@validate.qa/runner 1.0.100 → 1.0.102

package/dist/{chunk-MBKGTELT.mjs → chunk-3JM6XTSZ.mjs}

@@ -105,13 +105,13 @@ function isBlockedEnvVar(key) {
 function sanitizeTestVariables(vars) {
   if (!vars)
     return {};
-  const clean2 = {};
+  const clean3 = {};
   for (const [key, value] of Object.entries(vars)) {
     if (!isBlockedEnvVar(key)) {
-      clean2[key] = value;
+      clean3[key] = value;
     }
   }
-  return clean2;
+  return clean3;
 }
 function buildSandboxedEnv(processEnv, testVariables) {
   const env = {};
@@ -1619,8 +1619,11 @@ var init_discovery_har_decision = __esm({
 });
 
 // ../shared/dist/run-classification.js
-function isUserCancelledError(error) {
-  return typeof error === "string" && error.trim().startsWith(USER_CANCELLED_RUN_ERROR);
+function isCancelledReason(error) {
+  if (typeof error !== "string")
+    return false;
+  const text = error.trim();
+  return CANCELLED_REASON_PREFIXES.some((prefix) => text.startsWith(prefix));
 }
 function isHeldHealRun(run) {
   return run?.status === "PASSED" && typeof run.error === "string" && run.error.startsWith(HEAL_PATCH_HELD_RUN_ERROR_PREFIX);
@@ -1653,7 +1656,7 @@ function pickLatestHealthRun(runs) {
   for (const run of runs) {
     if (run.mode === "auth-setup")
       continue;
-    if (run.status === "ERROR" && isUserCancelledError(run.error))
+    if (run.status === "ERROR" && isCancelledReason(run.error))
       continue;
     if (isHeldHealRun(run))
       continue;
@@ -1671,6 +1674,15 @@ function pickDisplayRun(runs) {
     return latest;
   return pickLatestHealthRun(runs) ?? latest;
 }
+function featureRowRunStatus(runs) {
+  const latest = runs.find((run) => run.mode !== "auth-setup");
+  if (!latest)
+    return null;
+  const decisive = pickLatestHealthRun(runs.filter((run) => !isEnvironmentalError(run)));
+  if (decisive)
+    return decisive.status;
+  return latest.status === "PENDING" || latest.status === "RUNNING" ? latest.status : null;
+}
 function isEnvironmentalError(run) {
   if (!run)
     return false;
@@ -1702,7 +1714,7 @@ function classifyErrorMessage(error) {
     return "config_issue";
   if (EMAIL_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
     return "email_not_received";
-  if (isUserCancelledError(error))
+  if (isCancelledReason(error))
     return "cancelled";
   if (isRetriedRunInterruption(error))
     return "interrupted";
@@ -1737,7 +1749,7 @@ function heldHealRunWhere() {
 function excludeCancelledRunsWhere() {
   return {
     NOT: [
-      { status: "ERROR", error: { not: null, startsWith: USER_CANCELLED_RUN_ERROR } },
+      { status: "ERROR", OR: CANCELLED_REASON_PREFIXES.map((prefix) => ({ error: { not: null, startsWith: prefix } })) },
       heldHealRunWhere()
     ]
   };
@@ -1815,11 +1827,25 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
     USER_CANCELLED_RUN_ERROR = "Cancelled by user";
+    PLATFORM_SUPPORT_CANCELLED_RUN_ERROR = "Cancelled by platform support";
+    PLATFORM_ADMIN_CANCELLED_RUN_ERROR = "Cancelled by platform admin";
+    ADMIN_FORCE_CANCELLED_RUN_ERROR = "Admin force-cancelled all active runs";
+    CHAIN_CANCELLED_RUN_ERROR = "Cancelled: parent run cancelled";
+    RETRY_HELD_RUN_ERROR = "Cancelled: auto generation paused";
+    CANCELLED_REASON_PREFIXES = [
+      USER_CANCELLED_RUN_ERROR,
+      PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
+      PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
+      ADMIN_FORCE_CANCELLED_RUN_ERROR,
+      CHAIN_CANCELLED_RUN_ERROR,
+      RETRY_HELD_RUN_ERROR
+    ];
+    isUserCancelledError = isCancelledReason;
     HEAL_PATCH_HELD_RUN_ERROR_PREFIX = "Heal patch held";
     RUNNER_INTERRUPT_ERROR_PREFIX = "Runner shutting down";
     SERVER_INTERRUPT_ERROR_PREFIX = "Run interrupted by server restart";
@@ -1835,6 +1861,7 @@ var init_run_classification = __esm({
     UNEXPECTED_PASS_ERROR_PREFIX = "UNEXPECTED_PASS:";
     BUG_TEST_BROKEN_ERROR_PREFIX = "BUG_TEST_BROKEN:";
     BUG_TEST_BROKEN_REASON = "bug test broken (not a bug verdict)";
+    TEST_DID_NOT_RUN_ERROR = "Test did not run (a dependency failed or the run was interrupted)";
     EMAIL_NOT_RECEIVED_PREFIXES = [
       "VERIFICATION_EMAIL_NOT_RECEIVED:",
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
@@ -1847,9 +1874,10 @@ var init_run_classification = __esm({
     ];
     ENVIRONMENTAL_ERROR_STORED_PREFIXES = [
       ...ENVIRONMENTAL_ERROR_PREFIXES.flatMap((prefix) => [prefix, `Error: ${prefix}`]),
-      // Written by the cancel routes as is, with no prefix wrapper.
-      USER_CANCELLED_RUN_ERROR
+      // Written by the cancels as is, with no prefix wrapper.
