@validate.qa/runner 1.0.100 → 1.0.101

package/dist/{chunk-2XD63NU5.mjs → chunk-BBTK6OX6.mjs}

@@ -1,10 +1,10 @@
 import {
   require_survey_network_guard
-} from "./chunk-GIIIVO2W.mjs";
+} from "./chunk-SN3PN4G4.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-IGXGSDE3.mjs";
 import {
   __commonJS,
   __require,
@@ -365,6 +365,7 @@ var require_run_write_guard = __commonJS({
     exports.addRunWriteAuthHandler = addRunWriteAuthHandler;
     exports.runWriteContextOptions = runWriteContextOptions;
     exports.clearRunWriteRelay = clearRunWriteRelay;
+    exports.runWriteGuardHopBytesInFlight = runWriteGuardHopBytesInFlight;
     exports.installRunWriteGuard = installRunWriteGuard;
     exports.installNodeFetchGuard = installNodeFetchGuard;
     exports.runWriteGuardRefusal = runWriteGuardRefusal;
@@ -376,7 +377,11 @@ var require_run_write_guard = __commonJS({
     exports.safeWritePatternFor = safeWritePatternFor;
     var node_async_hooks_1 = __require("async_hooks");
     var node_crypto_1 = __require("crypto");
+    var node_http_1 = __require("http");
+    var node_https_1 = __require("https");
     var node_path_1 = __require("path");
+    var node_stream_1 = __require("stream");
+    var node_zlib_1 = __require("zlib");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_network_guard_js_1 = require_survey_network_guard();
     var bounded_output_js_1 = require_bounded_output();
@@ -424,12 +429,13 @@ var require_run_write_guard = __commonJS({
         allowPatterns,
         ignoredAllowPatterns,
         recordOnlyRules,
-        reason: v.reason.slice(0, MAX_REASON_CHARS)
+        reason: v.reason.slice(0, MAX_REASON_CHARS),
+        ...v.pwAgentsGuard === "off" ? { pwAgentsGuard: "off" } : {}
       };
     }
     var policyScope = new node_async_hooks_1.AsyncLocalStorage();
     var MIN_SIGN_IN_SECRET_CHARS = 6;
-    exports.SIGN_IN_SECRET_VARIABLE = /PASS(?:WORD|CODE|PHRASE)?$/i;
+    exports.SIGN_IN_SECRET_VARIABLE = /(?:PASS(?:WORD|CODE|PHRASE)?|[A-Z0-9]_PASSWD|[A-Z0-9]_PWD)$/i;
     function signInSecretsOf(vars) {
       if (!vars || typeof vars !== "object")
         return [];
@@ -446,6 +452,7 @@ var require_run_write_guard = __commonJS({
     }
     var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     var MAX_BODY_CHARS = 262144;
+    var MAX_SIGN_IN_LOG_LINES = 20;
     var CAPTCHA_HOSTS = ["recaptcha.net", "hcaptcha.com", "challenges.cloudflare.com"];
     var SEARCH_POST_HOSTS = ["algolia.net", "algolianet.com", "algolia.io"];
     var PAYMENT_HOSTS = [
@@ -471,7 +478,7 @@ var require_run_write_guard = __commonJS({
     var SEARCH_LAST_SEGMENTS = /* @__PURE__ */ new Set(["search", "autocomplete", "suggest", "suggestions", "typeahead"]);
     var PROVIDER_SIGN_UP_PATH = /(?:\/accounts:signup|\/dbconnections\/signup|\/auth\/v1\/signup|\/v1\/client\/sign_ups)(?:[/?]|$)/i;
     var FIRST_PARTY_SIGN_UP_SEGMENTS = /* @__PURE__ */ new Set(["signup", "sign-up", "sign_up", "register", "registration", "create-account", "createaccount", "sign_ups"]);
-    var NOT_A_SIGN_IN_SEGMENTS = /* @__PURE__ */ new Set([
+    var NOT_A_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
       "delete",
       "destroy",
       "remove",
@@ -480,19 +487,29 @@ var require_run_write_guard = __commonJS({
       "cancel",
       "password",
       "passwords",
-      "change-password",
-      "change_password",
       "reset",
-      "reset-password",
       "update",
       "logout",
       "signout",
-      "sign-out",
       "revoke",
       "transfer",
-      "withdraw"
+      "withdraw",
+      "disable",
+      "enable",
+      "unlink",
+      "change",
+      "erase",
+      "purge",
+      "wipe",
+      "terminate",
+      "suspend",
+      "leave",
+      "disconnect",
+      "deauthorize"
     ]);
-    var SIGN_IN_SHAPED_SEGMENTS = /* @__PURE__ */ new Set([
+    var ACCOUNT_CHANGE_WORDS = /* @__PURE__ */ new Set(["email", "mfa", "2fa", "totp", "otp"]);
+    var ACCOUNT_CHANGE_CONTEXT = /* @__PURE__ */ new Set(["account", "owner", "ownership", "invite"]);
+    var SIGN_IN_LAST_SEGMENTS = /* @__PURE__ */ new Set([
       "session",
       "sessions",
       "login",
@@ -502,25 +519,196 @@ var require_run_write_guard = __commonJS({
       "signin",
       "sign-in",
       "sign_in",
-      "auth",
       "authenticate",
       "authentication",
-      "token",
-      "tokens",
-      "oauth",
-      "oauth2",
-      "sso",
-      "identity",
-      "credentials"
+      "auth"
     ]);
