@flowriki/agent 0.1.0-beta.12 → 0.1.0-beta.14

package/dist/{chunk-YIZ6E6DB.js → chunk-OMYFENN7.js}

@@ -6,7 +6,7 @@ import os from "os";
 import path from "path";
 import { createRequire } from "module";
 import { spawnSync } from "child_process";
-var AGENT_VERSION = "0.1.0-beta.12";
+var AGENT_VERSION = "0.1.0-beta.14";
 async function prepareBrowsers() {
   if (browsersReady()) {
     return { ok: true, already: true, message: "chromium is already installed" };
@@ -135,7 +135,7 @@ function forgetConnection(service, env = process.env) {
 }
 var fingerprint = (secret) => crypto2.createHash("sha256").update(secret).digest("hex").slice(0, 12);
 
-// ../contracts/dist/chunk-BU7BOLBB.js
+// ../contracts/dist/chunk-BZ2CJR5T.js
 import { z } from "zod";
 var PROTOCOL_VERSION = 1;
 var PAIRING_CODE_TTL_MS = 5 * 60 * 1e3;
@@ -282,9 +282,16 @@ var HelloSchema = z.object({
    * BEFORE somebody presses Run and waits for a browser that never opens.
    *
    * Absent means an agent from before this existed: baseline only. Names are
-   * command names, so there is nothing new to keep in step. */
+   * command names, except for the few in `AGENT_FEATURES`. */
   capabilities: z.array(z.string()).default([])
 }).strict();
+var AGENT_FEATURES = /* @__PURE__ */ new Set([
+  /** Signing in and out through a shared procedure. */
+  "authentication.v1",
+  /** More than one participant, each with a browser session of its own —
+   *  which also covers starting one over and sharing a captured output. */
+  "actors.v1"
+]);
 var AgentMessageSchema = z.discriminatedUnion("type", [
   AckSchema,
   AgentEventSchema,
@@ -449,9 +456,9 @@ import fs7 from "fs";
 import path7 from "path";
 
 // ../engine-playwright/dist/index.js
-import { chromium, firefox, webkit } from "playwright";
+import path3 from "path";
 
-// ../test-model/dist/chunk-ROEX7TWK.js
+// ../test-model/dist/chunk-T76NYOOM.js
 import { z as z3 } from "zod";
 var LocatorOverrideSchema = z3.object({
   strategy: z3.enum(["css", "xpath", "id", "testId", "text", "label", "placeholder", "altText", "title"]),
@@ -632,7 +639,7 @@ var DialogAnswerSchema = z3.object({
 }).strict();
 var RecordedStepSchema = RecordedTargetSchema.extend({
   id: z3.string().min(1),
-  type: z3.enum(["fill", "select", "click", "dblclick", "rightclick", "drag", "check", "press", "hover", "upload", "scroll", "back", "forward", "navigate", "closePage", "unsupported", "setRange", "assert"]),
+  type: z3.enum(["fill", "select", "click", "dblclick", "rightclick", "drag", "check", "press", "hover", "upload", "scroll", "back", "forward", "navigate", "closePage", "unsupported", "setRange", "assert", "signIn", "signOut", "useActor", "resetActor", "capture"]),
   scope: z3.string(),
   value: z3.string(),
   secret: z3.boolean(),
@@ -681,11 +688,52 @@ var RecordedStepSchema = RecordedTargetSchema.extend({
    * When this is set, `value` is empty and carries nothing: the secret is
    * looked up by this name at run time, and a name that is not on this machine
    * stays unresolved and is reported, never invented. */
-  secretRef: z3.string().regex(SECRET_REF_PATTERN).optional()
+  secretRef: z3.string().regex(SECRET_REF_PATTERN).optional(),
+  /** WHICH PROCEDURE AND WHICH IDENTITY, for `signIn` and `signOut`.
+   *
+   * A reference, never an expansion: the sign-in's own steps are not copied
+   * in here. That is deliberate and is the one exception to a case holding
+   * editable copies — a login procedure is shared infrastructure, and
+   * duplicating it into forty tests recreates exactly the problem this
+   * feature exists to remove. */
+  auth: z3.object({
+    profileId: z3.string().min(1),
+    accountId: z3.string().optional(),
+    /** WHERE THIS SIGN-IN BEGINS — and it belongs here, not on the procedure.
+     *
+     * The same login serves both: taken to the login page when signing in is
+     * the first thing that happens, and performed from wherever the browser
+     * already is when a guest fills a basket and signs in at checkout. Asking
+     * the procedure meant choosing once, for every test that would ever use
+     * it. Absent means the procedure's own starting page. */
+    from: z3.enum(["loginPage", "here"]).optional()
+  }).strict().optional(),
+  /** Which participant this step belongs to, for `useActor`.
+   *
+   * Selecting an actor RESUMES its session; it does not sign in again. A step
+   * that named an actor and re-authenticated would make moving between two
+   * participants cost a login each time, which is the cost this removes. */
+  actorId: z3.string().optional(),
+  navigationBase: z3.enum(["page", "application"]).optional(),
+  capture: z3.object({ name: z3.string().regex(/^[a-zA-Z][a-zA-Z0-9_]*$/), source: z3.enum(["text", "value", "url"]) }).strict().optional()
 }).strict();
+var DraftStepSchema = RecordedStepSchema.extend({
+  role: z3.string().default(""),
+  name: z3.string().default(""),
+  scope: z3.string().default(""),
+  value: z3.string().default(""),
+  secret: z3.boolean().default(false),
+  legacySelector: z3.string().default(""),
+  proposals: z3.array(RecordedAssertionSchema).default([])
+});
 function slugify(name) {
   return name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "");
 }
+var ActorDefinitionSchema = z3.object({
+  id: z3.string().min(1).max(64).regex(/^[a-zA-Z0-9_-]+$/),
+  name: z3.string().min(1),
+  startSignedIn: z3.object({ profileId: z3.string().min(1), accountId: z3.string().optional() }).strict().optional()
+}).strict();
 var CURRENT_SCHEMA_VERSION = 5;
 var FlowDocumentSchema = z3.object({
   schemaVersion: z3.literal(CURRENT_SCHEMA_VERSION),
@@ -711,6 +759,8 @@ var FlowDocumentSchema = z3.object({
   steps: z3.array(RecordedStepSchema),
   environment: ExecutionEnvironmentSchema.optional(),
   path: z3.string().optional(),
+  actors: z3.array(ActorDefinitionSchema).optional(),
+  defaultActorId: z3.string().optional(),
   /** Bumped on every save. An edit carries the revision it was made against,
    *  so a save built on a stale copy is refused instead of overwriting work
    *  somebody else — or a debug session on the same machine — has since done.
@@ -812,6 +862,7 @@ function parseFlowDocument(input) {
 // ../test-model/dist/index.js
 import { z as z4 } from "zod";
 import { z as z22 } from "zod";
+import { z as z32 } from "zod";
 var EngineSchema = z4.enum(["chromium", "firefox", "webkit"]);
 var CapabilitySchema = z4.object({
   id: z4.string(),
@@ -845,6 +896,7 @@ var FlowOccurrenceSchema = z22.object({
    *  two occurrences, and editing, breakpoints, results and deletion must be
    *  able to tell them apart. */
   occurrenceId: z22.string().min(1),
+  actorId: z22.string().optional(),
   /** Editable, and initially the source flow's name. */
   name: z22.string().min(1),
   /** Where this copy starts, when it is told to navigate before running.
@@ -894,6 +946,8 @@ var TestCaseSchema = z22.object({
   useStartPath: z22.boolean().default(false),
   baseUrl: z22.string().url().optional(),
   environment: ExecutionEnvironmentSchema.optional(),
+  actors: z22.array(ActorDefinitionSchema).optional(),
+  defaultActorId: z22.string().optional(),
   occurrences: z22.array(FlowOccurrenceSchema).default([]),
   createdAt: z22.string(),
   createdBy: z22.string().default(""),
@@ -975,6 +1029,11 @@ function caseDebugPlan(testCase, baseUrl) {
   const steps = [];
   const occurrences = caseOccurrences(testCase);
   for (const [index, item] of occurrences.entries()) {
+    if (testCase.actors?.length) {
+      const id = `case-actor:${encodeURIComponent(item.occurrenceId)}`;
+      owners[id] = { occurrenceId: item.occurrenceId, stepId: null };
+      steps.push({ id, type: "useActor", actorId: item.actorId ?? testCase.defaultActorId ?? "default", role: "", name: "Select participant", scope: "", value: "", secret: false, legacySelector: "", proposals: [] });
+    }
     if (index > 0 && item.navigateFirst) {
       const id = `case-nav:${encodeURIComponent(item.occurrenceId)}`;
       owners[id] = { occurrenceId: item.occurrenceId, stepId: null };
@@ -999,6 +1058,8 @@ function caseDebugPlan(testCase, baseUrl) {
     updatedAt: testCase.updatedAt,
     steps,
     startPath: new URL(first?.startPath ?? "/", first?.baseUrl ?? testCase.baseUrl ?? baseUrl).href,
+    ...testCase.actors ? { actors: testCase.actors } : {},
+    ...testCase.defaultActorId ? { defaultActorId: testCase.defaultActorId } : {},
     ...testCase.environment ? { environment: testCase.environment } : {}
   });
   return { flow, owners };
@@ -1009,13 +1070,18 @@ function restoreDebugCase(testCase, owners, steps) {
   let current = occurrences[0];
   const present = new Set(steps.map((step) => step.id));
   for (const [id, owner] of Object.entries(owners)) {
-    if (owner.stepId === null && !present.has(id)) byId.get(owner.occurrenceId).navigateFirst = false;
+    if (id.startsWith("case-nav:") && owner.stepId === null && !present.has(id)) byId.get(owner.occurrenceId).navigateFirst = false;
   }
   for (const step of steps) {
     const owner = owners[step.id];
     if (owner) current = byId.get(owner.occurrenceId);
     if (!current) throw new Error("debug step has no case occurrence");
     if (owner?.stepId === null) {
+      if (step.id.startsWith("case-actor:")) {
+        if (step.type !== "useActor") throw new Error("a participant boundary must remain a participant step");
+        current.actorId = step.actorId;
+        continue;
+      }
       if (step.type !== "navigate") throw new Error("a case boundary must remain a navigation step");
       current.startPath = step.value;
       continue;
@@ -1024,6 +1090,342 @@ function restoreDebugCase(testCase, owners, steps) {
   }
   return { ...testCase, occurrences };
 }
+var AuthNavigationSchema = z32.discriminatedUnion("kind", [
+  /** Act from wherever the browser already is — a "Log in" link in the header.
+   *  The only kind that is safe part-way through a journey. */
+  z32.object({ kind: z32.literal("continue") }),
+  /** Open the procedure's own starting page first. Right when signing in is
+   *  the first thing that happens; it abandons a journey in progress. */
+  z32.object({ kind: z32.literal("open"), path: z32.string().min(1) })
+]);
+var AuthFieldSchema = z32.object({
+  /** The step in the recorded procedure this value is typed into. */
+  stepId: z32.string().min(1),
+  /** What it is called where somebody fills it in — the field's own name on
+   *  the page, so an account form reads "Username" rather than "st_9f2a". */
+  label: z32.string().min(1),
+  /** A secret arrives as a reference and is never written into a document. */
+  secret: z32.boolean().default(false),
+  /** What the recording typed. Empty for a secret, whose value never travels.
+   *  Kept so the first account can be made from what was recorded, with
+   *  nothing to fill in. */
+  recorded: z32.string().default("")
+}).strict();
+var AUTH_PROFILE_SCHEMA_VERSION = 2;
+var AuthProfileSchema = z32.object({
+  schemaVersion: z32.literal(AUTH_PROFILE_SCHEMA_VERSION),
+  id: z32.string().min(1),
+  slug: z32.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+  name: z32.string().min(1),
+  description: z32.string().default(""),
+  /** The recorded sign-in. A flow like any other, so it is edited, debugged
+   *  and replayed by everything that already knows how. */
+  flowId: z32.string().min(1),
+  /** Which of the values it types differ per identity. */
+  fields: z32.array(AuthFieldSchema).default([]),
+  /** Optional, and its own procedure with its own proof — most profiles will
+   *  not have one at first. The proof is read off that flow, the same way. */
+  signOutFlowId: z32.string().optional(),
+  /** Descriptive only — "admin", "staff". Never used to decide anything, so
+   *  two profiles may share a tag without becoming interchangeable. */
+  tags: z32.array(z32.string()).default([]),
+  createdAt: z32.string(),
+  createdBy: z32.string().default(""),
+  updatedAt: z32.string(),
+  revision: z32.number().int().nonnegative().default(0)
+}).strict();
+var ACCOUNT_BINDING_SCHEMA_VERSION = 2;
+var AccountBindingSchema = z32.object({
+  schemaVersion: z32.literal(ACCOUNT_BINDING_SCHEMA_VERSION),
+  id: z32.string().min(1),
+  slug: z32.string().regex(/^[a-z0-9][a-z0-9-]*$/),
+  name: z32.string().min(1),
+  profileId: z32.string().min(1),
+  /** Which environment of the APPLICATION UNDER TEST these credentials belong
+   *  to — never Flowriki's own dev or staging. Null means every environment,
+   *  which is what a project with one environment wants. */
+  environment: z32.string().min(1).nullable().default(null),
+  /** Step id → what this identity types there. Ordinary values: a username is
+   *  not a credential, and keeping it here is what lets somebody read an
+   *  account and know who it is. */
+  values: z32.record(z32.string(), z32.string()).default({}),
+  /** Step id → secret REFERENCE. The value is sealed in the vault and never
+   *  enters the repository, whatever form it was typed into. */
+  secrets: z32.record(z32.string(), z32.string().regex(/^[a-z][a-z0-9_]*$/i)).default({}),
+  /** What this identity should look like once signed in — a displayed name, a
+   *  tenant. Not secret, and checked so that an already-authenticated browser
+   *  holding the WRONG account is reported rather than accepted. */
+  identity: z32.object({
+    label: z32.string().optional(),
+    tenant: z32.string().optional()
+  }).default({}),
+  createdAt: z32.string(),
+  createdBy: z32.string().default(""),
+  updatedAt: z32.string(),
+  revision: z32.number().int().nonnegative().default(0)
+}).strict();
+var AuthReferenceSchema = z32.object({
+  profileId: z32.string().min(1),
+  /** Where this use of it begins. See the step's own field. */
+  from: z32.enum(["loginPage", "here"]).optional(),
+  /** Absent means "the only account bound to this profile for the selected
+   *  environment", which is resolved before a browser opens and refused when
+   *  it is ambiguous — a silent choice between two identities is the failure
+   *  this field exists to prevent. */
+  accountId: z32.string().optional()
+}).strict();
+var ActorSchema = ActorDefinitionSchema;
+var DeliveredAuthSchema = z32.object({
+  profileId: z32.string().min(1),
+  accountId: z32.string().min(1),
+  name: z32.string(),
+  accountName: z32.string(),
+  steps: z32.array(RecordedStepSchema),
+  navigation: AuthNavigationSchema,
+  success: z32.array(RecordedAssertionSchema),
+  secretRefs: z32.record(z32.string(), z32.string()),
+  signOut: z32.object({ steps: z32.array(RecordedStepSchema), success: z32.array(RecordedAssertionSchema) }).optional()
+}).strict();
+function actorPreparations(actors = []) {
+  return actors.flatMap((actor) => actor.startSignedIn ? [{
+    id: `prepare:${actor.id}`,
+    type: "signIn",
+    auth: actor.startSignedIn,
+    name: `Prepare ${actor.name}`,
+    role: "",
+    scope: "",
+    value: "",
+    secret: false,
+    legacySelector: "",
+    proposals: []
+  }] : []);
+}
+function validateActors(actors = [], defaultId = "default", used = []) {
+  ActorSchema.array().parse(actors);
+  const ids = /* @__PURE__ */ new Set(["default"]);
+  for (const actor of actors) {
+    if (ids.has(actor.id)) throw new Error(`Duplicate or reserved actor: ${actor.id}`);
+    ids.add(actor.id);
+  }
+  for (const id of [defaultId, ...used]) {
+    if (id === UNSET_ACTOR) throw new Error("A participant step does not say which participant \u2014 choose one before running");
+    if (id && !ids.has(id)) throw new Error(`Unknown actor: ${id} \u2014 configure this participant before running`);
+  }
+}
+var UNSET_ACTOR = "\0unset";
+function actorIdsUsed(steps) {
+  return steps.flatMap((step) => step.disabled ? [] : step.type === "useActor" ? [step.actorId ?? UNSET_ACTOR] : step.type === "resetActor" && step.actorId ? [step.actorId] : []);
+}
+
+// ../engine-playwright/dist/index.js
+import { createHmac, randomBytes } from "crypto";
+import { errors } from "playwright";
+
+// ../core/dist/index.js
+function proposeAssertions(before, after) {
+  const out = [];
+  if (!before || !after) return out;
+  if (before.url !== after.url)
+    out.push({
+      kind: "screen",
+      value: after.heading || after.title,
+      why: "navigated to a new screen"
+    });
+  for (const a of after.alerts.filter((x) => !before.alerts.includes(x)))
+    out.push({ kind: "message", value: a, why: "a message appeared that was not there before" });
+  if (before.url === after.url && before.heading !== after.heading && after.heading)
+    out.push({ kind: "heading", value: after.heading, why: "the heading changed in place" });
+  const newFields = after.fields.filter((f) => !before.fields.includes(f));
+  if (newFields.length)
+    out.push({ kind: "fields_visible", value: newFields, why: "new fields became visible" });
+  if (before.url === after.url) {
+    const seenKeys = new Set(before.texts.map((t) => t.key));
+    const covered = /* @__PURE__ */ new Set([after.heading, ...after.alerts]);
+    const appeared = after.texts.filter((t) => !seenKeys.has(t.key) && !covered.has(t.text));
+    for (const t of appeared.slice(0, 2))
+      out.push({
+        kind: "message",
+        value: t.text,
+        why: "this text appeared after the action",
+        confidence: "low"
+      });
+  }
+  return out;
+}
+function hasObservableChange(before, after) {
+  return proposeAssertions(before, after).some((p) => p.confidence !== "low");
+}
+function isLocalHost(host) {
+  const h = host.toLowerCase();
+  return h === "localhost" || h.endsWith(".localhost") || h === "127.0.0.1" || h === "[::1]" || h === "0.0.0.0";
+}
+function hasScheme(raw) {
+  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(raw)) return true;
+  return /^[a-zA-Z][a-zA-Z0-9+.-]*:(?!\d)/.test(raw);
+}
+function normalizeStartUrl(input) {
+  const raw = (input ?? "").trim();
+  if (!raw) throw new Error("enter a URL to record against");
+  let candidate;
+  if (hasScheme(raw)) {
+    candidate = raw;
+  } else {
+    const bare = raw.replace(/^\/+/, "");
+    const host = bare.split(/[/?#]/)[0] ?? "";
+    candidate = `${isLocalHost(host.split(":")[0] ?? "") ? "http" : "https"}://${bare}`;
+  }
+  let parsed;
+  try {
+    parsed = new URL(candidate);
+  } catch {
+    throw new Error(`"${raw}" is not a valid URL`);
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    throw new Error(`only http:// and https:// URLs can be recorded (got ${parsed.protocol}//)`);
+  }
+  if (!parsed.hostname) throw new Error(`"${raw}" has no host`);
+  return parsed.toString();
+}
+function resolveStartUrl(baseUrl, startPath) {
+  const base = normalizeStartUrl(baseUrl);
+  return new URL(startPath || "/", base).toString();
+}
+var INPUT_ROLES = /* @__PURE__ */ new Set(["textbox", "combobox", "checkbox", "radio", "spinbutton", "searchbox"]);
+var NAVIGATIONS = /* @__PURE__ */ new Set(["back", "forward"]);
+function locatorPlan(step) {
+  const o = step.locator;
+  if (o && o.value.trim()) {
+    const value = o.value.trim();
+    switch (o.strategy) {
+      // Playwright reads a leading `xpath=` prefix, and also bare paths that
+      // start with `/` or `//`. Normalising here means the QA can paste either.
+      case "xpath":
+        return { method: "locator", arg: value.startsWith("xpath=") ? value : `xpath=${value}`, overridden: true };
+      // Typed as a bare id, so nobody has to remember the `#`.
