base = basename(rel);
+        return patterns.some((re) => re.test(base) || re.test(rel));
+    };
+}
 export function detectEnvs(scan) {
     const envs = [];
     const evidence = [];
     let ui;
     let api;
+    const ignored = gitIgnoredEnvMatcher(scan);
     for (const f of scan.files) {
         const name = basename(f.rel);
         if (!name.startsWith('.env'))
             continue;
         if (f.rel.split('/').length > 2)
             continue;
+        // A gitignored .env holds real credentials and real internal hostnames. Reading it puts
+        // those values into the report, and `analyze --json` / the generated yaml are things people
+        // paste into issues and commit. The file is deliberately not in the repo; the analyzer has
+        // no business republishing it.
+        if (ignored(f.rel)) {
+            evidence.push(ev(f.rel, undefined, 'gitignored — not read'));
+            continue;
+        }
         const envName = name === '.env' ? 'local' : name.replace(/^\.env\.?/, '').replace(/\.local$/, '') || 'local';
         const vars = [];
         let uiBaseUrl;
         let apiBaseUrl;
+        let uiScore = -1;
+        let apiScore = -1;
         for (const hit of scan.grep(f.rel, /^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/)) {
             const key = hit.match[1];
             const raw = hit.match[2].trim().replace(/^["']|["']$/g, '');
             vars.push(key);
             if (URL_VAR.test(key) && /^https?:\/\//.test(raw)) {
-                if (/API|ENDPOINT/i.test(key))
-                    apiBaseUrl ??= raw;
-                else
-                    uiBaseUrl ??= raw;
+                const score = urlKeyScore(key);
+                const isApi = /API|ENDPOINT/i.test(key);
+                // Strictly greater: the first key at a given specificity still wins, so a file with two
+                // equally-canonical names keeps its existing, file-order-stable answer.
+                if (isApi ? score > apiScore : score > uiScore) {
+                    if (isApi) {
+                        apiBaseUrl = raw;
+                        apiScore = score;
+                    }
+                    else {
+                        uiBaseUrl = raw;
+                        uiScore = score;
+                    }
+                }
                 evidence.push(ev(f.rel, hit.line, `${key}=${/example|sample/i.test(name) ? raw : '…'}`));
             }
         }
@@ -757,7 +954,12 @@ export function detectEnvs(scan) {
             }
         }
     }
-    for (const e of envs) {
+    // Real environments first, `.env.example` last. `propose` drops `example` from the env list
+    // (it is a template, not an environment) while base URLs were folded in file order — so a repo
+    // whose .env.example sorted first handed its placeholder URLs to every generated env, and the
+    // proposal named environments that had supplied none of its own values.
+    const isTemplate = (n) => n === 'example' || n === 'sample';
+    for (const e of [...envs].sort((a, b) => Number(isTemplate(a.name)) - Number(isTemplate(b.name)))) {
         ui ??= e.uiBaseUrl;
         api ??= e.apiBaseUrl;
     }
@@ -766,9 +968,19 @@ export function detectEnvs(scan) {
         const portHit = scan.files
             .filter((f) => SOURCE_EXT.has(f.ext))
             .flatMap((f) => scan.grep(f.rel, /\.listen\(\s*(?:\{[^}]*port:\s*)?(\d{4,5})/).map((h) => ({ f, h })))[0];
-        api = portHit ? `http://localhost:${portHit.h.match[1]}` : 'http://localhost:3000';
-        if (portHit)
-            evidence.push(ev(portHit.f.rel, portHit.h.line, portHit.h.text));
+        // Only when it names a DIFFERENT origin than the UI. A full-stack app (Next, Nuxt) serves
+        // its API from the same port under /api, and an express dependency there is usually a socket
+        // or worker server — not a second API origin. The old code set `api` unconditionally, which
+        // both invented `http://localhost:3000` out of nothing when no `.listen()` existed AND
+        // suppressed the `api ??= ui + '/api'` fallback below, so every generated API scenario was
+        // pointed at the UI origin with no /api suffix.
+        if (portHit) {
+            const candidate = `http://localhost:${portHit.h.match[1]}`;
+            if (candidate !== ui) {
+                api = candidate;
+                evidence.push(ev(portHit.f.rel, portHit.h.line, portHit.h.text));
+            }
+        }
     }
     api ??= ui ? `${ui}/api` : undefined;
     return { envs, baseUrls: { ui, api, evidence } };

