@zitadel/testing 0.1.0-alpha.18 → 0.1.0-alpha.19

package/README.md

@@ -70,6 +70,24 @@ apps; the console maps the same fields to `VITE_*`/`CONSOLE_*` names instead.
 The fixtures find the instance through `ZITADEL_TESTING_HANDSHAKE`, which
 `withZitadel()` points at its handshake file.
 
+`app` is optional. Omit it when the instance itself serves the app — the
+Zitadel binary embeds the console and hosted sign-in at `/ui/console/` and
+`/ui/login/`, so a suite testing those surfaces has no second server to boot.
+Only the instance entry is generated, and `appOrigin` must then be the
+instance's own local origin:
+
+```ts
+export default defineConfig({
+  testDir: "./e2e",
+  use: { baseURL: "http://localhost:8092" },
+  ...withZitadel({
+    configDir: import.meta.dirname,
+    port: 8092,
+    appOrigin: "http://localhost:8092", // the instance is the app server
+  }),
+});
+```
+
 ### Start tests authenticated
 
 Most app tests don't want to re-test login. `authenticatedPage` seeds a user,
@@ -181,7 +199,7 @@ const z = await startLocalZitadel({
   appOrigins,    // registered as the project's preview_origins
   useCase,       // "minimal" (default) | "consumer" | "business"
   preset,        // "password-first" (default)
-  serverBinary,  // ZITADEL_SERVER_BINARY override (in-repo: dist/server/nextgen)
+  serverBinary,  // ZITADEL_SERVER_BINARY override (path to a built server binary)
   keep,          // keep the temp dir for debugging
 });
 
@@ -219,7 +237,8 @@ above.
   bearer for everything else) → `POST /schemas` (server assigns the schema id)
   → `POST /flow_definitions` (default login flow pinned to that schema id).
   Templates come from `@zitadel/config/defaults`.
-- **Seeding** is `POST /users` (the body carries `$schema: <schema id>`) +
+- **Seeding** is `POST /users` (the body names the schema in `schema` and puts
+  the schema-defined content under `attributes`) +
   `PUT /users/{id}/password` with `is_change_required: false`.
 
 ## Parallelism model
@@ -229,7 +248,7 @@ project, so per-test `seed.user()` calls are isolation enough for login-flow
 tests, and tests run fully parallel against the shared instance
 (demonstrated by `demo-next-e2e:e2e-real`, 2 workers).
 
-Typical timings with the SQLite local default (dev build, July 2026 — estimates, not a fresh remeasure):
+Typical timings with the SQLite local default (dated estimates from a July 2026 dev build — orders of magnitude, not a benchmark; remeasure locally before relying on them):
 
 | Operation | Time |
 | --- | --- |
@@ -259,10 +278,12 @@ Customer installs get the published server binary through `@zitadel/server`'s
 platform packages; the in-repo workspace carries no such binary, so the repo's
 own suites run `moon run server:build` and point the kit at the result via
 `ZITADEL_SERVER_BINARY` (the `withZitadel` option `zitadel.serverBinary` /
-`serverBinaryHint` exists for this). The in-repo moon tasks set
+`serverBinaryHint` exists for this). Most in-repo moon tasks set
 `NEXTGEN_SERVER_LOGIN_ENABLED=false` / `NEXTGEN_SERVER_CONSOLE_ENABLED=false`
-— the suites drive the app-embedded login, not the server-hosted `/ui/*`.
-Customer installs need none of this.
+because they drive the app-embedded login, not the server-hosted `/ui/*`; the
+exception is `console-e2e:e2e-embedded`, which keeps both surfaces on and
+omits `app` — the binary-served `/ui/*` pages are its subject. Customer
+installs need none of this.
 
 ## Known limitations
 

package/dist/{app-env-D3W0GYhA.d.mts → app-env-Btmfcflb.d.mts}

@@ -16,9 +16,9 @@ interface InstanceHandle {
    */
   appOrigin?: string;
   /**
-   * Server-assigned id of the seeded user schema. User documents must
-   * reference it via their `$schema` field, so seeding needs it alongside the
-   * project credential.
+   * Server-assigned id of the seeded user schema. A user names it in `schema`
+   * and puts the schema-defined content under `attributes`, so seeding needs
+   * it alongside the project credential.
    */
   schemaId: string;
   previewSecret?: string;
@@ -119,4 +119,4 @@ declare const nextAppEnv: AppEnvTemplate;
 declare function applyAppEnvTemplate(template: AppEnvTemplate, handle: InstanceHandle): Record<string, string>;
 //#endregion
 export { Identity as a, LocalZitadelRuntime as c, SeedUserInput as d, SeedUsersTemplate as f, ConnectedZitadel as i, MintedSession as l, SessionCookie as m, applyAppEnvTemplate as n, InstanceHandle as o, SeededUser as p, nextAppEnv as r, LocalZitadel as s, AppEnvTemplate as t, SeedSessionInput as u };
-//# sourceMappingURL=app-env-D3W0GYhA.d.mts.map
+//# sourceMappingURL=app-env-Btmfcflb.d.mts.map

package/dist/{app-env-D3W0GYhA.d.mts.map → app-env-Btmfcflb.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"app-env-D3W0GYhA.d.mts","names":[],"sources":["../src/types.ts","../src/app-env.ts"],"mappings":";;;;;AAMA;;UAAiB,cAAA;EACf,OAAA;EACA,SAAA;EACA,aAAA;EAAA;;;;;EAMA,SAAA;EAUe;;;;;EAJf,QAAA;EACA,aAAA;AAAA;AAAA,UAGe,aAAA;EACf,KAAA;EACA,QAAA;EAKyB;EAHzB,UAAA,GAAa,MAAA;AAAA;AAAA,UAGE,UAAA;EACf,EAAA;EACA,KAAA;EACA,QAAA;AAAA;AAIF;AAAA,UAAiB,QAAA;EACf,KAAA;EACA,QAAA;AAAA;AAIF;AAAA,UAAiB,aAAA;EACf,IAAA;EACA,KAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;EACA,IAAA;AAAA;AAAA,UAGe,aAAA;EACf,IAAA,EAAM,UAAA;EAJF;EAMJ,YAAA;EACA,SAAA;EACA,MAAA,EAAQ,aAAA;AAAA;AAAA,UAGO,gBAAA,SAAyB,aAAA;EAPlC;EASN,IAAA,GAAO,UAAA;EANP;EAQA,kBAAA;EAPQ;;;AAGV;;EAUE,MAAA;AAAA;AAAA,UAGe,iBAAA;EACf,KAAA,IAAS,KAAA;EACT,QAAA,IAAY,KAAA;EACZ,UAAA,IAAc,KAAA,aAAkB,MAAA;AAAA;AAAA,UAGjB,gBAAA;EACf,MAAA,EAAQ,cAAA;EAPO;EASf,GAAA,EAAK,aAAA;;EAEL,MAAA,EAAQ,MAAA;EACR,QAAA,CAAS,KAAA,GAAQ,aAAA,GAAgB,OAAA,CAAQ,UAAA;EAXhC;EAaT,SAAA,CAAU,KAAA,UAAe,QAAA,GAAW,iBAAA,GAAoB,OAAA,CAAQ,UAAA;EAZpD;EAcZ,QAAA,IAAY,QAAA;EAbE;;;;AAGhB;EAgBE,WAAA,CAAY,KAAA,GAAQ,gBAAA,GAAmB,OAAA,CAAQ,aAAA;AAAA;AAAA,UAGhC,mBAAA;EACf,IAAA;EACA,GAAA;EAfiB;EAiBjB,GAAA;EACA,OAAA;AAAA;AAAA,UAGe,YAAA,SAAqB,gBAAA,EAAkB,eAAA;EACtD,OAAA,EAAS,mBAAA;EACT,IAAA,IAAQ,OAAA;AAAA;;;;;AAxGV;;;;KCEY,cAAA,GAAiB,MAAA,eAAqB,cAAA;;;;;;cAOrC,UAAA,EAAY,cAAA;AAAA,iBAMT,mBAAA,CACd,QAAA,EAAU,cAAA,EACV,MAAA,EAAQ,cAAA,GACP,MAAA"}
+{"version":3,"file":"app-env-Btmfcflb.d.mts","names":[],"sources":["../src/types.ts","../src/app-env.ts"],"mappings":";;;;;AAMA;;UAAiB,cAAA;EACf,OAAA;EACA,SAAA;EACA,aAAA;EAAA;;;;;EAMA,SAAA;EAUe;;;;;EAJf,QAAA;EACA,aAAA;AAAA;AAAA,UAGe,aAAA;EACf,KAAA;EACA,QAAA;EAKyB;EAHzB,UAAA,GAAa,MAAA;AAAA;AAAA,UAGE,UAAA;EACf,EAAA;EACA,KAAA;EACA,QAAA;AAAA;AAIF;AAAA,UAAiB,QAAA;EACf,KAAA;EACA,QAAA;AAAA;AAIF;AAAA,UAAiB,aAAA;EACf,IAAA;EACA,KAAA;EACA,QAAA;EACA,MAAA;EACA,QAAA;EACA,IAAA;AAAA;AAAA,UAGe,aAAA;EACf,IAAA,EAAM,UAAA;EAJF;EAMJ,YAAA;EACA,SAAA;EACA,MAAA,EAAQ,aAAA;AAAA;AAAA,UAGO,gBAAA,SAAyB,aAAA;EAPlC;EASN,IAAA,GAAO,UAAA;EANP;EAQA,kBAAA;EAPQ;;;AAGV;;EAUE,MAAA;AAAA;AAAA,UAGe,iBAAA;EACf,KAAA,IAAS,KAAA;EACT,QAAA,IAAY,KAAA;EACZ,UAAA,IAAc,KAAA,aAAkB,MAAA;AAAA;AAAA,UAGjB,gBAAA;EACf,MAAA,EAAQ,cAAA;EAPO;EASf,GAAA,EAAK,aAAA;;EAEL,MAAA,EAAQ,MAAA;EACR,QAAA,CAAS,KAAA,GAAQ,aAAA,GAAgB,OAAA,CAAQ,UAAA;EAXhC;EAaT,SAAA,CAAU,KAAA,UAAe,QAAA,GAAW,iBAAA,GAAoB,OAAA,CAAQ,UAAA;EAZpD;EAcZ,QAAA,IAAY,QAAA;EAbE;;;;AAGhB;EAgBE,WAAA,CAAY,KAAA,GAAQ,gBAAA,GAAmB,OAAA,CAAQ,aAAA;AAAA;AAAA,UAGhC,mBAAA;EACf,IAAA;EACA,GAAA;EAfiB;EAiBjB,GAAA;EACA,OAAA;AAAA;AAAA,UAGe,YAAA,SAAqB,gBAAA,EAAkB,eAAA;EACtD,OAAA,EAAS,mBAAA;EACT,IAAA,IAAQ,OAAA;AAAA;;;;;AAxGV;;;;KCEY,cAAA,GAAiB,MAAA,eAAqB,cAAA;;;;;;cAOrC,UAAA,EAAY,cAAA;AAAA,iBAMT,mBAAA,CACd,QAAA,EAAU,cAAA,EACV,MAAA,EAAQ,cAAA,GACP,MAAA"}

package/dist/index.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("./src-DirKLqi4.cjs");
+const require_src = require("./src-I0KAh1zU.cjs");
 const require_handshake = require("./handshake-CRKcgkfN.cjs");
 exports.SESSION_COOKIE_NAME = require_src.SESSION_COOKIE_NAME;
 exports.applyAppEnvTemplate = require_handshake.applyAppEnvTemplate;

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-import { a as Identity, c as LocalZitadelRuntime, d as SeedUserInput, f as SeedUsersTemplate, i as ConnectedZitadel, l as MintedSession, m as SessionCookie, n as applyAppEnvTemplate, o as InstanceHandle, p as SeededUser, r as nextAppEnv, s as LocalZitadel, t as AppEnvTemplate, u as SeedSessionInput } from "./app-env-D3W0GYhA.mjs";
+import { a as Identity, c as LocalZitadelRuntime, d as SeedUserInput, f as SeedUsersTemplate, i as ConnectedZitadel, l as MintedSession, m as SessionCookie, n as applyAppEnvTemplate, o as InstanceHandle, p as SeededUser, r as nextAppEnv, s as LocalZitadel, t as AppEnvTemplate, u as SeedSessionInput } from "./app-env-Btmfcflb.mjs";
 import { ZitadelClient } from "@zitadel/api/client";
 import { SetupPreset, SetupUseCase } from "@zitadel/config/defaults";
 

package/dist/index.mjs

@@ -1,3 +1,3 @@
 import { a as nextAppEnv, i as applyAppEnvTemplate, n as waitForHandshake, r as writeHandshake, t as readHandshakeSync } from "./handshake-ClzWvG8z.mjs";
-import { a as bootstrapProject, i as bootLocalServer, n as startLocalZitadel, r as SESSION_COOKIE_NAME, t as connectZitadel } from "./src-eTcdx-ZS.mjs";
+import { a as bootstrapProject, i as bootLocalServer, n as startLocalZitadel, r as SESSION_COOKIE_NAME, t as connectZitadel } from "./src-9dFjTIAw.mjs";
 export { SESSION_COOKIE_NAME, applyAppEnvTemplate, bootLocalServer, bootstrapProject, connectZitadel, nextAppEnv, readHandshakeSync, startLocalZitadel, waitForHandshake, writeHandshake };

