spiderly 19.12.1 → 19.12.3

package/lib/components/spiderly-data-table/spiderly-data-table.component.d.ts

@@ -10,7 +10,7 @@ import { Filter } from '../../entities/filter';
 import { LazyLoadSelectedIdsResult } from '../../entities/lazy-load-selected-ids-result';
 import { PaginatedResult } from '../../entities/paginated-result';
 import { PrimengOption } from '../../entities/primeng-option';
-import { FilterSource, SortKeyLabel } from '../../filters/filter-store';
+import { FilterSource, SortKeyLabel, SortPickOption } from '../../filters/filter-store';
 import { SpiderlyFilterTemplateDirective } from '../../directives/spiderly-filter-template.directive';
 import { ConfigServiceBase } from '../../services/config.service.base';
 import { SpiderlyMessageService } from '../../services/spiderly-message.service';
@@ -416,23 +416,32 @@ export declare class SpiderlyDataTableComponent implements OnInit, OnChanges, Af
     private get viewSortStateKey();
     /** The operator's stored sort for the active view, sanitized like any persisted sort. */
     private persistedViewSort;
-    /** The sort this view asks for: the operator's stored override, else its declared sort. */
-    private viewSort;
+    /**
+     * THE resolution ladder, named once: the operator's stored override, else the declared
+     * default (`defaultMultiSortMeta` = view's declared sort ?? table default). Null means
+     * "unsorted" — callers append their own `?? []` / blob terms rather than re-spelling the
+     * ladder, so a future term (a per-view default refinement, decision 10's columns half)
+     * lands everywhere at once.
+     */
+    private resolvedViewSort;
     /**
      * Records the current sort as the active view's override — called from the EXPLICIT sort
-     * gestures only (header click, menu sort, Clear filters), never from a load: a sort merely
-     * inherited at init must not crystallize into an override, or a later change to the view's
-     * declared sort would stop flowing to operators who never touched sort — the same
-     * flows-through rule `columnVisibilityOverrides` documents. A sort equal to the declared
-     * default is stored as ABSENCE for the same reason.
+     * gestures only (header click, `applySort` — the menu and both bar entry points), never
+     * from a load: a sort merely inherited at init must not crystallize into an override, or a
+     * later change to the view's declared sort would stop flowing to operators who never
+     * touched sort — the same flows-through rule `columnVisibilityOverrides` documents. A sort
+     * equal to the declared default is stored as ABSENCE for the same reason.
      */
     private persistActiveViewSort;
     /**
-     * Puts the entering view's sort on the grid — stored override first, then the declared sort;
-     * a view stating no preference keeps the ordering already there (the pre-decision-10-sort
-     * behavior, and the least surprising for the tab an operator never sorted). Broadcast only —
-     * the caller owns the refetch, because which request carries the new sort differs between the
-     * store and storeless paths.
+     * Puts the entering view's sort on the grid — stored override, else declared sort, else the
+     * table default, else UNSORTED. A view is a COMPLETE state, sort included (2026-09-06,
+     * grilled — supersedes the "a view stating no preference keeps the ordering already there"
+     * this first shipped with): the carried-over ordering read as a bug in its first live week,
+     * when "Poslate"'s statusChangedAt rode onto "Sve", whose sorted column ships hidden —
+     * read-only chip, no header to tri-state, no way out. Polaris IndexFilters is the model:
+     * sort is part of a view's saved definition. Broadcast only — the caller owns the refetch,
+     * because which request carries the new sort differs between the store and storeless paths.
      */
     private applyViewSort;
     /**
@@ -538,8 +547,8 @@ export declare class SpiderlyDataTableComponent implements OnInit, OnChanges, Af
     /**
      * Switches to a view. Clears first, always: a view is a STATE rather than an addition, and two
      * of them composed produce a question nobody asked. The clear runs through the store directly
-     * rather than through `clear(table)`, which would also wipe the sort and the persisted state a
-     * view is entitled to keep.
