@validate.qa/runner 1.0.100 → 1.0.101

package/dist/run-write-guard.js

@@ -3027,7 +3027,7 @@ function unescapeQuotedBody(raw) {
   return raw.replace(/\\(['"`\\])/g, "$1");
 }
 function extractRoleNameValue(line) {
-  const m = line.match(new RegExp(`getByRole\\s*\\([^,]+,\\s*\\{[^}]*name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
+  const m = line.match(new RegExp(`getByRole\\s*\\([^,]{1,200},\\s*\\{[^}]{0,200}?name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
   if (!m)
     return null;
   const raw = m[1] ?? m[2] ?? m[3];
@@ -3735,6 +3735,8 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
+  let prev = "";
+  let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
     if (quote) {
@@ -3742,12 +3744,24 @@ function stripCoverageComments(code) {
         i += 2;
         continue;
       }
-      if (ch === quote || ch === "\n" && quote !== "`")
+      if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
+        prev = ch === "\n" ? prev : ch;
+      }
       i++;
       continue;
     }
     const next = code[i + 1];
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+      const end = regexLiteralEnd3(code, i);
+      if (end > 0) {
+        i = end;
+        prev = "a";
+        continue;
+      }
+      const eol = code.indexOf("\n", i);
+      noRegexBefore = eol === -1 ? code.length : eol;
+    }
     if (ch === "/" && next === "*") {
       const end = code.indexOf("*/", i + 2);
       const stop = end === -1 ? code.length : end + 2;
@@ -3766,11 +3780,39 @@ function stripCoverageComments(code) {
     }
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
+      prev = ch;
     i++;
   }
   out.push(code.slice(copyFrom));
   return out.join("");
 }
+function regexLiteralEnd3(code, start) {
+  let inClass = false;
+  for (let j = start + 1; j < code.length; j++) {
+    const c = code[j];
+    if (c === "\n")
+      return -1;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]")
+        inClass = false;
+      continue;
+    }
+    if (c === "[")
+      inClass = true;
+    else if (c === "/") {
+      let k = j + 1;
+      while (k < code.length && isIdentChar(code[k]))
+        k++;
+      return k;
+    }
+  }
+  return -1;
+}
 function isIdentChar(ch) {
   if (!ch)
     return false;
@@ -4428,7 +4470,7 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
@@ -4465,6 +4507,7 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
+    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -4915,7 +4958,7 @@ function detectsErrorBannerAssertion(code) {
   const cleaned = stripCommentsAndLogs(stripLoginScaffolding(code));
   const lines = cleaned.split("\n");
   const candidates = [];
-  const positive = (stmt) => !NEGATED_ASSERT.test(stmt) && !ABSENCE_MATCHER.test(stmt);
+  const positive = (stmt) => !claimsAbsence(stmt);
   const statements = liveExpectStatements(cleaned).map((s) => s.stmt);
   for (const stmt of statements) {
     if (positive(stmt))
@@ -5044,6 +5087,12 @@ function detectsObservedFailureAsExpected(code) {
     return FAILURE_STATUS_ASSERT.some((re) => re.test(stmt)) || hasFailedListener && FAILED_LIST_ASSERT.test(stmt);
   });
 }
+function claimsAbsence(stmt) {
+  const negated = NEGATED_ASSERT_NOT.test(stmt);
+  const bare = negated ? stmt.replace(NOT_BEFORE_MATCHER, ".") : stmt;
+  const absenceMatcher = /\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+  return negated !== absenceMatcher;
+}
 function isVacuousErrorAbsence(stmt, presence) {
   if (!ABSENCE_MATCHER.test(stmt))
     return false;
@@ -5059,19 +5108,53 @@ function isChromeTarget(stmt) {
   return CHROME_LOCATOR.test(stmt) && !CONTENT_ROLE.test(stmt) && !/getByText\s*\(/.test(stmt);
 }
 function countsAsContentText(stmt) {
-  if (!TEXT_CONTENT_MATCHER.test(stmt))
+  if (!TEXT_CONTENT_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt))
     return false;
   if (isSymbolOnlyArgument(stmt, TEXT_CONTENT_MATCHER))
     return false;
-  if (!isChromeTarget(stmt))
+  return onContentTarget(stmt);
+}
+function onContentTarget(stmt) {
+  return !isChromeTarget(stmt) || /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+}
+function provesTextRemoved(stmt, presence) {
+  const m = stmt.match(NEGATED_TEXT);
+  if (!m || !onContentTarget(stmt))
+    return false;
+  const text = m[1] ?? m[2];
+  if (text === void 0)
     return true;
-  return /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+  if (!/[\p{L}\p{N}]/u.test(text))
+    return false;
+  return !ERROR_TEXT_WORDS.test(text) || presence().includes(text);
 }
 function isDataContentRole(stmt) {
   return CONTENT_ROLE.test(stmt) && !ANNOUNCE_ROLE.test(stmt);
 }
+function destructuresRequest(code) {
+  let readTo = -1;
+  for (const m of code.matchAll(ASYNC_DESTRUCTURE_OPEN)) {
+    const start = m.index + m[0].length;
+    if (start <= readTo)
+      continue;
+    let end = start;
+    while (end < code.length && code[end] !== "}" && code[end] !== ")")
+      end++;
+    readTo = end;
+    if (end === code.length)
+      return false;
+    if (code[end] !== "}" || !REQUEST_WORD.test(code.slice(start, end)))
+      continue;
+    let close = end + 1;
+    while (close < code.length && /\s/.test(code[close]))
+      close++;
+    if (code[close] === ")")
+      return true;
+  }
+  return false;
+}
 function isApiTest(code) {
-  const usesRequestFixture = /async\s*\(\s*\{[^})]*\brequest\b[^})]*\}\s*\)/.test(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
+  const usesRequestFixture = destructuresRequest(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
   if (!usesRequestFixture)
     return false;
   const drivesUi = /\bpage\.(getBy\w+|locator|click|fill|goto|waitForURL|reload)\s*\(/.test(code) || /\.(click|fill|check|uncheck|selectOption|pressSequentially)\s*\(/.test(code);
@@ -5330,6 +5413,9 @@ function hasOnlyConstantAssertions(code) {
   const { constant, real } = constantAssertions(code);
   return constant.length > 0 && real === 0;
 }
+function envValueKey(name) {
+  return `\0env:${name}`;
+}
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
@@ -5338,24 +5424,55 @@ function enteredValues(stmts) {
       navLines.push(startLine);
     let m;
     ENTERED_VALUE.lastIndex = 0;
-    while (m = ENTERED_VALUE.exec(stmt)) {
-      const value = (m[1] ?? m[2] ?? m[3]).toLowerCase();
-      if (!values.has(value))
-        values.set(value, startLine);
-    }
+    const add = (value) => {
+      const lines = values.get(value);
+      if (!lines)
+        values.set(value, [startLine]);
+      else if (lines[lines.length - 1] !== startLine)
+        lines.push(startLine);
+    };
+    while (m = ENTERED_VALUE.exec(stmt))
+      add((m[1] ?? m[2] ?? m[3]).toLowerCase());
+    ENTERED_ENV.lastIndex = 0;
+    while (m = ENTERED_ENV.exec(stmt))
+      add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
   return { values, navLines };
 }
-function isEnteredValueEcho(stmt, entered, startLine) {
+function countBelow(lines, line) {
+  let lo = 0;
+  let hi = lines.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lines[mid] < line)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function enteredLinesOf(stmt, entered) {
   const m = stmt.match(/\.toHaveValue\s*\(\s*(['"`])((?:(?!\1).)+)\1/);
-  if (!m)
+  if (m)
+    return entered.values.get(m[2].toLowerCase());
+  const env = stmt.match(HAVE_VALUE_ENV);
+  return env ? entered.values.get(envValueKey(env[1] ?? env[2])) : void 0;
+}
+function typedSinceLastNav(stmt, entered, startLine, lines = enteredLinesOf(stmt, entered)) {
+  if (!lines || startLine === void 0)
     return false;
-  const enteredAt = entered.values.get(m[2].toLowerCase());
-  if (enteredAt === void 0)
+  const before = countBelow(lines, startLine);
+  if (before === 0)
     return false;
-  if (startLine === void 0)
+  return countBelow(entered.navLines, startLine) === countBelow(entered.navLines, lines[before - 1] + 1);
+}
+function isEnteredValueEcho(stmt, entered, startLine) {
+  const lines = enteredLinesOf(stmt, entered);
+  if (!lines)
+    return false;
+  if (startLine === void 0 || lines[0] >= startLine)
     return true;
-  return !entered.navLines.some((n) => n > enteredAt && n < startLine);
+  return typedSinceLastNav(stmt, entered, startLine, lines);
 }
 function isAnyValueMatcher(stmt) {
   if (/\.not\.toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/.test(stmt))
@@ -5445,6 +5562,43 @@ function hasAttributeTransition(stmts) {
       return true;
   return false;
 }
+function comparesWithItself(subject, tail) {
+  const m = SELF_COMPARE_MATCHER.exec(tail);
+  if (!m)
+    return false;
+  const args = balancedArguments(tail, m[0].length, MATCHER_ARGS_MAX);
+  if (args === null)
+    return false;
+  const squash2 = (x) => x.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  const expected = squash2(args);
+  return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
+}
+function asPlainAssertion(s) {
+  const { stmt } = s;
+  if (COUNT_AT_LEAST_ZERO.test(stmt))
+    return [];
+  const subject = extractExpectSubject(stmt);
+  if (subject === null)
+    return [s];
+  const plain = subject.replace(/^await\s+/, "").trim();
+  const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
+  const tail = stmt.slice(subjectAt + subject.length).trimStart();
+  const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
+    return [];
+  if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
+    return [];
+  if (comparesWithItself(plain, tail))
+    return [];
+  const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
+  if (visible && IS_VISIBLE_TRUE.test(tail))
+    return as(`await expect(${visible[1]}).toBeVisible();`);
+  if (/^page\s*\.\s*(?:url|title)\s*\(\s*\)$/.test(plain) && PAGE_VALUE_MATCHER.test(tail)) {
+    const matcher = plain.includes("url") ? "toHaveURL" : "toHaveTitle";
+    return as(`await expect(page)${tail.replace(/^\)\s*\.\s*\w+\s*\(/, `.${matcher}(`)}`);
+  }
+  return [s];
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -5518,6 +5672,8 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       continue;
     if (isVacuousErrorAbsence(stmt, presence))
       continue;
+    if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
+      continue;
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -5527,12 +5683,15 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       else
         return { kind: "durable" };
     }
-    if (STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
+    const retyped = typedSinceLastNav(stmt, entered, startLine);
+    if (!retyped && STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
       return { kind: "durable" };
-    if (provesStoredControlValue(stmt, startLine, persistence))
+    if (!retyped && provesStoredControlValue(stmt, startLine, persistence))
       return { kind: "durable" };
     if (countsAsContentText(stmt))
