@validate.qa/runner 1.0.100 → 1.0.102

package/dist/discovery-mcp-server.js

@@ -91,13 +91,13 @@ function isBlockedEnvVar(key) {
 function sanitizeTestVariables(vars) {
   if (!vars)
     return {};
-  const clean2 = {};
+  const clean3 = {};
   for (const [key, value] of Object.entries(vars)) {
     if (!isBlockedEnvVar(key)) {
-      clean2[key] = value;
+      clean3[key] = value;
     }
   }
-  return clean2;
+  return clean3;
 }
 function buildSandboxedEnv(processEnv, testVariables) {
   const env = {};
@@ -1554,9 +1554,40 @@ function semanticTarget(label, platform, base) {
     }
   };
 }
+function androidResourceOwners(value) {
+  const owners = [];
+  for (const match of value.matchAll(ANDROID_RESOURCE_ID_SUFFIX_RE)) {
+    let runStart = match.index;
+    while (runStart > 0 && /[a-z0-9_.]/i.test(value[runStart - 1]))
+      runStart--;
+    const owner = ownerAtEndOfRun(value.slice(runStart, match.index));
+    if (owner !== null)
+      owners.push(owner);
+  }
+  return owners;
+}
+function ownerAtEndOfRun(run) {
+  const segments = run.split(".");
+  const last = segments.length - 1;
+  const startsWithLetter = (segment) => /^[a-z]/i.test(segment);
+  if (last < 1 || !startsWithLetter(segments[last]))
+    return null;
+  let first = last;
+  while (first > 0 && startsWithLetter(segments[first - 1]))
+    first--;
+  let offset = 0;
+  for (let i = 0; i < first - 1; i++)
+    offset += segments[i].length + 1;
+  if (first > 0) {
+    const letterAt = segments[first - 1].search(/[a-z]/i);
+    if (letterAt >= 0)
+      return run.slice(offset + letterAt);
+    offset += segments[first - 1].length + 1;
+  }
+  return first < last ? run.slice(offset) : null;
+}
 function containsForeignAppPackage(value, targetAppId) {
-  for (const match of value.matchAll(ANDROID_RESOURCE_OWNER_RE)) {
-    const owner = match[1];
+  for (const owner of androidResourceOwners(value)) {
     if (targetAppId && owner !== targetAppId && !owner.startsWith(`${targetAppId}.`))
       return true;
   }
@@ -1693,7 +1724,7 @@ function healMobileTestSteps(input) {
     summary: changed ? uniq(summary).slice(0, 12) : []
   };
 }
-var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_OWNER_RE, COMMON_EXTERNAL_PREFIXES;
+var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_ID_SUFFIX_RE, COMMON_EXTERNAL_PREFIXES;
 var init_mobile_step_healer = __esm({
   "../shared/dist/mobile-step-healer.js"() {
     "use strict";
@@ -1714,7 +1745,7 @@ var init_mobile_step_healer = __esm({
       "assertStateDelta"
     ]);
     FOREIGN_PACKAGE_RE = /\b[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){2,}\b/gi;
-    ANDROID_RESOURCE_OWNER_RE = /([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+):id\//gi;
+    ANDROID_RESOURCE_ID_SUFFIX_RE = /:id\//gi;
     COMMON_EXTERNAL_PREFIXES = [
       "com.android.",
       "com.google.",
@@ -3027,7 +3058,7 @@ function unescapeQuotedBody(raw) {
   return raw.replace(/\\(['"`\\])/g, "$1");
 }
 function extractRoleNameValue(line) {
-  const m = line.match(new RegExp(`getByRole\\s*\\([^,]+,\\s*\\{[^}]*name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
+  const m = line.match(new RegExp(`getByRole\\s*\\([^,]{1,200},\\s*\\{[^}]{0,200}?name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
   if (!m)
     return null;
   const raw = m[1] ?? m[2] ?? m[3];
@@ -3424,7 +3455,7 @@ var init_assertion_classifier = __esm({
       // toHaveCount(0) stays tier 4 (absence proof) via TIER4_PATTERNS.
       [/\.toHaveCount\s*\(\s*[1-9]\d*\s*\)/, "non-zero toHaveCount asserts a record count that changes between runs"],
       // parenthesised counts like "(3)" or "[12]" in text - but not Playwright method args
-      [/(?<!\.\w{3,20}\s*)\(\s*\d+\s*\)(?!\s*[,;]?\s*\))/i, "parenthesised count is session-specific"],
+      [/\((?<!\.\w{3,20}\s*\()\s*\d+\s*\)(?!\s*(?:[,;]\s*)?\))/i, "parenthesised count is session-specific"],
       // bare email addresses in assertion content
       [/\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b/i, "email address is user-specific"],
       // currency/balance amounts (dynamic account data)
@@ -3670,7 +3701,7 @@ var init_assertion_proof = __esm({
     PRESENCE_MATCHER = /\.(?:toBeVisible|toBeAttached|toBeEnabled|toBeInViewport|toBeEditable|toBeFocused)\s*\(|\.toHaveCount\s*\(\s*1\s*\)/;
     TEXT_MATCHER = /\.(?:toHaveText|toContainText)\s*\(/;
     ANY_VALUE_SOURCE = /^(?:\.|\\S|\\w|\\d|\[\^\\s\]|\[0-9\]|\[\\d\]|\[\\w\]|\[\\s\\S\])[+*]?\??$/;
-    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*\)/;
+    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*[,)]/;
     EMPTY_NOT_VALUE = /\.not\s*\.\s*toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/;
     TEXT_MATCHER_LITERAL = /\.(?:toHaveText|toContainText)\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
     GET_BY_TEXT_LITERAL = /getByText\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
@@ -3687,7 +3718,7 @@ var init_assertion_proof = __esm({
     DATA_ROLE = /getByRole\s*\(\s*['"`](?:dialog|alertdialog|alert|cell|gridcell|row|rowheader|columnheader|listitem|article|option|status|note|tooltip|paragraph|term|definition|log|marquee|timer|meter)['"`]/gi;
     TEXT_LOCATOR = /\.getByText\s*\(|\.filter\s*\(\s*\{\s*hasText\s*:/g;
     CSS_LOCATOR = /\.locator\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/g;
-    SPECIFIC_CSS = /\[[^\]]*=|#[\w-]|has-text|:text/;
+    SPECIFIC_CSS = /\[[^\][=]*=|#[\w-]|has-text|:text/;
   }
 });
 
@@ -3735,6 +3766,8 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
+  let prev = "";
+  let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
     if (quote) {
@@ -3742,12 +3775,24 @@ function stripCoverageComments(code) {
         i += 2;
         continue;
       }
-      if (ch === quote || ch === "\n" && quote !== "`")
+      if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
+        prev = ch === "\n" ? prev : ch;
+      }
       i++;
       continue;
     }
     const next = code[i + 1];
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+      const end = regexLiteralEnd3(code, i);
+      if (end > 0) {
+        i = end;
+        prev = "a";
+        continue;
+      }
+      const eol = code.indexOf("\n", i);
+      noRegexBefore = eol === -1 ? code.length : eol;
+    }
     if (ch === "/" && next === "*") {
       const end = code.indexOf("*/", i + 2);
       const stop = end === -1 ? code.length : end + 2;
@@ -3766,11 +3811,39 @@ function stripCoverageComments(code) {
     }
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
+      prev = ch;
     i++;
   }
   out.push(code.slice(copyFrom));
   return out.join("");
 }
+function regexLiteralEnd3(code, start) {
+  let inClass = false;
+  for (let j = start + 1; j < code.length; j++) {
+    const c = code[j];
+    if (c === "\n")
+      return -1;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]")
+        inClass = false;
+      continue;
+    }
+    if (c === "[")
+      inClass = true;
+    else if (c === "/") {
+      let k = j + 1;
+      while (k < code.length && isIdentChar(code[k]))
+        k++;
+      return k;
+    }
+  }
+  return -1;
+}
 function isIdentChar(ch) {
   if (!ch)
     return false;
@@ -4428,7 +4501,7 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
@@ -4465,6 +4538,7 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
+    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -4608,22 +4682,37 @@ function classifyAuthHandoffIntent(text) {
 function withoutIdpUrlAsserts(code) {
   return code.replace(/\.(?:toHaveURL|waitForURL)\s*\((?:[^)(]|\([^)]*\))*\)/g, (match) => /accountchooser|accounts\.google|appleid\.apple|login\.microsoftonline|\/v\d+\/signin|oauth/i.test(match) ? "" : match);
 }
+function stripLineComment(line) {
+  let from = line.length;
+  while (from > 0) {
+    const c = line.charCodeAt(from - 1);
+    if (c === 10 || c === 13 || c === 8232 || c === 8233)
+      break;
+    from--;
+  }
+  const at = line.indexOf("//", from);
+  return at < 0 ? line : line.slice(0, at);
+}
 function stripComments(code) {
-  return replaceBlockComments(code, () => "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
+  return replaceBlockComments(code, () => "").split("\n").map(stripLineComment).join("\n");
 }
-function balancedCall(code, start) {
-  const open = code.indexOf("(", start);
-  if (open < 0)
-    return null;
-  let depth = 0;
-  for (let i = open; i < code.length; i++) {
+function closingParens(code) {
+  const close = new Int32Array(code.length).fill(-1);
+  const open = [];
+  for (let i = 0; i < code.length; i++) {
     const c = code[i];
     if (c === "(")
-      depth++;
-    else if (c === ")" && --depth === 0)
-      return { inner: code.slice(open + 1, i), end: i };
+      open.push(i);
+    else if (c === ")" && open.length > 0)
+      close[open.pop()] = i;
   }
-  return null;
+  return close;
+}
+function balancedCall(code, close, start) {
+  const open = code.indexOf("(", start);
+  if (open < 0 || close[open] < 0)
+    return null;
+  return { inner: code.slice(open + 1, close[open]), end: close[open] };
 }
 function resolveLocator(code, subject) {
   const id = subject.trim().match(/^([A-Za-z_$][\w$]*)$/);
@@ -4671,8 +4760,10 @@ function isAuthHandoffDismissCode(code) {
   const expects = [];
   const re = new RegExp(EXPECT_CALL_RE.source, "g");
   let match;
+  let close = null;
   while (match = re.exec(body)) {
-    const found = balancedCall(body, match.index);
+    close ??= closingParens(body);
+    const found = balancedCall(body, close, match.index);
     if (found)
       expects.push({ inner: found.inner, tail: body.slice(found.end, found.end + 48) });
   }
@@ -4717,12 +4808,209 @@ var init_auth_handoff_coverage = __esm({
   }
 });
 