-    var GRAPHQL_SIGN_IN = /"operationName"\s*:\s*"(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})"|\bmutation\b[^{]{0,200}\{\s*(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})\s*[({]/i;
-    function isCredentialSignInShape(pathname, postData) {
-      const segs = segmentsOf(pathname);
-      if (segs.some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg)))
+    var SIGN_IN_VERB_SEGMENTS = /* @__PURE__ */ new Set(["login", "log-in", "log_in", "signin", "sign-in", "sign_in"]);
+    var SIGN_IN_CREDENTIAL_KINDS = /* @__PURE__ */ new Set(["email", "username", "phone", "password"]);
+    var SIGN_IN_TAILS = /* @__PURE__ */ new Set(["callback/credentials", "auth/local", "session/new", "sessions/new"]);
+    var PASSWORD_GRANT = /(?:^|[&{,\s"])grant_type"?\s*[=:]\s*"?password(?=["&,}\s]|$)/;
+    var NEW_CREDENTIAL_STEM = "(?:pass(?:word|wd)?|pwd)";
+    var NEW_CREDENTIAL_WORD = `(?:(?:new|old|current|confirm|repeat|verify|retype)[_-]?(?:${NEW_CREDENTIAL_STEM}|email)|${NEW_CREDENTIAL_STEM}[_-]?(?:new|old|current|confirm(?:ation)?|repeat(?:ed)?|verify|verification|again|retype|check|confirmed|2)|email[_-]?confirm(?:ation)?)`;
+    var NEW_CREDENTIAL_NAME = new RegExp(`^${NEW_CREDENTIAL_WORD}$`, "i");
+    var NEW_CREDENTIAL_KEY = new RegExp(`(?:^|["&{,\\s[])${NEW_CREDENTIAL_WORD}(?:["\\]]?\\s*[:=]|"\\s*(?:;|$))`, "im");
+    var PASSWORD_KEY_WORDS = /* @__PURE__ */ new Set(["password", "passwd", "pwd", "pass"]);
+    var PASSWORD_KEY_QUALIFIERS = /* @__PURE__ */ new Set([
+      "new",
+      "old",
+      "current",
+      "confirm",
+      "confirmed",
+      "confirmation",
+      "repeat",
+      "repeated",
+      "verify",
+      "verification",
+      "again",
+      "retype",
+      "check",
+      "2"
+    ]);
+    function isPasswordKey(key) {
+      const words = wordsOf(key);
+      return words.some((w) => PASSWORD_KEY_WORDS.has(w)) && words.every((w) => PASSWORD_KEY_WORDS.has(w) || PASSWORD_KEY_QUALIFIERS.has(w));
+    }
+    function couldBePassword(value) {
+      if (value === void 0)
+        return true;
+      if (typeof value === "number")
+        return Number.isFinite(value);
+      if (typeof value !== "string")
+        return false;
+      const v = value.trim();
+      return v !== "" && !/^(?:true|false|on|off|yes|no|null)$/i.test(v);
+    }
+    var MAX_CREDENTIAL_KEYS = 200;
+    function credentialKeysOf(body, contentType) {
+      const type = (contentType ?? "").toLowerCase();
+      const keys = [];
+      try {
+        if (type.includes("json") || /^\s*[[{]/.test(body)) {
+          const stack = [{ value: JSON.parse(body), under: null }];
+          while (stack.length > 0 && keys.length < MAX_CREDENTIAL_KEYS) {
+            const { value, under } = stack.pop();
+            if (Array.isArray(value))
+              stack.push(...value.slice(0, MAX_CREDENTIAL_KEYS).map((inner) => ({ value: inner, under: null })));
+            else if (value && typeof value === "object") {
+              for (const [key, inner] of Object.entries(value).slice(0, MAX_CREDENTIAL_KEYS)) {
+                const name = under === null ? key : `${under}_${key}`;
+                keys.push({ name, value: inner });
+                if (Array.isArray(inner) && isPasswordKey(name)) {
+                  for (const item of inner.slice(0, MAX_CREDENTIAL_KEYS))
+                    if (item === null || typeof item !== "object")
+                      keys.push({ name, value: item });
+                }
+                const object = inner !== null && typeof inner === "object" && !Array.isArray(inner);
+                stack.push({ value: inner, under: object && isPasswordKey(name) ? name : null });
+              }
+            }
+          }
+        } else if (type.includes("multipart/form-data")) {
+          for (const m of body.matchAll(/(?:^|[;\s])name="([^"]{1,200})"/g))
+            if (keys.push({ name: m[1], value: void 0 }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        } else if (type.includes("x-www-form-urlencoded")) {
+          for (const [name, value] of new URLSearchParams(body))
+            if (keys.push({ name, value }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        }
+      } catch {
+      }
+      return keys.slice(0, MAX_CREDENTIAL_KEYS).map(({ name, value }) => {
+        const bare = name.replace(/\[\]$/, "");
+        const parts = bare.match(/[^[\]]+/g);
+        if (bare.endsWith("]") && parts && parts.length > 1) {
+          const inner = parts[parts.length - 1];
+          const outer = parts[parts.length - 2];
+          if (isPasswordKey(outer)) {
+            if (/^\d+$/.test(inner))