+      case "id":
+        return { method: "locator", arg: /^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(value.replace(/^#/, "")) ? `#${value.replace(/^#/, "")}` : `[id=${JSON.stringify(value.replace(/^#/, ""))}]`, overridden: true };
+      case "css":
+        return { method: "locator", arg: value, overridden: true };
+      case "testId":
+        return { method: "getByTestId", arg: value, overridden: true };
+      case "text":
+        return { method: "getByText", arg: value, exact: true, overridden: true };
+      case "label":
+        return { method: "getByLabel", arg: value, exact: true, overridden: true };
+      case "placeholder":
+        return { method: "getByPlaceholder", arg: value, exact: true, overridden: true };
+      case "altText":
+        return { method: "getByAltText", arg: value, exact: true, overridden: true };
+      case "title":
+        return { method: "getByTitle", arg: value, exact: true, overridden: true };
+    }
+  }
+  if (NAVIGATIONS.has(step.type)) {
+    return { method: step.type === "back" ? "goBack" : "goForward", arg: "", overridden: false };
+  }
+  if (!step.name.trim()) return { method: "none", arg: "", overridden: false };
+  if (step.nameFrom === "adjacent-label") {
+    return {
+      method: "getByText",
+      arg: step.name,
+      exact: true,
+      overridden: false,
+      viaAdjacentLabel: true
+    };
+  }
+  if (step.nameFrom === "text") {
+    return {
+      method: "getByText",
+      arg: step.name,
+      exact: step.type !== "hover",
+      overridden: false,
+      visible: true
+    };
+  }
+  return INPUT_ROLES.has(step.role) ? { method: "getByLabel", arg: step.name, exact: true, overridden: false, inputRole: step.role } : step.role ? { method: "getByRole", arg: step.role, name: step.name, exact: true, overridden: false } : { method: "getByText", arg: step.name, exact: step.type !== "hover", overridden: false, visible: true };
+}
+function frameSelector(name) {
+  const positional = /^nth:(\d+)$/.exec(name);
+  if (positional) return `iframe, frame >> nth=${positional[1]}`;
+  const v = JSON.stringify(name);
+  return `iframe[title=${v}], iframe[name=${v}], iframe[id=${v}], frame[title=${v}], frame[name=${v}], frame[id=${v}]`;
+}
+function inputSelector(role) {
+  return role === "textbox" ? 'input, textarea, [contenteditable="true"], [role="textbox"]' : `input, select, [role="${role}"]`;
+}
+var SCOPE_ROLES = ["form", "group", "region", "dialog", "alertdialog"];
+var CHECKS = [
+  { id: "visible", label: "is visible", kind: "visible", group: "state" },
+  { id: "not-visible", label: "is not visible", kind: "visible", not: true, group: "state" },
+  { id: "attached", label: "exists on the page", kind: "attached", group: "state" },
+  { id: "not-attached", label: "does not exist", kind: "attached", not: true, group: "state" },
+  { id: "enabled", label: "is enabled", kind: "enabled", group: "state" },
+  { id: "disabled", label: "is disabled", kind: "enabled", not: true, group: "state" },
+  { id: "editable", label: "is editable", kind: "editable", group: "state" },
+  { id: "readonly", label: "is read-only", kind: "editable", not: true, group: "state" },
+  { id: "focused", label: "is focused", kind: "focused", group: "state" },
+  { id: "checked", label: "is checked", kind: "checked", value: "true", group: "state" },
+  { id: "unchecked", label: "is not checked", kind: "checked", value: "false", group: "state" },
+  { id: "text", label: "text is exactly", kind: "text", input: true, group: "text" },
+  { id: "text-contains", label: "text contains", kind: "text", op: "contains", input: true, group: "text" },
+  { id: "text-matches", label: "text matches pattern", kind: "text", op: "matches", input: true, group: "text" },
+  { id: "text-not", label: "text is not", kind: "text", not: true, input: true, group: "text" },
+  { id: "text-not-contains", label: "text does not contain", kind: "text", op: "contains", not: true, input: true, group: "text" },
+  { id: "value", label: "value is exactly", kind: "value", input: true, group: "value" },
+  { id: "value-contains", label: "value contains", kind: "value", op: "contains", input: true, group: "value" },
+  { id: "value-not", label: "value is not", kind: "value", not: true, input: true, group: "value" },
+  { id: "attr", label: "attribute is", kind: "attribute", input: true, attr: true, group: "attributes" },
+  { id: "attr-contains", label: "attribute contains", kind: "attribute", op: "contains", input: true, attr: true, group: "attributes" },
+  { id: "attr-not", label: "attribute is not", kind: "attribute", not: true, input: true, attr: true, group: "attributes" },
+  { id: "class", label: "has class", kind: "class", input: true, group: "attributes" },
+  { id: "not-class", label: "does not have class", kind: "class", not: true, input: true, group: "attributes" },
+  { id: "count", label: "how many \xB7 is exactly", kind: "count", input: true, roleOnly: true, group: "count" },
+  { id: "count-gte", label: "how many \xB7 is at least", kind: "count", op: "gte", input: true, roleOnly: true, group: "count" },
+  { id: "count-lte", label: "how many \xB7 is at most", kind: "count", op: "lte", input: true, roleOnly: true, group: "count" },
+  { id: "url", label: "page URL is", kind: "url", input: true, page: true, group: "page" },
+  { id: "url-contains", label: "page URL contains", kind: "url", op: "contains", input: true, page: true, group: "page" },
+  { id: "title", label: "page title is", kind: "title", input: true, page: true, group: "page" },
+  { id: "title-contains", label: "page title contains", kind: "title", op: "contains", input: true, page: true, group: "page" }
+];
+function matchCheck(a) {
+  const op = a.op ?? "equals";
+  const value = Array.isArray(a.value) ? a.value.join(", ") : a.value;
+  return CHECKS.find(
+    (c) => c.kind === a.kind && (c.op ?? "equals") === op && Boolean(c.not) === Boolean(a.not) && // A fixed-value entry (is checked / is not checked) only matches its own
+    // value, or the two would be indistinguishable.
+    (c.value === void 0 || c.value === value)
+  );
+}
+var PROPOSED_LABELS = {
+  screen: (v) => `screen is \u201C${v}\u201D`,
+  heading: (v) => `heading is \u201C${v}\u201D`,
+  message: (v) => `message \u201C${v}\u201D is shown`,
+  fields_visible: (v) => `fields visible: ${v}`
+};
+function describeAssertion(a, subject) {
+  const value = Array.isArray(a.value) ? a.value.join(", ") : a.value;
+  const proposed = PROPOSED_LABELS[a.kind];
+  if (proposed && !a.target) return proposed(value);
+  const check = matchCheck(a);
+  const who = a.target?.name || subject || "";
+  if (!check) {
+    return `${a.kind}${a.op && a.op !== "equals" ? ` ${a.op}` : ""}${a.not ? " not" : ""}${value ? ` \u201C${value}\u201D` : ""}`;
+  }
+  const attr = check.attr && a.attr ? ` ${a.attr}` : "";
+  const expects = check.input ? ` \u201C${value}\u201D` : "";
+  if (check.page) return `${check.label}${expects}`;
+  if (check.roleOnly) {
+    const role = a.target?.role || "element";
+    return `${role}s \xB7 ${check.label.replace("how many \xB7 ", "")}${expects}`;
+  }
+  const label = check.label.replace("attribute", `attribute${attr}`);
+  return who ? `\u201C${who}\u201D ${label}${expects}` : `${label}${expects}`;
+}
+
+// ../engine-playwright/dist/index.js
+import fs4 from "fs";
+import path22 from "path";
+import { chromium, firefox, webkit } from "playwright";
 
 // ../recorder/dist/index.js
 function openShadowRoots() {
@@ -2386,221 +2788,463 @@ function installDebugPanel() {
 }
 
 // ../engine-playwright/dist/index.js
-import fs4 from "fs";
+import "playwright";
+import "playwright";
+import fs22 from "fs";
 import { createRequire as createRequire2 } from "module";
-import path3 from "path";
+import path32 from "path";
 import { fileURLToPath } from "url";
 import "playwright";
-
-// ../core/dist/index.js
-function proposeAssertions(before, after) {
-  const out = [];
-  if (!before || !after) return out;
-  if (before.url !== after.url)
-    out.push({
-      kind: "screen",
-      value: after.heading || after.title,
-      why: "navigated to a new screen"
-    });
-  for (const a of after.alerts.filter((x) => !before.alerts.includes(x)))
-    out.push({ kind: "message", value: a, why: "a message appeared that was not there before" });
-  if (before.url === after.url && before.heading !== after.heading && after.heading)
-    out.push({ kind: "heading", value: after.heading, why: "the heading changed in place" });
-  const newFields = after.fields.filter((f) => !before.fields.includes(f));
-  if (newFields.length)
-    out.push({ kind: "fields_visible", value: newFields, why: "new fields became visible" });
-  if (before.url === after.url) {
-    const seenKeys = new Set(before.texts.map((t) => t.key));
-    const covered = /* @__PURE__ */ new Set([after.heading, ...after.alerts]);
-    const appeared = after.texts.filter((t) => !seenKeys.has(t.key) && !covered.has(t.text));
-    for (const t of appeared.slice(0, 2))
-      out.push({
-        kind: "message",
-        value: t.text,
-        why: "this text appeared after the action",
-        confidence: "low"
-      });
-  }
-  return out;
-}
-function hasObservableChange(before, after) {
-  return proposeAssertions(before, after).some((p) => p.confidence !== "low");
+import fs32 from "fs";
+import "playwright";
+function withRuntimeValues(step, values) {
+  const expand = (text) => text.replace(/\{\{([a-zA-Z][a-zA-Z0-9_]*)\}\}/g, (_, name) => {
+    if (!values.has(name)) throw new Error(`Runtime value "${name}" has not been captured yet`);
+    return values.get(name);
+  });
+  return {
+    ...step,
+    value: step.secret ? step.value : expand(step.value),
+    ...step.values ? { values: step.values.map(expand) } : {},
+    proposals: step.proposals.map((check) => ({ ...check, value: Array.isArray(check.value) ? check.value.map(expand) : expand(check.value) }))
+  };
 }
-function isLocalHost(host) {
-  const h = host.toLowerCase();
-  return h === "localhost" || h.endsWith(".localhost") || h === "127.0.0.1" || h === "[::1]" || h === "0.0.0.0";
+var secretsBehind = (auth) => [.../* @__PURE__ */ new Set([
+  ...Object.values(auth.secretRefs ?? {}),
+  ...auth.steps.flatMap((step) => step.secretRef ? [step.secretRef] : [])
+])].sort();
+function authStartUrl(auth, page, baseUrl) {
+  if (auth.navigation.kind === "continue") return null;
+  return new URL(auth.navigation.path, baseUrl || page.url()).href;
+}
+function describeAuthFailure(auth, cause) {
+  const who = `sign in as ${auth.accountName}`;
+  if (cause.step) return `could not ${who}: "${cause.step}" failed \u2014 ${cause.detail ?? "no detail"}`;
+  return `could not ${who}: ${cause.detail ?? "no detail"}`;
+}
+var hasSuccessCheck = (auth) => auth.success.some((check) => check.enabled !== false);
+var UNCHECKED_AUTH = "this sign-in has no check for whether it worked \u2014 add one so a failed login is not reported as a passed step";
+function authenticationResolver(input) {
+  const entries = DeliveredAuthSchema.array().parse(input ?? []);
+  return (reference) => {
+    const matches = entries.filter((item) => item.profileId === reference.profileId && (!reference.accountId || item.accountId === reference.accountId));
+    if (matches.length !== 1) return void 0;
+    return matches[0];
+  };
 }
-function hasScheme(raw) {
-  if (/^[a-zA-Z][a-zA-Z0-9+.-]*:\/\//.test(raw)) return true;
-  return /^[a-zA-Z][a-zA-Z0-9+.-]*:(?!\d)/.test(raw);
+var PEPPER = randomBytes(32);
+function preparationKey(identity) {
+  const material = JSON.stringify([
+    identity.scope,
+    identity.profileId,
+    identity.accountId,
+    identity.environment,
+    identity.baseUrl,
+    identity.browser,
+    // The procedure as it will actually run.
+    identity.auth.navigation,
+    identity.auth.steps,
+    identity.auth.success,
+    // Each secret separately, so reordering cannot collide with a rotation.
+    identity.secrets.map((value) => createHmac("sha256", PEPPER).update(value ?? "\0absent").digest("hex"))
+  ]);
+  return createHmac("sha256", PEPPER).update(material).digest("hex");
+}
+var AuthenticationReuse = class {
+  held = /* @__PURE__ */ new Map();
+  ttlMs;
+  max;
+  scope = "";
+  constructor({ ttlMs = 15 * 6e4, max = 16 } = {}) {
+    this.ttlMs = ttlMs;
+    this.max = max;
+  }
+  /** ONE EXECUTION AT A TIME. Asking under a new scope forgets every session
+   *  from the last one.
+   *
+   * The scope is already part of every key, so nothing could have been read
+   * across executions anyway. This is about not HOLDING them: a suite that has
+   * finished has no reason for its sessions to still exist, and an agent that
+   * keeps running would otherwise sit on them until they aged out. */
+  using(scope) {
+    if (scope === this.scope) return;
+    this.scope = scope;
+    for (const [key, held] of this.held) if (held.scope !== scope) this.held.delete(key);
+  }
+  get(key, now = Date.now()) {
+    const found = this.held.get(key);
+    if (!found) return void 0;
+    if (now - found.storedAt > this.ttlMs) {
+      this.held.delete(key);
+      return void 0;
+    }
+    this.held.delete(key);
+    this.held.set(key, found);
+    return found.state;
+  }
+  put(key, state, now = Date.now()) {
+    this.held.delete(key);
+    this.held.set(key, { state, storedAt: now, scope: this.scope });
+    while (this.held.size > this.max) {
+      const oldest = this.held.keys().next();
+      if (oldest.done) break;
+      this.held.delete(oldest.value);
+    }
+  }
+  /** After a session turned out to be stale. The next preparation signs in. */
+  evict(key) {
+    this.held.delete(key);
+  }
+  /** At the end of an execution, at a cancel, and at shutdown.
+   *
+   * Called from all three rather than relying on the TTL: a process that keeps
+   * running holds these until they expire otherwise, and there is no reason
+   * for a finished suite's sessions to exist at all. */
+  clear() {
+    this.held.clear();
+  }
+  get size() {
+    return this.held.size;
+  }
+};
+function keptSessionFor(opts, reference) {
+  if (!opts.reuse || !reference) return null;
+  opts.reuse.cache.using(opts.reuse.scope);
+  const auth = opts.resolveAuth?.(reference);
+  if (!auth || !auth.success.some((check) => check.enabled !== false)) return null;
+  const key = preparationKey({
+    scope: opts.reuse.scope,
+    profileId: reference.profileId,
+    accountId: reference.accountId ?? auth.accountName,
+    environment: opts.reuse.environment ?? null,
+    baseUrl: opts.baseUrl,
+    browser: JSON.stringify(opts.environment ?? {}),
+    auth,
+    secrets: secretsBehind(auth).map((ref) => opts.resolveSecret?.(ref))
+  });
+  const state = opts.reuse.cache.get(key);
+  return { key, auth, ...state ? { state } : {} };
 }
-function normalizeStartUrl(input) {
-  const raw = (input ?? "").trim();
-  if (!raw) throw new Error("enter a URL to record against");
-  let candidate;
-  if (hasScheme(raw)) {
-    candidate = raw;
-  } else {
-    const bare = raw.replace(/^\/+/, "");
-    const host = bare.split(/[/?#]/)[0] ?? "";
-    candidate = `${isLocalHost(host.split(":")[0] ?? "") ? "http" : "https"}://${bare}`;
+var RunActors = class {
+  constructor(main, opts) {
+    this.main = main;
+    this.opts = opts;
+    this.original = main;
+    this.current = main;
+    this.currentId = opts.defaultActorId ?? "default";
+    this.sessions.set(this.currentId, main);
   }
-  let parsed;
+  main;
+  opts;
+  values = /* @__PURE__ */ new Map();
+  sessions = /* @__PURE__ */ new Map();
+  initialized = /* @__PURE__ */ new Set();
+  /** How many times each participant has been started over, so each round's
+   *  evidence has a place of its own. */
+  resets = /* @__PURE__ */ new Map();
+  /** Sessions already closed and already collected. */
+  retired = /* @__PURE__ */ new Set();
+  /** Where each session writes its evidence, relative to the run's directory.
+   *  Fixed when the context is created — a video cannot be redirected later —
+   *  so it is remembered rather than recomputed at close. */
+  homes = /* @__PURE__ */ new Map();
+  /** How each participant was signed in: freshly, from a kept session, or
+   *  freshly after a kept one turned out to be stale. */
+  preparations = /* @__PURE__ */ new Map();
+  original;
+  current;
+  currentId;
+  all() {
+    return [...this.sessions.values()];
+  }
+  evidenceIn(suffix) {
+    return this.opts.evidenceDir ? { evidenceDir: path3.join(this.opts.evidenceDir, suffix) } : {};
+  }
+  /** What to call a participant in a report. The id is a slug nobody chose to
+   *  read; the name is what they typed when they created it. */
+  nameOf(id) {
+    if (!id || id === "default") return this.opts.actors?.find((a) => a.id === (id ?? "default"))?.name ?? "the main participant";
+    return this.opts.actors?.find((a) => a.id === id)?.name ?? id;
+  }
+  async select(id, startUrl = this.opts.startUrl) {
+    const actor = this.opts.actors?.find((a) => a.id === id);
+    if (id !== "default" && !actor) throw new Error(`Unknown actor: ${id}`);
+    const kept = !actor?.startSignedIn ? null : this.sessions.has(id) ? this.opts.hydrated?.id === id ? this.opts.hydrated : null : keptSessionFor(this.opts, actor.startSignedIn);
+    let session = this.sessions.get(id);
+    if (!session) {
+      session = await openRunSession({
+        ...this.opts,
+        browser: this.main.browser,
+        ...this.evidenceIn(`actor-${id}`),
+        ...kept?.state ? { storageState: kept.state } : {}
+      });
+      this.homes.set(session, `actor-${id}`);
+      this.sessions.set(id, session);
+      await this.opts.onCreate?.(session);
+    }
+    this.current = session;
+    this.currentId = id;
+    if (this.initialized.has(id)) return;
+    await session.page.goto(startUrl, { waitUntil: "domcontentloaded" });
+    if (actor?.startSignedIn) {
+      if (kept?.state) {
+        const confirmed = await confirmSignedIn(session.page, kept.auth, this.opts.reuseCheckMs ?? 3e3);
+        if (confirmed.ok) {
+          this.preparations.set(id, "reused");
+          this.initialized.add(id);
+          return;
+        }
+        this.opts.reuse?.cache.evict(kept.key);
+        this.preparations.set(id, "stale");
+        session = await this.replaceWithGuest(id, session);
+        await session.page.goto(startUrl, { waitUntil: "domcontentloaded" });
+      }
+      await executeStep(
+        session.page,
+        {
+          id: `prepare:${id}`,
+          type: "signIn",
+          auth: actor.startSignedIn,
+          name: `Prepare ${actor.name}`,
+          role: "",
+          scope: "",
+          value: "",
+          secret: false,
+          legacySelector: "",
+          proposals: []
+        },
+        {
+          pages: session.pages,
+          baseUrl: this.opts.baseUrl,
+          ...this.opts.resolveAuth ? { resolveAuth: this.opts.resolveAuth } : {},
+          ...this.opts.resolveSecret ? { resolveSecret: this.opts.resolveSecret } : {}
+        }
+      );
+      if (!this.preparations.has(id)) this.preparations.set(id, "fresh");
+      if (kept) {
+        try {
+          this.opts.reuse?.cache.put(kept.key, await session.context.storageState());
+        } catch {
+        }
+      }
+      await session.page.goto(startUrl, { waitUntil: "domcontentloaded" });
+    }
+    this.initialized.add(id);
+  }
+  /** Replace a participant's context without disturbing anyone else's. */
+  async replaceWithGuest(id, previous) {
+    const session = await openRunSession({ ...this.opts, browser: this.main.browser, ...this.evidenceIn(`actor-${id}`) });
+    this.homes.set(session, `actor-${id}`);
+    this.sessions.set(id, session);
+    this.current = session;
+    if (previous !== this.original) await previous.context.close().catch(() => {
+    });
+    await this.opts.onCreate?.(session);
+    return session;
+  }
+  /** How each participant came to be signed in, for the report.
+   *
+   * Visible on purpose: "this suite signed in once and reused it" and "this
+   * suite signed in forty times" are different tests, and somebody reading a
+   * green result is entitled to know which one they ran. */
+  preparedHow() {
+    return Object.fromEntries(this.preparations);
+  }
+  /** Throw this participant's session away and give them a new signed-out one.
+   *
+   * NOT SIGNING OUT. An application can be signed out of while the browser
+   * keeps every cookie and every token it was given, and a test of "log out,
+   * then visit this page" exists to find exactly that difference. This is the
+   * other thing: a browser that has never been anywhere.
+   *
+   * The session being replaced is CLOSED PROPERLY, not dropped. Closing the
+   * context directly threw away the video and the trace of everything that
+   * participant had done — which, since a reset usually follows something
+   * worth understanding, is the evidence most likely to be wanted. */
+  async freshGuest(id) {
+    if (id !== "default" && !this.opts.actors?.some((a) => a.id === id)) throw new Error(`Unknown actor: ${id}`);
+    const previous = this.sessions.get(id);
+    const round = (this.resets.get(id) ?? 0) + 1;
+    this.resets.set(id, round);
+    const home = `actor-${id}-${round}`;
+    const session = await openRunSession({ ...this.opts, browser: this.main.browser, ...this.evidenceIn(home) });
+    this.homes.set(session, home);
+    this.sessions.set(id, session);
+    this.current = session;
+    this.currentId = id;
+    if (previous) {
+      const where = this.homes.get(previous);
+      const artifacts = await closeRunSession(
+        { ...previous, ownsBrowser: false },
+        { passed: true, ...where === void 0 ? {} : this.evidenceIn(where) }
+      );
+      if (previous !== this.original) {
+        this.main.runArtifacts.push(...artifacts.map((a) => ({ ...a, relPath: where ? `${where}/${a.relPath}` : a.relPath })));
+      }
+      this.retired.add(previous);
+    }
+    await this.opts.onCreate?.(session);
+    await session.page.goto(this.opts.startUrl, { waitUntil: "domcontentloaded" });
+    this.initialized.add(id);
+  }
+  /** Back to one participant, between debug replays.
+   *
+   * THE SESSION THIS BEGAN WITH IS KEPT. It used to be closed and replaced,
+   * and everything that reads the browser — the panel injected into that
+   * context, the recorder listening on that page, the painter bound to its
+   * loads — had been handed it when the session started. After one Replay
+   * they were all driving a context that had been closed, and the debugger
+   * answered every request with "target has been closed".
+   *
+   * The extra participants are what this tears down, which is what it is for.
