@validate.qa/runner 1.0.100 → 1.0.101

package/dist/{chunk-MBKGTELT.mjs → chunk-IGXGSDE3.mjs}

@@ -1815,7 +1815,7 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
@@ -1835,6 +1835,7 @@ var init_run_classification = __esm({
     UNEXPECTED_PASS_ERROR_PREFIX = "UNEXPECTED_PASS:";
     BUG_TEST_BROKEN_ERROR_PREFIX = "BUG_TEST_BROKEN:";
     BUG_TEST_BROKEN_REASON = "bug test broken (not a bug verdict)";
+    TEST_DID_NOT_RUN_ERROR = "Test did not run (a dependency failed or the run was interrupted)";
     EMAIL_NOT_RECEIVED_PREFIXES = [
       "VERIFICATION_EMAIL_NOT_RECEIVED:",
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
@@ -2938,176 +2939,6 @@ var init_origin_domain = __esm({
   }
 });
 
-// ../shared/dist/auth-block-detector.js
-function stripEchoLines(text) {
-  return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
-}
-function matchesAny(text, patterns) {
-  return patterns.some((p) => p.test(text));
-}
-function detectAuthBlock(input) {
-  const tags = input.tags ?? [];
-  const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
-  if (!isAuthed)
-    return NO_DETECTION;
-  const meta = [input.testName, input.description].filter(Boolean).join(" ");
-  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
-    return NO_DETECTION;
-  const sources = [];
-  if (input.error)
-    sources.push(stripEchoLines(input.error));
-  if (input.logs)
-    sources.push(stripEchoLines(input.logs));
-  for (const sr of input.stepResults ?? []) {
-    if (sr.error)
-      sources.push(stripEchoLines(sr.error));
-  }
-  for (const text of sources) {
-    if (!text)
-      continue;
-    for (const sig of AUTH_BLOCK_SIGNATURES) {
-      if (sig.re.test(text)) {
-        return {
-          detected: true,
-          reason: sig.reason,
-          evidence: [`login-block signature "${sig.reason}" in: "${text.slice(0, 140).replace(/\s+/g, " ").trim()}"`]
-        };
-      }
-    }
-  }
-  return NO_DETECTION;
-}
-function detectApiColdSessionBlock(input) {
-  const tags = input.tags ?? [];
-  if (!tags.includes("@api"))
-    return NO_DETECTION;
-  const cookieMissing = input.authStateExpected && !input.authStateInjected;
-  const standingMissing = !!input.needsStandingHeaders && !input.standingHeadersInjected;
-  if (!cookieMissing && !standingMissing)
-    return NO_DETECTION;
-  const has401Status = (input.apiCalls ?? []).some((c) => c && (c.status === 401 || c.status === 403));
-  const texts = [];
-  if (input.error)
-    texts.push(input.error);
-  if (input.logs)
-    texts.push(input.logs);
-  for (const sr of input.stepResults ?? [])
-    if (sr.error)
-      texts.push(sr.error);
-  const has401Text = texts.some((t) => UNAUTHORIZED_TEXT_RE.test(t));
-  if (!has401Status && !has401Text)
-    return NO_DETECTION;
-  const missingAuth = cookieMissing ? "cold injected auth session (401/403 with no storageState)" : "missing standing auth header (401/403 with no API_AUTH_HEADERS installed)";
-  const injectedNoun = cookieMissing ? "injected session was absent/expired" : "standing auth header was not installed";
-  return {
-    detected: true,
-    reason: missingAuth,
-    evidence: [
-      has401Status ? `a captured @api call returned 401/403 while the ${injectedNoun}` : `a 401/403 signal in the run error/logs while the ${injectedNoun}`
-    ]
-  };
-}
-function coldSessionConfigMessage(context, reason, evidence) {
-  return `CONFIG_ISSUE: ${context} without valid injected auth (${reason}) \u2014 no session cookie was injected this run. Ensure the project login (auth-setup recipe / prewarm) is configured so the shared session jar warms (a project with no login: set TEST_USER_EMAIL and TEST_USER_PASSWORD in Test Data \u2192 Test Variables so a session can be captured); for endpoints that authenticate with a standing API key or bearer header instead, set them in the project's API_AUTH_HEADERS variable (injected as request headers). Evidence: ${evidence.join("; ")}`;
-}
-var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, UNAUTHORIZED_TEXT_RE;
-var init_auth_block_detector = __esm({
-  "../shared/dist/auth-block-detector.js"() {
-    "use strict";
-    NO_DETECTION = { detected: false, reason: "", evidence: [] };
-    AUTHED_TAGS = ["@needs-auth", "@inline-login"];
-    LOGIN_CTX = "\\b(?:log\\s*in|login|logging\\s+in|sign[\\s-]?in|signing\\s+in|continue)\\b";
-    AUTH_BLOCK_SIGNATURES = [
-      { reason: "incorrect password", re: /\b(incorrect|invalid|wrong|bad)\s+password\b/i },
-      { reason: "password is incorrect", re: /\bpassword\s+(is\s+)?(incorrect|invalid|wrong)\b/i },
-      { reason: "invalid credentials", re: /\b(invalid|incorrect|wrong|bad)\s+(login\s+)?credentials\b/i },
-      { reason: "credentials do not match", re: /\bcredentials\b[^\n]{0,40}\b(do(?:es)?\s*n['’]?t|do\s+not)\s+match\b/i },
-      { reason: "incorrect email or password", re: /\b(incorrect|invalid|wrong)\s+(email|username)\s+or\s+password\b/i },
-      // Require an EXPLICIT negative (codex #21): the old `(not\s+)?(confirmed|verified)` made the negation
-      // optional, so a benign "Email verified" success message / feature assertion matched and hid a real
-      // feature failure as a CONFIG_ISSUE. Only "email not (yet) confirmed/verified" or "unconfirmed/unverified".
-      { reason: "email not confirmed", re: /\b(e-?mail)\b[^\n]{0,30}\b(not\s+(?:yet\s+)?(?:confirmed|verified)|unconfirmed|unverified)\b/i },
-      { reason: "please confirm your email", re: /\bplease\s+(confirm|verify)\s+your\s+(e-?mail)\b/i },
-      // The bare "confirm/verify your email" and "account not found" phrases are ALSO ordinary feature copy
-      // ("Verify your email banner", a 404-style "Account not found" page), so they only count with a
-      // login/sign-in context on the SAME line (either side). "Please confirm/verify your email" above
-      // is already an explicit prompt and stays unconditional.
-      { reason: "confirm your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bconfirm\\s+your\\s+e-?mail\\b|\\bconfirm\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
-      { reason: "verify your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bverify\\s+your\\s+e-?mail\\b|\\bverify\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
-      {
-        reason: "account not found",
-        re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b|\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b[^\\n]{0,80}${LOGIN_CTX}`, "i")
-      },
-      { reason: "authentication failed", re: /\bauthentication\s+failed\b/i },
-      { reason: "login failed", re: /\b(login|log\s*in|sign[\s-]?in)\s+failed\b/i }
-    ];
-    INTENTIONAL_NEGATIVE_AUTH = [
-      /\b(invalid|incorrect|wrong|bad)\s+(password|credentials|email|login)\b/i,
-      /\b(negative|unhappy)\s+(login|auth|sign[\s-]?in|path|case|flow|test)\b/i,
-      // "should fail" et al must be TIED to an auth noun (codex #21): a bare `should\s+(fail|reject|deny)`
-      // exempted benign names like "Export should fail gracefully", silently disabling the anti-lockout
-      // protection for them. Require a login/auth noun on either side of the "should fail / fail to log in".
-      /\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password)\b[^\n]{0,40}\bshould\s+(fail|reject|deny)\b/i,
-      /\bshould\s+(fail|reject|deny|not\s+log(?:\s*in)?)\b[^\n]{0,40}\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password|unauthenticated)\b/i,
-      /\bfailed?\s+login\b/i,
-      /\blogin\s+(error|failure|rejected?)\b/i,
-      /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
-    ];
-    ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
-    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
-  }
-});
-
-// ../shared/dist/skip-coverage-detector.js
-function detectSkippedApiCoverage(steps) {
-  const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
-  if (allSkipped) {
-    if (steps.every((s) => s.skipKind === "fixme")) {
-      return {
-        detected: false,
-        logLine: "All @api tests skipped, but EVERY skip is a deliberate fixme (intentional N/A \u2014 e.g. a UI-only redirect login) \u2014 NOT relabelling CONFIG_ISSUE"
-      };
-    }
-    return {
-      detected: true,
-      error: (
-        // Name BOTH auth mechanisms (item 5d): the all-skipped copy used to say only "refresh the auth
-        // state", which misdirects a @auth-standing operator (whose real gap is a missing API_AUTH_HEADERS
-        // key, not a cold cookie session) to warm a login that was never the problem.