package/dist/playwright.cjs

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_src = require("./src-DirKLqi4.cjs");
+const require_src = require("./src-I0KAh1zU.cjs");
 const require_handshake = require("./handshake-CRKcgkfN.cjs");
 const require_orchestration = require("./orchestration-D7QBgQ0l.cjs");
 let node_fs = require("node:fs");
@@ -245,6 +245,10 @@ async function fillIfVisible(field, value) {
 * });
 * ```
 *
+* Omit `app` when the instance serves the app itself (the binary's embedded
+* `/ui/console/` and `/ui/login/` surfaces): only the boot entry is
+* generated, and `appOrigin` must be the instance's own origin.
+*
 * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the
 * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright
 * workers re-evaluate the config, which re-applies this for every process
@@ -257,9 +261,18 @@ function withZitadel(options, resolveEntry = entryPoint) {
 	if (!Number.isInteger(port) || port <= 0) throw new Error(`withZitadel: port must be a positive integer, got ${port}`);
 	const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : void 0;
 	if (!origin || origin.protocol !== "http:" && origin.protocol !== "https:" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error(`withZitadel: appOrigin must be an origin like "http://localhost:3002", got "${appOrigin}"`);
-	if (!app.readyPath.startsWith("/")) throw new Error(`withZitadel: app.readyPath must start with "/", got "${app.readyPath}"`);
-	if (app.command.length === 0) throw new Error("withZitadel: app.command must not be empty");
-	if (!(0, node_path.isAbsolute)(app.cwd)) throw new Error(`withZitadel: app.cwd must be absolute, got "${app.cwd}"`);
+	if (app === void 0) {
+		const loopbackHosts = new Set([
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		]);
+		if (origin.protocol !== "http:" || !loopbackHosts.has(origin.hostname) || (origin.port || "80") !== String(port)) throw new Error(`withZitadel: with no \`app\`, the instance itself serves the app, so appOrigin must be its local origin (http://localhost:${port}); got "${appOrigin}".`);
+	} else {
+		if (!app.readyPath.startsWith("/")) throw new Error(`withZitadel: app.readyPath must start with "/", got "${app.readyPath}"`);
+		if (app.command.length === 0) throw new Error("withZitadel: app.command must not be empty");
+		if (!(0, node_path.isAbsolute)(app.cwd)) throw new Error(`withZitadel: app.cwd must be absolute, got "${app.cwd}"`);
+	}
 	for (const [label, value] of [
 		["zitadel.serverBinary", options.zitadel?.serverBinary],
 		["zitadel.dir", options.zitadel?.dir],
@@ -278,13 +291,7 @@ function withZitadel(options, resolveEntry = entryPoint) {
 		preset: options.zitadel?.preset,
 		useCase: options.zitadel?.useCase
 	};
-	const appRunnerConfig = {
-		command: app.command,
-		cwd: app.cwd,
-		env: app.env,
-		handshakeTimeoutMs: app.readyTimeoutMs ?? 18e4
-	};
-	return { webServer: [{
+	const supervisorEntry = {
 		command: `node ${JSON.stringify(resolveEntry("supervisor"))}`,
 		url: `http://localhost:${port}/healthz`,
 		reuseExistingServer: false,
@@ -300,7 +307,15 @@ function withZitadel(options, resolveEntry = entryPoint) {
 			signal: "SIGTERM",
 			timeout: 3e4
 		}
-	}, {
+	};
+	if (app === void 0) return { webServer: [supervisorEntry] };
+	const appRunnerConfig = {
+		command: app.command,
+		cwd: app.cwd,
+		env: app.env,
+		handshakeTimeoutMs: app.readyTimeoutMs ?? 18e4
+	};
+	return { webServer: [supervisorEntry, {
 		command: `node ${JSON.stringify(resolveEntry("app-runner"))}`,
 		url: new URL(app.readyPath, appOrigin).toString(),
 		reuseExistingServer: false,
@@ -337,8 +352,11 @@ const test = _playwright_test.test.extend({
 	zitadel: [async ({}, use) => {
 		const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;
 		if (!handshakePath) throw new Error("ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file written by the script that boots the instance (see @zitadel/testing docs).");
-		await use(require_src.connectZitadel(require_handshake.readHandshakeSync(handshakePath)));
-	}, { scope: "worker" }],
+		await use(require_src.connectZitadel(await require_handshake.waitForHandshake(handshakePath)));
+	}, {
+		scope: "worker",
+		auto: true
+	}],
 	seed: async ({ zitadel, baseURL }, use) => {
 		await use({
 			user: (input) => zitadel.seedUser(input),

package/dist/playwright.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"playwright.cjs","names":["HANDSHAKE_ENV","SUPERVISOR_CONFIG_ENV","APP_RUNNER_CONFIG_ENV","base","connectZitadel","readHandshakeSync"],"sources":["../src/passkey.ts","../src/flows.ts","../src/playwright-config.ts","../src/playwright.ts"],"sourcesContent":["import type { CDPSession, Page } from \"@playwright/test\";\n\n/**\n * A virtual WebAuthn authenticator attached to one page. Ceremonies started\n * from that page (passkey registration, passkey login) complete automatically\n * — no OS authenticator dialog, no touch.\n */\nexport interface VirtualPasskey {\n  /** CDP id of the virtual authenticator, for advanced raw-protocol use. */\n  authenticatorId: string;\n  /** Number of credentials the authenticator currently stores. */\n  credentialCount(): Promise<number>;\n  /** Remove the authenticator and detach the CDP session. */\n  dispose(): Promise<void>;\n}\n\n/**\n * Attach a virtual passkey authenticator to the page via the Chrome DevTools\n * Protocol. The options mirror a platform authenticator with discoverable\n * credentials and automatic user presence — the profile the consumer journey\n * has run in CI since passkey coverage became mandatory there.\n *\n * Chromium only: the CDP WebAuthn domain does not exist in WebKit or Firefox.\n * The authenticator is bound to this page — drive registration and the later\n * login from the same page, or the credential is gone. Serve the app under\n * test on an origin WebAuthn accepts as a relying-party ID: HTTPS on a real\n * domain, or `http://localhost` for local runs — raw IP origins such as\n * `http://127.0.0.1` are invalid RP IDs.\n */\nexport async function enableVirtualPasskey(page: Page): Promise<VirtualPasskey> {\n  let client: CDPSession;\n  try {\n    client = await page.context().newCDPSession(page);\n  } catch (error) {\n    throw new Error(\n      \"enableVirtualPasskey: could not open a CDP session — passkey testing \" +\n        \"needs Chromium's virtual authenticator, so run passkey specs in a \" +\n        \"Chromium project.\",\n      { cause: error },\n    );\n  }\n  let authenticatorId: string;\n  try {\n    await client.send(\"WebAuthn.enable\");\n    ({ authenticatorId } = await client.send(\"WebAuthn.addVirtualAuthenticator\", {\n      options: {\n        protocol: \"ctap2\",\n        transport: \"internal\",\n        hasResidentKey: true,\n        hasUserVerification: true,\n        isUserVerified: true,\n        automaticPresenceSimulation: true,\n      },\n    }));\n  } catch (error) {\n    // Don't leave a half-initialized CDP session attached behind a throw.\n    await client.detach().catch(() => undefined);\n    throw error;\n  }\n\n  return {\n    authenticatorId,\n    async credentialCount() {\n      const { credentials } = await client.send(\"WebAuthn.getCredentials\", {\n        authenticatorId,\n      });\n      return credentials.length;\n    },\n    async dispose() {\n      // Best-effort: the page (and with it the CDP target) may already be\n      // gone when teardown runs after a failed test; never mask that failure.\n      // Detach even when the removal fails, so the session never outlives it.\n      try {\n        await client.send(\"WebAuthn.removeVirtualAuthenticator\", { authenticatorId });\n      } catch {\n        // ignore\n      } finally {\n        await client.detach().catch(() => undefined);\n      }\n    },\n  };\n}\n","import type { Locator, Page } from \"@playwright/test\";\n\n/**\n * Helpers that drive the `<zitadel-login>` widget through complete auth\n * ceremonies, built on the widget's documented automation hooks\n * (`zitadel-field-*` / `zitadel-input-*` on fields, `zitadel-action-*` on\n * actions — see packages/components/README.md). Field names use the\n * normalised hook token: the flow engine names credential fields\n * `x-auth-methods#password`, but the hook (and this API) says `password`.\n *\n * The ceremony helpers assume the default flow vocabulary — steps that\n * declare `submit` / `passkey` / `passkey_register` actions and `email` /\n * password fields, as `default-login.json` does. They branch only on\n * widget-observable state (which fields and actions the flow renders),\n * because customer flow configurations legitimately vary; they never\n * assert app state. Callers navigate to the widget first and assert their\n * own signed-in surface afterwards. Flows with renamed actions or custom\n * steps drive the widget directly via `flowAction` / `flowField`.\n */\n\nexport interface FlowActionOptions {\n  /**\n   * Accessible-name fallback for templates that do not emit the documented\n   * `data-testid` hooks: adds role-based button/link candidates.\n   */\n  name?: RegExp;\n}\n\nexport interface FlowFieldOptions {\n  /** Label fallback for templates that do not emit the documented hooks. */\n  label?: RegExp;\n}\n\n/**\n * One optional registration field, filled only when the flow renders it.\n * The value's type picks the control: a boolean drives a checkbox\n * (`zl-checkbox`), a string first tries a select (`zl-select`) and falls\n * back to filling a text-like input.\n */\nexport interface ProfileEntry {\n  /** Normalised field hook token, e.g. `givenName`. */\n  field: string;\n  value: string | boolean;\n  /** Label fallback for text-like inputs on templates without hooks. */\n  label?: RegExp;\n}\n\nexport interface LoginCredentials {\n  email: string;\n  password: string;\n}\n\nexport interface RegistrationDetails {\n  email: string;\n  /** Extra fields some flows require at registration, filled if rendered. */\n  profile?: ProfileEntry[];\n}\n\nexport interface PasswordRegistrationDetails extends RegistrationDetails {\n  password: string;\n}\n\n/**\n * A union locator resolves in DOM order across the whole page, so every\n * candidate built from a broad selector — accessible names, labels, the\n * generic `data-action` attribute — is scoped to the `<zitadel-login>`\n * host; otherwise a same-named control in the app's own chrome (header\n * nav, footer forms) could win the union. The host element exists no\n * matter what the tenant's template renders, so these fallbacks keep\n * working for custom templates that emit no automation hooks — the case\n * they exist for. The `zitadel-*` testid hooks and the `zl-button` atom\n * are namespaced and stay page-global.\n */\nfunction widgetRoot(page: Page): Locator {\n  return page.locator(\"zitadel-login\");\n}\n\n/**\n * Escape a value for use inside a double-quoted CSS attribute selector,\n * per the CSSOM \"serialize a string\" rules: NUL becomes U+FFFD, control\n * characters become hex code-point escapes, quote and backslash are\n * backslash-escaped. C1 controls (U+0080–U+009F) are escaped too — CSSOM\n * itself leaves them literal, but the escaped form is equivalent and\n * survives stricter-than-spec selector parsers. Anything the flow schema\n * accepts as an action name yields a parseable selector.\n */\nfunction cssAttributeValue(value: string): string {\n  let out = \"\";\n  for (const ch of value) {\n    const code = ch.codePointAt(0) ?? 0;\n    if (code === 0) {\n      out += \"�\";\n    } else if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {\n      out += `\\\\${code.toString(16)} `;\n    } else if (ch === '\"' || ch === \"\\\\\") {\n      out += `\\\\${ch}`;\n    } else {\n      out += ch;\n    }\n  }\n  return out;\n}\n\n/**\n * Locator for a flow action control by its declared action name. Matches\n * every hook shape the default template emits — host testid, native\n * shadow button/link testids, and the raw `action`/`data-action`\n * attributes (the recover link carries only `data-action`).\n */\nexport function flowAction(page: Page, action: string, options: FlowActionOptions = {}): Locator {\n  // Action names are free-form in the flow schema; escape them before\n  // interpolating into attribute selectors so an exotic name cannot break\n  // the whole union's parsing.\n  const attributeSafe = cssAttributeValue(action);\n  let candidates = page\n    .getByTestId(`zitadel-action-${action}`)\n    .or(page.getByTestId(`zitadel-action-${action}-button`))\n    .or(page.getByTestId(`zitadel-action-${action}-link`))\n    .or(page.locator(`zl-button[action=\"${attributeSafe}\"]`))\n    .or(widgetRoot(page).locator(`[data-action=\"${attributeSafe}\"]`));\n  if (options.name) {\n    candidates = candidates\n      .or(widgetRoot(page).getByRole(\"button\", { name: options.name }))\n      .or(widgetRoot(page).getByRole(\"link\", { name: options.name }));\n  }\n  return candidates.first();\n}\n\n/**\n * Locator for a flow field's input by its normalised hook token\n * (`email`, `password`, a user-schema property name).\n */\nexport function flowField(page: Page, field: string, options: FlowFieldOptions = {}): Locator {\n  let candidates = page\n    .getByTestId(`zitadel-input-${field}`)\n    .or(page.getByTestId(`zitadel-field-${field}`).locator(\"input\"));\n  if (options.label) {\n    candidates = candidates.or(widgetRoot(page).getByLabel(options.label));\n  }\n  return candidates.first();\n}\n\n/** Click a flow action (auto-waits like any locator click). */\nexport async function clickFlowAction(\n  page: Page,\n  action: string,\n  options?: FlowActionOptions,\n): Promise<void> {\n  await flowAction(page, action, options).click();\n}\n\n/** Fill a flow field (auto-waits like any locator fill). */\nexport async function fillFlowField(\n  page: Page,\n  field: string,\n  value: string,\n  options?: FlowFieldOptions,\n): Promise<void> {\n  await flowField(page, field, options).fill(value);\n}\n\n/**\n * Sign in with email and password from the flow's entry step. Handles both\n * the default split shape (identifier → password) and flows that render\n * the password field on the entry step.\n */\nexport async function loginWithPassword(\n  page: Page,\n  { email, password }: LoginCredentials,\n): Promise<void> {\n  await emailField(page).fill(email);\n  const password_ = passwordField(page);\n  if (!(await password_.isVisible().catch(() => false))) {\n    await flowAction(page, \"submit\").click();\n  }\n  await password_.fill(password);\n  await flowAction(page, \"submit\").click();\n}\n\n/**\n * Sign in with a passkey. With `email`, fills the identifier and takes the\n * step's passkey action; without, taps the entry step's passkey action\n * directly (discoverable-credential one-tap, e.g. the passkey-first\n * preset). Pair with `enableVirtualPasskey` / the `passkey` fixture in\n * headless runs — the ceremony completes automatically once the widget\n * issues the WebAuthn challenge.\n */\nexport async function loginWithPasskey(page: Page, options: { email?: string } = {}): Promise<void> {\n  if (options.email !== undefined) {\n    await emailField(page).fill(options.email);\n  }\n  await flowAction(page, \"passkey\").click();\n}\n\n/**\n * Register a new user with a password: enter the (unknown) identifier,\n * advance into the registration step, continue on the password path, and\n * submit the password. Ends when the final submit is clicked — assert your\n * app's signed-in surface afterwards. Flows that route through steps the\n * default flow does not (e.g. a passkey upsell) need caller-side handling\n * after this returns.\n */\nexport async function registerWithPassword(\n  page: Page,\n  { email, password, profile }: PasswordRegistrationDetails,\n): Promise<void> {\n  await advanceToRegistration(page, email, profile);\n  // Continue with password unless this flow renders the password field on\n  // the registration step itself.\n  const password_ = passwordField(page);\n  if (!(await password_.isVisible().catch(() => false))) {\n    await flowAction(page, \"submit\").click();\n  }\n  await password_.fill(password);\n  await flowAction(page, \"submit\").click();\n}\n\n/**\n * Register a new user with a passkey: enter the (unknown) identifier,\n * advance into the registration step, and take its `passkey_register`\n * action. Requires an authenticator (see `loginWithPasskey`). The default\n * flow completes registration from the ceremony directly.