+      ...CANCELLED_REASON_PREFIXES
     ];
+    FEATURE_ROW_RUN_WINDOW = 10;
     BUG_SURFACE_SUPPRESSING_TAGS = ["@rate-limit-blocked", "@quota-exceeded", "@auth-lost"];
     QUARANTINE_CLOSE_TAGS = [
       "@bug-found",
@@ -2938,176 +2966,6 @@ var init_origin_domain = __esm({
   }
 });
 
-// ../shared/dist/auth-block-detector.js
-function stripEchoLines(text) {
-  return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
-}
-function matchesAny(text, patterns) {
-  return patterns.some((p) => p.test(text));
-}
-function detectAuthBlock(input) {
-  const tags = input.tags ?? [];
-  const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
-  if (!isAuthed)
-    return NO_DETECTION;
-  const meta = [input.testName, input.description].filter(Boolean).join(" ");
-  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
-    return NO_DETECTION;
-  const sources = [];
-  if (input.error)
-    sources.push(stripEchoLines(input.error));
-  if (input.logs)
-    sources.push(stripEchoLines(input.logs));
-  for (const sr of input.stepResults ?? []) {
-    if (sr.error)
-      sources.push(stripEchoLines(sr.error));
-  }
-  for (const text of sources) {
-    if (!text)
-      continue;
-    for (const sig of AUTH_BLOCK_SIGNATURES) {
-      if (sig.re.test(text)) {
-        return {
-          detected: true,
-          reason: sig.reason,
-          evidence: [`login-block signature "${sig.reason}" in: "${text.slice(0, 140).replace(/\s+/g, " ").trim()}"`]
-        };
-      }
-    }
-  }
-  return NO_DETECTION;
-}
-function detectApiColdSessionBlock(input) {
-  const tags = input.tags ?? [];
-  if (!tags.includes("@api"))
-    return NO_DETECTION;
-  const cookieMissing = input.authStateExpected && !input.authStateInjected;
-  const standingMissing = !!input.needsStandingHeaders && !input.standingHeadersInjected;
-  if (!cookieMissing && !standingMissing)
-    return NO_DETECTION;
-  const has401Status = (input.apiCalls ?? []).some((c) => c && (c.status === 401 || c.status === 403));
-  const texts = [];
-  if (input.error)
-    texts.push(input.error);
-  if (input.logs)
-    texts.push(input.logs);
-  for (const sr of input.stepResults ?? [])
-    if (sr.error)
-      texts.push(sr.error);
-  const has401Text = texts.some((t) => UNAUTHORIZED_TEXT_RE.test(t));
-  if (!has401Status && !has401Text)
-    return NO_DETECTION;
-  const missingAuth = cookieMissing ? "cold injected auth session (401/403 with no storageState)" : "missing standing auth header (401/403 with no API_AUTH_HEADERS installed)";
-  const injectedNoun = cookieMissing ? "injected session was absent/expired" : "standing auth header was not installed";
-  return {
-    detected: true,
-    reason: missingAuth,
-    evidence: [
-      has401Status ? `a captured @api call returned 401/403 while the ${injectedNoun}` : `a 401/403 signal in the run error/logs while the ${injectedNoun}`
-    ]
-  };
-}
-function coldSessionConfigMessage(context, reason, evidence) {
-  return `CONFIG_ISSUE: ${context} without valid injected auth (${reason}) \u2014 no session cookie was injected this run. Ensure the project login (auth-setup recipe / prewarm) is configured so the shared session jar warms (a project with no login: set TEST_USER_EMAIL and TEST_USER_PASSWORD in Test Data \u2192 Test Variables so a session can be captured); for endpoints that authenticate with a standing API key or bearer header instead, set them in the project's API_AUTH_HEADERS variable (injected as request headers). Evidence: ${evidence.join("; ")}`;
-}
-var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, UNAUTHORIZED_TEXT_RE;
-var init_auth_block_detector = __esm({
-  "../shared/dist/auth-block-detector.js"() {
-    "use strict";
-    NO_DETECTION = { detected: false, reason: "", evidence: [] };
-    AUTHED_TAGS = ["@needs-auth", "@inline-login"];
-    LOGIN_CTX = "\\b(?:log\\s*in|login|logging\\s+in|sign[\\s-]?in|signing\\s+in|continue)\\b";
-    AUTH_BLOCK_SIGNATURES = [
-      { reason: "incorrect password", re: /\b(incorrect|invalid|wrong|bad)\s+password\b/i },
-      { reason: "password is incorrect", re: /\bpassword\s+(is\s+)?(incorrect|invalid|wrong)\b/i },
-      { reason: "invalid credentials", re: /\b(invalid|incorrect|wrong|bad)\s+(login\s+)?credentials\b/i },
-      { reason: "credentials do not match", re: /\bcredentials\b[^\n]{0,40}\b(do(?:es)?\s*n['’]?t|do\s+not)\s+match\b/i },
-      { reason: "incorrect email or password", re: /\b(incorrect|invalid|wrong)\s+(email|username)\s+or\s+password\b/i },
-      // Require an EXPLICIT negative (codex #21): the old `(not\s+)?(confirmed|verified)` made the negation
-      // optional, so a benign "Email verified" success message / feature assertion matched and hid a real
-      // feature failure as a CONFIG_ISSUE. Only "email not (yet) confirmed/verified" or "unconfirmed/unverified".
-      { reason: "email not confirmed", re: /\b(e-?mail)\b[^\n]{0,30}\b(not\s+(?:yet\s+)?(?:confirmed|verified)|unconfirmed|unverified)\b/i },
-      { reason: "please confirm your email", re: /\bplease\s+(confirm|verify)\s+your\s+(e-?mail)\b/i },
-      // The bare "confirm/verify your email" and "account not found" phrases are ALSO ordinary feature copy
-      // ("Verify your email banner", a 404-style "Account not found" page), so they only count with a
-      // login/sign-in context on the SAME line (either side). "Please confirm/verify your email" above
-      // is already an explicit prompt and stays unconditional.
-      { reason: "confirm your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bconfirm\\s+your\\s+e-?mail\\b|\\bconfirm\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
-      { reason: "verify your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bverify\\s+your\\s+e-?mail\\b|\\bverify\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
-      {
-        reason: "account not found",
-        re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b|\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b[^\\n]{0,80}${LOGIN_CTX}`, "i")
-      },
-      { reason: "authentication failed", re: /\bauthentication\s+failed\b/i },
-      { reason: "login failed", re: /\b(login|log\s*in|sign[\s-]?in)\s+failed\b/i }
-    ];
-    INTENTIONAL_NEGATIVE_AUTH = [
-      /\b(invalid|incorrect|wrong|bad)\s+(password|credentials|email|login)\b/i,
-      /\b(negative|unhappy)\s+(login|auth|sign[\s-]?in|path|case|flow|test)\b/i,
-      // "should fail" et al must be TIED to an auth noun (codex #21): a bare `should\s+(fail|reject|deny)`
-      // exempted benign names like "Export should fail gracefully", silently disabling the anti-lockout
-      // protection for them. Require a login/auth noun on either side of the "should fail / fail to log in".
-      /\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password)\b[^\n]{0,40}\bshould\s+(fail|reject|deny)\b/i,
-      /\bshould\s+(fail|reject|deny|not\s+log(?:\s*in)?)\b[^\n]{0,40}\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password|unauthenticated)\b/i,
-      /\bfailed?\s+login\b/i,
-      /\blogin\s+(error|failure|rejected?)\b/i,
-      /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
-    ];
-    ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
-    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
-  }
-});
-
-// ../shared/dist/skip-coverage-detector.js
-function detectSkippedApiCoverage(steps) {
-  const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
-  if (allSkipped) {
-    if (steps.every((s) => s.skipKind === "fixme")) {
-      return {
-        detected: false,
-        logLine: "All @api tests skipped, but EVERY skip is a deliberate fixme (intentional N/A \u2014 e.g. a UI-only redirect login) \u2014 NOT relabelling CONFIG_ISSUE"
-      };
-    }
-    return {
-      detected: true,
-      error: (
-        // Name BOTH auth mechanisms (item 5d): the all-skipped copy used to say only "refresh the auth
-        // state", which misdirects a @auth-standing operator (whose real gap is a missing API_AUTH_HEADERS
-        // key, not a cold cookie session) to warm a login that was never the problem.