+   * Contexts only: whatever a replay recorded belongs to the replay that is
+   * ending, and the debugger collects that on its own terms. */
+  async reset() {
+    for (const session of this.sessions.values()) {
+      if (session === this.original) continue;
+      await session.context.close().catch(() => {
+      });
+      this.homes.delete(session);
+    }
+    this.main = this.original;
+    this.current = this.original;
+    this.currentId = this.opts.defaultActorId ?? "default";
+    this.sessions = /* @__PURE__ */ new Map([[this.currentId, this.original]]);
+    this.initialized.clear();
+    this.retired.clear();
+    this.resets.clear();
+    this.values.clear();
+  }
+  async closeExtras(passed) {
+    for (const [id, session] of this.sessions) {
+      if (session === this.original || this.retired.has(session)) continue;
+      const where = this.homes.get(session) ?? `actor-${id}`;
+      try {
+        const artifacts = await closeRunSession(session, { passed, ...this.evidenceIn(where) });
+        this.main.runArtifacts.push(...artifacts.map((a) => ({ ...a, relPath: `${where}/${a.relPath}` })));
+      } catch {
+        await session.context.close().catch(() => {
+        });
+      }
+    }
+  }
+};
+var PASSWORD_FIELDS = 'input[type="password"]';
+async function captureFailure(opts) {
+  const { page, dir, ordinal } = opts;
+  let url = "";
+  let title = "";
   try {
-    parsed = new URL(candidate);
+    url = page.url();
+    title = await page.title();
   } catch {
-    throw new Error(`"${raw}" is not a valid URL`);
   }
-  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
-    throw new Error(`only http:// and https:// URLs can be recorded (got ${parsed.protocol}//)`);
+  let screenshot = null;
+  try {
+    const file = `step-${String(ordinal).padStart(2, "0")}.png`;
+    fs4.mkdirSync(dir, { recursive: true });
+    await page.screenshot({
+      path: path22.join(dir, file),
+      // The viewport, not the full page: a failure is about what was on screen,
+      // and a full-page capture of an infinite-scroll app is a 20MB image.
+      fullPage: false,
+      mask: masks(opts),
+      // Playwright's default is magenta, which reads as a rendering fault
+      // rather than as a deliberate redaction. A flat slate box is obviously
+      // something someone chose to cover up.
+      maskColor: "#475569",
+      timeout: 5e3
+    });
+    screenshot = file;
+  } catch {
+    screenshot = null;
   }
-  if (!parsed.hostname) throw new Error(`"${raw}" has no host`);
-  return parsed.toString();
+  return { screenshot, url, title };
 }
-function resolveStartUrl(baseUrl, startPath) {
-  const base = normalizeStartUrl(baseUrl);
-  return new URL(startPath || "/", base).toString();
+function maskTargets(steps = []) {
+  const frames = /* @__PURE__ */ new Set([JSON.stringify([])]);
+  for (const step of steps) {
+    if (step.frame?.length) frames.add(JSON.stringify(step.frame));
+  }
+  const targets = [...frames].map((chain) => {
+    const frame = JSON.parse(chain);
+    return frame.length ? { by: "selector", value: PASSWORD_FIELDS, frame } : { by: "selector", value: PASSWORD_FIELDS };
+  });
+  const seen = /* @__PURE__ */ new Set();
+  for (const step of steps) {
+    const name = step.name.trim();
+    if (!step.secret || !name) continue;
+    const key = `${JSON.stringify(step.frame ?? [])}|${name}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    targets.push(step.frame?.length ? { by: "label", value: name, frame: step.frame } : { by: "label", value: name });
+  }
+  return targets;
 }
-var INPUT_ROLES = /* @__PURE__ */ new Set(["textbox", "combobox", "checkbox", "radio", "spinbutton", "searchbox"]);
-var NAVIGATIONS = /* @__PURE__ */ new Set(["back", "forward"]);
-function locatorPlan(step) {
-  const o = step.locator;
-  if (o && o.value.trim()) {
-    const value = o.value.trim();
-    switch (o.strategy) {
-      // Playwright reads a leading `xpath=` prefix, and also bare paths that
-      // start with `/` or `//`. Normalising here means the QA can paste either.
-      case "xpath":
-        return { method: "locator", arg: value.startsWith("xpath=") ? value : `xpath=${value}`, overridden: true };
-      // Typed as a bare id, so nobody has to remember the `#`.
-      case "id":
-        return { method: "locator", arg: /^[a-zA-Z_][a-zA-Z0-9_-]*$/.test(value.replace(/^#/, "")) ? `#${value.replace(/^#/, "")}` : `[id=${JSON.stringify(value.replace(/^#/, ""))}]`, overridden: true };
-      case "css":
-        return { method: "locator", arg: value, overridden: true };
-      case "testId":
-        return { method: "getByTestId", arg: value, overridden: true };
-      case "text":
-        return { method: "getByText", arg: value, exact: true, overridden: true };
-      case "label":
-        return { method: "getByLabel", arg: value, exact: true, overridden: true };
-      case "placeholder":
-        return { method: "getByPlaceholder", arg: value, exact: true, overridden: true };
-      case "altText":
-        return { method: "getByAltText", arg: value, exact: true, overridden: true };
-      case "title":
-        return { method: "getByTitle", arg: value, exact: true, overridden: true };
+function masks(opts) {
+  const { page } = opts;
+  return maskTargets(opts.steps).map((t) => {
+    let root = page;
+    for (const frame of t.frame ?? []) root = root.frameLocator(frameSelector(frame));
+    return t.by === "selector" ? root.locator(t.value) : root.getByLabel(t.value, { exact: true });
+  });
+}
+async function finaliseArtifacts(opts) {
+  const { context, dir, passed, artifacts, consoleLines } = opts;
+  const keep = (mode) => mode === "always" || mode === "on-failure" && !passed;
+  const out = [];
+  const size = (file) => {
+    try {
+      return fs4.statSync(path22.join(dir, file)).size;
+    } catch {
+      return null;
+    }
+  };
+  if (artifacts.trace !== "off") {
+    const file = "trace.zip";
+    try {
+      if (keep(artifacts.trace)) {
+        fs4.mkdirSync(dir, { recursive: true });
+        await context.tracing.stop({ path: path22.join(dir, file) });
+        out.push({ kind: "trace", relPath: file, bytes: size(file) });
+      } else {
+        await context.tracing.stop();
+      }
+    } catch {
     }
   }
-  if (NAVIGATIONS.has(step.type)) {
-    return { method: step.type === "back" ? "goBack" : "goForward", arg: "", overridden: false };
+  if (artifacts.console && consoleLines.length) {
+    const file = "console.log";
+    try {
+      fs4.mkdirSync(dir, { recursive: true });
+      fs4.writeFileSync(path22.join(dir, file), consoleLines.join("\n") + "\n");
+      out.push({ kind: "console", relPath: file, bytes: size(file) });
+    } catch {
+    }
   }
-  if (!step.name.trim()) return { method: "none", arg: "", overridden: false };
-  if (step.nameFrom === "adjacent-label") {
-    return {
-      method: "getByText",
-      arg: step.name,
-      exact: true,
-      overridden: false,
-      viaAdjacentLabel: true
-    };
+  return out;
+}
+function collectVideos(dir, keep) {
+  let files;
+  try {
+    files = fs4.readdirSync(dir).filter((f) => f.endsWith(".webm"));
+  } catch {
+    return [];
   }
-  if (step.nameFrom === "text") {
-    return {
-      method: "getByText",
-      arg: step.name,
-      exact: step.type !== "hover",
-      overridden: false,
-      visible: true
-    };
+  if (!keep) {
+    for (const f of files) fs4.rmSync(path22.join(dir, f), { force: true });
+    return [];
   }
-  return INPUT_ROLES.has(step.role) ? { method: "getByLabel", arg: step.name, exact: true, overridden: false, inputRole: step.role } : step.role ? { method: "getByRole", arg: step.role, name: step.name, exact: true, overridden: false } : { method: "getByText", arg: step.name, exact: step.type !== "hover", overridden: false, visible: true };
-}
-function frameSelector(name) {
-  const positional = /^nth:(\d+)$/.exec(name);
-  if (positional) return `iframe, frame >> nth=${positional[1]}`;
-  const v = JSON.stringify(name);
-  return `iframe[title=${v}], iframe[name=${v}], iframe[id=${v}], frame[title=${v}], frame[name=${v}], frame[id=${v}]`;
-}
-function inputSelector(role) {
-  return role === "textbox" ? 'input, textarea, [contenteditable="true"], [role="textbox"]' : `input, select, [role="${role}"]`;
+  return files.map((f) => {
+    let bytes = null;
+    try {
+      bytes = fs4.statSync(path22.join(dir, f)).size;
+    } catch {
+      bytes = null;
+    }
+    return { kind: "video", relPath: f, bytes };
+  });
 }
-var SCOPE_ROLES = ["form", "group", "region", "dialog", "alertdialog"];
-var CHECKS = [
-  { id: "visible", label: "is visible", kind: "visible", group: "state" },
-  { id: "not-visible", label: "is not visible", kind: "visible", not: true, group: "state" },
-  { id: "attached", label: "exists on the page", kind: "attached", group: "state" },
-  { id: "not-attached", label: "does not exist", kind: "attached", not: true, group: "state" },
-  { id: "enabled", label: "is enabled", kind: "enabled", group: "state" },
-  { id: "disabled", label: "is disabled", kind: "enabled", not: true, group: "state" },
-  { id: "editable", label: "is editable", kind: "editable", group: "state" },
-  { id: "readonly", label: "is read-only", kind: "editable", not: true, group: "state" },
-  { id: "focused", label: "is focused", kind: "focused", group: "state" },
-  { id: "checked", label: "is checked", kind: "checked", value: "true", group: "state" },
-  { id: "unchecked", label: "is not checked", kind: "checked", value: "false", group: "state" },
-  { id: "text", label: "text is exactly", kind: "text", input: true, group: "text" },
-  { id: "text-contains", label: "text contains", kind: "text", op: "contains", input: true, group: "text" },
-  { id: "text-matches", label: "text matches pattern", kind: "text", op: "matches", input: true, group: "text" },
-  { id: "text-not", label: "text is not", kind: "text", not: true, input: true, group: "text" },
-  { id: "text-not-contains", label: "text does not contain", kind: "text", op: "contains", not: true, input: true, group: "text" },
-  { id: "value", label: "value is exactly", kind: "value", input: true, group: "value" },
-  { id: "value-contains", label: "value contains", kind: "value", op: "contains", input: true, group: "value" },
-  { id: "value-not", label: "value is not", kind: "value", not: true, input: true, group: "value" },
-  { id: "attr", label: "attribute is", kind: "attribute", input: true, attr: true, group: "attributes" },
-  { id: "attr-contains", label: "attribute contains", kind: "attribute", op: "contains", input: true, attr: true, group: "attributes" },
-  { id: "attr-not", label: "attribute is not", kind: "attribute", not: true, input: true, attr: true, group: "attributes" },
-  { id: "class", label: "has class", kind: "class", input: true, group: "attributes" },
-  { id: "not-class", label: "does not have class", kind: "class", not: true, input: true, group: "attributes" },
-  { id: "count", label: "how many \xB7 is exactly", kind: "count", input: true, roleOnly: true, group: "count" },
-  { id: "count-gte", label: "how many \xB7 is at least", kind: "count", op: "gte", input: true, roleOnly: true, group: "count" },
-  { id: "count-lte", label: "how many \xB7 is at most", kind: "count", op: "lte", input: true, roleOnly: true, group: "count" },
-  { id: "url", label: "page URL is", kind: "url", input: true, page: true, group: "page" },
-  { id: "url-contains", label: "page URL contains", kind: "url", op: "contains", input: true, page: true, group: "page" },
-  { id: "title", label: "page title is", kind: "title", input: true, page: true, group: "page" },
-  { id: "title-contains", label: "page title contains", kind: "title", op: "contains", input: true, page: true, group: "page" }
-];
-function matchCheck(a) {
-  const op = a.op ?? "equals";
-  const value = Array.isArray(a.value) ? a.value.join(", ") : a.value;
-  return CHECKS.find(
-    (c) => c.kind === a.kind && (c.op ?? "equals") === op && Boolean(c.not) === Boolean(a.not) && // A fixed-value entry (is checked / is not checked) only matches its own
-    // value, or the two would be indistinguishable.
-    (c.value === void 0 || c.value === value)
-  );
-}
-var PROPOSED_LABELS = {
-  screen: (v) => `screen is \u201C${v}\u201D`,
-  heading: (v) => `heading is \u201C${v}\u201D`,
-  message: (v) => `message \u201C${v}\u201D is shown`,
-  fields_visible: (v) => `fields visible: ${v}`
-};
-function describeAssertion(a, subject) {
-  const value = Array.isArray(a.value) ? a.value.join(", ") : a.value;
-  const proposed = PROPOSED_LABELS[a.kind];
-  if (proposed && !a.target) return proposed(value);
-  const check = matchCheck(a);
-  const who = a.target?.name || subject || "";
-  if (!check) {
-    return `${a.kind}${a.op && a.op !== "equals" ? ` ${a.op}` : ""}${a.not ? " not" : ""}${value ? ` \u201C${value}\u201D` : ""}`;
-  }
-  const attr = check.attr && a.attr ? ` ${a.attr}` : "";
-  const expects = check.input ? ` \u201C${value}\u201D` : "";
-  if (check.page) return `${check.label}${expects}`;
-  if (check.roleOnly) {
-    const role = a.target?.role || "element";
-    return `${role}s \xB7 ${check.label.replace("how many \xB7 ", "")}${expects}`;
-  }
-  const label = check.label.replace("attribute", `attribute${attr}`);
-  return who ? `\u201C${who}\u201D ${label}${expects}` : `${label}${expects}`;
-}
-
-// ../engine-playwright/dist/index.js
-import "playwright";
-import { errors } from "playwright";
-import fs22 from "fs";
-import path22 from "path";
-import "playwright";
-import fs32 from "fs";
-import "playwright";
 var DEFAULT_ENVIRONMENT = {
   browser: "chromium",
   viewport: { width: 1280, height: 720 },
@@ -2652,12 +3296,12 @@ function resolveCapture(options = {}) {
   };
 }
 var forcedHeadless = () => process.env["FLOWRIKI_FORCE_HEADLESS"] === "1";
-async function launchSession(environment = {}, headlessRequested = true, slowMo = 0, capture = {}) {
+async function launchSession(environment = {}, headlessRequested = true, slowMo = 0, capture = {}, existingBrowser, storageState) {
   const headless = headlessRequested || forcedHeadless();
   const config = { ...DEFAULT_ENVIRONMENT, ...ExecutionEnvironmentSchema.parse(environment) };
   const fullWindow = config.fullWindow === true && !headless;
   const engine = { chromium, firefox, webkit }[config.browser];
-  const browser = await engine.launch({
+  const browser = existingBrowser ?? await engine.launch({
     headless,
     slowMo,
     // Chromium's flag. Firefox and WebKit have no equivalent, and `viewport:
@@ -2673,6 +3317,7 @@ async function launchSession(environment = {}, headlessRequested = true, slowMo
       locale,
       timezoneId,
       colorScheme,
+      ...storageState ? { storageState } : {},
       // Playwright can only be told to record at context creation, so a video
       // wanted "on failure" is recorded for every run and thrown away when the
       // run passes. There is no way to start one after the fact.
@@ -2691,7 +3336,7 @@ async function launchSession(environment = {}, headlessRequested = true, slowMo
     if (config.openClosedShadowRoots) await context.addInitScript(openShadowRoots);
     return { browser, context, config, artifacts };
   } catch (error) {
-    await browser.close();
+    if (!existingBrowser) await browser.close();
     throw error;
   }
 }
@@ -2851,710 +3496,121 @@ async function locateDrop(page, step) {
     to: void 0
   });
 }
-var OUTCOME_WINDOW_MS = 2500;
-var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-var COMMITS = /* @__PURE__ */ new Set([
-  "click",
-  "dblclick",
-  "rightclick",
-  "drag",
-  "check",
-  "press",
-  "upload",
-  "back",
-  "forward"
-]);
-var cachedAccNameScript = null;
-var ACCNAME_ASSET = "accname.global.js";
-function accNameScript() {
-  if (cachedAccNameScript === null) {
-    cachedAccNameScript = fs4.readFileSync(accNameScriptPath(), "utf8");
-  }
-  return cachedAccNameScript;
+var STATES = {
+  visible: "visible",
+  hidden: "visible",
+  attached: "attached",
+  enabled: "enabled",
+  editable: "editable",
+  focused: "focused",
+  checked: "checked"
+};
+var TEXT_KINDS = /* @__PURE__ */ new Set(["text", "message", "screen", "heading"]);
+var PAGE_KINDS = /* @__PURE__ */ new Set(["url", "title"]);
+function absenceSatisfies(state, want) {
+  return !want && (state === "attached" || state === "visible");
 }
-function accNameScriptPath() {
+function firstLine(err) {
+  return String(err instanceof Error ? err.message : err).split("\n")[0].trim();
+}
+function ambiguityDetail(count) {
+  return `resolves to ${count} elements \u2014 nothing on the page tells them apart`;
+}
+async function presenceOf(target) {
+  let count;
   try {
-    return createRequire2(import.meta.url).resolve("@flowriki/recorder/accname.global.js");
-  } catch {
-    const beside = path3.join(path3.dirname(fileURLToPath(import.meta.url)), ACCNAME_ASSET);
-    if (fs4.existsSync(beside)) return beside;
+    count = await target.count();
+  } catch (err) {
+    return { outcome: "invalid", detail: firstLine(err) };
+  }
+  if (count === 0) return { outcome: "absent" };
+  if (count > 1) return { outcome: "ambiguous", count };
+  return { outcome: "present", locator: target };
+}
+async function readState(target, state, timeout) {
+  if (state === "visible") return target.isVisible();
+  if (state === "attached") return await target.count() > 0;
+  if (state === "enabled") return target.isEnabled({ timeout });
+  if (state === "editable") return target.isEditable({ timeout });
+  if (state === "checked") return target.isChecked({ timeout });
+  return target.evaluate((el) => el === el.ownerDocument.activeElement);
+}
+function compare(actual, expected, op) {
+  switch (op) {
+    case "contains":
+      return actual.includes(expected);
+    case "matches":
+      return new RegExp(expected).test(actual);
+    case "gt":
+      return Number(actual) > Number(expected);
+    case "gte":
+      return Number(actual) >= Number(expected);
+    case "lt":
+      return Number(actual) < Number(expected);
+    case "lte":
+      return Number(actual) <= Number(expected);
+    default:
+      return actual === expected;
+  }
+}
+var OP_WORDS = {
+  equals: ["is", "is not"],
+  contains: ["contains", "does not contain"],
+  matches: ["matches", "does not match"],
+  gt: ["is more than", "is not more than"],
+  gte: ["is at least", "is less than"],
+  lt: ["is fewer than", "is not fewer than"],
+  lte: ["is at most", "is more than"]
+};
+var DEFAULT_OPS = { message: "contains" };
+function explain(r) {
+  switch (r.outcome) {
+    case "absent":
+      return { detail: "no element matched", kind: "not_found" };
+    case "ambiguous":
+      return { detail: ambiguityDetail(r.count), kind: "ambiguous" };
+    case "invalid":
+      return { detail: `the locator could not be used \u2014 ${r.detail}`, kind: "unknown" };
+    case "unreadable":
+      return { detail: `the element could not be read \u2014 ${r.detail}`, kind: "unknown" };
+    case "not_visible":
+      return { detail: "the element is present but not visible", kind: null };
+    default:
+      return { detail: "", kind: null };
+  }
+}
+function fail(message, r) {
+  const { detail, kind } = explain(r);
+  throw Object.assign(new Error(detail ? `${message} \u2014 ${detail}` : message), kind ? { kind } : {});
+}
+async function checkAssertion(page, kind, value, timeoutMs = 3e3, assertion) {
+  const deadline = Date.now() + timeoutMs;
+  const remaining = () => Math.max(1, deadline - Date.now());
+  const op = assertion?.op ?? DEFAULT_OPS[kind] ?? "equals";
+  const negated = assertion?.not === true;
+  const expected = String(value);
+  const asStep = (t) => ({
+    id: "assertion",
+    type: "click",
+    value: "",
+    secret: false,
+    legacySelector: "",
+    proposals: [],
+    scope: "",
+    ...t
+  });
+  const NEEDS_TARGET = /* @__PURE__ */ new Set(["count", "attribute", "class", "value", "text", ...Object.keys(STATES)]);
+  if (NEEDS_TARGET.has(kind) && !assertion?.target) throw new Error(`${kind} assertion needs an element target`);
+  if (negated && !assertion?.target && (TEXT_KINDS.has(kind) || kind === "fields_visible")) {
     throw new Error(
-      `this build is missing ${ACCNAME_ASSET}, which recording injects into the page \u2014 reinstall the agent`
+      `a negated ${kind} assertion needs an element target \u2014 choose the element in the editor, or use a "hidden" check to assert that something has gone`
     );
   }
-}
-async function startRecordingSession(opts) {
-  const { headless = false, onStep, onState, onDisconnect, onStopRequested } = opts;
-  const url = normalizeStartUrl(opts.url);
-  const { browser, context, config } = await launchSession(opts.environment, headless);
-  const steps = [];
-  let pendingScrollPos = null;
-  const pageIds = /* @__PURE__ */ new Map();
-  let nextPageId = 0;
-  let pendingDialog = null;
-  let stopped = false;
-  let paused = false;
-  const frameChains = /* @__PURE__ */ new Map();
-  const frameLabel = async (frame) => {
-    const el = await frame.frameElement().catch(() => null);
-    if (el) {
-      for (const attr of ["title", "name", "id"]) {
-        const value = (await el.getAttribute(attr).catch(() => null))?.trim();
-        if (value) return value;
-      }
-    }
-    const named = frame.name();
-    if (named) return named;
-    const siblings = frame.parentFrame()?.childFrames() ?? [];
-    return `nth:${Math.max(0, siblings.indexOf(frame))}`;
-  };
-  const noteFrame = async (frame) => {
-    try {
-      const chain = [];
-      let f = frame;
-      while (f && f.parentFrame()) {
-        chain.unshift(await frameLabel(f));
-        f = f.parentFrame();
-      }
-      frameChains.set(frame, chain);
-    } catch {
-    }
-  };
-  const watchFrames = (page2) => {
-    for (const f of page2.frames()) void noteFrame(f);
-    page2.on("frameattached", (f) => void noteFrame(f));
-    page2.on("framenavigated", (f) => void noteFrame(f));
-  };
-  const snapshot = () => ({
-    status: "recording",
-    cursor: null,
-    breakpoints: [],
-    steps: steps.map((x) => ({ ...x })),
-    results: {},
-    failure: null,
-    recording: !paused,
-    recorded: steps.map((x) => x.id),
-    mode: "record",
-    ...pendingDialog ? { dialog: { type: pendingDialog.dialog.type(), message: pendingDialog.dialog.message(), defaultValue: pendingDialog.dialog.defaultValue() } } : {}
-  });
-  const paint = () => {
-    const safe2 = {
-      ...snapshot(),
-      // The characters typed into a password never leave this process.