+     * rather than through `clear()`, whose requery effect would spend a fetch before the entering
+     * view's filters are in place.
      */
     selectView(view: TableView): void;
     /**
@@ -636,6 +645,35 @@ export declare class SpiderlyDataTableComponent implements OnInit, OnChanges, Af
      * left falls back to its own name rather than vanishing.
      */
     private refreshSortKeys;
+    /**
+     * Gates the picker's reset row. Refreshed with `sortKeys` — same request, same reason it is a
+     * field rather than a getter. "Default" is view-aware (`defaultMultiSortMeta`), so inside a
+     * view the row offers the view's ordering back, not the table's.
+     */
+    sortIsDefault: boolean;
+    /**
+     * What the bar's picker offers: every sortable data column, hidden ones INCLUDED — the picker
+     * exists so an ordering does not need its column on screen. Built once in `ngOnInit` (columns
+     * are a declaration, not state) and labelled here because the bar knows nothing about columns.
+     */
+    sortPickOptions: SortPickOption[];
+    /**
+     * The one body of an explicit sort GESTURE — the thing `persistActiveViewSort`'s doc calls
+     * "explicit gestures only": page one, meta on the grid, fetch, save, selection anchor
+     * invalidated, override recorded. Shared by the header's single-click un-sort, the header
+     * menu and both bar entry points; `broadcastSort` is its deliberate no-fetch sibling. The
+     * page reset, `saveState` and anchor line mirror PrimeNG's own `sort()` (`sortMultiple()`
+     * does none of the three); the "lands on page one" / "survives a reload" specs pin why.
+     */
+    private applySort;
+    /** The picker's ask: one sort, replacing the whole meta — the same contract as the header menu. */
+    sortFromBar(pick: SortMeta): void;
+    /**
+     * Back to the resolved default — the view's declared sort, else the table default, else
+     * unsorted. Persisting right after is what empties the override slot: a sort equal to the
+     * default is stored as absence, so the declared ordering flows through again.
+     */
+    resetSortFromBar(): void;
     /** This column's share, override first, then its declared width, then the per-type default. */
     columnShare(col: Column): number;
     /**
@@ -716,11 +754,16 @@ export declare class SpiderlyDataTableComponent implements OnInit, OnChanges, Af
     actionTrackByFn(index: any, item: Action): string;
     exportListToExcel(): void;
     /**
-     * Clears everything that narrows the grid. With a store supplied it has to reach BOTH — the
-     * store holds the constraints and PrimeNG holds the persisted state and sort — or the bar goes
-     * empty while a reload brings the old filters back.
+     * Clears the FILTERS — and nothing else (2026-09-06, grilled). It used to also reach the
+     * sort and PrimeNG's persisted state, which made "Clear filters" a reset the label never
+     * claimed: sort is its own channel with its own affordances (the bar's picker, the header's
+     * tri-state), mirroring Polaris, where onClearAll is wired to the Filters while
+     * sortSelected never passes through it. The store's requery effect owns the refetch and the
+     * persisted-snapshot update — the button only renders with chips on the bar, so the applied
+     * set always changes — and dropping table.clear() also drops the second, unsequenced
+     * request the 2026-09-05 review flagged on every Clear.
      */
-    clear(table: Table): void;
+    clear(): void;
     setFakeIsAllSelected(): void;
     selectAll(checked: boolean): void;
     /**

package/lib/filters/filter-store.d.ts

@@ -164,12 +164,22 @@ export type FilterSnapshot = Record<string, {
     value: unknown;
 }>;
 /**
- * One sort key as the bar draws it. Sort deliberately does NOT live in the filter store:
- * `multiSortMeta` already holds it, keyed by field, and a copy here would be a second source of
- * truth for one fact. The bar is one surface reading two owners.