+              return { name: outer, value };
+            if (isPasswordKey(inner) || NEW_CREDENTIAL_NAME.test(inner))
+              return { name: inner, value };
+            return { name: `${outer}_${inner}`, value };
+          }
+        }
+        return { name: /\[([^[\]]*)\]$/.exec(bare)?.[1] ?? bare, value };
+      });
+    }
+    function namesNewCredential(body, contentType) {
+      if (NEW_CREDENTIAL_KEY.test(body))
+        return true;
+      const type = contentType ?? (/^\s*[[{]/.test(body) ? null : "application/x-www-form-urlencoded");
+      const keys = credentialKeysOf(body, type);
+      if (keys.some(({ name }) => NEW_CREDENTIAL_NAME.test(name)))
+        return true;
+      const found = keys.filter(({ name, value }) => isPasswordKey(name) && couldBePassword(value));
+      const isBare = (name) => wordsOf(name).every((w) => PASSWORD_KEY_WORDS.has(w));
+      const named = new Set(found.filter(({ name }) => !isBare(name)).map(({ name }) => name.toLowerCase()));
+      const bare = new Set(found.filter(({ name }) => isBare(name)).map(({ name, value }) => value === void 0 ? `name:${name.toLowerCase()}` : `value:${String(value)}`));
+      return named.size + Math.min(bare.size, 2) >= 2;
+    }
+    var GRAPHQL_SIGN_IN_NAME = /^(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})$/i;
+    function wordsOf(segment) {
+      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s._/-]+/).filter(Boolean);
+    }
+    function rawSegmentsOf(pathname) {
+      return pathname.split("/").map((seg) => {
+        const raw = seg.split(";")[0];
+        try {
+          return decodeURIComponent(raw);
+        } catch {
+          return raw;
+        }
+      }).filter(Boolean);
+    }
+    function changesSomething(segments, opts = {}) {
+      const words = segments.flatMap(wordsOf);
+      const joined = segments.map((seg) => wordsOf(seg).join(""));
+      const hard = (w) => NOT_A_SIGN_IN_WORDS.has(w) && !(opts.passwordIsCredential && (w === "password" || w === "passwords"));
+      if (words.some(hard) || joined.some(hard))
+        return true;
+      return words.some((w) => ACCOUNT_CHANGE_WORDS.has(w)) && words.some((w) => ACCOUNT_CHANGE_CONTEXT.has(w));
+    }
+    function isGraphqlSignInName(name) {
+      return GRAPHQL_SIGN_IN_NAME.test(name) && !changesSomething([name], { passwordIsCredential: true });
+    }
+    function graphqlSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let signIns = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return null;
+        const { query, operationName } = entry;
+        if (typeof query !== "string") {
+          if (!Array.isArray(parsed) && query === void 0 && typeof operationName === "string" && isGraphqlSignInName(operationName))
+            return "persisted";
+          return null;
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return null;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && changesSomething([operationName], { passwordIsCredential: true }))
+            return null;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.length === 0 || !roots.every(isGraphqlSignInName))
+            return null;
+          signIns += roots.length;
+        }
+      }
+      return signIns > 0 ? "document" : null;
+    }
+    function isCredentialSignInShape(pathname, search, postData, contentType) {
+      if (typeof postData === "string" && postData.length > MAX_BODY_CHARS)
+        return false;
+      const body = typeof postData === "string" && postData.length <= MAX_BODY_CHARS ? postData : null;
+      if (body !== null && namesNewCredential(body, contentType))
         return false;
-      if (segs.some((seg) => SIGN_IN_SHAPED_SEGMENTS.has(seg)))
+      const raw = rawSegmentsOf(pathname);
+      const segs = raw.map((seg) => seg.toLowerCase());
+      const last = segs[segs.length - 1] ?? "";
+      const prev = segs[segs.length - 2] ?? "";
+      if (SIGN_IN_VERB_SEGMENTS.has(prev) && SIGN_IN_CREDENTIAL_KINDS.has(last))
+        return !changesSomething(raw, { passwordIsCredential: true });
+      if (changesSomething(raw))
+        return false;
+      if (SIGN_IN_LAST_SEGMENTS.has(last) || SIGN_IN_TAILS.has(`${prev}/${last}`))
         return true;
-      return isGraphqlPath(pathname) && typeof postData === "string" && postData.length <= MAX_BODY_CHARS && GRAPHQL_SIGN_IN.test(postData);
+      if (last === "token")
+        return search.get("grant_type") === "password" || body !== null && PASSWORD_GRANT.test(body);
+      if (!isGraphqlPath(pathname) || body === null || (0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search))