-      steps: snapshot().steps.map((st) => ({
-        id: st.id,
-        type: st.type,
-        name: st.name,
-        scope: st.scope,
-        value: st.secret ? "" : st.value,
-        secret: st.secret,
-        // The sentence, written here rather than in the page: the catalogue's
-        // wording lives in core, and a panel that phrased checks its own way
-        // would say something different from the flow editor about the same
-        // step.
-        ...st.type === "assert" && st.proposals[0] ? { detail: describeAssertion(st.proposals[0], st.name) } : {}
-      }))
-    };
-    for (const p of context.pages()) {
-      p.evaluate(
-        (v) => window.__flDebugRender?.(v),
-        safe2
-      ).catch(() => {
-      });
-    }
-    onState?.(snapshot());
-  };
-  const toPanel = async (msg) => {
-    await context.pages()[0]?.evaluate(
-      (v) => window.__flPanelMessage?.(v),
-      msg
-    ).catch(() => {
-    });
-  };
-  let signature = null;
-  browser.on("disconnected", () => {
-    if (!stopped) onDisconnect?.();
-  });
-  let pending = null;
-  const finish = (after) => {
-    if (!pending) return;
-    const { step, before, timer } = pending;
-    clearTimeout(timer);
-    pending = null;
-    step.proposals = proposeAssertions(before, after).map(
-      (p) => (
-        // Inferred from a text diff, so it arrives unticked for a human to
-        // confirm. Everything else the page stated about itself and is safe to
-        // run as recorded.
-        p.confidence === "low" ? { ...p, enabled: false } : p
-      )
-    );
-    onStep?.(step);
-  };
-  const consider = (sig) => {
-    signature = sig;
-    if (!pending) return;
-    if (hasObservableChange(pending.before, sig)) finish(sig);
-  };
-  const begin = (step, before) => {
-    finish(signature);
-    const timer = setTimeout(() => finish(signature), OUTCOME_WINDOW_MS);
-    timer.unref?.();
-    pending = { step, before, timer };
-  };
-  const targetIds = /* @__PURE__ */ new Map();
-  const record = (payload, before) => {
-    if (["fill", "select", "setRange"].includes(payload.type)) {
-      const prev = steps[steps.length - 1];
-      if (prev && prev.type === payload.type && targetIds.get(prev.id) === payload.__targetId && payload.__targetId && prev.pageId === payload.pageId && JSON.stringify(prev.frame) === JSON.stringify(payload.frame)) {
-        prev.value = payload.value ?? "";
-        if (payload.values) prev.values = payload.values;
-        onStep?.(prev);
-        paint();
-        return;
-      }
-    }
-    if (payload.type === "scroll") {
-      pendingScrollPos = payload.scroll;
-      return;
-    }
-    if (payload.type === "dblclick") {
-      const prev = steps[steps.length - 1];
-      if (prev && prev.type === "click" && prev.name === payload.name && prev.scope === payload.scope) {
-        steps.pop();
-      }
-    }
-    const step = {
-      id: `st_${crypto.randomUUID().slice(0, 8)}`,
-      type: payload.type,
-      role: payload.role ?? "",
-      name: payload.name ?? "",
-      ...payload.nameFrom ? { nameFrom: payload.nameFrom } : {},
-      scope: payload.scope ?? "",
-      ...payload.scopeRole ? { scopeRole: payload.scopeRole } : {},
-      ...payload.frame?.length ? { frame: payload.frame } : {},
-      ...payload.to ? { to: payload.to } : {},
-      ...payload.locator ? { locator: payload.locator } : {},
-      ...payload.values ? { values: payload.values } : {},
-      ...payload.warning ? { warning: payload.warning } : {},
-      ...payload.pageId ? { pageId: payload.pageId } : {},
-      ...payload.scroll ? { scroll: payload.scroll } : {},
-      value: payload.value ?? "",
-      secret: Boolean(payload.secret),
-      legacySelector: payload.legacySelector ?? "",
-      proposals: []
-    };
-    RecordedStepSchema.parse(step);
-    targetIds.set(step.id, payload.__targetId);
-    if (pendingScrollPos) {
-      step.scroll = pendingScrollPos;
-      pendingScrollPos = null;
-    }
-    steps.push(step);
-    onStep?.(step);
-    paint();
-    if (COMMITS.has(step.type)) begin(step, before);
-  };
-  const PRESS_GRACE_MS = 200;
-  let held = null;
-  const releaseHeld = () => {
-    if (!held) return;
-    const { payload, before, timer } = held;
-    clearTimeout(timer);
-    held = null;
-    record(payload, before);
-  };
-  await context.exposeBinding("__flRecord", async (src, payload) => {
-    if (paused || !payload || stopped && payload.__sig === void 0) return;
-    if (src.frame && !frameChains.has(src.frame)) await noteFrame(src.frame);
-    if (src.page) payload.pageId = pageIds.get(src.page) ?? "main";
-    if (payload && payload.__sig !== void 0) {
-      if (!pending || pending.step.pageId === payload.pageId) consider(payload.__sig || null);
-      return;
-    }
-    const before = payload.__before ?? signature;
-    delete payload.__before;
-    const chain = src?.frame ? frameChains.get(src.frame) : void 0;
-    if (chain?.length) payload.frame = chain;
-    if (payload.type === "press" && payload.value === "Enter") {
-      releaseHeld();
-      const timer = setTimeout(releaseHeld, PRESS_GRACE_MS);
-      timer.unref?.();
-      held = { payload, before, timer };
-      return;
-    }
-    if (payload.type === "click" && held) {
-      clearTimeout(held.timer);
-      held = null;
-    } else if (held && payload.name !== held.payload.name) {
-      releaseHeld();
-    }
-    record(payload, before);
-  });
-  await context.exposeBinding("__flPicked", async (src, payload) => {
-    if (src.frame && !frameChains.has(src.frame)) await noteFrame(src.frame);
-    if (payload?.cancelled) {
-      void session.setPicking(false);
-      void toPanel({ picked: null });
-      return;
-    }
-    if (!payload?.target) return;
-    const chain = src?.frame ? frameChains.get(src.frame) : void 0;
-    if (chain?.length) payload.target.frame = chain;
-    if (src.page) payload.target.pageId = pageIds.get(src.page) ?? "main";
-    try {
-      const on = src.page ?? page;
-      const all = await locateAll(on, {
-        id: "pick",
-        type: "click",
-        value: "",
-        secret: false,
-        legacySelector: "",
-        proposals: [],
-        scope: "",
-        ...payload.target
-      });
-      const handles = await all.elementHandles();
-      if (handles.length > 1) {
-        for (const [i, handle] of handles.entries()) {
-          const isIt = await handle.evaluate((el) => el === window.__flPickedEl).catch(() => false);
-          if (isIt) {
-            payload.target.nth = i;
-            break;
-          }
-        }
-        if (payload.target.nth === void 0) {
-          payload.ambiguous = handles.length;
-        }
-      } else if (handles.length === 0) {
-        payload.unresolvable = true;
-      }
-      await Promise.all(handles.map((h) => h.dispose().catch(() => {
-      })));
-    } catch {
-    }
-    void session.setPicking(false);
-    void toPanel({ picked: payload });
-  });
-  await context.exposeBinding("__flStop", () => {
-    onStopRequested?.(true);
-  });
-  await context.exposeBinding("__flCmd", (_src, msg) => {
-    if (!msg || typeof msg.command !== "string") return;
-    if (msg.command === "end") onStopRequested?.(msg.commit !== false);
-    else if (msg.command === "deleteStep") void session.deleteStep(String(msg.stepId));
-    else if (msg.command === "pick") void session.setPicking(msg.on !== false);
-    else if (msg.command === "assert") {
-      void session.setPicking(false);
-      try {
-        session.addAssertion(msg.assertion);
-      } catch (err) {
-        void toPanel({ pickError: firstLine(err) });
-      }
-    } else if (msg.command === "record") void session.setPaused(!msg.on);
-  });
-  const INIT_SCRIPT = `${accNameScript()}
-;window.__flChecks=${JSON.stringify(CHECKS)};
-;(${installRecorder.toString()})();
-;(${installDebugPanel.toString()})();`;
-  await context.addInitScript({ content: INIT_SCRIPT });
-  const ensureInstalled = async (p) => {
-    try {
-      await p.evaluate((src) => {
-        if (document.__flInstalled) return;
-        (0, eval)(src);
-      }, INIT_SCRIPT);
-    } catch {
-    }
-  };
-  const page = await context.newPage();
-  pageIds.set(page, "main");
-  const watchPage = (p) => {
-    watchFrames(p);
-    void ensureInstalled(p);
-    p.on("domcontentloaded", () => void ensureInstalled(p));
-    p.on("download", (download) => {
-      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(p));
-      if (step) {
-        (step.downloads ??= []).push(download.suggestedFilename());
-        onStep?.(step);
-        paint();
-      }
-    });
-    p.on("dialog", (dialog) => {
-      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(p));
-      if (!step) {
-        void dialog.dismiss();
-        record({ type: "unsupported", name: "Dialog before first action", warning: "Record an explicit navigation before a page-load dialog", pageId: pageIds.get(p) }, null);
-        return;
-      }
-      pendingDialog = { dialog, step };
-      onState?.(snapshot());
-    });
-    p.on("close", () => {
-      if (!stopped && p !== page) record({ type: "closePage", pageId: pageIds.get(p) }, null);
-    });
-  };
-  watchPage(page);
-  context.on("page", (p) => {
-    const id = `page_${++nextPageId}`;
-    pageIds.set(p, id);
-    watchPage(p);
-    void p.opener().then((opener) => {
-      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(opener));
-      if (step) {
-        step.opensPage = id;
-        onStep?.(step);
-        paint();
-      } else record({ type: "unsupported", name: "Unlinked browser tab", warning: "Open this tab through a recorded link or button", pageId: id }, null);
-    });
-  });
-  try {
-    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 45e3 });
-  } catch (err) {
-    stopped = true;
-    await browser.close().catch(() => {
-    });
-    throw new Error(`could not open ${url} \u2014 ${firstLine(err)}`);
-  }
-  const session = {
-    environment: config,
-    page,
-    startUrl: url,
-    state: snapshot,
-    deleteStep(id) {
-      const i = steps.findIndex((x) => x.id === id);
-      if (i !== -1) steps.splice(i, 1);
-      paint();
-      return snapshot();
-    },
-    async setPicking(on) {
-      const call = (fn, arg) => Promise.all(
-        context.pages().flatMap(
-          (p) => p.frames().map(
-            (f) => f.evaluate(
-              ([name, value]) => window[name]?.(value),
-              [fn, arg]
-            ).catch(() => {
-            })
-          )
-        )
-      );
-      if (on) await call("__flSetMuted", true);
-      await call("__flSetPicking", on);
-      if (!on && !paused) await call("__flSetMuted", false);
-    },
-    addAssertion(assertion) {
-      const parsed = RecordedAssertionSchema.parse({ enabled: true, ...assertion });
-      const step = {
-        id: `st_${crypto.randomUUID().slice(0, 8)}`,
-        type: "assert",
-        // Mirrored from the target so a step list can name what is being
-        // checked without reaching inside the assertion to find out.
-        role: parsed.target?.role ?? "",
-        name: parsed.target?.name ?? "",
-        ...parsed.target?.nameFrom ? { nameFrom: parsed.target.nameFrom } : {},
-        scope: parsed.target?.scope ?? "",
-        ...parsed.target?.scopeRole ? { scopeRole: parsed.target.scopeRole } : {},
-        ...parsed.target?.frame?.length ? { frame: parsed.target.frame } : {},
-        ...parsed.target?.locator ? { locator: parsed.target.locator } : {},
-        ...parsed.target?.pageId ? { pageId: parsed.target.pageId } : {},
-        value: "",
-        secret: false,
-        legacySelector: "",
-        proposals: [parsed]
-      };
-      if ((parsed.kind === "text" || parsed.kind === "class" || parsed.kind === "attribute") && parsed.target?.nameFrom === "text" && !parsed.target.locator) {
-        step.warning = "This element is identified by its own text, so a change to that text reads as a missing element rather than a failed check. Give it a test ID or a locator to tell the two apart.";
-      }
-      RecordedStepSchema.parse(step);
-      if (pendingScrollPos) {
-        step.scroll = pendingScrollPos;
-        pendingScrollPos = null;
-      }
-      steps.push(step);
-      onStep?.(step);
-      paint();
-      return snapshot();
-    },
-    async setPaused(next) {
-      paused = next;
-      await Promise.all(
-        context.pages().map(
-          (p) => p.evaluate(
-            (v) => window.__flSetMuted?.(v),
-            next
-          ).catch(() => {
-          })
-        )
-      );
-      paint();
-      return snapshot();
-    },
-    async answerDialog(accept, promptText) {
-      if (!pendingDialog) throw new Error("No browser dialog is waiting");
-      const { dialog, step } = pendingDialog;
-      const answer = { type: dialog.type(), message: dialog.message(), accept, ...promptText !== void 0 ? { promptText } : {} };
-      if (accept) await dialog.accept(promptText);
-      else await dialog.dismiss();
-      (step.dialogs ??= []).push(answer);
-      pendingDialog = null;
-      onStep?.(step);
-      paint();
-    },
-    async stop() {
-      if (pendingDialog) throw new Error("Answer the browser dialog before saving the recording");
-      if (stopped) return steps;
-      await Promise.all(context.pages().flatMap((p) => p.frames().map((f) => f.evaluate(() => window.__flFlush?.()).catch(() => {
-      }))));
-      stopped = true;
-      releaseHeld();
-      if (pending) await sleep(OUTCOME_WINDOW_MS + 300);
-      finish(signature);
-      await browser.close().catch(() => {
-      });
-      return steps;
-    }
-  };
-  page.on("domcontentloaded", () => paint());
-  context.on("page", (p) => p.on("domcontentloaded", () => paint()));
-  paint();
-  return session;
-}
-function firstLine(err) {
-  return String(err?.message ?? err).split("\n")[0].trim();
-}
-var PASSWORD_FIELDS = 'input[type="password"]';
-async function captureFailure(opts) {
-  const { page, dir, ordinal } = opts;
-  let url = "";
-  let title = "";
-  try {
-    url = page.url();
-    title = await page.title();
-  } catch {
-  }
-  let screenshot = null;
-  try {
-    const file = `step-${String(ordinal).padStart(2, "0")}.png`;
-    fs22.mkdirSync(dir, { recursive: true });
-    await page.screenshot({
-      path: path22.join(dir, file),
-      // The viewport, not the full page: a failure is about what was on screen,
-      // and a full-page capture of an infinite-scroll app is a 20MB image.
-      fullPage: false,
-      mask: masks(opts),
-      // Playwright's default is magenta, which reads as a rendering fault
-      // rather than as a deliberate redaction. A flat slate box is obviously
-      // something someone chose to cover up.