+ * One column the bar's sort picker offers, labelled by whoever owns the columns — the bar knows
+ * nothing about them. Hidden sortable columns belong in the list: the picker exists precisely so
+ * an ordering does not need its column on screen (decision 2b's sort half).
  */
-export interface SortKeyLabel {
+export interface SortPickOption {
+    field: string;
     label: string;
+}
+/**
+ * One sort key as the bar draws it — a pick option WITH its direction. Sort deliberately does
+ * NOT live in the filter store: `multiSortMeta` already holds it, keyed by field, and a copy
+ * here would be a second source of truth for one fact. The bar is one surface reading two
+ * owners. `field` is what lets the picker mark the active row and flip its direction; the
+ * label alone could not say which option it names once two columns share a name.
+ */
+export interface SortKeyLabel extends SortPickOption {
     descending: boolean;
 }
 /** One applied constraint, in the shape the chip bar draws. */

package/lib/filters/spiderly-filter-bar.component.d.ts

@@ -1,7 +1,8 @@
 import { QueryList, TemplateRef } from '@angular/core';
+import { SortMeta } from 'primeng/api';
 import { SpiderlyFilterTemplateDirective } from '../directives/spiderly-filter-template.directive';
 import { MatchModeCodes } from '../enums/match-mode-enum-codes';
-import { AppliedFilter, FilterBarSource, FilterHandle, FilterOption, SortKeyLabel } from './filter-store';
+import { AppliedFilter, FilterBarSource, FilterHandle, FilterOption, SortKeyLabel, SortPickOption } from './filter-store';
 import * as i0 from "@angular/core";
 /**
  * Lowercased and stripped of diacritics for matching. NFD decomposition handles č/ć/š/ž, but NOT
@@ -33,8 +34,20 @@ export declare class SpiderlyFilterBarComponent {
      * about columns, so whoever owns the sort resolves the names.
      */
     readonly sort: import("@angular/core").InputSignal<SortKeyLabel[]>;
+    /**
+     * What the picker offers, labelled by the owner — every sortable column, HIDDEN ones
+     * included (their ordering is otherwise unreachable, which is the trap the picker closes).
+     * Empty keeps the chip read-only and the picker off.
+     */
+    readonly sortOptions: import("@angular/core").InputSignal<SortPickOption[]>;
+    /** Whether the grid already sits on its default ordering — gates the reset row, nothing else. */
+    readonly sortIsDefault: import("@angular/core").InputSignal<boolean>;
     /** Asked for, never done here — see the button's comment. */
     readonly clearAll: import("@angular/core").OutputEmitterRef<void>;
+    /** A single-sort ask. Multi-sort stays a header gesture (ctrl-click); the picker replaces. */
+    readonly sortPick: import("@angular/core").OutputEmitterRef<SortMeta>;
+    /** Back to the owner's default ordering — the owner knows what that resolves to, not the bar. */
+    readonly sortReset: import("@angular/core").OutputEmitterRef<void>;
     private readonly transloco;
     /** For the chip's date wording — the same locale mechanism the table's cells format with. */
     private readonly locale;
@@ -45,6 +58,7 @@ export declare class SpiderlyFilterBarComponent {
      */
     readonly controlTemplates: import("@angular/core").InputSignal<QueryList<SpiderlyFilterTemplateDirective>>;
     readonly isAddOpen: import("@angular/core").WritableSignal<boolean>;
+    readonly isSortOpen: import("@angular/core").WritableSignal<boolean>;
     /** Cleared when the popover closes, so reopening never starts inside someone's old query. */
     readonly addSearch: import("@angular/core").WritableSignal<string>;
     /** The filter whose control is open. One at a time: the bar edits, it is not a form. */
@@ -81,6 +95,23 @@ export declare class SpiderlyFilterBarComponent {
     }[]>;
     /** Opens a filter's control. Where it renders, and why not a popover: the template comment. */
     startEditing(id: string): void;
+    /**
+     * The menu's rows: each option decorated with its ACTIVE direction's arrow (any key, not
+     * just the primary), or null. A `computed`, not a per-row method call in the binding — the
+     * popover's content is projected, so it change-detects even while closed, and a `find` per
+     * option per pass is exactly what `operatorChoices` documents against.