-        "CONFIG_ISSUE: Authenticated @api coverage was NOT exercised \u2014 every test skipped (cold injected session, a missing standing auth header, or an unresolved fixme). Provide the auth the endpoints need \u2014 warm the project login/session cookie (auth-setup recipe / prewarm), or set a standing API key/bearer in the project's API_AUTH_HEADERS variable \u2014 so the assertions actually run."
-      ),
-      logLine: "All @api tests skipped \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so zero authenticated coverage is visible, not silent green"
-    };
-  }
-  const runtimeSkipped = steps.filter((s) => s.status === "skipped" && s.skipKind === "skip");
-  if (runtimeSkipped.length === 0)
-    return { detected: false };
-  const reasons = [...new Set(runtimeSkipped.map((s) => `"${s.title ?? "test"}"${s.skipReason ? ` (${s.skipReason})` : ""}`))].join("; ");
-  return {
-    detected: true,
-    error: `CONFIG_ISSUE: ${runtimeSkipped.length} of ${steps.length} @api tests skipped at runtime \u2014 that coverage was NOT exercised. Skipped: ${reasons}`,
-    logLine: `${runtimeSkipped.length}/${steps.length} @api tests skipped at runtime \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so the coverage hole is visible, not silent green`
-  };
-}
-var init_skip_coverage_detector = __esm({
-  "../shared/dist/skip-coverage-detector.js"() {
-    "use strict";
-  }
-});
-
-// ../shared/dist/feature-flags.js
-function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
-  return value?.trim().toLowerCase() !== "false";
-}
-function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
-  return value?.trim().toLowerCase() !== "false";
-}
-var init_feature_flags = __esm({
-  "../shared/dist/feature-flags.js"() {
-    "use strict";
-  }
-});
-
 // ../shared/dist/repository-cli.js
 function isRepositoryCli(value) {
   return typeof value === "string" && REPOSITORY_CLIS.includes(value);
@@ -4499,7 +4330,7 @@ function unescapeQuotedBody(raw) {
   return raw.replace(/\\(['"`\\])/g, "$1");
 }
 function extractRoleNameValue(line) {
-  const m = line.match(new RegExp(`getByRole\\s*\\([^,]+,\\s*\\{[^}]*name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
+  const m = line.match(new RegExp(`getByRole\\s*\\([^,]{1,200},\\s*\\{[^}]{0,200}?name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
   if (!m)
     return null;
   const raw = m[1] ?? m[2] ?? m[3];
@@ -5207,6 +5038,8 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
+  let prev = "";
+  let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
     if (quote) {
@@ -5214,12 +5047,24 @@ function stripCoverageComments(code) {
         i += 2;
         continue;
       }
-      if (ch === quote || ch === "\n" && quote !== "`")
+      if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
+        prev = ch === "\n" ? prev : ch;
+      }
       i++;
       continue;
     }
     const next = code[i + 1];
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+      const end = regexLiteralEnd3(code, i);
+      if (end > 0) {
+        i = end;
+        prev = "a";
+        continue;
+      }
+      const eol = code.indexOf("\n", i);
+      noRegexBefore = eol === -1 ? code.length : eol;
+    }
     if (ch === "/" && next === "*") {
       const end = code.indexOf("*/", i + 2);
       const stop = end === -1 ? code.length : end + 2;
@@ -5238,11 +5083,39 @@ function stripCoverageComments(code) {
     }
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
+      prev = ch;
     i++;
   }
   out.push(code.slice(copyFrom));
   return out.join("");
 }
+function regexLiteralEnd3(code, start) {
+  let inClass = false;
+  for (let j = start + 1; j < code.length; j++) {
+    const c = code[j];
+    if (c === "\n")
+      return -1;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]")
+        inClass = false;
+      continue;
+    }
+    if (c === "[")
+      inClass = true;
+    else if (c === "/") {
+      let k = j + 1;
+      while (k < code.length && isIdentChar(code[k]))
+        k++;
+      return k;
+    }
+  }
+  return -1;
+}
 function isIdentChar(ch) {
   if (!ch)
     return false;
@@ -5900,7 +5773,7 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
@@ -5937,6 +5810,7 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
+    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -6387,7 +6261,7 @@ function detectsErrorBannerAssertion(code) {
   const cleaned = stripCommentsAndLogs(stripLoginScaffolding(code));
   const lines = cleaned.split("\n");
   const candidates = [];
-  const positive = (stmt) => !NEGATED_ASSERT.test(stmt) && !ABSENCE_MATCHER.test(stmt);
+  const positive = (stmt) => !claimsAbsence(stmt);
   const statements = liveExpectStatements(cleaned).map((s) => s.stmt);
   for (const stmt of statements) {
     if (positive(stmt))
@@ -6516,6 +6390,12 @@ function detectsObservedFailureAsExpected(code) {
     return FAILURE_STATUS_ASSERT.some((re) => re.test(stmt)) || hasFailedListener && FAILED_LIST_ASSERT.test(stmt);
   });
 }
+function claimsAbsence(stmt) {
+  const negated = NEGATED_ASSERT_NOT.test(stmt);
+  const bare = negated ? stmt.replace(NOT_BEFORE_MATCHER, ".") : stmt;
+  const absenceMatcher = /\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+  return negated !== absenceMatcher;
+}
 function isVacuousErrorAbsence(stmt, presence) {
   if (!ABSENCE_MATCHER.test(stmt))
     return false;
@@ -6531,19 +6411,53 @@ function isChromeTarget(stmt) {
   return CHROME_LOCATOR.test(stmt) && !CONTENT_ROLE.test(stmt) && !/getByText\s*\(/.test(stmt);
 }
 function countsAsContentText(stmt) {
-  if (!TEXT_CONTENT_MATCHER.test(stmt))
+  if (!TEXT_CONTENT_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt))
     return false;
   if (isSymbolOnlyArgument(stmt, TEXT_CONTENT_MATCHER))
     return false;
-  if (!isChromeTarget(stmt))
+  return onContentTarget(stmt);
+}
+function onContentTarget(stmt) {
+  return !isChromeTarget(stmt) || /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+}
+function provesTextRemoved(stmt, presence) {
+  const m = stmt.match(NEGATED_TEXT);
+  if (!m || !onContentTarget(stmt))
+    return false;
+  const text = m[1] ?? m[2];
+  if (text === void 0)
     return true;
-  return /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+  if (!/[\p{L}\p{N}]/u.test(text))
+    return false;
+  return !ERROR_TEXT_WORDS.test(text) || presence().includes(text);
 }
 function isDataContentRole(stmt) {
   return CONTENT_ROLE.test(stmt) && !ANNOUNCE_ROLE.test(stmt);
 }
+function destructuresRequest(code) {
+  let readTo = -1;
+  for (const m of code.matchAll(ASYNC_DESTRUCTURE_OPEN)) {
+    const start = m.index + m[0].length;
+    if (start <= readTo)
+      continue;
+    let end = start;
+    while (end < code.length && code[end] !== "}" && code[end] !== ")")
+      end++;
+    readTo = end;
+    if (end === code.length)
+      return false;
+    if (code[end] !== "}" || !REQUEST_WORD.test(code.slice(start, end)))
+      continue;
+    let close = end + 1;
+    while (close < code.length && /\s/.test(code[close]))
+      close++;
+    if (code[close] === ")")
+      return true;
+  }
+  return false;
+}
 function isApiTest(code) {
-  const usesRequestFixture = /async\s*\(\s*\{[^})]*\brequest\b[^})]*\}\s*\)/.test(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
+  const usesRequestFixture = destructuresRequest(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
   if (!usesRequestFixture)
     return false;
   const drivesUi = /\bpage\.(getBy\w+|locator|click|fill|goto|waitForURL|reload)\s*\(/.test(code) || /\.(click|fill|check|uncheck|selectOption|pressSequentially)\s*\(/.test(code);
@@ -6802,6 +6716,9 @@ function hasOnlyConstantAssertions(code) {
   const { constant, real } = constantAssertions(code);
   return constant.length > 0 && real === 0;
 }
+function envValueKey(name) {
+  return `\0env:${name}`;
+}
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
@@ -6810,24 +6727,55 @@ function enteredValues(stmts) {
       navLines.push(startLine);
     let m;
     ENTERED_VALUE.lastIndex = 0;
-    while (m = ENTERED_VALUE.exec(stmt)) {
-      const value = (m[1] ?? m[2] ?? m[3]).toLowerCase();
-      if (!values.has(value))
-        values.set(value, startLine);
-    }
+    const add = (value) => {
+      const lines = values.get(value);
+      if (!lines)
+        values.set(value, [startLine]);
+      else if (lines[lines.length - 1] !== startLine)
+        lines.push(startLine);
+    };