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
+}
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
+  if (!sharedAuthInjectEnabled)
+    return false;
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function codeReadsStoredCredentials(code) {
+  if (!code)
+    return false;
+  if (/__vqaLogin\b/.test(code))
+    return true;
+  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
+    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
+      return true;
+  }
+  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
+    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
+      return true;
+  }
+  return false;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
+    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
+      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
+      switch (loginCompose[0]) {
+        case AUTH_TAG_COOKIE_STATE:
+          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_COOKIE:
+          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_BEARER:
+          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+      }
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
+  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
+  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds,
+    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
 // ../shared/dist/assertion-strength.js
+function parseLastActionProofMode(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  return v === "on" || v === "shadow" ? v : "off";
+}
+function isUrlProof(stmt) {
+  if (URL_PROOF.test(stmt))
+    return true;
+  let calls = 0;
+  for (const open of stmt.matchAll(POLL_OPEN)) {
+    if (++calls > POLL_CALLS_MAX)
+      break;
+    const from = open.index + open[0].length;
+    const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+    if (args === null)
+      continue;
+    const subject = pollSubject(args);
+    if (!POLL_PAGE_URL.test(subject))
+      continue;
+    if (!POLL_PAGE_URL_ONLY.test(subject) || PAGE_VALUE_MATCHER.test(stmt.slice(from + args.length)))
+      return true;
+  }
+  return false;
+}
 function liveExpectStatements(uncommented) {
   const masked = maskedOutsideStrings(uncommented).split("\n");
   return accumulateStatements(uncommented.split("\n")).filter((s) => EXPECT_STMT.test(s.stmt) && EXPECT_STMT.test(masked[s.startLine - 1] ?? ""));
 }
-function stripLineComment(ln) {
+function stripLineComment2(ln) {
   let quote = null;
   for (let i = 0; i < ln.length; i++) {
     const c = ln[i];
@@ -4745,7 +5033,7 @@ function splitInteractionStatementsWithLines(lines) {
   let depth = 0;
   let scaffold = false;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!ln)
       continue;
     const isContinuation = out.length > 0 && (ln.startsWith(".") || depth > 0 && !scaffold);
@@ -4769,7 +5057,7 @@ function testBlockIds(lines) {
   let any = false;
   let block = 0;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!open) {
       if (!TEST_BLOCK_OPEN.test(ln))
         continue;
@@ -4853,7 +5141,7 @@ function expectSubjectSpan(stmt) {
   }
   return null;
 }
-function resolveSubjectBindings(stmts, bindings, blockOfLine) {
+function resolveSubjectBindings(stmts, bindings, blockOfLine, boundAt) {
   if (bindings.length === 0)
     return [...stmts];
   return stmts.map((item) => {
@@ -4876,14 +5164,22 @@ function resolveSubjectBindings(stmts, bindings, blockOfLine) {
       subject = `${lead[1]}${found.expr.replace(/;\s*$/, "")}${subject.slice(lead[0].length)}`;
       line = found.line;
     }
-    return { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    const out = { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    if (boundAt !== void 0 && line !== item.startLine)
+      boundAt.set(out, line);
+    return out;
   });
 }
 function stripLoginScaffolding(code) {
-  const out = [];
+  const lines = code.split("\n");
+  return keptScaffoldingLines(lines).map((i) => lines[i]).join("\n");
+}
+function keptScaffoldingLines(lines) {
+  const kept = [];
   let inAuth = false;
   let inInbox = false;
-  for (const ln of code.split("\n")) {
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
     if (!inAuth && !inInbox && AUTH_START.test(ln)) {
       inAuth = true;
       continue;
@@ -4904,9 +5200,9 @@ function stripLoginScaffolding(code) {
     }
     if (LOGIN_CALL_LINE.test(ln))
       continue;
-    out.push(ln);
+    kept.push(i);
   }
-  return out.join("\n");
+  return kept;
 }
 function stripCommentsAndLogs(code) {
   return stripCoverageComments(code).split("\n").filter((ln) => !/^\s*console\./.test(ln)).join("\n");
@@ -4915,7 +5211,7 @@ function detectsErrorBannerAssertion(code) {
   const cleaned = stripCommentsAndLogs(stripLoginScaffolding(code));
   const lines = cleaned.split("\n");
   const candidates = [];
-  const positive = (stmt) => !NEGATED_ASSERT.test(stmt) && !ABSENCE_MATCHER.test(stmt);
+  const positive = (stmt) => !claimsAbsence(stmt);
   const statements = liveExpectStatements(cleaned).map((s) => s.stmt);
   for (const stmt of statements) {
     if (positive(stmt))
@@ -5044,6 +5340,12 @@ function detectsObservedFailureAsExpected(code) {
     return FAILURE_STATUS_ASSERT.some((re) => re.test(stmt)) || hasFailedListener && FAILED_LIST_ASSERT.test(stmt);
   });
 }
+function claimsAbsence(stmt) {
+  const negated = NEGATED_ASSERT_NOT.test(stmt);
+  const bare = negated ? stmt.replace(NOT_BEFORE_MATCHER, ".") : stmt;
+  const absenceMatcher = /\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+  return negated !== absenceMatcher;
+}
 function isVacuousErrorAbsence(stmt, presence) {
   if (!ABSENCE_MATCHER.test(stmt))
     return false;
@@ -5052,6 +5354,41 @@ function isVacuousErrorAbsence(stmt, presence) {
     return false;
   return !presence().includes(m[1]);
 }
+function isVacuousAccountAbsence(stmt, shown, account) {
+  if (!claimsAbsence(stmt))
+    return false;
+  if (!ABSENCE_MATCHER.test(stmt)) {
+    const negated = NEGATED_TEXT.exec(stmt);
+    if (!negated)
+      return false;
+    const read = account.exec(stmt.slice(negated.index));
+    return read !== null && !shown().has(read[0]);
+  }
+  const m = account.exec(stmt);
+  if (!m || shown().has(m[0]))
+    return false;
+  for (let at = endOfEnclosingCall(stmt, m.index + m[0].length); at < stmt.length; at = endOfEnclosingCall(stmt, at)) {
+    SCOPING_STEP.lastIndex = at;
+    if (SCOPING_STEP.test(stmt))
+      return false;
+  }
+  return true;
+}
+function endOfEnclosingCall(stmt, from) {
+  let depth = 0;
+  for (let i = from; i < stmt.length; i++) {
+    const c = stmt[i];
+    if (c === "'" || c === '"') {
+      for (i++; i < stmt.length && stmt[i] !== c; i++)
+        if (stmt[i] === "\\")
+          i++;
+    } else if (c === "(")
+      depth++;
+    else if (c === ")" && depth-- === 0)
+      return i + 1;
+  }
+  return stmt.length;
+}
 function isBareContainerVisibility(stmt) {
   return BARE_CONTAINER_ROLE.test(stmt) && !GET_BY_TEXT.test(stmt) && !HAS_TEXT_FILTER.test(stmt) && !TEXT_CONTENT_MATCHER.test(stmt);
 }
@@ -5059,19 +5396,53 @@ function isChromeTarget(stmt) {
   return CHROME_LOCATOR.test(stmt) && !CONTENT_ROLE.test(stmt) && !/getByText\s*\(/.test(stmt);
 }
 function countsAsContentText(stmt) {
-  if (!TEXT_CONTENT_MATCHER.test(stmt))
+  if (!TEXT_CONTENT_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt))
     return false;
   if (isSymbolOnlyArgument(stmt, TEXT_CONTENT_MATCHER))
     return false;
-  if (!isChromeTarget(stmt))
+  return onContentTarget(stmt);
+}
+function onContentTarget(stmt) {
+  return !isChromeTarget(stmt) || /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+}
+function provesTextRemoved(stmt, presence) {
+  const m = stmt.match(NEGATED_TEXT);
+  if (!m || !onContentTarget(stmt))
+    return false;
+  const text = m[1] ?? m[2];
+  if (text === void 0)
     return true;
-  return /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+  if (!/[\p{L}\p{N}]/u.test(text))
+    return false;
+  return !ERROR_TEXT_WORDS.test(text) || presence().includes(text);
 }
 function isDataContentRole(stmt) {
   return CONTENT_ROLE.test(stmt) && !ANNOUNCE_ROLE.test(stmt);
 }
+function destructuresRequest(code) {
+  let readTo = -1;
+  for (const m of code.matchAll(ASYNC_DESTRUCTURE_OPEN)) {
+    const start = m.index + m[0].length;
+    if (start <= readTo)
+      continue;
+    let end = start;
+    while (end < code.length && code[end] !== "}" && code[end] !== ")")
+      end++;
+    readTo = end;
+    if (end === code.length)
+      return false;
+    if (code[end] !== "}" || !REQUEST_WORD.test(code.slice(start, end)))
+      continue;
+    let close = end + 1;
+    while (close < code.length && /\s/.test(code[close]))
+      close++;
+    if (code[close] === ")")
+      return true;
+  }
+  return false;
+}
 function isApiTest(code) {
-  const usesRequestFixture = /async\s*\(\s*\{[^})]*\brequest\b[^})]*\}\s*\)/.test(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
+  const usesRequestFixture = destructuresRequest(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
   if (!usesRequestFixture)
     return false;
   const drivesUi = /\bpage\.(getBy\w+|locator|click|fill|goto|waitForURL|reload)\s*\(/.test(code) || /\.(click|fill|check|uncheck|selectOption|pressSequentially)\s*\(/.test(code);
@@ -5099,7 +5470,7 @@ function roleNames(s) {
 function interactedControlNames(lines) {
   const names = /* @__PURE__ */ new Set();
   for (const raw of lines) {
-    const ln = stripLineComment(raw);
+    const ln = stripLineComment2(raw);
     if (!INTERACT_VERB.test(ln))
       continue;
     for (const n of roleNames(ln))
@@ -5295,6 +5666,14 @@ function balancedArguments(code, from, limit = code.length) {
   }
   return null;
 }
+function expectCallTail(stmt) {
+  const at = stmt.search(EXPECT_CALL_RE);
+  if (at < 0)
+    return null;
+  const from = stmt.indexOf("(", at) + 1;
+  const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+  return args === null ? null : stmt.slice(from + args.length).trimStart();
+}
 function matcherArgumentsAreConstant(body, from) {
   MATCHER_OPEN.lastIndex = from;
   const opened = MATCHER_OPEN.exec(body);
@@ -5330,32 +5709,70 @@ function hasOnlyConstantAssertions(code) {
   const { constant, real } = constantAssertions(code);
   return constant.length > 0 && real === 0;
 }
+function envValueKey(name) {
+  return `\0env:${name}`;
+}
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
+  const accountConsts = /* @__PURE__ */ new Set();
   for (const { stmt, startLine } of stmts) {
     if (PAGE_NAV.test(stmt))
       navLines.push(startLine);
+    for (const c of stmt.matchAll(ACCOUNT_CONST))
+      accountConsts.add(c[1].replace(/\$/g, "\\$"));
     let m;
     ENTERED_VALUE.lastIndex = 0;
-    while (m = ENTERED_VALUE.exec(stmt)) {
-      const value = (m[1] ?? m[2] ?? m[3]).toLowerCase();
-      if (!values.has(value))
-        values.set(value, startLine);
-    }
+    const add = (value) => {
+      const lines = values.get(value);
+      if (!lines)
+        values.set(value, [startLine]);
+      else if (lines[lines.length - 1] !== startLine)
+        lines.push(startLine);
+    };
+    while (m = ENTERED_VALUE.exec(stmt))
+      add((m[1] ?? m[2] ?? m[3]).toLowerCase());
+    ENTERED_ENV.lastIndex = 0;
+    while (m = ENTERED_ENV.exec(stmt))
+      add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
-  return { values, navLines };
+  const consts = accountConsts.size > 0 ? `|(?<![\\w$.])(?:${[...accountConsts].join("|")})(?![\\w$])` : "";
+  return { values, navLines, account: new RegExp(`${ACCOUNT_ENV}${consts}`) };
 }
-function isEnteredValueEcho(stmt, entered, startLine) {
+function countBelow(lines, line) {
+  let lo = 0;
+  let hi = lines.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lines[mid] < line)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function enteredLinesOf(stmt, entered) {
   const m = stmt.match(/\.toHaveValue\s*\(\s*(['"`])((?:(?!\1).)+)\1/);
-  if (!m)
+  if (m)
+    return entered.values.get(m[2].toLowerCase());
+  const env = stmt.match(HAVE_VALUE_ENV);
+  return env ? entered.values.get(envValueKey(env[1] ?? env[2])) : void 0;
+}
+function typedSinceLastNav(stmt, entered, startLine, lines = enteredLinesOf(stmt, entered)) {
+  if (!lines || startLine === void 0)
+    return false;
+  const before = countBelow(lines, startLine);
+  if (before === 0)
     return false;
-  const enteredAt = entered.values.get(m[2].toLowerCase());
-  if (enteredAt === void 0)
+  return countBelow(entered.navLines, startLine) === countBelow(entered.navLines, lines[before - 1] + 1);
+}
+function isEnteredValueEcho(stmt, entered, startLine) {
+  const lines = enteredLinesOf(stmt, entered);
+  if (!lines)
     return false;
-  if (startLine === void 0)
+  if (startLine === void 0 || lines[0] >= startLine)
     return true;
-  return !entered.navLines.some((n) => n > enteredAt && n < startLine);
+  return typedSinceLastNav(stmt, entered, startLine, lines);
 }
 function isAnyValueMatcher(stmt) {
   if (/\.not\.toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/.test(stmt))
@@ -5445,6 +5862,49 @@ function hasAttributeTransition(stmts) {
       return true;
   return false;
 }
+function comparesWithItself(subject, tail) {
+  const m = SELF_COMPARE_MATCHER.exec(tail);
+  if (!m)
+    return false;
+  const args = balancedArguments(tail, m[0].length, MATCHER_ARGS_MAX);
+  if (args === null)
+    return false;
+  const squash2 = (x) => x.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  const expected = squash2(args);
+  return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
+}
+function asPlainAssertion(s) {
+  return plainAssertion(s, false);
+}
+function plainAssertion(s, keepSelfCompare) {
+  const { stmt } = s;
+  if (COUNT_AT_LEAST_ZERO.test(stmt))
+    return [];
+  const subject = extractExpectSubject(stmt);
+  if (subject === null)
+    return [s];
+  const plain = subject.replace(/^await\s+/, "").trim();
+  const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
+  const tail = (stmt.startsWith("expect.poll", stmt.search(EXPECT_CALL_RE)) ? expectCallTail(stmt) : null) ?? stmt.slice(subjectAt + subject.length).trimStart();
+  const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
+    return [];
+  if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
+    return [];
+  if (!keepSelfCompare && comparesWithItself(plain, tail))
+    return [];
+  const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
+  if (visible && IS_VISIBLE_TRUE.test(tail))
+    return as(`await expect(${visible[1]}).toBeVisible();`);
+  if (/^page\s*\.\s*(?:url|title)\s*\(\s*\)$/.test(plain) && PAGE_VALUE_MATCHER.test(tail)) {
+    const matcher = plain.includes("url") ? "toHaveURL" : "toHaveTitle";
+    return as(`await expect(page)${tail.replace(/^\)\s*\.\s*\w+\s*\(/, `.${matcher}(`)}`);
+  }
+  return [s];
+}
+function assertionStrengthHoistedReadsOn(value = typeof process !== "undefined" ? process.env?.ASSERTION_STRENGTH_HOISTED_READS : void 0) {
+  return /^(1|true|on)$/i.test((value ?? "").trim());
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -5477,6 +5937,22 @@ function successNoticeQuote(stmt) {
   }
   return null;
 }
+function namedPagePath(arg) {
+  const text = arg.trim();
+  let path;
+  const quoted = /^(['"`])([^'"`]*)\1$/.exec(text);
+  const regex = quoted ? null : /^\/((?:\\.|[^/\\])+)\/[a-z]*$/.exec(text);
+  if (quoted) {
+    path = quoted[2].replace(/^\$\{[^}]*\}/, "").replace(/^\*\*/, "").replace(/^[a-z][a-z\d+.-]*:\/\/[^/]*/i, "").replace(/\*\*$/, "");
+  } else if (regex) {
+    path = regex[1].replace(/^\^/, "").replace(/^\.\*/, "").replace(/\$$/, "").replace(/\\([/.-])/g, "$1");
+  } else {
+    return null;
+  }
+  if (!PLAIN_PAGE_PATH.test(path))
+    return null;
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function provesStoredControlValue(stmt, startLine, persistence) {
   if (!persistence || startLine === void 0)
     return false;
@@ -5503,7 +5979,64 @@ function reopenedAfterSave(startLine, persistence, reopens = persistence.reloadL
   }
   return lo < reopens.length && reopens[lo] < startLine;
 }
-function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence) {
+function actsBetween(withLines, from, to) {
+  let acts = actLinesOf.get(withLines);
+  if (acts === void 0) {
+    acts = withLines.filter((s) => ACTS.test(s.stmt)).map((s) => s.startLine).sort((a, b) => a - b);
+    actLinesOf.set(withLines, acts);
+  }
+  let lo = 0;
+  let hi = acts.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (acts[mid] <= from)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo < acts.length && acts[lo] < to;
+}
+function signInProofWindow(stmts, withLines, lines, blockIds) {
+  if (blockIds === null)
+    return void 0;
+  const testBodies2 = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const id = blockIds[i];
+    if (id > 0 && (i === 0 || blockIds[i - 1] !== id) && TEST_BODY_OPEN.test(stripLineComment2(lines[i]).trim()))
+      testBodies2.add(id);
+  }
+  const blockOf = (i) => blockIds[withLines[i].startLine - 1];
+  const passwordAt = stmts.findIndex((stmt, i) => testBodies2.has(blockOf(i)) && ENV_PASSWORD_ENTRY.test(stmt));
+  if (passwordAt < 0)
+    return void 0;
+  const body = blockOf(passwordAt);
+  let clickAt = passwordAt + 1;
+  while (clickAt < stmts.length && FORM_INPUT.test(stmts[clickAt]) && !ANY_CLICK.test(stmts[clickAt]))
+    clickAt++;
+  if (clickAt >= stmts.length || blockOf(clickAt) !== body || !ANY_CLICK.test(stmts[clickAt]) || NAV_LOCATOR.test(stmts[clickAt]))
+    return void 0;
+  let end = clickAt + 1;
+  for (; end < stmts.length && blockOf(end) === body; end++) {
+    if (CLOSERS_ONLY.test(stmts[end]))
+      continue;
+    if (!ASSERT_OR_WAIT.test(stmts[end]) || ACTS.test(stmts[end]))
+      return void 0;
+  }
+  return { after: withLines[clickAt].startLine, until: end < stmts.length ? withLines[end].startLine : Number.POSITIVE_INFINITY };
+}
+function isAccountControlCheck(stmt) {
+  if (!VISIBILITY_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt) || OPTION_ABSENCE.test(stmt))
+    return false;
+  const role = ACCOUNT_CONTROL_ROLE.exec(stmt);
+  if (!role)
+    return false;
+  const rest = stmt.slice(role.index + role[0].length, role.index + role[0].length + 300);
+  const close = rest.indexOf("}");
+  const options = close < 0 ? rest : rest.slice(0, close);
+  const name = options.match(/(?:^|[\s,])name\s*:\s*/);
+  return name !== null && ACCOUNT_EMAIL_ENV.test(options.slice(name.index + name[0].length));
+}
+function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence, signedIn) {
   if (mutated && hasAttributeTransition(stmts))
     return { kind: "durable" };
   const notices = [];
@@ -5513,11 +6046,25 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