+     */
+    readonly sortRows: import("@angular/core").Signal<{
+        arrow: string;
+        field: string;
+        label: string;
+    }[]>;
+    /**
+     * Ascending first; picking the already-ascending primary flips it. The direction is decided
+     * HERE so the owner applies exactly what the menu showed — an owner guessing "toggle" from its
+     * own state could disagree with a stale menu after a concurrent header click.
+     */
+    pickSort(option: SortPickOption): void;
     /** The raw-string controls only. Nothing reaches the bar or the query until `apply`. */
     draft(handle: FilterHandle, event: Event): void;
     controlTemplateFor(handle: FilterHandle): TemplateRef<unknown> | null;
@@ -128,5 +159,5 @@ export declare class SpiderlyFilterBarComponent {
      */
     chipValue(chip: AppliedFilter): string;
     static ɵfac: i0.ɵɵFactoryDeclaration<SpiderlyFilterBarComponent, never>;
-    static ɵcmp: i0.ɵɵComponentDeclaration<SpiderlyFilterBarComponent, "spiderly-filter-bar", never, { "filters": { "alias": "filters"; "required": true; "isSignal": true; }; "totalRecords": { "alias": "totalRecords"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "controlTemplates": { "alias": "controlTemplates"; "required": false; "isSignal": true; }; }, { "clearAll": "clearAll"; }, never, never, true, never>;
+    static ɵcmp: i0.ɵɵComponentDeclaration<SpiderlyFilterBarComponent, "spiderly-filter-bar", never, { "filters": { "alias": "filters"; "required": true; "isSignal": true; }; "totalRecords": { "alias": "totalRecords"; "required": false; "isSignal": true; }; "sort": { "alias": "sort"; "required": false; "isSignal": true; }; "sortOptions": { "alias": "sortOptions"; "required": false; "isSignal": true; }; "sortIsDefault": { "alias": "sortIsDefault"; "required": false; "isSignal": true; }; "controlTemplates": { "alias": "controlTemplates"; "required": false; "isSignal": true; }; }, { "clearAll": "clearAll"; "sortPick": "sortPick"; "sortReset": "sortReset"; }, never, never, true, never>;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "spiderly",
-  "version": "19.12.1",
+  "version": "19.12.3",
   "author": "Filip Trivan",
   "license": "MIT",
   "description": "Spiderly Angular Library to use in combination with Spiderly.",

package/styles/filters/spiderly-filter-bar.component.scss

@@ -147,12 +147,49 @@
   font-size: 0.875rem;
 }
 
+// The picker's trigger — same chip, now a button. bare-button resets the UA chrome; the hover
+// underline mirrors the filter chips' edit affordance so "this opens something" reads the same
+// across the bar.
+button.sort-chip {
+  @include bare-button();
+  cursor: pointer;
+
+  &:hover .sort-chip-key,
+  &:hover .sort-chip-label {
+    text-decoration: underline;
+  }
+}
+
+.sort-chip-caret {
+  font-size: 0.65rem;
+}
+
 .sort-chip-key {
   // The direction arrow is the non-colour channel; the priority is the reading order, which is
   // the thing the scattered header icons could never show.
   color: var(--p-text-color);
 }
 
+// Teleported with its popover into document.body, so TOP LEVEL like the add menu above it
+// (Angular/CLAUDE.md → overlay styling); pinned by the "sort menu styles survive the body
+// teleport" spec. Inherits .filter-add-option for the row look.