\n */\nexport async function registerWithPasskey(\n  page: Page,\n  { email, profile }: RegistrationDetails,\n): Promise<void> {\n  await advanceToRegistration(page, email, profile);\n  await flowAction(page, \"passkey_register\").click();\n}\n\nfunction emailField(page: Page): Locator {\n  return flowField(page, \"email\", { label: /email/i });\n}\n\nfunction passwordField(page: Page): Locator {\n  return flowField(page, \"password\", { label: /password/i });\n}\n\n/**\n * From the entry step: submit the unknown identifier (the default flow's\n * `user_not_found` transition routes to registration), or take an explicit\n * `register` navigate action when the entry step is a combined\n * email+password step — there, submitting would attempt a password sign-in\n * instead. Then wait for the registration step and fill what it renders.\n */\nasync function advanceToRegistration(\n  page: Page,\n  email: string,\n  profile: ProfileEntry[] | undefined,\n): Promise<void> {\n  await emailField(page).fill(email);\n  if (await passwordField(page).isVisible().catch(() => false)) {\n    await flowAction(page, \"register\").click();\n  } else {\n    await flowAction(page, \"submit\").click();\n  }\n  await expectRegistrationStep(page);\n  // The engine echoes the attempted identifier into the registration step's\n  // email field; refill defensively for flows that render it empty.\n  await fillIfVisible(emailField(page), email);\n  for (const entry of profile ?? []) {\n    await fillProfileEntry(page, entry);\n  }\n}\n\n/**\n * Fill one registration field with the verb its control needs: booleans\n * check the `zl-checkbox` native input, strings prefer the `zl-select`\n * native select (option matched by value, falling back to label) and\n * otherwise fill a text-like input. The select/checkbox natives carry the\n * name-first testids the atoms document (`zitadel-select-*`,\n * `zitadel-checkbox-*`); templates without those hooks drive such fields\n * via their own locators.\n */\nasync function fillProfileEntry(page: Page, entry: ProfileEntry): Promise<void> {\n  if (typeof entry.value === \"boolean\") {\n    const checkbox = page.getByTestId(`zitadel-checkbox-${entry.field}`).first();\n    if (await checkbox.isVisible().catch(() => false)) {\n      await checkbox.setChecked(entry.value);\n    }\n    return;\n  }\n  const select = page.getByTestId(`zitadel-select-${entry.field}`).first();\n  if (await select.isVisible().catch(() => false)) {\n    await select.selectOption(entry.value);\n    return;\n  }\n  await fillIfVisible(flowField(page, entry.field, { label: entry.label }), entry.value);\n}\n\n/**\n * Barrier between the entry submit and probing the registration step's\n * fields: without it, optional-field probes race the re-render and read\n * the outgoing step. The default flow's registration step declares\n * `passkey_register` — a structural, locale-independent signal; the\n * heading regex covers password-only flows on the default English\n * template.\n */\nasync function expectRegistrationStep(page: Page): Promise<void> {\n  await flowAction(page, \"passkey_register\")\n    .or(widgetRoot(page).getByRole(\"heading\", { name: /create|register|sign up|no-account/i }))\n    .first()\n    .waitFor({ state: \"visible\", timeout: 30_000 });\n}\n\nasync function fillIfVisible(field: Locator, value: string): Promise<void> {\n  if (await field.isVisible().catch(() => false)) {\n    await field.fill(value);\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { extname, isAbsolute, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type { PlaywrightTestConfig } from \"@playwright/test\";\n\nimport type { AppEnvTemplate } from \"./app-env\";\nimport {\n  APP_RUNNER_CONFIG_ENV,\n  HANDSHAKE_ENV,\n  SUPERVISOR_CONFIG_ENV,\n  type AppRunnerConfig,\n  type SupervisorConfig,\n} from \"./orchestration\";\n\ntype WebServerEntry = Extract<\n  NonNullable<PlaywrightTestConfig[\"webServer\"]>,\n  readonly unknown[]\n>[number];\n\nexport interface WithZitadelOptions {\n  /**\n   * The Playwright config's directory (`import.meta.dirname`). Anchors the\n   * default handshake location and the working directory of the generated\n   * webServer entries.\n   */\n  configDir: string;\n  /**\n   * Fixed TCP port for the instance. Required (unlike `startLocalZitadel`,\n   * which defaults to a free port) because Playwright's readiness URL must be\n   * known while the config is evaluated, before anything boots.\n   */\n  port: number;\n  /**\n   * Origin the browser will use for the app under test. Registered as the\n   * project's preview origin (the backend's origin check rejects forwarded\n   * requests from unregistered origins) and the base of `app.readyPath`.\n   */\n  appOrigin: string;\n  /** Boot/bootstrap options forwarded to the instance supervisor. */\n  zitadel?: {\n    /** Absolute path to the server binary. */\n    serverBinary?: string;\n    /** Appended to the missing-binary error, e.g. \"run `moon run server:build` first.\" */\n    serverBinaryHint?: string;\n    projectName?: string;\n    preset?: SupervisorConfig[\"preset\"];\n    useCase?: SupervisorConfig[\"useCase\"];\n    /** Absolute state directory; defaults to a fresh temp dir removed on stop. */\n    dir?: string;\n    /** Keep the owned temp dir after stop (debugging). */\n    keep?: boolean;\n    /** webServer readiness timeout for the boot; cold boot dominates it. */\n    bootTimeoutMs?: number;\n  };\n  /** The app dev server to run against the instance. */\n  app: {\n    /** Spawn argv (no shell), e.g. [\"corepack\", \"pnpm\", \"--filter\", \"my-app\", \"dev\"]. */\n    command: string[];\n    /** Working directory for the app command. */\n    cwd: string;\n    /** Path on `appOrigin` Playwright polls for readiness, e.g. \"/login\". */\n    readyPath: string;\n    /**\n     * Env vars the app needs, as a template mapping env names to\n     * InstanceHandle fields — see `nextAppEnv` for the `@zitadel/sdk-next`\n     * shape. A template (not a callback) because it crosses into the app\n     * runner process.\n     */\n    env: AppEnvTemplate;\n    readyTimeoutMs?: number;\n    /** How long SIGTERM gets before the app is killed on teardown. */\n    gracefulShutdownMs?: number;\n  };\n  /** Absolute path; defaults to `<configDir>/.zitadel-testing/handshake.json`. */\n  handshakePath?: string;\n}\n\n/**\n * Generate the Playwright `webServer` entries that boot an ephemeral seeded\n * Zitadel and run the app against it, replacing the per-suite wrapper\n * scripts. Spread the result into `defineConfig`:\n *\n * ```ts\n * export default defineConfig({\n *   ...withZitadel({ configDir: import.meta.dirname, port: 8092, ... }),\n *   testDir: \"./src-real\",\n * });\n * ```\n *\n * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the\n * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright\n * workers re-evaluate the config, which re-applies this for every process\n * that needs it. The returned value is plain data; append your own entries\n * to `webServer` if the suite needs additional servers.\n */\nexport function withZitadel(\n  options: WithZitadelOptions,\n  /** Test seam: alternative executable resolution. */\n  resolveEntry: (name: \"supervisor\" | \"app-runner\") => string = entryPoint,\n): { webServer: WebServerEntry[] } {\n  const { configDir, port, appOrigin, app } = options;\n  if (!isAbsolute(configDir)) {\n    throw new Error(`withZitadel: configDir must be absolute, got \"${configDir}\"`);\n  }\n  if (!Number.isInteger(port) || port <= 0) {\n    throw new Error(`withZitadel: port must be a positive integer, got ${port}`);\n  }\n  const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : undefined;\n  if (\n    !origin ||\n    (origin.protocol !== \"http:\" && origin.protocol !== \"https:\") ||\n    origin.pathname !== \"/\" ||\n    origin.search !== \"\" ||\n    origin.hash !== \"\"\n  ) {\n    throw new Error(\n      `withZitadel: appOrigin must be an origin like \"http://localhost:3002\", got \"${appOrigin}\"`,\n    );\n  }\n  if (!app.readyPath.startsWith(\"/\")) {\n    throw new Error(`withZitadel: app.readyPath must start with \"/\", got \"${app.readyPath}\"`);\n  }\n  if (app.command.length === 0) {\n    throw new Error(\"withZitadel: app.command must not be empty\");\n  }\n  if (!isAbsolute(app.cwd)) {\n    throw new Error(`withZitadel: app.cwd must be absolute, got \"${app.cwd}\"`);\n  }\n  // Path options are consumed by the executables, whose cwd is configDir —\n  // a relative path would silently resolve against that, not the project.\n  for (const [label, value] of [\n    [\"zitadel.serverBinary\", options.zitadel?.serverBinary],\n    [\"zitadel.dir\", options.zitadel?.dir],\n    [\"handshakePath\", options.handshakePath],\n  ] as const) {\n    if (value !== undefined && !isAbsolute(value)) {\n      throw new Error(`withZitadel: ${label} must be an absolute path, got \"${value}\"`);\n    }\n  }\n\n  const handshakePath =\n    options.handshakePath ?? join(configDir, \".zitadel-testing\", \"handshake.json\");\n  // Workers inherit the runner's env; the fixtures resolve the instance from it.\n  process.env[HANDSHAKE_ENV] = handshakePath;\n\n  const supervisorConfig: SupervisorConfig = {\n    port,\n    appOrigins: [appOrigin],\n    serverBinary: options.zitadel?.serverBinary,\n    serverBinaryHint: options.zitadel?.serverBinaryHint,\n    dir: options.zitadel?.dir,\n    keep: options.zitadel?.keep,\n    projectName: options.zitadel?.projectName,\n    preset: options.zitadel?.preset,\n    useCase: options.zitadel?.useCase,\n  };\n  const appRunnerConfig: AppRunnerConfig = {\n    command: app.command,\n    cwd: app.cwd,\n    env: app.env,\n    handshakeTimeoutMs: app.readyTimeoutMs ?? 180_000,\n  };\n\n  return {\n    webServer: [\n      {\n        command: `node ${JSON.stringify(resolveEntry(\"supervisor\"))}`,\n        url: `http://localhost:${port}/healthz`,\n        reuseExistingServer: false,\n        cwd: configDir,\n        stdout: \"pipe\",\n        stderr: \"pipe\",\n        // Cold boot (fresh data dir: migrations + health wait) dominates.\n        timeout: options.zitadel?.bootTimeoutMs ?? 120_000,\n        env: {\n          [HANDSHAKE_ENV]: handshakePath,\n          [SUPERVISOR_CONFIG_ENV]: JSON.stringify(supervisorConfig),\n        },\n        // SIGTERM first so the supervisor can stop the instance; the default\n        // hard kill would orphan the server process group.\n        gracefulShutdown: { signal: \"SIGTERM\", timeout: 30_000 },\n      },\n      {\n        command: `node ${JSON.stringify(resolveEntry(\"app-runner\"))}`,\n        url: new URL(app.readyPath, appOrigin).toString(),\n        reuseExistingServer: false,\n        cwd: configDir,\n        stdout: \"pipe\",\n        stderr: \"pipe\",\n        timeout: app.readyTimeoutMs ?? 180_000,\n        env: {\n          [HANDSHAKE_ENV]: handshakePath,\n          [APP_RUNNER_CONFIG_ENV]: JSON.stringify(appRunnerConfig),\n        },\n        gracefulShutdown: {\n          signal: \"SIGTERM\",\n          timeout: app.gracefulShutdownMs ?? 15_000,\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Resolve a sibling dist entry in the same module format this file was loaded\n * as (dist/supervisor.mjs next to dist/playwright.mjs, .cjs next to .cjs), so\n * the spawned process needs no package-manager bin plumbing.\n */\nfunction entryPoint(name: \"supervisor\" | \"app-runner\"): string {\n  const self = fileURLToPath(import.meta.url);\n  const ext = extname(self);\n  if (ext !== \".mjs\" && ext !== \".cjs\") {\n    throw new Error(\n      `withZitadel: expected to run from the built package (got ${self}); ` +\n        \"build @zitadel/testing first (in-repo: `moon run testing:build`).\",\n    );\n  }\n  const path = fileURLToPath(new URL(`./${name}${ext}`, import.meta.url));\n  if (!existsSync(path)) {\n    throw new Error(\n      `withZitadel: missing ${path}; rebuild @zitadel/testing (in-repo: \\`moon run testing:build\\`).`,\n    );\n  }\n  return path;\n}\n","import { test as base, type Page } from \"@playwright/test\";\n\nimport { readHandshakeSync } from \"./handshake\";\nimport { connectZitadel } from \"./index\";\nimport { enableVirtualPasskey, type VirtualPasskey } from \"./passkey\";\nimport type {\n  ConnectedZitadel,\n  Identity,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n\nexport interface AuthenticatedPage {\n  /** A page in its own context, already carrying the session cookie. */\n  page: Page;\n  user: SeededUser;\n  session: MintedSession;\n}\n\nexport interface ZitadelTestFixtures {\n  /** Per-test seeding; each call mints unique data on the shared instance. */\n  seed: {\n    user(input?: SeedUserInput): Promise<SeededUser>;\n    users(count: number, template?: SeedUsersTemplate): Promise<SeededUser[]>;\n    /** Unused email+password for registration flows — creates nothing. */\n    identity(): Identity;\n    /** Seeded user + headless real-flow login; password flows only. */\n    session(input?: SeedSessionInput): Promise<MintedSession>;\n  };\n  /**\n   * Start the test authenticated: a fresh user, a real session minted through\n   * the flow API, and the cookie injected into a dedicated browser context —\n   * the default `page` stays signed out for login-flow tests. Requires\n   * `use.baseURL` (every withZitadel consumer sets it).\n   */\n  authenticatedPage: AuthenticatedPage;\n  /**\n   * Virtual passkey authenticator attached to the default `page`, disposed on\n   * teardown. On-demand: tests that don't request it pay nothing. Chromium\n   * only — see `enableVirtualPasskey` for the constraints.\n   */\n  passkey: VirtualPasskey;\n}\n\nexport interface ZitadelWorkerFixtures {\n  /** Connection to the suite's instance, resolved once per worker. */\n  zitadel: ConnectedZitadel;\n}\n\nexport const test = base.extend<ZitadelTestFixtures, ZitadelWorkerFixtures>({\n  zitadel: [\n    // Playwright derives fixture dependencies from the destructuring pattern,\n    // so the empty pattern is required here.\n    // oxlint-disable-next-line no-empty-pattern\n    async ({}, use) => {\n      const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;\n      if (!handshakePath) {\n        throw new Error(\n          \"ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file \" +\n            \"written by the script that boots the instance (see @zitadel/testing docs).\",\n        );\n      }\n      await use(connectZitadel(readHandshakeSync(handshakePath)));\n    },\n    { scope: \"worker\" },\n  ],\n  seed: async ({ zitadel, baseURL }, use) => {\n    await use({\n      user: (input) => zitadel.seedUser(input),\n      users: (count, template) => zitadel.seedUsers(count, template),\n      identity: () => zitadel.identity(),\n      // The suite's baseURL is the app origin the project allowlists.\n      session: (input) => zitadel.seedSession({ origin: baseURL, ...input }),\n    });\n  },\n  passkey: async ({ page }, use) => {\n    const passkey = await enableVirtualPasskey(page);\n    await use(passkey);\n    await passkey.dispose();\n  },\n  authenticatedPage: async ({ browser, zitadel, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        \"authenticatedPage requires `use.baseURL` so the session cookie can be \" +\n          \"scoped to the app under test.\",\n      );\n    }\n    const session = await zitadel.seedSession({ origin: baseURL });\n    const context = await browser.newContext({ baseURL });\n    // `addCookies` takes either url or domain/path; url derives the rest.