@skyramp/mcp 0.4.4 → 0.5.0-rc.10

package/build/utils/utils-verify/parse.d.ts

@@ -1,4 +1,5 @@
 import { type UtilsLanguageSpec } from "./language-spec.js";
+import { type ActionPattern } from "./action-key.js";
 import { type HelperSleep } from "./fixed-sleep.js";
 import { type SourceSpan } from "../pom-scope/strip.js";
 export interface HelperAssertion {
@@ -56,6 +57,9 @@ export interface UtilsHelper {
      *  step per entry, for the sibling scan that matches step by step. */
     actionKey?: string;
     actionSteps?: string[];
+    /** The sequence as the sibling scan matches it, a parameter-fed locator as a
+     *  wildcard (SKYR-4537). See actionPatternOf. */
+    actionPattern?: ActionPattern;
 }
 /** The declared parameters of a signature, raw text trimmed, empty entries dropped
  *  (a trailing comma). Reads the signature from the definition line to its body

package/build/utils/utils-verify/parse.js

@@ -1,5 +1,5 @@
 import { normalizePath } from "./language-spec.js";
-import { actionStepKeys, actionStepsOf, } from "./action-key.js";
+import { actionPatternOf, actionStepKeys, actionStepsOf, } from "./action-key.js";
 /** A helper's action steps and their joined key, read once from its body. */
 function actionSequence(body, language) {
     const steps = actionStepsOf(body, language);
@@ -282,6 +282,7 @@ export function parseUtilsFile(content, spec) {
             // Comments blanked, strings kept: a commented-out click is not a step, and
             // the selector literals are the key.
             ...actionSequence(blankComments(body.join("\n"), spec), spec.language),
+            actionPattern: actionPatternOf(blankComments(body.join("\n"), spec), spec.language, params ?? []),
         };
         let requests = 0;
         for (let k = 0; k < body.length; k++) {

package/build/utils/versions.d.ts

@@ -1,4 +1,4 @@
-export declare const SKYRAMP_IMAGE_VERSION = "v1.3.50";
-export declare const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.50";
-export declare const WORKER_DOCKER_IMAGE = "skyramp/worker:v1.3.50";
+export declare const SKYRAMP_IMAGE_VERSION = "v1.3.53";
+export declare const EXECUTOR_DOCKER_IMAGE = "skyramp/executor:v1.3.53";
+export declare const WORKER_DOCKER_IMAGE = "skyramp/worker:v1.3.53";
 export declare const WORKER_CONTROL_PORT = 35142;

package/build/utils/versions.js

@@ -1,4 +1,4 @@
-export const SKYRAMP_IMAGE_VERSION = "v1.3.50";
+export const SKYRAMP_IMAGE_VERSION = "v1.3.53";
 export const EXECUTOR_DOCKER_IMAGE = `skyramp/executor:${SKYRAMP_IMAGE_VERSION}`;
 export const WORKER_DOCKER_IMAGE = `skyramp/worker:${SKYRAMP_IMAGE_VERSION}`;
 // Control port the Skyramp worker listens on (SDK `CONTAINER_PORT`).