+    while (m = ENTERED_VALUE.exec(stmt))
+      add((m[1] ?? m[2] ?? m[3]).toLowerCase());
+    ENTERED_ENV.lastIndex = 0;
+    while (m = ENTERED_ENV.exec(stmt))
+      add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
   return { values, navLines };
 }
-function isEnteredValueEcho(stmt, entered, startLine) {
+function countBelow(lines, line) {
+  let lo = 0;
+  let hi = lines.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lines[mid] < line)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function enteredLinesOf(stmt, entered) {
   const m = stmt.match(/\.toHaveValue\s*\(\s*(['"`])((?:(?!\1).)+)\1/);
-  if (!m)
+  if (m)
+    return entered.values.get(m[2].toLowerCase());
+  const env = stmt.match(HAVE_VALUE_ENV);
+  return env ? entered.values.get(envValueKey(env[1] ?? env[2])) : void 0;
+}
+function typedSinceLastNav(stmt, entered, startLine, lines = enteredLinesOf(stmt, entered)) {
+  if (!lines || startLine === void 0)
+    return false;
+  const before = countBelow(lines, startLine);
+  if (before === 0)
     return false;
-  const enteredAt = entered.values.get(m[2].toLowerCase());
-  if (enteredAt === void 0)
+  return countBelow(entered.navLines, startLine) === countBelow(entered.navLines, lines[before - 1] + 1);
+}
+function isEnteredValueEcho(stmt, entered, startLine) {
+  const lines = enteredLinesOf(stmt, entered);
+  if (!lines)
     return false;
-  if (startLine === void 0)
+  if (startLine === void 0 || lines[0] >= startLine)
     return true;
-  return !entered.navLines.some((n) => n > enteredAt && n < startLine);
+  return typedSinceLastNav(stmt, entered, startLine, lines);
 }
 function isAnyValueMatcher(stmt) {
   if (/\.not\.toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/.test(stmt))
@@ -6917,6 +6865,43 @@ function hasAttributeTransition(stmts) {
       return true;
   return false;
 }
+function comparesWithItself(subject, tail) {
+  const m = SELF_COMPARE_MATCHER.exec(tail);
+  if (!m)
+    return false;
+  const args = balancedArguments(tail, m[0].length, MATCHER_ARGS_MAX);
+  if (args === null)
+    return false;
+  const squash2 = (x) => x.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  const expected = squash2(args);
+  return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
+}
+function asPlainAssertion(s) {
+  const { stmt } = s;
+  if (COUNT_AT_LEAST_ZERO.test(stmt))
+    return [];
+  const subject = extractExpectSubject(stmt);
+  if (subject === null)
+    return [s];
+  const plain = subject.replace(/^await\s+/, "").trim();
+  const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
+  const tail = stmt.slice(subjectAt + subject.length).trimStart();
+  const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
+    return [];
+  if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
+    return [];
+  if (comparesWithItself(plain, tail))
+    return [];
+  const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
+  if (visible && IS_VISIBLE_TRUE.test(tail))
+    return as(`await expect(${visible[1]}).toBeVisible();`);
+  if (/^page\s*\.\s*(?:url|title)\s*\(\s*\)$/.test(plain) && PAGE_VALUE_MATCHER.test(tail)) {
+    const matcher = plain.includes("url") ? "toHaveURL" : "toHaveTitle";
+    return as(`await expect(page)${tail.replace(/^\)\s*\.\s*\w+\s*\(/, `.${matcher}(`)}`);
+  }
+  return [s];
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -6990,6 +6975,8 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       continue;
     if (isVacuousErrorAbsence(stmt, presence))
       continue;
+    if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
+      continue;
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -6999,12 +6986,15 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       else
         return { kind: "durable" };
     }
-    if (STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
+    const retyped = typedSinceLastNav(stmt, entered, startLine);
+    if (!retyped && STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
       return { kind: "durable" };
-    if (provesStoredControlValue(stmt, startLine, persistence))
+    if (!retyped && provesStoredControlValue(stmt, startLine, persistence))
       return { kind: "durable" };
     if (countsAsContentText(stmt))
       return { kind: "durable" };
+    if (provesTextRemoved(stmt, presence))
+      return { kind: "durable" };
     if (mutated && VISIBILITY_MATCHER.test(stmt)) {
       const revealsText = GET_BY_TEXT.test(stmt) || HAS_TEXT_FILTER.test(stmt) || CONTENT_ROLE.test(stmt);
       if (revealsText && !isChromeTarget(stmt)) {
@@ -7071,7 +7061,7 @@ function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMut
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
-  const stmts = liveExpectStatements(stripCoverageComments(body));
+  const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
   const base = (extra) => ({
     apiTest: false,
     interacted: false,
@@ -7277,7 +7267,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, IN_FLIGHT_TEXT, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -7302,8 +7292,8 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /\.toBeDisabled\s*\(/,
-      // a control became DISABLED — a gating/validation outcome
+      /(?<!\.not\s*)\.\s*toBeDisabled\s*\(/,
+      // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
       // something the action removed/closed (disappearance proof)
@@ -7311,7 +7301,7 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)|\bexpect\s*\.\s*poll\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*(?:\{\s*return\s+)?page\s*\.\s*url\s*\(\s*\)/;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
@@ -7340,6 +7330,7 @@ var init_assertion_strength = __esm({
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
+    NEGATED_ASSERT_NOT = /\.not\s*\.\s*to[A-Z]/;
     CONST_CHAIN_MAX_DEPTH = 5;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
@@ -7355,8 +7346,14 @@ var init_assertion_strength = __esm({
     CATCH_ALL_PATTERN = /^(['"`])\*\*(?:\/\*)?\1$|^\/\.\*\/[a-z]*$/;
     GUARD_HANDLER = /\bMUTATING\.has\s*\(|blockedbyclient|Read-only guard/;
     ABSENCE_MATCHER = /\.not\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/;
+    VALUE_ABSENCE = /\.(?:count\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*0\s*\)|toBeLessThan\s*\(\s*1\s*\))|isVisible\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*false\s*\)|toBeFalsy\s*\()|isHidden\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*true\s*\)|toBeTruthy\s*\())/;
+    OPTION_ABSENCE = /\.(?:toBeVisible\s*\(\s*\{[^{}()]{0,200}\bvisible|toBeAttached\s*\(\s*\{[^{}()]{0,200}\battached)\s*:\s*false\b/;
+    NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
+    ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
+    REQUEST_WORD = /\brequest\b/;
     ROLE_NAME_RE = /getByRole\s*\(\s*['"`][a-z]+['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
     INTERACT_VERB = /\.(click|fill|check|uncheck|setChecked|selectOption|pressSequentially)\s*\(/;
     ROLE_SIG_RE = /getByRole\s*\(\s*['"`]([a-z]+)['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
@@ -7377,7 +7374,20 @@ var init_assertion_strength = __esm({
     MATCHER_OPEN = /\s*(?:\.\s*(?:not|resolves|rejects)\s*)*\.\s*[A-Za-z_$][\w$]*\s*\(/y;
     ENTERED_VALUE = /\.(?:fill|pressSequentially)\s*\(\s*['"`]([^'"`]+)['"`]|keyboard\.type\s*\(\s*['"`]([^'"`]+)['"`]|\.selectOption\s*\(\s*(?:\[\s*)?(?:\{\s*(?:label|value)\s*:\s*)?['"`]([^'"`]+)['"`]/g;
     PAGE_NAV = /\.(?:goto|reload)\s*\(/;
+    ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
+    ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
+    HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
+    LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
+    LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
+    ALWAYS_TRUE_ON_OBJECT = /^\)\s*\.\s*(?:toBeTruthy|toBeDefined|not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy))\s*\(/;
+    COUNT_AT_LEAST_ZERO = /\.(?:count\s*\(\s*\)|length)[\s)]{0,10}\.(?:toBeGreaterThanOrEqual\s*\(\s*0\s*\)|toBeGreaterThan\s*\(\s*-\s*1\s*\))/;
+    DEFINED_VALUE_READ = /\.\s*(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|title|url|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts)\s*\([^()]*\)$/;
+    ALWAYS_DEFINED = /^\)\s*\.\s*(?:toBeDefined|not\s*\.\s*toBeUndefined)\s*\(/;
+    SELF_COMPARE_MATCHER = /^\)\s*\.\s*(toBe|toEqual|toStrictEqual|toHaveCount)\s*\(/;
+    IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