       return { kind: "durable" };
+    if (provesTextRemoved(stmt, presence))
+      return { kind: "durable" };
     if (mutated && VISIBILITY_MATCHER.test(stmt)) {
       const revealsText = GET_BY_TEXT.test(stmt) || HAS_TEXT_FILTER.test(stmt) || CONTENT_ROLE.test(stmt);
       if (revealsText && !isChromeTarget(stmt)) {
@@ -5599,7 +5758,7 @@ function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMut
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
-  const stmts = liveExpectStatements(stripCoverageComments(body));
+  const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
   const base = (extra) => ({
     apiTest: false,
     interacted: false,
@@ -5805,7 +5964,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, IN_FLIGHT_TEXT, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -5830,8 +5989,8 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /\.toBeDisabled\s*\(/,
-      // a control became DISABLED — a gating/validation outcome
+      /(?<!\.not\s*)\.\s*toBeDisabled\s*\(/,
+      // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
       // something the action removed/closed (disappearance proof)
@@ -5839,7 +5998,7 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)|\bexpect\s*\.\s*poll\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*(?:\{\s*return\s+)?page\s*\.\s*url\s*\(\s*\)/;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
@@ -5868,6 +6027,7 @@ var init_assertion_strength = __esm({
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
+    NEGATED_ASSERT_NOT = /\.not\s*\.\s*to[A-Z]/;
     CONST_CHAIN_MAX_DEPTH = 5;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
@@ -5883,8 +6043,14 @@ var init_assertion_strength = __esm({
     CATCH_ALL_PATTERN = /^(['"`])\*\*(?:\/\*)?\1$|^\/\.\*\/[a-z]*$/;
     GUARD_HANDLER = /\bMUTATING\.has\s*\(|blockedbyclient|Read-only guard/;
     ABSENCE_MATCHER = /\.not\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/;
+    VALUE_ABSENCE = /\.(?:count\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*0\s*\)|toBeLessThan\s*\(\s*1\s*\))|isVisible\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*false\s*\)|toBeFalsy\s*\()|isHidden\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*true\s*\)|toBeTruthy\s*\())/;
+    OPTION_ABSENCE = /\.(?:toBeVisible\s*\(\s*\{[^{}()]{0,200}\bvisible|toBeAttached\s*\(\s*\{[^{}()]{0,200}\battached)\s*:\s*false\b/;
+    NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
+    ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
+    REQUEST_WORD = /\brequest\b/;
     ROLE_NAME_RE = /getByRole\s*\(\s*['"`][a-z]+['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
     INTERACT_VERB = /\.(click|fill|check|uncheck|setChecked|selectOption|pressSequentially)\s*\(/;
     ROLE_SIG_RE = /getByRole\s*\(\s*['"`]([a-z]+)['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
@@ -5905,7 +6071,20 @@ var init_assertion_strength = __esm({
     MATCHER_OPEN = /\s*(?:\.\s*(?:not|resolves|rejects)\s*)*\.\s*[A-Za-z_$][\w$]*\s*\(/y;
     ENTERED_VALUE = /\.(?:fill|pressSequentially)\s*\(\s*['"`]([^'"`]+)['"`]|keyboard\.type\s*\(\s*['"`]([^'"`]+)['"`]|\.selectOption\s*\(\s*(?:\[\s*)?(?:\{\s*(?:label|value)\s*:\s*)?['"`]([^'"`]+)['"`]/g;
     PAGE_NAV = /\.(?:goto|reload)\s*\(/;
+    ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
+    ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
+    HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
+    LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
+    LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
+    ALWAYS_TRUE_ON_OBJECT = /^\)\s*\.\s*(?:toBeTruthy|toBeDefined|not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy))\s*\(/;
+    COUNT_AT_LEAST_ZERO = /\.(?:count\s*\(\s*\)|length)[\s)]{0,10}\.(?:toBeGreaterThanOrEqual\s*\(\s*0\s*\)|toBeGreaterThan\s*\(\s*-\s*1\s*\))/;
+    DEFINED_VALUE_READ = /\.\s*(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|title|url|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts)\s*\([^()]*\)$/;
+    ALWAYS_DEFINED = /^\)\s*\.\s*(?:toBeDefined|not\s*\.\s*toBeUndefined)\s*\(/;
+    SELF_COMPARE_MATCHER = /^\)\s*\.\s*(toBe|toEqual|toStrictEqual|toHaveCount)\s*\(/;
+    IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
+    PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
     COPY_CONTROL = /\bcopy\b/i;
@@ -6114,7 +6293,7 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
@@ -6134,6 +6313,7 @@ var init_run_classification = __esm({
     UNEXPECTED_PASS_ERROR_PREFIX = "UNEXPECTED_PASS:";
     BUG_TEST_BROKEN_ERROR_PREFIX = "BUG_TEST_BROKEN:";
     BUG_TEST_BROKEN_REASON = "bug test broken (not a bug verdict)";
+    TEST_DID_NOT_RUN_ERROR = "Test did not run (a dependency failed or the run was interrupted)";
     EMAIL_NOT_RECEIVED_PREFIXES = [
       "VERIFICATION_EMAIL_NOT_RECEIVED:",
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
@@ -8875,6 +9055,23 @@ var init_auth_block_detector = __esm({
   }
 });
 
+// ../shared/dist/auth-session-stamp.js
+function parseAuthSessionStamp(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const { shared, role, generation } = value;
+  if (shared !== true || role !== "producer" && role !== "follower")
+    return null;
+  return typeof generation === "string" && AUTH_SESSION_GENERATION_RE.test(generation) ? { shared: true, role, generation } : { shared: true, role };
+}
+var AUTH_SESSION_GENERATION_RE;
+var init_auth_session_stamp = __esm({
+  "../shared/dist/auth-session-stamp.js"() {
+    "use strict";
+    AUTH_SESSION_GENERATION_RE = /^[0-9a-z]{1,16}$/;
+  }
+});
+
 // ../shared/dist/auth-state-freshness.js
 function isCsrfTokenName(name) {
   return /csrf|xsrf|forgery|authenticity|requestverification/.test(name.toLowerCase());
@@ -10103,7 +10300,7 @@ var init_agentic_cli_runtime = __esm({
     GROK_CLI_DEFAULT_MODEL = "grok-4.7";
     GROK_CLI_DEFAULT_REASONING_EFFORT = "high";
     CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-    CLAUDE_CLI_DEFAULT_EFFORT = "max";
+    CLAUDE_CLI_DEFAULT_EFFORT = "high";
     MUSE_CLI_DEFAULT_MODEL = "muse-spark-1.3-contributor";
     MUSE_CLI_DEFAULT_EFFORT = "high";
     CODEX_CLI_DEFAULT_MODEL = "gpt-6.1-sol";
@@ -10154,9 +10351,25 @@ function isOpenCodeGoModelId(id) {
 function hasOpenCodeGoPrefix(id) {
   return (id?.trim() ?? "").startsWith(OPENCODE_GO_PREFIX);
 }
+function hasOpenCodeGo2Prefix(id) {
+  return (id?.trim() ?? "").startsWith(OPENCODE_GO_2_PREFIX);
+}
 function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
-  return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
+  if (!isOpenCodeGoModelId(trimmed))
+    return null;
+  return trimmed.slice((hasOpenCodeGo2Prefix(trimmed) ? OPENCODE_GO_2_PREFIX : OPENCODE_GO_PREFIX).length);
+}
+function isZaiModelId(id) {
+  const trimmed = id?.trim() ?? "";
+  return ZAI_MODEL_PATTERN.test(trimmed) && !trimmed.includes("..");
+}
+function hasZaiPrefix(id) {
+  return (id?.trim() ?? "").startsWith(ZAI_PREFIX);
+}
+function zaiWireModel(id) {
+  const trimmed = id?.trim() ?? "";
+  return isZaiModelId(trimmed) ? trimmed.slice(ZAI_PREFIX.length) : null;
 }
 function isEngineId(value) {
   return CLI_ENGINE_MODEL_IDS.includes(value);
@@ -10254,7 +10467,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_2_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10313,7 +10526,10 @@ var init_engine_spec = __esm({
     OPENROUTER_PREFIX = "openrouter:";
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
-    OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
+    OPENCODE_GO_2_PREFIX = "opencode-go-2:";
+    OPENCODE_GO_MODEL_PATTERN = /^opencode-go(?:-2)?:[a-z0-9][a-z0-9._-]{0,100}$/;
+    ZAI_PREFIX = "zai:";
+    ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
 });
 
@@ -10598,6 +10814,8 @@ var init_api_model_catalog = __esm({
       authCaptureModel: "Login capture",
       plannerModel: "Scenario Planner",
       plannerGateModel: "Planner Gate",
+      pwAgentsHealerModel: "Test Healer (Playwright agents)",
+      pwAgentsReviewModel: "Plan Review (Playwright agents)",
       generationModel: "Code Generation",
       reviewModel: "Code Review",
       apiTestModel: "API Test Generator",
@@ -10622,11 +10840,6 @@ var init_api_model_catalog = __esm({
 });
 
 // ../shared/dist/provider-chains.js
-function isClaudeModel(id) {
-  if (/claude|anthropic/i.test(id))
-    return true;
-  return API_MODEL_CATALOG.some((m) => m.provider === "anthropic" && (m.id === id || m.apiModel === id));
-}
 function chainKey(modelId) {
   const id = canonicalModelId(modelId);
   if (!id)
@@ -10634,34 +10847,83 @@ function chainKey(modelId) {
   const entry = API_MODEL_CATALOG.find((m) => m.id === id || m.apiModel === id);
   return entry?.id ?? id;
 }
+function has(map, key) {
+  return Object.prototype.hasOwnProperty.call(map, key);
+}
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
-  if (!key || isClaudeModel(key))
-    return [];
-  return Object.prototype.hasOwnProperty.call(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+  return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+}
+function providerChainLeadsFor(modelId) {
+  const key = chainKey(modelId);
+  return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
+}
+function allChains() {
+  return [...Object.entries(PROVIDER_CHAINS), ...Object.entries(PROVIDER_CHAIN_LEADS)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
-  return id !== "" && Object.values(PROVIDER_CHAINS).some((hops) => hops.includes(id));
+  return id !== "" && allChains().some(([, hops]) => hops.includes(id));
 }
 function providerChainPrimariesForHop(hopId) {
   const id = hopId ?? "";
   if (!id)
     return [];
-  return Object.entries(PROVIDER_CHAINS).filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+  return allChains().filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+}
+function providerChainHostOf(value, modelValue) {
+  if (value === modelValue)
+    return "own";
+  if (hasZaiPrefix(value))
+    return "zai";
+  if (hasOpenCodeGo2Prefix(value))
+    return "opencode-go-2";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  return "own";
+}
+function providerHostPlan(modelId) {
+  const key = chainKey(modelId);
+  if (!key)
+    return [];
+  const own = { host: hasOpenRouterPrefix(key) ? "openrouter" : "own", value: key };
+  const steps = [
+    ...providerChainLeadsFor(key).map((value) => ({ host: providerChainHostOf(value, key), value })),
+    own,
+    ...providerChainFor(key).map((value) => ({ host: providerChainHostOf(value, key), value }))
+  ];
+  const notOffered = Object.prototype.hasOwnProperty.call(PROVIDER_HOST_NOT_OFFERED, key) ? PROVIDER_HOST_NOT_OFFERED[key] : {};
+  for (const [host, reason] of Object.entries(notOffered)) {
+    const at = steps.findIndex((step) => step === own) + 1;
+    steps.splice(at, 0, { host, value: null, notOffered: reason });
