@trackunit/iris-app-playwright 0.2.116-alpha-5b28b432cab.0 → 0.2.116

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@trackunit/iris-app-playwright",
-  "version": "0.2.116-alpha-5b28b432cab.0",
+  "version": "0.2.116",
   "repository": "https://github.com/Trackunit/manager",
   "license": "SEE LICENSE IN LICENSE.txt",
   "generators": "./generators.json",

package/src/fixtures/hostReadiness.d.ts

@@ -11,11 +11,6 @@ export declare class HostNeverBecameReadyError extends Error {
     /** Creates an error whose message is exactly "host never became ready". The wait that ended is kept as `cause`. */
     constructor(cause?: unknown);
 }
-/** Thrown when the terms gate remains visibly loading after its shorter diagnostic budget. */
-export declare class TermsGateDidNotSettleError extends HostNeverBecameReadyError {
-    /** Creates a readiness error that names the shorter terms-gate timeout. */
-    constructor(timeoutMs: number);
-}
 /**
  * True only when `NX_FEATURE_BRANCH_BASE_URL` is a non-empty string.
  *

package/src/fixtures/hostReadiness.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.isFeatureBranchHost = exports.TermsGateDidNotSettleError = exports.HostNeverBecameReadyError = void 0;
+exports.isFeatureBranchHost = exports.HostNeverBecameReadyError = void 0;
 /**
  * Thrown when a feature-branch host never becomes ready.
  *
@@ -18,16 +18,6 @@ class HostNeverBecameReadyError extends Error {
     }
 }
 exports.HostNeverBecameReadyError = HostNeverBecameReadyError;
-/** Thrown when the terms gate remains visibly loading after its shorter diagnostic budget. */
-class TermsGateDidNotSettleError extends HostNeverBecameReadyError {
-    /** Creates a readiness error that names the shorter terms-gate timeout. */
-    constructor(timeoutMs) {
-        super();
-        this.name = "TermsGateDidNotSettleError";
-        this.message = `terms gate did not settle within ${String(timeoutMs)}ms`;
-    }
-}
-exports.TermsGateDidNotSettleError = TermsGateDidNotSettleError;
 /**
  * True only when `NX_FEATURE_BRANCH_BASE_URL` is a non-empty string.
  *

package/src/fixtures/login.fixture.d.ts

@@ -1,5 +1,4 @@
-import { type TermsStatusPage } from "./acceptTerms";
-import { type CachedStorageState, type StorageStateHydrator } from "./hydrateStorageState";
+import { type CachedStorageState } from "./hydrateStorageState";
 import { type AuthCredentials, type ResolveCredentialsOptions } from "./resolveCredentials";
 export type { AuthCredentials };
 export type LoginOptions = ResolveCredentialsOptions;
@@ -27,14 +26,6 @@ export declare const MAIN_MENU_READY_SELECTOR = "[data-testid=\"mainMenu\"]:not(
 type MainMenuReadinessInput = {
     readonly selector: string;
     readonly fragments: ReadonlyArray<string>;
-    /**
-     * False on a feature-branch host, so `/terms` is not a finished login.
-     * {@link waitForMainMenuReady} always sets this in Node. The predicate runs
-     * in the browser, so the default must not call {@link isFeatureBranchHost}:
-     * that closure is not serialized, and a dropped argument would throw there.
-     * Omitted means ready, which is the staging hide-menu behaviour.
-     */
-    readonly termsCountsAsReady?: boolean;
 };
 type MainMenuWaitPage = {
     waitForFunction: (pageFunction: (input: MainMenuReadinessInput) => boolean, input: MainMenuReadinessInput, options?: {
@@ -62,24 +53,12 @@ export declare const extendTestTimeout: (testInfo: TestTimeoutInfo | undefined,
  * branch is unchanged.
  */
 export declare const reserveFeatureBranchLoginBudget: (testInfo?: TestTimeoutInfo) => void;
-/**
- * Returns whether the main menu is ready or intentionally hidden for the current route.
- *
- * Root cause (GLU-2632): `/terms` is in {@link HIDE_MENU_URL_FRAGMENTS}, so every
- * host treated the unfinished terms prompt as a finished login. Callers on a
- * feature-branch host pass `termsCountsAsReady: false`, so a URL containing
- * `/terms` is not ready even if a menu node is present. An omitted flag stays
- * ready, which keeps today's behaviour for every other host.
- */
-export declare const isMainMenuReady: ({ selector, fragments, termsCountsAsReady, }: MainMenuReadinessInput) => boolean;
+/** Returns whether the main menu is ready or intentionally hidden for the current route. */
+export declare const isMainMenuReady: ({ selector, fragments }: MainMenuReadinessInput) => boolean;
 /**
  * Waits until Manager's main menu is rendered without a loading skeleton, or
  * until the browser is on a HostLayout hide-menu route (marketplace / auth /
  * terms) where the menu is intentionally absent.
- *
- * On a feature-branch host, `/terms` is excluded: the prompt is not a finished
- * login (GLU-2632). The flag is computed here, in Node, and passed in because
- * {@link isMainMenuReady} is evaluated in the page.
  */
 export declare const waitForMainMenuReady: (page: MainMenuWaitPage, testInfo?: TestTimeoutInfo) => Promise<void>;
 type EnvReadyResponse = {
@@ -159,10 +138,6 @@ type LoginRequestContext = {
 type SessionDocument = {
     ok: () => boolean;
 };
-type TermsButton = {
-    isVisible: () => Promise<boolean>;
-    click: () => Promise<void>;
-};
 type OktaLoginPage = {
     goto: (url: string, options?: {
         timeout?: number;
@@ -172,38 +147,19 @@ type OktaLoginPage = {
     }) => Promise<unknown>;
     locator: (selector: string) => {
         waitFor: (options: {
-            state: "visible" | "hidden";
+            state: "visible";
             timeout: number;
         }) => Promise<unknown>;
-        isVisible?: () => Promise<boolean>;
     };
-    /** Present on a real Playwright page. Session-handoff fakes omit it. */
-    url?: () => string;
-    getByRole?: (role: "button", options: {
-        name: string;
-        exact?: boolean;
-    }) => TermsButton;
-    on?: TermsStatusPage["on"];
-    off?: TermsStatusPage["off"];
-    waitForFunction?: MainMenuWaitPage["waitForFunction"];
 };
-/**
- * How long a ready shell must stay off `/terms`, with the gate no longer loading, before
- * login treats the prompt as not coming.