-        "CONFIG_ISSUE: Authenticated @api coverage was NOT exercised \u2014 every test skipped (cold injected session, a missing standing auth header, or an unresolved fixme). Provide the auth the endpoints need \u2014 warm the project login/session cookie (auth-setup recipe / prewarm), or set a standing API key/bearer in the project's API_AUTH_HEADERS variable \u2014 so the assertions actually run."
-      ),
-      logLine: "All @api tests skipped \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so zero authenticated coverage is visible, not silent green"
-    };
-  }
-  const runtimeSkipped = steps.filter((s) => s.status === "skipped" && s.skipKind === "skip");
-  if (runtimeSkipped.length === 0)
-    return { detected: false };
-  const reasons = [...new Set(runtimeSkipped.map((s) => `"${s.title ?? "test"}"${s.skipReason ? ` (${s.skipReason})` : ""}`))].join("; ");
-  return {
-    detected: true,
-    error: `CONFIG_ISSUE: ${runtimeSkipped.length} of ${steps.length} @api tests skipped at runtime \u2014 that coverage was NOT exercised. Skipped: ${reasons}`,
-    logLine: `${runtimeSkipped.length}/${steps.length} @api tests skipped at runtime \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so the coverage hole is visible, not silent green`
-  };
-}
-var init_skip_coverage_detector = __esm({
-  "../shared/dist/skip-coverage-detector.js"() {
-    "use strict";
-  }
-});
-
-// ../shared/dist/feature-flags.js
-function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
-  return value?.trim().toLowerCase() !== "false";
-}
-function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
-  return value?.trim().toLowerCase() !== "false";
-}
-var init_feature_flags = __esm({
-  "../shared/dist/feature-flags.js"() {
-    "use strict";
-  }
-});
-
 // ../shared/dist/repository-cli.js
 function isRepositoryCli(value) {
   return typeof value === "string" && REPOSITORY_CLIS.includes(value);
@@ -3303,9 +3161,40 @@ function semanticTarget(label, platform, base) {
     }
   };
 }
+function androidResourceOwners(value) {
+  const owners = [];
+  for (const match of value.matchAll(ANDROID_RESOURCE_ID_SUFFIX_RE)) {
+    let runStart = match.index;
+    while (runStart > 0 && /[a-z0-9_.]/i.test(value[runStart - 1]))
+      runStart--;
+    const owner = ownerAtEndOfRun(value.slice(runStart, match.index));
+    if (owner !== null)
+      owners.push(owner);
+  }
+  return owners;
+}
+function ownerAtEndOfRun(run) {
+  const segments = run.split(".");
+  const last = segments.length - 1;
+  const startsWithLetter = (segment) => /^[a-z]/i.test(segment);
+  if (last < 1 || !startsWithLetter(segments[last]))
+    return null;
+  let first = last;
+  while (first > 0 && startsWithLetter(segments[first - 1]))
+    first--;
+  let offset = 0;
+  for (let i = 0; i < first - 1; i++)
+    offset += segments[i].length + 1;
+  if (first > 0) {
+    const letterAt = segments[first - 1].search(/[a-z]/i);
+    if (letterAt >= 0)
+      return run.slice(offset + letterAt);
+    offset += segments[first - 1].length + 1;
+  }
+  return first < last ? run.slice(offset) : null;
+}
 function containsForeignAppPackage(value, targetAppId) {
-  for (const match of value.matchAll(ANDROID_RESOURCE_OWNER_RE)) {
-    const owner = match[1];
+  for (const owner of androidResourceOwners(value)) {
     if (targetAppId && owner !== targetAppId && !owner.startsWith(`${targetAppId}.`))
       return true;
   }
@@ -3442,7 +3331,7 @@ function healMobileTestSteps(input) {
     summary: changed ? uniq(summary).slice(0, 12) : []
   };
 }
-var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_OWNER_RE, COMMON_EXTERNAL_PREFIXES;
+var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_ID_SUFFIX_RE, COMMON_EXTERNAL_PREFIXES;
 var init_mobile_step_healer = __esm({
   "../shared/dist/mobile-step-healer.js"() {
     "use strict";
@@ -3463,7 +3352,7 @@ var init_mobile_step_healer = __esm({
       "assertStateDelta"
     ]);
     FOREIGN_PACKAGE_RE = /\b[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){2,}\b/gi;
-    ANDROID_RESOURCE_OWNER_RE = /([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+):id\//gi;
+    ANDROID_RESOURCE_ID_SUFFIX_RE = /:id\//gi;
     COMMON_EXTERNAL_PREFIXES = [
       "com.android.",
       "com.google.",
@@ -4499,7 +4388,7 @@ function unescapeQuotedBody(raw) {
   return raw.replace(/\\(['"`\\])/g, "$1");
 }
 function extractRoleNameValue(line) {
-  const m = line.match(new RegExp(`getByRole\\s*\\([^,]+,\\s*\\{[^}]*name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
+  const m = line.match(new RegExp(`getByRole\\s*\\([^,]{1,200},\\s*\\{[^}]{0,200}?name\\s*:\\s*(?:${QUOTED_BODY}|\\/([^/]*?)\\/)`, "i"));
   if (!m)
     return null;
   const raw = m[1] ?? m[2] ?? m[3];
@@ -4896,7 +4785,7 @@ var init_assertion_classifier = __esm({
       // toHaveCount(0) stays tier 4 (absence proof) via TIER4_PATTERNS.