+        return false;
+      const graphql = graphqlSignIn(body);
+      return graphql === "persisted" ? graphql : graphql === "document";
     }
     function bodyHasSignInSecret(body, secrets) {
       if (!body || body.length > MAX_BODY_CHARS || secrets.length === 0)
@@ -548,7 +736,7 @@ var require_run_write_guard = __commonJS({
     var COGNITO_HOSTED_UI_RE = /^\/(?:oauth2\/(?:token|authorize|userinfo|idpresponse)|saml2\/idpresponse|login|logincontinue)$/;
     var CLERK_FAPI_RE = /^\/v1\/(?:client(?:\/(?:sign_ins(?:\/[^/]+\/(?:prepare_first_factor|attempt_first_factor|prepare_second_factor|attempt_second_factor))?|sessions\/[^/]+\/(?:touch|tokens(?:\/[^/]+)?)|handshake|sync|link))?|dev_browser|environment|oauth_callback)$/;
     var SUPABASE_AUTH_RE = /^\/auth\/v1\/(?:token|otp|magiclink|verify|authorize|callback|sso|saml\/acs|reauthenticate|factors\/[^/]+\/(?:challenge|verify))$/;
-    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
+    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-(?:sms|push|email)-list|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
     var OKTA_AUTH_RE = /^\/(?:api\/v1\/(?:authn(?:\/(?:factors\/[^/]+\/verify|skip|cancel))?|sessions(?:\/me\/lifecycle\/refresh)?)|oauth2\/(?:[^/]+\/)?v1\/(?:token|authorize|introspect|userinfo|device\/authorize)|idp\/idx\/(?:introspect|identify(?:\/select)?|challenge(?:\/answer|\/poll)?|skip|cancel)|login\/[^/]+(?:\/[^/]+)?)$/;
     var MICROSOFT_AUTH_RE = /\/(?:oauth2\/(?:v2\.0\/)?(?:token|authorize|devicecode)|login|kmsi|getcredentialtype|sas\/(?:processauth|beginauth|endauth)|selfasserted|api\/combinedsigninandsignup\/[^/]+|resume|reprocess|federation\/oauth2)$/;
     var GOOGLE_ACCOUNTS_RE = /^\/(?:o\/oauth2\/(?:token|auth|v2\/auth|iframerpc|postmessagerelay|approval)|gsi\/[^/]+(?:\/[^/]+)?|_\/(?:signin|lookup|identitysigninui|accountssigninui)\/.+|v3\/signin\/.+|signin\/.+|servicelogin|checkcookie|accountchooser)$/;
@@ -614,14 +802,26 @@ var require_run_write_guard = __commonJS({
       return GENERIC_IDP_AUTH_RE.test(path);
     }
     function isAuthProviderWrite(method, host, pathname, amzTarget, search) {
+      if (!isPlainPost(method, search))
+        return false;
+      if (!(0, shared_1.isAuthProviderHost)(host))
+        return false;
+      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+    }
+    function isPlainPost(method, search) {
       if (method.toUpperCase() !== "POST")
         return false;
       const tunnelled = search.get("_method");
-      if (tunnelled !== null && tunnelled.toUpperCase() !== "POST")
+      return tunnelled === null || tunnelled.toUpperCase() === "POST";
+    }
+    function isAuth0CustomDomainSignIn(method, pathname, search) {
+      if (!isPlainPost(method, search))
         return false;
-      if (!(0, shared_1.isAuthProviderHost)(host))
+      const path = pathname.toLowerCase();
+      if (!AUTH0_AUTH_RE.test(path))
         return false;
-      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+      const needsState = path.startsWith("/u/") || path === "/authorize" || path === "/authorize/resume";
+      return !needsState || (search.get("state") ?? "") !== "";
     }
     function isSignUp(host, pathname, amzTarget) {
       if (PROVIDER_SIGN_UP_PATH.test(pathname))
@@ -747,8 +947,7 @@ var require_run_write_guard = __commonJS({
       const host = url.hostname.toLowerCase().replace(/\.$/, "");
       const pathname = url.pathname;
       if (READ_METHODS.has(method)) {
-        const doc = method === "GET" && isGraphqlPath(pathname) ? url.searchParams.get("query") : null;
-        if (doc !== null && !(0, survey_network_guard_js_1.graphqlDocumentIsQueryOnly)(doc)) {
+        if (method === "GET" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlGetMayWrite)(url, facts.postData)) {
           return { action: "write", rule: "graphql-get-mutation", record: describe(facts, url, "graphql-get-mutation") };
         }
         if (method !== "OPTIONS" && isAppSite(host, policy)) {
@@ -781,15 +980,17 @@ var require_run_write_guard = __commonJS({
         return { action: "allow", rule: "auth-provider" };
       if (appSite && (0, survey_network_guard_js_1.isSignInPathWrite)(method, pathname))
         return { action: "allow", rule: "sign-in" };
-      if (appSite && method === "POST" && facts.brokerTokenInBody && !segmentsOf(pathname).some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg))) {
+      if (appSite && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "sign-in" };