-      maskColor: "#475569",
-      timeout: 5e3
-    });
-    screenshot = file;
-  } catch {
-    screenshot = null;
-  }
-  return { screenshot, url, title };
-}
-function maskTargets(steps = []) {
-  const frames = /* @__PURE__ */ new Set([JSON.stringify([])]);
-  for (const step of steps) {
-    if (step.frame?.length) frames.add(JSON.stringify(step.frame));
-  }
-  const targets = [...frames].map((chain) => {
-    const frame = JSON.parse(chain);
-    return frame.length ? { by: "selector", value: PASSWORD_FIELDS, frame } : { by: "selector", value: PASSWORD_FIELDS };
-  });
-  const seen = /* @__PURE__ */ new Set();
-  for (const step of steps) {
-    const name = step.name.trim();
-    if (!step.secret || !name) continue;
-    const key = `${JSON.stringify(step.frame ?? [])}|${name}`;
-    if (seen.has(key)) continue;
-    seen.add(key);
-    targets.push(step.frame?.length ? { by: "label", value: name, frame: step.frame } : { by: "label", value: name });
-  }
-  return targets;
-}
-function masks(opts) {
-  const { page } = opts;
-  return maskTargets(opts.steps).map((t) => {
-    let root = page;
-    for (const frame of t.frame ?? []) root = root.frameLocator(frameSelector(frame));
-    return t.by === "selector" ? root.locator(t.value) : root.getByLabel(t.value, { exact: true });
-  });
-}
-async function finaliseArtifacts(opts) {
-  const { context, dir, passed, artifacts, consoleLines } = opts;
-  const keep = (mode) => mode === "always" || mode === "on-failure" && !passed;
-  const out = [];
-  const size = (file) => {
-    try {
-      return fs22.statSync(path22.join(dir, file)).size;
-    } catch {
-      return null;
-    }
-  };
-  if (artifacts.trace !== "off") {
-    const file = "trace.zip";
-    try {
-      if (keep(artifacts.trace)) {
-        fs22.mkdirSync(dir, { recursive: true });
-        await context.tracing.stop({ path: path22.join(dir, file) });
-        out.push({ kind: "trace", relPath: file, bytes: size(file) });
-      } else {
-        await context.tracing.stop();
-      }
-    } catch {
-    }
-  }
-  if (artifacts.console && consoleLines.length) {
-    const file = "console.log";
-    try {
-      fs22.mkdirSync(dir, { recursive: true });
-      fs22.writeFileSync(path22.join(dir, file), consoleLines.join("\n") + "\n");
-      out.push({ kind: "console", relPath: file, bytes: size(file) });
-    } catch {
-    }
-  }
-  return out;
-}
-function collectVideos(dir, keep) {
-  let files;
-  try {
-    files = fs22.readdirSync(dir).filter((f) => f.endsWith(".webm"));
-  } catch {
-    return [];
-  }
-  if (!keep) {
-    for (const f of files) fs22.rmSync(path22.join(dir, f), { force: true });
-    return [];
-  }
-  return files.map((f) => {
-    let bytes = null;
-    try {
-      bytes = fs22.statSync(path22.join(dir, f)).size;
-    } catch {
-      bytes = null;
-    }
-    return { kind: "video", relPath: f, bytes };
-  });
-}
-var STATES = {
-  visible: "visible",
-  hidden: "visible",
-  attached: "attached",
-  enabled: "enabled",
-  editable: "editable",
-  focused: "focused",
-  checked: "checked"
-};
-var TEXT_KINDS = /* @__PURE__ */ new Set(["text", "message", "screen", "heading"]);
-var PAGE_KINDS = /* @__PURE__ */ new Set(["url", "title"]);
-function absenceSatisfies(state, want) {
-  return !want && (state === "attached" || state === "visible");
-}
-function firstLine2(err) {
-  return String(err instanceof Error ? err.message : err).split("\n")[0].trim();
-}
-function ambiguityDetail(count) {
-  return `resolves to ${count} elements \u2014 nothing on the page tells them apart`;
-}
-async function presenceOf(target) {
-  let count;
-  try {
-    count = await target.count();
-  } catch (err) {
-    return { outcome: "invalid", detail: firstLine2(err) };
-  }
-  if (count === 0) return { outcome: "absent" };
-  if (count > 1) return { outcome: "ambiguous", count };
-  return { outcome: "present", locator: target };
-}
-async function readState(target, state, timeout) {
-  if (state === "visible") return target.isVisible();
-  if (state === "attached") return await target.count() > 0;
-  if (state === "enabled") return target.isEnabled({ timeout });
-  if (state === "editable") return target.isEditable({ timeout });
-  if (state === "checked") return target.isChecked({ timeout });
-  return target.evaluate((el) => el === el.ownerDocument.activeElement);
-}
-function compare(actual, expected, op) {
-  switch (op) {
-    case "contains":
-      return actual.includes(expected);
-    case "matches":
-      return new RegExp(expected).test(actual);
-    case "gt":
-      return Number(actual) > Number(expected);
-    case "gte":
-      return Number(actual) >= Number(expected);
-    case "lt":
-      return Number(actual) < Number(expected);
-    case "lte":
-      return Number(actual) <= Number(expected);
-    default:
-      return actual === expected;
-  }
-}
-var OP_WORDS = {
-  equals: ["is", "is not"],
-  contains: ["contains", "does not contain"],
-  matches: ["matches", "does not match"],
-  gt: ["is more than", "is not more than"],
-  gte: ["is at least", "is less than"],
-  lt: ["is fewer than", "is not fewer than"],
-  lte: ["is at most", "is more than"]
-};
-var DEFAULT_OPS = { message: "contains" };
-function explain(r) {
-  switch (r.outcome) {
-    case "absent":
-      return { detail: "no element matched", kind: "not_found" };
-    case "ambiguous":
-      return { detail: ambiguityDetail(r.count), kind: "ambiguous" };
-    case "invalid":
-      return { detail: `the locator could not be used \u2014 ${r.detail}`, kind: "unknown" };
-    case "unreadable":
-      return { detail: `the element could not be read \u2014 ${r.detail}`, kind: "unknown" };
-    case "not_visible":
-      return { detail: "the element is present but not visible", kind: null };
-    default:
-      return { detail: "", kind: null };
-  }
-}
-function fail(message, r) {
-  const { detail, kind } = explain(r);
-  throw Object.assign(new Error(detail ? `${message} \u2014 ${detail}` : message), kind ? { kind } : {});
-}
-async function checkAssertion(page, kind, value, timeoutMs = 3e3, assertion) {
-  const deadline = Date.now() + timeoutMs;
-  const remaining = () => Math.max(1, deadline - Date.now());
-  const op = assertion?.op ?? DEFAULT_OPS[kind] ?? "equals";
-  const negated = assertion?.not === true;
-  const expected = String(value);
-  const asStep = (t) => ({
-    id: "assertion",
-    type: "click",
-    value: "",
-    secret: false,
-    legacySelector: "",
-    proposals: [],
-    scope: "",
-    ...t
-  });
-  const NEEDS_TARGET = /* @__PURE__ */ new Set(["count", "attribute", "class", "value", "text", ...Object.keys(STATES)]);
-  if (NEEDS_TARGET.has(kind) && !assertion?.target) throw new Error(`${kind} assertion needs an element target`);
-  if (negated && !assertion?.target && (TEXT_KINDS.has(kind) || kind === "fields_visible")) {
-    throw new Error(
-      `a negated ${kind} assertion needs an element target \u2014 choose the element in the editor, or use a "hidden" check to assert that something has gone`
-    );
-  }
-  const aboutAbsence = kind === "attached" || kind === "hidden" || kind === "visible" && negated;
-  const target = assertion?.target && kind !== "count" ? await locate(page, asStep(assertion.target), { includeHidden: aboutAbsence }) : void 0;
-  if (kind === "fields_visible") {
-    for (const name of Array.isArray(value) ? value : [value]) {
-      await page.getByLabel(name, { exact: true }).or(page.getByRole("textbox", { name, exact: true })).waitFor({ state: "visible", timeout: remaining() });
+  const aboutAbsence = kind === "attached" || kind === "hidden" || kind === "visible" && negated;
+  const target = assertion?.target && kind !== "count" ? await locate(page, asStep(assertion.target), { includeHidden: aboutAbsence }) : void 0;
+  if (kind === "fields_visible") {
+    for (const name of Array.isArray(value) ? value : [value]) {
+      await page.getByLabel(name, { exact: true }).or(page.getByRole("textbox", { name, exact: true })).waitFor({ state: "visible", timeout: remaining() });
     }
     return `fields visible: ${Array.isArray(value) ? value.join(", ") : value}`;
   }
@@ -3574,7 +3630,7 @@ async function checkAssertion(page, kind, value, timeoutMs = 3e3, assertion) {
           last2 = { outcome: "state", value: actual };
         } catch (err) {
           if (err instanceof Error && err.name === "TimeoutError" && Date.now() >= deadline && last2.outcome === "state") break;
-          last2 = { outcome: "unreadable", detail: firstLine2(err) };
+          last2 = { outcome: "unreadable", detail: firstLine(err) };
         }
       } else {
         last2 = p;
@@ -3612,7 +3668,7 @@ async function checkAssertion(page, kind, value, timeoutMs = 3e3, assertion) {
         const n2 = await (await locateAll(page, asStep(assertion.target), { allowRoleOnly: true })).count();
         reading = { outcome: "value", value: String(n2) };
       } catch (err) {
-        reading = { outcome: "invalid", detail: firstLine2(err) };
+        reading = { outcome: "invalid", detail: firstLine(err) };
       }
     } else {
       const p = await presenceOf(targetFor());
@@ -3626,7 +3682,7 @@ async function checkAssertion(page, kind, value, timeoutMs = 3e3, assertion) {
         } catch (err) {
           if (/Unsupported assertion/.test(String(err))) throw err;
           if (err instanceof Error && err.name === "TimeoutError" && Date.now() >= deadline && last.outcome === "value") break;
-          reading = { outcome: "unreadable", detail: firstLine2(err) };
+          reading = { outcome: "unreadable", detail: firstLine(err) };
         }
       }
     }
@@ -3711,12 +3767,19 @@ async function applyAction(loc, step, value, ctx = {}) {
 }
 var NAVIGATIONS2 = /* @__PURE__ */ new Set(["back", "forward"]);
 async function openRunSession(opts) {
-  const { steps, headless = true, slowMo = 0, resolveSecret, evidenceDir } = opts;
+  const { headless = true, slowMo = 0, resolveSecret, evidenceDir } = opts;
+  const steps = [...opts.steps, ...opts.steps.flatMap((step) => {
+    if (!step.auth) return [];
+    const resolved = opts.resolveAuth?.(step.auth);
+    return [...resolved?.steps ?? [], ...resolved?.signOut?.steps ?? []];
+  })];
   const { browser, context, config, artifacts } = await launchSession(
     opts.environment,
     headless,
     slowMo,
-    { policy: opts.artifacts, dir: evidenceDir, hasSecrets: steps.some((s2) => s2.secret) }
+    { policy: opts.artifacts, dir: evidenceDir, hasSecrets: steps.some((s2) => s2.secret) },
+    opts.browser,
+    opts.storageState
   );
   const page = await context.newPage();
   const pages = new ExecutionPages(context, page);
@@ -3730,44 +3793,240 @@ async function openRunSession(opts) {
     watch(page);
     context.on("page", watch);
   }
-  return { browser, context, page, pages, config, artifacts, consoleLines, runArtifacts: [] };
+  return { ownsBrowser: !opts.browser, browser, context, page, pages, config, artifacts, consoleLines, runArtifacts: [] };
 }
 async function closeRunSession(session, { evidenceDir, passed }) {
   const { context, browser, artifacts, consoleLines, runArtifacts } = session;
   if (evidenceDir) {
-    runArtifacts.push(
-      ...await finaliseArtifacts({
-        context,
-        dir: evidenceDir,
-        passed,
-        artifacts: { video: artifacts.video, trace: artifacts.trace, console: artifacts.console },
-        consoleLines
-      })
-    );
+    try {
+      runArtifacts.push(
+        ...await finaliseArtifacts({
+          context,
+          dir: evidenceDir,
+          passed,
+          artifacts: { video: artifacts.video, trace: artifacts.trace, console: artifacts.console },
+          consoleLines
+        })
+      );
+    } catch {
+    }
+  }
+  await context.close().catch(() => {
+  });
+  if (evidenceDir && artifacts.video !== "off") {
+    runArtifacts.push(...collectVideos(evidenceDir, artifacts.video === "always" || !passed));
+  }
+  if (session.ownsBrowser !== false) await browser.close().catch(() => {
+  });
+  return runArtifacts.filter((artifact, at) => runArtifacts.findIndex((other) => other.relPath === artifact.relPath) === at);
+}
+async function performSignIn(session, step, opts) {
+  const reference = step.auth;
+  if (!reference) {
+    return { ok: false, label: "Sign in", detail: "this step does not say which sign-in to use", kind: "unknown", checks: [] };
+  }
+  const resolved = opts.resolveAuth?.(reference);
+  const auth = step.type === "signOut" && resolved?.signOut ? { ...resolved, ...resolved.signOut, navigation: { kind: "continue" } } : step.type === "signOut" ? void 0 : resolved;
+  if (!auth) {
+    return {
+      ok: false,
+      label: "Sign in",
+      detail: "this run was delivered without the sign-in it needs \u2014 open it again so its procedure and account are resolved",
+      kind: "unknown",
+      checks: []
+    };
+  }
+  const label = step.type === "signOut" ? `Sign out ${auth.accountName}` : `Sign in as ${auth.accountName}`;
+  if (step.pageId && step.pageId !== "main") {
+    return {
+      ok: false,
+      label,
+      kind: "unknown",
+      checks: [],
+      detail: `a sign-in cannot be aimed at another browser tab \u2014 move this step to the main tab, or record the popup inside "${auth.name}"`
+    };
+  }
+  if ((opts.authDepth ?? 0) > 0) {
+    return { ok: false, label, detail: `"${auth.name}" signs in from inside its own sign-in`, kind: "unknown", checks: [] };
+  }
+  if (!hasSuccessCheck(auth)) {
+    return { ok: false, label, detail: UNCHECKED_AUTH, kind: "assertion", checks: [] };
+  }
+  const inner = await runStepsIn(session, auth.steps, {
+    ...opts,
+    stepOffset: 0,
+    // The procedure's own steps are not the test's steps. Reporting each one
+    // would bury the test being run under a login form nobody wrote.
+    ...opts.onStepResult ? { onStepResult: () => void 0 } : {},
+    // WHERE THIS STEP WANTS TO BEGIN, over where the procedure normally does.
+    // Same login, two honest uses: taken to the login page when signing in is
+    // the first thing that happens, and performed from wherever the browser
+    // already got to when a guest fills a basket and signs in at checkout.
+    startUrl: authStartUrl(
+      step.auth?.from === "here" ? { ...auth, navigation: { kind: "continue" } } : auth,
+      session.pages.pageFor(step),
+      opts.baseUrl ?? ""
+    ),
+    authDepth: (opts.authDepth ?? 0) + 1
+  });
+  if (inner.status !== "passed") {
+    const failed = inner.results.find((r) => r.status === "failed");
+    return {
+      ok: false,
+      label,
+      detail: describeAuthFailure(auth, { ...failed ? { step: failed.name } : {}, detail: failed?.detail ?? inner.error }),
+      kind: failed?.failureKind ?? "unknown",
+      checks: []
+    };
   }
-  await context.close().catch(() => {
+  const proof = await runStepsIn(session, [checkStep(step.id, auth.success)], {
+    ...opts,
+    ...opts.onStepResult ? { onStepResult: () => void 0 } : {},
+    startUrl: null,
+    authDepth: (opts.authDepth ?? 0) + 1
   });
-  if (evidenceDir && artifacts.video !== "off") {
-    runArtifacts.push(...collectVideos(evidenceDir, artifacts.video === "always" || !passed));
+  const checked = proof.results[0];
+  if (proof.status !== "passed") {
+    return {
+      ok: false,
+      label,
+      detail: describeAuthFailure(auth, { detail: checked?.detail ?? "the signed-in check did not pass" }),
+      kind: "assertion",
+      checks: checked?.checks ?? []
+    };
   }
-  await browser.close().catch(() => {
-  });
-  return runArtifacts;
+  return { ok: true, label, detail: null, kind: null, checks: checked?.checks ?? [] };
+}
+async function confirmSignedIn(page, auth, timeoutMs) {
+  for (const check of auth.success) {
+    if (check.enabled === false) continue;
+    try {
+      await checkAssertion(page, check.kind, check.value, timeoutMs, check);
+    } catch (err) {
+      return { ok: false, detail: firstLine2(err) };
+    }
+  }
+  return { ok: true, detail: null };
+}
+var checkStep = (id, proposals) => ({
+  id: `${id}__signed-in`,
+  type: "assert",
+  role: "",
+  name: "Signed in",
+  scope: "",
+  value: "",
+  secret: false,
+  legacySelector: "",
+  proposals
+});
+function stepFailure(step, detail) {
+  return {
+    stepId: step.id,
+    name: step.name,
+    type: step.type,
+    value: null,
+    secret: step.secret,
+    status: "failed",
+    detail,
+    failureKind: "unknown",
+    durationMs: 0,
+    checks: []
+  };
 }
 async function runStepsIn(session, steps, opts) {
-  const { page, pages, config, artifacts } = session;
+  let { page, pages, config, artifacts } = session;
   const { resolveSecret, resolveFile, onStepResult, evidenceDir } = opts;
   const results = [];
   let status2 = "passed";
   let error = null;
   try {
     if (opts.startUrl) await page.goto(opts.startUrl, { waitUntil: "domcontentloaded" });
-    for (const step of steps) {
+    for (const recorded of steps) {
+      let step = recorded;
+      if (!recorded.disabled) {
+        try {
+          step = withRuntimeValues(recorded, opts.actors?.values ?? /* @__PURE__ */ new Map());
+        } catch (err) {
+          const result2 = stepFailure(recorded, firstLine2(err));
+          results.push(result2);
+          onStepResult?.(result2);
+          status2 = "failed";
+          error = `${recorded.type} "${recorded.name}": ${result2.detail}`;
+          break;
+        }
+      }
+      if ((opts.authDepth ?? 0) > 0 && !step.disabled && (step.type === "useActor" || step.type === "resetActor" || step.type === "capture")) {
+        const result2 = stepFailure(step, `a shared sign-in cannot ${step.type === "capture" ? "capture an output" : "change participants"}`);
+        results.push(result2);
+        onStepResult?.(result2);
+        status2 = "failed";
+        error = result2.detail;
+        break;
+      }
+      if (opts.actors) {
+        if (step.type === "useActor" && !step.disabled) {
+          const began = Date.now();
+          const result2 = {
+            stepId: step.id,
+            name: `Continue as ${opts.actors.nameOf(step.actorId)}`,
+            type: step.type,
+            value: null,
+            secret: false,
+            status: "passed",
+            detail: null,
+            failureKind: null,
+            durationMs: 0,
+            checks: []
+          };
+          try {
+            await opts.actors.select(step.actorId ?? "");
+          } catch (err) {
+            result2.status = "failed";
+            result2.failureKind = "unknown";
+            result2.detail = firstLine2(err);
+          }
+          result2.durationMs = Date.now() - began;
+          results.push(result2);
+          onStepResult?.(result2);
+          if (result2.status === "failed") {
+            status2 = "failed";
+            error = `${result2.name}: ${result2.detail}`;
+            break;
+          }
+          continue;
+        }
+        session = opts.actors.current;
+        ({ page, pages, config, artifacts } = session);
+      }
       if (opts.signal?.aborted) {
         status2 = "errored";
         error = "the run was cancelled";
         break;
       }
+      if ((step.type === "signIn" || step.type === "signOut") && !step.disabled) {
+        const started = Date.now();
+        const outcome = await performSignIn(session, step, opts);
+        const result2 = {
+          stepId: step.id,
+          name: outcome.label,
+          type: step.type,
+          value: null,
+          secret: false,
+          status: outcome.ok ? "passed" : "failed",
+          detail: outcome.detail,
+          failureKind: outcome.ok ? null : outcome.kind,
+          durationMs: Date.now() - started,
+          checks: outcome.checks
+        };
+        results.push(result2);
+        onStepResult?.(result2);
+        if (!outcome.ok) {
+          status2 = "failed";
+          error = outcome.detail;
+          break;
+        }
+        continue;
+      }
       if (step.disabled) {
         const skipped = {
           stepId: step.id,
@@ -3807,6 +4066,9 @@ async function runStepsIn(session, steps, opts) {
           pages,
           resolveSecret,
           resolveFile,
+          valuesResolved: true,
+          baseUrl: opts.baseUrl,
+          ...opts.actors ? { actors: opts.actors } : {},
           timeoutMs: config.timeoutMs,
           navigationTimeoutMs: config.navigationTimeoutMs
         });
@@ -3826,7 +4088,7 @@ async function runStepsIn(session, steps, opts) {
           } catch (err) {
             const kind = err.kind ?? null;
             if (kind && !soft) checkFailureKind = kind;
-            result.checks.push({ kind: a.kind, expected: label, ok: false, soft, detail: firstLine(err) });
+            result.checks.push({ kind: a.kind, expected: label, ok: false, soft, detail: firstLine2(err) });
           }
         }
         const hardFailure = result.checks.find((c) => !c.ok && !c.soft);
@@ -3838,7 +4100,7 @@ async function runStepsIn(session, steps, opts) {
       } catch (err) {
         result.status = "failed";
         result.failureKind = err.kind ?? (/strict mode violation/.test(String(err)) ? "ambiguous" : err instanceof errors.TimeoutError ? "timeout" : "unknown");
-        result.detail = firstLine(err);
+        result.detail = firstLine2(err);
       }
       const wantsShot = artifacts.screenshot === "always" || artifacts.screenshot === "on-failure" && result.status === "failed";
       if (wantsShot && evidenceDir) {
@@ -3864,262 +4126,853 @@ async function runStepsIn(session, steps, opts) {
         break;
       }
     }
-  } catch (err) {
+  } catch (err) {
+    status2 = "errored";
+    error = firstLine2(err);
+  }
+  return { results, status: status2, error };
+}
+async function replayFlow(opts) {
+  const { steps, baseUrl, startPath } = opts;
+  validateActors(opts.actors, opts.defaultActorId, actorIdsUsed(steps));
+  const started = Date.now();
+  const hydrated = keptSessionFor(
+    { ...opts, baseUrl },
+    opts.actors?.find((a) => a.id === (opts.defaultActorId ?? "default"))?.startSignedIn
+  );
+  const session = await openRunSession({
+    steps: [...steps, ...actorPreparations(opts.actors)],
+    ...hydrated?.state ? { storageState: hydrated.state } : {},
+    ...opts.resolveAuth ? { resolveAuth: opts.resolveAuth } : {},
+    ...opts.environment === void 0 ? {} : { environment: opts.environment },
+    ...opts.headless === void 0 ? {} : { headless: opts.headless },
+    ...opts.slowMo === void 0 ? {} : { slowMo: opts.slowMo },
+    ...opts.artifacts === void 0 ? {} : { artifacts: opts.artifacts },
+    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret }
+  });
+  const actors = new RunActors(session, {
+    ...opts,
+    steps: [...steps, ...actorPreparations(opts.actors)],
+    startUrl: resolveStartUrl(baseUrl, startPath),
+    hydrated: hydrated ? { ...hydrated, id: opts.defaultActorId ?? "default" } : null
+  });
+  let prepared = null;
+  try {
+    await actors.select(opts.defaultActorId ?? "default");
+  } catch (e) {
+    prepared = e.message;
+  }
+  const { results, status: status2, error } = prepared ? { results: [], status: "failed", error: prepared } : await runStepsIn(actors.current, steps, {
+    actors,
+    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret },
+    ...opts.resolveFile === void 0 ? {} : { resolveFile: opts.resolveFile },
+    ...opts.onStepResult === void 0 ? {} : { onStepResult: opts.onStepResult },
+    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+    ...opts.signal === void 0 ? {} : { signal: opts.signal },
+    ...opts.resolveAuth === void 0 ? {} : { resolveAuth: opts.resolveAuth },
+    baseUrl,
+    startUrl: null
+  });
+  await actors.closeExtras(status2 === "passed");
+  const runArtifacts = await closeRunSession(session, {
+    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+    passed: status2 === "passed"
+  });
+  return {
+    status: status2,
+    error,
+    artifacts: runArtifacts,
+    durationMs: Date.now() - started,
+    // Steps that actually ran. A step turned off in the editor is in
+    // `results` so the report can say so, but counting it as run would make a
+    // flow look busier than it was.