+  }
+  return steps;
 }
-var PROVIDER_CHAINS;
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
     init_api_model_catalog();
+    init_engine_spec();
     PROVIDER_CHAINS = {
-      "minimax-m3": ["openrouter:minimax/minimax-m3", "opencode-go:minimax-m3"],
-      "minimax-m3.1-flash": ["openrouter:minimax/minimax-m3.1-flash", "opencode-go:minimax-m3.1-flash"],
+      "minimax-m3": ["opencode-go:minimax-m3", "openrouter:minimax/minimax-m3"],
+      "minimax-m3.1-flash": ["opencode-go:minimax-m3.1-flash", "openrouter:minimax/minimax-m3.1-flash"],
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
-      "openrouter:z-ai/glm-5.3-flash": ["opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["opencode-go:glm-5.2"]
+      "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
+      "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
+      "deepseek-flash": ["opencode-go-2:deepseek-v4.1-flash", "opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go-2:deepseek-v4-pro", "opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
+    };
+    PROVIDER_CHAIN_LEADS = {
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go-2:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go-2:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go-2:glm-5.2", "opencode-go:glm-5.2"]
+    };
+    PROVIDER_HOST_NOT_OFFERED = {
+      "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
+      "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
     };
   }
 });
@@ -12620,7 +12882,7 @@ function stateLiteralsOf(line) {
   const out = [];
   for (const m of line.matchAll(STRING_LITERAL_RE)) {
     const text = m[1] ?? m[2] ?? m[3] ?? "";
-    if (text.includes("placeholder="))
+    if (PLACEHOLDER_ATTR_RE.test(text))
       continue;
     if (PLACEHOLDER_CALL_TAIL_RE.test(line.slice(Math.max(0, m.index - 40), m.index)))
       continue;
@@ -12716,7 +12978,7 @@ function formatReadinessPollAdvisory(findings) {
   const where = findings.length === 1 ? "One place" : `${findings.length} places`;
   return `${where} re-check a background state once and assert the finished state at once (${short(first.line, 90)} then ${short(first.assertion, 90)}). ${first.reason}`;
 }
-var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
+var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_ATTR_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
 var init_readiness_poll = __esm({
   "../shared/dist/readiness-poll.js"() {
     "use strict";
@@ -12729,7 +12991,7 @@ var init_readiness_poll = __esm({
     STRING_LITERAL_RE = /'((?:\\.|[^'\\\n]){0,300})'|"((?:\\.|[^"\\\n]){0,300})"|`((?:\\.|[^`\\\n]){0,300})`/g;
     RECHECK_NAME_RE = /^\s{0,10}(?:check again|check (?:status|availability|now|for updates|progress)|re-?check(?: status)?|update status|see (?:latest|updates))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
     RETRY_NAME_RE = /^\s{0,10}(?:refresh(?: (?:status|list|page|results|now))?|reload(?: (?:page|results|list))?|try again|retry|load (?:again|latest))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
-    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b[a-z]{3,40}(?<!th)ing(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
+    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b(?:saving|uploading|downloading|signing|logging|submitting|creating|updating|deleting|importing|exporting|publishing|connecting|redirecting|authenticating|installing|retrieving|fetching|analy[sz]ing|running|rendering|restarting|building|compiling|booting|provisioning|deploying|indexing|migrating|launching|initiali[sz]ing|optimi[sz]ing|converting|processing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}(?:starting|scanning|working|applying|finishing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}[a-z]{3,40}(?<!th)ing\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
     LOCATOR_LINE_RE = /\.(?:getBy[A-Z]\w{0,30}|locator|toHaveText|toContainText)\s{0,20}\(/;
     CLICK_RE = /\.(?:click|dblclick|tap)\s{0,20}\(/;
     RELOAD_RE = /\bpage\.reload\s{0,20}\(/;
@@ -12743,6 +13005,7 @@ var init_readiness_poll = __esm({
     TEST_END_RE = /^\s{0,20}\}\s{0,20}\)\s{0,20};?\s{0,20}$/;
     TEST_START_RE = /\btest(?:\.\w{1,20})?\s{0,20}\(/;
     POLL_OPEN_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}async\b|\bexpect\.poll\s{0,20}\(|\bfor\s{0,20}\(|\bwhile\s{0,20}\(|\bdo\s{0,20}\{/g;
+    PLACEHOLDER_ATTR_RE = /placeholder\s{0,4}[*^$~|]?=/;
     PLACEHOLDER_CALL_TAIL_RE = /getByPlaceholder\s{0,20}\(\s{0,20}$/;
     POLL_SHAPE = "await expect(async () => { await page.reload(); await expect(<the finished state>).toBeVisible({ timeout: 1500 }); }).toPass({ timeout: 20000 });";
   }
@@ -13144,6 +13407,15 @@ function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
   return COMPUTE_RE.test(code) || RELATIONAL_RE.test(line);
 }
+function identifiersIn(line) {
+  const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX");
+  return [code, ...[...line.matchAll(TEMPLATE_EXPR_RE)].map((m) => m[1])].flatMap((part) => part.match(IDENTIFIER_RE) ?? []);
+}
+function addTyped(typed, value) {
+  const d = digitsOf(value);
+  if (/\d/.test(d))
+    typed.add(d);
+}
 function reasonFor4(kind, label, value) {
   const what = kind === "derived-value-shape-only" ? `The ${label} is checked only for its shape, so any amount passes, including a wrongly computed one.` : `The ${label} is checked against a number written into the test (${value}). That number was read off the page, so when the page computes it wrong the check still passes.`;
   return `${what} Instead, ${COMPUTE_SHAPE} If the number is not computed from other values (a list price, an id, a fixed fee), leave it as it is. Keep the existing checks.`;
@@ -13155,25 +13427,32 @@ function analyzeDerivedValues(rawCode) {
   for (const body of testBodies(rawCode)) {
     if (findings.length >= MAX_FINDINGS4)
       break;
-    if (body.some(computes))
-      continue;
     const typed = /* @__PURE__ */ new Set();
     const definitions = /* @__PURE__ */ new Map();
+    const computed = /* @__PURE__ */ new Set();
+    const usesComputed = (text) => identifiersIn(text).some((id) => computed.has(id));
     for (const line of body) {
       if (FILL_RE2.test(line) && !EXPECT_RE3.test(line)) {
-        for (const m of line.matchAll(/['"`]([^'"`\n]{0,40})['"`]/g)) {
-          const d = digitsOf(m[1]);
-          if (/\d/.test(d))
-            typed.add(d);
-        }
+        for (const m of line.matchAll(QUOTED_RE))
+          addTyped(typed, m[1]);
+        const arg = FILL_ARG_RE.exec(line)?.[1];
+        const literal = arg === void 0 ? null : LITERAL_VALUE_RE.exec(definitions.get(arg) ?? "");
+        const value = literal?.slice(1).find((v) => v !== void 0);
+        if (value !== void 0)
+          addTyped(typed, value);
       }
       const def = DEFINITION_RE.exec(line);
-      if (def)
+      if (def) {
         definitions.set(def[1], def[2]);
+        if (computes(def[2]) || usesComputed(def[2]))
+          computed.add(def[1]);
+      }
     }
     for (const line of body) {
       if (!EXPECT_RE3.test(line) || !VALUE_MATCHER_RE2.test(line) || /\.not\s{0,20}\./.test(line))
         continue;
+      if (computes(line) || usesComputed(line))
+        continue;
       const subject = EXPECT_SUBJECT_RE.exec(line)?.[1];
       const label = DERIVED_WORD_RE.exec(`${line} ${(subject && definitions.get(subject)) ?? ""}`)?.[0];
       if (!label)
@@ -13203,7 +13482,7 @@ function formatDerivedValueAdvisory(findings) {
   const where = findings.length === 1 ? "One computed value is" : `${findings.length} computed values are`;
   return `${where} checked against a copied number or only its shape (${short4(first.line, 90)}). ${first.reason}`;
 }
-var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, COMPUTE_SHAPE;
+var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, TEMPLATE_EXPR_RE, IDENTIFIER_RE, QUOTED_RE, FILL_ARG_RE, LITERAL_VALUE_RE, COMPUTE_SHAPE;
 var init_derived_value_check = __esm({
   "../shared/dist/derived-value-check.js"() {
     "use strict";
@@ -13223,6 +13502,11 @@ var init_derived_value_check = __esm({
     DEFINITION_RE = /\b(?:const|let)\s{1,10}([\w$]{1,60})\s{0,10}=\s{0,10}([^\n]{0,300})/;
     EXPECT_SUBJECT_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}([\w$]{1,60})/;
     LITERAL_ARITH_RE = /\b\d[\d_.]{0,15}(?:\s{0,5}[*/+-]\s{0,5}\d[\d_.]{0,15}){1,8}\b/g;
+    TEMPLATE_EXPR_RE = /\$\{([^{}\n]{0,200})\}/g;
+    IDENTIFIER_RE = /[A-Za-z_$][\w$]{0,60}/g;
+    QUOTED_RE = /['"`]([^'"`\n]{0,40})['"`]/g;
+    FILL_ARG_RE = /\.(?:fill|type|pressSequentially|selectOption)\s{0,20}\(\s{0,20}([A-Za-z_$][\w$]{0,60})\s{0,20}[,)]/;
+    LITERAL_VALUE_RE = /^\s{0,10}(?:'([^'\n]{0,40})'|"([^"\n]{0,40})"|`([^`$\n]{0,40})`|(\d[\d_,]{0,15}(?:\.\d{1,4})?))\s{0,10};?\s{0,10}$/;
     COMPUTE_SHAPE = "compute the expected value in the test from its inputs (the values the test typed, or each input read from the page) and compare: const toNumber = (s) => Number(s.replace(/[^\\d.-]/g, '')); const unit = toNumber(await <unit price locator>.innerText()); then expect(toNumber(await <shown value locator>.innerText())).toBeCloseTo(unit * quantity, 2); for several lines, read them all and sum them with reduce. For a comma-decimal price like \u20AC1.234,56, drop the dots and turn the comma into a point before Number, since the replace above would read it as 1.23456.";
   }
 });
@@ -15257,6 +15541,99 @@ function formatStaleAfterSubmitAdvisory(rawCode) {
   const more = described.length > 3 ? ` (+${described.length - 3} more)` : "";
   return `stale-after-submit: ${described.slice(0, 3).join("; ")}${more}; these pass before the request lands and still pass if the server rejects or ignores the save. Wait for the result instead: page.waitForResponse around the click, or assert something the submit creates (the new row, the confirmation message, a path with an end anchor such as /\\/orders\\/\\d+$/)`;
 }
+function regexLiteralEnd4(text, at) {
+  let inClass = false;
+  for (let i = at + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\n")
+      return -1;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/")
+      return i + 1;
+  }
+  return -1;
+}
+function startsWithRegexLiteral(text) {
+  const t = text.trimStart();
+  return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
+}
+function afterFirstArg(args) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i];
+    if (quote) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}")
+      depth--;
+    else if (ch === "," && depth === 0)
+      return args.slice(i + 1);
+  }
+  return "";
+}
+function analyzeRegexMatchers(rawCode) {
+  if (!rawCode || typeof rawCode !== "string")
+    return [];
+  const code = stripComments2(rawCode.slice(0, MAX_LINT_INPUT));
+  const out = [];
+  const re = /\bexpect(?:\.soft)?\s{0,20}\(/g;