package/build/workspace/workspace.d.ts

@@ -5,24 +5,8 @@ export { SUPPORTED_FRAMEWORKS } from "./frameworks.js";
 export declare const serviceSchema: z.ZodObject<{
     serviceName: z.ZodString;
     repository: z.ZodOptional<z.ZodString>;
-    language: z.ZodOptional<z.ZodEnum<{
-        python: "python";
-        typescript: "typescript";
-        javascript: "javascript";
-        java: "java";
-    }>>;
-    framework: z.ZodOptional<z.ZodEnum<{
-        playwright: "playwright";
-        pytest: "pytest";
-        robot: "robot";
-        junit: "junit";
-        vitest: "vitest";
-        jest: "jest";
-        mocha: "mocha";
-        go: "go";
-        rspec: "rspec";
-        jasmine: "jasmine";
-    }>>;
+    language: z.ZodOptional<z.ZodString>;
+    framework: z.ZodOptional<z.ZodString>;
     testDirectory: z.ZodOptional<z.ZodString>;
     api: z.ZodOptional<z.ZodObject<{
         schemaPath: z.ZodOptional<z.ZodString>;
@@ -46,49 +30,30 @@ export declare const serviceSchema: z.ZodObject<{
         baseUrl: z.ZodOptional<z.ZodString>;
         skipTLSVerify: z.ZodOptional<z.ZodBoolean>;
     }, z.core.$strict>>;
-    runtimeDetails: z.ZodOptional<z.ZodObject<{
+    runtimeDetails: z.ZodOptional<z.ZodPipe<z.ZodObject<{
         serverStartCommand: z.ZodOptional<z.ZodString>;
         serverStopCommand: z.ZodOptional<z.ZodString>;
         runtime: z.ZodPreprocess<z.ZodEnum<typeof import("../types/TestTypes.js").RuntimeEnvironment>, unknown>;
         dockerNetwork: z.ZodOptional<z.ZodString>;
         k8sNamespace: z.ZodOptional<z.ZodString>;
         k8sContext: z.ZodOptional<z.ZodString>;
-        testSuites: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodObject<{
-            framework: z.ZodOptional<z.ZodEnum<{
-                playwright: "playwright";
-                pytest: "pytest";
-                robot: "robot";
-                junit: "junit";
-                vitest: "vitest";
-                jest: "jest";
-                mocha: "mocha";
-                go: "go";
-                rspec: "rspec";
-                jasmine: "jasmine";
-            }>>;
-            testRunCommand: z.ZodString;
-            pathGlobs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-            canaryStatus: z.ZodOptional<z.ZodEnum<{
-                proven: "proven";
-                unproven: "unproven";
-            }>>;
-            canaryDetail: z.ZodOptional<z.ZodString>;
-            testEnv: z.ZodOptional<z.ZodUnknown>;
-        }, z.core.$strict>, z.ZodTransform<{
-            testRunCommand: string;
-            framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
-            pathGlobs?: string[] | undefined;
-            canaryStatus?: "proven" | "unproven" | undefined;
-            canaryDetail?: string | undefined;
-        }, {
-            testRunCommand: string;
-            framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
-            pathGlobs?: string[] | undefined;
-            canaryStatus?: "proven" | "unproven" | undefined;
-            canaryDetail?: string | undefined;
-            testEnv?: unknown;
-        }>>>>;
-    }, z.core.$strict>>;
+        testSuites: z.ZodOptional<z.ZodUnknown>;
+    }, z.core.$strict>, z.ZodTransform<{
+        runtime: import("../types/TestTypes.js").RuntimeEnvironment;
+        serverStartCommand?: string | undefined;
+        serverStopCommand?: string | undefined;
+        dockerNetwork?: string | undefined;
+        k8sNamespace?: string | undefined;
+        k8sContext?: string | undefined;
+    }, {
+        runtime: import("../types/TestTypes.js").RuntimeEnvironment;
+        serverStartCommand?: string | undefined;
+        serverStopCommand?: string | undefined;
+        dockerNetwork?: string | undefined;
+        k8sNamespace?: string | undefined;
+        k8sContext?: string | undefined;
+        testSuites?: unknown;