+    stepsRun: results.filter((r) => r.status !== "skipped").length,
+    stepsTotal: steps.length,
+    steps: results
+  };
+}
+async function executeStep(main, input, options = {}) {
+  const parsed = RecordedStepSchema.parse(input);
+  const step = options.valuesResolved ? parsed : withRuntimeValues(parsed, options.actors?.values ?? /* @__PURE__ */ new Map());
+  if (options.actors) {
+    if (step.type === "resetActor") {
+      await options.actors.freshGuest(step.actorId ?? options.actors.currentId);
+      return options.actors.current.page;
+    }
+    if (step.type === "useActor") {
+      await options.actors.select(step.actorId ?? "");
+      return options.actors.current.page;
+    }
+    main = options.actors.current.page;
+    options = { ...options, pages: options.actors.current.pages };
+  }
+  const page = options.pages?.pageFor(step) ?? main;
+  if (step.type === "signIn" || step.type === "signOut") {
+    const context = main.context();
+    const outcome = await performSignIn({
+      browser: context.browser(),
+      context,
+      page: main,
+      pages: options.pages ?? new ExecutionPages(context, main),
+      config: { ...DEFAULT_ENVIRONMENT, timeoutMs: options.timeoutMs ?? 8e3 },
+      artifacts: resolveCapture({}),
+      consoleLines: [],
+      runArtifacts: []
+    }, step, { ...options, startUrl: null });
+    if (!outcome.ok) throw new Error(outcome.detail ?? "Authentication failed");
+    return main;
+  }
+  if (step.type === "capture") {
+    if (!step.capture || !options.actors) throw new Error("Configure the runtime output name and source");
+    if (step.secret) throw new Error("Secret fields cannot be captured as shared outputs");
+    let value;
+    if (step.capture.source === "url") value = page.url();
+    else {
+      const target = await locate(page, step);
+      if (await target.getAttribute("type") === "password") throw new Error("Password fields cannot be captured as shared outputs");
+      value = step.capture.source === "value" ? await target.inputValue() : await target.innerText();
+    }
+    if (value.length > 16384) throw new Error("Captured output exceeds 16 KB");
+    options.actors.values.set(step.capture.name, value);
+    return page;
+  }
+  const deadline = Date.now() + (step.timeoutMs ?? options.timeoutMs ?? 8e3);
+  const remaining = () => Math.max(1, deadline - Date.now());
+  const navigationBudget = () => step.navigationTimeoutMs ?? options.navigationTimeoutMs ?? 45e3;
+  page.setDefaultTimeout(remaining());
+  const act = async () => {
+    if (step.type === "unsupported") throw new Error(step.warning || step.value || "This interaction requires a supported action before replay");
+    if (step.type === "assert") {
+      if (step.scroll) await applyScroll(page, step, Math.min(2e3, remaining()));
+      return;
+    }
+    if (step.type === "navigate") {
+      await page.goto(new URL(step.value, step.navigationBase === "application" ? options.baseUrl ?? page.url() : page.url()).href, { waitUntil: "domcontentloaded", timeout: navigationBudget() });
+      return;
+    }
+    if (step.type === "closePage") {
+      await page.close();
+      return;
+    }
+    if (step.type === "back" || step.type === "forward") {
+      await navigateHistory(page, step.type, navigationBudget());
+      return;
+    }
+    if (step.type === "scroll" && step.scroll) {
+      await applyScroll(page, step, remaining());
+      return;
+    }
+    const ref = step.secretRef || step.value;
+    const value = step.secret ? ref ? options.resolveSecret?.(ref) : void 0 : step.value;
+    if (step.secret && value === void 0) {
+      throw Object.assign(
+        new Error(
+          ref ? `the secret "${ref}" is not set on this machine \u2014 add it under Settings \u203A Secrets, or in .flowriki/secrets.local.json, then run again` : `this step needs a secret that has not been stored yet \u2014 open the flow, re-enter the value for "${step.name}" and save`
+        ),
+        { kind: "not_found" }
+      );
+    }
+    if (step.scroll && step.type !== "scroll") {
+      await applyScroll(page, step, Math.min(2e3, remaining()));
+    }
+    const loc = await locate(page, step);
+    await ensureTarget(page, loc, step, remaining());
+    page.setDefaultTimeout(remaining());
+    await applyAction(loc, step, value, { resolveFile: options.resolveFile, dropTarget: await locateDrop(page, step) });
+  };
+  if (options.pages) await options.pages.action(page, step, remaining(), act);
+  else await act();
+  return page;
+}
+async function navigateHistory(page, direction, timeout) {
+  let traversed = false;
+  const listener = (frame) => {
+    if (frame === page.mainFrame()) traversed = true;
+  };
+  page.on("framenavigated", listener);
+  try {
+    const response = await (direction === "back" ? page.goBack({ waitUntil: "domcontentloaded", timeout }) : page.goForward({ waitUntil: "domcontentloaded", timeout }));
+    if (!response && (!traversed || page.url() === "about:blank")) throw Object.assign(new Error(`no history entry to go ${direction} to`), { kind: "navigation" });
+  } finally {
+    page.off("framenavigated", listener);
+  }
+}
+async function applyScroll(page, step, timeout) {
+  const scroll = step.scroll;
+  if (!scroll) return;
+  try {
+    const container = scroll.container;
+    const subject = step.type === "scroll" ? step : container ? {
+      ...step,
+      type: "scroll",
+      role: container.role,
+      name: container.name,
+      scope: container.scope ?? "",
+      scopeRole: container.scopeRole,
+      frame: container.frame,
+      pageId: container.pageId,
+      nameFrom: container.nameFrom,
+      locator: container.locator,
+      nth: container.nth,
+      legacySelector: scroll.legacySelector ?? ""
+    } : step;
+    const root = rootFor(page, subject);
+    const loc = subject.locator || subject.name ? await locate(page, subject) : root.locator("html");
+    await loc.evaluate(
+      (el, pos) => {
+        el.scrollTo({ left: pos.x, top: pos.y, behavior: "instant" });
+      },
+      { x: scroll.x, y: scroll.y },
+      { timeout }
+    );
+  } catch {
+  }
+}
+async function ensureTarget(page, loc, step, timeout) {
+  const firstWait = Math.max(500, Math.floor(timeout * 0.45));
+  const recovery = Math.max(1e3, Math.floor(timeout * 0.35));
+  try {
+    await loc.waitFor({ state: "attached", timeout: firstWait });
+    return;
+  } catch (error) {
+    if (/strict mode violation/.test(String(error))) {
+      throw Object.assign(error, { kind: "ambiguous" });
+    }
+  }
+  if (await scrollUntilFound(page, loc, recovery)) return;
+  throw Object.assign(
+    new Error(
+      `no element named "${step.name}" \u2014 nothing on this page matches the target or its recorded scope`
+    ),
+    { kind: "not_found" }
+  );
+}
+async function replayCase(opts) {
+  const { occurrences, baseUrl } = opts;
+  const started = Date.now();
+  const warnings = [];
+  validateActors(opts.actors, opts.defaultActorId, occurrences.flatMap((o) => [o.actorId, ...actorIdsUsed(o.steps)]));
+  const allSteps = [...occurrences.flatMap((o) => o.steps), ...actorPreparations(opts.actors)];
+  for (const occurrence of occurrences) {
+    if (occurrence.environment && Object.keys(occurrence.environment).length > 0) {
+      warnings.push(
+        `"${occurrence.name}" was recorded with its own browser settings; the case's settings were used instead`
+      );
+    }
+  }
+  const caseHydrated = keptSessionFor(
+    { ...opts, baseUrl },
+    opts.actors?.find((a) => a.id === (opts.defaultActorId ?? "default"))?.startSignedIn
+  );
+  const session = await openRunSession({
+    steps: allSteps,
+    ...caseHydrated?.state ? { storageState: caseHydrated.state } : {},
+    ...opts.resolveAuth ? { resolveAuth: opts.resolveAuth } : {},
+    ...opts.environment === void 0 ? {} : { environment: opts.environment },
+    ...opts.headless === void 0 ? {} : { headless: opts.headless },
+    ...opts.slowMo === void 0 ? {} : { slowMo: opts.slowMo },
+    ...opts.artifacts === void 0 ? {} : { artifacts: opts.artifacts },
+    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret }
+  });
+  const actors = new RunActors(session, {
+    ...opts,
+    steps: allSteps,
+    startUrl: resolveStartUrl(baseUrl, occurrences[0]?.startPath ?? "/"),
+    hydrated: caseHydrated ? { ...caseHydrated, id: opts.defaultActorId ?? "default" } : null
+  });
+  const outcomes = [];
+  let status2 = "passed";
+  let error = null;
+  try {
+    for (const [index, occurrence] of occurrences.entries()) {
+      if (status2 !== "passed" || opts.signal?.aborted) {
+        const skipped = {
+          occurrenceId: occurrence.occurrenceId,
+          name: occurrence.name,
+          status: "skipped",
+          error: null,
+          steps: [],
+          stepsRun: 0,
+          stepsTotal: occurrence.steps.length,
+          durationMs: 0,
+          continued: false
+        };
+        if (status2 === "passed" && opts.signal?.aborted) {
+          status2 = "errored";
+          error = "the run was cancelled";
+        }
+        outcomes.push(skipped);
+        opts.onOccurrenceResult?.(skipped);
+        continue;
+      }
+      const navigates = occurrence.navigateFirst;
+      try {
+        await actors.select(occurrence.actorId ?? opts.defaultActorId ?? "default", resolveStartUrl(occurrence.baseUrl ?? baseUrl, occurrence.startPath ?? "/"));
+      } catch (failure) {
+        status2 = "failed";
+        error = failure.message;
+        outcomes.push({ occurrenceId: occurrence.occurrenceId, name: occurrence.name, status: status2, error, steps: [], stepsRun: 0, stepsTotal: occurrence.steps.length, durationMs: 0, continued: false });
+        continue;
+      }
+      const at0 = Date.now();
+      const { results, status: ran, error: failed } = await runStepsIn(actors.current, occurrence.steps, {
+        actors,
+        baseUrl: occurrence.baseUrl ?? baseUrl,
+        ...opts.resolveAuth ? { resolveAuth: opts.resolveAuth } : {},
+        stepOffset: outcomes.reduce((count, previous) => count + previous.stepsTotal, 0),
+        ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret },
+        ...opts.resolveFile === void 0 ? {} : { resolveFile: opts.resolveFile },
+        ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+        ...opts.signal === void 0 ? {} : { signal: opts.signal },
+        ...opts.onStepResult ? { onStepResult: (result) => opts.onStepResult(result, occurrence.occurrenceId) } : {},
+        startUrl: navigates ? resolveStartUrl(occurrence.baseUrl ?? baseUrl, occurrence.startPath ?? "/") : null
+      });
+      const outcome = {
+        occurrenceId: occurrence.occurrenceId,
+        name: occurrence.name,
+        status: ran,
+        error: failed,
+        steps: results,
+        stepsRun: results.filter((r) => r.status !== "skipped").length,
+        stepsTotal: occurrence.steps.length,
+        durationMs: Date.now() - at0,
+        continued: index > 0 && !navigates
+      };
+      outcomes.push(outcome);
+      opts.onOccurrenceResult?.(outcome);
+      if (ran !== "passed") {
+        status2 = ran;
+        error = `${occurrence.name}: ${failed ?? "failed"}`;
+      }
+    }
+  } finally {
+    await actors.closeExtras(status2 === "passed");
+    await closeRunSession(session, {
+      ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
+      passed: status2 === "passed"
+    });
+  }
+  if (opts.signal?.aborted) {
     status2 = "errored";
-    error = firstLine(err);
+    error = "the run was cancelled";
   }
-  return { results, status: status2, error };
-}
-async function replayFlow(opts) {
-  const { steps, baseUrl, startPath } = opts;
-  const started = Date.now();
-  const session = await openRunSession({
-    steps,
-    ...opts.environment === void 0 ? {} : { environment: opts.environment },
-    ...opts.headless === void 0 ? {} : { headless: opts.headless },
-    ...opts.slowMo === void 0 ? {} : { slowMo: opts.slowMo },
-    ...opts.artifacts === void 0 ? {} : { artifacts: opts.artifacts },
-    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret }
-  });
-  const { results, status: status2, error } = await runStepsIn(session, steps, {
-    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret },
-    ...opts.resolveFile === void 0 ? {} : { resolveFile: opts.resolveFile },
-    ...opts.onStepResult === void 0 ? {} : { onStepResult: opts.onStepResult },
-    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-    ...opts.signal === void 0 ? {} : { signal: opts.signal },
-    startUrl: resolveStartUrl(baseUrl, startPath)
-  });
-  const runArtifacts = await closeRunSession(session, {
-    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-    passed: status2 === "passed"
-  });
+  const steps = outcomes.flatMap((o) => o.steps);
   return {
     status: status2,
     error,
-    artifacts: runArtifacts,
+    artifacts: session.runArtifacts,
     durationMs: Date.now() - started,
-    // Steps that actually ran. A step turned off in the editor is in
-    // `results` so the report can say so, but counting it as run would make a
-    // flow look busier than it was.
-    stepsRun: results.filter((r) => r.status !== "skipped").length,
-    stepsTotal: steps.length,
-    steps: results
+    occurrences: outcomes,
+    steps,
+    stepsRun: steps.filter((r) => r.status !== "skipped").length,
+    stepsTotal: occurrences.reduce((n2, o) => n2 + o.steps.length, 0),
+    warnings
   };
 }
-async function executeStep(main, input, options = {}) {
-  const step = RecordedStepSchema.parse(input);
-  const page = options.pages?.pageFor(step) ?? main;
-  const deadline = Date.now() + (step.timeoutMs ?? options.timeoutMs ?? 8e3);
-  const remaining = () => Math.max(1, deadline - Date.now());
-  const navigationBudget = () => step.navigationTimeoutMs ?? options.navigationTimeoutMs ?? 45e3;
-  page.setDefaultTimeout(remaining());
-  const act = async () => {
-    if (step.type === "unsupported") throw new Error(step.warning || step.value || "This interaction requires a supported action before replay");
-    if (step.type === "assert") {
-      if (step.scroll) await applyScroll(page, step, Math.min(2e3, remaining()));
+var OUTCOME_WINDOW_MS = 2500;
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var COMMITS = /* @__PURE__ */ new Set([
+  "click",
+  "dblclick",
+  "rightclick",
+  "drag",
+  "check",
+  "press",
+  "upload",
+  "back",
+  "forward"
+]);
+var cachedAccNameScript = null;
+var ACCNAME_ASSET = "accname.global.js";
+function accNameScript() {
+  if (cachedAccNameScript === null) {
+    cachedAccNameScript = fs22.readFileSync(accNameScriptPath(), "utf8");
+  }
+  return cachedAccNameScript;
+}
+function accNameScriptPath() {
+  try {
+    return createRequire2(import.meta.url).resolve("@flowriki/recorder/accname.global.js");
+  } catch {
+    const beside = path32.join(path32.dirname(fileURLToPath(import.meta.url)), ACCNAME_ASSET);
+    if (fs22.existsSync(beside)) return beside;
+    throw new Error(
+      `this build is missing ${ACCNAME_ASSET}, which recording injects into the page \u2014 reinstall the agent`
+    );
+  }
+}
+async function startRecordingSession(opts) {
+  const { headless = false, onStep, onState, onDisconnect, onStopRequested } = opts;
+  const url = normalizeStartUrl(opts.url);
+  const { browser, context, config } = await launchSession(opts.environment, headless);
+  const steps = [];
+  let pendingScrollPos = null;
+  const pageIds = /* @__PURE__ */ new Map();
+  let nextPageId = 0;
+  let pendingDialog = null;
+  let stopped = false;
+  let paused = false;
+  const frameChains = /* @__PURE__ */ new Map();
+  const frameLabel = async (frame) => {
+    const el = await frame.frameElement().catch(() => null);
+    if (el) {
+      for (const attr of ["title", "name", "id"]) {
+        const value = (await el.getAttribute(attr).catch(() => null))?.trim();
+        if (value) return value;
+      }
+    }
+    const named = frame.name();
+    if (named) return named;
+    const siblings = frame.parentFrame()?.childFrames() ?? [];
+    return `nth:${Math.max(0, siblings.indexOf(frame))}`;
+  };
+  const noteFrame = async (frame) => {
+    try {
+      const chain = [];
+      let f = frame;
+      while (f && f.parentFrame()) {
+        chain.unshift(await frameLabel(f));
+        f = f.parentFrame();
+      }
+      frameChains.set(frame, chain);
+    } catch {
+    }
+  };
+  const watchFrames = (page2) => {
+    for (const f of page2.frames()) void noteFrame(f);
+    page2.on("frameattached", (f) => void noteFrame(f));
+    page2.on("framenavigated", (f) => void noteFrame(f));
+  };
+  const snapshot = () => ({
+    status: "recording",
+    cursor: null,
+    breakpoints: [],
+    steps: steps.map((x) => ({ ...x })),
+    results: {},
+    failure: null,
+    recording: !paused,
+    recorded: steps.map((x) => x.id),
+    mode: "record",
+    ...pendingDialog ? { dialog: { type: pendingDialog.dialog.type(), message: pendingDialog.dialog.message(), defaultValue: pendingDialog.dialog.defaultValue() } } : {}
+  });
+  const paint = () => {
+    const safe2 = {
+      ...snapshot(),
+      // The characters typed into a password never leave this process.
+      steps: snapshot().steps.map((st) => ({
+        id: st.id,
+        type: st.type,
+        name: st.name,
+        scope: st.scope,
+        value: st.secret ? "" : st.value,
+        secret: st.secret,
+        // The sentence, written here rather than in the page: the catalogue's
+        // wording lives in core, and a panel that phrased checks its own way
+        // would say something different from the flow editor about the same
+        // step.
+        ...st.type === "assert" && st.proposals[0] ? { detail: describeAssertion(st.proposals[0], st.name) } : {}
+      }))
+    };
+    for (const p of context.pages()) {
+      p.evaluate(
+        (v) => window.__flDebugRender?.(v),
+        safe2
+      ).catch(() => {
+      });
+    }
+    onState?.(snapshot());
+  };
+  const toPanel = async (msg) => {
+    await context.pages()[0]?.evaluate(
+      (v) => window.__flPanelMessage?.(v),
+      msg
+    ).catch(() => {
+    });
+  };
+  let signature = null;
+  browser.on("disconnected", () => {
+    if (!stopped) onDisconnect?.();
+  });
+  let pending = null;
+  const finish = (after) => {
+    if (!pending) return;
+    const { step, before, timer } = pending;
+    clearTimeout(timer);
+    pending = null;
+    step.proposals = proposeAssertions(before, after).map(
+      (p) => (
+        // Inferred from a text diff, so it arrives unticked for a human to
+        // confirm. Everything else the page stated about itself and is safe to
+        // run as recorded.