+  let m;
+  let examined = 0;
+  let line = 1;
+  let lineAt2 = 0;
+  while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
+    const subj = readBalanced(code, m.index + m[0].length);
+    if (!subj)
+      continue;
+    const mm = /^\s{0,20}(\.\s{0,20}not)?\s{0,20}\.\s{0,20}(\w{1,40})\s{0,20}\(/.exec(code.slice(subj.end + 1, subj.end + 1 + 80));
+    if (!mm || !REGEX_EQUALITY_MATCHERS.has(mm[2]))
+      continue;
+    const args = readBalanced(code, subj.end + 1 + mm[0].length);
+    if (!args)
+      continue;
+    const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
+    if (!startsWithRegexLiteral(expected))
+      continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain" && (startsWithRegexLiteral(subj.text) || /^new\s+RegExp\b/.test(subj.text.trim())))
+      continue;
+    for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
+      line++;
+      lineAt2 = i + 1;
+    }
+    out.push({ line, matcher: mm[2], negated: mm[1] !== void 0 });
+  }
+  return out;
+}
+function formatRegexMatcherNote(findings) {
+  const lines = findings.map((f) => `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? "always passes (a regex never equals the value), so it checks nothing" : "can never pass: this matcher compares by equality and a regex never equals a value"}.`);
+  return `${lines.join("\n")}
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For a DOM property read it first: expect(await loc.evaluate((n) => n.<prop>)).toMatch(/re/). Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+}
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
     return [];
@@ -15264,6 +15641,10 @@ function lintTestQuality(rawCode, opts = {}) {
     return lintTestData(rawCode, { pageContacts: opts.pageContacts });
   if (opts.only === "test-data-blocking")
     return analyzeTestData(rawCode, { pageContacts: opts.pageContacts }).blocking;
+  if (opts.only === "regex-matcher") {
+    const found = analyzeRegexMatchers(rawCode);
+    return found.length > 0 ? [formatRegexMatcherNote(found)] : [];
+  }
   const warnings = [];
   if (rawCode.length > MAX_LINT_INPUT) {
     warnings.push(`The code is ${Math.round(rawCode.length / 1024)} KB; the quality lint checked only the first ${MAX_LINT_INPUT / 1e3} KB. Split it into smaller tests (one behaviour per test).`);
@@ -15538,7 +15919,7 @@ function specItemsFromTestPlans(testPlans) {
   }
   return [...new Set(out)].slice(0, 200);
 }
-var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, STOP, SYNONYMS, AREA_TOKENS;
+var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, MAX_REGEX_MATCHER_FINDINGS, REGEX_EQUALITY_MATCHERS, STOP, SYNONYMS, AREA_TOKENS;
 var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
@@ -15770,6 +16151,8 @@ var init_test_authoring_quality = __esm({
     };
     LIVE_WRITE_NAME = /\b(?:submit|place|book|reserve|confirm|pay|send|checkout|order|register|sign\s?up|create account)\b/i;
     BUNDLED_CHECKS_BEFORE_WRITE = 5;
+    MAX_REGEX_MATCHER_FINDINGS = 10;
+    REGEX_EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toContain", "toHaveJSProperty"]);
     STOP = /* @__PURE__ */ new Set([
       "a",
       "an",
@@ -15998,6 +16381,19 @@ var init_fence_runs = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/survey-bug-signature.js
 function normalizeWords(text) {
   return text.toLowerCase().replace(UUID, " id ").replace(PREFIXED_ID, " id ").replace(HEX_RUN, (run) => /\d/.test(run) ? " id " : run).replace(NUMBER_RUN, " # ").replace(/[^\p{L}\p{N}#]+/gu, " ").replace(/\s+/g, " ").trim();
@@ -16008,7 +16404,7 @@ function normalizeBugPath(route) {
   if (hash >= 0 && path[hash + 1] !== "/")
     path = path.slice(0, hash);
   const segments = path.toLowerCase().split("/").map((segment) => /\d/.test(segment) ? ":id" : segment);
-  const joined = segments.join("/").replace(/\/+$/, "");
+  const joined = stripTrailingSlashes(segments.join("/"));
   return joined || (path.startsWith("/") ? "/" : "");
 }
 function isGenericConsoleMessage(message) {
@@ -16142,6 +16538,7 @@ var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
+    init_trailing_slashes();
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17422,9 +17819,9 @@ function lastLocatorLabels(chain) {
       if (t)
         labels.push(t[1]);
     }
-    const has = optionText(last.args, HAS_TEXT_OPTION_RE);
-    if (has !== null)
-      labels.push(has);
+    const has2 = optionText(last.args, HAS_TEXT_OPTION_RE);
+    if (has2 !== null)
+      labels.push(has2);
   }
   return labels.map((l) => l.replace(/^[\s^(?:]+/, "").trim());
 }
@@ -18181,14 +18578,17 @@ var init_promotion_quality_gate = __esm({
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, strengthGate, flagContradictedAdditions }) {
+      run({ code, tags, strengthGate, flagContradictedAdditions }) {
         const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
-        if (verdict.severity !== "block")
+        const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
+        if (verdict.severity !== "block" && !authDowngrade)
           return [];
         const revealed = strengthGate?.severity === "none" && strengthGate.revealEvidence === "revealed" && strengthGate.source !== "heal";
-        return revealed ? [] : [{ check: "strength-block" }];
+        if (revealed)
+          return [];
+        return [{ check: authDowngrade ? "strength-downgrade-auth" : "strength-block" }];
       }
     };
     STRING_CONST = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,60})\s{0,20}=\s{0,20}(?:'([^'\\\n]{0,300})'|"([^"\\\n]{0,300})"|`([^`\\$\n]{0,300})`)\s{0,20}[;\n]/g;
@@ -18595,6 +18995,7 @@ __export(dist_exports, {
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
   AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
   AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
+  AUTH_SESSION_GENERATION_RE: () => AUTH_SESSION_GENERATION_RE,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -18727,6 +19128,8 @@ __export(dist_exports, {
   LIVE_FRAME_STALE_MS: () => LIVE_FRAME_STALE_MS,
   LIVE_FRAME_UNFOCUSED_INTERVAL_MS: () => LIVE_FRAME_UNFOCUSED_INTERVAL_MS,
   LIVE_THUMBNAIL_MAX_BASE64_BYTES: () => LIVE_THUMBNAIL_MAX_BASE64_BYTES,
+  MAX_BALANCED_SCAN: () => MAX_BALANCED_SCAN,
+  MAX_CALLS: () => MAX_CALLS,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MAX_EMAIL_ADDRESS_LENGTH: () => MAX_EMAIL_ADDRESS_LENGTH,
@@ -18771,6 +19174,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
+  OPENCODE_GO_2_PREFIX: () => OPENCODE_GO_2_PREFIX,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -18806,6 +19210,8 @@ __export(dist_exports, {
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
   READINESS_POLL_MAX_CODE_CHARS: () => READINESS_POLL_MAX_CODE_CHARS,
@@ -18844,6 +19250,7 @@ __export(dist_exports, {
   SURVEY_NOTES_RENDER_MAX_CHARS: () => SURVEY_NOTES_RENDER_MAX_CHARS,
   SURVEY_NOTE_KEYS: () => SURVEY_NOTE_KEYS,
   SUSPICIOUS_PASS_TAG: () => SUSPICIOUS_PASS_TAG,
+  TEST_DID_NOT_RUN_ERROR: () => TEST_DID_NOT_RUN_ERROR,
   TEST_QUALITY_CONVENTIONS: () => TEST_QUALITY_CONVENTIONS,
   TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TEST_VARIABLE_SECRET_KEY_PATTERN: () => TEST_VARIABLE_SECRET_KEY_PATTERN,
@@ -18859,6 +19266,8 @@ __export(dist_exports, {
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
+  ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
+  ZAI_PREFIX: () => ZAI_PREFIX,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
@@ -18867,6 +19276,7 @@ __export(dist_exports, {
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   analyzePersistenceReread: () => analyzePersistenceReread,
   analyzeReadinessPolling: () => analyzeReadinessPolling,
+  analyzeRegexMatchers: () => analyzeRegexMatchers,
   analyzeSharedAccountUse: () => analyzeSharedAccountUse,
   analyzeStaleAfterSubmit: () => analyzeStaleAfterSubmit,
   analyzeTestData: () => analyzeTestData,
@@ -19030,6 +19440,7 @@ __export(dist_exports, {
   formatPersistenceRereadAdvisory: () => formatPersistenceRereadAdvisory,
   formatPoolBudgetLine: () => formatPoolBudgetLine,
   formatReadinessPollAdvisory: () => formatReadinessPollAdvisory,
+  formatRegexMatcherNote: () => formatRegexMatcherNote,
   formatStaleAfterSubmitAdvisory: () => formatStaleAfterSubmitAdvisory,
   formatSuspiciousExpectation: () => formatSuspiciousExpectation,
   formatUrlWaitAdvisory: () => formatUrlWaitAdvisory,
@@ -19068,12 +19479,14 @@ __export(dist_exports, {
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
   hasOnlyConstantAssertions: () => hasOnlyConstantAssertions,
+  hasOpenCodeGo2Prefix: () => hasOpenCodeGo2Prefix,
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
+  hasZaiPrefix: () => hasZaiPrefix,
   healMobileTestSteps: () => healMobileTestSteps,
   healthRunWhere: () => healthRunWhere,
   heldCodeRecord: () => heldCodeRecord,
@@ -19177,6 +19590,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  isZaiModelId: () => isZaiModelId,
   jsEscapedForms: () => jsEscapedForms,
   jsonStructureRefusalOf: () => jsonStructureRefusalOf,
   jsonStructureVerify: () => jsonStructureVerify,
@@ -19225,6 +19639,7 @@ __export(dist_exports, {
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
+  parseAuthSessionStamp: () => parseAuthSessionStamp,
   parseBoolFlag: () => parseBoolFlag,
   parseDbPoolSize: () => parseDbPoolSize,
   parseDeepgramListenResponse: () => parseDeepgramListenResponse,
@@ -19268,7 +19683,11 @@ __export(dist_exports, {
   profileKeyRoute: () => profileKeyRoute,
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
+  providerChainHostOf: () => providerChainHostOf,
+  providerChainLeadsFor: () => providerChainLeadsFor,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
+  providerHostPlan: () => providerHostPlan,
+  readBalanced: () => readBalanced,
   readChatFailover: () => readChatFailover,
   readChatReasoningTokens: () => readChatReasoningTokens,
   readChatUsage: () => readChatUsage,
@@ -19351,6 +19770,7 @@ __export(dist_exports, {
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
@@ -19378,7 +19798,8 @@ __export(dist_exports, {
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
   withoutServerOnlySpendFields: () => withoutServerOnlySpendFields,
-  withoutSurveyNotes: () => withoutSurveyNotes
+  withoutSurveyNotes: () => withoutSurveyNotes,
+  zaiWireModel: () => zaiWireModel
 });
 var init_dist = __esm({
   "../shared/dist/index.js"() {
@@ -19420,6 +19841,7 @@ var init_dist = __esm({
     init_admin_view_return_to();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_session_stamp();
     init_auth_state_freshness();
     init_skip_coverage_detector();
     init_feature_coverage();
@@ -19476,6 +19898,7 @@ var init_dist = __esm({
     init_promotion_quality_gate();
     init_regex_alternation();
     init_page_evidence();
+    init_trailing_slashes();
   }
 });
 