+    PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
     COPY_CONTROL = /\bcopy\b/i;
@@ -8859,51 +8869,188 @@ function deriveAuthPlan(tags, code, opts) {
   const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
   const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
   return {
-    version: 1,
-    source: "legacy",
-    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
-    presentation: authedLegacy ? "cookie" : "none",
-    needsCookieState: cookie,
-    needsStandingHeaders: false,
-    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
-    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
-    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
-    needsLoginCreds,
-    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds,
+    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
+// ../shared/dist/auth-block-detector.js
+function stripEchoLines(text) {
+  return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
+}
+function matchesAny(text, patterns) {
+  return patterns.some((p) => p.test(text));
+}
+function detectAuthBlock(input) {
+  const tags = input.tags ?? [];
+  const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
+  if (!isAuthed)
+    return NO_DETECTION;
+  const meta = [input.testName, input.description].filter(Boolean).join(" ");
+  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
+    return NO_DETECTION;
+  const sources = [];
+  if (input.error)
+    sources.push(stripEchoLines(input.error));
+  if (input.logs)
+    sources.push(stripEchoLines(input.logs));
+  for (const sr of input.stepResults ?? []) {
+    if (sr.error)
+      sources.push(stripEchoLines(sr.error));
+  }
+  for (const text of sources) {
+    if (!text)
+      continue;
+    for (const sig of AUTH_BLOCK_SIGNATURES) {
+      if (sig.re.test(text)) {
+        return {
+          detected: true,
+          reason: sig.reason,
+          evidence: [`login-block signature "${sig.reason}" in: "${text.slice(0, 140).replace(/\s+/g, " ").trim()}"`]
+        };
+      }
+    }
+  }
+  return NO_DETECTION;
+}
+function detectApiColdSessionBlock(input) {
+  const tags = input.tags ?? [];
+  if (!tags.includes("@api"))
+    return NO_DETECTION;
+  const cookieMissing = input.authStateExpected && !input.authStateInjected;
+  const standingMissing = !!input.needsStandingHeaders && !input.standingHeadersInjected;
+  if (!cookieMissing && !standingMissing)
+    return NO_DETECTION;
+  const has401Status = (input.apiCalls ?? []).some((c) => c && (c.status === 401 || c.status === 403));
+  const texts = [];
+  if (input.error)
+    texts.push(input.error);
+  if (input.logs)
+    texts.push(input.logs);
+  for (const sr of input.stepResults ?? [])
+    if (sr.error)
+      texts.push(sr.error);
+  const has401Text = texts.some((t) => UNAUTHORIZED_TEXT_RE.test(t));
+  if (!has401Status && !has401Text)
+    return NO_DETECTION;
+  const missingAuth = cookieMissing ? "cold injected auth session (401/403 with no storageState)" : "missing standing auth header (401/403 with no API_AUTH_HEADERS installed)";
+  const injectedNoun = cookieMissing ? "injected session was absent/expired" : "standing auth header was not installed";
+  return {
+    detected: true,
+    reason: missingAuth,
+    evidence: [
+      has401Status ? `a captured @api call returned 401/403 while the ${injectedNoun}` : `a 401/403 signal in the run error/logs while the ${injectedNoun}`
+    ]
   };
 }
-function authTypeTag(tags) {
-  const t = Array.isArray(tags) ? tags : [];
-  const explicit = explicitAuthTypeTags(t);
-  return explicit.length === 1 ? explicit[0] : void 0;
+function coldSessionConfigMessage(context, reason, evidence) {
+  return `CONFIG_ISSUE: ${context} without valid injected auth (${reason}) \u2014 no session cookie was injected this run. Ensure the project login (auth-setup recipe / prewarm) is configured so the shared session jar warms (a project with no login: set TEST_USER_EMAIL and TEST_USER_PASSWORD in Test Data \u2192 Test Variables so a session can be captured); for endpoints that authenticate with a standing API key or bearer header instead, set them in the project's API_AUTH_HEADERS variable (injected as request headers). Evidence: ${evidence.join("; ")}`;
 }
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
-var init_auth_plan = __esm({
-  "../shared/dist/auth-plan.js"() {
+var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, UNAUTHORIZED_TEXT_RE;
+var init_auth_block_detector = __esm({
+  "../shared/dist/auth-block-detector.js"() {
     "use strict";
-    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
-    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
-    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
-    AUTH_TAG_STANDING = "@auth-standing";
-    AUTH_TAG_NONE = "@auth-none";
-    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
-    AUTH_TYPE_TAGS = [
-      AUTH_TAG_COOKIE_STATE,
-      AUTH_TAG_LOGIN_COOKIE,
-      AUTH_TAG_LOGIN_BEARER,
-      AUTH_TAG_STANDING,
-      AUTH_TAG_NONE,
-      AUTH_TAG_UNSUPPORTED
+    NO_DETECTION = { detected: false, reason: "", evidence: [] };
+    AUTHED_TAGS = ["@needs-auth", "@inline-login"];
+    LOGIN_CTX = "\\b(?:log\\s*in|login|logging\\s+in|sign[\\s-]?in|signing\\s+in|continue)\\b";
+    AUTH_BLOCK_SIGNATURES = [
+      { reason: "incorrect password", re: /\b(incorrect|invalid|wrong|bad)\s+password\b/i },
+      { reason: "password is incorrect", re: /\bpassword\s+(is\s+)?(incorrect|invalid|wrong)\b/i },
+      { reason: "invalid credentials", re: /\b(invalid|incorrect|wrong|bad)\s+(login\s+)?credentials\b/i },
+      { reason: "credentials do not match", re: /\bcredentials\b[^\n]{0,40}\b(do(?:es)?\s*n['’]?t|do\s+not)\s+match\b/i },
+      { reason: "incorrect email or password", re: /\b(incorrect|invalid|wrong)\s+(email|username)\s+or\s+password\b/i },
+      // Require an EXPLICIT negative (codex #21): the old `(not\s+)?(confirmed|verified)` made the negation
+      // optional, so a benign "Email verified" success message / feature assertion matched and hid a real
+      // feature failure as a CONFIG_ISSUE. Only "email not (yet) confirmed/verified" or "unconfirmed/unverified".
+      { reason: "email not confirmed", re: /\b(e-?mail)\b[^\n]{0,30}\b(not\s+(?:yet\s+)?(?:confirmed|verified)|unconfirmed|unverified)\b/i },
+      { reason: "please confirm your email", re: /\bplease\s+(confirm|verify)\s+your\s+(e-?mail)\b/i },
+      // The bare "confirm/verify your email" and "account not found" phrases are ALSO ordinary feature copy
+      // ("Verify your email banner", a 404-style "Account not found" page), so they only count with a
+      // login/sign-in context on the SAME line (either side). "Please confirm/verify your email" above
+      // is already an explicit prompt and stays unconditional.
+      { reason: "confirm your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bconfirm\\s+your\\s+e-?mail\\b|\\bconfirm\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
+      { reason: "verify your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bverify\\s+your\\s+e-?mail\\b|\\bverify\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
+      {
+        reason: "account not found",
+        re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b|\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b[^\\n]{0,80}${LOGIN_CTX}`, "i")
+      },
+      { reason: "authentication failed", re: /\bauthentication\s+failed\b/i },
+      { reason: "login failed", re: /\b(login|log\s*in|sign[\s-]?in)\s+failed\b/i }
     ];
-    AUTH_TAG_ALIASES = {
-      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
-      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
-      "@auth-token": AUTH_TAG_LOGIN_BEARER,
-      "@auth-api-key": AUTH_TAG_STANDING,
-      "@auth-standing-header": AUTH_TAG_STANDING
-    };
-    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
-    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+    INTENTIONAL_NEGATIVE_AUTH = [
+      /\b(invalid|incorrect|wrong|bad)\s+(password|credentials|email|login)\b/i,
+      /\b(negative|unhappy)\s+(login|auth|sign[\s-]?in|path|case|flow|test)\b/i,
+      // "should fail" et al must be TIED to an auth noun (codex #21): a bare `should\s+(fail|reject|deny)`
+      // exempted benign names like "Export should fail gracefully", silently disabling the anti-lockout
+      // protection for them. Require a login/auth noun on either side of the "should fail / fail to log in".