       [/\.toHaveCount\s*\(\s*[1-9]\d*\s*\)/, "non-zero toHaveCount asserts a record count that changes between runs"],
       // parenthesised counts like "(3)" or "[12]" in text - but not Playwright method args
-      [/(?<!\.\w{3,20}\s*)\(\s*\d+\s*\)(?!\s*[,;]?\s*\))/i, "parenthesised count is session-specific"],
+      [/\((?<!\.\w{3,20}\s*\()\s*\d+\s*\)(?!\s*(?:[,;]\s*)?\))/i, "parenthesised count is session-specific"],
       // bare email addresses in assertion content
       [/\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b/i, "email address is user-specific"],
       // currency/balance amounts (dynamic account data)
@@ -5142,7 +5031,7 @@ var init_assertion_proof = __esm({
     PRESENCE_MATCHER = /\.(?:toBeVisible|toBeAttached|toBeEnabled|toBeInViewport|toBeEditable|toBeFocused)\s*\(|\.toHaveCount\s*\(\s*1\s*\)/;
     TEXT_MATCHER = /\.(?:toHaveText|toContainText)\s*\(/;
     ANY_VALUE_SOURCE = /^(?:\.|\\S|\\w|\\d|\[\^\\s\]|\[0-9\]|\[\\d\]|\[\\w\]|\[\\s\\S\])[+*]?\??$/;
-    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*\)/;
+    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*[,)]/;
     EMPTY_NOT_VALUE = /\.not\s*\.\s*toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/;
     TEXT_MATCHER_LITERAL = /\.(?:toHaveText|toContainText)\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
     GET_BY_TEXT_LITERAL = /getByText\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
@@ -5159,7 +5048,7 @@ var init_assertion_proof = __esm({
     DATA_ROLE = /getByRole\s*\(\s*['"`](?:dialog|alertdialog|alert|cell|gridcell|row|rowheader|columnheader|listitem|article|option|status|note|tooltip|paragraph|term|definition|log|marquee|timer|meter)['"`]/gi;
     TEXT_LOCATOR = /\.getByText\s*\(|\.filter\s*\(\s*\{\s*hasText\s*:/g;
     CSS_LOCATOR = /\.locator\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/g;
-    SPECIFIC_CSS = /\[[^\]]*=|#[\w-]|has-text|:text/;
+    SPECIFIC_CSS = /\[[^\][=]*=|#[\w-]|has-text|:text/;
   }
 });
 
@@ -5207,6 +5096,8 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
+  let prev = "";
+  let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
     if (quote) {
@@ -5214,12 +5105,24 @@ function stripCoverageComments(code) {
         i += 2;
         continue;
       }
-      if (ch === quote || ch === "\n" && quote !== "`")
+      if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
+        prev = ch === "\n" ? prev : ch;
+      }
       i++;
       continue;
     }
     const next = code[i + 1];
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+      const end = regexLiteralEnd3(code, i);
+      if (end > 0) {
+        i = end;
+        prev = "a";
+        continue;
+      }
+      const eol = code.indexOf("\n", i);
+      noRegexBefore = eol === -1 ? code.length : eol;
+    }
     if (ch === "/" && next === "*") {
       const end = code.indexOf("*/", i + 2);
       const stop = end === -1 ? code.length : end + 2;
@@ -5238,11 +5141,39 @@ function stripCoverageComments(code) {
     }
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
+    if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
+      prev = ch;
     i++;
   }
   out.push(code.slice(copyFrom));
   return out.join("");
 }
+function regexLiteralEnd3(code, start) {
+  let inClass = false;
+  for (let j = start + 1; j < code.length; j++) {
+    const c = code[j];
+    if (c === "\n")
+      return -1;
+    if (c === "\\") {
+      j++;
+      continue;
+    }
+    if (inClass) {
+      if (c === "]")
+        inClass = false;
+      continue;
+    }
+    if (c === "[")
+      inClass = true;
+    else if (c === "/") {
+      let k = j + 1;
+      while (k < code.length && isIdentChar(code[k]))
+        k++;
+      return k;
+    }
+  }
+  return -1;
+}
 function isIdentChar(ch) {
   if (!ch)
     return false;
@@ -5900,7 +5831,7 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
@@ -5937,6 +5868,7 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
+    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -6080,22 +6012,37 @@ function classifyAuthHandoffIntent(text) {
 function withoutIdpUrlAsserts(code) {
   return code.replace(/\.(?:toHaveURL|waitForURL)\s*\((?:[^)(]|\([^)]*\))*\)/g, (match) => /accountchooser|accounts\.google|appleid\.apple|login\.microsoftonline|\/v\d+\/signin|oauth/i.test(match) ? "" : match);
 }
+function stripLineComment(line) {
+  let from = line.length;
+  while (from > 0) {
+    const c = line.charCodeAt(from - 1);
+    if (c === 10 || c === 13 || c === 8232 || c === 8233)
+      break;
+    from--;
+  }
+  const at = line.indexOf("//", from);
+  return at < 0 ? line : line.slice(0, at);
+}
 function stripComments(code) {
-  return replaceBlockComments(code, () => "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
+  return replaceBlockComments(code, () => "").split("\n").map(stripLineComment).join("\n");
 }
-function balancedCall(code, start) {
-  const open = code.indexOf("(", start);
-  if (open < 0)
-    return null;
-  let depth = 0;
-  for (let i = open; i < code.length; i++) {
+function closingParens(code) {
+  const close = new Int32Array(code.length).fill(-1);
+  const open = [];
+  for (let i = 0; i < code.length; i++) {
     const c = code[i];
     if (c === "(")
-      depth++;
-    else if (c === ")" && --depth === 0)
-      return { inner: code.slice(open + 1, i), end: i };
+      open.push(i);
+    else if (c === ")" && open.length > 0)
+      close[open.pop()] = i;
   }
-  return null;
+  return close;
+}
+function balancedCall(code, close, start) {
+  const open = code.indexOf("(", start);
+  if (open < 0 || close[open] < 0)
+    return null;
+  return { inner: code.slice(open + 1, close[open]), end: close[open] };
 }
 function resolveLocator(code, subject) {
   const id = subject.trim().match(/^([A-Za-z_$][\w$]*)$/);
@@ -6143,8 +6090,10 @@ function isAuthHandoffDismissCode(code) {
   const expects = [];
   const re = new RegExp(EXPECT_CALL_RE.source, "g");
   let match;
+  let close = null;
   while (match = re.exec(body)) {
-    const found = balancedCall(body, match.index);
+    close ??= closingParens(body);
+    const found = balancedCall(body, close, match.index);
     if (found)
       expects.push({ inner: found.inner, tail: body.slice(found.end, found.end + 48) });
   }
@@ -6189,35 +6138,232 @@ var init_auth_handoff_coverage = __esm({
   }
 });
 
-// ../shared/dist/assertion-strength.js
-function liveExpectStatements(uncommented) {
-  const masked = maskedOutsideStrings(uncommented).split("\n");
-  return accumulateStatements(uncommented.split("\n")).filter((s) => EXPECT_STMT.test(s.stmt) && EXPECT_STMT.test(masked[s.startLine - 1] ?? ""));
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
 }
-function stripLineComment(ln) {
-  let quote = null;
-  for (let i = 0; i < ln.length; i++) {
