[botinc-agent]

Problem

The auth core package's browser suite covered the hosted redirect, concurrent tabs, step-ups and bot protection, but not most headless methods, and not cancelled or invalid redirects, passkey cancellation, reload restoration, revoked sessions or credential leakage. Those journeys are release-QA requirements, so a regression in them would ship untested.

Solution

• Added packages/auth/e2e/journeys.spec.mjs, 15 browser journeys driving the built package in the independent fixture app against the recorded runtime API.
• Covers emailed codes, sign-up and its password policy, MFA verification and enrolment, phone delivery errors, agent consent and revocation, passkey cancellation and origin binding, cancelled and forged hosted callbacks, session restoration after a reload, revoked and reused-refresh sessions, and storage/error credential hygiene.
• PKCE and state are exercised end to end: the recorded API only answers requests whose code challenge, state and transaction match the recording.
• No production code changed. These journeys found no defect in the SDK's current behaviour.

Verification

• npm test in packages/auth: 101 unit tests pass.
• npx playwright test in packages/auth: 87 pass, 8 live tests skipped (Chromium, Firefox and WebKit).
• npm run typecheck and npm run build in packages/auth pass.
• The live suite (e2e/live.spec.mjs) could not run here because this checkout has no Didit auth service or mailbox; it remains the check for real passkey registration, passkey protection, email delivery and token rotation against staging.