   };
   let presenceText;
   const presence = () => presenceText ??= stmts.filter((o) => !ABSENCE_MATCHER.test(o.stmt) && !NEGATED_ASSERT.test(o.stmt)).map((o) => o.stmt).join("\n");
+  let shownAccounts;
+  const shown = () => {
+    if (shownAccounts)
+      return shownAccounts;
+    const ref = new RegExp(entered.account.source, "g");
+    return shownAccounts = new Set(stmts.filter((o) => !claimsAbsence(o.stmt)).flatMap((o) => Array.from(o.stmt.matchAll(ref), (m) => m[0])));
+  };
   for (const { stmt, startLine } of stmts) {
     if (firstMutLine !== void 0 && startLine !== void 0 && startLine < firstMutLine)
       continue;
     if (isVacuousErrorAbsence(stmt, presence))
       continue;
+    if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
+      continue;
+    if (isVacuousAccountAbsence(stmt, shown, entered.account))
+      continue;
+    if (signedIn && startLine !== void 0 && startLine > signedIn.after && startLine < signedIn.until && isAccountControlCheck(stmt)) {
+      return { kind: "durable" };
+    }
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -5527,12 +6074,15 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       else
         return { kind: "durable" };
     }
-    if (STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
+    const retyped = typedSinceLastNav(stmt, entered, startLine);
+    if (!retyped && STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
       return { kind: "durable" };
-    if (provesStoredControlValue(stmt, startLine, persistence))
+    if (!retyped && provesStoredControlValue(stmt, startLine, persistence))
       return { kind: "durable" };
     if (countsAsContentText(stmt))
       return { kind: "durable" };
+    if (provesTextRemoved(stmt, presence))
+      return { kind: "durable" };
     if (mutated && VISIBILITY_MATCHER.test(stmt)) {
       const revealsText = GET_BY_TEXT.test(stmt) || HAS_TEXT_FILTER.test(stmt) || CONTENT_ROLE.test(stmt);
       if (revealsText && !isChromeTarget(stmt)) {
@@ -5596,10 +6146,57 @@ function noticeOnlyExemption(clicked, noticeText, interactionStmts) {
 function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine) {
   return classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine).kind !== "none";
 }
+function clickLabel(stmt) {
+  let label = null;
+  for (const m of stmt.matchAll(CONTROL_LABEL))
+    label = m[2] ?? m[3] ?? null;
+  return label;
+}
+function teardownLines(lines) {
+  const out = new Array(lines.length).fill(false);
+  let open = false;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const ln = stripLineComment2(lines[i]).trim();
+    let from = 0;
+    if (!open) {
+      const m = TEARDOWN_OPEN.exec(ln);
+      if (!m)
+        continue;
+      open = true;
+      depth = 0;
+      from = m.index;
+    }
+    out[i] = true;
+    let closed = false;
+    let quote = null;
+    for (let k = from; k < ln.length; k++) {
+      const ch = ln[k];
+      if (quote !== null) {
+        if (ch === "\\")
+          k++;
+        else if (ch === quote)
+          quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`")
+        quote = ch;
+      else if (ch === "{")
+        depth++;
+      else if (ch === "}") {
+        depth--;
+        closed = true;
+      }
+    }
+    if (depth <= 0 && closed)
+      open = false;
+  }
+  return out;
+}
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
-  const stmts = liveExpectStatements(stripCoverageComments(body));
+  const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
   const base = (extra) => ({
     apiTest: false,
     interacted: false,
@@ -5639,7 +6236,13 @@ function validateAssertionStrength(code, opts = {}) {
   const interactionStmts = inlineLocatorBindings(interactionStmtsRaw);
   const blockIds = testBlockIds(lines);
   const blockOfLine = (line) => blockIds?.[line - 1] ?? 0;
-  const checks = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine);
+  const hoistedReads = assertionStrengthHoistedReadsOn();
+  const boundAt = hoistedReads ? /* @__PURE__ */ new Map() : void 0;
+  const resolved = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine, boundAt);
+  const checks = boundAt === void 0 ? resolved : resolved.flatMap((s) => {
+    const from = boundAt.get(s);
+    return plainAssertion(s, from !== void 0 && actsBetween(interactionStmtsWithLines, from, s.startLine));
+  });
   const insideTest = linesInsideTestBlocks(lines);
   const inTestOrder = (i) => insideTest === null || insideTest[interactionStmtsWithLines[i].startLine - 1] === true;
   let mutated = opts.interactionPerformed === true;
@@ -5649,9 +6252,34 @@ function validateAssertionStrength(code, opts = {}) {
   let navClicks = 0;
   const persistence = { mutLines: [], reloadLines: [], reloadCalls: [] };
   const openedPages = /* @__PURE__ */ new Set();
+  let checkedPage = null;
+  const savedOnCheckedPage = /* @__PURE__ */ new Set();
+  const saveAt = (i, at) => {
+    lastMutIdx = i;
+    if (!inTestOrder(i))
+      return;
+    persistence.mutLines.push(at);
+    if (firstMutIdx < 0)
+      firstMutIdx = i;
+    if (checkedPage !== null)
+      savedOnCheckedPage.add(checkedPage);
+  };
+  const lastActionProof = opts.lastActionProof ?? "off";
+  const teardown = lastActionProof === "off" ? null : teardownLines(lines);
+  const acts = { last: null, prev: null, count: 0 };
+  const noteAct = (i, at, kind) => {
+    if (teardown === null || teardown[at - 1] || !inTestOrder(i))
+      return;
+    if (kind !== "enter")
+      acts.count++;
+    acts.prev = acts.last;
+    acts.last = { i, kind };
+  };
   for (let i = 0; i < interactionStmts.length; i++) {
     const ln = interactionStmts[i];
     const at = interactionStmtsWithLines[i].startLine;
+    if (teardown !== null && acts.last?.kind === "fill" && ENTER_PRESS.test(ln))
+      noteAct(i, at, "enter");
     if (RELOAD.test(ln)) {
       persistence.reloadLines.push(at);
       persistence.reloadCalls.push(at);
@@ -5659,32 +6287,31 @@ function validateAssertionStrength(code, opts = {}) {
     const opened = ln.match(/\.goto\s*\(\s*([^,)]+)/);
     if (opened) {
       const page = opened[1].trim();
-      if (openedPages.has(page))
+      const path = namedPagePath(page);
+      if (openedPages.has(page) || path !== null && savedOnCheckedPage.has(path))
         persistence.reloadLines.push(at);
-      else
-        openedPages.add(page);
-    }
+      openedPages.add(page);
+      checkedPage = null;
+    }
+    if (/\bpage\s*\.\s*go(?:Back|Forward)\s*\(/.test(ln))
+      checkedPage = null;
+    const checked = URL_CHECK_ARG.exec(ln);
+    if (checked)
+      checkedPage = namedPagePath(checked[1] ?? checked[2]);
     if (FORM_INPUT.test(ln)) {
       mutated = true;
-      lastMutIdx = i;
-      if (inTestOrder(i)) {
-        persistence.mutLines.push(at);
-        if (firstMutIdx < 0)
-          firstMutIdx = i;
-      }
+      saveAt(i, at);
+      noteAct(i, at, "fill");
       continue;
     }
     if (ANY_CLICK.test(ln)) {
       if (NAV_LOCATOR.test(ln)) {
         navClicks++;
+        checkedPage = null;
       } else {
         mutated = true;
-        lastMutIdx = i;
-        if (inTestOrder(i)) {
-          persistence.mutLines.push(at);
-          if (firstMutIdx < 0)
-            firstMutIdx = i;
-        }
+        saveAt(i, at);
+        noteAct(i, at, "click");
       }
     }
   }
@@ -5717,9 +6344,28 @@ function validateAssertionStrength(code, opts = {}) {
     };
   }
   const orderedPersistence = firstMutLine !== void 0 ? persistence : void 0;
-  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence);
+  const signedIn = signInProofWindow(interactionStmts, interactionStmtsWithLines, lines, blockIds);
+  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn);
   if (proof.kind === "durable") {
     const signals2 = base({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal });
+    const { last, prev } = acts;
+    if (teardown !== null && last !== null && acts.count >= 2 && last.kind !== "fill" && (last.kind === "enter" || isCommitClick(interactionStmts[last.i]) && !(prev?.kind === "click" && isDestructiveClick(interactionStmts[prev.i])))) {
+      const lastLine = interactionStmtsWithLines[last.i].startLine;
+      const clicked = clickedControlNames(interactionStmts);
+      const after = classifyOutcomeProof(checks, mutated, reloaded, clicked, entered, lastLine, orderedPersistence, signedIn);
+      const unproven = after.kind === "none" || after.kind === "notice" && noticeOnlyExemption(clicked, after.noticeText, interactionStmts) === null;
+      if (unproven && lastActionProof === "on") {
+        const line = (keptScaffoldingLines(code.split("\n"))[lastLine - 1] ?? lastLine - 1) + 1;
+        return {
+          ok: false,
+          severity: "block",
+          reason: `the last save (line ${line}) has no outcome check after it (the earlier check proves only the earlier action)`,
+          signals: { ...signals2, lastActionUnproven: true }
+        };
+      }
+      if (unproven)
+        signals2.lastActionUnproven = true;
+    }
     return { ok: true, severity: "none", reason: "proves an outcome (count / diff / value / revealed content)", signals: signals2 };
   }
   if (mutated && proof.kind === "notice") {
@@ -5768,7 +6414,7 @@ function validateAssertionStrength(code, opts = {}) {
         signals
       };
     }
-    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && URL_PROOF.test(s));
+    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && isUrlProof(s));
     if (urlProofAfter) {
       return {
         ok: false,
@@ -5805,7 +6451,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, IN_FLIGHT_TEXT, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -5814,6 +6460,7 @@ var init_assertion_strength = __esm({
     init_assertion_proof();
     init_auth_handoff_coverage();
     init_expect_call();
+    init_auth_plan();
     ERROR_BANNER = /(client-side exception|application error|something (?:went wrong|broke)|unhandled (?:exception|error|rejection)|runtime error|error boundary|an unexpected error|internal server error|\b5\d\d\s+(?:internal\s+)?server error|stack trace|chunkloaderror|hydration failed|maximum update depth exceeded)/i;
     OUTCOME_ALWAYS = [
       /\.toHaveCount\s*\(/,
@@ -5830,8 +6477,8 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /\.toBeDisabled\s*\(/,
-      // a control became DISABLED — a gating/validation outcome
+      /\.(?<!\.not\s*\.)\s*toBeDisabled\s*\(/,
+      // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
       // something the action removed/closed (disappearance proof)
@@ -5839,12 +6486,16 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    POLL_OPEN = /\bexpect\s*\.\s*poll\s*\(/g;
+    POLL_PAGE_URL = /^page\s*\.\s*url\s*\(\s*\)/;
+    POLL_PAGE_URL_ONLY = /^page\s*\.\s*url\s*\(\s*\)$/;
+    POLL_CALLS_MAX = 8;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     TEST_BLOCK_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow|serial|describe\.serial))?\s*\(|^(?:test\.)?(?:beforeEach|beforeAll)\s*\(/;
-    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
+    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=(?:\s*(?!\s)|\s*(?=\s(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\())(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
     EXPECT_OPEN = /\bexpect(?:\.soft)?\s*\(/;
     STATE_MATCHER = /\.(toBeChecked|toBeVisible|toHaveValue|toBeDisabled|toBeEnabled)\s*\(/;
     CHROME_LOCATOR = /getByRole\s*\(\s*['"`](?:heading|navigation|banner|main|contentinfo|complementary|region|search|tablist|tab|button|link|menuitem|textbox|searchbox|combobox|spinbutton)['"`]/i;
@@ -5864,16 +6515,17 @@ var init_assertion_strength = __esm({
     EMPTY_STATE_TEXT = /\bno\b[\s\S]{0,24}?\b(yet|found|results?|items?|favou?rites?|entries|records?|matches|posts?|comments?)\b|nothing (?:here|yet|to show|found)|\bempty\b|\(\s*0\s*\)|\b0\s+(?:favou?rites?|results?|items?|entries|records?|matches|posts?|comments?)\b/i;
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
-    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
+    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*(?:;\s*)?$/;
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
+    NEGATED_ASSERT_NOT = /\.not\s*\.\s*to[A-Z]/;
     CONST_CHAIN_MAX_DEPTH = 5;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
     FAILURE_STATUS_ASSERT = [
       /\.status\s*\(\s*\)[^;]{0,200}\.(?:toBeGreaterThanOrEqual|toBeGreaterThan)\s*\(\s*(?:399|[45]\d\d)\b/,
-      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\))?\s*>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
+      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\)\s*)?>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
       /\bexpect\s*\([^;]{0,200}\.ok\s*\(\s*\)\s*\)\s*\.\s*(?:toBe\s*\(\s*false\s*\)|toBeFalsy\s*\()/
     ];
     FAILED_LIST_ASSERT = /\bexpect\s*\(\s*[^;]{0,200}(?:fail|abort|error)\w{0,40}(?:\.length)?\s*\)\s*\.\s*(?:toBeGreaterThan\s*\(\s*0|toHaveLength\s*\(\s*[1-9]|not\s*\.\s*toHaveLength\s*\(\s*0|not\s*\.\s*toEqual\s*\(\s*\[\s*\])/i;
@@ -5883,8 +6535,15 @@ var init_assertion_strength = __esm({
     CATCH_ALL_PATTERN = /^(['"`])\*\*(?:\/\*)?\1$|^\/\.\*\/[a-z]*$/;
     GUARD_HANDLER = /\bMUTATING\.has\s*\(|blockedbyclient|Read-only guard/;
     ABSENCE_MATCHER = /\.not\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/;
+    VALUE_ABSENCE = /\.(?:count\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*0\s*\)|toBeLessThan\s*\(\s*1\s*\))|isVisible\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*false\s*\)|toBeFalsy\s*\()|isHidden\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*true\s*\)|toBeTruthy\s*\())/;
+    OPTION_ABSENCE = /\.(?:toBeVisible\s*\(\s*\{[^{}()]{0,200}\bvisible|toBeAttached\s*\(\s*\{[^{}()]{0,200}\battached)\s*:\s*false\b/;
+    NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    SCOPING_STEP = /(?:\s*\.\s*(?:first|last|nth)\s*\([^()]*\))*\s*\.\s*(?:getBy[A-Z]\w*|locator|filter)\s*\(/y;
+    NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
+    ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
+    REQUEST_WORD = /\brequest\b/;
     ROLE_NAME_RE = /getByRole\s*\(\s*['"`][a-z]+['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
     INTERACT_VERB = /\.(click|fill|check|uncheck|setChecked|selectOption|pressSequentially)\s*\(/;
     ROLE_SIG_RE = /getByRole\s*\(\s*['"`]([a-z]+)['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
@@ -5905,21 +6564,64 @@ var init_assertion_strength = __esm({
     MATCHER_OPEN = /\s*(?:\.\s*(?:not|resolves|rejects)\s*)*\.\s*[A-Za-z_$][\w$]*\s*\(/y;
     ENTERED_VALUE = /\.(?:fill|pressSequentially)\s*\(\s*['"`]([^'"`]+)['"`]|keyboard\.type\s*\(\s*['"`]([^'"`]+)['"`]|\.selectOption\s*\(\s*(?:\[\s*)?(?:\{\s*(?:label|value)\s*:\s*)?['"`]([^'"`]+)['"`]/g;
     PAGE_NAV = /\.(?:goto|reload)\s*\(/;
+    ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
+    ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
+    HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
+    ACCOUNT_KEYS = TEST_USER_ENV_KEYS.join("|");
+    ACCOUNT_ENV = `process\\.env(?:\\??\\.(?:${ACCOUNT_KEYS})\\b|(?:\\?\\.)?\\[\\s*['"\`](?:${ACCOUNT_KEYS})['"\`]\\s*\\])`;
+    ACCOUNT_CONST = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*(?::\\s*string\\s*)?=\\s*${ACCOUNT_ENV}`, "g");
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
+    LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
+    LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
+    ALWAYS_TRUE_ON_OBJECT = /^\)\s*\.\s*(?:toBeTruthy|toBeDefined|not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy))\s*\(/;
+    COUNT_AT_LEAST_ZERO = /\.(?:count\s*\(\s*\)|length)[\s)]{0,10}\.(?:toBeGreaterThanOrEqual\s*\(\s*0\s*\)|toBeGreaterThan\s*\(\s*-\s*1\s*\))/;
+    DEFINED_VALUE_READ = /\.\s*(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|title|url|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts)\s*\([^()]*\)$/;
+    ALWAYS_DEFINED = /^\)\s*\.\s*(?:toBeDefined|not\s*\.\s*toBeUndefined)\s*\(/;
+    SELF_COMPARE_MATCHER = /^\)\s*\.\s*(toBe|toEqual|toStrictEqual|toHaveCount)\s*\(/;
+    IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
+    PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
+    URL_CHECK_ARG = /\bpage\s*\.\s*waitForURL\s*\(\s*([^,)]+)|\bexpect(?:\s*\.\s*soft)?\s*\(\s*page\s*\)\s*\.\s*toHaveURL\s*\(\s*([^,)]+)/;
+    PLAIN_PAGE_PATH = /^\/[\w\-./~%]*(?:[?#][^\s]*)?$/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
+    ACCOUNT_EMAIL_ENV = /^process\.env(?:(?:\?\.|\.)TEST_USER_EMAIL\b|(?:\?\.)?\[\s*['"]TEST_USER_EMAIL['"]\s*\])/;
+    ENV_PASSWORD_ENTRY = /\.(?:fill|pressSequentially)\s*\(\s*process\.env(?:(?:\?\.|\.)TEST_USER_PASSWORD\b|(?:\?\.)?\[\s*['"]TEST_USER_PASSWORD['"]\s*\])/;
+    ACCOUNT_CONTROL_ROLE = /getByRole\s*\(\s*['"`](?:button|link|menuitem)['"`]\s*,\s*\{/;
+    ASSERT_OR_WAIT = /^(?:await\s+)?(?:expect(?:\.soft|\.poll)?\s*\(|[\w$]+(?:\.[\w$]+)*\.waitFor[A-Za-z]*\s*\()/;
+    ACTS = /\.(?:click|dblclick|tap|press|pressSequentially|fill|clear|type|check|uncheck|setChecked|selectOption|setInputFiles|dispatchEvent|hover|focus|dragTo|goto|reload|goBack|goForward|evaluate|evaluateHandle)\s*\(|\b(?:keyboard|mouse|touchscreen)\s*\.|\.toPass\s*\(/;
+    actLinesOf = /* @__PURE__ */ new WeakMap();
+    CLOSERS_ONLY = /^[})\];,\s]+$/;
+    TEST_BODY_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow))?\s*\(/;
     COPY_CONTROL = /\bcopy\b/i;
     COPIED_NOTICE = /\bcopied\b/i;
     SEND_CONTROL = /\b(send|submit|subscribe|sign up for|contact|feedback|join (the )?waitlist)\b/i;
     SEND_NOTICE = /\b(thank|thanks|sent|subscribed|received|in touch)\b/i;
     MARK_READ_CONTROL = /\bmark(?:ed)? as read\b|\bmark all(?: as)? read\b/i;
     APP_DATA_FIELD = /\b(title|name of|amount|price|quantity|sku|status|due|assignee|project|ticket|invoice|order)\b/i;
+    COMMIT_CONTROL = /\b(?:save|submit|update|apply|add|create|post|send|publish)\b|\bconfirm\s+changes\b/i;
+    NOT_COMMIT_CONTROL = /\b(?:delete|remove|cancel|close|dismiss|discard|back|sign\s*out|log\s*out|logout|done|ok|got\s+it|export|download)\b/i;
+    DESTRUCTIVE_CONTROL = /\b(?:delete|remove|discard)\b/i;
+    ENTER_PRESS = /\.press\s*\(\s*['"`]Enter['"`]/;
+    CONTROL_LABEL = /(?:name\s*:\s*|getBy(?:Text|Label|Title|TestId)\s*\(\s*|has-text\(\s*)(?:(['"`])((?:(?!\1).)*)\1|\/((?:\\.|[^/\\])+)\/)/g;
+    isCommitClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && COMMIT_CONTROL.test(label) && !NOT_COMMIT_CONTROL.test(label) && !EXCLUDE_AFFORDANCE.test(label);
+    };
+    isDestructiveClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && DESTRUCTIVE_CONTROL.test(label);
+    };
+    TEARDOWN_OPEN = /\bfinally\s*\{|^(?:test\.)?(?:after|before)(?:Each|All)\s*\(/;
   }
 });
 