+      if (appSite && method === "POST" && facts.brokerTokenInBody && !changesSomething(rawSegmentsOf(pathname))) {
         return { action: "allow", rule: "broker-sign-in" };
       }
       if (appSite && isEvidencedTokenRefresh(method, pathname, facts.postData))
         return { action: "allow", rule: "token-refresh" };
-      if (appSite && method === "POST" && facts.signInSecretInBody && isCredentialSignInShape(pathname, facts.postData)) {
-        return { action: "allow", rule: "credential-sign-in" };
-      }
-      if (method === "POST" && isGraphqlPath(pathname) && isGraphqlQueryOnlyBody(facts.postData))
+      const signIn = appSite && method === "POST" && facts.signInSecretInBody ? isCredentialSignInShape(pathname, url.searchParams, facts.postData, facts.contentType) : false;
+      if (signIn)
+        return { action: "allow", rule: "credential-sign-in", ...signIn === "persisted" ? { persisted: true } : {} };
+      if (method === "POST" && isGraphqlPath(pathname) && !(0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
         return { action: "allow", rule: "graphql-query" };
       if (method === "POST" && hostIs(host, SEARCH_POST_HOSTS))
         return { action: "allow", rule: "search-post" };
@@ -834,6 +1035,8 @@ var require_run_write_guard = __commonJS({
       recordOnly;
       log;
       signInSecrets;
+      /** The deadline of one request the guard sends itself, all its hops together (sendCheckingRedirect). */
+      redirectCheckTimeoutMs;
       /** Tokens the Google sign-in broker handed this context, each until its expiry (epoch ms). */
       brokerTokens = [];
       /** Origins of the Firebase Auth handlers the broker registered for this context. */
@@ -842,12 +1045,16 @@ var require_run_write_guard = __commonJS({
       relayIds = /* @__PURE__ */ new Set();
       relayed = 0;
       relayRejected = 0;
+      /** Credential sign-ins already said in the run log (observe mode; method, host and path shape). */
+      signInsLogged = /* @__PURE__ */ new Set();
       constructor(policy, opts = {}) {
         this.policy = policy;
         this.compiled = policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
         this.recordOnly = new Set((policy.recordOnlyRules ?? exports.DEFAULT_RECORD_ONLY_RULES).filter((rule) => exports.RECORD_ONLY_CAPABLE_RULES.includes(rule)));
         this.log = opts.onLog;
         this.signInSecrets = (opts.signInSecrets ?? []).filter((v) => typeof v === "string" && v.length >= MIN_SIGN_IN_SECRET_CHARS);
+        const ms = opts.redirectCheckTimeoutMs;
+        this.redirectCheckTimeoutMs = typeof ms === "number" && ms > 0 ? Math.min(ms, REDIRECT_CHECK_TIMEOUT_MS) : REDIRECT_CHECK_TIMEOUT_MS;
       }
       decide(facts) {
         const signInSecretInBody = facts.signInSecretInBody ?? bodyHasSignInSecret(facts.postData, this.signInSecrets);
@@ -870,8 +1077,28 @@ var require_run_write_guard = __commonJS({
           consumedBrokerTokens.add(brokerToken.value);
           this.brokerTokens = this.brokerTokens.filter((t) => t !== brokerToken);
         }
+        if (decision.rule === "credential-sign-in" && this.policy.mode === "observe")
+          this.noteCredentialSignIn(facts, decision.persisted === true);
         return decision;
       }
+      /**
+       * Observe mode says where each credential sign-in went, once per path and kind (the lead): the
+       * method, host and masked path only, never the body, so the rule can be checked against real runs
+       * before a site is blocked. A GraphQL persisted query is marked unverified.
+       */
+      noteCredentialSignIn(facts, persisted) {
+        let host = "";
+        try {
+          host = new URL(facts.url).hostname.toLowerCase();
+        } catch {
+          return;
+        }
+        const line = `${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} [credential-sign-in${persisted ? " (persisted, unverified)" : ""}]`;
+        if (this.signInsLogged.has(line) || this.signInsLogged.size >= MAX_SIGN_IN_LOG_LINES)
+          return;
+        this.signInsLogged.add(line);
+        this.log?.(`[run-write-guard] allowed ${line}`);
+      }
       /**
        * A code or ID token the Google sign-in broker hands this context: the first POST that carries it
        * to the app in the next BROKER_TOKEN_TTL_MS is the sign-in. Anything not shaped like a Google code
@@ -931,8 +1158,9 @@ var require_run_write_guard = __commonJS({
       }
       /**
        * A hop the guard fetched itself (sendCheckingRedirect) failed, so the request fails in the page.