+        p.confidence === "low" ? { ...p, enabled: false } : p
+      )
+    );
+    onStep?.(step);
+  };
+  const consider = (sig) => {
+    signature = sig;
+    if (!pending) return;
+    if (hasObservableChange(pending.before, sig)) finish(sig);
+  };
+  const begin = (step, before) => {
+    finish(signature);
+    const timer = setTimeout(() => finish(signature), OUTCOME_WINDOW_MS);
+    timer.unref?.();
+    pending = { step, before, timer };
+  };
+  const targetIds = /* @__PURE__ */ new Map();
+  const record = (payload, before) => {
+    if (["fill", "select", "setRange"].includes(payload.type)) {
+      const prev = steps[steps.length - 1];
+      if (prev && prev.type === payload.type && targetIds.get(prev.id) === payload.__targetId && payload.__targetId && prev.pageId === payload.pageId && JSON.stringify(prev.frame) === JSON.stringify(payload.frame)) {
+        prev.value = payload.value ?? "";
+        if (payload.values) prev.values = payload.values;
+        onStep?.(prev);
+        paint();
+        return;
+      }
+    }
+    if (payload.type === "scroll") {
+      pendingScrollPos = payload.scroll;
       return;
     }
-    if (step.type === "navigate") {
-      await page.goto(new URL(step.value, page.url()).href, { waitUntil: "domcontentloaded", timeout: navigationBudget() });
+    if (payload.type === "dblclick") {
+      const prev = steps[steps.length - 1];
+      if (prev && prev.type === "click" && prev.name === payload.name && prev.scope === payload.scope) {
+        steps.pop();
+      }
+    }
+    const step = {
+      id: `st_${crypto.randomUUID().slice(0, 8)}`,
+      type: payload.type,
+      role: payload.role ?? "",
+      name: payload.name ?? "",
+      ...payload.nameFrom ? { nameFrom: payload.nameFrom } : {},
+      scope: payload.scope ?? "",
+      ...payload.scopeRole ? { scopeRole: payload.scopeRole } : {},
+      ...payload.frame?.length ? { frame: payload.frame } : {},
+      ...payload.to ? { to: payload.to } : {},
+      ...payload.locator ? { locator: payload.locator } : {},
+      ...payload.values ? { values: payload.values } : {},
+      ...payload.warning ? { warning: payload.warning } : {},
+      ...payload.pageId ? { pageId: payload.pageId } : {},
+      ...payload.scroll ? { scroll: payload.scroll } : {},
+      value: payload.value ?? "",
+      secret: Boolean(payload.secret),
+      legacySelector: payload.legacySelector ?? "",
+      proposals: []
+    };
+    RecordedStepSchema.parse(step);
+    targetIds.set(step.id, payload.__targetId);
+    if (pendingScrollPos) {
+      step.scroll = pendingScrollPos;
+      pendingScrollPos = null;
+    }
+    steps.push(step);
+    onStep?.(step);
+    paint();
+    if (COMMITS.has(step.type)) begin(step, before);
+  };
+  const PRESS_GRACE_MS = 200;
+  let held = null;
+  const releaseHeld = () => {
+    if (!held) return;
+    const { payload, before, timer } = held;
+    clearTimeout(timer);
+    held = null;
+    record(payload, before);
+  };
+  await context.exposeBinding("__flRecord", async (src, payload) => {
+    if (paused || !payload || stopped && payload.__sig === void 0) return;
+    if (src.frame && !frameChains.has(src.frame)) await noteFrame(src.frame);
+    if (src.page) payload.pageId = pageIds.get(src.page) ?? "main";
+    if (payload && payload.__sig !== void 0) {
+      if (!pending || pending.step.pageId === payload.pageId) consider(payload.__sig || null);
       return;
     }
-    if (step.type === "closePage") {
-      await page.close();
+    const before = payload.__before ?? signature;
+    delete payload.__before;
+    const chain = src?.frame ? frameChains.get(src.frame) : void 0;
+    if (chain?.length) payload.frame = chain;
+    if (payload.type === "press" && payload.value === "Enter") {
+      releaseHeld();
+      const timer = setTimeout(releaseHeld, PRESS_GRACE_MS);
+      timer.unref?.();
+      held = { payload, before, timer };
       return;
     }
-    if (step.type === "back" || step.type === "forward") {
-      await navigateHistory(page, step.type, navigationBudget());
-      return;
+    if (payload.type === "click" && held) {
+      clearTimeout(held.timer);
+      held = null;
+    } else if (held && payload.name !== held.payload.name) {
+      releaseHeld();
     }
-    if (step.type === "scroll" && step.scroll) {
-      await applyScroll(page, step, remaining());
+    record(payload, before);
+  });
+  await context.exposeBinding("__flPicked", async (src, payload) => {
+    if (src.frame && !frameChains.has(src.frame)) await noteFrame(src.frame);
+    if (payload?.cancelled) {
+      void session.setPicking(false);
+      void toPanel({ picked: null });
       return;
     }
-    const ref = step.secretRef || step.value;
-    const value = step.secret ? ref ? options.resolveSecret?.(ref) : void 0 : step.value;
-    if (step.secret && value === void 0) {
-      throw Object.assign(
-        new Error(
-          ref ? `the secret "${ref}" is not set on this machine \u2014 add it under Settings \u203A Secrets, or in .flowriki/secrets.local.json, then run again` : `this step needs a secret that has not been stored yet \u2014 open the flow, re-enter the value for "${step.name}" and save`
-        ),
-        { kind: "not_found" }
-      );
-    }
-    if (step.scroll && step.type !== "scroll") {
-      await applyScroll(page, step, Math.min(2e3, remaining()));
+    if (!payload?.target) return;
+    const chain = src?.frame ? frameChains.get(src.frame) : void 0;
+    if (chain?.length) payload.target.frame = chain;
+    if (src.page) payload.target.pageId = pageIds.get(src.page) ?? "main";
+    try {
+      const on = src.page ?? page;
+      const all = await locateAll(on, {
+        id: "pick",
+        type: "click",
+        value: "",
+        secret: false,
+        legacySelector: "",
+        proposals: [],
+        scope: "",
+        ...payload.target
+      });
+      const handles = await all.elementHandles();
+      if (handles.length > 1) {
+        for (const [i, handle] of handles.entries()) {
+          const isIt = await handle.evaluate((el) => el === window.__flPickedEl).catch(() => false);
+          if (isIt) {
+            payload.target.nth = i;
+            break;
+          }
+        }
+        if (payload.target.nth === void 0) {
+          payload.ambiguous = handles.length;
+        }
+      } else if (handles.length === 0) {
+        payload.unresolvable = true;
+      }
+      await Promise.all(handles.map((h) => h.dispose().catch(() => {
+      })));
+    } catch {
     }
-    const loc = await locate(page, step);
-    await ensureTarget(page, loc, step, remaining());
-    page.setDefaultTimeout(remaining());
-    await applyAction(loc, step, value, { resolveFile: options.resolveFile, dropTarget: await locateDrop(page, step) });
-  };
-  if (options.pages) await options.pages.action(page, step, remaining(), act);
-  else await act();
-  return page;
-}
-async function navigateHistory(page, direction, timeout) {
-  let traversed = false;
-  const listener = (frame) => {
-    if (frame === page.mainFrame()) traversed = true;
-  };
-  page.on("framenavigated", listener);
-  try {
-    const response = await (direction === "back" ? page.goBack({ waitUntil: "domcontentloaded", timeout }) : page.goForward({ waitUntil: "domcontentloaded", timeout }));
-    if (!response && (!traversed || page.url() === "about:blank")) throw Object.assign(new Error(`no history entry to go ${direction} to`), { kind: "navigation" });
-  } finally {
-    page.off("framenavigated", listener);
-  }
-}
-async function applyScroll(page, step, timeout) {
-  const scroll = step.scroll;
-  if (!scroll) return;
-  try {
-    const container = scroll.container;
-    const subject = step.type === "scroll" ? step : container ? {
-      ...step,
-      type: "scroll",
-      role: container.role,
-      name: container.name,
-      scope: container.scope ?? "",
-      scopeRole: container.scopeRole,
-      frame: container.frame,
-      pageId: container.pageId,
-      nameFrom: container.nameFrom,
-      locator: container.locator,
-      nth: container.nth,
-      legacySelector: scroll.legacySelector ?? ""
-    } : step;
-    const root = rootFor(page, subject);
-    const loc = subject.locator || subject.name ? await locate(page, subject) : root.locator("html");
-    await loc.evaluate(
-      (el, pos) => {
-        el.scrollTo({ left: pos.x, top: pos.y, behavior: "instant" });
-      },
-      { x: scroll.x, y: scroll.y },
-      { timeout }
-    );
-  } catch {
-  }
-}
-async function ensureTarget(page, loc, step, timeout) {
-  const firstWait = Math.max(500, Math.floor(timeout * 0.45));
-  const recovery = Math.max(1e3, Math.floor(timeout * 0.35));
-  try {
-    await loc.waitFor({ state: "attached", timeout: firstWait });
-    return;
-  } catch (error) {
-    if (/strict mode violation/.test(String(error))) {
-      throw Object.assign(error, { kind: "ambiguous" });
+    void session.setPicking(false);
+    void toPanel({ picked: payload });
+  });
+  await context.exposeBinding("__flStop", () => {
+    onStopRequested?.(true);
+  });
+  await context.exposeBinding("__flCmd", (_src, msg) => {
+    if (!msg || typeof msg.command !== "string") return;
+    if (msg.command === "end") onStopRequested?.(msg.commit !== false);
+    else if (msg.command === "deleteStep") void session.deleteStep(String(msg.stepId));
+    else if (msg.command === "pick") void session.setPicking(msg.on !== false);
+    else if (msg.command === "assert") {
+      void session.setPicking(false);
+      try {
+        session.addAssertion(msg.assertion);
+      } catch (err) {
+        void toPanel({ pickError: firstLine2(err) });
+      }
+    } else if (msg.command === "record") void session.setPaused(!msg.on);
+  });
+  const INIT_SCRIPT = `${accNameScript()}
+;window.__flChecks=${JSON.stringify(CHECKS)};
+;(${installRecorder.toString()})();
+;(${installDebugPanel.toString()})();`;
+  const page = await context.newPage();
+  if (opts.authentication) {
+    try {
+      await page.goto(url, { waitUntil: "domcontentloaded" });
+      await executeStep(page, opts.authentication.step, { ...opts.authentication, baseUrl: url });
+      const resume = { id: "auth-return", type: "navigate", name: "Open recording start page", role: "", scope: "", value: new URL(url).pathname + new URL(url).search + new URL(url).hash, navigationBase: "application", secret: false, legacySelector: "", proposals: [] };
+      steps.push(opts.authentication.step, resume);
+      onStep?.(opts.authentication.step);
+      onStep?.(resume);
+    } catch (error) {
+      await browser.close();
+      throw error;
     }
   }
-  if (await scrollUntilFound(page, loc, recovery)) return;
-  throw Object.assign(
-    new Error(
-      `no element named "${step.name}" \u2014 nothing on this page matches the target or its recorded scope`
-    ),
-    { kind: "not_found" }
-  );
-}
-async function replayCase(opts) {
-  const { occurrences, baseUrl } = opts;
-  const started = Date.now();
-  const warnings = [];
-  const allSteps = occurrences.flatMap((o) => o.steps);
-  for (const occurrence of occurrences) {
-    if (occurrence.environment && Object.keys(occurrence.environment).length > 0) {
-      warnings.push(
-        `"${occurrence.name}" was recorded with its own browser settings; the case's settings were used instead`
-      );
+  await context.addInitScript({ content: INIT_SCRIPT });
+  const ensureInstalled = async (p) => {
+    try {
+      await p.evaluate((src) => {
+        if (document.__flInstalled) return;
+        (0, eval)(src);
+      }, INIT_SCRIPT);
+    } catch {
     }
-  }
-  const session = await openRunSession({
-    steps: allSteps,
-    ...opts.environment === void 0 ? {} : { environment: opts.environment },
-    ...opts.headless === void 0 ? {} : { headless: opts.headless },
-    ...opts.slowMo === void 0 ? {} : { slowMo: opts.slowMo },
-    ...opts.artifacts === void 0 ? {} : { artifacts: opts.artifacts },
-    ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-    ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret }
+  };
+  pageIds.set(page, "main");
+  const watchPage = (p) => {
+    watchFrames(p);
+    void ensureInstalled(p);
+    p.on("domcontentloaded", () => void ensureInstalled(p));
+    p.on("download", (download) => {
+      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(p));
+      if (step) {
+        (step.downloads ??= []).push(download.suggestedFilename());
+        onStep?.(step);
+        paint();
+      }
+    });
+    p.on("dialog", (dialog) => {
+      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(p));
+      if (!step) {
+        void dialog.dismiss();
+        record({ type: "unsupported", name: "Dialog before first action", warning: "Record an explicit navigation before a page-load dialog", pageId: pageIds.get(p) }, null);
+        return;
+      }
+      pendingDialog = { dialog, step };
+      onState?.(snapshot());
+    });
+    p.on("close", () => {
+      if (!stopped && p !== page) record({ type: "closePage", pageId: pageIds.get(p) }, null);
+    });
+  };
+  watchPage(page);
+  context.on("page", (p) => {
+    const id = `page_${++nextPageId}`;
+    pageIds.set(p, id);
+    watchPage(p);
+    void p.opener().then((opener) => {
+      const step = [...steps].reverse().find((s2) => (s2.pageId ?? "main") === pageIds.get(opener));
+      if (step) {
+        step.opensPage = id;
+        onStep?.(step);
+        paint();
+      } else record({ type: "unsupported", name: "Unlinked browser tab", warning: "Open this tab through a recorded link or button", pageId: id }, null);
+    });
   });
-  const outcomes = [];
-  let status2 = "passed";
-  let error = null;
   try {
-    for (const [index, occurrence] of occurrences.entries()) {
-      if (status2 !== "passed" || opts.signal?.aborted) {
-        const skipped = {
-          occurrenceId: occurrence.occurrenceId,
-          name: occurrence.name,
-          status: "skipped",
-          error: null,
-          steps: [],
-          stepsRun: 0,
-          stepsTotal: occurrence.steps.length,
-          durationMs: 0,
-          continued: false
-        };
-        if (status2 === "passed" && opts.signal?.aborted) {
-          status2 = "errored";
-          error = "the run was cancelled";
-        }
-        outcomes.push(skipped);
-        opts.onOccurrenceResult?.(skipped);
-        continue;
-      }
-      const navigates = index === 0 || occurrence.navigateFirst;
-      const at0 = Date.now();
-      const { results, status: ran, error: failed } = await runStepsIn(session, occurrence.steps, {
-        stepOffset: outcomes.reduce((count, previous) => count + previous.stepsTotal, 0),
-        ...opts.resolveSecret === void 0 ? {} : { resolveSecret: opts.resolveSecret },
-        ...opts.resolveFile === void 0 ? {} : { resolveFile: opts.resolveFile },
-        ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-        ...opts.signal === void 0 ? {} : { signal: opts.signal },
-        ...opts.onStepResult ? { onStepResult: (result) => opts.onStepResult(result, occurrence.occurrenceId) } : {},
-        startUrl: navigates ? resolveStartUrl(occurrence.baseUrl ?? baseUrl, occurrence.startPath ?? "/") : null
-      });
-      const outcome = {
-        occurrenceId: occurrence.occurrenceId,
-        name: occurrence.name,
-        status: ran,
-        error: failed,
-        steps: results,
-        stepsRun: results.filter((r) => r.status !== "skipped").length,
-        stepsTotal: occurrence.steps.length,
-        durationMs: Date.now() - at0,
-        continued: !navigates
+    await page.goto(url, { waitUntil: "domcontentloaded", timeout: 45e3 });
+  } catch (err) {
+    stopped = true;
+    await browser.close().catch(() => {
+    });
+    throw new Error(`could not open ${url} \u2014 ${firstLine2(err)}`);
+  }
+  const session = {
+    environment: config,
+    page,
+    startUrl: url,
+    state: snapshot,
+    deleteStep(id) {
+      const i = steps.findIndex((x) => x.id === id);
+      if (i !== -1) steps.splice(i, 1);
+      paint();
+      return snapshot();
+    },
+    async setPicking(on) {
+      const call = (fn, arg) => Promise.all(
+        context.pages().flatMap(
+          (p) => p.frames().map(
+            (f) => f.evaluate(
+              ([name, value]) => window[name]?.(value),
+              [fn, arg]
+            ).catch(() => {
+            })
+          )
+        )
+      );
+      if (on) await call("__flSetMuted", true);
+      await call("__flSetPicking", on);
+      if (!on && !paused) await call("__flSetMuted", false);
+    },
+    addAssertion(assertion) {
+      const parsed = RecordedAssertionSchema.parse({ enabled: true, ...assertion });
+      const step = {
+        id: `st_${crypto.randomUUID().slice(0, 8)}`,
+        type: "assert",
+        // Mirrored from the target so a step list can name what is being
+        // checked without reaching inside the assertion to find out.
+        role: parsed.target?.role ?? "",
+        name: parsed.target?.name ?? "",
+        ...parsed.target?.nameFrom ? { nameFrom: parsed.target.nameFrom } : {},
+        scope: parsed.target?.scope ?? "",
+        ...parsed.target?.scopeRole ? { scopeRole: parsed.target.scopeRole } : {},
+        ...parsed.target?.frame?.length ? { frame: parsed.target.frame } : {},
+        ...parsed.target?.locator ? { locator: parsed.target.locator } : {},
+        ...parsed.target?.pageId ? { pageId: parsed.target.pageId } : {},
+        value: "",
+        secret: false,
+        legacySelector: "",
+        proposals: [parsed]
       };
-      outcomes.push(outcome);
-      opts.onOccurrenceResult?.(outcome);
-      if (ran !== "passed") {
-        status2 = ran;
-        error = `${occurrence.name}: ${failed ?? "failed"}`;
+      if ((parsed.kind === "text" || parsed.kind === "class" || parsed.kind === "attribute") && parsed.target?.nameFrom === "text" && !parsed.target.locator) {
+        step.warning = "This element is identified by its own text, so a change to that text reads as a missing element rather than a failed check. Give it a test ID or a locator to tell the two apart.";
+      }
+      RecordedStepSchema.parse(step);
+      if (pendingScrollPos) {
+        step.scroll = pendingScrollPos;
+        pendingScrollPos = null;
       }
+      steps.push(step);
+      onStep?.(step);
+      paint();
+      return snapshot();
+    },
+    async setPaused(next) {
+      paused = next;
+      await Promise.all(
+        context.pages().map(
+          (p) => p.evaluate(
+            (v) => window.__flSetMuted?.(v),
+            next
+          ).catch(() => {
+          })
+        )
+      );
+      paint();
+      return snapshot();
+    },
+    async answerDialog(accept, promptText) {
+      if (!pendingDialog) throw new Error("No browser dialog is waiting");
+      const { dialog, step } = pendingDialog;
+      const answer = { type: dialog.type(), message: dialog.message(), accept, ...promptText !== void 0 ? { promptText } : {} };
+      if (accept) await dialog.accept(promptText);
+      else await dialog.dismiss();
+      (step.dialogs ??= []).push(answer);
+      pendingDialog = null;
+      onStep?.(step);
+      paint();
+    },
+    async stop() {
+      if (pendingDialog) throw new Error("Answer the browser dialog before saving the recording");
+      if (stopped) return steps;
+      await Promise.all(context.pages().flatMap((p) => p.frames().map((f) => f.evaluate(() => window.__flFlush?.()).catch(() => {
+      }))));
+      stopped = true;
+      releaseHeld();
+      if (pending) await sleep(OUTCOME_WINDOW_MS + 300);
+      finish(signature);
+      await browser.close().catch(() => {
+      });
+      return steps;
     }
-  } finally {
-    await closeRunSession(session, {
-      ...opts.evidenceDir === void 0 ? {} : { evidenceDir: opts.evidenceDir },
-      passed: status2 === "passed"
-    });
-  }
-  if (opts.signal?.aborted) {
-    status2 = "errored";
-    error = "the run was cancelled";
-  }
-  const steps = outcomes.flatMap((o) => o.steps);
-  return {
-    status: status2,
-    error,
-    artifacts: session.runArtifacts,
-    durationMs: Date.now() - started,
-    occurrences: outcomes,
-    steps,
-    stepsRun: steps.filter((r) => r.status !== "skipped").length,
-    stepsTotal: occurrences.reduce((n2, o) => n2 + o.steps.length, 0),
-    warnings
   };
+  page.on("domcontentloaded", () => paint());
+  context.on("page", (p) => p.on("domcontentloaded", () => paint()));
+  paint();
+  return session;
+}
+function firstLine2(err) {
+  return String(err?.message ?? err).split("\n")[0].trim();
+}
+var SESSION_STEPS = /* @__PURE__ */ new Set(["signIn", "signOut", "useActor", "resetActor", "capture"]);
+var usesAnOutput = (text) => Array.isArray(text) ? text.some(usesAnOutput) : String(text ?? "").includes("{{");
+function needsWholeRun(opts) {
+  if (opts.actors?.length) return true;
+  return opts.steps.some((step) => SESSION_STEPS.has(step.type) || usesAnOutput(step.value) || (step.values ?? []).some(usesAnOutput) || (step.proposals ?? []).some((check) => usesAnOutput(check.value)));
 }
 async function verifySteps(opts) {
+  if (needsWholeRun(opts)) {
+    const result = await replayFlow({ ...opts, onStepResult: (step) => opts.onStepResult?.({ stepId: step.stepId, status: step.status, matches: 0, detail: step.detail ?? "Action and assertions passed" }) });
+    return {
+      ok: result.status === "passed",
+      error: result.error,
+      failedAtStepId: result.steps.find((s2) => s2.status === "failed")?.stepId ?? null,
+      results: result.steps.map((s2) => ({ stepId: s2.stepId, status: s2.status, matches: 0, detail: s2.detail ?? "Action and assertions passed" }))
+    };
+  }
   const {
     steps,
     baseUrl,
@@ -4153,7 +5006,7 @@ async function verifySteps(opts) {
       let matches = 0;
       try {
         const current = pages.pageFor(step);
-        if (!["back", "forward", "navigate", "closePage", "unsupported", "scroll", "assert"].includes(step.type)) {
+        if (!["back", "forward", "navigate", "closePage", "unsupported", "scroll", "assert", "signIn", "signOut"].includes(step.type)) {
           const all = await locateAll(current, step);
           const budget = step.timeoutMs ?? timeoutMs;
           try {
@@ -4165,7 +5018,7 @@ async function verifySteps(opts) {
           matches = await all.count();
           if (matches > 1 && step.nth === void 0) throw new Error(`${matches} elements match this step \u2014 choose a unique target`);
         }
-        const active = await executeStep(page, step, { pages, resolveSecret, resolveFile, timeoutMs });
+        const active = await executeStep(page, step, { pages, resolveSecret, resolveFile, timeoutMs, baseUrl, ...opts.resolveAuth ? { resolveAuth: opts.resolveAuth } : {} });
         for (const a of step.proposals) if (a.enabled !== false) await checkAssertion(active, a.kind, a.value, config.assertionTimeoutMs, a);
         report2({
           stepId: step.id,
@@ -4176,15 +5029,15 @@ async function verifySteps(opts) {
       } catch (caught) {
         const err = /Timeout/.test(String(caught)) ? new Error(`Target could not be found within the step timeout`) : caught;
         const what = step.type === "assert" ? `check ${describeAssertion(step.proposals[0] ?? { kind: "visible", value: "" }, step.name)}` : `${step.type} "${step.name}"`;
-        error = `step ${index + 1} (${what}): ${firstLine(err)}`;
+        error = `step ${index + 1} (${what}): ${firstLine2(err)}`;
         failedAtStepId = step.id;
-        report2({ stepId: step.id, status: "failed", matches, detail: firstLine(err) });
+        report2({ stepId: step.id, status: "failed", matches, detail: firstLine2(err) });
         for (const later of steps.slice(index + 1)) report2({ stepId: later.id, status: "skipped", matches: 0, detail: "the flow could not reach this step" });
         break;
       }
     }
   } catch (err) {
-    error = firstLine(err);
+    error = firstLine2(err);
   } finally {
     await browser.close();
   }