 // ../shared/dist/run-classification.js
-function isUserCancelledError(error) {
-  return typeof error === "string" && error.trim().startsWith(USER_CANCELLED_RUN_ERROR);
+function isCancelledReason(error) {
+  if (typeof error !== "string")
+    return false;
+  const text = error.trim();
+  return CANCELLED_REASON_PREFIXES.some((prefix) => text.startsWith(prefix));
 }
 function isHeldHealRun(run) {
   return run?.status === "PASSED" && typeof run.error === "string" && run.error.startsWith(HEAL_PATCH_HELD_RUN_ERROR_PREFIX);
@@ -5952,7 +6654,7 @@ function pickLatestHealthRun(runs) {
   for (const run of runs) {
     if (run.mode === "auth-setup")
       continue;
-    if (run.status === "ERROR" && isUserCancelledError(run.error))
+    if (run.status === "ERROR" && isCancelledReason(run.error))
       continue;
     if (isHeldHealRun(run))
       continue;
@@ -5970,6 +6672,15 @@ function pickDisplayRun(runs) {
     return latest;
   return pickLatestHealthRun(runs) ?? latest;
 }
+function featureRowRunStatus(runs) {
+  const latest = runs.find((run) => run.mode !== "auth-setup");
+  if (!latest)
+    return null;
+  const decisive = pickLatestHealthRun(runs.filter((run) => !isEnvironmentalError(run)));
+  if (decisive)
+    return decisive.status;
+  return latest.status === "PENDING" || latest.status === "RUNNING" ? latest.status : null;
+}
 function isEnvironmentalError(run) {
   if (!run)
     return false;
@@ -6001,7 +6712,7 @@ function classifyErrorMessage(error) {
     return "config_issue";
   if (EMAIL_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
     return "email_not_received";
-  if (isUserCancelledError(error))
+  if (isCancelledReason(error))
     return "cancelled";
   if (isRetriedRunInterruption(error))
     return "interrupted";
@@ -6036,7 +6747,7 @@ function heldHealRunWhere() {
 function excludeCancelledRunsWhere() {
   return {
     NOT: [
-      { status: "ERROR", error: { not: null, startsWith: USER_CANCELLED_RUN_ERROR } },
+      { status: "ERROR", OR: CANCELLED_REASON_PREFIXES.map((prefix) => ({ error: { not: null, startsWith: prefix } })) },
       heldHealRunWhere()
     ]
   };
@@ -6114,11 +6825,25 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
     USER_CANCELLED_RUN_ERROR = "Cancelled by user";
+    PLATFORM_SUPPORT_CANCELLED_RUN_ERROR = "Cancelled by platform support";
+    PLATFORM_ADMIN_CANCELLED_RUN_ERROR = "Cancelled by platform admin";
+    ADMIN_FORCE_CANCELLED_RUN_ERROR = "Admin force-cancelled all active runs";
+    CHAIN_CANCELLED_RUN_ERROR = "Cancelled: parent run cancelled";
+    RETRY_HELD_RUN_ERROR = "Cancelled: auto generation paused";
+    CANCELLED_REASON_PREFIXES = [
+      USER_CANCELLED_RUN_ERROR,
+      PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
+      PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
+      ADMIN_FORCE_CANCELLED_RUN_ERROR,
+      CHAIN_CANCELLED_RUN_ERROR,
+      RETRY_HELD_RUN_ERROR
+    ];
+    isUserCancelledError = isCancelledReason;
     HEAL_PATCH_HELD_RUN_ERROR_PREFIX = "Heal patch held";
     RUNNER_INTERRUPT_ERROR_PREFIX = "Runner shutting down";
     SERVER_INTERRUPT_ERROR_PREFIX = "Run interrupted by server restart";
@@ -6134,6 +6859,7 @@ var init_run_classification = __esm({
     UNEXPECTED_PASS_ERROR_PREFIX = "UNEXPECTED_PASS:";
     BUG_TEST_BROKEN_ERROR_PREFIX = "BUG_TEST_BROKEN:";
     BUG_TEST_BROKEN_REASON = "bug test broken (not a bug verdict)";
+    TEST_DID_NOT_RUN_ERROR = "Test did not run (a dependency failed or the run was interrupted)";
     EMAIL_NOT_RECEIVED_PREFIXES = [
       "VERIFICATION_EMAIL_NOT_RECEIVED:",
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
@@ -6146,9 +6872,10 @@ var init_run_classification = __esm({
     ];
     ENVIRONMENTAL_ERROR_STORED_PREFIXES = [
       ...ENVIRONMENTAL_ERROR_PREFIXES.flatMap((prefix) => [prefix, `Error: ${prefix}`]),
-      // Written by the cancel routes as is, with no prefix wrapper.
-      USER_CANCELLED_RUN_ERROR
+      // Written by the cancels as is, with no prefix wrapper.
+      ...CANCELLED_REASON_PREFIXES
     ];
+    FEATURE_ROW_RUN_WINDOW = 10;
     BUG_SURFACE_SUPPRESSING_TAGS = ["@rate-limit-blocked", "@quota-exceeded", "@auth-lost"];
     QUARANTINE_CLOSE_TAGS = [
       "@bug-found",
@@ -8581,180 +9308,6 @@ var init_admin_view_return_to = __esm({
   }
 });
 
-// ../shared/dist/auth-plan.js
-function hasInlineLoginSteps(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
-}
-function hasGeneratedAuthGuard(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
-}
-function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
-  if (!sharedAuthInjectEnabled)
-    return false;
-  if (tags.includes("@auth"))
-    return false;
-  if (tags.includes("@api"))
-    return true;
-  if (!tags.includes("@needs-auth"))
-    return false;
-  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
-    return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
-  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
-}
-function codeReadsStoredCredentials(code) {
-  if (!code)
-    return false;
-  if (/__vqaLogin\b/.test(code))
-    return true;
-  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
-    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
-      return true;
-  }
-  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
-    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
-      return true;
-  }
-  return false;
-}
-function explicitAuthTypeTags(t) {
-  const found = /* @__PURE__ */ new Set();
-  for (const tag of t) {
-    if (AUTH_TYPE_TAGS.includes(tag))
-      found.add(tag);
-    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
-      found.add(AUTH_TAG_ALIASES[tag]);
-  }
-  return [...found];
-}
-function invalidPlan(configurationError) {
-  return {
-    version: 1,
-    source: "invalid",
-    acquisition: "unsupported",
-    presentation: "none",
-    needsCookieState: false,
-    needsStandingHeaders: false,
-    standingHeadersMode: "none",
-    needsLoginCreds: false,
-    requiredEnvKeys: [],
-    configurationError
-  };
-}
-function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
-  return {
-    version: 1,
-    source: "explicit",
-    authTypeTag: authTypeTag2,
-    acquisition,
-    presentation,
-    needsCookieState: opts.cookie,
-    needsStandingHeaders: opts.standingMode === "required",
-    standingHeadersMode: opts.standingMode,
-    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
-    requiredEnvKeys: opts.requiredEnvKeys
-  };
-}
-function deriveAuthPlan(tags, code, opts) {
-  const t = Array.isArray(tags) ? tags : [];
-  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
-  const isApi = t.includes("@api");
-  const explicit = isApi ? explicitAuthTypeTags(t) : [];
-  if (explicit.length > 0) {
-    if (t.includes("@auth")) {
-      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
-    }
-    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
-    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
-      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
-      switch (loginCompose[0]) {
-        case AUTH_TAG_COOKIE_STATE:
-          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_COOKIE:
-          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_BEARER:
-          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-      }
-    }
-    if (explicit.length > 1) {
-      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
-    }
-    switch (explicit[0]) {
-      case AUTH_TAG_UNSUPPORTED:
-        return {
-          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
-        };
-      case AUTH_TAG_NONE:
-        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
-      case AUTH_TAG_STANDING:
-        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
-      case AUTH_TAG_LOGIN_BEARER:
-        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_LOGIN_COOKIE:
-        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_COOKIE_STATE:
-        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-    }
-  }
-  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
-  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
-  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
-  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
-  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
-  return {
-    version: 1,
-    source: "legacy",
-    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
-    presentation: authedLegacy ? "cookie" : "none",
-    needsCookieState: cookie,
-    needsStandingHeaders: false,
-    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
-    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
-    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
-    needsLoginCreds,
-    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
-  };
-}
-function authTypeTag(tags) {
-  const t = Array.isArray(tags) ? tags : [];
-  const explicit = explicitAuthTypeTags(t);
-  return explicit.length === 1 ? explicit[0] : void 0;
-}
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
-var init_auth_plan = __esm({
-  "../shared/dist/auth-plan.js"() {
-    "use strict";
-    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
-    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
-    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
-    AUTH_TAG_STANDING = "@auth-standing";
-    AUTH_TAG_NONE = "@auth-none";
-    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
-    AUTH_TYPE_TAGS = [
-      AUTH_TAG_COOKIE_STATE,
-      AUTH_TAG_LOGIN_COOKIE,
-      AUTH_TAG_LOGIN_BEARER,
-      AUTH_TAG_STANDING,
-      AUTH_TAG_NONE,
-      AUTH_TAG_UNSUPPORTED
-    ];
-    AUTH_TAG_ALIASES = {
-      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
-      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
-      "@auth-token": AUTH_TAG_LOGIN_BEARER,
-      "@auth-api-key": AUTH_TAG_STANDING,
-      "@auth-standing-header": AUTH_TAG_STANDING
-    };
-    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
-    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
-  }
-});
-
 // ../shared/dist/auth-block-detector.js
 function stripEchoLines(text) {
   return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
@@ -8762,13 +9315,16 @@ function stripEchoLines(text) {
 function matchesAny(text, patterns) {
   return patterns.some((p) => p.test(text));
 }
+function isIntentionalNegativeAuthTest(input) {
+  const meta = [input.testName, input.description].filter(Boolean).join(" ");
+  return matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH);
+}
 function detectAuthBlock(input) {
   const tags = input.tags ?? [];
   const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
   if (!isAuthed)
     return NO_DETECTION;
-  const meta = [input.testName, input.description].filter(Boolean).join(" ");
-  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
+  if (isIntentionalNegativeAuthTest(input))
     return NO_DETECTION;
   const sources = [];
   if (input.error)
@@ -8871,7 +9427,24 @@ var init_auth_block_detector = __esm({
       /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
     ];
     ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
-    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*(?::\s*)?(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+  }
+});
+
+// ../shared/dist/auth-session-stamp.js
+function parseAuthSessionStamp(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const { shared, role, generation } = value;
+  if (shared !== true || role !== "producer" && role !== "follower")
+    return null;
+  return typeof generation === "string" && AUTH_SESSION_GENERATION_RE.test(generation) ? { shared: true, role, generation } : { shared: true, role };
+}
+var AUTH_SESSION_GENERATION_RE;
+var init_auth_session_stamp = __esm({
+  "../shared/dist/auth-session-stamp.js"() {
+    "use strict";
+    AUTH_SESSION_GENERATION_RE = /^[0-9a-z]{1,16}$/;
   }
 });
 
@@ -9795,12 +10368,70 @@ function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
 function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
   return value?.trim().toLowerCase() !== "false";
 }
+function visualBaselinesEnabled(projectId, raw = process.env.VISUAL_BASELINES_PROJECTS) {
+  if (typeof projectId !== "string" || projectId.trim() === "")
+    return false;
+  const listed = (raw ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return listed.includes("*") || listed.includes(projectId);
+}
 var init_feature_flags = __esm({
   "../shared/dist/feature-flags.js"() {
     "use strict";
   }
 });
 