- */
-export declare const TERMS_GATE_QUIET_MS = 1000;
-/** How long a visibly loading terms gate may remain unchanged before login fails specifically. */
-export declare const TERMS_GATE_STALL_TIMEOUT_MS = 20000;
 /**
  * Performs the slow path: wait for the branch host to serve `/env`, hit Okta's
  * `/api/v1/authn`, redeem the `sessionToken` via the manager-classic redirect,
- * and wait for the host layout to render. On a feature-branch host it then
- * finishes the terms prompt and waits for the main shell inside the same
- * budget. Factored out so the cache hit/miss branches read clearly.
+ * and wait for the host layout to render. Factored out so the cache hit/miss
+ * branches read clearly.
  *
  * `createRequestContext`, `now`, and `sleep` are injectable so a unit test can
- * drive the session handoff and the terms prompt without a browser or a real
- * three-minute wait.
+ * drive the session handoff without a browser or a real three-minute wait.
  */
 export declare const performOktaLogin: ({ page, baseURL, credentials, testInfo, createRequestContext, now, sleep: pause, }: {
     page: OktaLoginPage;
@@ -216,28 +172,4 @@ export declare const performOktaLogin: ({ page, baseURL, credentials, testInfo,
     /** Injectable pause between session document reloads. Production waits on the event loop. */
     sleep?: (ms: number) => Promise<void>;
 }) => Promise<void>;
-type SignInPage = Omit<OktaLoginPage, "waitForFunction"> & {
-    context: () => StorageStateHydrator & {
-        storageState: () => Promise<CachedStorageState>;
-    };
-    /** Required so the shell wait after a restored session can run in the page. */
-    waitForFunction: MainMenuWaitPage["waitForFunction"];
-};
-/**
- * Signs in, reusing this worker's cached session when one exists.
- *
- * `now` and `sleep` are injectable so a unit test can drive the restored
- * feature-branch terms wait without a browser or a real three-minute clock.
- * Production uses `Date.now` and the event loop.
- */
-export declare const signIn: ({ page, baseURL, cache, testInfo, options, now, sleep: pause, createRequestContext, }: {
-    page: SignInPage;
-    baseURL: string | undefined;
-    cache: Map<string, CachedStorageState>;
-    testInfo?: TestTimeoutInfo;
-    options?: LoginOptions;
-    now?: () => number;
-    sleep?: (ms: number) => Promise<void>;
-    createRequestContext?: (baseURL: string | undefined) => Promise<LoginRequestContext>;
-}) => Promise<void>;
 export { expect } from "@playwright/test";

package/src/fixtures/login.fixture.js

@@ -1,8 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.expect = exports.signIn = exports.performOktaLogin = exports.TERMS_GATE_STALL_TIMEOUT_MS = exports.TERMS_GATE_QUIET_MS = exports.test = exports.waitForEnvReady = exports.EnvReadyTimeoutError = exports.waitForMainMenuReady = exports.isMainMenuReady = exports.reserveFeatureBranchLoginBudget = exports.extendTestTimeout = exports.MAIN_MENU_READY_SELECTOR = exports.SESSION_DOCUMENT_RETRY_DELAY_MS = exports.ENV_READY_POLL_INTERVAL_MS = exports.ENV_READY_TIMEOUT_ENV_VAR = exports.ENV_READY_TIMEOUT_MS = exports.MAIN_MENU_READY_TIMEOUT_MS = exports.HIDE_MENU_URL_FRAGMENTS = void 0;
+exports.expect = exports.performOktaLogin = exports.test = exports.waitForEnvReady = exports.EnvReadyTimeoutError = exports.waitForMainMenuReady = exports.isMainMenuReady = exports.reserveFeatureBranchLoginBudget = exports.extendTestTimeout = exports.MAIN_MENU_READY_SELECTOR = exports.SESSION_DOCUMENT_RETRY_DELAY_MS = exports.ENV_READY_POLL_INTERVAL_MS = exports.ENV_READY_TIMEOUT_ENV_VAR = exports.ENV_READY_TIMEOUT_MS = exports.MAIN_MENU_READY_TIMEOUT_MS = exports.HIDE_MENU_URL_FRAGMENTS = void 0;
 const test_1 = require("@playwright/test");
-const acceptTerms_1 = require("./acceptTerms");
 const hostReadiness_1 = require("./hostReadiness");
 const hydrateStorageState_1 = require("./hydrateStorageState");
 const loginCacheKey_1 = require("./loginCacheKey");
@@ -70,19 +69,8 @@ const reserveFeatureBranchLoginBudget = (testInfo) => {
     (0, exports.extendTestTimeout)(testInfo, exports.MAIN_MENU_READY_TIMEOUT_MS);
 };
 exports.reserveFeatureBranchLoginBudget = reserveFeatureBranchLoginBudget;
-/**
- * Returns whether the main menu is ready or intentionally hidden for the current route.
- *
- * Root cause (GLU-2632): `/terms` is in {@link HIDE_MENU_URL_FRAGMENTS}, so every
- * host treated the unfinished terms prompt as a finished login. Callers on a
- * feature-branch host pass `termsCountsAsReady: false`, so a URL containing
- * `/terms` is not ready even if a menu node is present. An omitted flag stays
- * ready, which keeps today's behaviour for every other host.
- */
-const isMainMenuReady = ({ selector, fragments, termsCountsAsReady = true, }) => {
-    if (!termsCountsAsReady && window.location.pathname.includes("/terms")) {
-        return false;
-    }
+/** Returns whether the main menu is ready or intentionally hidden for the current route. */
+const isMainMenuReady = ({ selector, fragments }) => {
     if (document.querySelector(selector) !== null) {
         return true;
     }
@@ -93,29 +81,10 @@ exports.isMainMenuReady = isMainMenuReady;
  * Waits until Manager's main menu is rendered without a loading skeleton, or
  * until the browser is on a HostLayout hide-menu route (marketplace / auth /
  * terms) where the menu is intentionally absent.