+    }>>>;
 }, z.core.$strict>;
 export declare const workspaceConfigSchema: z.ZodObject<{
     workspace: z.ZodOptional<z.ZodObject<{
@@ -102,27 +67,19 @@ export declare const workspaceConfigSchema: z.ZodObject<{
         createdAt: z.ZodOptional<z.ZodString>;
         updatedAt: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
+    dataSafety: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodEnum<{
+            readonly: "readonly";
+            strict: "strict";
+            off: "off";
+        }>>;
+        offLimits: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strict>>;
     services: z.ZodOptional<z.ZodArray<z.ZodObject<{
         serviceName: z.ZodString;
         repository: z.ZodOptional<z.ZodString>;
-        language: z.ZodOptional<z.ZodEnum<{
-            python: "python";
-            typescript: "typescript";
-            javascript: "javascript";
-            java: "java";
-        }>>;
-        framework: z.ZodOptional<z.ZodEnum<{
-            playwright: "playwright";
-            pytest: "pytest";
-            robot: "robot";
-            junit: "junit";
-            vitest: "vitest";
-            jest: "jest";
-            mocha: "mocha";
-            go: "go";
-            rspec: "rspec";
-            jasmine: "jasmine";
-        }>>;
+        language: z.ZodOptional<z.ZodString>;
+        framework: z.ZodOptional<z.ZodString>;
         testDirectory: z.ZodOptional<z.ZodString>;
         api: z.ZodOptional<z.ZodObject<{
             schemaPath: z.ZodOptional<z.ZodString>;
@@ -146,55 +103,35 @@ export declare const workspaceConfigSchema: z.ZodObject<{
             baseUrl: z.ZodOptional<z.ZodString>;
             skipTLSVerify: z.ZodOptional<z.ZodBoolean>;
         }, z.core.$strict>>;
-        runtimeDetails: z.ZodOptional<z.ZodObject<{
+        runtimeDetails: z.ZodOptional<z.ZodPipe<z.ZodObject<{
             serverStartCommand: z.ZodOptional<z.ZodString>;
             serverStopCommand: z.ZodOptional<z.ZodString>;
             runtime: z.ZodPreprocess<z.ZodEnum<typeof import("../types/TestTypes.js").RuntimeEnvironment>, unknown>;
             dockerNetwork: z.ZodOptional<z.ZodString>;
             k8sNamespace: z.ZodOptional<z.ZodString>;
             k8sContext: z.ZodOptional<z.ZodString>;
-            testSuites: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodObject<{
-                framework: z.ZodOptional<z.ZodEnum<{
-                    playwright: "playwright";
-                    pytest: "pytest";
-                    robot: "robot";
-                    junit: "junit";
-                    vitest: "vitest";
-                    jest: "jest";
-                    mocha: "mocha";
-                    go: "go";
-                    rspec: "rspec";
-                    jasmine: "jasmine";
-                }>>;
-                testRunCommand: z.ZodString;
-                pathGlobs: z.ZodOptional<z.ZodArray<z.ZodString>>;
-                canaryStatus: z.ZodOptional<z.ZodEnum<{
-                    proven: "proven";
-                    unproven: "unproven";
-                }>>;
-                canaryDetail: z.ZodOptional<z.ZodString>;
-                testEnv: z.ZodOptional<z.ZodUnknown>;
-            }, z.core.$strict>, z.ZodTransform<{
-                testRunCommand: string;
-                framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
-                pathGlobs?: string[] | undefined;
-                canaryStatus?: "proven" | "unproven" | undefined;
-                canaryDetail?: string | undefined;
-            }, {
-                testRunCommand: string;
-                framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
-                pathGlobs?: string[] | undefined;
-                canaryStatus?: "proven" | "unproven" | undefined;
-                canaryDetail?: string | undefined;
-                testEnv?: unknown;
-            }>>>>;