+      /\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password)\b[^\n]{0,40}\bshould\s+(fail|reject|deny)\b/i,
+      /\bshould\s+(fail|reject|deny|not\s+log(?:\s*in)?)\b[^\n]{0,40}\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password|unauthenticated)\b/i,
+      /\bfailed?\s+login\b/i,
+      /\blogin\s+(error|failure|rejected?)\b/i,
+      /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
+    ];
+    ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
+    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+  }
+});
+
+// ../shared/dist/auth-session-stamp.js
+function parseAuthSessionStamp(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const { shared, role, generation } = value;
+  if (shared !== true || role !== "producer" && role !== "follower")
+    return null;
+  return typeof generation === "string" && AUTH_SESSION_GENERATION_RE.test(generation) ? { shared: true, role, generation } : { shared: true, role };
+}
+var AUTH_SESSION_GENERATION_RE;
+var init_auth_session_stamp = __esm({
+  "../shared/dist/auth-session-stamp.js"() {
+    "use strict";
+    AUTH_SESSION_GENERATION_RE = /^[0-9a-z]{1,16}$/;
   }
 });
 
@@ -9092,6 +9239,43 @@ var init_auth_state_freshness = __esm({
   }
 });
 
+// ../shared/dist/skip-coverage-detector.js
+function detectSkippedApiCoverage(steps) {
+  const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
+  if (allSkipped) {
+    if (steps.every((s) => s.skipKind === "fixme")) {
+      return {
+        detected: false,
+        logLine: "All @api tests skipped, but EVERY skip is a deliberate fixme (intentional N/A \u2014 e.g. a UI-only redirect login) \u2014 NOT relabelling CONFIG_ISSUE"
+      };
+    }
+    return {
+      detected: true,
+      error: (
+        // Name BOTH auth mechanisms (item 5d): the all-skipped copy used to say only "refresh the auth
+        // state", which misdirects a @auth-standing operator (whose real gap is a missing API_AUTH_HEADERS
+        // key, not a cold cookie session) to warm a login that was never the problem.
+        "CONFIG_ISSUE: Authenticated @api coverage was NOT exercised \u2014 every test skipped (cold injected session, a missing standing auth header, or an unresolved fixme). Provide the auth the endpoints need \u2014 warm the project login/session cookie (auth-setup recipe / prewarm), or set a standing API key/bearer in the project's API_AUTH_HEADERS variable \u2014 so the assertions actually run."
+      ),
+      logLine: "All @api tests skipped \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so zero authenticated coverage is visible, not silent green"
+    };
+  }
+  const runtimeSkipped = steps.filter((s) => s.status === "skipped" && s.skipKind === "skip");
+  if (runtimeSkipped.length === 0)
+    return { detected: false };
+  const reasons = [...new Set(runtimeSkipped.map((s) => `"${s.title ?? "test"}"${s.skipReason ? ` (${s.skipReason})` : ""}`))].join("; ");
+  return {
+    detected: true,
+    error: `CONFIG_ISSUE: ${runtimeSkipped.length} of ${steps.length} @api tests skipped at runtime \u2014 that coverage was NOT exercised. Skipped: ${reasons}`,
+    logLine: `${runtimeSkipped.length}/${steps.length} @api tests skipped at runtime \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so the coverage hole is visible, not silent green`
+  };
+}
+var init_skip_coverage_detector = __esm({
+  "../shared/dist/skip-coverage-detector.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/feature-coverage.js
 function computeFeatureCoverage(input) {
   const { tests } = input;
@@ -9783,6 +9967,19 @@ var init_deepgram_speech = __esm({
   }
 });
 
+// ../shared/dist/feature-flags.js
+function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
+  return value?.trim().toLowerCase() !== "false";
+}
+function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
+  return value?.trim().toLowerCase() !== "false";
+}
+var init_feature_flags = __esm({
+  "../shared/dist/feature-flags.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/analytics-url.js
 function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
@@ -10085,7 +10282,7 @@ var init_agentic_cli_runtime = __esm({
     GROK_CLI_DEFAULT_MODEL = "grok-4.7";
     GROK_CLI_DEFAULT_REASONING_EFFORT = "high";
     CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-    CLAUDE_CLI_DEFAULT_EFFORT = "max";
+    CLAUDE_CLI_DEFAULT_EFFORT = "high";
     MUSE_CLI_DEFAULT_MODEL = "muse-spark-1.3-contributor";
     MUSE_CLI_DEFAULT_EFFORT = "high";
     CODEX_CLI_DEFAULT_MODEL = "gpt-6.1-sol";
@@ -10136,9 +10333,25 @@ function isOpenCodeGoModelId(id) {
 function hasOpenCodeGoPrefix(id) {
   return (id?.trim() ?? "").startsWith(OPENCODE_GO_PREFIX);
 }
+function hasOpenCodeGo2Prefix(id) {
+  return (id?.trim() ?? "").startsWith(OPENCODE_GO_2_PREFIX);
+}
 function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
-  return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
+  if (!isOpenCodeGoModelId(trimmed))
+    return null;
+  return trimmed.slice((hasOpenCodeGo2Prefix(trimmed) ? OPENCODE_GO_2_PREFIX : OPENCODE_GO_PREFIX).length);
+}
+function isZaiModelId(id) {
+  const trimmed = id?.trim() ?? "";
+  return ZAI_MODEL_PATTERN.test(trimmed) && !trimmed.includes("..");
+}
+function hasZaiPrefix(id) {
+  return (id?.trim() ?? "").startsWith(ZAI_PREFIX);
+}
+function zaiWireModel(id) {
+  const trimmed = id?.trim() ?? "";
+  return isZaiModelId(trimmed) ? trimmed.slice(ZAI_PREFIX.length) : null;
 }
 function isEngineId(value) {
   return CLI_ENGINE_MODEL_IDS.includes(value);
@@ -10236,7 +10449,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_2_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10295,7 +10508,10 @@ var init_engine_spec = __esm({
     OPENROUTER_PREFIX = "openrouter:";
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
-    OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
+    OPENCODE_GO_2_PREFIX = "opencode-go-2:";
+    OPENCODE_GO_MODEL_PATTERN = /^opencode-go(?:-2)?:[a-z0-9][a-z0-9._-]{0,100}$/;
+    ZAI_PREFIX = "zai:";
+    ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
 });
 
@@ -10580,6 +10796,8 @@ var init_api_model_catalog = __esm({
       authCaptureModel: "Login capture",
       plannerModel: "Scenario Planner",
       plannerGateModel: "Planner Gate",
+      pwAgentsHealerModel: "Test Healer (Playwright agents)",
+      pwAgentsReviewModel: "Plan Review (Playwright agents)",
       generationModel: "Code Generation",
       reviewModel: "Code Review",
       apiTestModel: "API Test Generator",
@@ -10604,11 +10822,6 @@ var init_api_model_catalog = __esm({
 });
 
 // ../shared/dist/provider-chains.js
-function isClaudeModel(id) {
-  if (/claude|anthropic/i.test(id))
-    return true;
-  return API_MODEL_CATALOG.some((m) => m.provider === "anthropic" && (m.id === id || m.apiModel === id));
-}
 function chainKey(modelId) {
   const id = canonicalModelId(modelId);
   if (!id)
@@ -10616,34 +10829,83 @@ function chainKey(modelId) {
   const entry = API_MODEL_CATALOG.find((m) => m.id === id || m.apiModel === id);
   return entry?.id ?? id;
 }
+function has(map, key) {
+  return Object.prototype.hasOwnProperty.call(map, key);
+}
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
-  if (!key || isClaudeModel(key))
-    return [];
-  return Object.prototype.hasOwnProperty.call(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+  return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+}
+function providerChainLeadsFor(modelId) {
+  const key = chainKey(modelId);
+  return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
+}
+function allChains() {
+  return [...Object.entries(PROVIDER_CHAINS), ...Object.entries(PROVIDER_CHAIN_LEADS)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
-  return id !== "" && Object.values(PROVIDER_CHAINS).some((hops) => hops.includes(id));