-    const c = ln[i];
-    if (quote) {
-      if (c === quote && ln[i - 1] !== "\\")
-        quote = null;
-      continue;
-    }
-    if (c === '"' || c === "'" || c === "`") {
-      quote = c;
-      continue;
-    }
-    if (c === "/" && ln[i + 1] === "/")
-      return ln.slice(0, i);
-  }
-  return ln;
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
 }
-function splitInteractionStatementsWithLines(lines) {
-  const out = [];
-  let depth = 0;
-  let scaffold = false;
-  for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
+  if (!sharedAuthInjectEnabled)
+    return false;
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function codeReadsStoredCredentials(code) {
+  if (!code)
+    return false;
+  if (/__vqaLogin\b/.test(code))
+    return true;
+  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
+    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
+      return true;
+  }
+  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
+    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
+      return true;
+  }
+  return false;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
+    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
+      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
+      switch (loginCompose[0]) {
+        case AUTH_TAG_COOKIE_STATE:
+          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_COOKIE:
+          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_BEARER:
+          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+      }
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
+  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
+  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds,
+    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
+// ../shared/dist/assertion-strength.js
+function parseLastActionProofMode(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  return v === "on" || v === "shadow" ? v : "off";
+}
+function isUrlProof(stmt) {
+  if (URL_PROOF.test(stmt))
+    return true;
+  let calls = 0;
+  for (const open of stmt.matchAll(POLL_OPEN)) {
+    if (++calls > POLL_CALLS_MAX)
+      break;
+    const from = open.index + open[0].length;
+    const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+    if (args === null)
+      continue;
+    const subject = pollSubject(args);
+    if (!POLL_PAGE_URL.test(subject))
+      continue;
+    if (!POLL_PAGE_URL_ONLY.test(subject) || PAGE_VALUE_MATCHER.test(stmt.slice(from + args.length)))
+      return true;
+  }
+  return false;
+}
+function liveExpectStatements(uncommented) {
+  const masked = maskedOutsideStrings(uncommented).split("\n");
+  return accumulateStatements(uncommented.split("\n")).filter((s) => EXPECT_STMT.test(s.stmt) && EXPECT_STMT.test(masked[s.startLine - 1] ?? ""));
+}
+function stripLineComment2(ln) {
+  let quote = null;
+  for (let i = 0; i < ln.length; i++) {
+    const c = ln[i];
+    if (quote) {
+      if (c === quote && ln[i - 1] !== "\\")
+        quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'" || c === "`") {
+      quote = c;
+      continue;
+    }
+    if (c === "/" && ln[i + 1] === "/")
+      return ln.slice(0, i);
+  }
+  return ln;
+}
+function splitInteractionStatementsWithLines(lines) {
+  const out = [];
+  let depth = 0;
+  let scaffold = false;
+  for (let i = 0; i < lines.length; i++) {
+    const ln = stripLineComment2(lines[i]).trim();
     if (!ln)
       continue;
     const isContinuation = out.length > 0 && (ln.startsWith(".") || depth > 0 && !scaffold);
@@ -6241,7 +6387,7 @@ function testBlockIds(lines) {
   let any = false;
   let block = 0;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!open) {
       if (!TEST_BLOCK_OPEN.test(ln))
         continue;
@@ -6325,7 +6471,7 @@ function expectSubjectSpan(stmt) {
   }
   return null;
 }
-function resolveSubjectBindings(stmts, bindings, blockOfLine) {
+function resolveSubjectBindings(stmts, bindings, blockOfLine, boundAt) {
   if (bindings.length === 0)
     return [...stmts];
   return stmts.map((item) => {
@@ -6348,14 +6494,22 @@ function resolveSubjectBindings(stmts, bindings, blockOfLine) {
       subject = `${lead[1]}${found.expr.replace(/;\s*$/, "")}${subject.slice(lead[0].length)}`;
       line = found.line;
     }
-    return { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    const out = { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    if (boundAt !== void 0 && line !== item.startLine)
+      boundAt.set(out, line);
+    return out;
   });
 }
 function stripLoginScaffolding(code) {
-  const out = [];
+  const lines = code.split("\n");
+  return keptScaffoldingLines(lines).map((i) => lines[i]).join("\n");
+}
+function keptScaffoldingLines(lines) {
+  const kept = [];
   let inAuth = false;
   let inInbox = false;
-  for (const ln of code.split("\n")) {
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
     if (!inAuth && !inInbox && AUTH_START.test(ln)) {
       inAuth = true;
       continue;
@@ -6376,9 +6530,9 @@ function stripLoginScaffolding(code) {
     }
     if (LOGIN_CALL_LINE.test(ln))
       continue;
-    out.push(ln);
+    kept.push(i);
   }
-  return out.join("\n");
+  return kept;
 }
 function stripCommentsAndLogs(code) {
   return stripCoverageComments(code).split("\n").filter((ln) => !/^\s*console\./.test(ln)).join("\n");
@@ -6387,7 +6541,7 @@ function detectsErrorBannerAssertion(code) {
   const cleaned = stripCommentsAndLogs(stripLoginScaffolding(code));
   const lines = cleaned.split("\n");
   const candidates = [];
-  const positive = (stmt) => !NEGATED_ASSERT.test(stmt) && !ABSENCE_MATCHER.test(stmt);
+  const positive = (stmt) => !claimsAbsence(stmt);
   const statements = liveExpectStatements(cleaned).map((s) => s.stmt);
   for (const stmt of statements) {
     if (positive(stmt))
@@ -6516,6 +6670,12 @@ function detectsObservedFailureAsExpected(code) {
     return FAILURE_STATUS_ASSERT.some((re) => re.test(stmt)) || hasFailedListener && FAILED_LIST_ASSERT.test(stmt);
   });
 }
+function claimsAbsence(stmt) {
+  const negated = NEGATED_ASSERT_NOT.test(stmt);
+  const bare = negated ? stmt.replace(NOT_BEFORE_MATCHER, ".") : stmt;
+  const absenceMatcher = /\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+  return negated !== absenceMatcher;
+}
 function isVacuousErrorAbsence(stmt, presence) {
   if (!ABSENCE_MATCHER.test(stmt))
     return false;
@@ -6524,6 +6684,41 @@ function isVacuousErrorAbsence(stmt, presence) {
     return false;
   return !presence().includes(m[1]);
 }
+function isVacuousAccountAbsence(stmt, shown, account) {
+  if (!claimsAbsence(stmt))
+    return false;
+  if (!ABSENCE_MATCHER.test(stmt)) {
+    const negated = NEGATED_TEXT.exec(stmt);
+    if (!negated)
+      return false;
+    const read = account.exec(stmt.slice(negated.index));