- *
- * On a feature-branch host, `/terms` is excluded: the prompt is not a finished
- * login (GLU-2632). The flag is computed here, in Node, and passed in because
- * {@link isMainMenuReady} is evaluated in the page.
  */
 const waitForMainMenuReady = async (page, testInfo) => {
     (0, exports.extendTestTimeout)(testInfo, exports.MAIN_MENU_READY_TIMEOUT_MS);
-    try {
-        await page.waitForFunction(exports.isMainMenuReady, {
-            selector: exports.MAIN_MENU_READY_SELECTOR,
-            fragments: exports.HIDE_MENU_URL_FRAGMENTS,
-            termsCountsAsReady: !(0, hostReadiness_1.isFeatureBranchHost)(),
-        }, { timeout: exports.MAIN_MENU_READY_TIMEOUT_MS });
-    }
-    catch (error) {
-        // The terms prompt can redirect after the inner shell wait has returned.
-        // On a feature-branch host that timeout is the host never becoming ready,
-        // before any page assertion. Other hosts keep Playwright's timeout.
-        if ((0, hostReadiness_1.isFeatureBranchHost)() && error instanceof test_1.errors.TimeoutError) {
-            throw new hostReadiness_1.HostNeverBecameReadyError(error);
-        }
-        throw error;
-    }
+    await page.waitForFunction(exports.isMainMenuReady, { selector: exports.MAIN_MENU_READY_SELECTOR, fragments: exports.HIDE_MENU_URL_FRAGMENTS }, { timeout: exports.MAIN_MENU_READY_TIMEOUT_MS });
 };
 exports.waitForMainMenuReady = waitForMainMenuReady;
 const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
@@ -195,187 +164,44 @@ exports.test = test_1.test.extend({
         { scope: "worker" },
     ],
     login: async ({ page, baseURL, _loginCache }, provide, testInfo) => {
-        await provide(options => (0, exports.signIn)({ page, baseURL, cache: _loginCache, testInfo, options }));
-    },
-});
-const noopTermsWatcher = () => ({
-    revision: () => 0,
-    stop: () => undefined,
-});
-/** Suspense fallback that sits in the host layout until the lazy `TermsGate` chunk loads. */
-const TERMS_GATE_FALLBACK_SELECTOR = '[data-testid="manager-app-fallback"]';
-/** Spinner `TermsGate` renders once its chunk has loaded, while the status lookup is still loading. */
-const TERMS_GATE_LOADING_SELECTOR = '[data-testid="termsGateLoading"]';
-/**
- * How long a ready shell must stay off `/terms`, with the gate no longer loading, before
- * login treats the prompt as not coming.
- */
-exports.TERMS_GATE_QUIET_MS = 1000;
-/** How long a visibly loading terms gate may remain unchanged before login fails specifically. */
-exports.TERMS_GATE_STALL_TIMEOUT_MS = 20000;
-/**
- * Starts the terms-status watcher only on a feature-branch host, and only when the
- * page can listen for requests. An unset or empty `NX_FEATURE_BRANCH_BASE_URL` does
- * not subscribe and does not click Accept (GLU-2632).
- */
-const startFeatureBranchTermsWatch = (page) => {
-    if (!(0, hostReadiness_1.isFeatureBranchHost)() || page.on === undefined || page.off === undefined) {
-        return noopTermsWatcher();
-    }
-    // Call through the page. A detached `page.on` runs without `this`, and Playwright
-    // then throws `this.listenerCount is not a function` before any request is seen.
-    return (0, acceptTerms_1.watchTermsStatus)({
-        on: (event, listener) => {
-            page.on?.(event, listener);
-        },
-        off: (event, listener) => {
-            page.off?.(event, listener);
-        },
-    });
-};
-/**
- * True while `TermsGate` has not decided yet: either the lazy chunk has not replaced its
- * Suspense fallback, or the chunk is mounted and shows its own spinner because the status
- * lookup is still loading. A page that cannot see those nodes is treated as decided.
- */
-const isTermsGateStillLoading = async (page) => {
-    for (const selector of [TERMS_GATE_FALLBACK_SELECTOR, TERMS_GATE_LOADING_SELECTOR]) {
-        const node = page.locator(selector);
-        if (node.isVisible !== undefined && (await node.isVisible())) {
-            return true;
-        }
-    }
-    return false;
-};
-/** True only for the spinner owned by `TermsGate`, not the shared application Suspense fallback. */
-const isTermsStatusStillLoading = async (page) => {
-    const node = page.locator(TERMS_GATE_LOADING_SELECTOR);
-    return node.isVisible !== undefined && (await node.isVisible());
-};
-/**
- * Finishes the terms prompt, then waits for the main shell, inside the login budget.
- *
- * Root cause (GLU-2632): feature-branch `/terms` is not a finished login, and waiting
- * for the menu never clicks the prompt. `#host-layout-content` is visible while
- * `TermsGate` is still a Suspense fallback, so returning as soon as the layout appears
- * can miss a later redirect. URL and rendered gate state are authoritative: a `/terms`
- * URL starts the accept flow, while a ready shell that stays off `/terms` with no gate
- * loader for {@link TERMS_GATE_QUIET_MS} is finished. Starting a new status request
- * resets that quiet window, but its response is never awaited because browser requests
- * can remain pending across navigation. A visibly loading gate gets the shorter
- * {@link TERMS_GATE_STALL_TIMEOUT_MS} diagnostic budget.
- */
-const finishFeatureBranchTerms = async ({ page, watcher, now, sleep: pause, deadline, }) => {
-    if (!(0, hostReadiness_1.isFeatureBranchHost)()) {
-        return;
-    }
-    let acceptedPrompt = false;
-    let quietSince;
-    let quietRevision = 0;
-    let gateLoadingSince;
-    const acceptIfPrompted = async () => {
-        // Call through the page. Detached Playwright methods run without `this` and throw
-        // reading `_mainFrame` before terms can finish.