\n    const { path: _path, ...cookie } = session.cookie;\n    await context.addCookies([{ ...cookie, url: baseURL }]);\n    const page = await context.newPage();\n    await use({ page, user: session.user, session });\n    await context.close();\n  },\n});\n\nexport { expect } from \"@playwright/test\";\nexport { applyAppEnvTemplate, nextAppEnv } from \"./app-env\";\nexport type { AppEnvTemplate } from \"./app-env\";\nexport {\n  clickFlowAction,\n  fillFlowField,\n  flowAction,\n  flowField,\n  loginWithPassword,\n  loginWithPasskey,\n  registerWithPassword,\n  registerWithPasskey,\n} from \"./flows\";\nexport type {\n  FlowActionOptions,\n  FlowFieldOptions,\n  LoginCredentials,\n  PasswordRegistrationDetails,\n  ProfileEntry,\n  RegistrationDetails,\n} from \"./flows\";\nexport { enableVirtualPasskey } from \"./passkey\";\nexport type { VirtualPasskey } from \"./passkey\";\nexport { withZitadel } from \"./playwright-config\";\nexport type { WithZitadelOptions } from \"./playwright-config\";\nexport type {\n  ConnectedZitadel,\n  Identity,\n  InstanceHandle,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,qBAAqB,MAAqC;CAC9E,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,KAAK,SAAS,CAAC,cAAc,KAAK;UAC1C,OAAO;AACd,QAAM,IAAI,MACR,4JAGA,EAAE,OAAO,OAAO,CACjB;;CAEH,IAAI;AACJ,KAAI;AACF,QAAM,OAAO,KAAK,kBAAkB;AACpC,GAAC,CAAE,mBAAoB,MAAM,OAAO,KAAK,oCAAoC,EAC3E,SAAS;GACP,UAAU;GACV,WAAW;GACX,gBAAgB;GAChB,qBAAqB;GACrB,gBAAgB;GAChB,6BAA6B;GAC9B,EACF,CAAC;UACK,OAAO;AAEd,QAAM,OAAO,QAAQ,CAAC,YAAY,KAAA,EAAU;AAC5C,QAAM;;AAGR,QAAO;EACL;EACA,MAAM,kBAAkB;GACtB,MAAM,EAAE,gBAAgB,MAAM,OAAO,KAAK,2BAA2B,EACnE,iBACD,CAAC;AACF,UAAO,YAAY;;EAErB,MAAM,UAAU;AAId,OAAI;AACF,UAAM,OAAO,KAAK,uCAAuC,EAAE,iBAAiB,CAAC;WACvE,WAEE;AACR,UAAM,OAAO,QAAQ,CAAC,YAAY,KAAA,EAAU;;;EAGjD;;;;;;;;;;;;;;;ACPH,SAAS,WAAW,MAAqB;AACvC,QAAO,KAAK,QAAQ,gBAAgB;;;;;;;;;;;AAYtC,SAAS,kBAAkB,OAAuB;CAChD,IAAI,MAAM;AACV,MAAK,MAAM,MAAM,OAAO;EACtB,MAAM,OAAO,GAAG,YAAY,EAAE,IAAI;AAClC,MAAI,SAAS,EACX,QAAO;WACE,QAAQ,MAAS,QAAQ,OAAQ,QAAQ,IAClD,QAAO,KAAK,KAAK,SAAS,GAAG,CAAC;WACrB,OAAO,QAAO,OAAO,KAC9B,QAAO,KAAK;MAEZ,QAAO;;AAGX,QAAO;;;;;;;;AAST,SAAgB,WAAW,MAAY,QAAgB,UAA6B,EAAE,EAAW;CAI/F,MAAM,gBAAgB,kBAAkB,OAAO;CAC/C,IAAI,aAAa,KACd,YAAY,kBAAkB,SAAS,CACvC,GAAG,KAAK,YAAY,kBAAkB,OAAO,SAAS,CAAC,CACvD,GAAG,KAAK,YAAY,kBAAkB,OAAO,OAAO,CAAC,CACrD,GAAG,KAAK,QAAQ,qBAAqB,cAAc,IAAI,CAAC,CACxD,GAAG,WAAW,KAAK,CAAC,QAAQ,iBAAiB,cAAc,IAAI,CAAC;AACnE,KAAI,QAAQ,KACV,cAAa,WACV,GAAG,WAAW,KAAK,CAAC,UAAU,UAAU,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC,CAChE,GAAG,WAAW,KAAK,CAAC,UAAU,QAAQ,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC;AAEnE,QAAO,WAAW,OAAO;;;;;;AAO3B,SAAgB,UAAU,MAAY,OAAe,UAA4B,EAAE,EAAW;CAC5F,IAAI,aAAa,KACd,YAAY,iBAAiB,QAAQ,CACrC,GAAG,KAAK,YAAY,iBAAiB,QAAQ,CAAC,QAAQ,QAAQ,CAAC;AAClE,KAAI,QAAQ,MACV,cAAa,WAAW,GAAG,WAAW,KAAK,CAAC,WAAW,QAAQ,MAAM,CAAC;AAExE,QAAO,WAAW,OAAO;;;AAI3B,eAAsB,gBACpB,MACA,QACA,SACe;AACf,OAAM,WAAW,MAAM,QAAQ,QAAQ,CAAC,OAAO;;;AAIjD,eAAsB,cACpB,MACA,OACA,OACA,SACe;AACf,OAAM,UAAU,MAAM,OAAO,QAAQ,CAAC,KAAK,MAAM;;;;;;;AAQnD,eAAsB,kBACpB,MACA,EAAE,OAAO,YACM;AACf,OAAM,WAAW,KAAK,CAAC,KAAK,MAAM;CAClC,MAAM,YAAY,cAAc,KAAK;AACrC,KAAI,CAAE,MAAM,UAAU,WAAW,CAAC,YAAY,MAAM,CAClD,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,UAAU,KAAK,SAAS;AAC9B,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;;;;;;;;;;AAW1C,eAAsB,iBAAiB,MAAY,UAA8B,EAAE,EAAiB;AAClG,KAAI,QAAQ,UAAU,KAAA,EACpB,OAAM,WAAW,KAAK,CAAC,KAAK,QAAQ,MAAM;AAE5C,OAAM,WAAW,MAAM,UAAU,CAAC,OAAO;;;;;;;;;;AAW3C,eAAsB,qBACpB,MACA,EAAE,OAAO,UAAU,WACJ;AACf,OAAM,sBAAsB,MAAM,OAAO,QAAQ;CAGjD,MAAM,YAAY,cAAc,KAAK;AACrC,KAAI,CAAE,MAAM,UAAU,WAAW,CAAC,YAAY,MAAM,CAClD,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,UAAU,KAAK,SAAS;AAC9B,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;;;;;;;;AAS1C,eAAsB,oBACpB,MACA,EAAE,OAAO,WACM;AACf,OAAM,sBAAsB,MAAM,OAAO,QAAQ;AACjD,OAAM,WAAW,MAAM,mBAAmB,CAAC,OAAO;;AAGpD,SAAS,WAAW,MAAqB;AACvC,QAAO,UAAU,MAAM,SAAS,EAAE,OAAO,UAAU,CAAC;;AAGtD,SAAS,cAAc,MAAqB;AAC1C,QAAO,UAAU,MAAM,YAAY,EAAE,OAAO,aAAa,CAAC;;;;;;;;;AAU5D,eAAe,sBACb,MACA,OACA,SACe;AACf,OAAM,WAAW,KAAK,CAAC,KAAK,MAAM;AAClC,KAAI,MAAM,cAAc,KAAK,CAAC,WAAW,CAAC,YAAY,MAAM,CAC1D,OAAM,WAAW,MAAM,WAAW,CAAC,OAAO;KAE1C,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,uBAAuB,KAAK;AAGlC,OAAM,cAAc,WAAW,KAAK,EAAE,MAAM;AAC5C,MAAK,MAAM,SAAS,WAAW,EAAE,CAC/B,OAAM,iBAAiB,MAAM,MAAM;;;;;;;;;;;AAavC,eAAe,iBAAiB,MAAY,OAAoC;AAC9E,KAAI,OAAO,MAAM,UAAU,WAAW;EACpC,MAAM,WAAW,KAAK,YAAY,oBAAoB,MAAM,QAAQ,CAAC,OAAO;AAC5E,MAAI,MAAM,SAAS,WAAW,CAAC,YAAY,MAAM,CAC/C,OAAM,SAAS,WAAW,MAAM,MAAM;AAExC;;CAEF,MAAM,SAAS,KAAK,YAAY,kBAAkB,MAAM,QAAQ,CAAC,OAAO;AACxE,KAAI,MAAM,OAAO,WAAW,CAAC,YAAY,MAAM,EAAE;AAC/C,QAAM,OAAO,aAAa,MAAM,MAAM;AACtC;;AAEF,OAAM,cAAc,UAAU,MAAM,MAAM,OAAO,EAAE,OAAO,MAAM,OAAO,CAAC,EAAE,MAAM,MAAM;;;;;;;;;;AAWxF,eAAe,uBAAuB,MAA2B;AAC/D,OAAM,WAAW,MAAM,mBAAmB,CACvC,GAAG,WAAW,KAAK,CAAC,UAAU,WAAW,EAAE,MAAM,uCAAuC,CAAC,CAAC,CAC1F,OAAO,CACP,QAAQ;EAAE,OAAO;EAAW,SAAS;EAAQ,CAAC;;AAGnD,eAAe,cAAc,OAAgB,OAA8B;AACzE,KAAI,MAAM,MAAM,WAAW,CAAC,YAAY,MAAM,CAC5C,OAAM,MAAM,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;ACpN3B,SAAgB,YACd,SAEA,eAA8D,YAC7B;CACjC,MAAM,EAAE,WAAW,MAAM,WAAW,QAAQ;AAC5C,KAAI,EAAA,GAAA,UAAA,YAAY,UAAU,CACxB,OAAM,IAAI,MAAM,iDAAiD,UAAU,GAAG;AAEhF,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,QAAQ,EACrC,OAAM,IAAI,MAAM,qDAAqD,OAAO;CAE9E,MAAM,SAAS,IAAI,SAAS,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,KAAA;AAC9D,KACE,CAAC,UACA,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,GAEhB,OAAM,IAAI,MACR,+EAA+E,UAAU,GAC1F;AAEH,KAAI,CAAC,IAAI,UAAU,WAAW,IAAI,CAChC,OAAM,IAAI,MAAM,wDAAwD,IAAI,UAAU,GAAG;AAE3F,KAAI,IAAI,QAAQ,WAAW,EACzB,OAAM,IAAI,MAAM,6CAA6C;AAE/D,KAAI,EAAA,GAAA,UAAA,YAAY,IAAI,IAAI,CACtB,OAAM,IAAI,MAAM,+CAA+C,IAAI,IAAI,GAAG;AAI5E,MAAK,MAAM,CAAC,OAAO,UAAU;EAC3B,CAAC,wBAAwB,QAAQ,SAAS,aAAa;EACvD,CAAC,eAAe,QAAQ,SAAS,IAAI;EACrC,CAAC,iBAAiB,QAAQ,cAAc;EACzC,CACC,KAAI,UAAU,KAAA,KAAa,EAAA,GAAA,UAAA,YAAY,MAAM,CAC3C,OAAM,IAAI,MAAM,gBAAgB,MAAM,kCAAkC,MAAM,GAAG;CAIrF,MAAM,gBACJ,QAAQ,kBAAA,GAAA,UAAA,MAAsB,WAAW,oBAAoB,iBAAiB;AAEhF,SAAQ,IAAIA,sBAAAA,iBAAiB;CAE7B,MAAM,mBAAqC;EACzC;EACA,YAAY,CAAC,UAAU;EACvB,cAAc,QAAQ,SAAS;EAC/B,kBAAkB,QAAQ,SAAS;EACnC,KAAK,QAAQ,SAAS;EACtB,MAAM,QAAQ,SAAS;EACvB,aAAa,QAAQ,SAAS;EAC9B,QAAQ,QAAQ,SAAS;EACzB,SAAS,QAAQ,SAAS;EAC3B;CACD,MAAM,kBAAmC;EACvC,SAAS,IAAI;EACb,KAAK,IAAI;EACT,KAAK,IAAI;EACT,oBAAoB,IAAI,kBAAkB;EAC3C;AAED,QAAO,EACL,WAAW,CACT;EACE,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,oBAAoB,KAAK;EAC9B,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EAER,SAAS,QAAQ,SAAS,iBAAiB;EAC3C,KAAK;IACFA,sBAAAA,gBAAgB;IAChBC,sBAAAA,wBAAwB,KAAK,UAAU,iBAAiB;GAC1D;EAGD,kBAAkB;GAAE,QAAQ;GAAW,SAAS;GAAQ;EACzD,EACD;EACE,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,IAAI,IAAI,IAAI,WAAW,UAAU,CAAC,UAAU;EACjD,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EACR,SAAS,IAAI,kBAAkB;EAC/B,KAAK;IACFD,sBAAAA,gBAAgB;IAChBE,sBAAAA,wBAAwB,KAAK,UAAU,gBAAgB;GACzD;EACD,kBAAkB;GAChB,QAAQ;GACR,SAAS,IAAI,sBAAsB;GACpC;EACF,CACF,EACF;;;;;;;AAQH,SAAS,WAAW,MAA2C;CAC7D,MAAM,QAAA,GAAA,SAAA,eAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAqC;CAC3C,MAAM,OAAA,GAAA,UAAA,SAAc,KAAK;AACzB,KAAI,QAAQ,UAAU,QAAQ,OAC5B,OAAM,IAAI,MACR,4DAA4D,KAAK,wEAElE;CAEH,MAAM,QAAA,GAAA,SAAA,eAAqB,IAAI,IAAI,KAAK,OAAO,OAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAuB,CAAC;AACvE,KAAI,EAAA,GAAA,QAAA,YAAY,KAAK,CACnB,OAAM,IAAI,MACR,wBAAwB,KAAK,mEAC9B;AAEH,QAAO;;;;AC5KT,MAAa,OAAOC,iBAAAA,KAAK,OAAmD;CAC1E,SAAS,CAIP,OAAO,IAAI,QAAQ;EACjB,MAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,cACH,OAAM,IAAI,MACR,kJAED;AAEH,QAAM,IAAIC,YAAAA,eAAeC,kBAAAA,kBAAkB,cAAc,CAAC,CAAC;IAE7D,EAAE,OAAO,UAAU,CACpB;CACD,MAAM,OAAO,EAAE,SAAS,WAAW,QAAQ;AACzC,QAAM,IAAI;GACR,OAAO,UAAU,QAAQ,SAAS,MAAM;GACxC,QAAQ,OAAO,aAAa,QAAQ,UAAU,OAAO,SAAS;GAC9D,gBAAgB,QAAQ,UAAU;GAElC,UAAU,UAAU,QAAQ,YAAY;IAAE,QAAQ;IAAS,GAAG;IAAO,CAAC;GACvE,CAAC;;CAEJ,SAAS,OAAO,EAAE,QAAQ,QAAQ;EAChC,MAAM,UAAU,MAAM,qBAAqB,KAAK;AAChD,QAAM,IAAI,QAAQ;AAClB,QAAM,QAAQ,SAAS;;CAEzB,mBAAmB,OAAO,EAAE,SAAS,SAAS,WAAW,QAAQ;AAC/D,MAAI,CAAC,QACH,OAAM,IAAI,MACR,sGAED;EAEH,MAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,QAAQ,SAAS,CAAC;EAC9D,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,CAAC;EAErD,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW,QAAQ;AAC3C,QAAM,QAAQ,WAAW,CAAC;GAAE,GAAG;GAAQ,KAAK;GAAS,CAAC,CAAC;AAEvD,QAAM,IAAI;GAAE,MAAA,MADO,QAAQ,SAAS;GAClB,MAAM,QAAQ;GAAM;GAAS,CAAC;AAChD,QAAM,QAAQ,OAAO;;CAExB,CAAC"}
+{"version":3,"file":"playwright.cjs","names":["HANDSHAKE_ENV","SUPERVISOR_CONFIG_ENV","APP_RUNNER_CONFIG_ENV","base","connectZitadel","waitForHandshake"],"sources":["../src/passkey.ts","../src/flows.ts","../src/playwright-config.ts","../src/playwright.ts"],"sourcesContent":["import type { CDPSession, Page } from \"@playwright/test\";\n\n/**\n * A virtual WebAuthn authenticator attached to one page. Ceremonies started\n * from that page (passkey registration, passkey login) complete automatically\n * — no OS authenticator dialog, no touch.\n */\nexport interface VirtualPasskey {\n  /** CDP id of the virtual authenticator, for advanced raw-protocol use. */\n  authenticatorId: string;\n  /** Number of credentials the authenticator currently stores. */\n  credentialCount(): Promise<number>;\n  /** Remove the authenticator and detach the CDP session. */\n  dispose(): Promise<void>;\n}\n\n/**\n * Attach a virtual passkey authenticator to the page via the Chrome DevTools\n * Protocol. The options mirror a platform authenticator with discoverable\n * credentials and automatic user presence — the profile the consumer journey\n * has run in CI since passkey coverage became mandatory there.\n *\n * Chromium only: the CDP WebAuthn domain does not exist in WebKit or Firefox.\n * The authenticator is bound to this page — drive registration and the later\n * login from the same page, or the credential is gone. Serve the app under\n * test on an origin WebAuthn accepts as a relying-party ID: HTTPS on a real\n * domain, or `http://localhost` for local runs — raw IP origins such as\n * `http://127.0.0.1` are invalid RP IDs.\n */\nexport async function enableVirtualPasskey(page: Page): Promise<VirtualPasskey> {\n  let client: CDPSession;\n  try {\n    client = await page.context().newCDPSession(page);\n  } catch (error) {\n    throw new Error(\n      \"enableVirtualPasskey: could not open a CDP session — passkey testing \" +\n        \"needs Chromium's virtual authenticator, so run passkey specs in a \" +\n        \"Chromium project.\",\n      { cause: error },\n    );\n  }\n  let authenticatorId: string;\n  try {\n    await client.send(\"WebAuthn.enable\");\n    ({ authenticatorId } = await client.send(\"WebAuthn.addVirtualAuthenticator\", {\n      options: {\n        protocol: \"ctap2\",\n        transport: \"internal\",\n        hasResidentKey: true,\n        hasUserVerification: true,\n        isUserVerified: true,\n        automaticPresenceSimulation: true,\n      },\n    }));\n  } catch (error) {\n    // Don't leave a half-initialized CDP session attached behind a throw.\n    await client.detach().catch(() => undefined);\n    throw error;\n  }\n\n  return {\n    authenticatorId,\n    async credentialCount() {\n      const { credentials } = await client.send(\"WebAuthn.getCredentials\", {\n        authenticatorId,\n      });\n      return credentials.length;\n    },\n    async dispose() {\n      // Best-effort: the page (and with it the CDP target) may already be\n      // gone when teardown runs after a failed test; never mask that failure.\n      // Detach even when the removal fails, so the session never outlives it.\n      try {\n        await client.send(\"WebAuthn.removeVirtualAuthenticator\", { authenticatorId });\n      } catch {\n        // ignore\n      } finally {\n        await client.detach().catch(() => undefined);\n      }\n    },\n  };\n}\n","import type { Locator, Page } from \"@playwright/test\";\n\n/**\n * Helpers that drive the `<zitadel-login>` widget through complete auth\n * ceremonies, built on the widget's documented automation hooks\n * (`zitadel-field-*` / `zitadel-input-*` on fields, `zitadel-action-*` on\n * actions — see packages/components/README.md). Field names use the\n * normalised hook token: the flow engine names credential fields\n * `x-auth-methods#password`, but the hook (and this API) says `password`.\n *\n * The ceremony helpers assume the default flow vocabulary — steps that\n * declare `submit` / `passkey` / `passkey_register` actions and `email` /\n * password fields, as `default-login.json` does. They branch only on\n * widget-observable state (which fields and actions the flow renders),\n * because customer flow configurations legitimately vary; they never\n * assert app state. Callers navigate to the widget first and assert their\n * own signed-in surface afterwards. Flows with renamed actions or custom\n * steps drive the widget directly via `flowAction` / `flowField`.\n */\n\nexport interface FlowActionOptions {\n  /**\n   * Accessible-name fallback for templates that do not emit the documented\n   * `data-testid` hooks: adds role-based button/link candidates.\n   */\n  name?: RegExp;\n}\n\nexport interface FlowFieldOptions {\n  /** Label fallback for templates that do not emit the documented hooks. */\n  label?: RegExp;\n}\n\n/**\n * One optional registration field, filled only when the flow renders it.\n * The value's type picks the control: a boolean drives a checkbox\n * (`zl-checkbox`), a string first tries a select (`zl-select`) and falls\n * back to filling a text-like input.\n */\nexport interface ProfileEntry {\n  /** Normalised field hook token, e.g. `givenName`. */\n  field: string;\n  value: string | boolean;\n  /** Label fallback for text-like inputs on templates without hooks. */\n  label?: RegExp;\n}\n\nexport interface LoginCredentials {\n  email: string;\n  password: string;\n}\n\nexport interface RegistrationDetails {\n  email: string;\n  /** Extra fields some flows require at registration, filled if rendered. */\n  profile?: ProfileEntry[];\n}\n\nexport interface PasswordRegistrationDetails extends RegistrationDetails {\n  password: string;\n}\n\n/**\n * A union locator resolves in DOM order across the whole page, so every\n * candidate built from a broad selector — accessible names, labels, the\n * generic `data-action` attribute — is scoped to the `<zitadel-login>`\n * host; otherwise a same-named control in the app's own chrome (header\n * nav, footer forms) could win the union. The host element exists no\n * matter what the tenant's template renders, so these fallbacks keep\n * working for custom templates that emit no automation hooks — the case\n * they exist for. The `zitadel-*` testid hooks and the `zl-button` atom\n * are namespaced and stay page-global.\n */\nfunction widgetRoot(page: Page): Locator {\n  return page.locator(\"zitadel-login\");\n}\n\n/**\n * Escape a value for use inside a double-quoted CSS attribute selector,\n * per the CSSOM \"serialize a string\" rules: NUL becomes U+FFFD, control\n * characters become hex code-point escapes, quote and backslash are\n * backslash-escaped. C1 controls (U+0080–U+009F) are escaped too — CSSOM\n * itself leaves them literal, but the escaped form is equivalent and\n * survives stricter-than-spec selector parsers. Anything the flow schema\n * accepts as an action name yields a parseable selector.\n */\nfunction cssAttributeValue(value: string): string {\n  let out = \"\";\n  for (const ch of value) {\n    const code = ch.codePointAt(0) ?? 0;\n    if (code === 0) {\n      out += \"�\";\n    } else if (code <= 0x1f || (code >= 0x7f && code <= 0x9f)) {\n      out += `\\\\${code.toString(16)} `;\n    } else if (ch === '\"' || ch === \"\\\\\") {\n      out += `\\\\${ch}`;\n    } else {\n      out += ch;\n    }\n  }\n  return out;\n}\n\n/**\n * Locator for a flow action control by its declared action name. Matches\n * every hook shape the default template emits — host testid, native\n * shadow button/link testids, and the raw `action`/`data-action`\n * attributes (the recover link carries only `data-action`).\n */\nexport function flowAction(page: Page, action: string, options: FlowActionOptions = {}): Locator {\n  // Action names are free-form in the flow schema; escape them before\n  // interpolating into attribute selectors so an exotic name cannot break\n  // the whole union's parsing.\n  const attributeSafe = cssAttributeValue(action);\n  let candidates = page\n    .getByTestId(`zitadel-action-${action}`)\n    .or(page.getByTestId(`zitadel-action-${action}-button`))\n    .or(page.getByTestId(`zitadel-action-${action}-link`))\n    .or(page.locator(`zl-button[action=\"${attributeSafe}\"]`))\n    .or(widgetRoot(page).locator(`[data-action=\"${attributeSafe}\"]`));\n  if (options.name) {\n    candidates = candidates\n      .or(widgetRoot(page).getByRole(\"button\", { name: options.name }))\n      .or(widgetRoot(page).getByRole(\"link\", { name: options.name }));\n  }\n  return candidates.first();\n}\n\n/**\n * Locator for a flow field's input by its normalised hook token\n * (`email`, `password`, a user-schema property name).