+.sort-menu-option {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 12px;
+}
+
+.sort-menu-direction {
+  color: var(--p-primary-color);
+}
+
+.sort-menu-reset {
+  border-top: 1px solid var(--p-content-border-color);
+  border-radius: 0;
+  color: var(--p-text-muted-color);
+}
+
 .filter-bar-clear {
   // Pushed to the far end, away from the chips: a destructive action next to the x it resembles
   // is how a single chip gets removed by someone reaching for all of them. It is also the LAST

package/agent/skills/verify-ui/SKILL.md

@@ -1,166 +0,0 @@
----
-name: verify-ui
-description: Log past Spiderly's email-code auth wall to visually verify the running Angular admin panel — screenshot a page, click through a flow, or dogfood a UI change without writing a test. Use when asked to "verify the admin UI", "check this page renders", "screenshot the admin panel", "does this screen look right", or to eyeball a change in the live app. For authoring Playwright test suites or debugging CI traces, use the e2e-testing skill instead.
-allowed-tools: Bash(node:*), Bash(npx:*), Bash(agent-browser:*), Bash(curl:*)
----
-
-# Verify Spiderly Admin UI (past the auth wall)
-
-The Spiderly admin panel sits entirely behind a passwordless **email-code** login, which blocks any agent that just opens `localhost:4200`. This skill gets you a logged-in session headlessly so you can look at the real UI.
-
-**This is for ad-hoc visual verification, not test authoring.** If you're writing a Playwright suite or debugging a failing CI run, use the `e2e-testing` skill — it owns the canonical login helper and the PrimeNG selector quirks.
-
-## Two auth flows — check which one first
-
-- **Header flow** (`Login` + `RefreshTokenWithHeaders`): tokens in localStorage → recipe below.
-- **Cookie flow** (`LoginWithCookies` + `RefreshTokenWithCookies`): the refresh token is an HttpOnly cookie — localStorage injection can't work. Symptom: bearer fetches return 200, yet every load bounces to `/login` with a 401 on `RefreshTokenWithCookies`. Log in **from inside the browser** with `credentials: 'include'` instead:
-
-```js
-// eval on the admin origin; email must have the Admin role
-const browserId = 'verify-ui';
-localStorage.setItem('browser_id', browserId); // must match the login below
-const { verificationCode } = await (await fetch(API + '/api/Security/SendLoginVerificationEmail', {
-  method: 'POST', headers: {'Content-Type':'application/json'}, credentials: 'include',
-  body: JSON.stringify({ email, browserId }) })).json();
-await fetch(API + '/api/Security/LoginWithCookies', { method: 'POST',
-  headers: {'Content-Type':'application/json'}, credentials: 'include',
-  body: JSON.stringify({ verificationCode, email, browserId }) });
-// reload — boot's RefreshTokenWithCookies now finds the cookie
-```
-
-## The core idea — header flow (driver-agnostic)
-
-In development, `SecurityService.SendLoginVerificationEmail` returns the verification code **in the response body** (when `ShouldShowVerificationCodeInNotification()` is true — i.e. `IWebHostEnvironment.IsDevelopment()` **and** SMTP is not fully configured, so `emailingService.IsConfigured()` is false). So no email inbox is needed. The flow is always:
-
-1. `POST /api/Security/SendLoginVerificationEmail` `{ email, browserId }` → read `verificationCode`.
-2. `POST /api/Security/Login` `{ verificationCode, email, browserId }` → get `accessToken` + `refreshToken`.
-3. In the browser, set three `localStorage` keys on the admin origin, then reload:
-   - `access_token`, `refresh_token`, `browser_id` (the last must equal the `browserId` used above).
-4. Wait for `sidebar-menu` to appear — that confirms you're authenticated and in.
-
-Step 1+2 are scripted for you: **`scripts/get-admin-token.mjs`** (pure Node, no dependencies, fails loudly).
-
-```bash
-node scripts/get-admin-token.mjs --email admin@example.com
-# → { "accessToken": "...", "refreshToken": "...", "browserId": "verify-ui" }
-```
-
-Flags: `--email` (required — must have the **Admin role**, see gotcha below), `--api` (default `http://localhost:5000`), `--browser-id` (default `verify-ui`).