+  return id !== "" && allChains().some(([, hops]) => hops.includes(id));
 }
 function providerChainPrimariesForHop(hopId) {
   const id = hopId ?? "";
   if (!id)
     return [];
-  return Object.entries(PROVIDER_CHAINS).filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+  return allChains().filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+}
+function providerChainHostOf(value, modelValue) {
+  if (value === modelValue)
+    return "own";
+  if (hasZaiPrefix(value))
+    return "zai";
+  if (hasOpenCodeGo2Prefix(value))
+    return "opencode-go-2";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  return "own";
+}
+function providerHostPlan(modelId) {
+  const key = chainKey(modelId);
+  if (!key)
+    return [];
+  const own = { host: hasOpenRouterPrefix(key) ? "openrouter" : "own", value: key };
+  const steps = [
+    ...providerChainLeadsFor(key).map((value) => ({ host: providerChainHostOf(value, key), value })),
+    own,
+    ...providerChainFor(key).map((value) => ({ host: providerChainHostOf(value, key), value }))
+  ];
+  const notOffered = Object.prototype.hasOwnProperty.call(PROVIDER_HOST_NOT_OFFERED, key) ? PROVIDER_HOST_NOT_OFFERED[key] : {};
+  for (const [host, reason] of Object.entries(notOffered)) {
+    const at = steps.findIndex((step) => step === own) + 1;
+    steps.splice(at, 0, { host, value: null, notOffered: reason });
+  }
+  return steps;
 }
-var PROVIDER_CHAINS;
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
     init_api_model_catalog();
+    init_engine_spec();
     PROVIDER_CHAINS = {
-      "minimax-m3": ["openrouter:minimax/minimax-m3", "opencode-go:minimax-m3"],
-      "minimax-m3.1-flash": ["openrouter:minimax/minimax-m3.1-flash", "opencode-go:minimax-m3.1-flash"],
+      "minimax-m3": ["opencode-go:minimax-m3", "openrouter:minimax/minimax-m3"],
+      "minimax-m3.1-flash": ["opencode-go:minimax-m3.1-flash", "openrouter:minimax/minimax-m3.1-flash"],
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
-      "openrouter:z-ai/glm-5.3-flash": ["opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["opencode-go:glm-5.2"]
+      "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
+      "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
+      "deepseek-flash": ["opencode-go-2:deepseek-v4.1-flash", "opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go-2:deepseek-v4-pro", "opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
+    };
+    PROVIDER_CHAIN_LEADS = {
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go-2:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go-2:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go-2:glm-5.2", "opencode-go:glm-5.2"]
+    };
+    PROVIDER_HOST_NOT_OFFERED = {
+      "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
+      "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
     };
   }
 });
@@ -12581,7 +12843,7 @@ function stateLiteralsOf(line) {
   const out = [];
   for (const m of line.matchAll(STRING_LITERAL_RE)) {
     const text = m[1] ?? m[2] ?? m[3] ?? "";
-    if (text.includes("placeholder="))
+    if (PLACEHOLDER_ATTR_RE.test(text))
       continue;
     if (PLACEHOLDER_CALL_TAIL_RE.test(line.slice(Math.max(0, m.index - 40), m.index)))
       continue;
@@ -12677,7 +12939,7 @@ function formatReadinessPollAdvisory(findings) {
   const where = findings.length === 1 ? "One place" : `${findings.length} places`;
   return `${where} re-check a background state once and assert the finished state at once (${short(first.line, 90)} then ${short(first.assertion, 90)}). ${first.reason}`;
 }
-var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
+var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_ATTR_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
 var init_readiness_poll = __esm({
   "../shared/dist/readiness-poll.js"() {
     "use strict";
@@ -12690,7 +12952,7 @@ var init_readiness_poll = __esm({
     STRING_LITERAL_RE = /'((?:\\.|[^'\\\n]){0,300})'|"((?:\\.|[^"\\\n]){0,300})"|`((?:\\.|[^`\\\n]){0,300})`/g;
     RECHECK_NAME_RE = /^\s{0,10}(?:check again|check (?:status|availability|now|for updates|progress)|re-?check(?: status)?|update status|see (?:latest|updates))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
     RETRY_NAME_RE = /^\s{0,10}(?:refresh(?: (?:status|list|page|results|now))?|reload(?: (?:page|results|list))?|try again|retry|load (?:again|latest))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
-    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b[a-z]{3,40}(?<!th)ing(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
+    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b(?:saving|uploading|downloading|signing|logging|submitting|creating|updating|deleting|importing|exporting|publishing|connecting|redirecting|authenticating|installing|retrieving|fetching|analy[sz]ing|running|rendering|restarting|building|compiling|booting|provisioning|deploying|indexing|migrating|launching|initiali[sz]ing|optimi[sz]ing|converting|processing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}(?:starting|scanning|working|applying|finishing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}[a-z]{3,40}(?<!th)ing\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
     LOCATOR_LINE_RE = /\.(?:getBy[A-Z]\w{0,30}|locator|toHaveText|toContainText)\s{0,20}\(/;
     CLICK_RE = /\.(?:click|dblclick|tap)\s{0,20}\(/;
     RELOAD_RE = /\bpage\.reload\s{0,20}\(/;
@@ -12704,6 +12966,7 @@ var init_readiness_poll = __esm({
     TEST_END_RE = /^\s{0,20}\}\s{0,20}\)\s{0,20};?\s{0,20}$/;
     TEST_START_RE = /\btest(?:\.\w{1,20})?\s{0,20}\(/;
     POLL_OPEN_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}async\b|\bexpect\.poll\s{0,20}\(|\bfor\s{0,20}\(|\bwhile\s{0,20}\(|\bdo\s{0,20}\{/g;
+    PLACEHOLDER_ATTR_RE = /placeholder\s{0,4}[*^$~|]?=/;
     PLACEHOLDER_CALL_TAIL_RE = /getByPlaceholder\s{0,20}\(\s{0,20}$/;
     POLL_SHAPE = "await expect(async () => { await page.reload(); await expect(<the finished state>).toBeVisible({ timeout: 1500 }); }).toPass({ timeout: 20000 });";
   }
@@ -13105,6 +13368,15 @@ function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
   return COMPUTE_RE.test(code) || RELATIONAL_RE.test(line);
 }
+function identifiersIn(line) {
+  const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX");
+  return [code, ...[...line.matchAll(TEMPLATE_EXPR_RE)].map((m) => m[1])].flatMap((part) => part.match(IDENTIFIER_RE) ?? []);
+}
+function addTyped(typed, value) {
+  const d = digitsOf(value);
+  if (/\d/.test(d))
+    typed.add(d);
+}
 function reasonFor4(kind, label, value) {
   const what = kind === "derived-value-shape-only" ? `The ${label} is checked only for its shape, so any amount passes, including a wrongly computed one.` : `The ${label} is checked against a number written into the test (${value}). That number was read off the page, so when the page computes it wrong the check still passes.`;
   return `${what} Instead, ${COMPUTE_SHAPE} If the number is not computed from other values (a list price, an id, a fixed fee), leave it as it is. Keep the existing checks.`;
@@ -13116,25 +13388,32 @@ function analyzeDerivedValues(rawCode) {
   for (const body of testBodies(rawCode)) {
     if (findings.length >= MAX_FINDINGS4)
       break;
-    if (body.some(computes))
-      continue;
     const typed = /* @__PURE__ */ new Set();
     const definitions = /* @__PURE__ */ new Map();
+    const computed = /* @__PURE__ */ new Set();
+    const usesComputed = (text) => identifiersIn(text).some((id) => computed.has(id));
     for (const line of body) {
       if (FILL_RE2.test(line) && !EXPECT_RE3.test(line)) {
-        for (const m of line.matchAll(/['"`]([^'"`\n]{0,40})['"`]/g)) {
-          const d = digitsOf(m[1]);
-          if (/\d/.test(d))