\n */\nexport function flowField(page: Page, field: string, options: FlowFieldOptions = {}): Locator {\n  let candidates = page\n    .getByTestId(`zitadel-input-${field}`)\n    .or(page.getByTestId(`zitadel-field-${field}`).locator(\"input\"));\n  if (options.label) {\n    candidates = candidates.or(widgetRoot(page).getByLabel(options.label));\n  }\n  return candidates.first();\n}\n\n/** Click a flow action (auto-waits like any locator click). */\nexport async function clickFlowAction(\n  page: Page,\n  action: string,\n  options?: FlowActionOptions,\n): Promise<void> {\n  await flowAction(page, action, options).click();\n}\n\n/** Fill a flow field (auto-waits like any locator fill). */\nexport async function fillFlowField(\n  page: Page,\n  field: string,\n  value: string,\n  options?: FlowFieldOptions,\n): Promise<void> {\n  await flowField(page, field, options).fill(value);\n}\n\n/**\n * Sign in with email and password from the flow's entry step. Handles both\n * the default split shape (identifier → password) and flows that render\n * the password field on the entry step.\n */\nexport async function loginWithPassword(\n  page: Page,\n  { email, password }: LoginCredentials,\n): Promise<void> {\n  await emailField(page).fill(email);\n  const password_ = passwordField(page);\n  if (!(await password_.isVisible().catch(() => false))) {\n    await flowAction(page, \"submit\").click();\n  }\n  await password_.fill(password);\n  await flowAction(page, \"submit\").click();\n}\n\n/**\n * Sign in with a passkey. With `email`, fills the identifier and takes the\n * step's passkey action; without, taps the entry step's passkey action\n * directly (discoverable-credential one-tap, e.g. the passkey-first\n * preset). Pair with `enableVirtualPasskey` / the `passkey` fixture in\n * headless runs — the ceremony completes automatically once the widget\n * issues the WebAuthn challenge.\n */\nexport async function loginWithPasskey(page: Page, options: { email?: string } = {}): Promise<void> {\n  if (options.email !== undefined) {\n    await emailField(page).fill(options.email);\n  }\n  await flowAction(page, \"passkey\").click();\n}\n\n/**\n * Register a new user with a password: enter the (unknown) identifier,\n * advance into the registration step, continue on the password path, and\n * submit the password. Ends when the final submit is clicked — assert your\n * app's signed-in surface afterwards. Flows that route through steps the\n * default flow does not (e.g. a passkey upsell) need caller-side handling\n * after this returns.\n */\nexport async function registerWithPassword(\n  page: Page,\n  { email, password, profile }: PasswordRegistrationDetails,\n): Promise<void> {\n  await advanceToRegistration(page, email, profile);\n  // Continue with password unless this flow renders the password field on\n  // the registration step itself.\n  const password_ = passwordField(page);\n  if (!(await password_.isVisible().catch(() => false))) {\n    await flowAction(page, \"submit\").click();\n  }\n  await password_.fill(password);\n  await flowAction(page, \"submit\").click();\n}\n\n/**\n * Register a new user with a passkey: enter the (unknown) identifier,\n * advance into the registration step, and take its `passkey_register`\n * action. Requires an authenticator (see `loginWithPasskey`). The default\n * flow completes registration from the ceremony directly.\n */\nexport async function registerWithPasskey(\n  page: Page,\n  { email, profile }: RegistrationDetails,\n): Promise<void> {\n  await advanceToRegistration(page, email, profile);\n  await flowAction(page, \"passkey_register\").click();\n}\n\nfunction emailField(page: Page): Locator {\n  return flowField(page, \"email\", { label: /email/i });\n}\n\nfunction passwordField(page: Page): Locator {\n  return flowField(page, \"password\", { label: /password/i });\n}\n\n/**\n * From the entry step: submit the unknown identifier (the default flow's\n * `user_not_found` transition routes to registration), or take an explicit\n * `register` navigate action when the entry step is a combined\n * email+password step — there, submitting would attempt a password sign-in\n * instead. Then wait for the registration step and fill what it renders.\n */\nasync function advanceToRegistration(\n  page: Page,\n  email: string,\n  profile: ProfileEntry[] | undefined,\n): Promise<void> {\n  await emailField(page).fill(email);\n  if (await passwordField(page).isVisible().catch(() => false)) {\n    await flowAction(page, \"register\").click();\n  } else {\n    await flowAction(page, \"submit\").click();\n  }\n  await expectRegistrationStep(page);\n  // The engine echoes the attempted identifier into the registration step's\n  // email field; refill defensively for flows that render it empty.\n  await fillIfVisible(emailField(page), email);\n  for (const entry of profile ?? []) {\n    await fillProfileEntry(page, entry);\n  }\n}\n\n/**\n * Fill one registration field with the verb its control needs: booleans\n * check the `zl-checkbox` native input, strings prefer the `zl-select`\n * native select (option matched by value, falling back to label) and\n * otherwise fill a text-like input. The select/checkbox natives carry the\n * name-first testids the atoms document (`zitadel-select-*`,\n * `zitadel-checkbox-*`); templates without those hooks drive such fields\n * via their own locators.\n */\nasync function fillProfileEntry(page: Page, entry: ProfileEntry): Promise<void> {\n  if (typeof entry.value === \"boolean\") {\n    const checkbox = page.getByTestId(`zitadel-checkbox-${entry.field}`).first();\n    if (await checkbox.isVisible().catch(() => false)) {\n      await checkbox.setChecked(entry.value);\n    }\n    return;\n  }\n  const select = page.getByTestId(`zitadel-select-${entry.field}`).first();\n  if (await select.isVisible().catch(() => false)) {\n    await select.selectOption(entry.value);\n    return;\n  }\n  await fillIfVisible(flowField(page, entry.field, { label: entry.label }), entry.value);\n}\n\n/**\n * Barrier between the entry submit and probing the registration step's\n * fields: without it, optional-field probes race the re-render and read\n * the outgoing step. The default flow's registration step declares\n * `passkey_register` — a structural, locale-independent signal; the\n * heading regex covers password-only flows on the default English\n * template.\n */\nasync function expectRegistrationStep(page: Page): Promise<void> {\n  await flowAction(page, \"passkey_register\")\n    .or(widgetRoot(page).getByRole(\"heading\", { name: /create|register|sign up|no-account/i }))\n    .first()\n    .waitFor({ state: \"visible\", timeout: 30_000 });\n}\n\nasync function fillIfVisible(field: Locator, value: string): Promise<void> {\n  if (await field.isVisible().catch(() => false)) {\n    await field.fill(value);\n  }\n}\n","import { existsSync } from \"node:fs\";\nimport { extname, isAbsolute, join } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\n\nimport type { PlaywrightTestConfig } from \"@playwright/test\";\n\nimport type { AppEnvTemplate } from \"./app-env\";\nimport {\n  APP_RUNNER_CONFIG_ENV,\n  HANDSHAKE_ENV,\n  SUPERVISOR_CONFIG_ENV,\n  type AppRunnerConfig,\n  type SupervisorConfig,\n} from \"./orchestration\";\n\ntype WebServerEntry = Extract<\n  NonNullable<PlaywrightTestConfig[\"webServer\"]>,\n  readonly unknown[]\n>[number];\n\nexport interface WithZitadelOptions {\n  /**\n   * The Playwright config's directory (`import.meta.dirname`). Anchors the\n   * default handshake location and the working directory of the generated\n   * webServer entries.\n   */\n  configDir: string;\n  /**\n   * Fixed TCP port for the instance. Required (unlike `startLocalZitadel`,\n   * which defaults to a free port) because Playwright's readiness URL must be\n   * known while the config is evaluated, before anything boots.\n   */\n  port: number;\n  /**\n   * Origin the browser will use for the app under test. Registered as the\n   * project's preview origin (the backend's origin check rejects forwarded\n   * requests from unregistered origins) and the base of `app.readyPath`.\n   */\n  appOrigin: string;\n  /** Boot/bootstrap options forwarded to the instance supervisor. */\n  zitadel?: {\n    /** Absolute path to the server binary. */\n    serverBinary?: string;\n    /** Appended to the missing-binary error, e.g. \"run `moon run server:build` first.\" */\n    serverBinaryHint?: string;\n    projectName?: string;\n    preset?: SupervisorConfig[\"preset\"];\n    useCase?: SupervisorConfig[\"useCase\"];\n    /** Absolute state directory; defaults to a fresh temp dir removed on stop. */\n    dir?: string;\n    /** Keep the owned temp dir after stop (debugging). */\n    keep?: boolean;\n    /** webServer readiness timeout for the boot; cold boot dominates it. */\n    bootTimeoutMs?: number;\n  };\n  /**\n   * The app dev server to run against the instance.\n   *\n   * Omit it when the **instance itself serves the app** — the Zitadel binary\n   * embeds the console and hosted login shells at `/ui/console/` and\n   * `/ui/login/`, so there is no second server to boot and no env to hand it.\n   * Only the supervisor entry is generated, and `appOrigin` must then be the\n   * instance's own local origin — `http://localhost:<port>` (or another\n   * loopback alias); nothing else is served in this mode. This is the only\n   * configuration that exercises the production path — under a dev server,\n   * the app's proxy rewrites API requests that the binary would serve\n   * directly.\n   */\n  app?: {\n    /** Spawn argv (no shell), e.g. [\"corepack\", \"pnpm\", \"--filter\", \"my-app\", \"dev\"]. */\n    command: string[];\n    /** Working directory for the app command. */\n    cwd: string;\n    /** Path on `appOrigin` Playwright polls for readiness, e.g. \"/login\". */\n    readyPath: string;\n    /**\n     * Env vars the app needs, as a template mapping env names to\n     * InstanceHandle fields — see `nextAppEnv` for the `@zitadel/sdk-next`\n     * shape. A template (not a callback) because it crosses into the app\n     * runner process.\n     */\n    env: AppEnvTemplate;\n    readyTimeoutMs?: number;\n    /** How long SIGTERM gets before the app is killed on teardown. */\n    gracefulShutdownMs?: number;\n  };\n  /** Absolute path; defaults to `<configDir>/.zitadel-testing/handshake.json`. */\n  handshakePath?: string;\n}\n\n/**\n * Generate the Playwright `webServer` entries that boot an ephemeral seeded\n * Zitadel and run the app against it, replacing the per-suite wrapper\n * scripts. Spread the result into `defineConfig`:\n *\n * ```ts\n * export default defineConfig({\n *   ...withZitadel({ configDir: import.meta.dirname, port: 8092, ... }),\n *   testDir: \"./src-real\",\n * });\n * ```\n *\n * Omit `app` when the instance serves the app itself (the binary's embedded\n * `/ui/console/` and `/ui/login/` surfaces): only the boot entry is\n * generated, and `appOrigin` must be the instance's own origin.\n *\n * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the\n * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright\n * workers re-evaluate the config, which re-applies this for every process\n * that needs it. The returned value is plain data; append your own entries\n * to `webServer` if the suite needs additional servers.\n */\nexport function withZitadel(\n  options: WithZitadelOptions,\n  /** Test seam: alternative executable resolution. */\n  resolveEntry: (name: \"supervisor\" | \"app-runner\") => string = entryPoint,\n): { webServer: WebServerEntry[] } {\n  const { configDir, port, appOrigin, app } = options;\n  if (!isAbsolute(configDir)) {\n    throw new Error(`withZitadel: configDir must be absolute, got \"${configDir}\"`);\n  }\n  if (!Number.isInteger(port) || port <= 0) {\n    throw new Error(`withZitadel: port must be a positive integer, got ${port}`);\n  }\n  const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : undefined;\n  if (\n    !origin ||\n    (origin.protocol !== \"http:\" && origin.protocol !== \"https:\") ||\n    origin.pathname !== \"/\" ||\n    origin.search !== \"\" ||\n    origin.hash !== \"\"\n  ) {\n    throw new Error(\n      `withZitadel: appOrigin must be an origin like \"http://localhost:3002\", got \"${appOrigin}\"`,\n    );\n  }\n  if (app === undefined) {\n    // Nothing else will bind appOrigin in this mode: the instance is the app\n    // server, and it listens on plain HTTP at localhost:<port>. Anything\n    // else — another port, a real hostname, https — is an origin nobody\n    // serves, so Playwright's readiness wait would hang (or, worse, pass\n    // against an unrelated stale server). Loopback aliases are the only\n    // freedom; the scheme and port are the instance's.\n    const loopbackHosts = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\"]);\n    if (\n      origin.protocol !== \"http:\" ||\n      !loopbackHosts.has(origin.hostname) ||\n      (origin.port || \"80\") !== String(port)\n    ) {\n      throw new Error(\n        `withZitadel: with no \\`app\\`, the instance itself serves the app, so appOrigin ` +\n          `must be its local origin (http://localhost:${port}); got \"${appOrigin}\".`,\n      );\n    }\n  } else {\n    if (!app.readyPath.startsWith(\"/\")) {\n      throw new Error(`withZitadel: app.readyPath must start with \"/\", got \"${app.readyPath}\"`);\n    }\n    if (app.command.length === 0) {\n      throw new Error(\"withZitadel: app.command must not be empty\");\n    }\n    if (!isAbsolute(app.cwd)) {\n      throw new Error(`withZitadel: app.cwd must be absolute, got \"${app.cwd}\"`);\n    }\n  }\n  // Path options are consumed by the executables, whose cwd is configDir —\n  // a relative path would silently resolve against that, not the project.\n  for (const [label, value] of [\n    [\"zitadel.serverBinary\", options.zitadel?.serverBinary],\n    [\"zitadel.dir\", options.zitadel?.dir],\n    [\"handshakePath\", options.handshakePath],\n  ] as const) {\n    if (value !== undefined && !isAbsolute(value)) {\n      throw new Error(`withZitadel: ${label} must be an absolute path, got \"${value}\"`);\n    }\n  }\n\n  const handshakePath =\n    options.handshakePath ?? join(configDir, \".zitadel-testing\", \"handshake.json\");\n  // Workers inherit the runner's env; the fixtures resolve the instance from it.\n  process.env[HANDSHAKE_ENV] = handshakePath;\n\n  const supervisorConfig: SupervisorConfig = {\n    port,\n    appOrigins: [appOrigin],\n    serverBinary: options.zitadel?.serverBinary,\n    serverBinaryHint: options.zitadel?.serverBinaryHint,\n    dir: options.zitadel?.dir,\n    keep: options.zitadel?.keep,\n    projectName: options.zitadel?.projectName,\n    preset: options.zitadel?.preset,\n    useCase: options.zitadel?.useCase,\n  };\n  const supervisorEntry: WebServerEntry = {\n    command: `node ${JSON.stringify(resolveEntry(\"supervisor\"))}`,\n    url: `http://localhost:${port}/healthz`,\n    reuseExistingServer: false,\n    cwd: configDir,\n    stdout: \"pipe\",\n    stderr: \"pipe\",\n    // Cold boot (fresh data dir: migrations + health wait) dominates.\n    timeout: options.zitadel?.bootTimeoutMs ?? 120_000,\n    env: {\n      [HANDSHAKE_ENV]: handshakePath,\n      [SUPERVISOR_CONFIG_ENV]: JSON.stringify(supervisorConfig),\n    },\n    // SIGTERM first so the supervisor can stop the instance; the default\n    // hard kill would orphan the server process group.\n    gracefulShutdown: { signal: \"SIGTERM\", timeout: 30_000 },\n  };\n\n  if (app === undefined) {\n    return { webServer: [supervisorEntry] };\n  }\n\n  const appRunnerConfig: AppRunnerConfig = {\n    command: app.command,\n    cwd: app.cwd,\n    env: app.env,\n    handshakeTimeoutMs: app.readyTimeoutMs ?? 180_000,\n  };\n\n  return {\n    webServer: [\n      supervisorEntry,\n      {\n        command: `node ${JSON.stringify(resolveEntry(\"app-runner\"))}`,\n        url: new URL(app.readyPath, appOrigin).toString(),\n        reuseExistingServer: false,\n        cwd: configDir,\n        stdout: \"pipe\",\n        stderr: \"pipe\",\n        timeout: app.readyTimeoutMs ?? 180_000,\n        env: {\n          [HANDSHAKE_ENV]: handshakePath,\n          [APP_RUNNER_CONFIG_ENV]: JSON.stringify(appRunnerConfig),\n        },\n        gracefulShutdown: {\n          signal: \"SIGTERM\",\n          timeout: app.gracefulShutdownMs ?? 15_000,\n        },\n      },\n    ],\n  };\n}\n\n/**\n * Resolve a sibling dist entry in the same module format this file was loaded\n * as (dist/supervisor.mjs next to dist/playwright.mjs, .cjs next to .cjs), so\n * the spawned process needs no package-manager bin plumbing.