@@ -19492,8 +19915,11 @@ var require_survey_network_guard = __commonJS({
     exports2.maskedPath = maskedPath;
     exports2.bodyKeysOf = bodyKeysOf;
     exports2.graphqlDocumentIsQueryOnly = graphqlDocumentIsQueryOnly;
+    exports2.graphqlOperationRoots = graphqlOperationRoots;
     exports2.isTokenRefreshWrite = isTokenRefreshWrite;
     exports2.isSignInPathWrite = isSignInPathWrite;
+    exports2.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports2.graphqlGetMayWrite = graphqlGetMayWrite;
     exports2.writeShapedGet = writeShapedGet;
     exports2.decideSurveyRequest = decideSurveyRequest;
     exports2.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -19770,6 +20196,100 @@ var require_survey_network_guard = __commonJS({
       }
       return depth === 0 && parens === 0 && objects === 0 && sawOperation;
     }
+    function graphqlOperationRoots(text) {
+      const tokens2 = lexGraphql(text);
+      if (!tokens2)
+        return null;
+      const ops = [];
+      let depth = 0;
+      let parens = 0;
+      let objects = 0;
+      let defStart = true;
+      let kind = null;
+      let current = null;
+      let prev = "";
+      for (const tok of tokens2) {
+        const last = prev;
+        prev = tok;
+        if (tok === "(") {
+          parens++;
+          continue;
+        }
+        if (tok === ")") {
+          parens--;
+          if (parens < 0 || objects !== 0)
+            return null;
+          continue;
+        }
+        if (parens > 0) {
+          if (tok === "{")
+            objects++;
+          else if (tok === "}") {
+            objects--;
+            if (objects < 0)
+              return null;
+          }
+          continue;
+        }
+        if (tok === "{") {
+          if (depth === 0) {
+            if (defStart)
+              kind = "query";
+            else if (kind === null)
+              return null;
+            current = kind === "fragment" ? null : { kind, roots: [] };
+            if (current)
+              ops.push(current);
+            defStart = false;
+          }
+          depth++;
+          continue;
+        }
+        if (tok === "}") {
+          depth--;
+          if (depth < 0)
+            return null;
+          if (depth === 0) {
+            defStart = true;
+            kind = null;
+            current = null;
+          }
+          continue;
+        }
+        if (depth === 0) {
+          if (!/^[_A-Za-z]/.test(tok)) {
+            if (tok === "@")
+              continue;
+            return null;
+          }
+          if (defStart) {
+            if (tok !== "query" && tok !== "mutation" && tok !== "fragment")
+              return null;
+            kind = tok;
+            defStart = false;
+          }
+          continue;
+        }
+        if (depth > 1 || !current)
+          continue;
+        if (/^[_A-Za-z]/.test(tok)) {
+          if (last === "@")
+            continue;
+          if (last === ":") {
+            if (current.roots.length === 0)
+              return null;
+            current.roots[current.roots.length - 1] = tok;
+            continue;
+          }
+          current.roots.push(tok);
+          continue;
+        }
+        if (tok === ":" || tok === "@")
+          continue;
+        return null;
+      }
+      return depth === 0 && parens === 0 && objects === 0 ? ops : null;
+    }
     function isGraphqlQueryOnly(postData) {
       if (!postData || postData.length > MAX_BODY_CHARS)
         return false;
@@ -19807,6 +20327,34 @@ var require_survey_network_guard = __commonJS({
       "remove"
     ]);
     var NOT_A_SESSION_END = (segs) => !segs.some((seg) => SESSION_END_SEGMENTS.has(seg));
+    var DESTRUCTIVE_WORDS = /* @__PURE__ */ new Set([
+      "delete",
+      "remove",
+      "destroy",
+      "deactivate",
+      "terminate",
+      "purge",
+      "wipe",
+      "erase",
+      "cancel",
+      "close",
+      "revoke",
+      "unlink",
+      "disconnect"
+    ]);
+    var DESTRUCTIVE_PREFIXES = ["delete", "remove", "destroy", "deactivate", "terminate", "purge"];
+    function hasDestructiveSegment(rawSegs) {
+      return rawSegs.some((raw) => {
+        let seg = raw;
+        try {
+          seg = decodeURIComponent(raw);
+        } catch {
+        }
+        const words = seg.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/);
+        return words.some((word) => DESTRUCTIVE_WORDS.has(word) || DESTRUCTIVE_PREFIXES.some((p) => word.startsWith(p)));
+      });
+    }
+    var rawPathSegments = (pathname) => pathname.split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     var pathSegments = (pathname) => pathname.toLowerCase().split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     function isTokenRefreshWrite(method, pathname, recentAction = false) {
       if (method.toUpperCase() !== "POST")
@@ -19823,6 +20371,8 @@ var require_survey_network_guard = __commonJS({
     var AUTH_PAGE_PATH_RE = /(?:^|\/)(?:log-?in|sign-?in|sign_in|auth|oauth2?|sso|callback)(?:\/|$)/;
     var SIGN_IN_SEGMENT_RE = /^(?:log-?in|sign-?in|sign_in)$/;
     var CALLBACK_ROOT_SEGMENTS = /* @__PURE__ */ new Set(["auth", "oauth", "oauth2", "sso"]);
+    var CALLBACK_PROTOCOL_SEGMENTS = /* @__PURE__ */ new Set(["oidc", "openid", "openid-connect", "openidconnect", "saml", "saml2", "oauth", "oauth2"]);
+    var API_VERSION_SEGMENT_RE = /^v[0-9]{1,3}$/;
     var PROVIDER_SEGMENT_RE = /^[a-z][a-z0-9_-]{0,39}$/;
     var NOT_A_PROVIDER_SEGMENTS = /* @__PURE__ */ new Set([
       "link",
@@ -19861,14 +20411,21 @@ var require_survey_network_guard = __commonJS({
       if (!NOT_A_SESSION_END(segs))
         return false;
       if (AUTH_END_PATH_RE.test(`/${segs.join("/")}`))
-        return true;
+        return !hasDestructiveSegment(rawPathSegments(pathname).slice(0, -1));
+      let top = segs[0] === "api" ? 1 : 0;
+      if (top < segs.length && API_VERSION_SEGMENT_RE.test(segs[top]))
+        top += 1;
+      const below = segs.length - top;
+      const isProvider = (seg) => PROVIDER_SEGMENT_RE.test(seg) && !NOT_A_PROVIDER_SEGMENTS.has(seg);
       const provider = segs[segs.length - 1];
-      const authRootAtTop = segs.length === 3 || segs[segs.length - 4] === "api" && (segs.length === 4 || segs[segs.length - 3] === "auth");
-      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && PROVIDER_SEGMENT_RE.test(provider) && !NOT_A_PROVIDER_SEGMENTS.has(provider)) {
+      const authRootAtTop = below === 3 || segs[segs.length - 4] === "api" && segs[segs.length - 3] === "auth";
+      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && isProvider(provider)) {
         const step = segs[segs.length - 2];
         if (step === "callback" || step === "signin")
           return true;
       }
+      if (below === 4 && CALLBACK_ROOT_SEGMENTS.has(segs[top]) && CALLBACK_PROTOCOL_SEGMENTS.has(segs[top + 1]) && isProvider(segs[top + 2]) && segs[top + 3] === "callback")
+        return true;
       if (segs.length < 2 || segs[segs.length - 1] !== "callback")
         return false;
       const parent = segs[segs.length - 2];
@@ -19895,7 +20452,7 @@ var require_survey_network_guard = __commonJS({
       try {
         const a = new URL(url);
         const b = new URL(appBaseUrl);
-        const path = (u) => u.pathname.replace(/\/+$/, "");
+        const path = (u) => (0, shared_1.stripTrailingSlashes)(u.pathname);
         return a.origin === b.origin && path(a) === path(b);
       } catch {
         return false;
@@ -19917,9 +20474,15 @@ var require_survey_network_guard = __commonJS({
       const bodyHash = (0, node_crypto_1.createHash)("sha256").update(req.postData ?? "").digest("hex").slice(0, 16);
       return `${record.method} ${url.hostname.toLowerCase()}${url.pathname} ${bodyHash}`;
     }
-    function isGraphqlGetWrite(url, s) {
-      const doc = url.searchParams.get("query");
-      return doc !== null && isGraphqlEndpoint(url, s) && !graphqlDocumentIsQueryOnly(doc);
+    function graphqlUrlCarriesQuery(params) {
+      return params.has("query");
+    }
+    function graphqlGetMayWrite(url, body) {
+      const docs = url.searchParams.getAll("query");
+      return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
+    }
+    function isGraphqlGetWrite(url, s, body) {
+      return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
     exports2.WRITE_VERBS = /* @__PURE__ */ new Set([
       "cancel",
@@ -20123,7 +20686,7 @@ var require_survey_network_guard = __commonJS({
       if (url.protocol !== "http:" && url.protocol !== "https:")
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
-      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s);
+      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
       const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
@@ -20157,7 +20720,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && !graphqlUrlCarriesQuery(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -20189,7 +20752,7 @@ var require_survey_network_guard = __commonJS({
         const re = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
         return { reason, test: (hostPath) => re.test(hostPath) };
       }
-      const p = pattern.trim().toLowerCase().replace(/\/+$/, "");
+      const p = (0, shared_1.stripTrailingSlashes)(pattern.trim().toLowerCase());
       if (p.includes("/"))
         return { reason, test: (hostPath) => hostPath.toLowerCase() === p || hostPath.toLowerCase().startsWith(`${p}/`) };
       return { reason, test: (hostPath) => {
@@ -20854,6 +21417,7 @@ var require_run_write_guard = __commonJS({
     exports2.addRunWriteAuthHandler = addRunWriteAuthHandler2;
     exports2.runWriteContextOptions = runWriteContextOptions;
     exports2.clearRunWriteRelay = clearRunWriteRelay2;
+    exports2.runWriteGuardHopBytesInFlight = runWriteGuardHopBytesInFlight;
     exports2.installRunWriteGuard = installRunWriteGuard2;
     exports2.installNodeFetchGuard = installNodeFetchGuard2;
     exports2.runWriteGuardRefusal = runWriteGuardRefusal;
@@ -20865,7 +21429,11 @@ var require_run_write_guard = __commonJS({
     exports2.safeWritePatternFor = safeWritePatternFor;
     var node_async_hooks_1 = require("async_hooks");
     var node_crypto_1 = require("crypto");
+    var node_http_1 = require("http");
+    var node_https_1 = require("https");
     var node_path_1 = require("path");
+    var node_stream_1 = require("stream");
+    var node_zlib_1 = require("zlib");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_network_guard_js_1 = require_survey_network_guard();
     var bounded_output_js_1 = require_bounded_output();
@@ -20913,12 +21481,13 @@ var require_run_write_guard = __commonJS({
         allowPatterns,
         ignoredAllowPatterns,
         recordOnlyRules,
-        reason: v.reason.slice(0, MAX_REASON_CHARS)
+        reason: v.reason.slice(0, MAX_REASON_CHARS),