-        }, z.core.$strict>>;
+            testSuites: z.ZodOptional<z.ZodUnknown>;
+        }, z.core.$strict>, z.ZodTransform<{
+            runtime: import("../types/TestTypes.js").RuntimeEnvironment;
+            serverStartCommand?: string | undefined;
+            serverStopCommand?: string | undefined;
+            dockerNetwork?: string | undefined;
+            k8sNamespace?: string | undefined;
+            k8sContext?: string | undefined;
+        }, {
+            runtime: import("../types/TestTypes.js").RuntimeEnvironment;
+            serverStartCommand?: string | undefined;
+            serverStopCommand?: string | undefined;
+            dockerNetwork?: string | undefined;
+            k8sNamespace?: string | undefined;
+            k8sContext?: string | undefined;
+            testSuites?: unknown;
+        }>>>;
     }, z.core.$strict>>>;
 }, z.core.$strict>;
 export type Service = z.infer<typeof serviceSchema>;
 export type ServiceApi = NonNullable<Service["api"]>;
 export type ServiceRuntimeDetails = NonNullable<Service["runtimeDetails"]>;
-export type TestSuite = NonNullable<ServiceRuntimeDetails["testSuites"]>[number];
 export type WorkspaceConfig = z.infer<typeof workspaceConfigSchema>;
 export type WorkspaceSection = NonNullable<WorkspaceConfig["workspace"]>;
 export type MetadataSection = NonNullable<WorkspaceConfig["metadata"]>;
@@ -211,11 +148,15 @@ export declare function validateWorkspaceConfig(config: unknown): z.ZodSafeParse
         createdAt?: string | undefined;
         updatedAt?: string | undefined;
     } | undefined;
+    dataSafety?: {
+        mode?: "readonly" | "strict" | "off" | undefined;
+        offLimits?: string[] | undefined;
+    } | undefined;
     services?: {
         serviceName: string;
         repository?: string | undefined;
-        language?: "python" | "typescript" | "javascript" | "java" | undefined;
-        framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
+        language?: string | undefined;
+        framework?: string | undefined;
         testDirectory?: string | undefined;
         api?: {
             schemaPath?: string | undefined;
@@ -237,13 +178,6 @@ export declare function validateWorkspaceConfig(config: unknown): z.ZodSafeParse
             dockerNetwork?: string | undefined;
             k8sNamespace?: string | undefined;
             k8sContext?: string | undefined;
-            testSuites?: {
-                testRunCommand: string;
-                framework?: "playwright" | "pytest" | "robot" | "junit" | "vitest" | "jest" | "mocha" | "go" | "rspec" | "jasmine" | undefined;
-                pathGlobs?: string[] | undefined;
-                canaryStatus?: "proven" | "unproven" | undefined;
-                canaryDetail?: string | undefined;
-            }[] | undefined;
         } | undefined;
     }[] | undefined;
 }>;
@@ -273,9 +207,17 @@ export declare class WorkspaceConfigManager {
     /**
      * Initialize workspace — creates .skyramp/workspace.yml with repo info.
      * Auto-detects repoName and repoUrl from git when not provided.
-     * Produces an empty services array and default metadata timestamps.
+     * Produces an empty services array and default metadata timestamps. Over an
+     * existing file it keeps that file's createdAt: the workspace was created
+     * then, however often it is rewritten.
      */
     initialize(workspaceInfo?: WorkspaceSection): Promise<WorkspaceConfig>;
+    /**
+     * The existing file's metadata.createdAt, read leniently: a rewrite is often
+     * the repair of a file that no longer validates, and its createdAt still
+     * stands. Undefined when there is no file or it records none.
+     */
+    private existingCreatedAt;
     /**
      * Update the metadata section of an existing workspace config.
      * Only the provided fields are merged; metadata.updatedAt is refreshed