-
-> **Don't trust the default ports — read them from the project.** The `:5000` (backend) and `:4200` (admin) values used throughout this skill are only the Spiderly scaffold defaults; any project can change them. The authoritative values live in **`Frontend/src/environments/environment.ts`**:
-> - `apiUrl` (e.g. `http://localhost:5000/api`) → pass its **origin** (strip the trailing `/api`) to `--api`.
-> - `frontendUrl` (e.g. `http://localhost:4200`) → the admin URL to open in the browser.
->
-> The backend's actually-bound port is in **`Backend/<App>.WebAPI/Properties/launchSettings.json`** → `applicationUrl`. If a connection fails or the project looks non-standard, read those files first instead of assuming the defaults below.
-
-> **CORS origin must match.** The backend allows one origin (`appsettings.json` → `Spiderly.Shared:FrontendUrl`). Serving the admin on a different port blocks every API call and surfaces as a misleading **"Connection Lost"** toast + bounce to `/login` (looks like an auth failure).
-
-## Prerequisites — validate before doing anything
-
-The token script already fails loudly on the first two. Confirm all four up front so you don't burn a turn on a half-running stack:
-
-| Requirement | How to confirm | If it fails |
-|---|---|---|
-| Backend reachable | the script's first POST succeeds (port from `launchSettings.json` → `applicationUrl`) | start the backend (`dotnet run` in the WebAPI project) |
-| Dev-mode code exposure on | response contains `verificationCode` | run backend with `ASPNETCORE_ENVIRONMENT=Development` **and** SMTP unconfigured (`IsConfigured()` false) — a fully-configured SMTP setup does a real send even in Development |
-| Admin SPA running | `frontendUrl` (from `environment.ts`, default `:4200`) responds | start the admin (`npm start` in `Frontend/`) |
-| Account has Admin role | login lands on a populated sidebar, not an empty shell | use an Admin-roled email (see gotcha) |
-
-## Driver A — agent-browser (preferred when available)
-
-[agent-browser](https://www.skills.sh/vercel-labs/agent-browser/agent-browser) gives an agent live, interactive control — ideal for clicking through a flow and screenshotting. If it isn't installed, install once (or skip to Driver B):
-
-```bash
-npx skills add https://github.com/vercel-labs/agent-browser --skill agent-browser
-npm i -g agent-browser && agent-browser install   # CLI + Chrome binary
-```
-
-Then log in and verify (replace `<AT>` / `<RT>` with the script's output, and `verify-ui` if you changed `--browser-id`):
-
-```bash
-# 1. Open the admin origin first so localStorage writes land on the right origin
-agent-browser open http://localhost:4200
-
-# 2. Inject the session (use --stdin so quoting can't corrupt the values)
-agent-browser eval --stdin <<'EOF'
-localStorage.setItem('access_token', '<AT>');
-localStorage.setItem('refresh_token', '<RT>');
-localStorage.setItem('browser_id', 'verify-ui');
-EOF
-
-# 3. Navigate straight to the page under review — this load reads the just-set
-#    localStorage; the sidebar-menu wait confirms auth (it renders on every
-#    authenticated route, so no separate dashboard round-trip is needed).
-agent-browser open http://localhost:4200/administration/banner \
-  && agent-browser wait "sidebar-menu" \
-  && agent-browser wait --load networkidle \
-  && agent-browser screenshot --full
-```
-
-From here use the normal agent-browser loop (`snapshot -i` → `click`/`fill` → re-snapshot) to drive a flow. Close the session when done: `agent-browser close`.
-
-## Driver B — Playwright (guaranteed floor, zero extra install)
-
-Every Spiderly app ships Playwright for e2e, so this always works without installing anything new. Run it **from the `Frontend/` directory** so `playwright` resolves. It reuses the same token script.