-        const pageUrl = page.url;
-        if (pageUrl === undefined || !(0, acceptTerms_1.isTermsRoute)(pageUrl.call(page))) {
-            return false;
-        }
-        if (page.getByRole === undefined) {
-            throw new hostReadiness_1.HostNeverBecameReadyError();
-        }
-        const readUrl = pageUrl.bind(page);
-        const findButton = page.getByRole.bind(page);
-        await (0, acceptTerms_1.acceptTermsWithinBudget)({
-            page: {
-                url: readUrl,
-                getByRole: findButton,
-                waitForURL: (predicate, options) => page.waitForURL(predicate, options),
-            },
-            now,
-            sleep: pause,
-            deadline,
-        });
-        return true;
-    };
-    if (page.waitForFunction === undefined) {
-        await acceptIfPrompted();
-        return;
-    }
-    const waitForFunction = page.waitForFunction.bind(page);
-    const shellInput = {
-        selector: exports.MAIN_MENU_READY_SELECTOR,
-        fragments: exports.HIDE_MENU_URL_FRAGMENTS,
-        termsCountsAsReady: false,
-    };
-    while (now() < deadline) {
-        const started = now();
-        acceptedPrompt = (await acceptIfPrompted()) || acceptedPrompt;
-        const remaining = deadline - now();
-        if (remaining <= 0) {
-            break;
-        }
-        const slice = Math.min(exports.TERMS_GATE_QUIET_MS, remaining);
-        let shellReady = false;
-        try {
-            await waitForFunction(exports.isMainMenuReady, shellInput, { timeout: slice });
-            shellReady = true;
-        }
-        catch (error) {
-            if (!isPlaywrightTimeout(error) && now() < deadline) {
-                throw error;
-            }
-        }
-        if (shellReady) {
-            acceptedPrompt = (await acceptIfPrompted()) || acceptedPrompt;
-        }
-        const onTerms = page.url !== undefined && (0, acceptTerms_1.isTermsRoute)(page.url());
-        const gateLoading = await isTermsGateStillLoading(page);
-        const termsStatusLoading = gateLoading && (await isTermsStatusStillLoading(page));
-        if (termsStatusLoading) {
-            gateLoadingSince ?? (gateLoadingSince = now());
-            if (now() - gateLoadingSince >= exports.TERMS_GATE_STALL_TIMEOUT_MS) {
-                throw new hostReadiness_1.TermsGateDidNotSettleError(exports.TERMS_GATE_STALL_TIMEOUT_MS);
-            }
-        }
-        else {
-            gateLoadingSince = undefined;
-        }
-        if (!shellReady || onTerms || gateLoading) {
-            quietSince = undefined;
-        }
-        else if (acceptedPrompt) {
-            return;
-        }
-        else {
-            // A request that first appears mid-window restarts it: the app may still be
-            // committing a redirect after the current DOM state was observed.
-            const revision = watcher.revision();
-            if (quietSince === undefined || revision !== quietRevision) {
-                quietSince = now();
-                quietRevision = revision;
-            }
-            if (now() - quietSince >= exports.TERMS_GATE_QUIET_MS) {
-                return;
+        const loginFn = async (options) => {
+            const credentials = await (0, resolveCredentials_1.resolveCredentials)(options);
+            const cacheKey = (0, loginCacheKey_1.buildLoginCacheKey)(baseURL, credentials);
+            const cached = _loginCache.get(cacheKey);
+            if (cached !== undefined) {
+                let cachedSessionRestored = false;
+                try {
+                    await (0, hydrateStorageState_1.hydrateStorageState)(page.context(), cached);
+                    await page.goto("/");
+                    await page.locator("#host-layout-content").waitFor({ state: "visible", timeout: 15000 });
+                    cachedSessionRestored = true;
+                }
+                catch {
+                    _loginCache.delete(cacheKey);
+                }
+                if (cachedSessionRestored) {
+                    await (0, exports.waitForMainMenuReady)(page, testInfo);
+                    return;
+                }
             }
-        }
-        if (now() >= deadline) {
-            break;
-        }
-        if (now() === started) {
-            const mark = `${page.url?.() ?? ""}|${String(watcher.revision())}|${String(acceptedPrompt)}`;
-            const left = deadline - now();
-            if (left <= 0) {
-                break;
+            (0, exports.reserveFeatureBranchLoginBudget)(testInfo);
+            await (0, exports.performOktaLogin)({ page, baseURL, credentials, testInfo });
+            // Capture the fully-authenticated state for reuse by later tests in
+            // this worker. Errors here would mask the actual login success, so we
+            // never let snapshot capture throw — at worst we'll re-hit Okta next
+            // time, which is the pre-cache behaviour.
+            try {
+                const snapshot = await page.context().storageState();
+                _loginCache.set(cacheKey, snapshot);
             }
-            await pause(Math.min(exports.TERMS_GATE_QUIET_MS, left));
-            const after = `${page.url?.() ?? ""}|${String(watcher.revision())}|${String(acceptedPrompt)}`;
-            if (now() === started && after === mark) {
-                throw new hostReadiness_1.HostNeverBecameReadyError();
+            catch {
+                /* Snapshot capture is best-effort; failing here is non-fatal. */
             }
-        }
-    }
-    throw new hostReadiness_1.HostNeverBecameReadyError();
-};
+            await (0, exports.waitForMainMenuReady)(page, testInfo);
+        };
+        await provide(loginFn);
+    },
+});
 const openDefaultRequestContext = async (baseURL) => {
     const context = await test_1.request.newContext({ baseURL });
     return {
@@ -492,18 +318,14 @@ const gotoSessionDocument = async (page, url, now, deadline, pause) => {
 /**
  * Performs the slow path: wait for the branch host to serve `/env`, hit Okta's
  * `/api/v1/authn`, redeem the `sessionToken` via the manager-classic redirect,
- * and wait for the host layout to render. On a feature-branch host it then
- * finishes the terms prompt and waits for the main shell inside the same
- * budget. Factored out so the cache hit/miss branches read clearly.
+ * and wait for the host layout to render. Factored out so the cache hit/miss
+ * branches read clearly.
  *
  * `createRequestContext`, `now`, and `sleep` are injectable so a unit test can
- * drive the session handoff and the terms prompt without a browser or a real
- * three-minute wait.
+ * drive the session handoff without a browser or a real three-minute wait.
  */
 const performOktaLogin = async ({ page, baseURL, credentials, testInfo, createRequestContext = openDefaultRequestContext, now = Date.now, sleep: pause = sleep, }) => {
     const context = await createRequestContext(baseURL);
-    // Before the session navigation: the menu can render before TermsGate redirects.