+// ../shared/dist/visual-compare-limits.js
+function isSafeMaskSelector(selector) {
+  if (typeof selector !== "string")
+    return false;
+  if (selector.trim().length === 0)
+    return false;
+  if (selector.length > VISUAL_MASK_SELECTOR_MAX_LENGTH)
+    return false;
+  return !VISUAL_MASK_SELECTOR_FORBIDDEN.test(selector);
+}
+var VISUAL_MASK_SELECTORS_MAX, VISUAL_MASK_SELECTOR_MAX_LENGTH, VISUAL_MASK_SELECTOR_FORBIDDEN;
+var init_visual_compare_limits = __esm({
+  "../shared/dist/visual-compare-limits.js"() {
+    "use strict";
+    VISUAL_MASK_SELECTORS_MAX = 50;
+    VISUAL_MASK_SELECTOR_MAX_LENGTH = 300;
+    VISUAL_MASK_SELECTOR_FORBIDDEN = /[{};@<\r\n]/;
+  }
+});
+
+// ../shared/dist/visual-baseline-identity.js
+function isBrowserVersion(value) {
+  return typeof value === "string" && value.length <= 32 && BROWSER_VERSION.test(value);
+}
+function renderIdentity(flavour, version, image) {
+  if (!/^[a-z][a-z-]{0,31}$/.test(flavour) || !/^[a-z][a-z-]{0,31}$/.test(image) || !isBrowserVersion(version))
+    return null;
+  const identity = `${flavour}/${version}/${image}`;
+  return identity.length <= RENDER_IDENTITY_MAX_LENGTH ? identity : null;
+}
+function v1RenderIdentity(version) {
+  return renderIdentity(VISUAL_V1_IDENTITY.flavour, version, VISUAL_V1_IDENTITY.image);
+}
+function parseRenderIdentity(value) {
+  if (typeof value !== "string" || value.length > RENDER_IDENTITY_MAX_LENGTH)
+    return null;
+  const parts = value.split("/");
+  if (parts.length !== 3)
+    return null;
+  const [flavour, version, image] = parts;
+  return renderIdentity(flavour, version, image) === value ? { flavour, version, image } : null;
+}
+var VISUAL_V1_IDENTITY, RENDER_IDENTITY_MAX_LENGTH, BROWSER_VERSION;
+var init_visual_baseline_identity = __esm({
+  "../shared/dist/visual-baseline-identity.js"() {
+    "use strict";
+    VISUAL_V1_IDENTITY = { platform: "linux", image: "runner-fast", flavour: "headless-shell" };
+    RENDER_IDENTITY_MAX_LENGTH = 64;
+    BROWSER_VERSION = /^\d{1,4}(\.\d{1,6}){0,3}$/;
+  }
+});
+
 // ../shared/dist/analytics-url.js
 function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
@@ -10103,7 +10734,7 @@ var init_agentic_cli_runtime = __esm({
     GROK_CLI_DEFAULT_MODEL = "grok-4.7";
     GROK_CLI_DEFAULT_REASONING_EFFORT = "high";
     CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-    CLAUDE_CLI_DEFAULT_EFFORT = "max";
+    CLAUDE_CLI_DEFAULT_EFFORT = "high";
     MUSE_CLI_DEFAULT_MODEL = "muse-spark-1.3-contributor";
     MUSE_CLI_DEFAULT_EFFORT = "high";
     CODEX_CLI_DEFAULT_MODEL = "gpt-6.1-sol";
@@ -10158,6 +10789,17 @@ function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
   return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
 }
+function isZaiModelId(id) {
+  const trimmed = id?.trim() ?? "";
+  return ZAI_MODEL_PATTERN.test(trimmed) && !trimmed.includes("..");
+}
+function hasZaiPrefix(id) {
+  return (id?.trim() ?? "").startsWith(ZAI_PREFIX);
+}
+function zaiWireModel(id) {
+  const trimmed = id?.trim() ?? "";
+  return isZaiModelId(trimmed) ? trimmed.slice(ZAI_PREFIX.length) : null;
+}
 function isEngineId(value) {
   return CLI_ENGINE_MODEL_IDS.includes(value);
 }
@@ -10254,7 +10896,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10314,6 +10956,8 @@ var init_engine_spec = __esm({
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
     OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
+    ZAI_PREFIX = "zai:";
+    ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
 });
 
@@ -10598,6 +11242,8 @@ var init_api_model_catalog = __esm({
       authCaptureModel: "Login capture",
       plannerModel: "Scenario Planner",
       plannerGateModel: "Planner Gate",
+      pwAgentsHealerModel: "Test Healer (Playwright agents)",
+      pwAgentsReviewModel: "Plan Review (Playwright agents)",
       generationModel: "Code Generation",
       reviewModel: "Code Review",
       apiTestModel: "API Test Generator",
@@ -10622,11 +11268,6 @@ var init_api_model_catalog = __esm({
 });
 
 // ../shared/dist/provider-chains.js
-function isClaudeModel(id) {
-  if (/claude|anthropic/i.test(id))
-    return true;
-  return API_MODEL_CATALOG.some((m) => m.provider === "anthropic" && (m.id === id || m.apiModel === id));
-}
 function chainKey(modelId) {
   const id = canonicalModelId(modelId);
   if (!id)
@@ -10634,35 +11275,334 @@ function chainKey(modelId) {
   const entry = API_MODEL_CATALOG.find((m) => m.id === id || m.apiModel === id);
   return entry?.id ?? id;
 }
+function has(map, key) {
+  return Object.prototype.hasOwnProperty.call(map, key);
+}
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
-  if (!key || isClaudeModel(key))
+  if (key && has(_overrideHops, key))
+    return _overrideHops[key];
+  return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+}
+function providerChainLeadsFor(modelId) {
+  const key = chainKey(modelId);
+  if (key && has(_overrideLeads, key))
+    return _overrideLeads[key];
+  return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
+}
+function allChains() {
+  const ordered = (map, override) => [...Object.entries(map).filter(([key]) => !has(override, key)), ...Object.entries(override)];
+  return [...ordered(PROVIDER_CHAINS, _overrideHops), ...ordered(PROVIDER_CHAIN_LEADS, _overrideLeads)];
+}
+function isProviderChainHopId(modelId) {
+  const id = modelId ?? "";
+  return id !== "" && allChains().some(([, hops]) => hops.includes(id));
+}
+function providerChainPrimariesForHop(hopId) {
+  const id = hopId ?? "";
+  if (!id)
+    return [];
+  return allChains().filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+}
+function providerChainHostOf(value, modelValue) {
+  if (value === modelValue)
+    return "own";
+  if (hasZaiPrefix(value))
+    return "zai";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  return "own";
+}
+function providerChainHostProvider(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasZaiPrefix(value))
+    return "zai";
+  const key = chainKey(value);
+  return API_MODEL_CATALOG.find((m) => m.id === key)?.provider ?? GEMINI_ASSISTANT_MODELS.find((m) => m.id === key)?.provider ?? null;
+}
+function providerHostPlan(modelId) {
+  const key = chainKey(modelId);
+  if (!key)
+    return [];
+  const own = { host: hasOpenRouterPrefix(key) ? "openrouter" : "own", value: key };
+  const steps = [
+    ...providerChainLeadsFor(key).map((value) => ({ host: providerChainHostOf(value, key), value })),
+    own,
+    ...providerChainFor(key).map((value) => ({ host: providerChainHostOf(value, key), value }))
+  ];
+  const notOffered = Object.prototype.hasOwnProperty.call(PROVIDER_HOST_NOT_OFFERED, key) ? PROVIDER_HOST_NOT_OFFERED[key] : {};
+  for (const [host, reason] of Object.entries(notOffered)) {
+    const at = steps.findIndex((step) => step === own) + 1;
+    steps.splice(at, 0, { host, value: null, notOffered: reason });
+  }
+  return steps;
+}
+function providerChainModelKey(modelId) {
+  return chainKey(modelId);
+}
+function hasProviderChainLeadsByDefault(modelId) {
+  const key = chainKey(modelId);
+  return key !== null && has(PROVIDER_CHAIN_LEADS, key);
+}
+function isChainablePrimary(id) {
+  return typeof id === "string" && id !== "" && (has(PROVIDER_CHAINS, id) || has(PROVIDER_CHAIN_LEADS, id));
+}
+function defaultProviderChainEntries(primary) {
+  if (!isChainablePrimary(primary))
     return [];
-  return Object.prototype.hasOwnProperty.call(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+  const leads = has(PROVIDER_CHAIN_LEADS, primary) ? PROVIDER_CHAIN_LEADS[primary] : [];
+  const hops = has(PROVIDER_CHAINS, primary) ? PROVIDER_CHAINS[primary] : [];
+  return [...leads, primary, ...hops].map((hop) => ({ hop, enabled: true }));
+}
+function allowedProviderChainHosts(primary) {
+  return defaultProviderChainEntries(primary).map((entry) => entry.hop);
+}
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function validateProviderChainEntries(primary, entries) {
+  if (!isChainablePrimary(primary))
+    return `${String(primary).slice(0, 80)} has no provider chain to order`;
+  if (!Array.isArray(entries))
+    return `${primary}: the chain must be a list`;
+  if (entries.length > PROVIDER_CHAIN_MAX_ENTRIES)
+    return `${primary}: at most ${PROVIDER_CHAIN_MAX_ENTRIES} hosts`;
+  const allowed = allowedProviderChainHosts(primary);
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!isPlainObject2(entry))
+      return `${primary}: each host must be { hop, enabled }`;
+    const keys = Object.keys(entry);
+    if (keys.length !== 2 || !keys.includes("hop") || !keys.includes("enabled"))
+      return `${primary}: each host must be { hop, enabled } and nothing else`;
+    const { hop, enabled } = entry;
+    if (typeof enabled !== "boolean")
+      return `${primary}: enabled must be true or false`;
+    if (typeof hop !== "string" || !hop)
+      return `${primary}: hop must be a model value`;
+    if (!allowed.includes(hop))
+      return `${primary}: ${hop.slice(0, 80)} is not a host of this model`;
+    if (seen.has(hop))
+      return `${primary}: ${hop} is listed twice`;
+    if (hop === primary && !enabled)
+      return `${primary}: the model's own value stays on (pick another model on AI Models instead)`;
+    seen.add(hop);
+  }
+  if (!seen.has(primary))
+    return `${primary}: list the model's own value once, where its own host sits`;
+  return null;
+}
+function decodeProviderChains(raw) {
+  let value = raw;
+  if (typeof raw === "string") {
+    if (raw.length > PROVIDER_CHAINS_SETTING_MAX_CHARS)
+      return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return { ok: false, error: "AI_PROVIDER_CHAINS must be valid JSON" };
+    }
+  } else if (JSON.stringify(raw ?? null).length > PROVIDER_CHAINS_SETTING_MAX_CHARS) {
+    return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+  }
+  if (!isPlainObject2(value))
+    return { ok: false, error: 'AI_PROVIDER_CHAINS must be an object: { "<model>": [ { "hop": "<model value>", "enabled": true } ] }' };
+  if (Object.keys(value).length > PROVIDER_CHAIN_MAX_PRIMARIES)
+    return { ok: false, error: `AI_PROVIDER_CHAINS names at most ${PROVIDER_CHAIN_MAX_PRIMARIES} models` };
+  return { ok: true, value };
+}
+function checkedProviderChains(value) {
+  const out = {};
+  for (const [primary, entries] of Object.entries(value)) {
+    const problem = validateProviderChainEntries(primary, entries);
+    if (problem)
+      return { ok: false, error: problem };
+    out[primary] = entries.map(({ hop, enabled }) => ({ hop, enabled }));
+  }
+  return { ok: true, value: out };
+}
+function parseProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  return decoded.ok ? checkedProviderChains(decoded.value) : decoded;
+}
+function parseStoredProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  if (!decoded.ok)
+    return decoded;
+  const dropped = [];
+  const kept = {};
+  for (const [primary, entries] of Object.entries(decoded.value)) {
+    if (!isChainablePrimary(primary) || !Array.isArray(entries)) {
+      kept[primary] = entries;
+      continue;
+    }
+    const allowed = allowedProviderChainHosts(primary);
+    kept[primary] = entries.filter((entry) => {
+      const hop = isPlainObject2(entry) ? entry.hop : void 0;
+      if (typeof hop !== "string" || hop === "" || allowed.includes(hop))
+        return true;
+      dropped.push({ primary, hop: hop.slice(0, 80) });
+      return false;
+    });
+  }
+  const checked = checkedProviderChains(kept);
+  return checked.ok ? { ...checked, dropped } : checked;
+}
+function validateProviderChainsSetting(raw) {
+  const parsed = parseProviderChainOverrides(raw);
+  return parsed.ok ? null : parsed.error;
 }
-function isProviderChainHopId(modelId) {
-  const id = modelId ?? "";
-  return id !== "" && Object.values(PROVIDER_CHAINS).some((hops) => hops.includes(id));
+function setProviderChainOverrides(value, onDropped) {
+  const parsed = value === null || value === void 0 || value === "" ? null : parseStoredProviderChainOverrides(value);
+  if (parsed?.ok && parsed.dropped.length > 0)
+    onDropped?.(parsed.dropped);
+  _overrides = parsed?.ok ? parsed.value : null;
+  _overrideLeads = {};
+  _overrideHops = {};
+  for (const [primary, entries] of Object.entries(_overrides ?? {})) {
+    const at = entries.findIndex((entry) => entry.hop === primary);
+    const on = (list) => list.filter((entry) => entry.enabled).map((entry) => entry.hop);
+    _overrideLeads[primary] = on(entries.slice(0, at));
+    _overrideHops[primary] = on(entries.slice(at + 1));
+  }
+  return parsed === null || parsed.ok;
 }
-function providerChainPrimariesForHop(hopId) {
-  const id = hopId ?? "";
-  if (!id)
-    return [];
-  return Object.entries(PROVIDER_CHAINS).filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+function getProviderChainOverrides() {
+  return _overrides;
 }
-var PROVIDER_CHAINS;
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED, PROVIDER_CHAIN_MAX_ENTRIES, PROVIDER_CHAINS_SETTING_MAX_CHARS, PROVIDER_CHAIN_MAX_PRIMARIES, ALLOWED_PROVIDER_CHAIN_HOPS, _overrides, _overrideLeads, _overrideHops;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
     init_api_model_catalog();
+    init_engine_spec();
     PROVIDER_CHAINS = {
-      "minimax-m3": ["openrouter:minimax/minimax-m3", "opencode-go:minimax-m3"],
-      "minimax-m3.1-flash": ["openrouter:minimax/minimax-m3.1-flash", "opencode-go:minimax-m3.1-flash"],
+      "minimax-m3": ["opencode-go:minimax-m3", "openrouter:minimax/minimax-m3"],
+      "minimax-m3.1-flash": ["opencode-go:minimax-m3.1-flash", "openrouter:minimax/minimax-m3.1-flash"],
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
-      "openrouter:z-ai/glm-5.3-flash": ["opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["opencode-go:glm-5.2"]
+      "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
+      "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
+      "deepseek-flash": ["opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
     };
+    PROVIDER_CHAIN_LEADS = {
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go:glm-5.2"]
+    };
+    PROVIDER_HOST_NOT_OFFERED = {
+      "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
+      "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
+    };
+    PROVIDER_CHAIN_MAX_ENTRIES = 8;
+    PROVIDER_CHAINS_SETTING_MAX_CHARS = 16e3;
+    PROVIDER_CHAIN_MAX_PRIMARIES = 32;
+    ALLOWED_PROVIDER_CHAIN_HOPS = /* @__PURE__ */ new Set([
+      ...Object.values(PROVIDER_CHAINS).flat(),
+      ...Object.values(PROVIDER_CHAIN_LEADS).flat()
+    ]);
+    _overrides = null;
+    _overrideLeads = {};
+    _overrideHops = {};
+  }
+});
+
+// ../shared/dist/provider-accounts.js
+function modelNames(modelId) {
+  const value = modelId.trim();
+  const names = /* @__PURE__ */ new Set([value]);
+  for (const prefix of HOST_PREFIXES) {
+    if (!value.startsWith(prefix))
+      continue;
+    const bare = value.slice(prefix.length);
+    names.add(bare);
+    const slash = bare.lastIndexOf("/");
+    if (slash >= 0)
+      names.add(bare.slice(slash + 1));
+  }
+  const canonical = canonicalModelId(value);
+  if (canonical) {
+    names.add(canonical);
+    const entry = API_MODEL_CATALOG.find((m) => m.id === canonical || m.apiModel === canonical);
+    if (entry) {
+      names.add(entry.id);
+      if (entry.apiModel)
+        names.add(entry.apiModel);
+    }
+  }
+  return names;
+}
+function accountServesModel(models, modelId) {
+  if (!models || models.length === 0)
+    return true;
+  if (!modelId)
+    return false;
+  const names = modelNames(modelId);
+  return models.some((model) => names.has(model.trim()));
+}
+function normalizeProviderAccountModels(models) {
+  if (!Array.isArray(models))
+    return null;
+  const out = [];
+  for (const model of models) {
+    if (typeof model !== "string")
+      return null;
+    const trimmed = model.trim();
+    if (!PROVIDER_ACCOUNT_MODEL_PATTERN.test(trimmed) || trimmed.includes(".."))
+      return null;
+    if (!out.includes(trimmed))
+      out.push(trimmed);
+  }
+  return out.length > MAX_PROVIDER_ACCOUNT_MODELS ? null : out;
+}
+function parseProviderAccountLists(value, providers) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const parsed = {};
+  for (const provider of providers) {
+    const list = value[provider];
+    if (!Array.isArray(list))
+      continue;
+    const accounts = [];
+    for (const raw of list) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const { id, label, key, models } = raw;
+      if (typeof id !== "string" || !id.trim() || typeof key !== "string" || !key.trim())
+        continue;
+      const modelList = Array.isArray(models) ? models.filter((m) => typeof m === "string" && m.trim() !== "").map((m) => m.trim()) : [];
+      accounts.push({ id: id.trim(), label: typeof label === "string" && label.trim() ? label.trim() : null, key: key.trim(), models: modelList });
+    }
+    if (accounts.length > 0)
+      parsed[provider] = accounts;
+  }
+  return parsed;
+}
+var DEFAULT_PROVIDER_ACCOUNT_ID, PROVIDER_ACCOUNT_ID_PATTERN, MAX_PROVIDER_ACCOUNTS, MAX_PROVIDER_ACCOUNT_MODELS, PROVIDER_ACCOUNT_MODEL_PATTERN, OPENCODE_GO_DEEPSEEK_GLM_MODELS, HOST_PREFIXES;
+var init_provider_accounts = __esm({
+  "../shared/dist/provider-accounts.js"() {
+    "use strict";
+    init_api_model_catalog();
+    DEFAULT_PROVIDER_ACCOUNT_ID = "primary";
+    PROVIDER_ACCOUNT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    MAX_PROVIDER_ACCOUNTS = 10;
+    MAX_PROVIDER_ACCOUNT_MODELS = 50;
+    PROVIDER_ACCOUNT_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,120}$/;
+    OPENCODE_GO_DEEPSEEK_GLM_MODELS = [
+      "deepseek-v4.1-flash",
+      "deepseek-v4-pro",
+      "glm-5.3-flash",
+      "glm-5.3",
+      "glm-5.2"
+    ];
+    HOST_PREFIXES = ["opencode-go:", "zai:", "openrouter:"];
   }
 });
 
@@ -10781,6 +11721,25 @@ var init_project_engine_overrides = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+function stripTrailingChars(value, isTrailing) {
+  let end = value.length;
+  while (end > 0 && isTrailing.test(value[end - 1]))
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/gemini-visual.js
 function visualProDailyBudget(raw) {
   const parsed = raw && /^\s*\d{1,6}\s*$/.test(raw) ? Number(raw.trim()) : NaN;
@@ -10794,7 +11753,7 @@ function isRetiredGeminiModel(id) {
 }
 function geminiNativeModelsUrl(base = process.env.GEMINI_API_BASE) {
   const raw = base && base.trim() || GEMINI_OPENAI_BASE;
-  const native = raw.replace(/\/openai\/?$/, "/").replace(/\/+$/, "");
+  const native = stripTrailingSlashes(raw.replace(/\/openai\/?$/, "/"));
   return `${native}/models?pageSize=1000`;
 }
 function asRecord(value) {
@@ -10914,6 +11873,7 @@ var KNOWN_INPUT_USD_PER_M, GEMINI_OPENAI_BASE, DEFAULT_GEMINI_SCREEN_MODEL, DEFA
 var init_gemini_visual = __esm({
   "../shared/dist/gemini-visual.js"() {
     "use strict";
+    init_trailing_slashes();
     KNOWN_INPUT_USD_PER_M = {
       "gemini-2.5-flash-lite": 0.1,
       "gemini-3.1-flash-lite": 0.25,
@@ -12277,12 +13237,13 @@ function truncateAtWord(text, max) {
   const slice = trimmed.slice(0, room + 1);
   const lastSpace = slice.lastIndexOf(" ");
   const cut = lastSpace > room * 0.5 ? slice.slice(0, lastSpace) : trimmed.slice(0, room);
-  return `${cut.replace(/[\s,;:.\-–—]+$/u, "")}\u2026`;
+  return `${stripTrailingChars(cut, TRAILING_PUNCTUATION)}\u2026`;
 }
-var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE;
+var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE, TRAILING_PUNCTUATION;
 var init_canvas_support = __esm({
   "../shared/dist/canvas-support.js"() {
     "use strict";
+    init_trailing_slashes();
     CANVAS_UNSUPPORTED_CODE = "canvas_unsupported";
     CANVAS_UNSUPPORTED_TITLE = "Games and canvas apps aren't supported yet";
     CANVAS_UNSUPPORTED_BODY = "This app draws its screen on a canvas (like a game), so there are no page elements for Validate.QA to read and test. Support for games and canvas apps is coming.";
@@ -12407,6 +13368,7 @@ var init_canvas_support = __esm({
     TOUCH_NONE_RE = /touch-action\s{0,8}:\s{0,8}none/;
     CODE_TAGS = /* @__PURE__ */ new Set(["script", "link", "flt-glass-pane", "flutter-view", "flt-scene-host"]);
     STATIC_STANDARD_MIN_INTERACTIVE = 3;
+    TRAILING_PUNCTUATION = /[\s,;:.\-–—]/u;
   }
 });
 