+        ...v.pwAgentsGuard === "off" ? { pwAgentsGuard: "off" } : {}
       };
     }
     var policyScope = new node_async_hooks_1.AsyncLocalStorage();
     var MIN_SIGN_IN_SECRET_CHARS = 6;
-    exports2.SIGN_IN_SECRET_VARIABLE = /PASS(?:WORD|CODE|PHRASE)?$/i;
+    exports2.SIGN_IN_SECRET_VARIABLE = /(?:PASS(?:WORD|CODE|PHRASE)?|[A-Z0-9]_PASSWD|[A-Z0-9]_PWD)$/i;
     function signInSecretsOf(vars) {
       if (!vars || typeof vars !== "object")
         return [];
@@ -20935,6 +21504,7 @@ var require_run_write_guard = __commonJS({
     }
     var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     var MAX_BODY_CHARS = 262144;
+    var MAX_SIGN_IN_LOG_LINES = 20;
     var CAPTCHA_HOSTS = ["recaptcha.net", "hcaptcha.com", "challenges.cloudflare.com"];
     var SEARCH_POST_HOSTS = ["algolia.net", "algolianet.com", "algolia.io"];
     var PAYMENT_HOSTS = [
@@ -20960,7 +21530,7 @@ var require_run_write_guard = __commonJS({
     var SEARCH_LAST_SEGMENTS = /* @__PURE__ */ new Set(["search", "autocomplete", "suggest", "suggestions", "typeahead"]);
     var PROVIDER_SIGN_UP_PATH = /(?:\/accounts:signup|\/dbconnections\/signup|\/auth\/v1\/signup|\/v1\/client\/sign_ups)(?:[/?]|$)/i;
     var FIRST_PARTY_SIGN_UP_SEGMENTS = /* @__PURE__ */ new Set(["signup", "sign-up", "sign_up", "register", "registration", "create-account", "createaccount", "sign_ups"]);
-    var NOT_A_SIGN_IN_SEGMENTS = /* @__PURE__ */ new Set([
+    var NOT_A_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
       "delete",
       "destroy",
       "remove",
@@ -20969,19 +21539,29 @@ var require_run_write_guard = __commonJS({
       "cancel",
       "password",
       "passwords",
-      "change-password",
-      "change_password",
       "reset",
-      "reset-password",
       "update",
       "logout",
       "signout",
-      "sign-out",
       "revoke",
       "transfer",
-      "withdraw"
+      "withdraw",
+      "disable",
+      "enable",
+      "unlink",
+      "change",
+      "erase",
+      "purge",
+      "wipe",
+      "terminate",
+      "suspend",
+      "leave",
+      "disconnect",
+      "deauthorize"
     ]);
-    var SIGN_IN_SHAPED_SEGMENTS = /* @__PURE__ */ new Set([
+    var ACCOUNT_CHANGE_WORDS = /* @__PURE__ */ new Set(["email", "mfa", "2fa", "totp", "otp"]);
+    var ACCOUNT_CHANGE_CONTEXT = /* @__PURE__ */ new Set(["account", "owner", "ownership", "invite"]);
+    var SIGN_IN_LAST_SEGMENTS = /* @__PURE__ */ new Set([
       "session",
       "sessions",
       "login",
@@ -20991,25 +21571,196 @@ var require_run_write_guard = __commonJS({
       "signin",
       "sign-in",
       "sign_in",
-      "auth",
       "authenticate",
       "authentication",
-      "token",
-      "tokens",
-      "oauth",
-      "oauth2",
-      "sso",
-      "identity",
-      "credentials"
+      "auth"
     ]);
-    var GRAPHQL_SIGN_IN = /"operationName"\s*:\s*"(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})"|\bmutation\b[^{]{0,200}\{\s*(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})\s*[({]/i;
-    function isCredentialSignInShape(pathname, postData) {
-      const segs = segmentsOf(pathname);
-      if (segs.some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg)))
+    var SIGN_IN_VERB_SEGMENTS = /* @__PURE__ */ new Set(["login", "log-in", "log_in", "signin", "sign-in", "sign_in"]);
+    var SIGN_IN_CREDENTIAL_KINDS = /* @__PURE__ */ new Set(["email", "username", "phone", "password"]);
+    var SIGN_IN_TAILS = /* @__PURE__ */ new Set(["callback/credentials", "auth/local", "session/new", "sessions/new"]);
+    var PASSWORD_GRANT = /(?:^|[&{,\s"])grant_type"?\s*[=:]\s*"?password(?=["&,}\s]|$)/;
+    var NEW_CREDENTIAL_STEM = "(?:pass(?:word|wd)?|pwd)";
+    var NEW_CREDENTIAL_WORD = `(?:(?:new|old|current|confirm|repeat|verify|retype)[_-]?(?:${NEW_CREDENTIAL_STEM}|email)|${NEW_CREDENTIAL_STEM}[_-]?(?:new|old|current|confirm(?:ation)?|repeat(?:ed)?|verify|verification|again|retype|check|confirmed|2)|email[_-]?confirm(?:ation)?)`;
+    var NEW_CREDENTIAL_NAME = new RegExp(`^${NEW_CREDENTIAL_WORD}$`, "i");
+    var NEW_CREDENTIAL_KEY = new RegExp(`(?:^|["&{,\\s[])${NEW_CREDENTIAL_WORD}(?:["\\]]?\\s*[:=]|"\\s*(?:;|$))`, "im");
+    var PASSWORD_KEY_WORDS = /* @__PURE__ */ new Set(["password", "passwd", "pwd", "pass"]);
+    var PASSWORD_KEY_QUALIFIERS = /* @__PURE__ */ new Set([
+      "new",
+      "old",
+      "current",
+      "confirm",
+      "confirmed",
+      "confirmation",
+      "repeat",
+      "repeated",
+      "verify",
+      "verification",
+      "again",
+      "retype",
+      "check",
+      "2"
+    ]);
+    function isPasswordKey(key) {
+      const words = wordsOf(key);
+      return words.some((w) => PASSWORD_KEY_WORDS.has(w)) && words.every((w) => PASSWORD_KEY_WORDS.has(w) || PASSWORD_KEY_QUALIFIERS.has(w));
+    }
+    function couldBePassword(value) {
+      if (value === void 0)
+        return true;
+      if (typeof value === "number")
+        return Number.isFinite(value);
+      if (typeof value !== "string")
+        return false;
+      const v = value.trim();
+      return v !== "" && !/^(?:true|false|on|off|yes|no|null)$/i.test(v);
+    }
+    var MAX_CREDENTIAL_KEYS = 200;
+    function credentialKeysOf(body, contentType) {
+      const type = (contentType ?? "").toLowerCase();
+      const keys = [];
+      try {
+        if (type.includes("json") || /^\s*[[{]/.test(body)) {
+          const stack = [{ value: JSON.parse(body), under: null }];
+          while (stack.length > 0 && keys.length < MAX_CREDENTIAL_KEYS) {
+            const { value, under } = stack.pop();
+            if (Array.isArray(value))
+              stack.push(...value.slice(0, MAX_CREDENTIAL_KEYS).map((inner) => ({ value: inner, under: null })));
+            else if (value && typeof value === "object") {
+              for (const [key, inner] of Object.entries(value).slice(0, MAX_CREDENTIAL_KEYS)) {
+                const name = under === null ? key : `${under}_${key}`;
+                keys.push({ name, value: inner });
+                if (Array.isArray(inner) && isPasswordKey(name)) {
+                  for (const item of inner.slice(0, MAX_CREDENTIAL_KEYS))
+                    if (item === null || typeof item !== "object")
+                      keys.push({ name, value: item });
+                }
+                const object = inner !== null && typeof inner === "object" && !Array.isArray(inner);
+                stack.push({ value: inner, under: object && isPasswordKey(name) ? name : null });
+              }
+            }
+          }
+        } else if (type.includes("multipart/form-data")) {
+          for (const m of body.matchAll(/(?:^|[;\s])name="([^"]{1,200})"/g))
+            if (keys.push({ name: m[1], value: void 0 }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        } else if (type.includes("x-www-form-urlencoded")) {
+          for (const [name, value] of new URLSearchParams(body))
+            if (keys.push({ name, value }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        }
+      } catch {
+      }
+      return keys.slice(0, MAX_CREDENTIAL_KEYS).map(({ name, value }) => {
+        const bare = name.replace(/\[\]$/, "");
+        const parts = bare.match(/[^[\]]+/g);
+        if (bare.endsWith("]") && parts && parts.length > 1) {
+          const inner = parts[parts.length - 1];
+          const outer = parts[parts.length - 2];
+          if (isPasswordKey(outer)) {
+            if (/^\d+$/.test(inner))
+              return { name: outer, value };
+            if (isPasswordKey(inner) || NEW_CREDENTIAL_NAME.test(inner))
+              return { name: inner, value };
+            return { name: `${outer}_${inner}`, value };
+          }
+        }
+        return { name: /\[([^[\]]*)\]$/.exec(bare)?.[1] ?? bare, value };
+      });
+    }
+    function namesNewCredential(body, contentType) {
+      if (NEW_CREDENTIAL_KEY.test(body))
+        return true;
+      const type = contentType ?? (/^\s*[[{]/.test(body) ? null : "application/x-www-form-urlencoded");
+      const keys = credentialKeysOf(body, type);
+      if (keys.some(({ name }) => NEW_CREDENTIAL_NAME.test(name)))
+        return true;
+      const found = keys.filter(({ name, value }) => isPasswordKey(name) && couldBePassword(value));
+      const isBare = (name) => wordsOf(name).every((w) => PASSWORD_KEY_WORDS.has(w));
+      const named = new Set(found.filter(({ name }) => !isBare(name)).map(({ name }) => name.toLowerCase()));
+      const bare = new Set(found.filter(({ name }) => isBare(name)).map(({ name, value }) => value === void 0 ? `name:${name.toLowerCase()}` : `value:${String(value)}`));
+      return named.size + Math.min(bare.size, 2) >= 2;
+    }
+    var GRAPHQL_SIGN_IN_NAME = /^(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})$/i;
+    function wordsOf(segment) {
+      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s._/-]+/).filter(Boolean);
+    }
+    function rawSegmentsOf(pathname) {
+      return pathname.split("/").map((seg) => {
+        const raw = seg.split(";")[0];
+        try {
+          return decodeURIComponent(raw);
+        } catch {
+          return raw;
+        }
+      }).filter(Boolean);
+    }
+    function changesSomething(segments, opts = {}) {
+      const words = segments.flatMap(wordsOf);
+      const joined = segments.map((seg) => wordsOf(seg).join(""));
+      const hard = (w) => NOT_A_SIGN_IN_WORDS.has(w) && !(opts.passwordIsCredential && (w === "password" || w === "passwords"));
+      if (words.some(hard) || joined.some(hard))
+        return true;
+      return words.some((w) => ACCOUNT_CHANGE_WORDS.has(w)) && words.some((w) => ACCOUNT_CHANGE_CONTEXT.has(w));
+    }
+    function isGraphqlSignInName(name) {
+      return GRAPHQL_SIGN_IN_NAME.test(name) && !changesSomething([name], { passwordIsCredential: true });
+    }
+    function graphqlSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let signIns = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return null;
+        const { query, operationName } = entry;
+        if (typeof query !== "string") {
+          if (!Array.isArray(parsed) && query === void 0 && typeof operationName === "string" && isGraphqlSignInName(operationName))
+            return "persisted";
+          return null;
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return null;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && changesSomething([operationName], { passwordIsCredential: true }))
+            return null;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.length === 0 || !roots.every(isGraphqlSignInName))
+            return null;
+          signIns += roots.length;
+        }
+      }
+      return signIns > 0 ? "document" : null;
+    }
+    function isCredentialSignInShape(pathname, search, postData, contentType) {