package/build/workspace/workspace.js

@@ -14,7 +14,6 @@ import { execFile } from "child_process";
 import { promisify } from "util";
 import yaml from "js-yaml";
 import { z } from "zod";
-import { SUPPORTED_FRAMEWORKS } from "./frameworks.js";
 import { runtimeEnvironmentInputSchema } from "../types/TestTypes.js";
 import { parseOwnerRepo } from "../utils/repositorySlug.js";
 const execFileAsync = promisify(execFile);
@@ -23,8 +22,8 @@ const execFileAsync = promisify(execFile);
 // ---------------------------------------------------------------------------
 export const WORKSPACE_DIR = ".skyramp";
 export const WORKSPACE_FILENAME = "workspace.yml";
-// SUPPORTED_FRAMEWORKS lives in the dependency-free ./frameworks module (imported
-// above for the schema below) and is re-exported here for existing importers.
+// SUPPORTED_FRAMEWORKS lives in the dependency-free ./frameworks module and is
+// re-exported here for existing importers.
 export { SUPPORTED_FRAMEWORKS } from "./frameworks.js";
 // ---------------------------------------------------------------------------
 // Zod schemas (source of truth — types are inferred from these below)
@@ -32,12 +31,14 @@ export { SUPPORTED_FRAMEWORKS } from "./frameworks.js";
 export const serviceSchema = z
     .object({
     serviceName: z.string(),
-    // owner/repo this service belongs to (multi-repo workspaces). Absent → the
+    // owner/repo (org/project/repo on Azure DevOps) this service belongs to (multi-repo workspaces). Absent → the
     // primary repo. Service identity is the composite (repository, serviceName),
     // so the same serviceName can appear once per repo without colliding.
     repository: z.string().optional(),
-    language: z.enum(["python", "typescript", "javascript", "java"]).optional(),
-    framework: z.enum(SUPPORTED_FRAMEWORKS).optional(),
+    // Any language and test framework, as the repository names them: the scan is
+    // language- and framework-agnostic.
+    language: z.string().optional(),
+    framework: z.string().optional(),
     testDirectory: z.string().optional(),
     api: z
         .object({
@@ -105,49 +106,13 @@ export const serviceSchema = z
         dockerNetwork: z.string().optional(),
         k8sNamespace: z.string().optional(),
         k8sContext: z.string().optional(),
-        // External-suite test contract (SKYR-4002). A service hosts one or more
-        // runnable suites — record each under testSuites, even a single suite
-        // (there is no flat single-suite form). Written by the SUT adapt_workflow
-        // bootstrap (skyramp_testbot_sut). Each suite carries its own framework
-        // (falling back to the service's), testRunCommand, and pathGlobs
-        // — the repo-relative paths that suite owns, which the agent reads to find
-        // the suite of a test file. One service can host multiple frameworks.
-        testSuites: z
-            .array(
-        // A workspace.yml written before testEnv was removed still loads: the
-        // key is accepted and then dropped, so the next write leaves it out.
-        z
-            .object({
-            framework: z.enum(SUPPORTED_FRAMEWORKS).optional(),
-            testRunCommand: z.string().min(1),
-            pathGlobs: z.array(z.string()).optional(),
-            // Did SUT setup actually run one test from this suite?
-            //
-            // "Is the environment proven" and "should maintenance work on this
-            // suite" are independent, and collapsing them costs one way or the
-            // other. The prompt used to make recording free, so a suite could
-            // read as covered while never having executed. Requiring proof
-            // instead would drop exactly the suite a user most wants
-            // maintained: a self-provisioning e2e suite whose substrate the
-            // setup cannot stand up. Run 30402703836 shows why that trade is