+    return read !== null && !shown().has(read[0]);
+  }
+  const m = account.exec(stmt);
+  if (!m || shown().has(m[0]))
+    return false;
+  for (let at = endOfEnclosingCall(stmt, m.index + m[0].length); at < stmt.length; at = endOfEnclosingCall(stmt, at)) {
+    SCOPING_STEP.lastIndex = at;
+    if (SCOPING_STEP.test(stmt))
+      return false;
+  }
+  return true;
+}
+function endOfEnclosingCall(stmt, from) {
+  let depth = 0;
+  for (let i = from; i < stmt.length; i++) {
+    const c = stmt[i];
+    if (c === "'" || c === '"') {
+      for (i++; i < stmt.length && stmt[i] !== c; i++)
+        if (stmt[i] === "\\")
+          i++;
+    } else if (c === "(")
+      depth++;
+    else if (c === ")" && depth-- === 0)
+      return i + 1;
+  }
+  return stmt.length;
+}
 function isBareContainerVisibility(stmt) {
   return BARE_CONTAINER_ROLE.test(stmt) && !GET_BY_TEXT.test(stmt) && !HAS_TEXT_FILTER.test(stmt) && !TEXT_CONTENT_MATCHER.test(stmt);
 }
@@ -6531,19 +6726,53 @@ function isChromeTarget(stmt) {
   return CHROME_LOCATOR.test(stmt) && !CONTENT_ROLE.test(stmt) && !/getByText\s*\(/.test(stmt);
 }
 function countsAsContentText(stmt) {
-  if (!TEXT_CONTENT_MATCHER.test(stmt))
+  if (!TEXT_CONTENT_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt))
     return false;
   if (isSymbolOnlyArgument(stmt, TEXT_CONTENT_MATCHER))
     return false;
-  if (!isChromeTarget(stmt))
+  return onContentTarget(stmt);
+}
+function onContentTarget(stmt) {
+  return !isChromeTarget(stmt) || /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+}
+function provesTextRemoved(stmt, presence) {
+  const m = stmt.match(NEGATED_TEXT);
+  if (!m || !onContentTarget(stmt))
+    return false;
+  const text = m[1] ?? m[2];
+  if (text === void 0)
     return true;
-  return /getByRole\s*\(\s*['"`]main['"`]/i.test(stmt);
+  if (!/[\p{L}\p{N}]/u.test(text))
+    return false;
+  return !ERROR_TEXT_WORDS.test(text) || presence().includes(text);
 }
 function isDataContentRole(stmt) {
   return CONTENT_ROLE.test(stmt) && !ANNOUNCE_ROLE.test(stmt);
 }
+function destructuresRequest(code) {
+  let readTo = -1;
+  for (const m of code.matchAll(ASYNC_DESTRUCTURE_OPEN)) {
+    const start = m.index + m[0].length;
+    if (start <= readTo)
+      continue;
+    let end = start;
+    while (end < code.length && code[end] !== "}" && code[end] !== ")")
+      end++;
+    readTo = end;
+    if (end === code.length)
+      return false;
+    if (code[end] !== "}" || !REQUEST_WORD.test(code.slice(start, end)))
+      continue;
+    let close = end + 1;
+    while (close < code.length && /\s/.test(code[close]))
+      close++;
+    if (code[close] === ")")
+      return true;
+  }
+  return false;
+}
 function isApiTest(code) {
-  const usesRequestFixture = /async\s*\(\s*\{[^})]*\brequest\b[^})]*\}\s*\)/.test(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
+  const usesRequestFixture = destructuresRequest(code) || /\brequest\.(get|post|put|patch|delete|head|fetch)\s*\(/.test(code);
   if (!usesRequestFixture)
     return false;
   const drivesUi = /\bpage\.(getBy\w+|locator|click|fill|goto|waitForURL|reload)\s*\(/.test(code) || /\.(click|fill|check|uncheck|selectOption|pressSequentially)\s*\(/.test(code);
@@ -6571,7 +6800,7 @@ function roleNames(s) {
 function interactedControlNames(lines) {
   const names = /* @__PURE__ */ new Set();
   for (const raw of lines) {
-    const ln = stripLineComment(raw);
+    const ln = stripLineComment2(raw);
     if (!INTERACT_VERB.test(ln))
       continue;
     for (const n of roleNames(ln))
@@ -6767,6 +6996,14 @@ function balancedArguments(code, from, limit = code.length) {
   }
   return null;
 }
+function expectCallTail(stmt) {
+  const at = stmt.search(EXPECT_CALL_RE);
+  if (at < 0)
+    return null;
+  const from = stmt.indexOf("(", at) + 1;
+  const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+  return args === null ? null : stmt.slice(from + args.length).trimStart();
+}
 function matcherArgumentsAreConstant(body, from) {
   MATCHER_OPEN.lastIndex = from;
   const opened = MATCHER_OPEN.exec(body);
@@ -6802,34 +7039,72 @@ function hasOnlyConstantAssertions(code) {
   const { constant, real } = constantAssertions(code);
   return constant.length > 0 && real === 0;
 }
+function envValueKey(name) {
+  return `\0env:${name}`;
+}
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
+  const accountConsts = /* @__PURE__ */ new Set();
   for (const { stmt, startLine } of stmts) {
     if (PAGE_NAV.test(stmt))
       navLines.push(startLine);
+    for (const c of stmt.matchAll(ACCOUNT_CONST))
+      accountConsts.add(c[1].replace(/\$/g, "\\$"));
     let m;
     ENTERED_VALUE.lastIndex = 0;
-    while (m = ENTERED_VALUE.exec(stmt)) {
-      const value = (m[1] ?? m[2] ?? m[3]).toLowerCase();
-      if (!values.has(value))
-        values.set(value, startLine);
-    }
+    const add = (value) => {
+      const lines = values.get(value);
+      if (!lines)
+        values.set(value, [startLine]);
+      else if (lines[lines.length - 1] !== startLine)
+        lines.push(startLine);
+    };
+    while (m = ENTERED_VALUE.exec(stmt))
+      add((m[1] ?? m[2] ?? m[3]).toLowerCase());
+    ENTERED_ENV.lastIndex = 0;
+    while (m = ENTERED_ENV.exec(stmt))
+      add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
-  return { values, navLines };
+  const consts = accountConsts.size > 0 ? `|(?<![\\w$.])(?:${[...accountConsts].join("|")})(?![\\w$])` : "";
+  return { values, navLines, account: new RegExp(`${ACCOUNT_ENV}${consts}`) };
 }
-function isEnteredValueEcho(stmt, entered, startLine) {
+function countBelow(lines, line) {
+  let lo = 0;
+  let hi = lines.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (lines[mid] < line)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo;
+}
+function enteredLinesOf(stmt, entered) {
   const m = stmt.match(/\.toHaveValue\s*\(\s*(['"`])((?:(?!\1).)+)\1/);
-  if (!m)
+  if (m)
+    return entered.values.get(m[2].toLowerCase());
+  const env = stmt.match(HAVE_VALUE_ENV);
+  return env ? entered.values.get(envValueKey(env[1] ?? env[2])) : void 0;
+}
+function typedSinceLastNav(stmt, entered, startLine, lines = enteredLinesOf(stmt, entered)) {
+  if (!lines || startLine === void 0)
     return false;
-  const enteredAt = entered.values.get(m[2].toLowerCase());
-  if (enteredAt === void 0)
+  const before = countBelow(lines, startLine);
+  if (before === 0)
     return false;
-  if (startLine === void 0)
-    return true;
-  return !entered.navLines.some((n) => n > enteredAt && n < startLine);
+  return countBelow(entered.navLines, startLine) === countBelow(entered.navLines, lines[before - 1] + 1);
 }
-function isAnyValueMatcher(stmt) {
+function isEnteredValueEcho(stmt, entered, startLine) {
+  const lines = enteredLinesOf(stmt, entered);