+      if (typeof postData === "string" && postData.length > MAX_BODY_CHARS)
         return false;
-      if (segs.some((seg) => SIGN_IN_SHAPED_SEGMENTS.has(seg)))
+      const body = typeof postData === "string" && postData.length <= MAX_BODY_CHARS ? postData : null;
+      if (body !== null && namesNewCredential(body, contentType))
+        return false;
+      const raw = rawSegmentsOf(pathname);
+      const segs = raw.map((seg) => seg.toLowerCase());
+      const last = segs[segs.length - 1] ?? "";
+      const prev = segs[segs.length - 2] ?? "";
+      if (SIGN_IN_VERB_SEGMENTS.has(prev) && SIGN_IN_CREDENTIAL_KINDS.has(last))
+        return !changesSomething(raw, { passwordIsCredential: true });
+      if (changesSomething(raw))
+        return false;
+      if (SIGN_IN_LAST_SEGMENTS.has(last) || SIGN_IN_TAILS.has(`${prev}/${last}`))
         return true;
-      return isGraphqlPath(pathname) && typeof postData === "string" && postData.length <= MAX_BODY_CHARS && GRAPHQL_SIGN_IN.test(postData);
+      if (last === "token")
+        return search.get("grant_type") === "password" || body !== null && PASSWORD_GRANT.test(body);
+      if (!isGraphqlPath(pathname) || body === null || (0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search))
+        return false;
+      const graphql = graphqlSignIn(body);
+      return graphql === "persisted" ? graphql : graphql === "document";
     }
     function bodyHasSignInSecret(body, secrets) {
       if (!body || body.length > MAX_BODY_CHARS || secrets.length === 0)
@@ -21037,7 +21788,7 @@ var require_run_write_guard = __commonJS({
     var COGNITO_HOSTED_UI_RE = /^\/(?:oauth2\/(?:token|authorize|userinfo|idpresponse)|saml2\/idpresponse|login|logincontinue)$/;
     var CLERK_FAPI_RE = /^\/v1\/(?:client(?:\/(?:sign_ins(?:\/[^/]+\/(?:prepare_first_factor|attempt_first_factor|prepare_second_factor|attempt_second_factor))?|sessions\/[^/]+\/(?:touch|tokens(?:\/[^/]+)?)|handshake|sync|link))?|dev_browser|environment|oauth_callback)$/;
     var SUPABASE_AUTH_RE = /^\/auth\/v1\/(?:token|otp|magiclink|verify|authorize|callback|sso|saml\/acs|reauthenticate|factors\/[^/]+\/(?:challenge|verify))$/;
-    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
+    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-(?:sms|push|email)-list|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
     var OKTA_AUTH_RE = /^\/(?:api\/v1\/(?:authn(?:\/(?:factors\/[^/]+\/verify|skip|cancel))?|sessions(?:\/me\/lifecycle\/refresh)?)|oauth2\/(?:[^/]+\/)?v1\/(?:token|authorize|introspect|userinfo|device\/authorize)|idp\/idx\/(?:introspect|identify(?:\/select)?|challenge(?:\/answer|\/poll)?|skip|cancel)|login\/[^/]+(?:\/[^/]+)?)$/;
     var MICROSOFT_AUTH_RE = /\/(?:oauth2\/(?:v2\.0\/)?(?:token|authorize|devicecode)|login|kmsi|getcredentialtype|sas\/(?:processauth|beginauth|endauth)|selfasserted|api\/combinedsigninandsignup\/[^/]+|resume|reprocess|federation\/oauth2)$/;
     var GOOGLE_ACCOUNTS_RE = /^\/(?:o\/oauth2\/(?:token|auth|v2\/auth|iframerpc|postmessagerelay|approval)|gsi\/[^/]+(?:\/[^/]+)?|_\/(?:signin|lookup|identitysigninui|accountssigninui)\/.+|v3\/signin\/.+|signin\/.+|servicelogin|checkcookie|accountchooser)$/;
@@ -21103,14 +21854,26 @@ var require_run_write_guard = __commonJS({
       return GENERIC_IDP_AUTH_RE.test(path);
     }
     function isAuthProviderWrite(method, host, pathname, amzTarget, search) {
+      if (!isPlainPost(method, search))
+        return false;
+      if (!(0, shared_1.isAuthProviderHost)(host))
+        return false;
+      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+    }
+    function isPlainPost(method, search) {
       if (method.toUpperCase() !== "POST")
         return false;
       const tunnelled = search.get("_method");
-      if (tunnelled !== null && tunnelled.toUpperCase() !== "POST")
+      return tunnelled === null || tunnelled.toUpperCase() === "POST";
+    }
+    function isAuth0CustomDomainSignIn(method, pathname, search) {
+      if (!isPlainPost(method, search))
         return false;
-      if (!(0, shared_1.isAuthProviderHost)(host))
+      const path = pathname.toLowerCase();
+      if (!AUTH0_AUTH_RE.test(path))
         return false;
-      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+      const needsState = path.startsWith("/u/") || path === "/authorize" || path === "/authorize/resume";
+      return !needsState || (search.get("state") ?? "") !== "";
     }
     function isSignUp(host, pathname, amzTarget) {
       if (PROVIDER_SIGN_UP_PATH.test(pathname))
@@ -21236,8 +21999,7 @@ var require_run_write_guard = __commonJS({
       const host = url.hostname.toLowerCase().replace(/\.$/, "");
       const pathname = url.pathname;
       if (READ_METHODS.has(method)) {
-        const doc = method === "GET" && isGraphqlPath(pathname) ? url.searchParams.get("query") : null;
-        if (doc !== null && !(0, survey_network_guard_js_1.graphqlDocumentIsQueryOnly)(doc)) {
+        if (method === "GET" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlGetMayWrite)(url, facts.postData)) {
           return { action: "write", rule: "graphql-get-mutation", record: describe(facts, url, "graphql-get-mutation") };
         }
         if (method !== "OPTIONS" && isAppSite(host, policy)) {
@@ -21270,15 +22032,17 @@ var require_run_write_guard = __commonJS({
         return { action: "allow", rule: "auth-provider" };
       if (appSite && (0, survey_network_guard_js_1.isSignInPathWrite)(method, pathname))
         return { action: "allow", rule: "sign-in" };
-      if (appSite && method === "POST" && facts.brokerTokenInBody && !segmentsOf(pathname).some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg))) {
+      if (appSite && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "sign-in" };
+      if (appSite && method === "POST" && facts.brokerTokenInBody && !changesSomething(rawSegmentsOf(pathname))) {
         return { action: "allow", rule: "broker-sign-in" };
       }
       if (appSite && isEvidencedTokenRefresh(method, pathname, facts.postData))
         return { action: "allow", rule: "token-refresh" };
-      if (appSite && method === "POST" && facts.signInSecretInBody && isCredentialSignInShape(pathname, facts.postData)) {
-        return { action: "allow", rule: "credential-sign-in" };
-      }
-      if (method === "POST" && isGraphqlPath(pathname) && isGraphqlQueryOnlyBody(facts.postData))
+      const signIn = appSite && method === "POST" && facts.signInSecretInBody ? isCredentialSignInShape(pathname, url.searchParams, facts.postData, facts.contentType) : false;
+      if (signIn)
+        return { action: "allow", rule: "credential-sign-in", ...signIn === "persisted" ? { persisted: true } : {} };
+      if (method === "POST" && isGraphqlPath(pathname) && !(0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
         return { action: "allow", rule: "graphql-query" };
       if (method === "POST" && hostIs(host, SEARCH_POST_HOSTS))
         return { action: "allow", rule: "search-post" };
@@ -21323,6 +22087,8 @@ var require_run_write_guard = __commonJS({
       recordOnly;
       log;
       signInSecrets;
+      /** The deadline of one request the guard sends itself, all its hops together (sendCheckingRedirect). */
+      redirectCheckTimeoutMs;
       /** Tokens the Google sign-in broker handed this context, each until its expiry (epoch ms). */
       brokerTokens = [];
       /** Origins of the Firebase Auth handlers the broker registered for this context. */
@@ -21331,12 +22097,16 @@ var require_run_write_guard = __commonJS({
       relayIds = /* @__PURE__ */ new Set();
       relayed = 0;
       relayRejected = 0;
+      /** Credential sign-ins already said in the run log (observe mode; method, host and path shape). */
+      signInsLogged = /* @__PURE__ */ new Set();
       constructor(policy, opts = {}) {
         this.policy = policy;
         this.compiled = policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
         this.recordOnly = new Set((policy.recordOnlyRules ?? exports2.DEFAULT_RECORD_ONLY_RULES).filter((rule) => exports2.RECORD_ONLY_CAPABLE_RULES.includes(rule)));
         this.log = opts.onLog;
         this.signInSecrets = (opts.signInSecrets ?? []).filter((v) => typeof v === "string" && v.length >= MIN_SIGN_IN_SECRET_CHARS);
+        const ms = opts.redirectCheckTimeoutMs;
+        this.redirectCheckTimeoutMs = typeof ms === "number" && ms > 0 ? Math.min(ms, REDIRECT_CHECK_TIMEOUT_MS) : REDIRECT_CHECK_TIMEOUT_MS;
       }
       decide(facts) {
         const signInSecretInBody = facts.signInSecretInBody ?? bodyHasSignInSecret(facts.postData, this.signInSecrets);
@@ -21359,8 +22129,28 @@ var require_run_write_guard = __commonJS({
           consumedBrokerTokens.add(brokerToken.value);
           this.brokerTokens = this.brokerTokens.filter((t) => t !== brokerToken);
         }
+        if (decision.rule === "credential-sign-in" && this.policy.mode === "observe")
+          this.noteCredentialSignIn(facts, decision.persisted === true);
         return decision;
       }
+      /**
+       * Observe mode says where each credential sign-in went, once per path and kind (the lead): the
+       * method, host and masked path only, never the body, so the rule can be checked against real runs
+       * before a site is blocked. A GraphQL persisted query is marked unverified.
+       */
+      noteCredentialSignIn(facts, persisted) {
+        let host = "";
+        try {
+          host = new URL(facts.url).hostname.toLowerCase();
+        } catch {
+          return;
+        }
+        const line = `${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} [credential-sign-in${persisted ? " (persisted, unverified)" : ""}]`;
+        if (this.signInsLogged.has(line) || this.signInsLogged.size >= MAX_SIGN_IN_LOG_LINES)
+          return;
+        this.signInsLogged.add(line);
+        this.log?.(`[run-write-guard] allowed ${line}`);
+      }
       /**
        * A code or ID token the Google sign-in broker hands this context: the first POST that carries it
        * to the app in the next BROKER_TOKEN_TTL_MS is the sign-in. Anything not shaped like a Google code
@@ -21420,8 +22210,9 @@ var require_run_write_guard = __commonJS({
       }
       /**
        * A hop the guard fetched itself (sendCheckingRedirect) failed, so the request fails in the page.
-       * Said in the run log, with the timeout when it was that: a slow allowed upload or stream is cut
-       * at REDIRECT_CHECK_TIMEOUT_MS, and the page only sees a network error.
+       * Said in the run log, with the reason when it was the guard's own limit: a slow allowed upload or
+       * stream is cut at its deadline, an answer over MAX_GUARD_HOP_BYTES as it streams in, and the page
+       * only sees a network error.