-            // bad — with its Playwright environment dead, static analysis
-            // still found the stale POM testid and fixed it correctly.
-            //
-            // So an unproven suite STAYS and is still maintained; this records
-            // that its environment was never validated, and canaryDetail says
-            // what it needs. Absent means unproven (older artifacts predate
-            // this field), which is the safe reading.
-            canaryStatus: z.enum(["proven", "unproven"]).optional(),
-            /** Why it could not be proven — required by the prompt when unproven. */
-            canaryDetail: z.string().optional(),
-            // Accepted only so an older file parses; the transform removes it.
-            testEnv: z.unknown().optional(),
-        })
-            .strict()
-            .transform(({ testEnv: _testEnv, ...rest }) => rest))
-            .optional(),
+        // Deprecated: testSuites (with its pathGlobs) is no longer recorded or read.
+        // A workspace.yml that still has it loads; the key is dropped, so the next
+        // write leaves it out.
+        testSuites: z.unknown().optional(),
     })
         .strict()
+        .transform(({ testSuites: _testSuites, ...rest }) => rest)
         .optional(),
 })
     .strict();
@@ -174,6 +139,16 @@ export const workspaceConfigSchema = z
     })
         .strict()
         .optional(),
+    /** Data safety for UI recording: scratch-entity discipline mode and
+     *  customer off-limits URL patterns. Consumed by the Playwright trace
+     *  backend and by testbot's config resolution. */
+    dataSafety: z
+        .object({
+        mode: z.enum(["strict", "readonly", "off"]).optional(),
+        offLimits: z.array(z.string()).optional(),
+    })
+        .strict()
+        .optional(),
     services: z.array(serviceSchema).optional(),
 })
     .strict();
@@ -346,13 +321,18 @@ export class WorkspaceConfigManager {
     /**
      * Initialize workspace — creates .skyramp/workspace.yml with repo info.
      * Auto-detects repoName and repoUrl from git when not provided.
-     * Produces an empty services array and default metadata timestamps.
+     * Produces an empty services array and default metadata timestamps. Over an
+     * existing file it keeps that file's createdAt: the workspace was created
+     * then, however often it is rewritten.
      */
     async initialize(workspaceInfo = {}) {
         await fs.mkdir(this.skyrampDir, { recursive: true });
         // Auto-detect repo info from workspace root when not explicitly provided
         const detected = await detectRepoInfo(this.workspacePath);
         const config = createDefaultConfig();
+        const createdAt = await this.existingCreatedAt();
+        if (createdAt && config.metadata)
+            config.metadata.createdAt = createdAt;
         config.workspace = {
             repoName: workspaceInfo.repoName || detected.repoName || undefined,
             repoUrl: workspaceInfo.repoUrl || detected.repoUrl || undefined,
@@ -361,6 +341,23 @@ export class WorkspaceConfigManager {
         await writeWorkspaceFile(this.configPath, validated);
         return validated;
     }
+    /**
+     * The existing file's metadata.createdAt, read leniently: a rewrite is often
+     * the repair of a file that no longer validates, and its createdAt still
+     * stands. Undefined when there is no file or it records none.
+     */
+    async existingCreatedAt() {
+        try {
+            const doc = yaml.load(await fs.readFile(this.configPath, "utf8"));
+            const createdAt = doc?.metadata?.createdAt;
+            return typeof createdAt === "string" && createdAt.trim()
+                ? createdAt
+                : undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
     /**
      * Update the metadata section of an existing workspace config.
      * Only the provided fields are merged; metadata.updatedAt is refreshed