-    const termsWatcher = startFeatureBranchTermsWatch(page);
     try {
         const env = await readHostEnv(context, baseURL, testInfo);
         const domainValue = env.auth?.url;
@@ -511,10 +333,9 @@ const performOktaLogin = async ({ page, baseURL, credentials, testInfo, createRe
             throw new Error(`No domain found from servers /env found env: ${JSON.stringify(env)}`);
         }
         const domain = domainValue;
-        // Started once `/env` is ready. The Okta post, the session document, the
-        // handoff, the terms prompt and the shell wait share this window. Only the
-        // document, the handoff and the prompt are retried against it; the post keeps
-        // its own fixed timeout (GLU-2631, GLU-2632).
+        // Started once `/env` is ready. The Okta post, the session document and the
+        // handoff all run inside this window; only the last two are retried against
+        // it, the post keeps its own fixed timeout (GLU-2631).
         const readyDeadline = (0, hostReadiness_1.isFeatureBranchHost)() ? now() + exports.MAIN_MENU_READY_TIMEOUT_MS : undefined;
         const authResponse = await context.post(`${domain}/api/v1/authn`, {
             data: {
@@ -536,89 +357,12 @@ const performOktaLogin = async ({ page, baseURL, credentials, testInfo, createRe
         await gotoSessionDocument(page, `/auth/manager-classic#session_token=${sessionToken}&userProfile=true`, now, readyDeadline, pause);
         await waitForSessionHandoff(page, now, readyDeadline);
         await page.locator("#host-layout-content").waitFor({ state: "visible", timeout: 15000 });
-        if (readyDeadline !== undefined) {
-            await finishFeatureBranchTerms({
-                page,
-                watcher: termsWatcher,
-                now,
-                sleep: pause,
-                deadline: readyDeadline,
-            });
-        }
     }
     finally {
-        termsWatcher.stop();
         await context.dispose();
     }
 };
 exports.performOktaLogin = performOktaLogin;
-/**
- * Signs in, reusing this worker's cached session when one exists.
- *
- * `now` and `sleep` are injectable so a unit test can drive the restored
- * feature-branch terms wait without a browser or a real three-minute clock.
- * Production uses `Date.now` and the event loop.
- */
-const signIn = async ({ page, baseURL, cache, testInfo, options, now = Date.now, sleep: pause = sleep, createRequestContext, }) => {
-    const credentials = await (0, resolveCredentials_1.resolveCredentials)(options);
-    const cacheKey = (0, loginCacheKey_1.buildLoginCacheKey)(baseURL, credentials);
-    const cached = cache.get(cacheKey);
-    if (cached !== undefined) {
-        let cachedSessionRestored = false;
-        const termsWatcher = startFeatureBranchTermsWatch(page);
-        try {
-            try {
-                await (0, hydrateStorageState_1.hydrateStorageState)(page.context(), cached);
-                await page.goto("/");
-                await page.locator("#host-layout-content").waitFor({ state: "visible", timeout: 15000 });
-                if ((0, hostReadiness_1.isFeatureBranchHost)()) {
-                    // The terms wait can use the whole three-minute budget. Reserve it
-                    // before that wait: the miss-path call below is skipped when restore
-                    // succeeds, and the menu wait extends the timeout only after this returns.
-                    (0, exports.reserveFeatureBranchLoginBudget)(testInfo);
-                    const deadline = now() + exports.MAIN_MENU_READY_TIMEOUT_MS;
-                    await finishFeatureBranchTerms({
-                        page,
-                        watcher: termsWatcher,
-                        now,
-                        sleep: pause,
-                        deadline,
-                    });
-                }
-                cachedSessionRestored = true;
-            }
-            catch (error) {
-                if (error instanceof hostReadiness_1.HostNeverBecameReadyError) {
-                    throw error;
-                }
-                cache.delete(cacheKey);
-            }
-            if (cachedSessionRestored) {
-                await (0, exports.waitForMainMenuReady)(page, testInfo);
-                return;
-            }
-        }
-        finally {
-            termsWatcher.stop();
-        }
-    }
-    (0, exports.reserveFeatureBranchLoginBudget)(testInfo);
-    await (0, exports.performOktaLogin)({ page, baseURL, credentials, testInfo, now, sleep: pause, createRequestContext });
-    await (0, exports.waitForMainMenuReady)(page, testInfo);
-    // Capture only after the shell is ready. A feature-branch host can sit
-    // on `/terms` with the layout mounted; storing that snapshot would reuse
-    // a session whose prompt is not finished (GLU-2632). Errors here would
-    // mask the actual login success, so snapshot capture never throws — at
-    // worst we'll re-hit Okta next time, which is the pre-cache behaviour.