package/dist/analyze/index.d.ts

@@ -3,6 +3,5 @@ export { analyzeProject, buildChecklist, type AnalyzeOptions } from './analyze.j
 export { proposeProject, slugify, type ProposeOptions } from './propose.js';
 export { applyProposal, importPlaywrightSpecs, type ApplyOptions, type ApplyResult, } from './apply.js';
 export { computeCoverage, parseFeatures, pomRouteSteps, type CoverageOptions } from './coverage.js';
-export { detectModules, moduleOfFile, moduleOfPath, canonicalAlias, MODULE_ALIASES, SIGNAL_WEIGHTS, type ModuleSignal, type ModuleVote, type DetectedModule, type DetectModulesOptions, type DetectModulesResult, } from './modules.js';
 export * from './detectors.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/analyze/index.js

@@ -3,6 +3,5 @@ export { analyzeProject, buildChecklist } from './analyze.js';
 export { proposeProject, slugify } from './propose.js';
 export { applyProposal, importPlaywrightSpecs, } from './apply.js';
 export { computeCoverage, parseFeatures, pomRouteSteps } from './coverage.js';
-export { detectModules, moduleOfFile, moduleOfPath, canonicalAlias, MODULE_ALIASES, SIGNAL_WEIGHTS, } from './modules.js';
 export * from './detectors.js';
 //# sourceMappingURL=index.js.map