-            typed.add(d);
-        }
+        for (const m of line.matchAll(QUOTED_RE))
+          addTyped(typed, m[1]);
+        const arg = FILL_ARG_RE.exec(line)?.[1];
+        const literal = arg === void 0 ? null : LITERAL_VALUE_RE.exec(definitions.get(arg) ?? "");
+        const value = literal?.slice(1).find((v) => v !== void 0);
+        if (value !== void 0)
+          addTyped(typed, value);
       }
       const def = DEFINITION_RE.exec(line);
-      if (def)
+      if (def) {
         definitions.set(def[1], def[2]);
+        if (computes(def[2]) || usesComputed(def[2]))
+          computed.add(def[1]);
+      }
     }
     for (const line of body) {
       if (!EXPECT_RE3.test(line) || !VALUE_MATCHER_RE2.test(line) || /\.not\s{0,20}\./.test(line))
         continue;
+      if (computes(line) || usesComputed(line))
+        continue;
       const subject = EXPECT_SUBJECT_RE.exec(line)?.[1];
       const label = DERIVED_WORD_RE.exec(`${line} ${(subject && definitions.get(subject)) ?? ""}`)?.[0];
       if (!label)
@@ -13164,7 +13443,7 @@ function formatDerivedValueAdvisory(findings) {
   const where = findings.length === 1 ? "One computed value is" : `${findings.length} computed values are`;
   return `${where} checked against a copied number or only its shape (${short4(first.line, 90)}). ${first.reason}`;
 }
-var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, COMPUTE_SHAPE;
+var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, TEMPLATE_EXPR_RE, IDENTIFIER_RE, QUOTED_RE, FILL_ARG_RE, LITERAL_VALUE_RE, COMPUTE_SHAPE;
 var init_derived_value_check = __esm({
   "../shared/dist/derived-value-check.js"() {
     "use strict";
@@ -13184,6 +13463,11 @@ var init_derived_value_check = __esm({
     DEFINITION_RE = /\b(?:const|let)\s{1,10}([\w$]{1,60})\s{0,10}=\s{0,10}([^\n]{0,300})/;
     EXPECT_SUBJECT_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}([\w$]{1,60})/;
     LITERAL_ARITH_RE = /\b\d[\d_.]{0,15}(?:\s{0,5}[*/+-]\s{0,5}\d[\d_.]{0,15}){1,8}\b/g;
+    TEMPLATE_EXPR_RE = /\$\{([^{}\n]{0,200})\}/g;
+    IDENTIFIER_RE = /[A-Za-z_$][\w$]{0,60}/g;
+    QUOTED_RE = /['"`]([^'"`\n]{0,40})['"`]/g;
+    FILL_ARG_RE = /\.(?:fill|type|pressSequentially|selectOption)\s{0,20}\(\s{0,20}([A-Za-z_$][\w$]{0,60})\s{0,20}[,)]/;
+    LITERAL_VALUE_RE = /^\s{0,10}(?:'([^'\n]{0,40})'|"([^"\n]{0,40})"|`([^`$\n]{0,40})`|(\d[\d_,]{0,15}(?:\.\d{1,4})?))\s{0,10};?\s{0,10}$/;
     COMPUTE_SHAPE = "compute the expected value in the test from its inputs (the values the test typed, or each input read from the page) and compare: const toNumber = (s) => Number(s.replace(/[^\\d.-]/g, '')); const unit = toNumber(await <unit price locator>.innerText()); then expect(toNumber(await <shown value locator>.innerText())).toBeCloseTo(unit * quantity, 2); for several lines, read them all and sum them with reduce. For a comma-decimal price like \u20AC1.234,56, drop the dots and turn the comma into a point before Number, since the replace above would read it as 1.23456.";
   }
 });
@@ -15218,6 +15502,99 @@ function formatStaleAfterSubmitAdvisory(rawCode) {
   const more = described.length > 3 ? ` (+${described.length - 3} more)` : "";
   return `stale-after-submit: ${described.slice(0, 3).join("; ")}${more}; these pass before the request lands and still pass if the server rejects or ignores the save. Wait for the result instead: page.waitForResponse around the click, or assert something the submit creates (the new row, the confirmation message, a path with an end anchor such as /\\/orders\\/\\d+$/)`;
 }
+function regexLiteralEnd4(text, at) {
+  let inClass = false;
+  for (let i = at + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\n")
+      return -1;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/")
+      return i + 1;
+  }
+  return -1;
+}
+function startsWithRegexLiteral(text) {
+  const t = text.trimStart();
+  return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
+}
+function afterFirstArg(args) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i];
+    if (quote) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}")
+      depth--;
+    else if (ch === "," && depth === 0)
+      return args.slice(i + 1);
+  }
+  return "";
+}
+function analyzeRegexMatchers(rawCode) {
+  if (!rawCode || typeof rawCode !== "string")
+    return [];
+  const code = stripComments2(rawCode.slice(0, MAX_LINT_INPUT));
+  const out = [];
+  const re = /\bexpect(?:\.soft)?\s{0,20}\(/g;
+  let m;
+  let examined = 0;
+  let line = 1;
+  let lineAt2 = 0;
+  while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
+    const subj = readBalanced(code, m.index + m[0].length);
+    if (!subj)
+      continue;
+    const mm = /^\s{0,20}(\.\s{0,20}not)?\s{0,20}\.\s{0,20}(\w{1,40})\s{0,20}\(/.exec(code.slice(subj.end + 1, subj.end + 1 + 80));
+    if (!mm || !REGEX_EQUALITY_MATCHERS.has(mm[2]))
+      continue;
+    const args = readBalanced(code, subj.end + 1 + mm[0].length);
+    if (!args)
+      continue;
+    const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
+    if (!startsWithRegexLiteral(expected))
+      continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain" && (startsWithRegexLiteral(subj.text) || /^new\s+RegExp\b/.test(subj.text.trim())))
+      continue;
+    for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
+      line++;
+      lineAt2 = i + 1;
+    }
+    out.push({ line, matcher: mm[2], negated: mm[1] !== void 0 });
+  }
+  return out;
+}
+function formatRegexMatcherNote(findings) {
+  const lines = findings.map((f) => `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? "always passes (a regex never equals the value), so it checks nothing" : "can never pass: this matcher compares by equality and a regex never equals a value"}.`);
+  return `${lines.join("\n")}
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For a DOM property read it first: expect(await loc.evaluate((n) => n.<prop>)).toMatch(/re/). Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+}
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
     return [];
@@ -15225,6 +15602,10 @@ function lintTestQuality(rawCode, opts = {}) {
     return lintTestData(rawCode, { pageContacts: opts.pageContacts });
   if (opts.only === "test-data-blocking")
     return analyzeTestData(rawCode, { pageContacts: opts.pageContacts }).blocking;
+  if (opts.only === "regex-matcher") {
+    const found = analyzeRegexMatchers(rawCode);
+    return found.length > 0 ? [formatRegexMatcherNote(found)] : [];
+  }
   const warnings = [];
   if (rawCode.length > MAX_LINT_INPUT) {
     warnings.push(`The code is ${Math.round(rawCode.length / 1024)} KB; the quality lint checked only the first ${MAX_LINT_INPUT / 1e3} KB. Split it into smaller tests (one behaviour per test).`);
@@ -15499,7 +15880,7 @@ function specItemsFromTestPlans(testPlans) {
   }
   return [...new Set(out)].slice(0, 200);
 }
-var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, STOP, SYNONYMS, AREA_TOKENS;
+var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, MAX_REGEX_MATCHER_FINDINGS, REGEX_EQUALITY_MATCHERS, STOP, SYNONYMS, AREA_TOKENS;
 var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
@@ -15731,6 +16112,8 @@ var init_test_authoring_quality = __esm({
     };
     LIVE_WRITE_NAME = /\b(?:submit|place|book|reserve|confirm|pay|send|checkout|order|register|sign\s?up|create account)\b/i;
     BUNDLED_CHECKS_BEFORE_WRITE = 5;
+    MAX_REGEX_MATCHER_FINDINGS = 10;
+    REGEX_EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toContain", "toHaveJSProperty"]);
     STOP = /* @__PURE__ */ new Set([
       "a",
       "an",
@@ -15959,6 +16342,19 @@ var init_fence_runs = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/survey-bug-signature.js
 function normalizeWords(text) {