-
-Save as `Frontend/verify-page.mjs` (gitignore it — it's a throwaway), then:
-
-```bash
-node verify-page.mjs --email admin@example.com \
-  --url http://localhost:4200/administration/banner \
-  --token-script <skill-dir>/scripts/get-admin-token.mjs --out ./_verify.png
-```
-
-It reuses the same token helper (`--token-script`, required — pass the absolute path to this skill's `scripts/get-admin-token.mjs`), so the localStorage key names and `sidebar-menu` wait stay defined in one place. Keep that injection block in sync with `e2e-testing`'s `authenticateBrowser` if either changes.
-
-```js
-import { chromium } from "playwright";
-import { execFileSync } from "node:child_process";
-
-function arg(name, fallback) {
-  const i = process.argv.indexOf(`--${name}`);
-  return i !== -1 ? process.argv[i + 1] : fallback;
-}
-
-const email = arg("email");
-const url = arg("url", "http://localhost:4200");
-const api = arg("api", "http://localhost:5000");
-const out = arg("out", "./_verify.png");
-const tokenScript = arg("token-script");
-if (!email || !tokenScript) {
-  throw new Error("Pass --email <admin-roled account> and --token-script <path to get-admin-token.mjs>");
-}
-
-const { accessToken, refreshToken, browserId } = JSON.parse(
-  execFileSync("node", [tokenScript, "--email", email, "--api", api], { encoding: "utf8" })
-);
-
-const browser = await chromium.launch();
-try {
-  const page = await browser.newPage();
-  // Tokens must be set on the admin origin before the app reads them, so land there first.
-  await page.goto(new URL(url).origin);
-  await page.evaluate(
-    ([at, rt, bid]) => {
-      localStorage.setItem("access_token", at);
-      localStorage.setItem("refresh_token", rt);
-      localStorage.setItem("browser_id", bid);
-    },
-    [accessToken, refreshToken, browserId]
-  );
-  await page.goto(url);
-  await page.locator("sidebar-menu").waitFor({ state: "visible", timeout: 15000 });
-  await page.screenshot({ path: out, fullPage: true });
-  console.log(`Saved ${out}`);
-} finally {
-  await browser.close();
-}
-```
-
-## Gotcha — login can succeed but show an empty shell
-
-`SendLoginVerificationEmail` mints a session for any email when `OnlyAdminCanAddUsers` is `false` (the default) — a not-yet-existing user is **auto-provisioned with no role**, so the sidebar comes up empty and most pages are inaccessible. If you can log in but see nothing useful, the account lacks permissions. Use an email that already has the **Admin role** (role/permission assignment is seeded per-project, e.g. via a `PermissionSeeder`). Permissions hang off roles, not off the user directly.
-
-## Why a separate skill from e2e-testing
-
-Same login mechanism, different job: `e2e-testing` is for *authoring* Playwright suites and debugging CI traces; this is for *looking at* the running admin UI ad-hoc. Keeping them separate keeps each skill's trigger sharp. The login flow lives in both only as a thin reference — `e2e-testing` holds the canonical Playwright helper (`authenticateBrowser`); this skill holds the dependency-free token script and the agent-browser path.

package/agent/skills/verify-ui/scripts/get-admin-token.mjs

@@ -1,134 +0,0 @@
-#!/usr/bin/env node
-// Obtain a Spiderly admin session token without an email inbox.
-//
-// In development, SecurityService.SendLoginVerificationEmail returns the
-// verification code directly in the response body (when
-// ShouldShowVerificationCodeInNotification() is true). This script uses that
-// to complete the passwordless login flow headlessly and print the tokens an
-// admin SPA expects in localStorage.
-//
-// The --api default (http://localhost:5000) is the Spiderly scaffold default only.
-// The authoritative backend URL for a project is the origin of `apiUrl` in
-// Frontend/src/environments/environment.ts (strip the trailing /api); the bound
-// port is in Backend/<App>.WebAPI/Properties/launchSettings.json -> applicationUrl.