\n */\nfunction entryPoint(name: \"supervisor\" | \"app-runner\"): string {\n  const self = fileURLToPath(import.meta.url);\n  const ext = extname(self);\n  if (ext !== \".mjs\" && ext !== \".cjs\") {\n    throw new Error(\n      `withZitadel: expected to run from the built package (got ${self}); ` +\n        \"build @zitadel/testing first (in-repo: `moon run testing:build`).\",\n    );\n  }\n  const path = fileURLToPath(new URL(`./${name}${ext}`, import.meta.url));\n  if (!existsSync(path)) {\n    throw new Error(\n      `withZitadel: missing ${path}; rebuild @zitadel/testing (in-repo: \\`moon run testing:build\\`).`,\n    );\n  }\n  return path;\n}\n","import { test as base, type Page } from \"@playwright/test\";\n\nimport { waitForHandshake } from \"./handshake\";\nimport { connectZitadel } from \"./index\";\nimport { enableVirtualPasskey, type VirtualPasskey } from \"./passkey\";\nimport type {\n  ConnectedZitadel,\n  Identity,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n\nexport interface AuthenticatedPage {\n  /** A page in its own context, already carrying the session cookie. */\n  page: Page;\n  user: SeededUser;\n  session: MintedSession;\n}\n\nexport interface ZitadelTestFixtures {\n  /** Per-test seeding; each call mints unique data on the shared instance. */\n  seed: {\n    user(input?: SeedUserInput): Promise<SeededUser>;\n    users(count: number, template?: SeedUsersTemplate): Promise<SeededUser[]>;\n    /** Unused email+password for registration flows — creates nothing. */\n    identity(): Identity;\n    /** Seeded user + headless real-flow login; password flows only. */\n    session(input?: SeedSessionInput): Promise<MintedSession>;\n  };\n  /**\n   * Start the test authenticated: a fresh user, a real session minted through\n   * the flow API, and the cookie injected into a dedicated browser context —\n   * the default `page` stays signed out for login-flow tests. Requires\n   * `use.baseURL` (every withZitadel consumer sets it).\n   */\n  authenticatedPage: AuthenticatedPage;\n  /**\n   * Virtual passkey authenticator attached to the default `page`, disposed on\n   * teardown. On-demand: tests that don't request it pay nothing. Chromium\n   * only — see `enableVirtualPasskey` for the constraints.\n   */\n  passkey: VirtualPasskey;\n}\n\nexport interface ZitadelWorkerFixtures {\n  /** Connection to the suite's instance, resolved once per worker. */\n  zitadel: ConnectedZitadel;\n}\n\nexport const test = base.extend<ZitadelTestFixtures, ZitadelWorkerFixtures>({\n  zitadel: [\n    // Playwright derives fixture dependencies from the destructuring pattern,\n    // so the empty pattern is required here.\n    // oxlint-disable-next-line no-empty-pattern\n    async ({}, use) => {\n      const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;\n      if (!handshakePath) {\n        throw new Error(\n          \"ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file \" +\n            \"written by the script that boots the instance (see @zitadel/testing docs).\",\n        );\n      }\n      // Wait, don't read-once: the supervisor's Playwright readiness URL is\n      // the instance's /healthz, which answers as soon as the *server* is up\n      // — the handshake lands only after *bootstrap* (project, schema,\n      // flows) completes a moment later. Suites with an `app` entry never\n      // see the gap (the app runner waits for the handshake before the app\n      // reports ready), but in app-less mode the first worker can get here\n      // first. Bootstrap after health is seconds at most, so the default\n      // wait is generous; a bootstrap failure surfaces as this timeout.\n      await use(connectZitadel(await waitForHandshake(handshakePath)));\n    },\n    // `auto`: every worker waits for the bootstrapped instance before its\n    // first test, including tests that use no fixture. Without it, a\n    // `page`-only test in an app-less suite can navigate during the\n    // bootstrap window and observe a project-less deployment — truthful,\n    // rendered as the setup hint, and not what any suite means to test.\n    // For app-ful suites this is a one-time handshake file read per worker.\n    { scope: \"worker\", auto: true },\n  ],\n  seed: async ({ zitadel, baseURL }, use) => {\n    await use({\n      user: (input) => zitadel.seedUser(input),\n      users: (count, template) => zitadel.seedUsers(count, template),\n      identity: () => zitadel.identity(),\n      // The suite's baseURL is the app origin the project allowlists.\n      session: (input) => zitadel.seedSession({ origin: baseURL, ...input }),\n    });\n  },\n  passkey: async ({ page }, use) => {\n    const passkey = await enableVirtualPasskey(page);\n    await use(passkey);\n    await passkey.dispose();\n  },\n  authenticatedPage: async ({ browser, zitadel, baseURL }, use) => {\n    if (!baseURL) {\n      throw new Error(\n        \"authenticatedPage requires `use.baseURL` so the session cookie can be \" +\n          \"scoped to the app under test.\",\n      );\n    }\n    const session = await zitadel.seedSession({ origin: baseURL });\n    const context = await browser.newContext({ baseURL });\n    // `addCookies` takes either url or domain/path; url derives the rest.\n    const { path: _path, ...cookie } = session.cookie;\n    await context.addCookies([{ ...cookie, url: baseURL }]);\n    const page = await context.newPage();\n    await use({ page, user: session.user, session });\n    await context.close();\n  },\n});\n\nexport { expect } from \"@playwright/test\";\nexport { applyAppEnvTemplate, nextAppEnv } from \"./app-env\";\nexport type { AppEnvTemplate } from \"./app-env\";\nexport {\n  clickFlowAction,\n  fillFlowField,\n  flowAction,\n  flowField,\n  loginWithPassword,\n  loginWithPasskey,\n  registerWithPassword,\n  registerWithPasskey,\n} from \"./flows\";\nexport type {\n  FlowActionOptions,\n  FlowFieldOptions,\n  LoginCredentials,\n  PasswordRegistrationDetails,\n  ProfileEntry,\n  RegistrationDetails,\n} from \"./flows\";\nexport { enableVirtualPasskey } from \"./passkey\";\nexport type { VirtualPasskey } from \"./passkey\";\nexport { withZitadel } from \"./playwright-config\";\nexport type { WithZitadelOptions } from \"./playwright-config\";\nexport type {\n  ConnectedZitadel,\n  Identity,\n  InstanceHandle,\n  MintedSession,\n  SeededUser,\n  SeedSessionInput,\n  SeedUserInput,\n  SeedUsersTemplate,\n} from \"./types\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AA6BA,eAAsB,qBAAqB,MAAqC;CAC9E,IAAI;AACJ,KAAI;AACF,WAAS,MAAM,KAAK,SAAS,CAAC,cAAc,KAAK;UAC1C,OAAO;AACd,QAAM,IAAI,MACR,4JAGA,EAAE,OAAO,OAAO,CACjB;;CAEH,IAAI;AACJ,KAAI;AACF,QAAM,OAAO,KAAK,kBAAkB;AACpC,GAAC,CAAE,mBAAoB,MAAM,OAAO,KAAK,oCAAoC,EAC3E,SAAS;GACP,UAAU;GACV,WAAW;GACX,gBAAgB;GAChB,qBAAqB;GACrB,gBAAgB;GAChB,6BAA6B;GAC9B,EACF,CAAC;UACK,OAAO;AAEd,QAAM,OAAO,QAAQ,CAAC,YAAY,KAAA,EAAU;AAC5C,QAAM;;AAGR,QAAO;EACL;EACA,MAAM,kBAAkB;GACtB,MAAM,EAAE,gBAAgB,MAAM,OAAO,KAAK,2BAA2B,EACnE,iBACD,CAAC;AACF,UAAO,YAAY;;EAErB,MAAM,UAAU;AAId,OAAI;AACF,UAAM,OAAO,KAAK,uCAAuC,EAAE,iBAAiB,CAAC;WACvE,WAEE;AACR,UAAM,OAAO,QAAQ,CAAC,YAAY,KAAA,EAAU;;;EAGjD;;;;;;;;;;;;;;;ACPH,SAAS,WAAW,MAAqB;AACvC,QAAO,KAAK,QAAQ,gBAAgB;;;;;;;;;;;AAYtC,SAAS,kBAAkB,OAAuB;CAChD,IAAI,MAAM;AACV,MAAK,MAAM,MAAM,OAAO;EACtB,MAAM,OAAO,GAAG,YAAY,EAAE,IAAI;AAClC,MAAI,SAAS,EACX,QAAO;WACE,QAAQ,MAAS,QAAQ,OAAQ,QAAQ,IAClD,QAAO,KAAK,KAAK,SAAS,GAAG,CAAC;WACrB,OAAO,QAAO,OAAO,KAC9B,QAAO,KAAK;MAEZ,QAAO;;AAGX,QAAO;;;;;;;;AAST,SAAgB,WAAW,MAAY,QAAgB,UAA6B,EAAE,EAAW;CAI/F,MAAM,gBAAgB,kBAAkB,OAAO;CAC/C,IAAI,aAAa,KACd,YAAY,kBAAkB,SAAS,CACvC,GAAG,KAAK,YAAY,kBAAkB,OAAO,SAAS,CAAC,CACvD,GAAG,KAAK,YAAY,kBAAkB,OAAO,OAAO,CAAC,CACrD,GAAG,KAAK,QAAQ,qBAAqB,cAAc,IAAI,CAAC,CACxD,GAAG,WAAW,KAAK,CAAC,QAAQ,iBAAiB,cAAc,IAAI,CAAC;AACnE,KAAI,QAAQ,KACV,cAAa,WACV,GAAG,WAAW,KAAK,CAAC,UAAU,UAAU,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC,CAChE,GAAG,WAAW,KAAK,CAAC,UAAU,QAAQ,EAAE,MAAM,QAAQ,MAAM,CAAC,CAAC;AAEnE,QAAO,WAAW,OAAO;;;;;;AAO3B,SAAgB,UAAU,MAAY,OAAe,UAA4B,EAAE,EAAW;CAC5F,IAAI,aAAa,KACd,YAAY,iBAAiB,QAAQ,CACrC,GAAG,KAAK,YAAY,iBAAiB,QAAQ,CAAC,QAAQ,QAAQ,CAAC;AAClE,KAAI,QAAQ,MACV,cAAa,WAAW,GAAG,WAAW,KAAK,CAAC,WAAW,QAAQ,MAAM,CAAC;AAExE,QAAO,WAAW,OAAO;;;AAI3B,eAAsB,gBACpB,MACA,QACA,SACe;AACf,OAAM,WAAW,MAAM,QAAQ,QAAQ,CAAC,OAAO;;;AAIjD,eAAsB,cACpB,MACA,OACA,OACA,SACe;AACf,OAAM,UAAU,MAAM,OAAO,QAAQ,CAAC,KAAK,MAAM;;;;;;;AAQnD,eAAsB,kBACpB,MACA,EAAE,OAAO,YACM;AACf,OAAM,WAAW,KAAK,CAAC,KAAK,MAAM;CAClC,MAAM,YAAY,cAAc,KAAK;AACrC,KAAI,CAAE,MAAM,UAAU,WAAW,CAAC,YAAY,MAAM,CAClD,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,UAAU,KAAK,SAAS;AAC9B,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;;;;;;;;;;AAW1C,eAAsB,iBAAiB,MAAY,UAA8B,EAAE,EAAiB;AAClG,KAAI,QAAQ,UAAU,KAAA,EACpB,OAAM,WAAW,KAAK,CAAC,KAAK,QAAQ,MAAM;AAE5C,OAAM,WAAW,MAAM,UAAU,CAAC,OAAO;;;;;;;;;;AAW3C,eAAsB,qBACpB,MACA,EAAE,OAAO,UAAU,WACJ;AACf,OAAM,sBAAsB,MAAM,OAAO,QAAQ;CAGjD,MAAM,YAAY,cAAc,KAAK;AACrC,KAAI,CAAE,MAAM,UAAU,WAAW,CAAC,YAAY,MAAM,CAClD,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,UAAU,KAAK,SAAS;AAC9B,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;;;;;;;;AAS1C,eAAsB,oBACpB,MACA,EAAE,OAAO,WACM;AACf,OAAM,sBAAsB,MAAM,OAAO,QAAQ;AACjD,OAAM,WAAW,MAAM,mBAAmB,CAAC,OAAO;;AAGpD,SAAS,WAAW,MAAqB;AACvC,QAAO,UAAU,MAAM,SAAS,EAAE,OAAO,UAAU,CAAC;;AAGtD,SAAS,cAAc,MAAqB;AAC1C,QAAO,UAAU,MAAM,YAAY,EAAE,OAAO,aAAa,CAAC;;;;;;;;;AAU5D,eAAe,sBACb,MACA,OACA,SACe;AACf,OAAM,WAAW,KAAK,CAAC,KAAK,MAAM;AAClC,KAAI,MAAM,cAAc,KAAK,CAAC,WAAW,CAAC,YAAY,MAAM,CAC1D,OAAM,WAAW,MAAM,WAAW,CAAC,OAAO;KAE1C,OAAM,WAAW,MAAM,SAAS,CAAC,OAAO;AAE1C,OAAM,uBAAuB,KAAK;AAGlC,OAAM,cAAc,WAAW,KAAK,EAAE,MAAM;AAC5C,MAAK,MAAM,SAAS,WAAW,EAAE,CAC/B,OAAM,iBAAiB,MAAM,MAAM;;;;;;;;;;;AAavC,eAAe,iBAAiB,MAAY,OAAoC;AAC9E,KAAI,OAAO,MAAM,UAAU,WAAW;EACpC,MAAM,WAAW,KAAK,YAAY,oBAAoB,MAAM,QAAQ,CAAC,OAAO;AAC5E,MAAI,MAAM,SAAS,WAAW,CAAC,YAAY,MAAM,CAC/C,OAAM,SAAS,WAAW,MAAM,MAAM;AAExC;;CAEF,MAAM,SAAS,KAAK,YAAY,kBAAkB,MAAM,QAAQ,CAAC,OAAO;AACxE,KAAI,MAAM,OAAO,WAAW,CAAC,YAAY,MAAM,EAAE;AAC/C,QAAM,OAAO,aAAa,MAAM,MAAM;AACtC;;AAEF,OAAM,cAAc,UAAU,MAAM,MAAM,OAAO,EAAE,OAAO,MAAM,OAAO,CAAC,EAAE,MAAM,MAAM;;;;;;;;;;AAWxF,eAAe,uBAAuB,MAA2B;AAC/D,OAAM,WAAW,MAAM,mBAAmB,CACvC,GAAG,WAAW,KAAK,CAAC,UAAU,WAAW,EAAE,MAAM,uCAAuC,CAAC,CAAC,CAC1F,OAAO,CACP,QAAQ;EAAE,OAAO;EAAW,SAAS;EAAQ,CAAC;;AAGnD,eAAe,cAAc,OAAgB,OAA8B;AACzE,KAAI,MAAM,MAAM,WAAW,CAAC,YAAY,MAAM,CAC5C,OAAM,MAAM,KAAK,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;ACpM3B,SAAgB,YACd,SAEA,eAA8D,YAC7B;CACjC,MAAM,EAAE,WAAW,MAAM,WAAW,QAAQ;AAC5C,KAAI,EAAA,GAAA,UAAA,YAAY,UAAU,CACxB,OAAM,IAAI,MAAM,iDAAiD,UAAU,GAAG;AAEhF,KAAI,CAAC,OAAO,UAAU,KAAK,IAAI,QAAQ,EACrC,OAAM,IAAI,MAAM,qDAAqD,OAAO;CAE9E,MAAM,SAAS,IAAI,SAAS,UAAU,GAAG,IAAI,IAAI,UAAU,GAAG,KAAA;AAC9D,KACE,CAAC,UACA,OAAO,aAAa,WAAW,OAAO,aAAa,YACpD,OAAO,aAAa,OACpB,OAAO,WAAW,MAClB,OAAO,SAAS,GAEhB,OAAM,IAAI,MACR,+EAA+E,UAAU,GAC1F;AAEH,KAAI,QAAQ,KAAA,GAAW;EAOrB,MAAM,gBAAgB,IAAI,IAAI;GAAC;GAAa;GAAa;GAAQ,CAAC;AAClE,MACE,OAAO,aAAa,WACpB,CAAC,cAAc,IAAI,OAAO,SAAS,KAClC,OAAO,QAAQ,UAAU,OAAO,KAAK,CAEtC,OAAM,IAAI,MACR,6HACgD,KAAK,UAAU,UAAU,IAC1E;QAEE;AACL,MAAI,CAAC,IAAI,UAAU,WAAW,IAAI,CAChC,OAAM,IAAI,MAAM,wDAAwD,IAAI,UAAU,GAAG;AAE3F,MAAI,IAAI,QAAQ,WAAW,EACzB,OAAM,IAAI,MAAM,6CAA6C;AAE/D,MAAI,EAAA,GAAA,UAAA,YAAY,IAAI,IAAI,CACtB,OAAM,IAAI,MAAM,+CAA+C,IAAI,IAAI,GAAG;;AAK9E,MAAK,MAAM,CAAC,OAAO,UAAU;EAC3B,CAAC,wBAAwB,QAAQ,SAAS,aAAa;EACvD,CAAC,eAAe,QAAQ,SAAS,IAAI;EACrC,CAAC,iBAAiB,QAAQ,cAAc;EACzC,CACC,KAAI,UAAU,KAAA,KAAa,EAAA,GAAA,UAAA,YAAY,MAAM,CAC3C,OAAM,IAAI,MAAM,gBAAgB,MAAM,kCAAkC,MAAM,GAAG;CAIrF,MAAM,gBACJ,QAAQ,kBAAA,GAAA,UAAA,MAAsB,WAAW,oBAAoB,iBAAiB;AAEhF,SAAQ,IAAIA,sBAAAA,iBAAiB;CAE7B,MAAM,mBAAqC;EACzC;EACA,YAAY,CAAC,UAAU;EACvB,cAAc,QAAQ,SAAS;EAC/B,kBAAkB,QAAQ,SAAS;EACnC,KAAK,QAAQ,SAAS;EACtB,MAAM,QAAQ,SAAS;EACvB,aAAa,QAAQ,SAAS;EAC9B,QAAQ,QAAQ,SAAS;EACzB,SAAS,QAAQ,SAAS;EAC3B;CACD,MAAM,kBAAkC;EACtC,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,oBAAoB,KAAK;EAC9B,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EAER,SAAS,QAAQ,SAAS,iBAAiB;EAC3C,KAAK;IACFA,sBAAAA,gBAAgB;IAChBC,sBAAAA,wBAAwB,KAAK,UAAU,iBAAiB;GAC1D;EAGD,kBAAkB;GAAE,QAAQ;GAAW,SAAS;GAAQ;EACzD;AAED,KAAI,QAAQ,KAAA,EACV,QAAO,EAAE,WAAW,CAAC,gBAAgB,EAAE;CAGzC,MAAM,kBAAmC;EACvC,SAAS,IAAI;EACb,KAAK,IAAI;EACT,KAAK,IAAI;EACT,oBAAoB,IAAI,kBAAkB;EAC3C;AAED,QAAO,EACL,WAAW,CACT,iBACA;EACE,SAAS,QAAQ,KAAK,UAAU,aAAa,aAAa,CAAC;EAC3D,KAAK,IAAI,IAAI,IAAI,WAAW,UAAU,CAAC,UAAU;EACjD,qBAAqB;EACrB,KAAK;EACL,QAAQ;EACR,QAAQ;EACR,SAAS,IAAI,kBAAkB;EAC/B,KAAK;IACFD,sBAAAA,gBAAgB;IAChBE,sBAAAA,wBAAwB,KAAK,UAAU,gBAAgB;GACzD;EACD,kBAAkB;GAChB,QAAQ;GACR,SAAS,IAAI,sBAAsB;GACpC;EACF,CACF,EACF;;;;;;;AAQH,SAAS,WAAW,MAA2C;CAC7D,MAAM,QAAA,GAAA,SAAA,eAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAqC;CAC3C,MAAM,OAAA,GAAA,UAAA,SAAc,KAAK;AACzB,KAAI,QAAQ,UAAU,QAAQ,OAC5B,OAAM,IAAI,MACR,4DAA4D,KAAK,wEAElE;CAEH,MAAM,QAAA,GAAA,SAAA,eAAqB,IAAI,IAAI,KAAK,OAAO,OAAA,QAAA,MAAA,CAAA,cAAA,WAAA,CAAA,KAAuB,CAAC;AACvE,KAAI,EAAA,GAAA,QAAA,YAAY,KAAK,CACnB,OAAM,IAAI,MACR,wBAAwB,KAAK,mEAC9B;AAEH,QAAO;;;;ACtNT,MAAa,OAAOC,iBAAAA,KAAK,OAAmD;CAC1E,SAAS,CAIP,OAAO,IAAI,QAAQ;EACjB,MAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,cACH,OAAM,IAAI,MACR,kJAED;AAUH,QAAM,IAAIC,YAAAA,eAAe,MAAMC,kBAAAA,iBAAiB,cAAc,CAAC,CAAC;IAQlE;EAAE,OAAO;EAAU,MAAM;EAAM,CAChC;CACD,MAAM,OAAO,EAAE,SAAS,WAAW,QAAQ;AACzC,QAAM,IAAI;GACR,OAAO,UAAU,QAAQ,SAAS,MAAM;GACxC,QAAQ,OAAO,aAAa,QAAQ,UAAU,OAAO,SAAS;GAC9D,gBAAgB,QAAQ,UAAU;GAElC,UAAU,UAAU,QAAQ,YAAY;IAAE,QAAQ;IAAS,GAAG;IAAO,CAAC;GACvE,CAAC;;CAEJ,SAAS,OAAO,EAAE,QAAQ,QAAQ;EAChC,MAAM,UAAU,MAAM,qBAAqB,KAAK;AAChD,QAAM,IAAI,QAAQ;AAClB,QAAM,QAAQ,SAAS;;CAEzB,mBAAmB,OAAO,EAAE,SAAS,SAAS,WAAW,QAAQ;AAC/D,MAAI,CAAC,QACH,OAAM,IAAI,MACR,sGAED;EAEH,MAAM,UAAU,MAAM,QAAQ,YAAY,EAAE,QAAQ,SAAS,CAAC;EAC9D,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,SAAS,CAAC;EAErD,MAAM,EAAE,MAAM,OAAO,GAAG,WAAW,QAAQ;AAC3C,QAAM,QAAQ,WAAW,CAAC;GAAE,GAAG;GAAQ,KAAK;GAAS,CAAC,CAAC;AAEvD,QAAM,IAAI;GAAE,MAAA,MADO,QAAQ,SAAS;GAClB,MAAM,QAAQ;GAAM;GAAS,CAAC;AAChD,QAAM,QAAQ,OAAO;;CAExB,CAAC"}

package/dist/playwright.d.mts

@@ -1,4 +1,4 @@
-import { a as Identity, d as SeedUserInput, f as SeedUsersTemplate, i as ConnectedZitadel, l as MintedSession, n as applyAppEnvTemplate, o as InstanceHandle, p as SeededUser, r as nextAppEnv, t as AppEnvTemplate, u as SeedSessionInput } from "./app-env-D3W0GYhA.mjs";
+import { a as Identity, d as SeedUserInput, f as SeedUsersTemplate, i as ConnectedZitadel, l as MintedSession, n as applyAppEnvTemplate, o as InstanceHandle, p as SeededUser, r as nextAppEnv, t as AppEnvTemplate, u as SeedSessionInput } from "./app-env-Btmfcflb.mjs";
 import { SetupPreset, SetupUseCase } from "@zitadel/config/defaults";
 import * as _$_playwright_test0 from "@playwright/test";
 import { Locator, Page, PlaywrightTestConfig, expect } from "@playwright/test";
@@ -194,8 +194,20 @@ interface WithZitadelOptions {
     keep?: boolean; /** webServer readiness timeout for the boot; cold boot dominates it. */
     bootTimeoutMs?: number;
   };
-  /** The app dev server to run against the instance. */
-  app: {
+  /**
+   * The app dev server to run against the instance.
+   *
+   * Omit it when the **instance itself serves the app** — the Zitadel binary
+   * embeds the console and hosted login shells at `/ui/console/` and
+   * `/ui/login/`, so there is no second server to boot and no env to hand it.
+   * Only the supervisor entry is generated, and `appOrigin` must then be the
+   * instance's own local origin — `http://localhost:<port>` (or another
+   * loopback alias); nothing else is served in this mode. This is the only
+   * configuration that exercises the production path — under a dev server,
+   * the app's proxy rewrites API requests that the binary would serve
+   * directly.
+   */
+  app?: {
     /** Spawn argv (no shell), e.g. ["corepack", "pnpm", "--filter", "my-app", "dev"]. */command: string[]; /** Working directory for the app command. */
     cwd: string; /** Path on `appOrigin` Playwright polls for readiness, e.g. "/login". */
     readyPath: string;
@@ -224,6 +236,10 @@ interface WithZitadelOptions {
  * });
  * ```
  *
+ * Omit `app` when the instance serves the app itself (the binary's embedded
+ * `/ui/console/` and `/ui/login/` surfaces): only the boot entry is
+ * generated, and `appOrigin` must be the instance's own origin.
+ *
  * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the
  * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright
  * workers re-evaluate the config, which re-applies this for every process