   return text.toLowerCase().replace(UUID, " id ").replace(PREFIXED_ID, " id ").replace(HEX_RUN, (run) => /\d/.test(run) ? " id " : run).replace(NUMBER_RUN, " # ").replace(/[^\p{L}\p{N}#]+/gu, " ").replace(/\s+/g, " ").trim();
@@ -15969,7 +16365,7 @@ function normalizeBugPath(route) {
   if (hash >= 0 && path[hash + 1] !== "/")
     path = path.slice(0, hash);
   const segments = path.toLowerCase().split("/").map((segment) => /\d/.test(segment) ? ":id" : segment);
-  const joined = segments.join("/").replace(/\/+$/, "");
+  const joined = stripTrailingSlashes(segments.join("/"));
   return joined || (path.startsWith("/") ? "/" : "");
 }
 function isGenericConsoleMessage(message) {
@@ -16103,6 +16499,7 @@ var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
+    init_trailing_slashes();
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17383,9 +17780,9 @@ function lastLocatorLabels(chain) {
       if (t)
         labels.push(t[1]);
     }
-    const has = optionText(last.args, HAS_TEXT_OPTION_RE);
-    if (has !== null)
-      labels.push(has);
+    const has2 = optionText(last.args, HAS_TEXT_OPTION_RE);
+    if (has2 !== null)
+      labels.push(has2);
   }
   return labels.map((l) => l.replace(/^[\s^(?:]+/, "").trim());
 }
@@ -18142,14 +18539,17 @@ var init_promotion_quality_gate = __esm({
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, strengthGate, flagContradictedAdditions }) {
+      run({ code, tags, strengthGate, flagContradictedAdditions }) {
         const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
-        if (verdict.severity !== "block")
+        const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
+        if (verdict.severity !== "block" && !authDowngrade)
           return [];
         const revealed = strengthGate?.severity === "none" && strengthGate.revealEvidence === "revealed" && strengthGate.source !== "heal";
-        return revealed ? [] : [{ check: "strength-block" }];
+        if (revealed)
+          return [];
+        return [{ check: authDowngrade ? "strength-downgrade-auth" : "strength-block" }];
       }
     };
     STRING_CONST = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,60})\s{0,20}=\s{0,20}(?:'([^'\\\n]{0,300})'|"([^"\\\n]{0,300})"|`([^`\\$\n]{0,300})`)\s{0,20}[;\n]/g;
@@ -18556,6 +18956,7 @@ __export(dist_exports, {
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
   AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
   AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
+  AUTH_SESSION_GENERATION_RE: () => AUTH_SESSION_GENERATION_RE,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -18688,6 +19089,8 @@ __export(dist_exports, {
   LIVE_FRAME_STALE_MS: () => LIVE_FRAME_STALE_MS,
   LIVE_FRAME_UNFOCUSED_INTERVAL_MS: () => LIVE_FRAME_UNFOCUSED_INTERVAL_MS,
   LIVE_THUMBNAIL_MAX_BASE64_BYTES: () => LIVE_THUMBNAIL_MAX_BASE64_BYTES,
+  MAX_BALANCED_SCAN: () => MAX_BALANCED_SCAN,
+  MAX_CALLS: () => MAX_CALLS,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MAX_EMAIL_ADDRESS_LENGTH: () => MAX_EMAIL_ADDRESS_LENGTH,
@@ -18732,6 +19135,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
+  OPENCODE_GO_2_PREFIX: () => OPENCODE_GO_2_PREFIX,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -18767,6 +19171,8 @@ __export(dist_exports, {
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
   READINESS_POLL_MAX_CODE_CHARS: () => READINESS_POLL_MAX_CODE_CHARS,
@@ -18805,6 +19211,7 @@ __export(dist_exports, {
   SURVEY_NOTES_RENDER_MAX_CHARS: () => SURVEY_NOTES_RENDER_MAX_CHARS,
   SURVEY_NOTE_KEYS: () => SURVEY_NOTE_KEYS,
   SUSPICIOUS_PASS_TAG: () => SUSPICIOUS_PASS_TAG,
+  TEST_DID_NOT_RUN_ERROR: () => TEST_DID_NOT_RUN_ERROR,
   TEST_QUALITY_CONVENTIONS: () => TEST_QUALITY_CONVENTIONS,
   TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TEST_VARIABLE_SECRET_KEY_PATTERN: () => TEST_VARIABLE_SECRET_KEY_PATTERN,
@@ -18820,6 +19227,8 @@ __export(dist_exports, {
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
+  ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
+  ZAI_PREFIX: () => ZAI_PREFIX,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
@@ -18828,6 +19237,7 @@ __export(dist_exports, {
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   analyzePersistenceReread: () => analyzePersistenceReread,
   analyzeReadinessPolling: () => analyzeReadinessPolling,
+  analyzeRegexMatchers: () => analyzeRegexMatchers,
   analyzeSharedAccountUse: () => analyzeSharedAccountUse,
   analyzeStaleAfterSubmit: () => analyzeStaleAfterSubmit,
   analyzeTestData: () => analyzeTestData,
@@ -18991,6 +19401,7 @@ __export(dist_exports, {
   formatPersistenceRereadAdvisory: () => formatPersistenceRereadAdvisory,
   formatPoolBudgetLine: () => formatPoolBudgetLine,
   formatReadinessPollAdvisory: () => formatReadinessPollAdvisory,
+  formatRegexMatcherNote: () => formatRegexMatcherNote,
   formatStaleAfterSubmitAdvisory: () => formatStaleAfterSubmitAdvisory,
   formatSuspiciousExpectation: () => formatSuspiciousExpectation,
   formatUrlWaitAdvisory: () => formatUrlWaitAdvisory,
@@ -19029,12 +19440,14 @@ __export(dist_exports, {
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
   hasOnlyConstantAssertions: () => hasOnlyConstantAssertions,
+  hasOpenCodeGo2Prefix: () => hasOpenCodeGo2Prefix,
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
+  hasZaiPrefix: () => hasZaiPrefix,
   healMobileTestSteps: () => healMobileTestSteps,
   healthRunWhere: () => healthRunWhere,
   heldCodeRecord: () => heldCodeRecord,
@@ -19138,6 +19551,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  isZaiModelId: () => isZaiModelId,
   jsEscapedForms: () => jsEscapedForms,
   jsonStructureRefusalOf: () => jsonStructureRefusalOf,
   jsonStructureVerify: () => jsonStructureVerify,
@@ -19186,6 +19600,7 @@ __export(dist_exports, {
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
+  parseAuthSessionStamp: () => parseAuthSessionStamp,
   parseBoolFlag: () => parseBoolFlag,
   parseDbPoolSize: () => parseDbPoolSize,
   parseDeepgramListenResponse: () => parseDeepgramListenResponse,
@@ -19229,7 +19644,11 @@ __export(dist_exports, {
   profileKeyRoute: () => profileKeyRoute,
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
+  providerChainHostOf: () => providerChainHostOf,
+  providerChainLeadsFor: () => providerChainLeadsFor,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
+  providerHostPlan: () => providerHostPlan,
+  readBalanced: () => readBalanced,
   readChatFailover: () => readChatFailover,
   readChatReasoningTokens: () => readChatReasoningTokens,
   readChatUsage: () => readChatUsage,
@@ -19312,6 +19731,7 @@ __export(dist_exports, {
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
@@ -19339,7 +19759,8 @@ __export(dist_exports, {
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
   withoutServerOnlySpendFields: () => withoutServerOnlySpendFields,
-  withoutSurveyNotes: () => withoutSurveyNotes
+  withoutSurveyNotes: () => withoutSurveyNotes,
+  zaiWireModel: () => zaiWireModel
 });
 var init_dist = __esm({
   "../shared/dist/index.js"() {
@@ -19381,6 +19802,7 @@ var init_dist = __esm({
     init_admin_view_return_to();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_session_stamp();
     init_auth_state_freshness();
     init_skip_coverage_detector();
     init_feature_coverage();
@@ -19437,6 +19859,7 @@ var init_dist = __esm({
     init_promotion_quality_gate();
     init_regex_alternation();
     init_page_evidence();
+    init_trailing_slashes();
   }
 });
 
@@ -19470,12 +19893,7 @@ export {
   isAppOriginResolutionEnabled,
   resolveCrossOriginConfigOverride,
   deriveAuthPlan,
-  detectAuthBlock,
-  detectApiColdSessionBlock,
-  coldSessionConfigMessage,
-  detectSkippedApiCoverage,
   isSharedAuthInjectEnabled,
-  isAuthReadinessGuardEnabled,
   isRepositoryCli,
   repositoryCliLabel,
   dist_exports,