-// Pass --api explicitly when a project overrides the default.
-//
-// Usage:
-//   node get-admin-token.mjs --email admin@example.com
-//   node get-admin-token.mjs --email admin@example.com --api http://localhost:5000 --browser-id verify-ui
-//
-// Output (stdout, JSON): { "accessToken": "...", "refreshToken": "...", "browserId": "..." }
-// Exit code 0 on success, 1 on any failure (fails loudly — no partial success).
-
-function parseArgs(argv) {
-  const args = {};
-  for (let i = 0; i < argv.length; i++) {
-    const token = argv[i];
-    if (!token.startsWith("--")) continue;
-
-    // Support both --flag=value and --flag value.
-    const eq = token.indexOf("=");
-    if (eq !== -1) {
-      args[token.slice(2, eq)] = token.slice(eq + 1);
-      continue;
-    }
-
-    const key = token.slice(2);
-    const next = argv[i + 1];
-    if (next !== undefined && !next.startsWith("--")) {
-      args[key] = next;
-      i++;
-    } else {
-      args[key] = true;
-    }
-  }
-  return args;
-}
-
-function fail(message) {
-  console.error(`[get-admin-token] ${message}`);
-  process.exit(1);
-}
-
-const args = parseArgs(process.argv.slice(2));
-
-const email = args.email;
-const apiBaseUrl = (args.api || "http://localhost:5000").replace(/\/+$/, "");
-const browserId = args["browser-id"] || "verify-ui";
-
-if (!email || email === true) {
-  fail(
-    "Missing required --email. Pass an account that has the Admin role in the target DB.\n" +
-      "  Usage: node get-admin-token.mjs --email admin@example.com [--api http://localhost:5000] [--browser-id verify-ui]"
-  );
-}
-
-async function postJson(path, body) {
-  let response;
-  try {
-    response = await fetch(`${apiBaseUrl}${path}`, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify(body),
-    });
-  } catch (err) {
-    fail(
-      `Could not reach the backend at ${apiBaseUrl}${path}. Is the backend running?\n  ${err.message}`
-    );
-  }
-
-  const text = await response.text();
-  let json;
-  try {
-    json = text ? JSON.parse(text) : {};
-  } catch {
-    json = { raw: text };
-  }
-
-  if (!response.ok) {
-    fail(`POST ${path} failed (HTTP ${response.status}): ${text || "(empty body)"}`);
-  }
-
-  return json;
-}
-
-const sendCodeResult = await postJson("/api/Security/SendLoginVerificationEmail", {
-  email,
-  browserId,
-});
-
-const verificationCode = sendCodeResult.verificationCode;
-if (!verificationCode) {
-  fail(
-    "SendLoginVerificationEmail did not return a verificationCode.\n" +
-      "  This means dev-mode code exposure is OFF (ShouldShowVerificationCodeInNotification() returned false).\n" +
-      "  The gate is IsDevelopment() && !IsConfigured(): run the backend with ASPNETCORE_ENVIRONMENT=Development\n" +
-      "  AND with SMTP left unconfigured. A fully-configured SMTP setup (EmailSender.Email + EmailSenderPassword\n" +
-      "  + SmtpHost + SmtpPort) does a real email send instead, even in Development."
-  );
-}
-
-const loginResult = await postJson("/api/Security/Login", {
-  verificationCode,
-  email,
-  browserId,
-});
-
-if (!loginResult.accessToken || !loginResult.refreshToken) {
-  fail(
-    `Login did not return tokens. Response: ${JSON.stringify(loginResult)}\n` +
-      "  The email may not exist, or the code expired. Check the account and retry."
-  );
-}
-
-process.stdout.write(
-  JSON.stringify(
-    {
-      accessToken: loginResult.accessToken,
-      refreshToken: loginResult.refreshToken,
-      browserId,
-    },
-    null,
-    2
-  ) + "\n"
-);