        */
       noteRedirectCheckFailed(facts, err, timeoutMs) {
         let host = "";
@@ -21429,8 +22220,8 @@ var require_run_write_guard = __commonJS({
           host = new URL(facts.url).hostname.toLowerCase();
         } catch {
         }
-        const timedOut = err instanceof Error && (err.name === "TimeoutError" || /\btimeout\b/i.test(err.message));
-        const why = timedOut ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : "the guard's redirect check failed";
+        const reason = err instanceof GuardHopError ? err.reason : null;
+        const why = reason === "timeout" ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : reason === "over-cap" ? `the answer was over ${MAX_GUARD_HOP_BYTES / (1024 * 1024)} MB (MAX_GUARD_HOP_BYTES), cut as it came in` : "the guard's redirect check failed";
         this.log?.(`[run-write-guard] note: ${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} failed in the page: ${why}`);
       }
       /** A request still undecided when its page closed (see guardPageClose): it is failed in the page, so the browser never sends it. */
@@ -21878,66 +22669,321 @@ var require_run_write_guard = __commonJS({
       }
     }
     var MAX_GUARD_REDIRECTS = 5;
-    var REDIRECT_CHECK_TIMEOUT_MS = 6e4;
+    var REDIRECT_CHECK_TIMEOUT_MS = 3e4;
+    var MAX_GUARD_HOP_BYTES = 16 * 1024 * 1024;
+    var MAX_GUARD_BUFFERED_BYTES = 128 * 1024 * 1024;
+    var SEND_HTTP = node_http_1.request;
+    var SEND_HTTPS = node_https_1.request;
+    var HOP_ONLY_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-connection",
+      "transfer-encoding",
+      "te",
+      "trailer",
+      "upgrade",
+      "proxy-authorization",
+      "proxy-authenticate",
+      "host",
+      "content-length"
+    ]);
+    var hopBytesInFlight = 0;
+    var hopsInFlight = /* @__PURE__ */ new Set();
+    var hopBudgetWaiters = [];
+    function releaseHopBytes(hop, bytes) {
+      hopsInFlight.delete(hop);
+      hopBytesInFlight -= bytes;
+      for (const wake of hopBudgetWaiters.splice(0))
+        wake();
+    }
+    function runWriteGuardHopBytesInFlight() {
+      return hopBytesInFlight;
+    }
+    var GuardHopError = class extends Error {
+      reason;
+      constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "GuardHopError";
+      }
+    };
+    function sendGuardHop(hop) {
+      return new Promise((resolve, reject) => {
+        let url;
+        try {
+          url = new URL(hop.url);
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        const send = url.protocol === "https:" ? SEND_HTTPS : url.protocol === "http:" ? SEND_HTTP : null;
+        if (!send) {
+          reject(new Error(`the guard sends only http(s), not ${url.protocol}`));
+          return;
+        }
+        const id = /* @__PURE__ */ Symbol("guard hop");
+        hopsInFlight.add(id);
+        let held = 0;
+        let settled = false;
+        let req = null;
+        const chunks = [];
+        const fail = (err) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          req?.destroy();
+          releaseHopBytes(id, held);
+          held = 0;
+          reject(err);
+        };
+        const overCap = () => new GuardHopError("over-cap", `answer over ${MAX_GUARD_HOP_BYTES} bytes`);
+        const timer = setTimeout(() => fail(new GuardHopError("timeout", "the guard hop passed its deadline")), Math.max(0, hop.deadline - Date.now()));
+        try {
+          req = send(url, { method: hop.method, headers: hop.headers, rejectUnauthorized: !hop.ignoreHTTPSErrors, agent: false }, (res) => {
+            const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+            const decoder = encoding === "gzip" || encoding === "x-gzip" ? (0, node_zlib_1.createGunzip)({ flush: node_zlib_1.constants.Z_SYNC_FLUSH, finishFlush: node_zlib_1.constants.Z_SYNC_FLUSH }) : encoding === "br" ? (0, node_zlib_1.createBrotliDecompress)({ flush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH, finishFlush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH }) : encoding === "deflate" ? (0, node_zlib_1.createInflate)() : null;
+            const body = decoder ? (0, node_stream_1.pipeline)(res, decoder, (err) => {
+              if (err)
+                fail(err);
+            }) : res;
+            const parked = [];
+            let paused = false;
+            let ended = false;
+            const take = (chunk) => {
+              if (settled)
+                return;
+              if (paused) {
+                parked.push(chunk);
+                return;
+              }
+              if (held + chunk.length > MAX_GUARD_HOP_BYTES) {
+                fail(overCap());
+                return;
+              }
+              const oldest = hopsInFlight.values().next().value === id;
+              const room = oldest ? MAX_GUARD_BUFFERED_BYTES : MAX_GUARD_BUFFERED_BYTES - MAX_GUARD_HOP_BYTES;
+              if (hopBytesInFlight + chunk.length > room) {
+                paused = true;
+                body.pause();
+                parked.push(chunk);
+                hopBudgetWaiters.push(drain);
+                return;
+              }
+              hopBytesInFlight += chunk.length;
+              held += chunk.length;
+              chunks.push(chunk);
+            };
+            const drain = () => {
+              paused = false;
+              const queued = parked.splice(0);
+              for (let i = 0; i < queued.length; i++) {
+                take(queued[i]);
+                if (settled)
+                  return;
+                if (paused) {
+                  parked.push(...queued.slice(i + 1));
+                  return;
+                }
+              }
+              if (ended)
+                finish();
+              else
+                body.resume();
+            };
+            body.on("data", take);
+            body.on("error", (err) => fail(err));
+            res.on("error", (err) => fail(err));
+            body.on("end", () => {
+              ended = true;
+              if (!paused)
+                finish();
+            });
+            const finish = () => {
+              if (settled)
+                return;
+              settled = true;
+              clearTimeout(timer);
+              const kept = held;
+              let released = false;
+              const headers = [];
+              for (let i = 0; i + 1 < res.rawHeaders.length; i += 2)
+                headers.push([res.rawHeaders[i], res.rawHeaders[i + 1]]);
+              resolve({
+                status: res.statusCode ?? 0,
+                headers,
+                body: Buffer.concat(chunks, kept),
+                decoded: decoder !== null,
+                release: () => {
+                  if (!released) {
+                    released = true;
+                    releaseHopBytes(id, kept);
+                  }
+                }
+              });
+            };
+          });
+          req.on("error", (err) => fail(err));
+          req.end(hop.body ?? void 0);
+        } catch (err) {
+          fail(err instanceof Error ? err : new Error(String(err)));
+        }
+      });
+    }
+    function contextIgnoresHttpsErrors(context) {
+      try {
+        return context._options?.ignoreHTTPSErrors === true;
+      } catch {
+        return false;
+      }
+    }
+    function hopRequestHeaders(pageHeaders, cookie) {
+      const out = { accept: "*/*" };
+      for (const [name, value] of Object.entries(pageHeaders)) {
+        const key = name.toLowerCase();
+        if (key.startsWith(":") || HOP_ONLY_HEADERS.has(key) || key === "cookie")
+          continue;
+        out[key] = value;
+      }
+      out["accept-encoding"] = "gzip, deflate, br";
+      if (cookie)
+        out.cookie = cookie;
+      return out;
+    }
+    function cookiePairs(header) {
+      return header.split(";").flatMap((part) => {
+        const eq = part.indexOf("=");
+        return eq > 0 ? [[part.slice(0, eq).trim(), part.slice(eq + 1).trim()]] : [];
+      });
+    }
+    function hopCookie(pageCookie, contextCookies, setCookies) {
+      const jar = /* @__PURE__ */ new Map();
+      if (pageCookie)
+        for (const [name, value] of cookiePairs(pageCookie))
+          jar.set(name, value);
+      else
+        for (const c of contextCookies)
+          jar.set(c.name, c.value);
+      for (const line of setCookies) {
+        const [pair, ...attrs] = line.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+          continue;
+        const name = pair.slice(0, eq).trim();
+        const gone = attrs.some((a) => {
+          const [k, v = ""] = a.split("=");
+          const key = k.trim().toLowerCase();
+          return key === "max-age" && Number(v.trim()) <= 0 || key === "expires" && Date.parse(v.trim()) < Date.now();
+        });
+        if (gone)
+          jar.delete(name);
+        else
+          jar.set(name, pair.slice(eq + 1).trim());
+      }
+      return [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
+    }
+    function setCookiesOf(answer) {
+      return answer.headers.filter(([name]) => name.toLowerCase() === "set-cookie").map(([, value]) => value);
+    }
+    function fulfillHeaders(answer, earlierSetCookies) {
+      const out = {};
+      const cookies = [...earlierSetCookies];
+      for (const [name, value] of answer.headers) {
+        const key = name.toLowerCase();
+        if (HOP_ONLY_HEADERS.has(key) || answer.decoded && key === "content-encoding")
+          continue;
+        if (key === "set-cookie") {
+          cookies.push(value);
+          continue;
+        }
+        out[key] = key in out ? `${out[key]}, ${value}` : value;
+      }
+      if (cookies.length > 0)
+        out["set-cookie"] = cookies.join("\n");
+      return out;
+    }
     var cutAtClose = /* @__PURE__ */ new WeakSet();
-    async function sendCheckingRedirect(route, guard) {
-      const first = factsOf(route.request());
+    async function sendCheckingRedirect(route, guard, context) {
+      const request = route.request();
+      const first = factsOf(request);
+      const deadline = Date.now() + guard.redirectCheckTimeoutMs;
       let facts = first;
+      let pageHeaders = {};
+      let postBody = null;
+      const setCookies = [];
       for (let hop = 0; ; hop++) {
-        let response;
+        let answer;
         try {
-          response = await route.fetch(hop === 0 ? { maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS } : { url: facts.url, maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS });
+          if (hop === 0) {
+            pageHeaders = request.headers();
+            postBody = request.postDataBuffer();
+          }
+          const pageCookie = hop === 0 ? Object.entries(pageHeaders).find(([name]) => name.toLowerCase() === "cookie")?.[1] : void 0;
+          const cookie = hopCookie(pageCookie, pageCookie ? [] : await context.cookies(facts.url), setCookies);
+          answer = await sendGuardHop({
+            url: facts.url,
+            method: facts.method,
+            headers: hopRequestHeaders(pageHeaders, cookie),
+            body: postBody,
+            ignoreHTTPSErrors: contextIgnoresHttpsErrors(context),
+            deadline
+          });
         } catch (err) {
           if (cutAtClose.has(route))
             return;
-          guard.noteRedirectCheckFailed(facts, err, REDIRECT_CHECK_TIMEOUT_MS);
+          guard.noteRedirectCheckFailed(facts, err, guard.redirectCheckTimeoutMs);
           await route.abort("failed").catch(() => {
           });
           return;
         }
-        if (cutAtClose.has(route))
-          return;
-        const status = response.status();
-        const location = response.headers()["location"];
-        const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
-        if (!next) {
-          await route.fulfill({ response }).catch(() => {
-          });
-          return;
-        }
-        let decision;
         try {
-          decision = guard.decide(next);
-        } catch {
-          decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
-        }
-        if (decision.action === "write") {
-          if (decision.record)
-            guard.note(decision.record);
-          if (guard.holds(decision.rule)) {
+          if (cutAtClose.has(route))
+            return;
+          const status = answer.status;
+          const location = answer.headers.find(([name]) => name.toLowerCase() === "location")?.[1];
+          const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
+          if (!next) {
+            await route.fulfill({ status, headers: fulfillHeaders(answer, setCookies), body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          let decision;
+          try {
+            decision = guard.decide(next);
+          } catch {
+            decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
+          }
+          if (decision.action === "write") {
+            if (decision.record)
+              guard.note(decision.record);
+            if (guard.holds(decision.rule)) {
+              await route.abort("blockedbyclient").catch(() => {
+              });
+              return;
+            }
+          }
+          if (READ_METHODS.has(next.method.toUpperCase())) {
+            await route.fulfill({ status, headers: { ...fulfillHeaders(answer, setCookies), location: next.url }, body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          if (!sameOrigin(next.url, first.url)) {
+            const target = new URL(next.url);
+            guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
             await route.abort("blockedbyclient").catch(() => {
             });
             return;
           }
+          if (hop + 1 >= MAX_GUARD_REDIRECTS) {
+            await route.abort("failed").catch(() => {
+            });
+            return;
+          }
+          setCookies.push(...setCookiesOf(answer));
+          facts = next;
+        } finally {
+          answer.release();
         }
-        if (READ_METHODS.has(next.method.toUpperCase())) {
-          await route.fulfill({ response, headers: { ...response.headers(), location: next.url } }).catch(() => {
-          });
-          return;
-        }
-        if (!sameOrigin(next.url, first.url)) {
-          const target = new URL(next.url);
-          guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
-          await route.abort("blockedbyclient").catch(() => {
-          });
-          return;
-        }
-        if (hop + 1 >= MAX_GUARD_REDIRECTS) {
-          await route.abort("failed").catch(() => {
-          });
-          return;
-        }
-        facts = next;
       }
     }
     function sameRouteUrl(a, b) {
@@ -22151,7 +23197,7 @@ var require_run_write_guard = __commonJS({
             }
           }
           if (decision.action === "allow" && !READ_METHODS.has(request.method().toUpperCase()) && checksRedirect(decision.rule, request.url(), guard.policy)) {
-            await sendCheckingRedirect(route, guard);
+            await sendCheckingRedirect(route, guard, context);
             return;
           }
           await route.fallback().catch(() => {