package/dist/playwright.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"playwright.d.mts","names":[],"sources":["../src/passkey.ts","../src/flows.ts","../src/orchestration.ts","../src/playwright-config.ts","../src/playwright.ts"],"mappings":";;;;;;;;;;;UAOiB,cAAA;EAAc;EAE7B,eAAA;EAIkB;EAFlB,eAAA,IAAmB,OAAA;EAAnB;EAEA,OAAA,IAAW,OAAA;AAAA;;;;AAgBb;;;;;;;;;;iBAAsB,oBAAA,CAAqB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,cAAA;;;;;;;;AAtBhE;;;;;;;;;;;AAsBA;UCTiB,iBAAA;;;;;EAKf,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,gBAAA;EDC0B;ECCzC,KAAA,GAAQ,MAAA;AAAA;;;;;;AAVV;UAmBiB,YAAA;;EAEf,KAAA;EACA,KAAA;EAde;EAgBf,KAAA,GAAQ,MAAA;AAAA;AAAA,UAGO,gBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,mBAAA;EACf,KAAA;EAZA;EAcA,OAAA,GAAU,YAAA;AAAA;AAAA,UAGK,2BAAA,SAAoC,mBAAA;EACnD,QAAA;AAAA;AAZF;;;;;AAKA;AALA,iBA8DgB,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,MAAA,UAAgB,OAAA,GAAS,iBAAA,GAAyB,OAAA;;;;;iBAuBzE,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,GAAS,gBAAA,GAAwB,OAAA;;iBAWhE,eAAA,CACpB,IAAA,EAAM,IAAA,EACN,MAAA,UACA,OAAA,GAAU,iBAAA,GACT,OAAA;AAzFH;AAAA,iBA8FsB,aAAA,CACpB,IAAA,EAAM,IAAA,EACN,KAAA,UACA,KAAA,UACA,OAAA,GAAU,gBAAA,GACT,OAAA;;;;AAhDH;;iBAyDsB,iBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO;AAAA,GAAY,gBAAA,GACpB,OAAA;;;;;;;;;iBAkBmB,gBAAA,CAAiB,IAAA,EAAM,IAAA,EAAM,OAAA;EAAW,KAAA;AAAA,IAAwB,OAAA;;;AAvDtF;;;;;;iBAsEsB,oBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO,QAAA;EAAU;AAAA,GAAW,2BAAA,GAC7B,OAAA;;;;;;;iBAkBmB,mBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO;AAAA,GAAW,mBAAA,GACnB,OAAA;;;UCnNc,gBAAA;EFFf;EEIA,IAAA;EACA,UAAA;EACA,YAAA;EFUoB;EERpB,gBAAA;EACA,GAAA;EACA,IAAA;EACA,WAAA;EACA,MAAA,GAAS,WAAA;EACT,OAAA,GAAU,YAAA;EACV,SAAA;AAAA;;;KCZG,cAAA,GAAiB,OAAA,CACpB,WAAA,CAAY,oBAAA;AAAA,UAIG,kBAAA;;AHbjB;;;;EGmBE,SAAA;EHfA;;;;;EGqBA,IAAA;EHHoB;;;;;EGSpB,SAAA;EHT6D;EGW7D,OAAA;IHX+C,0CGa7C,YAAA,WHboD;IGepD,gBAAA;IACA,WAAA;IACA,MAAA,GAAS,gBAAA;IACT,OAAA,GAAU,gBAAA;IAEV,GAAA,WF7Ba;IE+Bb,IAAA,YF1BK;IE4BL,aAAA;EAAA;EFzBa;EE4Bf,GAAA;IF1BQ,qFE4BN,OAAA,YF5BY;IE8BZ,GAAA,UFrByB;IEuBzB,SAAA;IFlBY;;;;;;IEyBZ,GAAA,EAAK,cAAA;IACL,cAAA,WFvB6B;IEyB7B,kBAAA;EAAA;EFvBM;EE0BR,aAAA;AAAA;;;;;;;;AFjBF;;;;;AAmDA;;;;;;iBEbgB,WAAA,CACd,OAAA,EAAS,kBAAA;;AAET,YAAA,IAAe,IAAA;EACZ,SAAA,EAAW,cAAA;AAAA;;;UCrFC,iBAAA;;EAEf,IAAA,EAAM,IAAA;EACN,IAAA,EAAM,UAAA;EACN,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,mBAAA;EJbf;EIeA,IAAA;IACE,IAAA,CAAK,KAAA,GAAQ,aAAA,GAAgB,OAAA,CAAQ,UAAA;IACrC,KAAA,CAAM,KAAA,UAAe,QAAA,GAAW,iBAAA,GAAoB,OAAA,CAAQ,UAAA,KJbnD;IIeT,QAAA,IAAY,QAAA,EJfI;IIiBhB,OAAA,CAAQ,KAAA,GAAQ,gBAAA,GAAmB,OAAA,CAAQ,aAAA;EAAA;;;;;;;EAQ7C,iBAAA,EAAmB,iBAAA;EJTsB;;;;;EIezC,OAAA,EAAS,cAAA;AAAA;AAAA,UAGM,qBAAA;EH3BA;EG6Bf,OAAA,EAAS,gBAAA;AAAA;AAAA,cAGE,IAAA,EAAI,mBAAA,CAAA,QAAA,CA+Cf,mBAAA,CA/Ce,kBAAA,GAAA,mBAAA,CAAA,qBAAA,GAAA,mBAAA,EAAA,mBAAA,CAAA,oBAAA,GAAA,mBAAA,CAAA,uBAAA,GAAA,qBAAA"}
+{"version":3,"file":"playwright.d.mts","names":[],"sources":["../src/passkey.ts","../src/flows.ts","../src/orchestration.ts","../src/playwright-config.ts","../src/playwright.ts"],"mappings":";;;;;;;;;;;UAOiB,cAAA;EAAc;EAE7B,eAAA;EAIkB;EAFlB,eAAA,IAAmB,OAAA;EAAnB;EAEA,OAAA,IAAW,OAAA;AAAA;;;;AAgBb;;;;;;;;;;iBAAsB,oBAAA,CAAqB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,cAAA;;;;;;;;AAtBhE;;;;;;;;;;;AAsBA;UCTiB,iBAAA;;;;;EAKf,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,gBAAA;EDC0B;ECCzC,KAAA,GAAQ,MAAA;AAAA;;;;;;AAVV;UAmBiB,YAAA;;EAEf,KAAA;EACA,KAAA;EAde;EAgBf,KAAA,GAAQ,MAAA;AAAA;AAAA,UAGO,gBAAA;EACf,KAAA;EACA,QAAA;AAAA;AAAA,UAGe,mBAAA;EACf,KAAA;EAZA;EAcA,OAAA,GAAU,YAAA;AAAA;AAAA,UAGK,2BAAA,SAAoC,mBAAA;EACnD,QAAA;AAAA;AAZF;;;;;AAKA;AALA,iBA8DgB,UAAA,CAAW,IAAA,EAAM,IAAA,EAAM,MAAA,UAAgB,OAAA,GAAS,iBAAA,GAAyB,OAAA;;;;;iBAuBzE,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,KAAA,UAAe,OAAA,GAAS,gBAAA,GAAwB,OAAA;;iBAWhE,eAAA,CACpB,IAAA,EAAM,IAAA,EACN,MAAA,UACA,OAAA,GAAU,iBAAA,GACT,OAAA;AAzFH;AAAA,iBA8FsB,aAAA,CACpB,IAAA,EAAM,IAAA,EACN,KAAA,UACA,KAAA,UACA,OAAA,GAAU,gBAAA,GACT,OAAA;;;;AAhDH;;iBAyDsB,iBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO;AAAA,GAAY,gBAAA,GACpB,OAAA;;;;;;;;;iBAkBmB,gBAAA,CAAiB,IAAA,EAAM,IAAA,EAAM,OAAA;EAAW,KAAA;AAAA,IAAwB,OAAA;;;AAvDtF;;;;;;iBAsEsB,oBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO,QAAA;EAAU;AAAA,GAAW,2BAAA,GAC7B,OAAA;;;;;;;iBAkBmB,mBAAA,CACpB,IAAA,EAAM,IAAA;EACJ,KAAA;EAAO;AAAA,GAAW,mBAAA,GACnB,OAAA;;;UCnNc,gBAAA;EFFf;EEIA,IAAA;EACA,UAAA;EACA,YAAA;EFUoB;EERpB,gBAAA;EACA,GAAA;EACA,IAAA;EACA,WAAA;EACA,MAAA,GAAS,WAAA;EACT,OAAA,GAAU,YAAA;EACV,SAAA;AAAA;;;KCZG,cAAA,GAAiB,OAAA,CACpB,WAAA,CAAY,oBAAA;AAAA,UAIG,kBAAA;;AHbjB;;;;EGmBE,SAAA;EHfA;;;;;EGqBA,IAAA;EHHoB;;;;;EGSpB,SAAA;EHT6D;EGW7D,OAAA;IHX+C,0CGa7C,YAAA,WHboD;IGepD,gBAAA;IACA,WAAA;IACA,MAAA,GAAS,gBAAA;IACT,OAAA,GAAU,gBAAA;IAEV,GAAA,WF7Ba;IE+Bb,IAAA,YF1BK;IE4BL,aAAA;EAAA;EFzBa;;;;;AAWjB;;;;;;;;EE6BE,GAAA;IFxBc,qFE0BZ,OAAA,YFvB6B;IEyB7B,GAAA,UFvBF;IEyBE,SAAA;IFtBa;;;;;;IE6Bb,GAAA,EAAK,cAAA;IACL,cAAA,WF3BoB;IE6BpB,kBAAA;EAAA;;EAGF,aAAA;AAAA;AFsBF;;;;;;;;;;;;;;;;AAuBA;;;;;;AAvBA,iBEGgB,WAAA,CACd,OAAA,EAAS,kBAAA;;AAET,YAAA,IAAe,IAAA;EACZ,SAAA,EAAW,cAAA;AAAA;;;UCrGC,iBAAA;;EAEf,IAAA,EAAM,IAAA;EACN,IAAA,EAAM,UAAA;EACN,OAAA,EAAS,aAAA;AAAA;AAAA,UAGM,mBAAA;EJbf;EIeA,IAAA;IACE,IAAA,CAAK,KAAA,GAAQ,aAAA,GAAgB,OAAA,CAAQ,UAAA;IACrC,KAAA,CAAM,KAAA,UAAe,QAAA,GAAW,iBAAA,GAAoB,OAAA,CAAQ,UAAA,KJbnD;IIeT,QAAA,IAAY,QAAA,EJfI;IIiBhB,OAAA,CAAQ,KAAA,GAAQ,gBAAA,GAAmB,OAAA,CAAQ,aAAA;EAAA;;;;;;;EAQ7C,iBAAA,EAAmB,iBAAA;EJTsB;;;;;EIezC,OAAA,EAAS,cAAA;AAAA;AAAA,UAGM,qBAAA;EH3BA;EG6Bf,OAAA,EAAS,gBAAA;AAAA;AAAA,cAGE,IAAA,EAAI,mBAAA,CAAA,QAAA,CA6Df,mBAAA,CA7De,kBAAA,GAAA,mBAAA,CAAA,qBAAA,GAAA,mBAAA,EAAA,mBAAA,CAAA,oBAAA,GAAA,mBAAA,CAAA,uBAAA,GAAA,qBAAA"}