@@ -4193,8 +5046,8 @@ async function verifySteps(opts) {
 var cachedAccName = null;
 function accNameScript2() {
   if (cachedAccName === null) {
-    const path33 = accNameScriptPath();
-    cachedAccName = fs32.readFileSync(path33, "utf8");
+    const path42 = accNameScriptPath();
+    cachedAccName = fs32.readFileSync(path42, "utf8");
   }
   return cachedAccName;
 }
@@ -4221,7 +5074,9 @@ async function startDebugSession(opts) {
   let stopRequested = false;
   const applied = /* @__PURE__ */ new Set();
   const recordedInSession = /* @__PURE__ */ new Set();
-  const { browser, context } = await launchSession({ ...opts.environment, timeoutMs }, headless, slowMo);
+  validateActors(opts.actors, opts.defaultActorId, actorIdsUsed(steps));
+  let actors;
+  const { browser, context, config, artifacts } = await launchSession({ ...opts.environment, timeoutMs }, headless, slowMo);
   let closed = false;
   browser.on("disconnected", () => {
     if (!closed) {
@@ -4238,7 +5093,8 @@ async function startDebugSession(opts) {
     failure,
     recording,
     recorded: [...recordedInSession],
-    mode: "debug"
+    mode: "debug",
+    actorId: actors?.currentId ?? "default"
   });
   const publish = () => {
     const s2 = snapshot();
@@ -4261,7 +5117,7 @@ async function startDebugSession(opts) {
       }))
     };
     await Promise.all(
-      context.pages().map(
+      (actors?.all().flatMap((s22) => s22.context.pages()) ?? context.pages()).map(
         (p) => p.evaluate(
           (v) => window.__flDebugRender?.(v),
           safe2
@@ -4271,68 +5127,82 @@ async function startDebugSession(opts) {
     );
   }
   const targetIds = /* @__PURE__ */ new Map();
-  await context.exposeBinding("__flRecord", (_src, payload) => {
-    if (!recording || !payload || payload.__sig !== void 0) return;
-    const step = {
-      id: `st_${crypto.randomUUID().slice(0, 8)}`,
-      type: payload.type,
-      role: payload.role ?? "",
-      ...payload.nameFrom ? { nameFrom: payload.nameFrom } : {},
-      name: payload.name ?? "",
-      scope: payload.scope ?? "",
-      frame: payload.frame,
-      scopeRole: payload.scopeRole,
-      to: payload.to,
-      locator: payload.locator,
-      values: payload.values,
-      warning: payload.warning,
-      scroll: payload.scroll,
-      value: payload.value ?? "",
-      secret: Boolean(payload.secret),
-      legacySelector: payload.legacySelector ?? "",
-      proposals: []
-    };
-    const at = cursor ? steps.findIndex((s2) => s2.id === cursor) : steps.length;
-    const insertAt = at === -1 ? steps.length : at;
-    if (["fill", "select", "setRange"].includes(step.type)) {
-      const prev = steps[insertAt - 1];
-      if (prev && applied.has(prev.id) && prev.type === step.type && payload.__targetId && targetIds.get(prev.id) === payload.__targetId) {
-        prev.value = step.value;
-        prev.values = step.values;
-        prev.secret = step.secret;
-        publish();
-        return;
+  async function installContext(context2) {
+    await context2.exposeBinding("__flRecord", (_src, payload) => {
+      if (!recording || !payload || payload.__sig !== void 0 || actors && _src.page.context() !== actors.current.context) return;
+      const step = {
+        id: `st_${crypto.randomUUID().slice(0, 8)}`,
+        type: payload.type,
+        role: payload.role ?? "",
+        ...payload.nameFrom ? { nameFrom: payload.nameFrom } : {},
+        name: payload.name ?? "",
+        scope: payload.scope ?? "",
+        frame: payload.frame,
+        scopeRole: payload.scopeRole,
+        to: payload.to,
+        locator: payload.locator,
+        values: payload.values,
+        warning: payload.warning,
+        scroll: payload.scroll,
+        value: payload.value ?? "",
+        secret: Boolean(payload.secret),
+        legacySelector: payload.legacySelector ?? "",
+        proposals: []
+      };
+      const at = cursor ? steps.findIndex((s2) => s2.id === cursor) : steps.length;
+      const insertAt = at === -1 ? steps.length : at;
+      if (["fill", "select", "setRange"].includes(step.type)) {
+        const prev = steps[insertAt - 1];
+        if (prev && applied.has(prev.id) && prev.type === step.type && payload.__targetId && targetIds.get(prev.id) === payload.__targetId) {
+          prev.value = step.value;
+          prev.values = step.values;
+          prev.secret = step.secret;
+          publish();
+          return;
+        }
       }
-    }
-    RecordedStepSchema.parse(step);
-    targetIds.set(step.id, payload.__targetId);
-    steps.splice(insertAt, 0, step);
-    applied.add(step.id);
-    recordedInSession.add(step.id);
-    results[step.id] = {
-      stepId: step.id,
-      status: "passed",
-      detail: "recorded here",
-      durationMs: 0,
-      checks: []
-    };
-    publish();
-  });
-  await context.exposeBinding("__flCmd", (_src, msg) => {
-    void handleCommand(msg);
-  });
-  await context.addInitScript({ content: `${accNameScript2()}
+      RecordedStepSchema.parse(step);
+      targetIds.set(step.id, payload.__targetId);
+      steps.splice(insertAt, 0, step);
+      applied.add(step.id);
+      recordedInSession.add(step.id);
+      results[step.id] = {
+        stepId: step.id,
+        status: "passed",
+        detail: "recorded here",
+        durationMs: 0,
+        checks: []
+      };
+      publish();
+    });
+    await context2.exposeBinding("__flCmd", (_src, msg) => {
+      void handleCommand(msg);
+    });
+    await context2.addInitScript({ content: `${accNameScript2()}
 ;(${installRecorder.toString()})();
 ;(${installDebugPanel.toString()})();` });
-  context.on("page", (p) => p.on("domcontentloaded", () => void paint(snapshot())));
+    context2.on("page", (p) => p.on("domcontentloaded", () => void paint(snapshot())));
+  }
+  await installContext(context);
   const page = await context.newPage();
   const pages = new ExecutionPages(context, page);
   page.on("domcontentloaded", () => void paint(snapshot()));
   await setMuted(true);
-  await page.goto(resolveStartUrl(baseUrl, startPath), { waitUntil: "domcontentloaded" });
+  actors = new RunActors({ browser, context, config, artifacts, page, pages, consoleLines: [], runArtifacts: [] }, {
+    ...opts,
+    startUrl: resolveStartUrl(baseUrl, startPath),
+    onCreate: async (session2) => installContext(session2.context)
+  });
+  try {
+    await actors.select(opts.defaultActorId ?? "default");
+  } catch (error) {
+    closed = true;
+    await browser.close();
+    throw error;
+  }
   async function setMuted(on) {
     await Promise.all(
-      context.pages().map(
+      (actors?.all().flatMap((s2) => s2.context.pages()) ?? context.pages()).map(
         (p) => p.evaluate((v) => window.__flSetMuted?.(v), on).catch(() => {
         })
       )
@@ -4399,8 +5269,10 @@ async function startDebugSession(opts) {
       checks: []
     };
     try {
+      step = withRuntimeValues(step, actors?.values ?? /* @__PURE__ */ new Map());
       const fresh = step.secret && recordedInSession.has(step.id);
-      const active = await executeStep(page, fresh ? { ...step, secret: false } : step, { pages, resolveSecret, resolveFile, timeoutMs });
+      const on = actors?.current ?? { page, pages };
+      const active = await executeStep(on.page, fresh ? { ...step, secret: false } : step, { pages: on.pages, resolveSecret, resolveFile, timeoutMs, baseUrl, valuesResolved: true, ...actors ? { actors } : {}, ...opts.resolveAuth ? { resolveAuth: opts.resolveAuth } : {} });
       for (const a of step.proposals ?? []) {
         if (a.enabled === false) continue;
         const label = describeAssertion(a, step.name);
@@ -4408,7 +5280,7 @@ async function startDebugSession(opts) {
           const detail = await checkAssertion(active, a.kind, a.value, step.timeoutMs ?? timeoutMs, a);
           result.checks.push({ kind: a.kind, expected: label, ok: true, soft: a.soft === true, detail });
         } catch (err) {
-          result.checks.push({ kind: a.kind, expected: label, ok: false, soft: a.soft === true, detail: firstLine(err) });
+          result.checks.push({ kind: a.kind, expected: label, ok: false, soft: a.soft === true, detail: firstLine2(err) });
         }
       }
       const bad = result.checks.find((c) => !c.ok && !c.soft);
@@ -4418,7 +5290,7 @@ async function startDebugSession(opts) {
       }
     } catch (err) {
       result.status = "failed";
-      result.detail = firstLine(err);
+      result.detail = firstLine2(err);
     }
     result.durationMs = Date.now() - t0;
     return result;
@@ -4458,7 +5330,9 @@ async function startDebugSession(opts) {
     return publish();
   }
   const session = {
-    page,
+    get page() {
+      return actors?.current.page ?? page;
+    },
     state: snapshot,
     async play() {
       if (failure) {
@@ -4532,7 +5406,8 @@ async function startDebugSession(opts) {
       status2 = "idle";
       publish();
       await pages.reset();
-      await page.goto(resolveStartUrl(baseUrl, startPath), { waitUntil: "domcontentloaded" });
+      await actors.reset();
+      await actors.select(opts.defaultActorId ?? "default");
       return runUntil();
     },
     toggleBreakpoint(stepId) {
@@ -5416,7 +6291,7 @@ function toSummary(row) {
   };
 }
 
-// ../repository-store/dist/chunk-EWIK7XW6.js
+// ../repository-store/dist/chunk-IXRMPDVC.js
 var FLOWRIKI_DIR = ".flowriki";
 var FEATURES_DIR = `${FLOWRIKI_DIR}/features`;
 var CONFIG_PATH = `${FLOWRIKI_DIR}/config.json`;
@@ -5425,6 +6300,8 @@ var FEATURE_FILE = "feature.json";
 var FLOW_SUFFIX = ".flow.json";
 var CASES_DIR = `${FLOWRIKI_DIR}/cases`;
 var SUITES_DIR = `${FLOWRIKI_DIR}/suites`;
+var AUTH_DIR = `${FLOWRIKI_DIR}/auth`;
+var ACCOUNTS_DIR = `${AUTH_DIR}/accounts`;
 function assertSlug(slug) {
   if (!/^[a-z0-9][a-z0-9-]*$/.test(slug)) throw new Error(`invalid slug: ${slug}`);
   return slug;
@@ -5454,6 +6331,8 @@ function parseConfig(raw) {
   const source = raw && typeof raw === "object" ? raw : {};
   return {
     baseUrl: typeof source["baseUrl"] === "string" ? source["baseUrl"] : "",
+    ...typeof source["applicationEnvironment"] === "string" ? { applicationEnvironment: source["applicationEnvironment"] } : {},
+    reuseAuthentication: source["reuseAuthentication"] === true,
     headless: source["headless"] === true,
     environment: ExecutionEnvironmentSchema.parse(source["environment"] ?? {}),
     artifacts: ArtifactPolicySchema.parse(source["artifacts"] ?? {}),
@@ -5491,7 +6370,7 @@ import path6 from "path";
 import { execFileSync } from "child_process";
 import { execFileSync as execFileSync2 } from "child_process";
 import fs33 from "fs";
-import path32 from "path";
+import path33 from "path";
 function uniqueRef(flowSlug, name, taken) {
   const base = `${flowSlug}_${slugify(name) || "secret"}`;
   if (!taken.has(base)) {
@@ -6040,7 +6919,7 @@ function tryGit(root, args) {
 }
 function readRepo(root) {
   const isRepo = tryGit(root, ["rev-parse", "--is-inside-work-tree"]) === "true";
-  const markerFile = path32.join(root, MARKER_PATH);
+  const markerFile = path33.join(root, MARKER_PATH);
   let marker = null;
   let markerUnreadable = false;
   if (fs33.existsSync(markerFile)) {
@@ -6095,8 +6974,8 @@ function writeMarker(root, marker, opts = {}) {
   if (!facts.clean) {
     throw new ClaimRefused("this repository has uncommitted changes \u2014 commit or stash them first");
   }
-  const file = path32.join(root, MARKER_PATH);
-  fs33.mkdirSync(path32.dirname(file), { recursive: true });
+  const file = path33.join(root, MARKER_PATH);
+  fs33.mkdirSync(path33.dirname(file), { recursive: true });
   fs33.writeFileSync(file, JSON.stringify(marker, null, 2) + "\n");
   git2(root, ["add", "--", MARKER_PATH]);
   git2(root, ["commit", "-m", `Bind this repository to Flowriki project ${marker.projectId}`]);
@@ -6181,6 +7060,10 @@ async function executeFlow(opts) {
       // One resolution, shared with debug and verification. See Store.environmentFor.
       environment: store.environmentFor(flow),
       steps: flow.steps,
+      ...flow.actors ? { actors: flow.actors } : {},
+      ...flow.defaultActorId ? { defaultActorId: flow.defaultActorId } : {},
+      ...store.resolveAuth ? { resolveAuth: store.resolveAuth } : {},
+      ...opts.reuse ? { reuse: opts.reuse } : {},
       // The flow's own origin when it has one, the project's otherwise. A flow
       // that carries no origin is the normal case now: the environment belongs
       // to the project, so moving a suite from staging to production is a
@@ -6461,6 +7344,10 @@ async function executeCase(opts) {
   try {
     outcome = await replayCase({
       occurrences: caseOccurrences(testCase),
+      ...testCase.actors ? { actors: testCase.actors } : {},
+      ...testCase.defaultActorId ? { defaultActorId: testCase.defaultActorId } : {},
+      resolveAuth: authenticationResolver(opts.authentications),
+      ...opts.reuse ? { reuse: opts.reuse } : {},
       baseUrl: testCase.baseUrl ?? baseUrl,
       ...testCase.environment ? { environment: testCase.environment } : {},
       headless,
@@ -6658,6 +7545,11 @@ var RecordingCoordinator = class {
     try {
       this.session = await startRecordingSession({
         url: target,
+        ...opts.authentication ? { authentication: {
+          step: { id: "auth-preparation", type: "signIn", auth: opts.authentication, name: "Sign in before recording", role: "", scope: "", value: "", secret: false, legacySelector: "", proposals: [] },
+          resolveAuth: authenticationResolver(opts.authentications),
+          resolveSecret: (ref) => opts.secrets?.[ref]
+        } } : {},
         // The project's saved defaults, unless this recording asks for
         // something else. Without the fallback the settings screen would write
         // a file nothing ever read.
@@ -6847,6 +7739,9 @@ var DebugCoordinator = class {
       const secrets = store.readSecrets();
       const session = await startDebugSession({
         steps: flow.steps,
+        ...flow.actors ? { actors: flow.actors } : {},
+        ...flow.defaultActorId ? { defaultActorId: flow.defaultActorId } : {},
+        ...store.resolveAuth ? { resolveAuth: store.resolveAuth } : {},
         environment: store.environmentFor(flow),
         resolveFile: (name) => store.resolveFile(name),
         baseUrl,
@@ -6968,7 +7863,7 @@ async function verifyFlowSteps(deps, opts) {
   const { store } = deps;
   const flow = store.getFlow(opts.flowId);
   if (!flow) throw new FlowNotFound("flow not found");
-  const steps = (opts.steps ?? flow.steps).map((s2) => RecordedStepSchema.parse(s2));
+  const steps = (opts.steps ?? flow.steps).map((s2) => DraftStepSchema.parse(s2));
   if (!opts.verifyIds.length) return { results: [], error: null, failedAtStepId: null, ok: true };
   const baseUrl = store.baseUrlFor(flow);
   const claim = deps.lease?.acquire("run");
@@ -6979,12 +7874,15 @@ async function verifyFlowSteps(deps, opts) {
   try {
     const secrets = store.readSecrets();
     return await verifySteps({
+      ...store.resolveAuth ? { resolveAuth: store.resolveAuth } : {},
       environment: store.environmentFor(flow),
       resolveFile: (name) => store.resolveFile(name),
       // Streamed, so the editor fills in as the pass proceeds instead of
       // sitting blank for the twenty-odd seconds a replay takes.
       ...deps.onStepResult ? { onStepResult: deps.onStepResult } : {},
       steps,
+      ...flow.actors ? { actors: flow.actors } : {},
+      ...flow.defaultActorId ? { defaultActorId: flow.defaultActorId } : {},
       baseUrl,
       startPath: flow.startPath,
       verifyIds: opts.verifyIds,
@@ -7002,6 +7900,7 @@ async function verifyFlowSteps(deps, opts) {
 function deliveredRun(delivered) {
   const { flow, secrets, config } = delivered;
   return {
+    resolveAuth: authenticationResolver(delivered.authentications),
     readConfig: () => config,
     // By id, and only the one that was sent. A machine serving no checkout has
     // no other flow to confuse it with.
@@ -7095,7 +7994,7 @@ function resolveCheckouts(dirs) {
   return { projects, skipped };
 }
 
-// ../agent-core/dist/chunk-63IFXBPX.js
+// ../agent-core/dist/chunk-EJDGHASQ.js
 import { WebSocket, WebSocketServer } from "ws";
 var HEARTBEAT_MS = 3e4;
 function adapt(socket) {
@@ -7768,12 +8667,12 @@ function repositoryHandlers({ storeFor }) {
         return { ok: false, reason: "failed", detail: "no flow document was sent" };
       }
       try {
-        const path33 = store.saveFlow(flow, {
+        const path34 = store.saveFlow(flow, {
           create: command.args["create"] === true,
           ...command.flowRevision !== void 0 ? { expectedRevision: command.flowRevision } : {}
         });
         const saved = store.getFlow(flow.id);
-        return { ok: true, result: { path: path33, revision: saved?.revision ?? null } };
+        return { ok: true, result: { path: path34, revision: saved?.revision ?? null } };
       } catch (err) {
         if (err instanceof FlowConflict) {
           return { ok: false, reason: "stale_revision", detail: err.message };
@@ -7964,7 +8863,14 @@ function historyHandlers({ storage, artifactLimit }) {
   };
 }
 function executionHandlers(ctx) {
-  const { storeFor, storage, onActivity, lease, cancels } = ctx;
+  const { storeFor, storage, onActivity, lease, cancels, authenticationReuse } = ctx;
+  const reuseFor = (command, projectId, config) => {
+    if (!authenticationReuse || config?.reuseAuthentication !== true) return void 0;
+    const cancelKey = command.args["cancelKey"];
+    const span = typeof cancelKey === "string" && cancelKey.startsWith("suite:") ? cancelKey : command.id;
+    const environment = config?.applicationEnvironment ?? null;
+    return { cache: authenticationReuse, scope: `${projectId}/${span}`, environment };
+  };
   return {
     "flow.run": async (command, project, emit) => {
       if (command.flowRevision === void 0) {
@@ -7974,6 +8880,7 @@ function executionHandlers(ctx) {
       const carried = command.args["flow"];
       const source = carried ? deliveredRun({
         flow: carried,
+        authentications: command.args["authentications"],
         secrets: command.args["secrets"] ?? {},
         config: command.args["config"] ?? {}
       }) : storeFor(project.root);
@@ -8005,8 +8912,10 @@ function executionHandlers(ctx) {
       if (typeof cancelKey === "string" && cancelKey.startsWith("suite:")) cancels.set(cancelKey, cancels.get(command.id));
       let runId = null;
       try {
+        const keeping = reuseFor(command, project.id, source.readConfig());
         const outcome = await executeFlow({
           signal: aborter.signal,
+          ...keeping ? { reuse: keeping } : {},
           ...typeof command.args["headless"] === "boolean" ? { headless: command.args["headless"] } : {},
           ...command.args["repeat"] ? { repeat: Number(command.args["repeat"]) } : {},
           store: source,
@@ -8074,8 +8983,10 @@ function executionHandlers(ctx) {
       if (typeof cancelKey === "string" && cancelKey.startsWith("suite:")) cancels.set(cancelKey, cancels.get(command.id));
       let runId = null;
       try {
+        const keepingForCase = reuseFor(command, project.id, command.args["config"]);
         const { outcome, run } = await executeCase({
           testCase,
+          authentications: command.args["authentications"],
           projectId: project.id,
           config: command.args["config"] ?? {},
           secrets: command.args["secrets"] ?? {},
@@ -8083,6 +8994,7 @@ function executionHandlers(ctx) {
           ...storage ? { storage } : {},
           trigger: "ui",
           ...typeof command.args["headless"] === "boolean" ? { headless: command.args["headless"] } : {},
+          ...keepingForCase ? { reuse: keepingForCase } : {},
           signal: aborter.signal,
           onEvent: (event) => {
             const seen = event.runId;
@@ -8120,6 +9032,7 @@ function executionHandlers(ctx) {
       const cancelled = runId ? cancels.get(runId) : candidates.length === 1 ? candidates[0] : void 0;
       if (!cancelled || cancelled.projectId !== project.id) return { ok: false, reason: "failed", detail: `no run ${runId} is in progress on this machine` };
       cancelled.cancel();
+      authenticationReuse?.clear();
       return { ok: true, result: { runId, projectId: project.id, stopping: true } };
     }
   };
@@ -8151,6 +9064,11 @@ function recordingHandlers({ recorder, onActivity }) {
           // returned on stop for the service to commit to the repository. A
           // machine that has the project checked out still records into it.
           root,
+          ...command.args["authentication"] ? {
+            authentication: AuthReferenceSchema.parse(command.args["authentication"]),
+            authentications: command.args["authentications"],
+            secrets: command.args["secrets"] ?? {}
+          } : {},
           projectId: project.id,
           featureId,
           name,
@@ -8234,6 +9152,7 @@ function debuggingHandlers(ctx) {
           root: project.root,
           ...carried ? { delivered: {
             flow: carried,
+            authentications: command.args["authentications"],
             secrets: command.args["secrets"] ?? {},
             config: command.args["config"] ?? {}
           } } : {},
@@ -8274,6 +9193,7 @@ function debuggingHandlers(ctx) {
           ...carried ? {
             delivered: {
               flow: carried,
+              authentications: command.args["authentications"],
               secrets: command.args["secrets"] ?? {},
               config: command.args["config"] ?? {},
               scratchRoot: scratchRoot(project.id)
@@ -8342,7 +9262,11 @@ function buildHandlers(deps) {
     // A video is easily hundreds of megabytes, and nobody wants one pushed down
     // a control channel by accident.
     artifactLimit: deps.artifactLimitBytes ?? 25 * 1024 * 1024,
-    cancels: /* @__PURE__ */ new Map()
+    cancels: /* @__PURE__ */ new Map(),
+    // ONE PER RUNTIME, holding one suite's participants at a time. It never
+    // reaches disk and never outlives the process; a project that has not
+    // asked for reuse never puts anything in it.
+    authenticationReuse: deps.authenticationReuse ?? new AuthenticationReuse()
   };
   const debug = debuggingHandlers(context);
   return {
@@ -8399,6 +9323,7 @@ function createAgentRuntime(options) {
     lease,
     store: deliveredRun({
       flow: delivered.flow,
+      authentications: delivered.authentications,
       secrets: delivered.secrets,
       config: delivered.config
     }),
@@ -8476,9 +9401,11 @@ function createAgentRuntime(options) {
     },
     active: () => recordingIn?.active() ?? null
   };
+  const keptSignIns = new AuthenticationReuse();
   function buildAgent() {
     const handlers = buildHandlers({
       lease,
+      authenticationReuse: keptSignIns,
       storeFor: (r) => new Store(r),
       ...options.storage ? { storage: options.storage } : {},
       recorder,
@@ -8510,7 +9437,11 @@ function createAgentRuntime(options) {
       // drifts from what the agent can actually do is worse than none: it
       // would have the service dispatch work this build cannot perform, or
       // refuse work it can.
-      capabilities: Object.keys(handlers),
+      // Commands, and then the FEATURES this build supports inside commands
+      // it has always accepted. Named from the shared set rather than written
+      // out here, so an agent cannot claim a feature the service has no gate
+      // for, or miss one it has.
+      capabilities: [...Object.keys(handlers), ...AGENT_FEATURES],
       // EVERY checkout, each named by its own marker. One agent run serves
       // all of them; the service routes each command to the folder that is
       // the project it names.
@@ -8520,6 +9451,11 @@ function createAgentRuntime(options) {
   }
   const agent = buildAgent();
   journal = agent.journal;
+  const closeAgent = agent.close.bind(agent);
+  agent.close = () => {
+    closeAgent();
+    keptSignIns.clear();
+  };
   return agent;
 }