-       * Said in the run log, with the timeout when it was that: a slow allowed upload or stream is cut
-       * at REDIRECT_CHECK_TIMEOUT_MS, and the page only sees a network error.
+       * Said in the run log, with the reason when it was the guard's own limit: a slow allowed upload or
+       * stream is cut at its deadline, an answer over MAX_GUARD_HOP_BYTES as it streams in, and the page
+       * only sees a network error.
        */
       noteRedirectCheckFailed(facts, err, timeoutMs) {
         let host = "";
@@ -940,8 +1168,8 @@ var require_run_write_guard = __commonJS({
           host = new URL(facts.url).hostname.toLowerCase();
         } catch {
         }
-        const timedOut = err instanceof Error && (err.name === "TimeoutError" || /\btimeout\b/i.test(err.message));
-        const why = timedOut ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : "the guard's redirect check failed";
+        const reason = err instanceof GuardHopError ? err.reason : null;
+        const why = reason === "timeout" ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : reason === "over-cap" ? `the answer was over ${MAX_GUARD_HOP_BYTES / (1024 * 1024)} MB (MAX_GUARD_HOP_BYTES), cut as it came in` : "the guard's redirect check failed";
         this.log?.(`[run-write-guard] note: ${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} failed in the page: ${why}`);
       }
       /** A request still undecided when its page closed (see guardPageClose): it is failed in the page, so the browser never sends it. */
@@ -1389,66 +1617,321 @@ var require_run_write_guard = __commonJS({
       }
     }
     var MAX_GUARD_REDIRECTS = 5;
-    var REDIRECT_CHECK_TIMEOUT_MS = 6e4;
+    var REDIRECT_CHECK_TIMEOUT_MS = 3e4;
+    var MAX_GUARD_HOP_BYTES = 16 * 1024 * 1024;
+    var MAX_GUARD_BUFFERED_BYTES = 128 * 1024 * 1024;
+    var SEND_HTTP = node_http_1.request;
+    var SEND_HTTPS = node_https_1.request;
+    var HOP_ONLY_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-connection",
+      "transfer-encoding",
+      "te",
+      "trailer",
+      "upgrade",
+      "proxy-authorization",
+      "proxy-authenticate",
+      "host",
+      "content-length"
+    ]);
+    var hopBytesInFlight = 0;
+    var hopsInFlight = /* @__PURE__ */ new Set();
+    var hopBudgetWaiters = [];
+    function releaseHopBytes(hop, bytes) {
+      hopsInFlight.delete(hop);
+      hopBytesInFlight -= bytes;
+      for (const wake of hopBudgetWaiters.splice(0))
+        wake();
+    }
+    function runWriteGuardHopBytesInFlight() {
+      return hopBytesInFlight;
+    }
+    var GuardHopError = class extends Error {
+      reason;
+      constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "GuardHopError";
+      }
+    };
+    function sendGuardHop(hop) {
+      return new Promise((resolve, reject) => {
+        let url;
+        try {
+          url = new URL(hop.url);
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        const send = url.protocol === "https:" ? SEND_HTTPS : url.protocol === "http:" ? SEND_HTTP : null;
+        if (!send) {
+          reject(new Error(`the guard sends only http(s), not ${url.protocol}`));
+          return;
+        }
+        const id = /* @__PURE__ */ Symbol("guard hop");
+        hopsInFlight.add(id);
+        let held = 0;
+        let settled = false;
+        let req = null;
+        const chunks = [];
+        const fail = (err) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          req?.destroy();
+          releaseHopBytes(id, held);
+          held = 0;
+          reject(err);
+        };
+        const overCap = () => new GuardHopError("over-cap", `answer over ${MAX_GUARD_HOP_BYTES} bytes`);
+        const timer = setTimeout(() => fail(new GuardHopError("timeout", "the guard hop passed its deadline")), Math.max(0, hop.deadline - Date.now()));
+        try {
+          req = send(url, { method: hop.method, headers: hop.headers, rejectUnauthorized: !hop.ignoreHTTPSErrors, agent: false }, (res) => {
+            const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+            const decoder = encoding === "gzip" || encoding === "x-gzip" ? (0, node_zlib_1.createGunzip)({ flush: node_zlib_1.constants.Z_SYNC_FLUSH, finishFlush: node_zlib_1.constants.Z_SYNC_FLUSH }) : encoding === "br" ? (0, node_zlib_1.createBrotliDecompress)({ flush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH, finishFlush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH }) : encoding === "deflate" ? (0, node_zlib_1.createInflate)() : null;
+            const body = decoder ? (0, node_stream_1.pipeline)(res, decoder, (err) => {
+              if (err)
+                fail(err);
+            }) : res;
+            const parked = [];
+            let paused = false;
+            let ended = false;
+            const take = (chunk) => {
+              if (settled)
+                return;
+              if (paused) {
+                parked.push(chunk);
+                return;
+              }
+              if (held + chunk.length > MAX_GUARD_HOP_BYTES) {
+                fail(overCap());
+                return;
+              }
+              const oldest = hopsInFlight.values().next().value === id;