+  if (!lines)
+    return false;
+  if (startLine === void 0 || lines[0] >= startLine)
+    return true;
+  return typedSinceLastNav(stmt, entered, startLine, lines);
+}
+function isAnyValueMatcher(stmt) {
   if (/\.not\.toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/.test(stmt))
     return true;
   const m = stmt.match(/\.toHaveValue\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*/);
@@ -6917,6 +7192,49 @@ function hasAttributeTransition(stmts) {
       return true;
   return false;
 }
+function comparesWithItself(subject, tail) {
+  const m = SELF_COMPARE_MATCHER.exec(tail);
+  if (!m)
+    return false;
+  const args = balancedArguments(tail, m[0].length, MATCHER_ARGS_MAX);
+  if (args === null)
+    return false;
+  const squash2 = (x) => x.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  const expected = squash2(args);
+  return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
+}
+function asPlainAssertion(s) {
+  return plainAssertion(s, false);
+}
+function plainAssertion(s, keepSelfCompare) {
+  const { stmt } = s;
+  if (COUNT_AT_LEAST_ZERO.test(stmt))
+    return [];
+  const subject = extractExpectSubject(stmt);
+  if (subject === null)
+    return [s];
+  const plain = subject.replace(/^await\s+/, "").trim();
+  const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
+  const tail = (stmt.startsWith("expect.poll", stmt.search(EXPECT_CALL_RE)) ? expectCallTail(stmt) : null) ?? stmt.slice(subjectAt + subject.length).trimStart();
+  const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
+    return [];
+  if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
+    return [];
+  if (!keepSelfCompare && comparesWithItself(plain, tail))
+    return [];
+  const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
+  if (visible && IS_VISIBLE_TRUE.test(tail))
+    return as(`await expect(${visible[1]}).toBeVisible();`);
+  if (/^page\s*\.\s*(?:url|title)\s*\(\s*\)$/.test(plain) && PAGE_VALUE_MATCHER.test(tail)) {
+    const matcher = plain.includes("url") ? "toHaveURL" : "toHaveTitle";
+    return as(`await expect(page)${tail.replace(/^\)\s*\.\s*\w+\s*\(/, `.${matcher}(`)}`);
+  }
+  return [s];
+}
+function assertionStrengthHoistedReadsOn(value = typeof process !== "undefined" ? process.env?.ASSERTION_STRENGTH_HOISTED_READS : void 0) {
+  return /^(1|true|on)$/i.test((value ?? "").trim());
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -6949,6 +7267,22 @@ function successNoticeQuote(stmt) {
   }
   return null;
 }
+function namedPagePath(arg) {
+  const text = arg.trim();
+  let path;
+  const quoted = /^(['"`])([^'"`]*)\1$/.exec(text);
+  const regex = quoted ? null : /^\/((?:\\.|[^/\\])+)\/[a-z]*$/.exec(text);
+  if (quoted) {
+    path = quoted[2].replace(/^\$\{[^}]*\}/, "").replace(/^\*\*/, "").replace(/^[a-z][a-z\d+.-]*:\/\/[^/]*/i, "").replace(/\*\*$/, "");
+  } else if (regex) {
+    path = regex[1].replace(/^\^/, "").replace(/^\.\*/, "").replace(/\$$/, "").replace(/\\([/.-])/g, "$1");
+  } else {
+    return null;
+  }
+  if (!PLAIN_PAGE_PATH.test(path))
+    return null;
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function provesStoredControlValue(stmt, startLine, persistence) {
   if (!persistence || startLine === void 0)
     return false;
@@ -6975,7 +7309,64 @@ function reopenedAfterSave(startLine, persistence, reopens = persistence.reloadL
   }
   return lo < reopens.length && reopens[lo] < startLine;
 }
-function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence) {
+function actsBetween(withLines, from, to) {
+  let acts = actLinesOf.get(withLines);
+  if (acts === void 0) {
+    acts = withLines.filter((s) => ACTS.test(s.stmt)).map((s) => s.startLine).sort((a, b) => a - b);
+    actLinesOf.set(withLines, acts);
+  }
+  let lo = 0;
+  let hi = acts.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (acts[mid] <= from)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo < acts.length && acts[lo] < to;
+}
+function signInProofWindow(stmts, withLines, lines, blockIds) {
+  if (blockIds === null)
+    return void 0;
+  const testBodies2 = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const id = blockIds[i];
+    if (id > 0 && (i === 0 || blockIds[i - 1] !== id) && TEST_BODY_OPEN.test(stripLineComment2(lines[i]).trim()))
+      testBodies2.add(id);
+  }
+  const blockOf = (i) => blockIds[withLines[i].startLine - 1];
+  const passwordAt = stmts.findIndex((stmt, i) => testBodies2.has(blockOf(i)) && ENV_PASSWORD_ENTRY.test(stmt));
+  if (passwordAt < 0)
+    return void 0;
+  const body = blockOf(passwordAt);
+  let clickAt = passwordAt + 1;
+  while (clickAt < stmts.length && FORM_INPUT.test(stmts[clickAt]) && !ANY_CLICK.test(stmts[clickAt]))
+    clickAt++;
+  if (clickAt >= stmts.length || blockOf(clickAt) !== body || !ANY_CLICK.test(stmts[clickAt]) || NAV_LOCATOR.test(stmts[clickAt]))
+    return void 0;
+  let end = clickAt + 1;
+  for (; end < stmts.length && blockOf(end) === body; end++) {
+    if (CLOSERS_ONLY.test(stmts[end]))
+      continue;
+    if (!ASSERT_OR_WAIT.test(stmts[end]) || ACTS.test(stmts[end]))
+      return void 0;
+  }
+  return { after: withLines[clickAt].startLine, until: end < stmts.length ? withLines[end].startLine : Number.POSITIVE_INFINITY };
+}
+function isAccountControlCheck(stmt) {
+  if (!VISIBILITY_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt) || OPTION_ABSENCE.test(stmt))
+    return false;
+  const role = ACCOUNT_CONTROL_ROLE.exec(stmt);
+  if (!role)
+    return false;
+  const rest = stmt.slice(role.index + role[0].length, role.index + role[0].length + 300);
+  const close = rest.indexOf("}");
+  const options = close < 0 ? rest : rest.slice(0, close);
+  const name = options.match(/(?:^|[\s,])name\s*:\s*/);
+  return name !== null && ACCOUNT_EMAIL_ENV.test(options.slice(name.index + name[0].length));
+}
+function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence, signedIn) {
   if (mutated && hasAttributeTransition(stmts))
     return { kind: "durable" };
   const notices = [];
@@ -6985,11 +7376,25 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
   };
   let presenceText;
   const presence = () => presenceText ??= stmts.filter((o) => !ABSENCE_MATCHER.test(o.stmt) && !NEGATED_ASSERT.test(o.stmt)).map((o) => o.stmt).join("\n");
+  let shownAccounts;
+  const shown = () => {
+    if (shownAccounts)
+      return shownAccounts;
+    const ref = new RegExp(entered.account.source, "g");
+    return shownAccounts = new Set(stmts.filter((o) => !claimsAbsence(o.stmt)).flatMap((o) => Array.from(o.stmt.matchAll(ref), (m) => m[0])));
+  };
   for (const { stmt, startLine } of stmts) {
     if (firstMutLine !== void 0 && startLine !== void 0 && startLine < firstMutLine)
       continue;
     if (isVacuousErrorAbsence(stmt, presence))
       continue;