@@ -12589,22 +13551,22 @@ function joinChainedLines(code) {
     const trimmed = lines[i].trimStart();
     if (last !== -1 && trimmed.startsWith(".") && !trimmed.startsWith("...")) {
       if (!lastStripped) {
-        lines[last] = stripLineComment2(lines[last]).trimEnd();
+        lines[last] = stripLineComment3(lines[last]).trimEnd();
         lastStripped = true;
       }
       if (lines[last].length <= MAX_LINE_CHARS)
-        lines[last] = `${lines[last]} ${stripLineComment2(trimmed).trimEnd()}`;
+        lines[last] = `${lines[last]} ${stripLineComment3(trimmed).trimEnd()}`;
       lines[i] = "";
       continue;
     }
-    if (stripLineComment2(lines[i]).trim()) {
+    if (stripLineComment3(lines[i]).trim()) {
       last = i;
       lastStripped = false;
     }
   }
   return lines.join("\n");
 }
-function stripLineComment2(rawLine) {
+function stripLineComment3(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -12620,7 +13582,7 @@ function stateLiteralsOf(line) {
   const out = [];
   for (const m of line.matchAll(STRING_LITERAL_RE)) {
     const text = m[1] ?? m[2] ?? m[3] ?? "";
-    if (text.includes("placeholder="))
+    if (PLACEHOLDER_ATTR_RE.test(text))
       continue;
     if (PLACEHOLDER_CALL_TAIL_RE.test(line.slice(Math.max(0, m.index - 40), m.index)))
       continue;
@@ -12653,7 +13615,7 @@ function analyzeReadinessPolling(rawCode) {
     offset += rawLine.length + 1;
     if (rawLine.length > MAX_LINE_CHARS)
       continue;
-    const line = stripLineComment2(rawLine);
+    const line = stripLineComment3(rawLine);
     if (!line.trim())
       continue;
     const literals = literalsOf(line);
@@ -12716,7 +13678,7 @@ function formatReadinessPollAdvisory(findings) {
   const where = findings.length === 1 ? "One place" : `${findings.length} places`;
   return `${where} re-check a background state once and assert the finished state at once (${short(first.line, 90)} then ${short(first.assertion, 90)}). ${first.reason}`;
 }
-var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
+var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_ATTR_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
 var init_readiness_poll = __esm({
   "../shared/dist/readiness-poll.js"() {
     "use strict";
@@ -12729,7 +13691,7 @@ var init_readiness_poll = __esm({
     STRING_LITERAL_RE = /'((?:\\.|[^'\\\n]){0,300})'|"((?:\\.|[^"\\\n]){0,300})"|`((?:\\.|[^`\\\n]){0,300})`/g;
     RECHECK_NAME_RE = /^\s{0,10}(?:check again|check (?:status|availability|now|for updates|progress)|re-?check(?: status)?|update status|see (?:latest|updates))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
     RETRY_NAME_RE = /^\s{0,10}(?:refresh(?: (?:status|list|page|results|now))?|reload(?: (?:page|results|list))?|try again|retry|load (?:again|latest))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
-    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b[a-z]{3,40}(?<!th)ing(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
+    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b(?:saving|uploading|downloading|signing|logging|submitting|creating|updating|deleting|importing|exporting|publishing|connecting|redirecting|authenticating|installing|retrieving|fetching|analy[sz]ing|running|rendering|restarting|building|compiling|booting|provisioning|deploying|indexing|migrating|launching|initiali[sz]ing|optimi[sz]ing|converting|processing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}(?:starting|scanning|working|applying|finishing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}[a-z]{3,40}(?<!th)ing\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
     LOCATOR_LINE_RE = /\.(?:getBy[A-Z]\w{0,30}|locator|toHaveText|toContainText)\s{0,20}\(/;
     CLICK_RE = /\.(?:click|dblclick|tap)\s{0,20}\(/;
     RELOAD_RE = /\bpage\.reload\s{0,20}\(/;
@@ -12743,6 +13705,7 @@ var init_readiness_poll = __esm({
     TEST_END_RE = /^\s{0,20}\}\s{0,20}\)\s{0,20};?\s{0,20}$/;
     TEST_START_RE = /\btest(?:\.\w{1,20})?\s{0,20}\(/;
     POLL_OPEN_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}async\b|\bexpect\.poll\s{0,20}\(|\bfor\s{0,20}\(|\bwhile\s{0,20}\(|\bdo\s{0,20}\{/g;
+    PLACEHOLDER_ATTR_RE = /placeholder\s{0,4}[*^$~|]?=/;
     PLACEHOLDER_CALL_TAIL_RE = /getByPlaceholder\s{0,20}\(\s{0,20}$/;
     POLL_SHAPE = "await expect(async () => { await page.reload(); await expect(<the finished state>).toBeVisible({ timeout: 1500 }); }).toPass({ timeout: 20000 });";
   }
@@ -12764,7 +13727,7 @@ function blankBlockComments2(code) {
     from = close + 2;
   }
 }
-function stripLineComment3(rawLine) {
+function stripLineComment4(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -12775,7 +13738,7 @@ function logicalLines(code) {
   for (const raw of code.split("\n")) {
     if (raw.length > MAX_LINE_CHARS2)
       continue;
-    const line = stripLineComment3(raw).trimEnd();
+    const line = stripLineComment4(raw).trimEnd();
     if (!line.trim())
       continue;
     const trimmed = line.trimStart();
@@ -13137,13 +14100,33 @@ function short4(text, max) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
 }
+function stripFractionZeros(s) {
+  let end = s.length;
+  while (end > 0 && s[end - 1] === "0")
+    end--;
+  if (end === s.length)
+    return s;
+  const dot = s.lastIndexOf(".");
+  if (dot < 0)
+    return s;
+  return s.slice(0, end === dot + 1 ? dot : end);
+}
 function digitsOf(token) {
-  return token.replace(/[^\d.]/g, "").replace(/\.0+$|(\.\d*?)0+$/, "$1").replace(/^0+(?=\d)/, "");
+  return stripFractionZeros(token.replace(/[^\d.]/g, "")).replace(/^0+(?=\d)/, "");
 }
 function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
   return COMPUTE_RE.test(code) || RELATIONAL_RE.test(line);
 }
+function identifiersIn(line) {
+  const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX");
+  return [code, ...[...line.matchAll(TEMPLATE_EXPR_RE)].map((m) => m[1])].flatMap((part) => part.match(IDENTIFIER_RE) ?? []);
+}
+function addTyped(typed, value) {
+  const d = digitsOf(value);
+  if (/\d/.test(d))
+    typed.add(d);
+}
 function reasonFor4(kind, label, value) {
   const what = kind === "derived-value-shape-only" ? `The ${label} is checked only for its shape, so any amount passes, including a wrongly computed one.` : `The ${label} is checked against a number written into the test (${value}). That number was read off the page, so when the page computes it wrong the check still passes.`;
   return `${what} Instead, ${COMPUTE_SHAPE} If the number is not computed from other values (a list price, an id, a fixed fee), leave it as it is. Keep the existing checks.`;
@@ -13155,25 +14138,32 @@ function analyzeDerivedValues(rawCode) {
   for (const body of testBodies(rawCode)) {
     if (findings.length >= MAX_FINDINGS4)
       break;
-    if (body.some(computes))
-      continue;
     const typed = /* @__PURE__ */ new Set();
     const definitions = /* @__PURE__ */ new Map();
+    const computed = /* @__PURE__ */ new Set();
+    const usesComputed = (text) => identifiersIn(text).some((id) => computed.has(id));
     for (const line of body) {
       if (FILL_RE2.test(line) && !EXPECT_RE3.test(line)) {
-        for (const m of line.matchAll(/['"`]([^'"`\n]{0,40})['"`]/g)) {
-          const d = digitsOf(m[1]);
-          if (/\d/.test(d))
-            typed.add(d);
-        }
+        for (const m of line.matchAll(QUOTED_RE))
+          addTyped(typed, m[1]);
+        const arg = FILL_ARG_RE.exec(line)?.[1];
+        const literal = arg === void 0 ? null : LITERAL_VALUE_RE.exec(definitions.get(arg) ?? "");
+        const value = literal?.slice(1).find((v) => v !== void 0);
+        if (value !== void 0)
+          addTyped(typed, value);
       }
       const def = DEFINITION_RE.exec(line);
-      if (def)
+      if (def) {
         definitions.set(def[1], def[2]);
+        if (computes(def[2]) || usesComputed(def[2]))
+          computed.add(def[1]);
+      }
     }
     for (const line of body) {
       if (!EXPECT_RE3.test(line) || !VALUE_MATCHER_RE2.test(line) || /\.not\s{0,20}\./.test(line))
         continue;
+      if (computes(line) || usesComputed(line))
+        continue;
       const subject = EXPECT_SUBJECT_RE.exec(line)?.[1];
       const label = DERIVED_WORD_RE.exec(`${line} ${(subject && definitions.get(subject)) ?? ""}`)?.[0];
       if (!label)
@@ -13203,7 +14193,7 @@ function formatDerivedValueAdvisory(findings) {
   const where = findings.length === 1 ? "One computed value is" : `${findings.length} computed values are`;
   return `${where} checked against a copied number or only its shape (${short4(first.line, 90)}). ${first.reason}`;
 }
-var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, COMPUTE_SHAPE;
+var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, TEMPLATE_EXPR_RE, IDENTIFIER_RE, QUOTED_RE, FILL_ARG_RE, LITERAL_VALUE_RE, COMPUTE_SHAPE;
 var init_derived_value_check = __esm({
   "../shared/dist/derived-value-check.js"() {
     "use strict";
@@ -13223,6 +14213,11 @@ var init_derived_value_check = __esm({
     DEFINITION_RE = /\b(?:const|let)\s{1,10}([\w$]{1,60})\s{0,10}=\s{0,10}([^\n]{0,300})/;
     EXPECT_SUBJECT_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}([\w$]{1,60})/;
     LITERAL_ARITH_RE = /\b\d[\d_.]{0,15}(?:\s{0,5}[*/+-]\s{0,5}\d[\d_.]{0,15}){1,8}\b/g;
+    TEMPLATE_EXPR_RE = /\$\{([^{}\n]{0,200})\}/g;
+    IDENTIFIER_RE = /[A-Za-z_$][\w$]{0,60}/g;
+    QUOTED_RE = /['"`]([^'"`\n]{0,40})['"`]/g;
+    FILL_ARG_RE = /\.(?:fill|type|pressSequentially|selectOption)\s{0,20}\(\s{0,20}([A-Za-z_$][\w$]{0,60})\s{0,20}[,)]/;
+    LITERAL_VALUE_RE = /^\s{0,10}(?:'([^'\n]{0,40})'|"([^"\n]{0,40})"|`([^`$\n]{0,40})`|(\d[\d_,]{0,15}(?:\.\d{1,4})?))\s{0,10};?\s{0,10}$/;
     COMPUTE_SHAPE = "compute the expected value in the test from its inputs (the values the test typed, or each input read from the page) and compare: const toNumber = (s) => Number(s.replace(/[^\\d.-]/g, '')); const unit = toNumber(await <unit price locator>.innerText()); then expect(toNumber(await <shown value locator>.innerText())).toBeCloseTo(unit * quantity, 2); for several lines, read them all and sum them with reduce. For a comma-decimal price like \u20AC1.234,56, drop the dots and turn the comma into a point before Number, since the replace above would read it as 1.23456.";
   }
 });
@@ -13335,7 +14330,7 @@ function findExpectCalls(code) {
     if (!subj)
       continue;
     const rest = code.slice(subj.end + 1, subj.end + 1 + 80);
-    const mm = /^\s*((?:\.\s*not)?\s*\.\s*(\w+))\s{0,20}\(/.exec(rest);
+    const mm = /^\s*((?:\.\s*not\s*)?\.\s*(\w+))\s{0,20}\(/.exec(rest);
     if (!mm)
       continue;
     const argStart = subj.end + 1 + mm[0].length;
@@ -15257,6 +16252,133 @@ function formatStaleAfterSubmitAdvisory(rawCode) {
   const more = described.length > 3 ? ` (+${described.length - 3} more)` : "";
   return `stale-after-submit: ${described.slice(0, 3).join("; ")}${more}; these pass before the request lands and still pass if the server rejects or ignores the save. Wait for the result instead: page.waitForResponse around the click, or assert something the submit creates (the new row, the confirmation message, a path with an end anchor such as /\\/orders\\/\\d+$/)`;
 }
+function regexLiteralEnd4(text, at) {
+  let inClass = false;
+  for (let i = at + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\n")
+      return -1;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/")
+      return i + 1;
+  }
+  return -1;
+}
+function startsWithRegexLiteral(text) {
+  const t = text.trimStart();
+  return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
+}
+function isBareRegexLiteral(text) {
+  const t = text.trimStart();
+  if (t[0] !== "/" || t[1] === "/" || t[1] === "*")
+    return false;
+  const end = regexLiteralEnd4(t, 0);
+  if (end === -1)
+    return false;
+  let i = end;
+  while (i < t.length && /[a-z]/.test(t[i]))
+    i++;
+  while (i < t.length && /\s/.test(t[i]))
+    i++;
+  return i >= t.length || t[i] === ",";
+}
+function regexDeclaredNames(code) {
+  const names = /* @__PURE__ */ new Set();
+  const decl = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,80})\s{0,20}=\s{0,20}(?:\/(?![/*])|new\s{1,20}RegExp\b)/g;
+  let m;
+  while ((m = decl.exec(code)) !== null)
+    names.add(m[1]);
+  return names;
+}
+function afterFirstArg(args) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i];
+    if (quote) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}")
+      depth--;
+    else if (ch === "," && depth === 0)
+      return args.slice(i + 1);
+  }
+  return "";
+}
+function analyzeRegexMatchers(rawCode) {
+  if (!rawCode || typeof rawCode !== "string")
+    return [];
+  const code = stripComments2(rawCode.slice(0, MAX_LINT_INPUT));
+  const out = [];
+  const re = /\bexpect(?:\.soft)?\s{0,20}\(/g;
+  let m;
+  let examined = 0;
+  let line = 1;
+  let lineAt2 = 0;
+  let regexNames;
+  while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
+    const subj = readBalanced(code, m.index + m[0].length);
+    if (!subj)
+      continue;
+    const mm = /^\s{0,20}(\.\s{0,20}not)?\s{0,20}\.\s{0,20}(\w{1,40})\s{0,20}\(/.exec(code.slice(subj.end + 1, subj.end + 1 + 80));
+    if (!mm || !REGEX_EQUALITY_MATCHERS.has(mm[2]))
+      continue;
+    const args = readBalanced(code, subj.end + 1 + mm[0].length);
+    if (!args)
+      continue;
+    const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
+    if (!isBareRegexLiteral(expected))
+      continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain") {
+      const subject = subj.text.trim();
+      if (startsWithRegexLiteral(subject) || /^new\s+RegExp\b/.test(subject))
+        continue;
+      if (/^[A-Za-z_$][\w$]{0,80}$/.test(subject)) {
+        regexNames ??= regexDeclaredNames(code);
+        if (regexNames.has(subject))
+          continue;
+      }
+    }
+    for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
+      line++;
+      lineAt2 = i + 1;
+    }
+    out.push({ line, matcher: mm[2], negated: mm[1] !== void 0 });
+  }
+  return out;
+}
+function formatRegexMatcherNote(findings) {
+  const lines = findings.map((f) => {
+    const negated = f.matcher === "toContain" ? "throws on a string and otherwise always passes (a regex never equals an item), so it checks nothing" : "always passes (a regex never equals the value), so it checks nothing";
+    return `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? negated : "can never pass: this matcher compares by equality and a regex never equals a value"}.`;
+  });
+  return `${lines.join("\n")}
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For the \`value\` of an input, textarea or select, use await expect(loc).toHaveValue(/re/). For any other DOM property (or element), poll it so the check still retries: await expect.poll(() => loc.evaluate((n) => n.<prop>)).toMatch(/re/). Never read it once with expect(await loc.evaluate(\u2026)), which sees the value before the page updates it. Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+}
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
     return [];
@@ -15264,6 +16386,10 @@ function lintTestQuality(rawCode, opts = {}) {
     return lintTestData(rawCode, { pageContacts: opts.pageContacts });
   if (opts.only === "test-data-blocking")
     return analyzeTestData(rawCode, { pageContacts: opts.pageContacts }).blocking;
+  if (opts.only === "regex-matcher") {
+    const found = analyzeRegexMatchers(rawCode);
+    return found.length > 0 ? [formatRegexMatcherNote(found)] : [];
+  }
   const warnings = [];
   if (rawCode.length > MAX_LINT_INPUT) {
     warnings.push(`The code is ${Math.round(rawCode.length / 1024)} KB; the quality lint checked only the first ${MAX_LINT_INPUT / 1e3} KB. Split it into smaller tests (one behaviour per test).`);
@@ -15538,7 +16664,7 @@ function specItemsFromTestPlans(testPlans) {
   }
   return [...new Set(out)].slice(0, 200);
 }
-var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, STOP, SYNONYMS, AREA_TOKENS;
+var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, MAX_REGEX_MATCHER_FINDINGS, REGEX_EQUALITY_MATCHERS, STOP, SYNONYMS, AREA_TOKENS;
 var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
@@ -15770,6 +16896,8 @@ var init_test_authoring_quality = __esm({
     };
     LIVE_WRITE_NAME = /\b(?:submit|place|book|reserve|confirm|pay|send|checkout|order|register|sign\s?up|create account)\b/i;
     BUNDLED_CHECKS_BEFORE_WRITE = 5;
+    MAX_REGEX_MATCHER_FINDINGS = 10;
+    REGEX_EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toContain", "toHaveJSProperty"]);
     STOP = /* @__PURE__ */ new Set([
       "a",
       "an",
@@ -16008,7 +17136,7 @@ function normalizeBugPath(route) {
   if (hash >= 0 && path[hash + 1] !== "/")
     path = path.slice(0, hash);
   const segments = path.toLowerCase().split("/").map((segment) => /\d/.test(segment) ? ":id" : segment);
-  const joined = segments.join("/").replace(/\/+$/, "");
+  const joined = stripTrailingSlashes(segments.join("/"));
   return joined || (path.startsWith("/") ? "/" : "");
 }
 function isGenericConsoleMessage(message) {
@@ -16021,14 +17149,17 @@ function requestSignatures(text) {
   const statuses = [...text.matchAll(HTTP_STATUS)].map((m) => ({ status: m[1], at: m.index ?? 0, end: (m.index ?? 0) + m[0].length }));
   if (statuses.length === 0)
     return [];
-  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => ({
-    method: m[1] ?? null,
-    path: normalizeBugPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "")),
-    // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
-    incidental: isIncidentalAssetPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "").split(/[?#]/, 1)[0].toLowerCase()),
-    at: m.index ?? 0,
-    end: (m.index ?? 0) + m[0].length
-  })).filter((p) => p.path.length > 1);
+  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => {
+    const rawPath = stripTrailingChars(m[2] ?? m[3] ?? "", PATH_TRAILING_PUNCTUATION);
+    return {
+      method: m[1] ?? null,
+      path: normalizeBugPath(rawPath),
+      // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
+      incidental: isIncidentalAssetPath(rawPath.split(/[?#]/, 1)[0].toLowerCase()),
+      at: m.index ?? 0,
+      end: (m.index ?? 0) + m[0].length
+    };
+  }).filter((p) => p.path.length > 1);
   const out = /* @__PURE__ */ new Map();
   for (const { status, at, end } of statuses) {
     const lead = STATUS_TO_PATH.exec(text.slice(end, end + 40));
@@ -16138,10 +17269,12 @@ function dedupeSiteWideSuspectedBugs(drafts) {
       delete plans.suspectedBugs;
   }
 }
-var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
+var PATH_TRAILING_PUNCTUATION, SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
+    init_trailing_slashes();
+    PATH_TRAILING_PUNCTUATION = /[.,;:]/;
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17422,9 +18555,9 @@ function lastLocatorLabels(chain) {
       if (t)
         labels.push(t[1]);
     }
-    const has = optionText(last.args, HAS_TEXT_OPTION_RE);
-    if (has !== null)
-      labels.push(has);
+    const has2 = optionText(last.args, HAS_TEXT_OPTION_RE);
+    if (has2 !== null)
+      labels.push(has2);
   }
   return labels.map((l) => l.replace(/^[\s^(?:]+/, "").trim());
 }
@@ -17472,7 +18605,7 @@ function pathIdsIn(text) {
 function findCounterIdPins(code) {
   if (code.length > CLOCK_MAX_CODE_CHARS)
     return [];
-  const clean2 = stripLineComments(blankBlockComments3(code));
+  const clean3 = stripLineComments(blankBlockComments3(code));
   const fillValues = [];
   const candidates = [];
   let seenWrite = false;
@@ -17480,24 +18613,24 @@ function findCounterIdPins(code) {
   CALL_RE.lastIndex = 0;
   let m;
   let calls = 0;
-  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean2)) !== null) {
+  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean3)) !== null) {
     const name = m[1];
     const open = m.index + m[0].length - 1;
     if (VALUE_WRITES.has(name)) {
       seenWrite = true;
-      const args2 = argsAt(clean2, open);
+      const args2 = argsAt(clean3, open);
       if (args2 !== null)
         fillValues.push(...staticStrings(args2));
       continue;
     }
     if (createIndex === -1) {
-      if (name === "click" && seenWrite && isCreateClick(clean2, m.index))
+      if (name === "click" && seenWrite && isCreateClick(clean3, m.index))
         createIndex = m.index;
       continue;
     }
     if (name === "click")
       continue;
-    const args = argsAt(clean2, open);
+    const args = argsAt(clean3, open);
     if (args === null)
       continue;
     const isUrl = URL_SINKS.has(name);
@@ -17516,7 +18649,7 @@ function findCounterIdPins(code) {
   }
   if (createIndex === -1)
     return [];
-  const before = clean2.slice(0, createIndex);
+  const before = clean3.slice(0, createIndex);
   let pathIdsBefore = null;
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -17540,7 +18673,7 @@ function findCounterIdPins(code) {
           continue;
       }
     }
-    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean2, c.index) });
+    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean3, c.index) });
   }
   return findings;
 }
@@ -17835,7 +18968,7 @@ var init_suspicious_expectation = __esm({
     NOT_STUCK_RE = /\b(?:not|never|no longer|isn't|doesn't|don't|without)\s+(?:\w+\s+){0,2}?(?:stuck|hang|hangs|hung|freeze|freezes|frozen|spin|spins|spinning)\b/i;
     LISTS_STUCK_RE = /\b(?:appears? in (?:the )?[\w ]{0,25}(?:report|list|dashboard|queue)|(?:lists?|monitors?|shows?|reports?) (?:\w+ ){0,2}(?:that|which|whose) (?:are |is )?(?:stuck|hangs?|hung|frozen)|can (?:retry|re-?run) (?:\w+ ){0,2}(?:that (?:are )?)?stuck)\b/i;
     STUCK_VETO_RE = new RegExp(`${NOT_STUCK_RE.source}|${LISTS_STUCK_RE.source}`, "i");
-    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:fail(?:s|ing|ed)?|ignor\w*)?\s*silent(?:ly)?\b/i;
+    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:(?:fail(?:s|ing|ed)?|ignor\w*)\s*)?silent(?:ly)?\b/i;
     PENDING_WORD = "(?:sending|loading|saving|searching|checking(?!\\s+(?:account|balance|out|in)\\b)|syncing|refreshing|fetching|validating|processing|submitting|uploading|posting|publishing|creating|updating|deleting|connecting|verifying|signing in|logging in)";
     ELLIPSIS = "(?:\\.{3}|\u2026)";
     NOT_STAY_RE = /\b(?:not|never|no longer|without|n't|cannot)\s+(?:\w+\s+){0,2}?(?:stay|stays|stayed|remain|remains|remained|leave|leaves|left)\b/i;
@@ -17991,7 +19124,7 @@ function outcomeNamedByAssertion(outcome, code) {
 function namedByStatements(outcome, statements) {
   const text = outcomeText(outcome);
   if (outcome.type === "url") {
-    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => r.replace(/[.,;:!?)]+$/, "")).filter((r) => r.length > 1);
+    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => stripTrailingChars(r, ROUTE_TRAILING_PUNCTUATION)).filter((r) => r.length > 1);
     return statements.some((stmt) => {
       if (!/\.(?:waitForURL|toHaveURL)\s{0,20}\(/.test(stmt))
         return false;
@@ -18163,7 +19296,7 @@ function evaluatePromotionGate(input, checks = PROMOTION_QUALITY_CHECKS) {
     ...suspiciousTagged ? { suspiciousPass: { mode: suspicious, covered: suspiciousCovered, wouldHold: suspiciousHold } } : {}
   };
 }
-var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
+var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
 var init_promotion_quality_gate = __esm({
   "../shared/dist/promotion-quality-gate.js"() {
     "use strict";
@@ -18178,17 +19311,21 @@ var init_promotion_quality_gate = __esm({
     init_run_classification();
     init_expected_outcome_coverage();
     init_expect_call();
+    init_trailing_slashes();
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, strengthGate, flagContradictedAdditions }) {
-        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
+      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof }) {
+        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
-        if (verdict.severity !== "block")
+        const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
+        if (verdict.severity !== "block" && !authDowngrade)
           return [];
         const revealed = strengthGate?.severity === "none" && strengthGate.revealEvidence === "revealed" && strengthGate.source !== "heal";
-        return revealed ? [] : [{ check: "strength-block" }];
+        if (revealed)
+          return [];
+        return [{ check: authDowngrade ? "strength-downgrade-auth" : "strength-block" }];
       }
     };
     STRING_CONST = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,60})\s{0,20}=\s{0,20}(?:'([^'\\\n]{0,300})'|"([^"\\\n]{0,300})"|`([^`\\$\n]{0,300})`)\s{0,20}[;\n]/g;
@@ -18197,7 +19334,7 @@ var init_promotion_quality_gate = __esm({
     MAX_STATEMENTS = 500;
     MAX_STATEMENT_CHARS = 400;
     LITERAL_OR_IDENTIFIER = /'(?:[^'\\\n]|\\.){0,500}'|"(?:[^"\\\n]|\\.){0,500}"|`(?:[^`\\]|\\.){0,2000}`|(?<![\w$.])[A-Za-z_$][\w$]{0,60}/g;
-    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
+    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
     FEEDBACK_REGION = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/i;
     ONE_SHOT_MESSAGE_REASON = "one-shot success/error banner text";
     FEEDBACK_REGION_ALL = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/gi;
@@ -18256,6 +19393,7 @@ var init_promotion_quality_gate = __esm({
       "element-hidden": /\.(?:toBeHidden|not\s{0,20}\.\s{0,20}toBeVisible|not\s{0,20}\.\s{0,20}toBeAttached|not\s{0,20}\.\s{0,20}toContainText)\s{0,20}\(|\.toHaveCount\s{0,20}\(\s{0,20}0\s{0,20}\)/
     };
     ROUTE_TERM = /\/[A-Za-z0-9_./?&=#-]{1,200}/g;
+    ROUTE_TRAILING_PUNCTUATION = /[.,;:!?)]/;
     QUOTED_LITERAL = /'([^'\\\n]{3,200})'|"([^"\\\n]{3,200})"|`([^`\\$\n]{3,200})`/g;
     GENERIC_LITERAL = /^(?:true|false|button|link|heading|dialog|alertdialog|article|main|region|status|alert|textbox|combobox|checkbox|radio|tab|tabpanel|option|list|listitem|row|cell|img|navigation|banner|complementary|contentinfo|form|search|menu|menuitem|visible|hidden|attached|detached|domcontentloaded|load|networkidle)$/i;
     MAX_OUTCOME_STATEMENTS = 300;
@@ -18375,8 +19513,8 @@ ${goalText}`);
         return count3 > 0 ? [{ check: "locator-fragment", detail: String(count3), soft: true }] : [];
       }
     };
-    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|press)\s*\(/i;
-    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s*\(/;
+    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|setChecked|press)\s*\(/i;
+    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s*\(/;
     REDUCTION_PROOF = /\.toHaveCount\s*\(|\.not\s*\.\s*(?:toBeVisible|toBeAttached|toContainText|toHaveText)\s*\(|\.toBeHidden\s*\(|\bShowing\b|\bof \d+\b|\b\d+ (?:results?|rows?|items?|candidates?|entries|matches|records)\b|\bNo (?:[\w'-]+ ){0,3}(?:match|matches|results?|found|left|remain|yet)\b|\bNothing (?:to show|found|matches)\b|\bis empty\b|\btoHaveURL\b/i;
     MAX_FILTER_LINES = 2e3;
     MAX_FILTER_LINE_CHARS = 600;
@@ -18491,7 +19629,7 @@ ${goalText}`);
 });
 