package/build/workspace/workspaceVerifier.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Verifies the services written to .skyramp/workspace.yml against the rules
+ * the scan instructions state and that a file can show deterministically:
+ * service identity, runtime fields and API addressing and auth.
+ * skyramp_init_workspace refuses a write that breaks one, and the SUT eval runs
+ * it on the file a run produced. It reports only what is certainly wrong.
+ */
+import type { Service } from "./workspace.js";
+/** A repository of the Target other than the workspace's own. */
+export interface VerifierRepository {
+    repository: string;
+    repositoryPath: string;
+}
+export interface WorkspaceVerifierOptions {
+    /** The workspace's own repository root, where a service with no `repository` lives. */
+    workspacePath: string;
+    /** The other repositories the scan named. When given, every service's
+     *  `repository` is one of them. */
+    relatedRepositories?: VerifierRepository[];
+}
+/** Every problem with `services`, one line each, naming the service and the fix. */
+export declare function verifyWorkspaceServices(services: readonly Service[], opts: WorkspaceVerifierOptions): string[];

package/build/workspace/workspaceVerifier.js

@@ -0,0 +1,65 @@
+/**
+ * Verifies the services written to .skyramp/workspace.yml against the rules
+ * the scan instructions state and that a file can show deterministically:
+ * service identity, runtime fields and API addressing and auth.
+ * skyramp_init_workspace refuses a write that breaks one, and the SUT eval runs
+ * it on the file a run produced. It reports only what is certainly wrong.
+ */
+import { isRepositorySlug } from "../utils/repositorySlug.js";
+/** Every problem with `services`, one line each, naming the service and the fix. */
+export function verifyWorkspaceServices(services, opts) {
+    const issues = [];
+    const related = opts.relatedRepositories;
+    const seen = new Set();
+    for (const service of services) {
+        const name = service.serviceName;
+        const where = service.repository ? `${service.repository}/${name}` : name;
+        const key = `${service.repository ?? ""}\u0000${name}`;
+        if (seen.has(key))
+            issues.push(`${where}: listed twice. Each (repository, serviceName) pair is one service; merge the entries.`);
+        seen.add(key);
+        if (service.repository !== undefined) {
+            if (!isRepositorySlug(service.repository))
+                issues.push(`${where}: repository "${service.repository}" is not owner/repo, or org/project/repo on Azure DevOps.`);
+            else if (related?.length &&
+                !related.some((r) => r.repository.toLowerCase() === service.repository.toLowerCase()))
+                issues.push(`${where}: repository "${service.repository}" is not one the scan named (${related.map((r) => r.repository).join(", ")}). Set it to the repository the service was found in, or leave it out for the workspace's own repository.`);
+        }
+        issues.push(...runtimeIssues(service, where));
+        issues.push(...apiIssues(service, where));
+    }
+    return issues;
+}
+function runtimeIssues(service, where) {
+    const issues = [];
+    const rt = service.runtimeDetails;
+    if (!rt)
+        return issues;
+    const runtime = rt.runtime;
+    if (runtime !== "docker" && rt.dockerNetwork)
+        issues.push(`${where}: dockerNetwork is set only for runtime docker; remove it.`);
+    if (runtime !== "k8s" && (rt.k8sNamespace || rt.k8sContext))
+        issues.push(`${where}: k8sNamespace and k8sContext are set only for runtime k8s; remove them.`);
+    return issues;
+}
+function apiIssues(service, where) {
+    const issues = [];
+    const api = service.api;
+    if (!api)
+        return issues;
+    if (api.baseUrl !== undefined) {
+        let ok = false;
+        try {
+            const url = new URL(api.baseUrl);
+            ok = url.protocol === "http:" || url.protocol === "https:";
+        }
+        catch {
+            ok = false;
+        }
+        if (!ok)
+            issues.push(`${where}: api.baseUrl "${api.baseUrl}" is not an absolute http(s) URL.`);
+    }
+    if (api.authType === "apiKey" && !api.authHeader?.trim())
+        issues.push(`${where}: authType apiKey needs authHeader, the header that carries the key. If it cannot be found, use authType none.`);
+    return issues;
+}

package/node_modules/playwright/lib/dom-analyzer/blueprint.js

@@ -595,7 +595,7 @@ async function domEvaluationScript(options) {
     }
     return key;
   }
-  function isDynamicIdClient(id) {
+  function isDynamicIdClient(id, kinds) {
     if (/^react-aria\d+/.test(id)) return true;
     if (/^mui-\d+/.test(id)) return true;
     if (/^(mat|cdk)-[a-z]+-\d+$/.test(id)) return true;
@@ -604,9 +604,10 @@ async function domEvaluationScript(options) {
     if (/^\d+$/.test(id)) return true;
     if (/\d{4,}$/.test(id)) return true;
     if (/[-_][0-9a-f]{6,}$/i.test(id)) return true;
-    const m = id.match(/[-_]([0-9a-f]{3,5})$/i);
-    if (m && /[0-9]/.test(m[1])) return true;
-    if (/[a-zA-Z][0-9]{3,}$/.test(id)) return true;
+    const m = id.match(/^(.*?)[-_]([0-9a-f]{3,5})$/i);
+    if (m && (/[0-9]/.test(m[2]) || m[2].length >= 4 && kinds?.includes(m[1].toLowerCase()))) return true;
+    const counter = id.match(/^(.*?[a-zA-Z])([0-9]+)$/);
+    if (counter && (counter[2].length >= 3 || kinds?.includes(counter[1].toLowerCase()))) return true;
     if (id.includes(":")) return true;
     if (/«r[0-9a-z]*»|(^|[-_])_?r_[0-9a-z]+_/.test(id)) return true;
     if (/^.+__search_[a-zA-Z0-9]{4,}$/.test(id)) return true;
@@ -627,7 +628,7 @@ async function domEvaluationScript(options) {
         const ancestorTestId = resolveTestId(cur);
         if (ancestorTestId) return ancestorTestId.value;
         const id = cur.getAttribute("id");
-        if (id && !isDynamicIdClient(id)) return id;
+        if (id && !isDynamicIdClient(id, [cur.localName, getRole(cur).role])) return id;
       }
       cur = cur.parentElement;
       depth++;
@@ -845,7 +846,7 @@ async function domEvaluationScript(options) {
     const idAttr = el.getAttribute("id");
     const resolvedTestId = resolveTestId(el);
     const fingerprint = widgetType === "native" ? null : await computeElementFingerprint(el);
-    const stableIdValue = idAttr && idUnique(idAttr) && !isDynamicIdClient(idAttr) ? idAttr : null;
+    const stableIdValue = idAttr && idUnique(idAttr) && !isDynamicIdClient(idAttr, [el.localName, role]) ? idAttr : null;
     return {
       role,
       accessibleName,