-    try {
-        const snapshot = await page.context().storageState();
-        cache.set(cacheKey, snapshot);
-    }
-    catch {
-        /* Snapshot capture is best-effort; failing here is non-fatal. */
-    }
-};
-exports.signIn = signIn;
 var test_2 = require("@playwright/test");
 Object.defineProperty(exports, "expect", { enumerable: true, get: function () { return test_2.expect; } });
 //# sourceMappingURL=login.fixture.js.map

package/migrations/entry.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"entry.js","sourceRoot":"","sources":["../../../../../libs/iris-app-sdk/iris-app-playwright/migrations/entry.ts"],"names":[],"mappings":"","sourcesContent":["export {};\n"]}

package/src/credentials/guards.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"guards.js","sourceRoot":"","sources":["../../../../../../libs/iris-app-sdk/iris-app-playwright/src/credentials/guards.ts"],"names":[],"mappings":";;;AAAA,oEAAoE;AAC7D,MAAM,QAAQ,GAAG,CAAC,KAAc,EAAoC,EAAE,CAC3E,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AADjC,QAAA,QAAQ,YACyB","sourcesContent":["/** Narrows `unknown` to a plain object without a type assertion. */\nexport const isRecord = (value: unknown): value is Record<string, unknown> =>\n  typeof value === \"object\" && value !== null;\n"]}

package/src/credentials/keys.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.js","sourceRoot":"","sources":["../../../../../../libs/iris-app-sdk/iris-app-playwright/src/credentials/keys.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH;;;;;;GAMG;AACI,MAAM,eAAe,GAAG,CAAC,QAAgB,EAAU,EAAE,CAC1D,QAAQ;KACL,WAAW,EAAE;KACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;KAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAJhB,QAAA,eAAe,mBAIC;AAE7B,+EAA+E;AACxE,MAAM,YAAY,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,UAAU,IAAA,uBAAe,EAAC,QAAQ,CAAC,EAAE,CAAC;AAAnF,QAAA,YAAY,gBAAuE;AAEhG;;;;;;GAMG;AACI,MAAM,gBAAgB,GAAG,CAAC,QAAgB,EAAU,EAAE,CAAC,IAAA,oBAAY,EAAC,QAAQ,CAAC,CAAC;AAAxE,QAAA,gBAAgB,oBAAwD","sourcesContent":["/**\n * Credential-key derivation for the manager E2E password lookup (GLU-1451 / GLU-1452).\n *\n * An `auth.json` fixture identifies its account by `username` only — the password\n * is resolved at runtime by a stable key derived from the name: from a CircleCI\n * env variable in CI and from Vault locally.\n *\n * The `E2E_PW_<SLUG>` convention MUST stay in sync with the publish side in\n * `devtools/e2e-okta-rotation/slug.ts` (which writes the CircleCI/Vault values).\n */\n\n/**\n * Uppercase slug of an account name: non-alphanumeric runs collapse to a single\n * `_`, with leading/trailing separators trimmed. Keeps account names with spaces\n * and dashes valid as env-var/Vault-field keys.\n *\n * `Team Helios - E2E Test` -> `TEAM_HELIOS_E2E_TEST`\n */\nexport const slugifyUsername = (username: string): string =>\n  username\n    .toUpperCase()\n    .replace(/[^A-Z0-9]+/g, \"_\")\n    .replace(/^_+|_+$/g, \"\");\n\n/** The environment-variable key for an account's password: `E2E_PW_<SLUG>`. */\nexport const deriveEnvKey = (username: string): string => `E2E_PW_${slugifyUsername(username)}`;\n\n/**\n * The Vault field key for an account's password. This is the **same** key as the\n * env variable (`E2E_PW_<SLUG>`): the publish side writes each account's password\n * to a Vault field named by `devtools/e2e-okta-rotation/slug.ts`'s `envKey()`\n * (`E2E_PW_<SLUG>`), so the resolver must read it back under that exact key. A\n * lowercased-slug field would never be found once Vault is seeded.\n */\nexport const deriveVaultField = (username: string): string => deriveEnvKey(username);\n"]}

package/src/credentials/resolveE2EPassword.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"resolveE2EPassword.js","sourceRoot":"","sources":["../../../../../../libs/iris-app-sdk/iris-app-playwright/src/credentials/resolveE2EPassword.ts"],"names":[],"mappings":";;;;AAAA,2BAAkC;AAClC,+CAAyB;AACzB,mDAA6B;AAC7B,gEAA6D;AAC7D,qCAAoC;AACpC,iCAAwD;AAwBxD;;;GAGG;AACH,MAAM,cAAc,GAAG,CAAC,MAAe,EAAE,KAAa,EAAsB,EAAE;IAC5E,IAAI,CAAC,IAAA,iBAAQ,EAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC;IAC1B,IAAI,CAAC,IAAA,iBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,MAAM,GAAG,IAAA,iBAAQ,EAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,KAAK,EAAE,GAAsB,EAAoC,EAAE;IAC5F,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACtC,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC,CAAC,6BAA6B;IACjD,CAAC;IACD,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QACjB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,GAAG,CAAC,kBAAkB,IAAI,GAAG,CAAC,cAAc,CAAC;IAC9D,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CACb,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,+EAA+E;IAC/E,8EAA8E;IAC9E,wEAAwE;IACxE,MAAM,SAAS,GAAG,MAAM,0DAAO,YAAY,IAAE,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,6FAA6F;YAC3F,wCAAwC,CAC3C,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,gFAAgF;IAChF,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC;QAC/B,QAAQ;QACR,KAAK;QACL,cAAc,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,KAAM,EAAE;KACrD,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;AACzD,CAAC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,uBAAuB,GAAwB,IAAI,GAAG,CAAC;IAC3D,WAAW;IACX,WAAW;IACX,cAAc;IACd,YAAY;IACZ,WAAW;IACX,iBAAiB;IACjB,cAAc;IACd,aAAa;CACd,CAAC,CAAC;AAEH,2GAA2G;AAC3G,MAAM,uBAAuB,GAAG,CAAC,KAAc,EAAW,EAAE;IAC1D,IAAI,CAAC,IAAA,iBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;IACxB,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,uBAAuB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC,CAAC;AAEF;;;;;;GAMG;AACH,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAE9E,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAsB,EAAE;IACjE,IAAI,CAAC,IAAA,iBAAQ,EAAC,KAAK,CAAC,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAChC,IAAI,CAAC,IAAA,iBAAQ,EAAC,QAAQ,CAAC,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;IACvC,OAAO,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC,CAAC;AAEF,4FAA4F;AAC5F,MAAM,IAAI,GAAG,CAAC,OAAe,EAAS,EAAE;IACtC,MAAM,IAAI,KAAK,CAAC,IAAA,iCAAe,EAAC,OAAO,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC;AAEF,MAAM,aAAa,GAAG,IAAI,GAAG,EAA8B,CAAC;AAE5D;;;;;GAKG;AACI,MAAM,qBAAqB,GAAG,GAAS,EAAE;IAC9C,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC,CAAC;AAFW,QAAA,qBAAqB,yBAEhC;AAEF;;;;;;;;;;;;GAYG;AACI,MAAM,kBAAkB,GAAG,KAAK,EACrC,QAAgB,EAChB,UAAqC,EAAE,EACtB,EAAE;IACnB,IAAI,QAAQ,KAAK,EAAE,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QACjD,OAAO,IAAI,CAAC,yDAAyD,QAAQ,KAAK,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,GAAG,GAAG,IAAA,mBAAY,EAAC,QAAQ,CAAC,CAAC;IAEnC,uEAAuE;IACvE,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrC,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,4DAA4D;IAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC;IAC9D,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,IAAI,CACT,wBAAwB,QAAQ,uBAAuB,GAAG,6BAA6B;YACrF,gEAAgE,GAAG,CAAC,kBAAkB,6DAA6D,CACtJ,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,GAAG,CAAC,cAAc,CAAC;IACvC,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,IAAI,CAAC,2BAA2B,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,QAAQ,GAAG,WAAW,CAAC;IAE7B,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,uBAAuB,CAAC,KAAK,CAAC,EAAE,CAAC;YACnC,OAAO,IAAI,CACT,wBAAwB,QAAQ,mCAAmC;gBACjE,+DAA+D;gBAC/D,4CAA4C,GAAG,0DAA0D,GAAG,CAAC,kBAAkB,GAAG,CACrI,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,SAAS,IAAI,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrE,OAAO,IAAI,CACT,wBAAwB,QAAQ,uCAAuC,MAAM,MAAM;gBACjF,0CAA0C;gBAC1C,6CAA6C,GAAG,CAAC,kBAAkB,iDAAiD,GAAG,+EAA+E,GAAG,CAAC,kBAAkB,GAAG,CAClO,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CACT,wBAAwB,QAAQ,qBAAqB,QAAQ,oBAAoB,GAAG,CAAC,kBAAkB,GAAG,CAC3G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,cAAc,CAAC,MAAM,EAAE,IAAA,uBAAgB,EAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,IAAI,CACT,wBAAwB,QAAQ,gBAAgB,IAAA,uBAAgB,EAAC,QAAQ,CAAC,oBAAoB,QAAQ,IAAI,CAC3G,CAAC;IACJ,CAAC;IACD,aAAa,CAAC,GAAG,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACvC,OAAO,SAAS,CAAC;AACnB,CAAC,CAAC;AAtEW,QAAA,kBAAkB,sBAsE7B","sourcesContent":["import { readFileSync } from \"fs\";\nimport * as os from \"os\";\nimport * as path from \"path\";\nimport { redactSensitive } from \"../plugins/redactSensitive\";\nimport { isRecord } from \"./guards\";\nimport { deriveEnvKey, deriveVaultField } from \"./keys\";\n\n/**\n * Minimal structural view of the `node-vault` client's KV read: it returns\n * `{ data: ... }` (KV v1) or `{ data: { data: ... } }` (KV v2). Kept as an\n * interface so tests inject a fake and neither `node-vault` nor a real\n * Vault/VPN is needed. `read` returns `unknown` so callers narrow structurally\n * (no `as` cast at the boundary).\n */\nexport interface VaultReader {\n  read(secretPath: string): Promise<unknown>;\n}\n\nexport interface ResolveE2EPasswordOptions {\n  /** Process env to read (env-first precedence). Defaults to `process.env`. */\n  env?: NodeJS.ProcessEnv;\n  /**\n   * Vault client factory (local path). Returns `undefined` when Vault can't be\n   * reached/authenticated (e.g. no `~/.vault-token`). Defaults to a `node-vault`\n   * client using the local token, matching `libs/server/vault`.\n   */\n  createVault?: (env: NodeJS.ProcessEnv) => Promise<VaultReader | undefined>;\n}\n\n/**\n * Reads a field from a node-vault KV read result. KV v2 nests the fields under\n * `data.data`; KV v1 puts them directly on `data`. Narrows structurally.\n */\nconst readVaultField = (result: unknown, field: string): string | undefined => {\n  if (!isRecord(result)) {\n    return undefined;\n  }\n  const outer = result.data;\n  if (!isRecord(outer)) {\n    return undefined;\n  }\n  const fields = isRecord(outer.data) ? outer.data : outer;\n  const value = fields[field];\n  return typeof value === \"string\" && value !== \"\" ? value : undefined;\n};\n\n/**\n * Default Vault client: reads the local `~/.vault-token` and points `node-vault`\n * at the endpoint from `E2E_VAULT_ENDPOINT` (or `VAULT_ENDPOINT`).\n *\n * The Vault address is **never hardcoded** — it is supplied by the environment,\n * so any consumer of this package can opt into their own Vault. `node-vault` is\n * an optional peer dependency, imported lazily and only on the local path, so\n * consumers that only use the env-var (CI) path never load it.\n */\nconst defaultCreateVault = async (env: NodeJS.ProcessEnv): Promise<VaultReader | undefined> => {\n  const home = env.HOME ?? os.homedir();\n  let token: string;\n  try {\n    token = readFileSync(path.join(home, \".vault-token\"), \"utf-8\").trim();\n  } catch {\n    return undefined; // not logged in / not on VPN\n  }\n  if (token === \"\") {\n    return undefined;\n  }\n  const endpoint = env.E2E_VAULT_ENDPOINT ?? env.VAULT_ENDPOINT;\n  if (endpoint === undefined || endpoint === \"\") {\n    throw new Error(\n      \"E2E credentials: a Vault token was found but no endpoint — set E2E_VAULT_ENDPOINT (or VAULT_ENDPOINT) to your Vault address.\"\n    );\n  }\n  // Imported lazily so consumers on the env-var path (and unit tests, which\n  // inject `createVault`) never load the optional `node-vault` peer. Its absence\n  // is an expected configuration state, so fail with the resolver's actionable,\n  // redacted style instead of leaking a raw `ERR_MODULE_NOT_FOUND` stack.\n  const nodeVault = await import(\"node-vault\").catch(() => undefined);\n  if (nodeVault === undefined) {\n    return fail(\n      \"E2E credentials: install the optional `node-vault` peer dependency for local Vault lookup, \" +\n        \"or set the E2E_PW_<SLUG> env variable.\"\n    );\n  }\n  // `timeout` bounds the whole request so an off-VPN endpoint that black-holes\n  // the connection fails fast (~10s) instead of hanging until the test times out.