package/dist/analyze/propose.js

@@ -1,7 +1,7 @@
 import { basename } from 'node:path';
 import { stringify as toYaml } from 'yaml';
-import { detectModules } from './modules.js';
 import { ProjectConfigSchema, } from '@sdods/contracts';
+const RESERVED_SEGMENTS = new Set(['api', 'app', 'src', 'pages']);
 export function slugify(input) {
     const s = input
         .toLowerCase()
@@ -10,19 +10,48 @@ export function slugify(input) {
         .replace(/^-+|-+$/g, '');
     return s || 'app';
 }
+/**
+ * A route key is a feature-file identifier a person has to read, type and grep for — it names
+ * `features/<module>/<key>.feature`. The old version cleaned every segment and joined all of
+ * them, so a deep route produced a long key whose leading segments were pure transport
+ * (`api-v1-…`) and whose parameter segments lost the fact that they were parameters.
+ *
+ * Now: transport prefixes are dropped, parameters read as `by-<param>`, and the key is capped at
+ * the segments that actually distinguish it. Collisions are still resolved by the `-2`, `-3`
+ * suffix loop in the caller, so shortening cannot silently merge two routes.
+ */
+const TRANSPORT_SEGMENTS = new Set(['api', 'rest', 'v1', 'v2', 'v3']);
 function routeName(path) {
     if (path === '/' || path === '')
         return 'home';
-    const segs = path
-        .split('/')
-        .filter(Boolean)
-        .map((s) => s.replace(/[{}*]/g, '').replace(/[^a-zA-Z0-9]+/g, '-'));
-    const name = segs
-        .filter(Boolean)
-        .map((s, i) => (i > 0 && path.includes(`{${s}}`) ? `by-${s}` : s))
-        .join('-')
-        .toLowerCase();
-    return name || 'home';
+    const raw = path.split('/').filter(Boolean);
+    const isParam = (s) => /^[{:*]/.test(s) || /^\[.*\]$/.test(s);
+    const clean = (s) => s
+        .replace(/[{}[\]:*]/g, '')
+        .replace(/^\.\.\./, '')
+        .replace(/[^a-zA-Z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    const parts = [];
+    for (const [i, seg] of raw.entries()) {
+        const name = clean(seg);
+        if (!name)
+            continue;
+        // Only a LEADING transport segment is dropped: a resource genuinely called `v2` deeper in
+        // the path is part of the identity of the route.
+        if (i === 0 && TRANSPORT_SEGMENTS.has(name.toLowerCase()))
+            continue;
+        parts.push(isParam(seg) ? `by-${name}` : name);
+    }
+    // Keep the head (what it is) and the tail (what it does); the middle rarely distinguishes.
+    const trimmed = parts.length > 4 ? [parts[0], ...parts.slice(-3)] : parts;
+    return trimmed.join('-').toLowerCase() || 'home';
+}
+function moduleOfPath(path) {
+    const first = path.split('/').filter(Boolean)[0];
+    if (!first || first.startsWith('{'))
+        return 'home';
+    const clean = first.replace(/[^a-zA-Z0-9]+/g, '-').toLowerCase();
+    return RESERVED_SEGMENTS.has(clean) ? 'core' : clean;
 }
 function pathToConcrete(path) {
     return path.replace(/\{[^}]+\}/g, '1');
@@ -69,26 +98,48 @@ export function proposeProject(report, opts = {}) {
     }
     if (hasUi && !routes.home)
         routes.home = '/';
-    // modules: signal fusion over route-defining files, workspaces, domain dirs and OpenAPI tags.
-    // See analyze/modules.ts - first-URL-segment grouping is kept only as the weakest signal.
-    const detected = detectModules(report);
-    const nameOfPath = new Map();
-    for (const [key, path] of Object.entries(routes))
-        if (!nameOfPath.has(path))
-            nameOfPath.set(path, key);
+    // modules: UI by first path segment, API by openapi tag or first segment
     const modules = new Map();
-    for (const m of detected.modules) {
-        modules.set(m.name, {
-            name: m.name,
-            layers: m.layers,
-            // module.routes are route NAMES (keys of the project `routes` map), not paths
-            routes: [...new Set(m.routes.map((p) => nameOfPath.get(p) ?? routeName(p)))],
-            endpoints: m.endpoints,
-            testingTypes: m.testingTypes,
-            tags: m.tags,
-        });
+    const ensure = (m, layer) => {
+        const key = slugify(m);
+        const mod = modules.get(key) ?? {
+            name: key,
+            layers: [],
+            routes: [],
+            endpoints: [],
+            testingTypes: ['functional', 'smoke', 'regression'],
+            tags: [`@${key}`],
+        };
+        if (!mod.layers.includes(layer))
+            mod.layers.push(layer);
+        modules.set(key, mod);
+        return mod;
+    };
+    for (const [key, path] of Object.entries(routes)) {
+        const mod = ensure(moduleOfPath(path), 'ui');
+        if (!mod.routes.includes(key))
+            mod.routes.push(key);
+    }
+    const endpointSet = new Set();
+    for (const e of openapiEndpoints) {
+        const mod = ensure(e.tag ?? moduleOfPath(e.path), 'api');
+        if (!mod.endpoints.includes(e.path))
+            mod.endpoints.push(e.path);
+        if (!mod.testingTypes.includes('contract'))
+            mod.testingTypes.push('contract');
+        endpointSet.add(e.path);
     }
-    const endpointSet = new Set(detected.modules.flatMap((m) => m.endpoints));
+    for (const r of apiRoutes) {
+        if (endpointSet.has(r.path))
+            continue;
+        const mod = ensure(moduleOfPath(r.path.replace(/^\/api\//, '/')), 'api');
+        if (!mod.endpoints.includes(r.path))
+            mod.endpoints.push(r.path);
+        endpointSet.add(r.path);
+    }
+    const authModule = [...modules.values()].find((m) => /auth|login|account|session/.test(m.name));
+    if (authModule && !authModule.testingTypes.includes('data-driven'))
+        authModule.testingTypes.push('data-driven');
     // envs
     const detectedEnvNames = [
         ...new Set(report.envs.map((e) => e.name).filter((n) => n !== 'example')),
@@ -254,15 +305,6 @@ export function proposeProject(report, opts = {}) {
         coverageMap,
         checklist,
         notes,
-        detectedModules: detected.modules.map((m) => ({
-            name: m.name,
-            confidence: m.confidence,
-            signals: m.signals,
-            routes: m.routes.length,
-            endpoints: m.endpoints.length,
-            evidence: m.evidence,
-        })),
-        ignoredTargets: detected.ignored,
     };
 }
 function titleCase(s) {