package/node_modules/playwright/lib/dom-analyzer/dynamicId.js

@@ -21,7 +21,7 @@ __export(dynamicId_exports, {
   isDynamicId: () => isDynamicId
 });
 module.exports = __toCommonJS(dynamicId_exports);
-function isDynamicId(id) {
+function isDynamicId(id, kinds) {
   if (/^react-aria\d+/.test(id)) return true;
   if (/^mui-\d+/.test(id)) return true;
   if (/^(mat|cdk)-[a-z]+-\d+$/.test(id)) return true;
@@ -30,9 +30,10 @@ function isDynamicId(id) {
   if (/^\d+$/.test(id)) return true;
   if (/\d{4,}$/.test(id)) return true;
   if (/[-_][0-9a-f]{6,}$/i.test(id)) return true;
-  const shortHexMatch = id.match(/[-_]([0-9a-f]{3,5})$/i);
-  if (shortHexMatch && /[0-9]/.test(shortHexMatch[1])) return true;
-  if (/[a-zA-Z][0-9]{3,}$/.test(id)) return true;
+  const shortHexMatch = id.match(/^(.*?)[-_]([0-9a-f]{3,5})$/i);
+  if (shortHexMatch && (/[0-9]/.test(shortHexMatch[2]) || shortHexMatch[2].length >= 4 && kinds?.includes(shortHexMatch[1].toLowerCase()))) return true;
+  const counterMatch = id.match(/^(.*?[a-zA-Z])([0-9]+)$/);
+  if (counterMatch && (counterMatch[2].length >= 3 || kinds?.includes(counterMatch[1].toLowerCase()))) return true;
   if (id.includes(":")) return true;
   if (/«r[0-9a-z]*»|(^|[-_])_?r_[0-9a-z]+_/.test(id)) return true;
   if (/^.+__search_[a-zA-Z0-9]{4,}$/.test(id)) return true;

package/node_modules/playwright/lib/dom-analyzer/dynamicId.test.js

@@ -71,6 +71,18 @@ test("isDynamicId: React 19 useId forms", () => {
   assertTrue((0, import_dynamicId.isDynamicId)("_r_1k_"), "_r_1k_ (bare React 19.1)");
   assertFalse((0, import_dynamicId.isDynamicId)("user_r_name"), "user_r_name (word, not a useId)");
 });
+test("isDynamicId: the element's own kind plus a counter or short hash", () => {
+  assertTrue((0, import_dynamicId.isDynamicId)("input-cbcc", ["input", "textbox"]), "input-cbcc on an input");
+  assertTrue((0, import_dynamicId.isDynamicId)("checkbox7", ["input", "checkbox"]), "checkbox7 on a checkbox");
+  assertTrue((0, import_dynamicId.isDynamicId)("textbox-fdda", ["input", "textbox"]), "textbox-fdda on a textbox");
+  assertFalse((0, import_dynamicId.isDynamicId)("input-cbcc"), "input-cbcc without the element: a word-like suffix");
+  assertFalse((0, import_dynamicId.isDynamicId)("checkbox7"), "checkbox7 without the element: below the 3-digit threshold");
+  assertFalse((0, import_dynamicId.isDynamicId)("news-feed", ["input", "textbox"]), "news-feed: authored stem");
+  assertFalse((0, import_dynamicId.isDynamicId)("option2", ["input", "checkbox"]), "option2: stem is not the element kind");
+  assertFalse((0, import_dynamicId.isDynamicId)("IDToken2", ["input", "textbox"]), "IDToken2: authored stem");
+  assertFalse((0, import_dynamicId.isDynamicId)("password-login", ["input", "textbox"]), "password-login");
+  assertFalse((0, import_dynamicId.isDynamicId)("button-add", ["button"]), "button-add: 3 letters stay a word");
+});
 let failed = 0;
 for (const { name, run } of cases) {
   try {