\n  const client = nodeVault.default({\n    endpoint,\n    token,\n    requestOptions: { strictSSL: true, timeout: 10_000 },\n  });\n  return { read: secretPath => client.read(secretPath) };\n};\n\n/**\n * Node/socket error codes that mean the Vault host could not be reached at all —\n * as opposed to a reachable Vault answering with a 403/404. Off-VPN, the internal\n * Vault hostname either fails DNS (`ENOTFOUND`/`EAI_AGAIN`) or the connection is\n * refused/timed out, so these map to an actionable \"connect to the VPN\" hint.\n */\nconst VAULT_UNREACHABLE_CODES: ReadonlySet<string> = new Set([\n  \"ENOTFOUND\",\n  \"EAI_AGAIN\",\n  \"ECONNREFUSED\",\n  \"ECONNRESET\",\n  \"ETIMEDOUT\",\n  \"ESOCKETTIMEDOUT\",\n  \"EHOSTUNREACH\",\n  \"ENETUNREACH\",\n]);\n\n/** True when a thrown Vault-read error is a transport failure (host unreachable), not an HTTP response. */\nconst isVaultUnreachableError = (error: unknown): boolean => {\n  if (!isRecord(error)) {\n    return false;\n  }\n  const code = error.code;\n  return typeof code === \"string\" && VAULT_UNREACHABLE_CODES.has(code);\n};\n\n/**\n * HTTP statuses a *reachable* Vault returns when the caller's token is missing,\n * invalid, or expired — i.e. \"not logged in / not authenticated\" (as opposed to a\n * 404 for a real missing path). `node-vault` attaches the HTTP response to the\n * thrown error as `error.response.statusCode`, so we narrow to it structurally\n * rather than making an extra `tokenLookupSelf` round-trip.\n */\nconst VAULT_UNAUTHENTICATED_STATUS: ReadonlySet<number> = new Set([401, 403]);\n\n/** Extracts the HTTP status code from a thrown `node-vault` read error, if present. */\nconst getVaultErrorStatus = (error: unknown): number | undefined => {\n  if (!isRecord(error)) {\n    return undefined;\n  }\n  const response = error.response;\n  if (!isRecord(response)) {\n    return undefined;\n  }\n  const statusCode = response.statusCode;\n  return typeof statusCode === \"number\" ? statusCode : undefined;\n};\n\n/** Throws an error whose message is routed through `redactSensitive` (defence in depth). */\nconst fail = (message: string): never => {\n  throw new Error(redactSensitive(message));\n};\n\nconst passwordCache = new Map<string, string | undefined>();\n\n/**\n * Clears the in-memory resolved-password cache. The cache is a module-level\n * singleton that lives for the whole process, so a resolved value would\n * otherwise leak across calls (and across test cases). Call this between tests\n * to keep each `resolveE2EPassword` call independent.\n */\nexport const resetE2EPasswordCache = (): void => {\n  passwordCache.clear();\n};\n\n/**\n * Resolves an account's E2E password by name.\n *\n * Order: env variable `E2E_PW_<SLUG>` (CI path, never touches Vault) -> Vault\n * field `<slug>` (local path). Throws a clear, account-named, redacted error on\n * miss. The password is never included in any error/diagnostic (on failure there\n * is no resolved value to leak).\n *\n * @param username - Account identifier from the fixture (`auth.json` `username`).\n * @param options - Process env and Vault-client seams.\n * @returns {Promise<string>} The resolved password.\n * @throws when the fixture is a placeholder, or neither env nor Vault yields a value.\n */\nexport const resolveE2EPassword = async (\n  username: string,\n  options: ResolveE2EPasswordOptions = {}\n): Promise<string> => {\n  if (username === \"\" || username === \"REPLACE_ME\") {\n    return fail(`E2E credentials: fixture account name is unresolved (\"${username}\").`);\n  }\n  const cached = passwordCache.get(username);\n  if (cached !== undefined) {\n    return cached;\n  }\n\n  const env = options.env ?? process.env;\n  const key = deriveEnvKey(username);\n\n  // CI path: an injected env variable wins and Vault is never contacted.\n  const fromEnv = env[key];\n  if (fromEnv !== undefined && fromEnv !== \"\") {\n    passwordCache.set(username, fromEnv);\n    return fromEnv;\n  }\n\n  // Local path: read the password from Vault by the same key.\n  const createVault = options.createVault ?? defaultCreateVault;\n  const vault = await createVault(env);\n  if (vault === undefined) {\n    return fail(\n      `E2E credentials for \"${username}\": no env variable (${key}) and Vault is unavailable ` +\n        `(not authenticated / not on VPN). Run \\`vault login -address=${env.E2E_VAULT_ENDPOINT} -method=oidc -path=okta\\` on VPN, or set the env variable.`\n    );\n  }\n\n  const logicalPath = env.E2E_VAULT_PATH;\n  if (!logicalPath) {\n    return fail(\"E2E_VAULT_PATH is not set\");\n  }\n  const readPath = logicalPath;\n\n  let result: unknown;\n  try {\n    result = await vault.read(readPath);\n  } catch (error) {\n    if (isVaultUnreachableError(error)) {\n      return fail(\n        `E2E credentials for \"${username}\": Vault endpoint is unreachable ` +\n          `(likely not on VPN, or E2E_VAULT_ENDPOINT is misconfigured). ` +\n          `Connect to the VPN and retry, or set the ${key} env variable, right now vault is trying to connect to ${env.E2E_VAULT_ENDPOINT}.`\n      );\n    }\n    const status = getVaultErrorStatus(error);\n    if (status !== undefined && VAULT_UNAUTHENTICATED_STATUS.has(status)) {\n      return fail(\n        `E2E credentials for \"${username}\": Vault rejected the request (HTTP ${status}) — ` +\n          `your Vault token is missing or expired. ` +\n          `Run something like \\`vault login -address=${env.E2E_VAULT_ENDPOINT} -method=oidc -path=okta\\` on VPN, or set the ${key} env variable, right now vault is trying to connect to a logged in vault at ${env.E2E_VAULT_ENDPOINT}.`\n      );\n    }\n    return fail(\n      `E2E credentials for \"${username}\": Vault read of \"${readPath}\" failed on host ${env.E2E_VAULT_ENDPOINT}.`\n    );\n  }\n\n  const fromVault = readVaultField(result, deriveVaultField(username));\n  if (fromVault === undefined) {\n    return fail(\n      `E2E credentials for \"${username}\": no field \"${deriveVaultField(username)}\" at Vault path \"${readPath}\".`\n    );\n  }\n  passwordCache.set(username, fromVault);\n  return fromVault;\n};\n"]}