package/dist/analyze/scan.js

@@ -34,6 +34,10 @@ export const IGNORED_DIRS = new Set([
     'bin',
     'obj',
 ]);
+/** A directory that contains `.git` (a dir for a clone, a file for a worktree). */
+function isRepositoryRoot(dir) {
+    return existsSync(join(dir, '.git'));
+}
 export const TEXT_EXTENSIONS = new Set([
     '.ts',
     '.tsx',
@@ -77,7 +81,12 @@ export class Scan {
     byRel = new Map();
     constructor(root, opts = {}) {
         this.root = resolvePath(root);
-        const maxFiles = opts.maxFiles ?? 8000;
+        // 8,000 was below the size of a single real monorepo app: `apps/sat` alone is ~6,400 files,
+        // so the walk truncated before reaching `.github/`, and every absence-based finding
+        // ("no CI", "no OpenAPI", "no test ids") was then reported as fact rather than as
+        // "not seen". Raising the default is half the fix; `--max-files` / `--max-depth` on the CLI
+        // is the other half, because no default is right for every repo.
+        const maxFiles = opts.maxFiles ?? 25000;
         const maxDepth = opts.maxDepth ?? 12;
         let truncated = false;
         const walk = (dir, depth) => {
@@ -96,6 +105,15 @@ export class Scan {
                     return;
                 }
                 const abs = join(dir, name);
+                // A directory holding its own `.git` is a different repository — a
+                // submodule, a vendored checkout, or a git worktree. Descending into
+                // one attributes another project's routes to this one, and a worktree
+                // is usually a STALE copy of this very repo, so every route gets
+                // reported twice with the wrong path. Observed on a real monorepo: all
+                // 157 routes were cited inside `.claude/worktrees/<branch>/`, a path
+                // that repo's own .gitignore excludes.
+                if (dir !== this.root && isRepositoryRoot(dir))
+                    return;
                 let st;
                 try {
                     st = statSync(abs);

package/dist/api/client.js

@@ -53,7 +53,13 @@ export class ApiClient {
         };
         if (opts.body !== undefined && !headers['content-type'] && !opts.form)
             headers['content-type'] = 'application/json';
-        const auth = opts.auth === null ? undefined : (opts.auth ?? this.deps.ctx.auth ?? envAuth(env.auth));
+        // `null` at either level means "send this unauthenticated". Only `undefined`
+        // falls through to the next layer, so a scenario can opt out of the
+        // environment credential without the environment having to know.
+        const ctxAuth = this.deps.ctx.auth;
+        const auth = opts.auth === null
+            ? undefined
+            : (opts.auth ?? (ctxAuth === null ? undefined : (ctxAuth ?? envAuth(env.auth))));
         if (auth) {
             if (auth.type === 'bearer')
                 headers.authorization = `Bearer ${auth.token}`;

package/dist/auth/capture.js

@@ -111,14 +111,22 @@ export async function captureAuth(opts) {
                 results.push(result);
                 continue;
             }
-            if (!opts.force && cache.isFresh(user)) {
+            // A fresh storageState means the LOGIN can be skipped. It says nothing about
+            // the token: the two are separate artefacts with separate lifetimes, and the
+            // token file is what the API layer reads (steps/data.steps.ts). Skipping the
+            // whole user here left roles with a browser session and no token, so every
+            // `@user:<role>` API scenario fell through to a live mint -- one Firebase
+            // sign-in per scenario, which is how a suite earns QUOTA_EXCEEDED. So the
+            // freshness check now gates the login only, and the token block below still
+            // runs -- and it is not a wasted mint either, because it now mints only when
+            // there is no token file yet, or when --force asked for a fresh one.
+            const loginIsFresh = !opts.force && cache.isFresh(user);
+            const interactive = opts.interactive || strategy.strategy === 'sso';
+            if (loginIsFresh) {
                 result.file = cache.fileFor(user);
                 result.skipped = 'fresh state exists (use force to recapture)';
-                results.push(result);
-                continue;
             }
-            const interactive = opts.interactive || strategy.strategy === 'sso';
-            if (interactive) {
+            else if (interactive) {
                 const file = cache.fileFor(user);
                 const loginUrl = new URL(opts.loginUrl ?? config.project.auth.form?.loginPath ?? '/', config.env.ui.baseUrl).toString();
                 const args = ['playwright', 'codegen', '--save-storage', file];
@@ -144,7 +152,7 @@ export async function captureAuth(opts) {
                 else if (!strategy.token)
                     result.skipped = 'strategy returned no storage state';
             }
-            if (strategy.token) {
+            if (strategy.token && (opts.force || !existsSync(tokenFileFor(config, user)))) {
                 const token = await strategy.token({ config, user });
                 if (token) {
                     const file = tokenFileFor(config, user);
@@ -153,6 +161,11 @@ export async function captureAuth(opts) {
                     result.tokenFile = file;
                 }
             }
+            else if (strategy.token) {
+                // Reused, not absent. Reporting nothing here reads as "this role has no
+                // token", which is the opposite of the truth.
+                result.tokenFile = tokenFileFor(config, user);
+            }
             results.push(result);
         }
     }