+              const room = oldest ? MAX_GUARD_BUFFERED_BYTES : MAX_GUARD_BUFFERED_BYTES - MAX_GUARD_HOP_BYTES;
+              if (hopBytesInFlight + chunk.length > room) {
+                paused = true;
+                body.pause();
+                parked.push(chunk);
+                hopBudgetWaiters.push(drain);
+                return;
+              }
+              hopBytesInFlight += chunk.length;
+              held += chunk.length;
+              chunks.push(chunk);
+            };
+            const drain = () => {
+              paused = false;
+              const queued = parked.splice(0);
+              for (let i = 0; i < queued.length; i++) {
+                take(queued[i]);
+                if (settled)
+                  return;
+                if (paused) {
+                  parked.push(...queued.slice(i + 1));
+                  return;
+                }
+              }
+              if (ended)
+                finish();
+              else
+                body.resume();
+            };
+            body.on("data", take);
+            body.on("error", (err) => fail(err));
+            res.on("error", (err) => fail(err));
+            body.on("end", () => {
+              ended = true;
+              if (!paused)
+                finish();
+            });
+            const finish = () => {
+              if (settled)
+                return;
+              settled = true;
+              clearTimeout(timer);
+              const kept = held;
+              let released = false;
+              const headers = [];
+              for (let i = 0; i + 1 < res.rawHeaders.length; i += 2)
+                headers.push([res.rawHeaders[i], res.rawHeaders[i + 1]]);
+              resolve({
+                status: res.statusCode ?? 0,
+                headers,
+                body: Buffer.concat(chunks, kept),
+                decoded: decoder !== null,
+                release: () => {
+                  if (!released) {
+                    released = true;
+                    releaseHopBytes(id, kept);
+                  }
+                }
+              });
+            };
+          });
+          req.on("error", (err) => fail(err));
+          req.end(hop.body ?? void 0);
+        } catch (err) {
+          fail(err instanceof Error ? err : new Error(String(err)));
+        }
+      });
+    }
+    function contextIgnoresHttpsErrors(context) {
+      try {
+        return context._options?.ignoreHTTPSErrors === true;
+      } catch {
+        return false;
+      }
+    }
+    function hopRequestHeaders(pageHeaders, cookie) {
+      const out = { accept: "*/*" };
+      for (const [name, value] of Object.entries(pageHeaders)) {
+        const key = name.toLowerCase();
+        if (key.startsWith(":") || HOP_ONLY_HEADERS.has(key) || key === "cookie")
+          continue;
+        out[key] = value;
+      }
+      out["accept-encoding"] = "gzip, deflate, br";
+      if (cookie)
+        out.cookie = cookie;
+      return out;
+    }
+    function cookiePairs(header) {
+      return header.split(";").flatMap((part) => {
+        const eq = part.indexOf("=");
+        return eq > 0 ? [[part.slice(0, eq).trim(), part.slice(eq + 1).trim()]] : [];
+      });
+    }
+    function hopCookie(pageCookie, contextCookies, setCookies) {
+      const jar = /* @__PURE__ */ new Map();
+      if (pageCookie)
+        for (const [name, value] of cookiePairs(pageCookie))
+          jar.set(name, value);
+      else
+        for (const c of contextCookies)
+          jar.set(c.name, c.value);
+      for (const line of setCookies) {
+        const [pair, ...attrs] = line.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+          continue;
+        const name = pair.slice(0, eq).trim();
+        const gone = attrs.some((a) => {
+          const [k, v = ""] = a.split("=");
+          const key = k.trim().toLowerCase();
+          return key === "max-age" && Number(v.trim()) <= 0 || key === "expires" && Date.parse(v.trim()) < Date.now();
+        });
+        if (gone)
+          jar.delete(name);
+        else
+          jar.set(name, pair.slice(eq + 1).trim());
+      }
+      return [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
+    }
+    function setCookiesOf(answer) {
+      return answer.headers.filter(([name]) => name.toLowerCase() === "set-cookie").map(([, value]) => value);
+    }
+    function fulfillHeaders(answer, earlierSetCookies) {
+      const out = {};
+      const cookies = [...earlierSetCookies];
+      for (const [name, value] of answer.headers) {
+        const key = name.toLowerCase();
+        if (HOP_ONLY_HEADERS.has(key) || answer.decoded && key === "content-encoding")
+          continue;
+        if (key === "set-cookie") {
+          cookies.push(value);
+          continue;
+        }
+        out[key] = key in out ? `${out[key]}, ${value}` : value;
+      }
+      if (cookies.length > 0)
+        out["set-cookie"] = cookies.join("\n");
+      return out;
+    }
     var cutAtClose = /* @__PURE__ */ new WeakSet();
-    async function sendCheckingRedirect(route, guard) {
-      const first = factsOf(route.request());
+    async function sendCheckingRedirect(route, guard, context) {