 // ../shared/dist/regex-alternation.js
-function closingParens(source) {
+function closingParens2(source) {
   const close = new Int32Array(source.length).fill(-1);
   const open = [];
   let inClass = false;
@@ -18516,7 +19654,7 @@ function closingParens(source) {
   return close;
 }
 function alternatesAtTop(source) {
-  const close = closingParens(source);
+  const close = closingParens2(source);
   let start = source.startsWith("^") ? 1 : 0;
   let end = source.endsWith("$") ? source.length - 1 : source.length;
   while (start < end && source[start] === "(" && close[start] === end - 1) {
@@ -18565,6 +19703,124 @@ var init_page_evidence = __esm({
   }
 });
 
+// ../shared/dist/stated-limits.js
+function validDate(v) {
+  const [y, m, d] = v.split("-").map(Number);
+  const t = new Date(Date.UTC(y, m - 1, d));
+  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;
+}
+function isoFor(type, v) {
+  const re = DATE_RE[type];
+  if (!re || !re.test(v))
+    return false;
+  if (type === "date")
+    return validDate(v);
+  if (type === "datetime-local")
+    return validDate(v.slice(0, 10)) && Number(v.slice(11, 13)) < 24 && Number(v.slice(14, 16)) < 60;
+  if (type === "time")
+    return Number(v.slice(0, 2)) < 24 && Number(v.slice(3, 5)) < 60;
+  if (type === "month")
+    return Number(v.slice(5, 7)) >= 1 && Number(v.slice(5, 7)) <= 12;
+  return Number(v.slice(6, 8)) >= 1 && Number(v.slice(6, 8)) <= 53;
+}
+function clean2(raw) {
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function statedLimitsFromAttrs(attrs, inputType) {
+  const type = (inputType ?? "").trim().toLowerCase();
+  const limits = [];
+  const add = (k, v) => {
+    limits.push({ k, v });
+  };
+  if (NUMBER_TYPES.has(type)) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (NUMBER_RE.test(v))
+        add(k, v);
+    }
+    const step = clean2(attrs.step);
+    if (NUMBER_RE.test(step) && Number(step) > 0)
+      add("step", step);
+  } else if (type in DATE_RE) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (isoFor(type, v))
+        add(k, v);
+    }
+  } else if (TEXT_TYPES.has(type)) {
+    for (const [attr, k] of [["minlength", "minLength"], ["maxlength", "maxLength"]]) {
+      const v = clean2(attrs[attr]);
+      if (LENGTH_RE.test(v))
+        add(k, String(Number(v)));
+    }
+    const pattern = cleanPattern(clean2(attrs.pattern).slice(0, STATED_PATTERN_MAX));
+    if (pattern)
+      add("pattern", pattern);
+  }
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+function cleanPattern(text) {
+  return text.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "");
+}
+function readStatedLimits(stored) {
+  if (!stored || typeof stored !== "object" || Array.isArray(stored))
+    return [];
+  const rec = stored;
+  if (rec.v !== STATED_LIMITS_VERSION || !Array.isArray(rec.limits))
+    return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of rec.limits.slice(0, MAX_LIMITS * 2)) {
+    if (!item || typeof item !== "object")
+      continue;
+    const { k, v } = item;
+    if (typeof k !== "string" || typeof v !== "string" || !KINDS.includes(k) || seen.has(k))
+      continue;
+    if (v.length === 0 || v.length > STATED_PATTERN_MAX)
+      continue;
+    const text = k === "pattern" ? cleanPattern(v) : v;
+    if (text === "")
+      continue;
+    if (k === "minLength" || k === "maxLength") {
+      if (!LENGTH_RE.test(v))
+        continue;
+    } else if (k === "step") {
+      if (!NUMBER_RE.test(v))
+        continue;
+    } else if (k === "min" || k === "max") {
+      if (!NUMBER_RE.test(v) && !Object.values(DATE_RE).some((re) => re.test(v)))
+        continue;
+    }
+    seen.add(k);
+    out.push({ k, v: text });
+  }
+  return out;
+}
+function statedLimitsRecord(limits) {
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+var STATED_LIMITS_VERSION, STATED_PATTERN_MAX, KINDS, MAX_LIMITS, TEXT_TYPES, NUMBER_TYPES, DATE_RE, NUMBER_RE, LENGTH_RE;
+var init_stated_limits = __esm({
+  "../shared/dist/stated-limits.js"() {
+    "use strict";
+    STATED_LIMITS_VERSION = 1;
+    STATED_PATTERN_MAX = 200;
+    KINDS = ["min", "max", "minLength", "maxLength", "step", "pattern"];
+    MAX_LIMITS = KINDS.length;
+    TEXT_TYPES = /* @__PURE__ */ new Set(["text", "search", "email", "url", "tel", "password", "textarea", ""]);
+    NUMBER_TYPES = /* @__PURE__ */ new Set(["number", "range"]);
+    DATE_RE = {
+      date: /^\d{4}-\d{2}-\d{2}$/,
+      "datetime-local": /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?$/,
+      time: /^\d{2}:\d{2}(?::\d{2})?$/,
+      month: /^\d{4}-\d{2}$/,
+      week: /^\d{4}-W\d{2}$/
+    };
+    NUMBER_RE = /^-?\d{1,15}(?:\.\d{1,10})?$/;
+    LENGTH_RE = /^\d{1,7}$/;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -18572,9 +19828,11 @@ __export(dist_exports, {
   ACTION_BATCH_MAX_SIZE: () => ACTION_BATCH_MAX_SIZE,
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
+  ADMIN_FORCE_CANCELLED_RUN_ERROR: () => ADMIN_FORCE_CANCELLED_RUN_ERROR,
   ADMIN_VIEW_DEFAULT_RETURN_TO: () => ADMIN_VIEW_DEFAULT_RETURN_TO,
   AGENT_AI_PROVIDER_PREFIXES: () => AGENT_AI_PROVIDER_PREFIXES,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  ALLOWED_PROVIDER_CHAIN_HOPS: () => ALLOWED_PROVIDER_CHAIN_HOPS,
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_MODEL_CATALOG: () => API_MODEL_CATALOG,
   API_MODEL_FIELDS: () => API_MODEL_FIELDS,
@@ -18595,6 +19853,7 @@ __export(dist_exports, {
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
   AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
   AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
+  AUTH_SESSION_GENERATION_RE: () => AUTH_SESSION_GENERATION_RE,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -18613,12 +19872,14 @@ __export(dist_exports, {
   BUG_TEST_BROKEN_REASON: () => BUG_TEST_BROKEN_REASON,
   BUG_TEST_BROKEN_TAG: () => BUG_TEST_BROKEN_TAG,
   CACHE_PRICE_PER_M: () => CACHE_PRICE_PER_M,
+  CANCELLED_REASON_PREFIXES: () => CANCELLED_REASON_PREFIXES,
   CANVAS_UNSUPPORTED_BODY: () => CANVAS_UNSUPPORTED_BODY,
   CANVAS_UNSUPPORTED_CODE: () => CANVAS_UNSUPPORTED_CODE,
   CANVAS_UNSUPPORTED_NOT_CHARGED: () => CANVAS_UNSUPPORTED_NOT_CHARGED,
   CANVAS_UNSUPPORTED_OVERRIDE_HINT: () => CANVAS_UNSUPPORTED_OVERRIDE_HINT,
   CANVAS_UNSUPPORTED_TITLE: () => CANVAS_UNSUPPORTED_TITLE,
   CAPTURE_JSON_STRUCTURE_LIMITS: () => CAPTURE_JSON_STRUCTURE_LIMITS,
+  CHAIN_CANCELLED_RUN_ERROR: () => CHAIN_CANCELLED_RUN_ERROR,
   CHAT_FAILOVER_KEY: () => CHAT_FAILOVER_KEY,
   CLAUDE_CLI_DEFAULT_EFFORT: () => CLAUDE_CLI_DEFAULT_EFFORT,
   CLAUDE_CLI_DEFAULT_MODEL: () => CLAUDE_CLI_DEFAULT_MODEL,
@@ -18655,6 +19916,7 @@ __export(dist_exports, {
   DEFAULT_GEMINI_SCREEN_MODEL: () => DEFAULT_GEMINI_SCREEN_MODEL,
   DEFAULT_JSON_STRUCTURE_LIMITS: () => DEFAULT_JSON_STRUCTURE_LIMITS,
   DEFAULT_PLATFORM_DB_POOL_SIZE: () => DEFAULT_PLATFORM_DB_POOL_SIZE,
+  DEFAULT_PROVIDER_ACCOUNT_ID: () => DEFAULT_PROVIDER_ACCOUNT_ID,
   DEFAULT_SHARED_DB_POOL_SIZE: () => DEFAULT_SHARED_DB_POOL_SIZE,
   DEFAULT_STT_MODEL: () => DEFAULT_STT_MODEL,
   DEFAULT_STT_MODEL_BY_PROVIDER: () => DEFAULT_STT_MODEL_BY_PROVIDER,
@@ -18671,6 +19933,7 @@ __export(dist_exports, {
   ENVIRONMENTAL_ERROR_STORED_PREFIXES: () => ENVIRONMENTAL_ERROR_STORED_PREFIXES,
   EVIDENCE_NOTE_PREFIXES: () => EVIDENCE_NOTE_PREFIXES,
   EXPECT_CALL_RE: () => EXPECT_CALL_RE,
+  FEATURE_ROW_RUN_WINDOW: () => FEATURE_ROW_RUN_WINDOW,
   FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
   FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
   FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
@@ -18727,6 +19990,8 @@ __export(dist_exports, {
   LIVE_FRAME_STALE_MS: () => LIVE_FRAME_STALE_MS,
   LIVE_FRAME_UNFOCUSED_INTERVAL_MS: () => LIVE_FRAME_UNFOCUSED_INTERVAL_MS,
   LIVE_THUMBNAIL_MAX_BASE64_BYTES: () => LIVE_THUMBNAIL_MAX_BASE64_BYTES,
+  MAX_BALANCED_SCAN: () => MAX_BALANCED_SCAN,
+  MAX_CALLS: () => MAX_CALLS,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MAX_EMAIL_ADDRESS_LENGTH: () => MAX_EMAIL_ADDRESS_LENGTH,
@@ -18736,6 +20001,8 @@ __export(dist_exports, {
   MAX_ORG_NAME_LENGTH: () => MAX_ORG_NAME_LENGTH,
   MAX_PASSWORD_BYTES: () => MAX_PASSWORD_BYTES,
   MAX_PLAYWRIGHT_CODE_LENGTH: () => MAX_PLAYWRIGHT_CODE_LENGTH,
+  MAX_PROVIDER_ACCOUNTS: () => MAX_PROVIDER_ACCOUNTS,
+  MAX_PROVIDER_ACCOUNT_MODELS: () => MAX_PROVIDER_ACCOUNT_MODELS,
   MAX_SURVEY_ENTRY_URLS: () => MAX_SURVEY_ENTRY_URLS,
   MAX_SURVEY_ENTRY_URL_LENGTH: () => MAX_SURVEY_ENTRY_URL_LENGTH,
   MCP_ARMY_LIMITS: () => MCP_ARMY_LIMITS,
@@ -18771,6 +20038,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
+  OPENCODE_GO_DEEPSEEK_GLM_MODELS: () => OPENCODE_GO_DEEPSEEK_GLM_MODELS,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -18790,10 +20058,12 @@ __export(dist_exports, {
   PLAN_FEATURES: () => PLAN_FEATURES,
   PLAN_FEATURE_LOCKED_CODE: () => PLAN_FEATURE_LOCKED_CODE,
   PLAN_ORDER: () => PLAN_ORDER,
+  PLATFORM_ADMIN_CANCELLED_RUN_ERROR: () => PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
   PLATFORM_DEFAULT_PROVIDER: () => PLATFORM_DEFAULT_PROVIDER,
   PLATFORM_PLAN_BILLING: () => PLATFORM_PLAN_BILLING,
   PLATFORM_SERVER_APPLICATION_NAME: () => PLATFORM_SERVER_APPLICATION_NAME,
+  PLATFORM_SUPPORT_CANCELLED_RUN_ERROR: () => PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
   POST_SPECIAL_TRIAL_DAYS: () => POST_SPECIAL_TRIAL_DAYS,
   PRESET_DIRECT_FALLBACK: () => PRESET_DIRECT_FALLBACK,
   PRODUCTION_READ_ONLY_GUARD_TEMPLATE: () => PRODUCTION_READ_ONLY_GUARD_TEMPLATE,
@@ -18805,17 +20075,25 @@ __export(dist_exports, {
   PROJECT_OVERRIDE_FIELDS: () => PROJECT_OVERRIDE_FIELDS,
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
+  PROVIDER_ACCOUNT_ID_PATTERN: () => PROVIDER_ACCOUNT_ID_PATTERN,
+  PROVIDER_ACCOUNT_MODEL_PATTERN: () => PROVIDER_ACCOUNT_MODEL_PATTERN,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAINS_SETTING_MAX_CHARS: () => PROVIDER_CHAINS_SETTING_MAX_CHARS,
+  PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_CHAIN_MAX_ENTRIES: () => PROVIDER_CHAIN_MAX_ENTRIES,
+  PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
   READINESS_POLL_MAX_CODE_CHARS: () => READINESS_POLL_MAX_CODE_CHARS,
   READ_ONLY_TAGS: () => READ_ONLY_TAGS,
   RECHECKED_NOTES: () => RECHECKED_NOTES,
   RECORDING_VALUE_PLACEHOLDERS: () => RECORDING_VALUE_PLACEHOLDERS,
+  RENDER_IDENTITY_MAX_LENGTH: () => RENDER_IDENTITY_MAX_LENGTH,
   REPOSITORY_CLIS: () => REPOSITORY_CLIS,
   RESERVED_PROJECT_KEYS: () => RESERVED_PROJECT_KEYS,
   RESULT_STRUCTURE_TOO_COSTLY_CODE: () => RESULT_STRUCTURE_TOO_COSTLY_CODE,
   RETRIED_ATTEMPTS_KEY: () => RETRIED_ATTEMPTS_KEY,
+  RETRY_HELD_RUN_ERROR: () => RETRY_HELD_RUN_ERROR,
   RUNNER_INTERRUPT_ERROR_PREFIX: () => RUNNER_INTERRUPT_ERROR_PREFIX,
   RUN_INTERRUPTED_ERROR_PREFIXES: () => RUN_INTERRUPTED_ERROR_PREFIXES,
   RUN_INTERRUPTION_NOT_RETRIED_MARKERS: () => RUN_INTERRUPTION_NOT_RETRIED_MARKERS,
@@ -18828,6 +20106,8 @@ __export(dist_exports, {
   SHARED_SERVER_APPLICATION_NAME: () => SHARED_SERVER_APPLICATION_NAME,
   SPEND_SOURCE_KEY: () => SPEND_SOURCE_KEY,
   SPEND_SOURCE_SERVER: () => SPEND_SOURCE_SERVER,
+  STATED_LIMITS_VERSION: () => STATED_LIMITS_VERSION,
+  STATED_PATTERN_MAX: () => STATED_PATTERN_MAX,
   STATIC_STANDARD_MIN_INTERACTIVE: () => STATIC_STANDARD_MIN_INTERACTIVE,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   SUCCESS_NOTICE_TEXT: () => SUCCESS_NOTICE_TEXT,
@@ -18844,6 +20124,7 @@ __export(dist_exports, {
   SURVEY_NOTES_RENDER_MAX_CHARS: () => SURVEY_NOTES_RENDER_MAX_CHARS,
   SURVEY_NOTE_KEYS: () => SURVEY_NOTE_KEYS,
   SUSPICIOUS_PASS_TAG: () => SUSPICIOUS_PASS_TAG,
+  TEST_DID_NOT_RUN_ERROR: () => TEST_DID_NOT_RUN_ERROR,
   TEST_QUALITY_CONVENTIONS: () => TEST_QUALITY_CONVENTIONS,
   TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TEST_VARIABLE_SECRET_KEY_PATTERN: () => TEST_VARIABLE_SECRET_KEY_PATTERN,
@@ -18856,23 +20137,33 @@ __export(dist_exports, {
   UI_VARIANTS: () => UI_VARIANTS,
   UNEXPECTED_PASS_ERROR_PREFIX: () => UNEXPECTED_PASS_ERROR_PREFIX,
   USER_CANCELLED_RUN_ERROR: () => USER_CANCELLED_RUN_ERROR,
+  VISUAL_MASK_SELECTORS_MAX: () => VISUAL_MASK_SELECTORS_MAX,
+  VISUAL_MASK_SELECTOR_FORBIDDEN: () => VISUAL_MASK_SELECTOR_FORBIDDEN,
+  VISUAL_MASK_SELECTOR_MAX_LENGTH: () => VISUAL_MASK_SELECTOR_MAX_LENGTH,
+  VISUAL_V1_IDENTITY: () => VISUAL_V1_IDENTITY,
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
+  ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
+  ZAI_PREFIX: () => ZAI_PREFIX,
+  accountServesModel: () => accountServesModel,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
+  allowedProviderChainHosts: () => allowedProviderChainHosts,
   alternatesAtTop: () => alternatesAtTop,
   analyzeDerivedValues: () => analyzeDerivedValues,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   analyzePersistenceReread: () => analyzePersistenceReread,
   analyzeReadinessPolling: () => analyzeReadinessPolling,
+  analyzeRegexMatchers: () => analyzeRegexMatchers,
   analyzeSharedAccountUse: () => analyzeSharedAccountUse,
   analyzeStaleAfterSubmit: () => analyzeStaleAfterSubmit,
   analyzeTestData: () => analyzeTestData,
   analyzeUnreachedUrlWaits: () => analyzeUnreachedUrlWaits,
   analyzeUrlWaits: () => analyzeUrlWaits,
   analyzeWriteResponse: () => analyzeWriteResponse,
+  androidResourceOwners: () => androidResourceOwners,
   apiModelCardsFromConfig: () => apiModelCardsFromConfig,
   apiModelsForProvider: () => apiModelsForProvider,
   apiProviderModelLabel: () => apiProviderModelLabel,
@@ -18883,6 +20174,7 @@ __export(dist_exports, {
   applyLaunchSpecialPlan: () => applyLaunchSpecialPlan,
   asPlainExpect: () => asPlainExpect,
   assertionOnlyCode: () => assertionOnlyCode,
+  assertionStrengthHoistedReadsOn: () => assertionStrengthHoistedReadsOn,
   assertionsReadVisibleContent: () => assertionsReadVisibleContent,
   assessCodeOutcomeCoverage: () => assessCodeOutcomeCoverage,
   assessTitleCoverage: () => assessTitleCoverage,
@@ -18966,6 +20258,7 @@ __export(dist_exports, {
   deepgramSpeak: () => deepgramSpeak,
   deepgramTranscribe: () => deepgramTranscribe,
   defaultConfirmModel: () => defaultConfirmModel,
+  defaultProviderChainEntries: () => defaultProviderChainEntries,
   defaultScreenModel: () => defaultScreenModel,
   defaultVoiceForTtsModel: () => defaultVoiceForTtsModel,
   deriveAuthPlan: () => deriveAuthPlan,
@@ -19008,6 +20301,7 @@ __export(dist_exports, {
   extractOutcomeSearchTerms: () => extractOutcomeSearchTerms,
   featureForAiCallType: () => featureForAiCallType,
   featureForMcpTool: () => featureForMcpTool,
+  featureRowRunStatus: () => featureRowRunStatus,
   findBracedClause: () => findBracedClause,
   findCounterIdPins: () => findCounterIdPins,
   findCredentialTextLeftover: () => findCredentialTextLeftover,
@@ -19030,6 +20324,7 @@ __export(dist_exports, {
   formatPersistenceRereadAdvisory: () => formatPersistenceRereadAdvisory,
   formatPoolBudgetLine: () => formatPoolBudgetLine,
   formatReadinessPollAdvisory: () => formatReadinessPollAdvisory,
+  formatRegexMatcherNote: () => formatRegexMatcherNote,
   formatStaleAfterSubmitAdvisory: () => formatStaleAfterSubmitAdvisory,
   formatSuspiciousExpectation: () => formatSuspiciousExpectation,
   formatUrlWaitAdvisory: () => formatUrlWaitAdvisory,
@@ -19055,6 +20350,7 @@ __export(dist_exports, {
   getPlanChangeType: () => getPlanChangeType,
   getPlanDefinition: () => getPlanDefinition,
   getPlanLabel: () => getPlanLabel,
+  getProviderChainOverrides: () => getProviderChainOverrides,
   getTrialDaysRemaining: () => getTrialDaysRemaining,
   googleBrokerNavigationUrl: () => googleBrokerNavigationUrl,
   googleBrokerUnavailableLine: () => googleBrokerUnavailableLine,
@@ -19071,9 +20367,11 @@ __export(dist_exports, {
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
+  hasProviderChainLeadsByDefault: () => hasProviderChainLeadsByDefault,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
+  hasZaiPrefix: () => hasZaiPrefix,
   healMobileTestSteps: () => healMobileTestSteps,
   healthRunWhere: () => healthRunWhere,
   heldCodeRecord: () => heldCodeRecord,
@@ -19095,8 +20393,11 @@ __export(dist_exports, {
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isBrowserCliEngine: () => isBrowserCliEngine,
+  isBrowserVersion: () => isBrowserVersion,
   isBugTestBrokenError: () => isBugTestBrokenError,
+  isCancelledReason: () => isCancelledReason,
   isCanvasUnsupportedMessage: () => isCanvasUnsupportedMessage,
+  isChainablePrimary: () => isChainablePrimary,
   isCliEngineModelId: () => isCliEngineModelId,
   isCliEngineSpec: () => isCliEngineSpec,
   isCodeFactNote: () => isCodeFactNote,
@@ -19120,6 +20421,7 @@ __export(dist_exports, {
   isIdentityMobileXpath: () => isIdentityMobileXpath,
   isIdentityProviderSurface: () => isIdentityProviderSurface,
   isIncidentalAssetPath: () => isIncidentalAssetPath,
+  isIntentionalNegativeAuthTest: () => isIntentionalNegativeAuthTest,
   isIpOrLocalhost: () => isIpOrLocalhost,
   isKnownPageType: () => isKnownPageType,
   isLaunchSpecialActive: () => isLaunchSpecialActive,
@@ -19147,6 +20449,7 @@ __export(dist_exports, {
   isRunInterruptedError: () => isRunInterruptedError,
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
+  isSafeMaskSelector: () => isSafeMaskSelector,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
   isSelectableApiModel: () => isSelectableApiModel,
   isSelfServePlan: () => isSelfServePlan,
@@ -19177,6 +20480,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  isZaiModelId: () => isZaiModelId,
   jsEscapedForms: () => jsEscapedForms,
   jsonStructureRefusalOf: () => jsonStructureRefusalOf,
   jsonStructureVerify: () => jsonStructureVerify,
@@ -19209,6 +20513,7 @@ __export(dist_exports, {
   normalizeFinishReason: () => normalizeFinishReason,
   normalizeNoteText: () => normalizeNoteText,
   normalizePageType: () => normalizePageType,
+  normalizeProviderAccountModels: () => normalizeProviderAccountModels,
   normalizeTtsModel: () => normalizeTtsModel,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   noteChatFailover: () => noteChatFailover,
@@ -19225,6 +20530,7 @@ __export(dist_exports, {
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
+  parseAuthSessionStamp: () => parseAuthSessionStamp,
   parseBoolFlag: () => parseBoolFlag,
   parseDbPoolSize: () => parseDbPoolSize,
   parseDeepgramListenResponse: () => parseDeepgramListenResponse,
@@ -19232,13 +20538,18 @@ __export(dist_exports, {
   parseGeminiModelsPayload: () => parseGeminiModelsPayload,
   parseGoogleAuthorizeUrl: () => parseGoogleAuthorizeUrl,
   parseGoogleGisRequestUrl: () => parseGoogleGisRequestUrl,
+  parseLastActionProofMode: () => parseLastActionProofMode,
   parseLimitParam: () => parseLimitParam,
   parseOffsetParam: () => parseOffsetParam,
   parsePageParam: () => parsePageParam,
   parsePgIntSetting: () => parsePgIntSetting,
   parseProjectEngineOverrides: () => parseProjectEngineOverrides,
   parsePromotionGateMode: () => parsePromotionGateMode,
+  parseProviderAccountLists: () => parseProviderAccountLists,
+  parseProviderChainOverrides: () => parseProviderChainOverrides,
   parseRecheckClearMode: () => parseRecheckClearMode,
+  parseRenderIdentity: () => parseRenderIdentity,
+  parseStoredProviderChainOverrides: () => parseStoredProviderChainOverrides,
   parseSurveyEntryUrls: () => parseSurveyEntryUrls,
   parseSuspiciousPassMode: () => parseSuspiciousPassMode,
   parseTaskModelUpdate: () => parseTaskModelUpdate,
@@ -19268,13 +20579,20 @@ __export(dist_exports, {
   profileKeyRoute: () => profileKeyRoute,
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
+  providerChainHostOf: () => providerChainHostOf,
+  providerChainHostProvider: () => providerChainHostProvider,
+  providerChainLeadsFor: () => providerChainLeadsFor,
+  providerChainModelKey: () => providerChainModelKey,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
+  providerHostPlan: () => providerHostPlan,
+  readBalanced: () => readBalanced,
   readChatFailover: () => readChatFailover,
   readChatReasoningTokens: () => readChatReasoningTokens,
   readChatUsage: () => readChatUsage,
   readEnabledEngines: () => readEnabledEngines,
   readProjectEngineOverrides: () => readProjectEngineOverrides,
   readRetriedAttempts: () => readRetriedAttempts,
+  readStatedLimits: () => readStatedLimits,
   readStaticPageCanvasSignals: () => readStaticPageCanvasSignals,
   readSurveyEntryUrls: () => readSurveyEntryUrls,
   readSurveyNotes: () => readSurveyNotes,
@@ -19287,6 +20605,7 @@ __export(dist_exports, {
   regexLiteralEnd: () => regexLiteralEnd2,
   regexOpensAfter: () => regexOpensAfter,
   registrableDomain: () => registrableDomain,
+  renderIdentity: () => renderIdentity,
   renderSurveyNotesForPrompt: () => renderSurveyNotesForPrompt,
   repairPageType: () => repairPageType,
   replaceBlockComments: () => replaceBlockComments,
@@ -19334,11 +20653,14 @@ __export(dist_exports, {
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
   setAgenticCliRuntime: () => setAgenticCliRuntime,
+  setProviderChainOverrides: () => setProviderChainOverrides,
   signupPlanFor: () => signupPlanFor,
   simplifyMobileWanderingInPlace: () => simplifyMobileWanderingInPlace,
   siteOf: () => siteOf,
   specItemsFromTestPlans: () => specItemsFromTestPlans,
   splitAnswerLines: () => splitAnswerLines,
+  statedLimitsFromAttrs: () => statedLimitsFromAttrs,
+  statedLimitsRecord: () => statedLimitsRecord,
   stepAppliesToPlatform: () => stepAppliesToPlatform,
   stepConsoleLines: () => stepConsoleLines,
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
@@ -19350,7 +20672,11 @@ __export(dist_exports, {
   stripCodeFactPrefix: () => stripCodeFactPrefix,
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
+  stripFractionZeros: () => stripFractionZeros,
+  stripLineComment: () => stripLineComment,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingChars: () => stripTrailingChars,
+  stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
@@ -19367,10 +20693,14 @@ __export(dist_exports, {
   ttsFallbackModel: () => ttsFallbackModel,
   ttsProviderForModel: () => ttsProviderForModel,
   unexpectedPassError: () => unexpectedPassError,
+  v1RenderIdentity: () => v1RenderIdentity,
   validateAppMapDocument: () => validateAppMapDocument,
   validateAssertionStrength: () => validateAssertionStrength,
   validateEngineSpec: () => validateEngineSpec,
+  validateProviderChainEntries: () => validateProviderChainEntries,
+  validateProviderChainsSetting: () => validateProviderChainsSetting,
   validateTaskModelId: () => validateTaskModelId,
+  visualBaselinesEnabled: () => visualBaselinesEnabled,
   visualProDailyBudget: () => visualProDailyBudget,
   voiceMatchesTtsModel: () => voiceMatchesTtsModel,
   voicesForTtsModel: () => voicesForTtsModel,
@@ -19378,7 +20708,8 @@ __export(dist_exports, {
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
   withoutServerOnlySpendFields: () => withoutServerOnlySpendFields,
-  withoutSurveyNotes: () => withoutSurveyNotes
+  withoutSurveyNotes: () => withoutSurveyNotes,
+  zaiWireModel: () => zaiWireModel
 });
 var init_dist = __esm({
   "../shared/dist/index.js"() {
@@ -19420,6 +20751,7 @@ var init_dist = __esm({
     init_admin_view_return_to();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_session_stamp();
     init_auth_state_freshness();
     init_skip_coverage_detector();
     init_feature_coverage();
@@ -19431,11 +20763,14 @@ var init_dist = __esm({
     init_deepgram_voices();
     init_feature_flags();
     init_env_flags();
+    init_visual_compare_limits();
+    init_visual_baseline_identity();
     init_analytics_url();
     init_agentic_cli_runtime();
     init_api_model_catalog();
     init_engine_spec();
     init_provider_chains();
+    init_provider_accounts();
     init_project_engine_overrides();
     init_ai_profiles();
     init_openrouter_usage();
@@ -19476,6 +20811,8 @@ var init_dist = __esm({
     init_promotion_quality_gate();
     init_regex_alternation();
     init_page_evidence();
+    init_trailing_slashes();
+    init_stated_limits();
   }
 });
 