package/dist/playwright.mjs

@@ -1,5 +1,5 @@
-import { a as nextAppEnv, i as applyAppEnvTemplate, t as readHandshakeSync } from "./handshake-ClzWvG8z.mjs";
-import { t as connectZitadel } from "./src-eTcdx-ZS.mjs";
+import { a as nextAppEnv, i as applyAppEnvTemplate, n as waitForHandshake } from "./handshake-ClzWvG8z.mjs";
+import { t as connectZitadel } from "./src-9dFjTIAw.mjs";
 import { n as HANDSHAKE_ENV, r as SUPERVISOR_CONFIG_ENV, t as APP_RUNNER_CONFIG_ENV } from "./orchestration-C640_1Lg.mjs";
 import { extname, isAbsolute, join } from "node:path";
 import { existsSync } from "node:fs";
@@ -244,6 +244,10 @@ async function fillIfVisible(field, value) {
 * });
 * ```
 *
+* Omit `app` when the instance serves the app itself (the binary's embedded
+* `/ui/console/` and `/ui/login/` surfaces): only the boot entry is
+* generated, and `appOrigin` must be the instance's own origin.
+*
 * Also points ZITADEL_TESTING_HANDSHAKE at the handshake file so the
 * `@zitadel/testing/playwright` fixtures resolve the instance — Playwright
 * workers re-evaluate the config, which re-applies this for every process
@@ -256,9 +260,18 @@ function withZitadel(options, resolveEntry = entryPoint) {
 	if (!Number.isInteger(port) || port <= 0) throw new Error(`withZitadel: port must be a positive integer, got ${port}`);
 	const origin = URL.canParse(appOrigin) ? new URL(appOrigin) : void 0;
 	if (!origin || origin.protocol !== "http:" && origin.protocol !== "https:" || origin.pathname !== "/" || origin.search !== "" || origin.hash !== "") throw new Error(`withZitadel: appOrigin must be an origin like "http://localhost:3002", got "${appOrigin}"`);
-	if (!app.readyPath.startsWith("/")) throw new Error(`withZitadel: app.readyPath must start with "/", got "${app.readyPath}"`);
-	if (app.command.length === 0) throw new Error("withZitadel: app.command must not be empty");
-	if (!isAbsolute(app.cwd)) throw new Error(`withZitadel: app.cwd must be absolute, got "${app.cwd}"`);
+	if (app === void 0) {
+		const loopbackHosts = new Set([
+			"localhost",
+			"127.0.0.1",
+			"[::1]"
+		]);
+		if (origin.protocol !== "http:" || !loopbackHosts.has(origin.hostname) || (origin.port || "80") !== String(port)) throw new Error(`withZitadel: with no \`app\`, the instance itself serves the app, so appOrigin must be its local origin (http://localhost:${port}); got "${appOrigin}".`);
+	} else {
+		if (!app.readyPath.startsWith("/")) throw new Error(`withZitadel: app.readyPath must start with "/", got "${app.readyPath}"`);
+		if (app.command.length === 0) throw new Error("withZitadel: app.command must not be empty");
+		if (!isAbsolute(app.cwd)) throw new Error(`withZitadel: app.cwd must be absolute, got "${app.cwd}"`);
+	}
 	for (const [label, value] of [
 		["zitadel.serverBinary", options.zitadel?.serverBinary],
 		["zitadel.dir", options.zitadel?.dir],
@@ -277,13 +290,7 @@ function withZitadel(options, resolveEntry = entryPoint) {
 		preset: options.zitadel?.preset,
 		useCase: options.zitadel?.useCase
 	};
-	const appRunnerConfig = {
-		command: app.command,
-		cwd: app.cwd,
-		env: app.env,
-		handshakeTimeoutMs: app.readyTimeoutMs ?? 18e4
-	};
-	return { webServer: [{
+	const supervisorEntry = {
 		command: `node ${JSON.stringify(resolveEntry("supervisor"))}`,
 		url: `http://localhost:${port}/healthz`,
 		reuseExistingServer: false,
@@ -299,7 +306,15 @@ function withZitadel(options, resolveEntry = entryPoint) {
 			signal: "SIGTERM",
 			timeout: 3e4
 		}
-	}, {
+	};
+	if (app === void 0) return { webServer: [supervisorEntry] };
+	const appRunnerConfig = {
+		command: app.command,
+		cwd: app.cwd,
+		env: app.env,
+		handshakeTimeoutMs: app.readyTimeoutMs ?? 18e4
+	};
+	return { webServer: [supervisorEntry, {
 		command: `node ${JSON.stringify(resolveEntry("app-runner"))}`,
 		url: new URL(app.readyPath, appOrigin).toString(),
 		reuseExistingServer: false,
@@ -336,8 +351,11 @@ const test = test$1.extend({
 	zitadel: [async ({}, use) => {
 		const handshakePath = process.env.ZITADEL_TESTING_HANDSHAKE;
 		if (!handshakePath) throw new Error("ZITADEL_TESTING_HANDSHAKE is not set. Point it at the handshake file written by the script that boots the instance (see @zitadel/testing docs).");
-		await use(connectZitadel(readHandshakeSync(handshakePath)));
-	}, { scope: "worker" }],
+		await use(connectZitadel(await waitForHandshake(handshakePath)));
+	}, {
+		scope: "worker",
+		auto: true
+	}],
 	seed: async ({ zitadel, baseURL }, use) => {
 		await use({
 			user: (input) => zitadel.seedUser(input),