+      const request = route.request();
+      const first = factsOf(request);
+      const deadline = Date.now() + guard.redirectCheckTimeoutMs;
       let facts = first;
+      let pageHeaders = {};
+      let postBody = null;
+      const setCookies = [];
       for (let hop = 0; ; hop++) {
-        let response;
+        let answer;
         try {
-          response = await route.fetch(hop === 0 ? { maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS } : { url: facts.url, maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS });
+          if (hop === 0) {
+            pageHeaders = request.headers();
+            postBody = request.postDataBuffer();
+          }
+          const pageCookie = hop === 0 ? Object.entries(pageHeaders).find(([name]) => name.toLowerCase() === "cookie")?.[1] : void 0;
+          const cookie = hopCookie(pageCookie, pageCookie ? [] : await context.cookies(facts.url), setCookies);
+          answer = await sendGuardHop({
+            url: facts.url,
+            method: facts.method,
+            headers: hopRequestHeaders(pageHeaders, cookie),
+            body: postBody,
+            ignoreHTTPSErrors: contextIgnoresHttpsErrors(context),
+            deadline
+          });
         } catch (err) {
           if (cutAtClose.has(route))
             return;
-          guard.noteRedirectCheckFailed(facts, err, REDIRECT_CHECK_TIMEOUT_MS);
+          guard.noteRedirectCheckFailed(facts, err, guard.redirectCheckTimeoutMs);
           await route.abort("failed").catch(() => {
           });
           return;
         }
-        if (cutAtClose.has(route))
-          return;
-        const status = response.status();
-        const location = response.headers()["location"];
-        const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
-        if (!next) {
-          await route.fulfill({ response }).catch(() => {
-          });
-          return;
-        }
-        let decision;
         try {
-          decision = guard.decide(next);
-        } catch {
-          decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
-        }
-        if (decision.action === "write") {
-          if (decision.record)
-            guard.note(decision.record);
-          if (guard.holds(decision.rule)) {
+          if (cutAtClose.has(route))
+            return;
+          const status = answer.status;
+          const location = answer.headers.find(([name]) => name.toLowerCase() === "location")?.[1];
+          const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
+          if (!next) {
+            await route.fulfill({ status, headers: fulfillHeaders(answer, setCookies), body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          let decision;
+          try {
+            decision = guard.decide(next);
+          } catch {
+            decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
+          }
+          if (decision.action === "write") {
+            if (decision.record)
+              guard.note(decision.record);
+            if (guard.holds(decision.rule)) {
+              await route.abort("blockedbyclient").catch(() => {
+              });
+              return;
+            }
+          }
+          if (READ_METHODS.has(next.method.toUpperCase())) {
+            await route.fulfill({ status, headers: { ...fulfillHeaders(answer, setCookies), location: next.url }, body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          if (!sameOrigin(next.url, first.url)) {
+            const target = new URL(next.url);
+            guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
             await route.abort("blockedbyclient").catch(() => {
             });
             return;
           }
+          if (hop + 1 >= MAX_GUARD_REDIRECTS) {
+            await route.abort("failed").catch(() => {
+            });
+            return;
+          }
+          setCookies.push(...setCookiesOf(answer));
+          facts = next;
+        } finally {
+          answer.release();
         }
-        if (READ_METHODS.has(next.method.toUpperCase())) {
-          await route.fulfill({ response, headers: { ...response.headers(), location: next.url } }).catch(() => {
-          });
-          return;
-        }
-        if (!sameOrigin(next.url, first.url)) {
-          const target = new URL(next.url);
-          guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
-          await route.abort("blockedbyclient").catch(() => {
-          });
-          return;
-        }
-        if (hop + 1 >= MAX_GUARD_REDIRECTS) {
-          await route.abort("failed").catch(() => {
-          });
-          return;
-        }
-        facts = next;
       }
     }
     function sameRouteUrl(a, b) {
@@ -1662,7 +2145,7 @@ var require_run_write_guard = __commonJS({
             }
           }
           if (decision.action === "allow" && !READ_METHODS.has(request.method().toUpperCase()) && checksRedirect(decision.rule, request.url(), guard.policy)) {
-            await sendCheckingRedirect(route, guard);
+            await sendCheckingRedirect(route, guard, context);
             return;
           }
           await route.fallback().catch(() => {