@@ -19614,7 +20951,7 @@ var require_repo_brief = __commonJS({
       const signupJobs = brief.jobs.filter((job) => /sign.?up|register|create account/i.test(`${job.name} ${job.entry}`));
       return signupJobs.some((job) => job.validationRules.some(rejectsPlus)) || (brief.applicationFacts ?? []).some((fact) => /sign.?up|register|create account/i.test(fact.area) && rejectsPlus(`${fact.behavior} ${fact.testImplication}`));
     }
-    var KINDS = /* @__PURE__ */ new Set(["happy_path", "validation", "permission", "edge_case", "bug_risk"]);
+    var KINDS2 = /* @__PURE__ */ new Set(["happy_path", "validation", "permission", "edge_case", "bug_risk"]);
     var SESSIONS = /* @__PURE__ */ new Set(["none", "optional", "required"]);
     var FACT_KINDS = /* @__PURE__ */ new Set(["workflow", "business_rule", "state_transition", "permission", "integration", "data_model"]);
     var MISSING_REASON = "cited by the reader without a reason";
@@ -19727,7 +21064,7 @@ var require_repo_brief = __commonJS({
             const scenarioRefs = refs(scenario.sourceRefs);
             if (typeof scenarioName !== "string" || typeof expected !== "string" || scenarioRefs.length === 0)
               continue;
-            if (typeof kind !== "string" || !KINDS.has(kind))
+            if (typeof kind !== "string" || !KINDS2.has(kind))
               continue;
             scenarios.push({
               name: scenarioName.trim().slice(0, 160),
@@ -19911,6 +21248,7 @@ var require_route_manifest = __commonJS({
     exports2.renderRouteManifestChecklist = renderRouteManifestChecklist;
     exports2.renderRepoReadsChecklist = renderRepoReadsChecklist;
     exports2.buildRepoReadsRouteAllowlist = buildRepoReadsRouteAllowlist;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var promises_1 = require("fs/promises");
     var node_path_1 = require("path");
     var untrusted_knowledge_js_1 = require_untrusted_knowledge();
@@ -19926,7 +21264,7 @@ var require_route_manifest = __commonJS({
       return `routes-${n}.json`;
     }
     var AUTH_HINTS = /* @__PURE__ */ new Set(["public", "auth", "unknown"]);
-    var KINDS = /* @__PURE__ */ new Set(["page", "api", "redirect"]);
+    var KINDS2 = /* @__PURE__ */ new Set(["page", "api", "redirect"]);
     var COMPLETENESS = /* @__PURE__ */ new Set(["complete", "partial", "unsupported"]);
     var PROVENANCES = /* @__PURE__ */ new Set(["cli", "file-convention", "route-config"]);
     function str(value, max) {
@@ -19965,7 +21303,7 @@ var require_route_manifest = __commonJS({
     }
     function collapsePath(path) {
       const collapsed = path.replace(/\/{2,}/g, "/");
-      return collapsed.length > 1 ? collapsed.replace(/\/+$/, "") : collapsed;
+      return collapsed.length > 1 ? (0, shared_1.stripTrailingSlashes)(collapsed) : collapsed;
     }
     function normalizeManifestPath(raw) {
       const text = str(raw, 500);
@@ -20033,7 +21371,7 @@ var require_route_manifest = __commonJS({
         if (seenFamilies.has(family)) {
           const kept = routes.find((r2) => manifestRouteFamilyKey(r2.concretePath ?? r2.pattern ?? "") === family);
           const more = strList(rr.methods, 8, 10).map((m) => m.toUpperCase()).filter((m) => /^[A-Z]{3,10}$/.test(m));
-          const rowKind = KINDS.has(rr.kind) ? rr.kind : normalized.startsWith("/api/") ? "api" : "page";
+          const rowKind = KINDS2.has(rr.kind) ? rr.kind : normalized.startsWith("/api/") ? "api" : "page";
           if (kept?.kind === "api" && rowKind === "api" && more.length) {
             kept.methods = [.../* @__PURE__ */ new Set([...kept.methods ?? [], ...more])].slice(0, 8);
           } else {
@@ -20047,7 +21385,7 @@ var require_route_manifest = __commonJS({
         }
         seenFamilies.add(family);
         index += 1;
-        const kind = KINDS.has(rr.kind) ? rr.kind : normalized.startsWith("/api/") ? "api" : "page";
+        const kind = KINDS2.has(rr.kind) ? rr.kind : normalized.startsWith("/api/") ? "api" : "page";
         const authHint = AUTH_HINTS.has(rr.authHint) ? rr.authHint : "unknown";
         const methods = strList(rr.methods, 8, 10).map((m) => m.toUpperCase()).filter((m) => /^[A-Z]{3,10}$/.test(m));
         const sourceCheck = rr.sourceCheck === "matched" || rr.sourceCheck === "unmatched" ? rr.sourceCheck : void 0;
@@ -20303,6 +21641,7 @@ var require_exploration_parser = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.extractCodeLines = extractCodeLines;
     exports2.extractProvenLocator = extractProvenLocator;
+    exports2.maskTypedValues = maskTypedValues;
     exports2.sanitizePromptCodeLine = sanitizePromptCodeLine;
     exports2.extractPageUrl = extractPageUrl;
     exports2.extractPageTitle = extractPageTitle;
@@ -20314,9 +21653,10 @@ var require_exploration_parser = __commonJS({
     exports2.normalizeRouteForFocusScope = normalizeRouteForFocusScope;
     exports2.routeIsWithinFocusAreas = routeIsWithinFocusAreas;
     exports2.detectRouteFromResponse = detectRouteFromResponse;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function extractCodeLines(toolResultContent) {
       const isPlaywrightLine = (l) => l.startsWith("await page.") || l.startsWith("await expect(");
-      const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n([\s\S]*?)(?=\n###|\n$|$)/);
+      const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n(?![^\S\n]*\n)([\s\S]*?)(?=\n###|\n$|$)/);
       if (codeSection) {
         return codeSection[1].split("\n").map((l) => l.trim()).filter(isPlaywrightLine).map((l) => l.replace(/;$/, ""));
       }
@@ -20360,7 +21700,7 @@ var require_exploration_parser = __commonJS({
           cut = idx;
       }
       let locator = cut > start ? codeLine.slice(start, cut) : codeLine.slice(start);
-      locator = locator.trim().replace(/;+\s*$/, "").trim();
+      locator = locator.trim().replace(/(?<!;);+\s*$/, "").trim();
       if (!locator.includes("("))
         return null;
       if (!/^(getBy\w+|locator)\(/.test(locator))
@@ -20440,13 +21780,16 @@ var require_exploration_parser = __commonJS({
         return false;
       return RECORD_TITLE_WITH_COMPANY.test(name);
     }
+    var TYPED_VALUE_CALL_RE = /\.(fill|type|pressSequentially|insertText)\(\s*(['"])(?:\\.|(?!\2)[^\\])*\2(\s*,\s*\{[^{}]*\})?\s*\)/g;
+    function maskTypedValues(codeLine, mask) {
+      return codeLine.replace(TYPED_VALUE_CALL_RE, (_all, method, _quote, options) => `.${method}(${mask}${options ?? ""})`);
+    }
     function sanitizePromptCodeLine(codeLine) {
       let sanitized = codeLine;
       sanitized = sanitized.replace(/getByRole\('(textbox|searchbox|combobox|spinbutton)',\s*\{\s*name:\s*['"]([^'"]*)['"]\s*\}\)/g, (match, role, name, _offset, line) => looksDynamicFieldLabel(name, line) ? `getByRole('${role}')` : match);
       sanitized = sanitized.replace(/getByLabel\(\s*(['"])([^'"]*)\1\s*\)(?=\)?\.(?:fill|type|toHaveValue|inputValue|press)\()/g, (match, _quote, label, _offset, line) => looksDynamicFieldLabel(label, line) ? "getByRole('textbox')" : match);
       sanitized = sanitized.replace(/getByLabel\(\s*(['"])([^'"]*)\1\s*\)(?=\)?\.selectOption\()/g, (match, _quote, label, _offset, line) => looksDynamicFieldLabel(label, line) ? "getByRole('combobox')" : match);
-      sanitized = sanitized.replace(/\.fill\(\s*(['"]).*?\1\s*\)/g, ".fill('<test-value>')");
-      sanitized = sanitized.replace(/\.type\(\s*(['"]).*?\1\s*\)/g, ".type('<test-value>')");
+      sanitized = maskTypedValues(sanitized, "'<test-value>'");
       sanitized = sanitized.replace(/\.toHaveValue\(\s*(['"]).*?\1\s*\)/g, ".toHaveValue(/./)");
       sanitized = sanitized.replace(/getByRole\('heading',\s*\{\s*name:\s*'([^']*)'\s*\}\)/g, (match, name) => looksDynamicRecordTitle(name) ? "getByRole('heading')" : match);
       sanitized = sanitized.replace(/getByRole\('heading',\s*\{\s*name:\s*"([^"]*)"\s*\}\)/g, (match, name) => looksDynamicRecordTitle(name) ? "getByRole('heading')" : match);
@@ -20470,7 +21813,7 @@ var require_exploration_parser = __commonJS({
       return match ? match[1].trim() : null;
     }
     function extractSnapshotSection(content) {
-      const match = content.match(/###\s*Snapshot\s*\n([\s\S]*?)(?=\n###|$)/);
+      const match = content.match(/###\s*Snapshot\s*\n(?![^\S\n]*\n)([\s\S]*?)(?=\n###|$)/);
       if (!match)
         return null;
       if (/^\s*- \[Snapshot\]\([^)\n]*\)\s*$/.test(match[1]))
@@ -20538,7 +21881,7 @@ var require_exploration_parser = __commonJS({
       return hints;
     }
     function extractFirstAlert(snapshotYaml) {
-      const match = snapshotYaml.match(/^\s*-\s+(?:alert|status)\s+"([^"]+)"/m);
+      const match = snapshotYaml.match(/^[^\S\n\r\u2028\u2029]*-\s+(?:alert|status)\s+"([^"]+)"/m);
       return match ? match[1] : null;
     }
     function buildInteractionLogEntry(toolName, toolArgs, codeLines, pageUrl, pageTitle, snapshotSection) {
@@ -20579,6 +21922,12 @@ var require_exploration_parser = __commonJS({
         return /^\d{10,}$/.test(value);
       return false;
     }
+    function hashRouterPathWithoutTrailingSlash(hash) {
+      const q = hash.indexOf("?");
+      const path = q < 0 ? hash : hash.slice(0, q);
+      const stripped = (0, shared_1.stripTrailingSlashes)(path);
+      return stripped === "#" || stripped === "" ? hash : stripped + (q < 0 ? "" : hash.slice(q));
+    }
     function normalizeRoute(url) {
       let route = url.pathname;
       const encodeQueryPart = (part) => part.replace(/[%&=#+?]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
@@ -20597,7 +21946,7 @@ var require_exploration_parser = __commonJS({
         }
       }
       if (url.hash && url.hash !== "#" && url.hash !== "#/") {
-        route += url.hash;
+        route += url.hash.startsWith("#/") ? hashRouterPathWithoutTrailingSlash(url.hash) : url.hash;
       }
       return route;
     }
@@ -20607,7 +21956,7 @@ var require_exploration_parser = __commonJS({
       const decoded = raw.replace(/&amp;/g, "&").replace(/&#(\d+);/g, (_m, code) => String.fromCharCode(Number(code)));
       try {
         const url = new URL(decoded, "http://canonical.invalid");
-        url.pathname = url.pathname.replace(/\/+$/, "") || "/";
+        url.pathname = (0, shared_1.stripTrailingSlashes)(url.pathname) || "/";
         return normalizeRoute(url);
       } catch {
         return decoded;
@@ -20639,9 +21988,9 @@ var require_exploration_parser = __commonJS({
       const text = String(route ?? "").trim();
       const at = text.indexOf("#/");
       if (at < 0)
-        return text.startsWith("#") ? text.split("?")[0].toLowerCase().replace(/\/+$/, "") : null;
+        return text.startsWith("#") ? (0, shared_1.stripTrailingSlashes)(text.split("?")[0].toLowerCase()) : null;
       const hashPath = text.slice(at).split("?")[0].toLowerCase();
-      return hashPath.length > 2 ? hashPath.replace(/\/+$/, "") || "#/" : hashPath;
+      return hashPath.length > 2 ? (0, shared_1.stripTrailingSlashes)(hashPath) || "#/" : hashPath;
     }
     function routeIsWithinFocusAreas(route, focusAreas, otherRoutes) {
       if (!focusAreas || focusAreas.length === 0)
@@ -20898,8 +22247,12 @@ var require_survey_network_guard = __commonJS({
     exports2.maskedPath = maskedPath;
     exports2.bodyKeysOf = bodyKeysOf;
     exports2.graphqlDocumentIsQueryOnly = graphqlDocumentIsQueryOnly;
+    exports2.graphqlOperationRoots = graphqlOperationRoots;
     exports2.isTokenRefreshWrite = isTokenRefreshWrite;
     exports2.isSignInPathWrite = isSignInPathWrite;
+    exports2.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports2.graphqlUrlQueriesAreReads = graphqlUrlQueriesAreReads;
+    exports2.graphqlGetMayWrite = graphqlGetMayWrite;
     exports2.writeShapedGet = writeShapedGet;
     exports2.decideSurveyRequest = decideSurveyRequest;
     exports2.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -21176,6 +22529,100 @@ var require_survey_network_guard = __commonJS({
       }
       return depth === 0 && parens === 0 && objects === 0 && sawOperation;
     }
+    function graphqlOperationRoots(text) {
+      const tokens2 = lexGraphql(text);
+      if (!tokens2)
+        return null;
+      const ops = [];
+      let depth = 0;
+      let parens = 0;
+      let objects = 0;
+      let defStart = true;
+      let kind = null;
+      let current = null;
+      let prev = "";
+      for (const tok of tokens2) {
+        const last = prev;
+        prev = tok;
+        if (tok === "(") {
+          parens++;
+          continue;
+        }
+        if (tok === ")") {
+          parens--;
+          if (parens < 0 || objects !== 0)
+            return null;
+          continue;
+        }
+        if (parens > 0) {
+          if (tok === "{")
+            objects++;
+          else if (tok === "}") {
+            objects--;
+            if (objects < 0)
+              return null;
+          }
+          continue;
+        }
+        if (tok === "{") {
+          if (depth === 0) {
+            if (defStart)
+              kind = "query";
+            else if (kind === null)
+              return null;
+            current = kind === "fragment" ? null : { kind, roots: [] };
+            if (current)
+              ops.push(current);
+            defStart = false;
+          }
+          depth++;
+          continue;
+        }
+        if (tok === "}") {
+          depth--;
+          if (depth < 0)
+            return null;
+          if (depth === 0) {
+            defStart = true;
+            kind = null;
+            current = null;
+          }
+          continue;
+        }
+        if (depth === 0) {
+          if (!/^[_A-Za-z]/.test(tok)) {
+            if (tok === "@")
+              continue;
+            return null;
+          }
+          if (defStart) {
+            if (tok !== "query" && tok !== "mutation" && tok !== "fragment")
+              return null;
+            kind = tok;
+            defStart = false;
+          }
+          continue;
+        }
+        if (depth > 1 || !current)
+          continue;
+        if (/^[_A-Za-z]/.test(tok)) {
+          if (last === "@")
+            continue;
+          if (last === ":") {
+            if (current.roots.length === 0)
+              return null;
+            current.roots[current.roots.length - 1] = tok;
+            continue;
+          }
+          current.roots.push(tok);
+          continue;
+        }
+        if (tok === ":" || tok === "@")
+          continue;
+        return null;
+      }
+      return depth === 0 && parens === 0 && objects === 0 ? ops : null;
+    }
     function isGraphqlQueryOnly(postData) {
       if (!postData || postData.length > MAX_BODY_CHARS)
         return false;
@@ -21213,6 +22660,34 @@ var require_survey_network_guard = __commonJS({
       "remove"
     ]);
     var NOT_A_SESSION_END = (segs) => !segs.some((seg) => SESSION_END_SEGMENTS.has(seg));
+    var DESTRUCTIVE_WORDS = /* @__PURE__ */ new Set([
+      "delete",
+      "remove",
+      "destroy",
+      "deactivate",
+      "terminate",
+      "purge",
+      "wipe",
+      "erase",
+      "cancel",
+      "close",
+      "revoke",
+      "unlink",
+      "disconnect"
+    ]);
+    var DESTRUCTIVE_PREFIXES = ["delete", "remove", "destroy", "deactivate", "terminate", "purge"];
+    function hasDestructiveSegment(rawSegs) {
+      return rawSegs.some((raw) => {
+        let seg = raw;
+        try {
+          seg = decodeURIComponent(raw);
+        } catch {
+        }
+        const words = seg.replace(/([a-z0-9])([A-Z])/g, "$1 $2").toLowerCase().split(/[^a-z0-9]+/);
+        return words.some((word) => DESTRUCTIVE_WORDS.has(word) || DESTRUCTIVE_PREFIXES.some((p) => word.startsWith(p)));
+      });
+    }
+    var rawPathSegments = (pathname) => pathname.split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     var pathSegments = (pathname) => pathname.toLowerCase().split("/").map((seg) => seg.split(";")[0]).filter(Boolean);
     function isTokenRefreshWrite(method, pathname, recentAction = false) {
       if (method.toUpperCase() !== "POST")
@@ -21229,6 +22704,8 @@ var require_survey_network_guard = __commonJS({
     var AUTH_PAGE_PATH_RE = /(?:^|\/)(?:log-?in|sign-?in|sign_in|auth|oauth2?|sso|callback)(?:\/|$)/;
     var SIGN_IN_SEGMENT_RE = /^(?:log-?in|sign-?in|sign_in)$/;
     var CALLBACK_ROOT_SEGMENTS = /* @__PURE__ */ new Set(["auth", "oauth", "oauth2", "sso"]);
+    var CALLBACK_PROTOCOL_SEGMENTS = /* @__PURE__ */ new Set(["oidc", "openid", "openid-connect", "openidconnect", "saml", "saml2", "oauth", "oauth2"]);
+    var API_VERSION_SEGMENT_RE = /^v[0-9]{1,3}$/;
     var PROVIDER_SEGMENT_RE = /^[a-z][a-z0-9_-]{0,39}$/;
     var NOT_A_PROVIDER_SEGMENTS = /* @__PURE__ */ new Set([
       "link",
@@ -21267,14 +22744,21 @@ var require_survey_network_guard = __commonJS({
       if (!NOT_A_SESSION_END(segs))
         return false;
       if (AUTH_END_PATH_RE.test(`/${segs.join("/")}`))
-        return true;
+        return !hasDestructiveSegment(rawPathSegments(pathname).slice(0, -1));
+      let top = segs[0] === "api" ? 1 : 0;
+      if (top < segs.length && API_VERSION_SEGMENT_RE.test(segs[top]))
+        top += 1;
+      const below = segs.length - top;
+      const isProvider = (seg) => PROVIDER_SEGMENT_RE.test(seg) && !NOT_A_PROVIDER_SEGMENTS.has(seg);
       const provider = segs[segs.length - 1];
-      const authRootAtTop = segs.length === 3 || segs[segs.length - 4] === "api" && (segs.length === 4 || segs[segs.length - 3] === "auth");
-      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && PROVIDER_SEGMENT_RE.test(provider) && !NOT_A_PROVIDER_SEGMENTS.has(provider)) {
+      const authRootAtTop = below === 3 || segs[segs.length - 4] === "api" && segs[segs.length - 3] === "auth";
+      if (segs.length >= 3 && authRootAtTop && CALLBACK_ROOT_SEGMENTS.has(segs[segs.length - 3]) && isProvider(provider)) {
         const step = segs[segs.length - 2];
         if (step === "callback" || step === "signin")
           return true;
       }
+      if (below === 4 && CALLBACK_ROOT_SEGMENTS.has(segs[top]) && CALLBACK_PROTOCOL_SEGMENTS.has(segs[top + 1]) && isProvider(segs[top + 2]) && segs[top + 3] === "callback")
+        return true;
       if (segs.length < 2 || segs[segs.length - 1] !== "callback")
         return false;
       const parent = segs[segs.length - 2];
@@ -21301,7 +22785,7 @@ var require_survey_network_guard = __commonJS({
       try {
         const a = new URL(url);
         const b = new URL(appBaseUrl);
-        const path = (u) => u.pathname.replace(/\/+$/, "");
+        const path = (u) => (0, shared_1.stripTrailingSlashes)(u.pathname);
         return a.origin === b.origin && path(a) === path(b);
       } catch {
         return false;
@@ -21323,9 +22807,18 @@ var require_survey_network_guard = __commonJS({
       const bodyHash = (0, node_crypto_1.createHash)("sha256").update(req.postData ?? "").digest("hex").slice(0, 16);
       return `${record.method} ${url.hostname.toLowerCase()}${url.pathname} ${bodyHash}`;
     }
-    function isGraphqlGetWrite(url, s) {
-      const doc = url.searchParams.get("query");
-      return doc !== null && isGraphqlEndpoint(url, s) && !graphqlDocumentIsQueryOnly(doc);
+    function graphqlUrlCarriesQuery(params) {
+      return params.has("query");
+    }
+    function graphqlUrlQueriesAreReads(params) {
+      return params.getAll("query").every((doc) => doc.trim() !== "" && graphqlDocumentIsQueryOnly(doc));
+    }
+    function graphqlGetMayWrite(url, body) {
+      const docs = url.searchParams.getAll("query");
+      return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
+    }
+    function isGraphqlGetWrite(url, s, body) {
+      return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
     exports2.WRITE_VERBS = /* @__PURE__ */ new Set([
       "cancel",
@@ -21529,7 +23022,7 @@ var require_survey_network_guard = __commonJS({
       if (url.protocol !== "http:" && url.protocol !== "https:")
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
-      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s);
+      const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
       const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
@@ -21563,7 +23056,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && graphqlUrlQueriesAreReads(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -21595,7 +23088,7 @@ var require_survey_network_guard = __commonJS({
         const re = new RegExp(pattern.source, pattern.flags.replace(/[gy]/g, ""));
         return { reason, test: (hostPath) => re.test(hostPath) };
       }
-      const p = pattern.trim().toLowerCase().replace(/\/+$/, "");
+      const p = (0, shared_1.stripTrailingSlashes)(pattern.trim().toLowerCase());
       if (p.includes("/"))
         return { reason, test: (hostPath) => hostPath.toLowerCase() === p || hostPath.toLowerCase().startsWith(`${p}/`) };
       return { reason, test: (hostPath) => {
@@ -22143,6 +23636,7 @@ var require_survey_repo_route_frontier = __commonJS({
     exports2.buildRepoRouteCandidates = buildRepoRouteCandidates;
     exports2.routeIdsHiddenFromChecklist = routeIdsHiddenFromChecklist;
     exports2.parseRepoRouteCoverage = parseRepoRouteCoverage;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var route_manifest_js_1 = require_route_manifest();
     var survey_scope_js_1 = require_survey_scope();
     var repo_route_safety_js_1 = require_repo_route_safety();
@@ -22204,7 +23698,7 @@ var require_survey_repo_route_frontier = __commonJS({
         return route;
       try {
         const base = new URL(baseUrl);
-        return `${base.pathname.replace(/\/+$/, "") || "/"}${route}`;
+        return `${(0, shared_1.stripTrailingSlashes)(base.pathname) || "/"}${route}`;
       } catch {
         return `/${route}`;
       }
@@ -22435,7 +23929,7 @@ var require_survey_repo_route_frontier = __commonJS({
         try {
           const base = new URL(input.baseUrl);
           origin = base.origin;
-          basePathname = base.pathname.replace(/\/+$/, "") || "/";
+          basePathname = (0, shared_1.stripTrailingSlashes)(base.pathname) || "/";
         } catch {
           origin = null;
         }
@@ -22468,7 +23962,7 @@ var require_survey_repo_route_frontier = __commonJS({
           return null;
         if (parsed.origin !== this.appOrigin)
           return null;
-        const pathname = parsed.pathname.replace(/\/+$/, "") || "/";
+        const pathname = (0, shared_1.stripTrailingSlashes)(parsed.pathname) || "/";
         const key = manifestRouteKey(`${parsed.pathname}${parsed.search}${parsed.hash}`);
         if (!key)
           return null;
@@ -22933,6 +24427,7 @@ var require_repo_feature_verification = __commonJS({
     exports2.parseBrowserVerificationRequirement = parseBrowserVerificationRequirement;
     exports2.parseBrowserVerificationResult = parseBrowserVerificationResult;
     exports2.renderBrowserVerificationForPrompt = renderBrowserVerificationForPrompt;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_repo_route_frontier_js_1 = require_survey_repo_route_frontier();
     var ABSOLUTE_URL = /^[a-z][a-z0-9+.-]*:\/\//i;
     function originOf(url) {
@@ -22989,7 +24484,7 @@ var require_repo_feature_verification = __commonJS({
       before = before.split("?")[0];
       if (!before.startsWith("/"))
         return null;
-      return before.replace(/\/+$/, "");
+      return (0, shared_1.stripTrailingSlashes)(before);
     }
     function sameHashMount(route, entry) {
       const entryMount = hashMount(entry);
@@ -23045,7 +24540,7 @@ var require_repo_feature_verification = __commonJS({
     function compileEntryPattern(pattern) {
       const trimmed = String(pattern ?? "").trim();
       const hashAt = trimmed.indexOf("#/");
-      const raw = (hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]).replace(/\/+$/, "");
+      const raw = (0, shared_1.stripTrailingSlashes)(hashAt >= 0 || trimmed.startsWith("#") ? trimmed.slice(Math.max(hashAt, 0)).split("?")[0] : trimmed.split(/[?#]/)[0]);
       if (!isEntrySpelling(raw) || raw.length > 500)
         return null;
       let out = "";