+    if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
+      continue;
+    if (isVacuousAccountAbsence(stmt, shown, entered.account))
+      continue;
+    if (signedIn && startLine !== void 0 && startLine > signedIn.after && startLine < signedIn.until && isAccountControlCheck(stmt)) {
+      return { kind: "durable" };
+    }
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -6999,12 +7404,15 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       else
         return { kind: "durable" };
     }
-    if (STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
+    const retyped = typedSinceLastNav(stmt, entered, startLine);
+    if (!retyped && STATE_MATCHER.test(stmt) && (persistence && startLine !== void 0 ? reopenedAfterSave(startLine, persistence, persistence.reloadCalls) : reloaded))
       return { kind: "durable" };
-    if (provesStoredControlValue(stmt, startLine, persistence))
+    if (!retyped && provesStoredControlValue(stmt, startLine, persistence))
       return { kind: "durable" };
     if (countsAsContentText(stmt))
       return { kind: "durable" };
+    if (provesTextRemoved(stmt, presence))
+      return { kind: "durable" };
     if (mutated && VISIBILITY_MATCHER.test(stmt)) {
       const revealsText = GET_BY_TEXT.test(stmt) || HAS_TEXT_FILTER.test(stmt) || CONTENT_ROLE.test(stmt);
       if (revealsText && !isChromeTarget(stmt)) {
@@ -7068,10 +7476,57 @@ function noticeOnlyExemption(clicked, noticeText, interactionStmts) {
 function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine) {
   return classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine).kind !== "none";
 }
+function clickLabel(stmt) {
+  let label = null;
+  for (const m of stmt.matchAll(CONTROL_LABEL))
+    label = m[2] ?? m[3] ?? null;
+  return label;
+}
+function teardownLines(lines) {
+  const out = new Array(lines.length).fill(false);
+  let open = false;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const ln = stripLineComment2(lines[i]).trim();
+    let from = 0;
+    if (!open) {
+      const m = TEARDOWN_OPEN.exec(ln);
+      if (!m)
+        continue;
+      open = true;
+      depth = 0;
+      from = m.index;
+    }
+    out[i] = true;
+    let closed = false;
+    let quote = null;
+    for (let k = from; k < ln.length; k++) {
+      const ch = ln[k];
+      if (quote !== null) {
+        if (ch === "\\")
+          k++;
+        else if (ch === quote)
+          quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`")
+        quote = ch;
+      else if (ch === "{")
+        depth++;
+      else if (ch === "}") {
+        depth--;
+        closed = true;
+      }
+    }
+    if (depth <= 0 && closed)
+      open = false;
+  }
+  return out;
+}
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
-  const stmts = liveExpectStatements(stripCoverageComments(body));
+  const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
   const base = (extra) => ({
     apiTest: false,
     interacted: false,
@@ -7111,7 +7566,13 @@ function validateAssertionStrength(code, opts = {}) {
   const interactionStmts = inlineLocatorBindings(interactionStmtsRaw);
   const blockIds = testBlockIds(lines);
   const blockOfLine = (line) => blockIds?.[line - 1] ?? 0;
-  const checks = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine);
+  const hoistedReads = assertionStrengthHoistedReadsOn();
+  const boundAt = hoistedReads ? /* @__PURE__ */ new Map() : void 0;
+  const resolved = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine, boundAt);
+  const checks = boundAt === void 0 ? resolved : resolved.flatMap((s) => {
+    const from = boundAt.get(s);
+    return plainAssertion(s, from !== void 0 && actsBetween(interactionStmtsWithLines, from, s.startLine));
+  });
   const insideTest = linesInsideTestBlocks(lines);
   const inTestOrder = (i) => insideTest === null || insideTest[interactionStmtsWithLines[i].startLine - 1] === true;
   let mutated = opts.interactionPerformed === true;
@@ -7121,9 +7582,34 @@ function validateAssertionStrength(code, opts = {}) {
   let navClicks = 0;
   const persistence = { mutLines: [], reloadLines: [], reloadCalls: [] };
   const openedPages = /* @__PURE__ */ new Set();
+  let checkedPage = null;
+  const savedOnCheckedPage = /* @__PURE__ */ new Set();
+  const saveAt = (i, at) => {
+    lastMutIdx = i;
+    if (!inTestOrder(i))
+      return;
+    persistence.mutLines.push(at);
+    if (firstMutIdx < 0)
+      firstMutIdx = i;
+    if (checkedPage !== null)
+      savedOnCheckedPage.add(checkedPage);
+  };
+  const lastActionProof = opts.lastActionProof ?? "off";
+  const teardown = lastActionProof === "off" ? null : teardownLines(lines);
+  const acts = { last: null, prev: null, count: 0 };
+  const noteAct = (i, at, kind) => {
+    if (teardown === null || teardown[at - 1] || !inTestOrder(i))
+      return;
+    if (kind !== "enter")
+      acts.count++;
+    acts.prev = acts.last;
+    acts.last = { i, kind };
+  };
   for (let i = 0; i < interactionStmts.length; i++) {
     const ln = interactionStmts[i];
     const at = interactionStmtsWithLines[i].startLine;
+    if (teardown !== null && acts.last?.kind === "fill" && ENTER_PRESS.test(ln))
+      noteAct(i, at, "enter");
     if (RELOAD.test(ln)) {
       persistence.reloadLines.push(at);
       persistence.reloadCalls.push(at);
@@ -7131,32 +7617,31 @@ function validateAssertionStrength(code, opts = {}) {
     const opened = ln.match(/\.goto\s*\(\s*([^,)]+)/);
     if (opened) {
       const page = opened[1].trim();
-      if (openedPages.has(page))
+      const path = namedPagePath(page);
+      if (openedPages.has(page) || path !== null && savedOnCheckedPage.has(path))
         persistence.reloadLines.push(at);
-      else
-        openedPages.add(page);
-    }
+      openedPages.add(page);
+      checkedPage = null;
+    }
+    if (/\bpage\s*\.\s*go(?:Back|Forward)\s*\(/.test(ln))
+      checkedPage = null;
+    const checked = URL_CHECK_ARG.exec(ln);
+    if (checked)
+      checkedPage = namedPagePath(checked[1] ?? checked[2]);
     if (FORM_INPUT.test(ln)) {
       mutated = true;
-      lastMutIdx = i;
-      if (inTestOrder(i)) {
-        persistence.mutLines.push(at);
-        if (firstMutIdx < 0)
-          firstMutIdx = i;
-      }
+      saveAt(i, at);
+      noteAct(i, at, "fill");
       continue;
     }
     if (ANY_CLICK.test(ln)) {
       if (NAV_LOCATOR.test(ln)) {
         navClicks++;
+        checkedPage = null;
       } else {
         mutated = true;
-        lastMutIdx = i;
-        if (inTestOrder(i)) {
-          persistence.mutLines.push(at);
-          if (firstMutIdx < 0)
-            firstMutIdx = i;
-        }
+        saveAt(i, at);
+        noteAct(i, at, "click");
       }
     }
   }
@@ -7189,9 +7674,28 @@ function validateAssertionStrength(code, opts = {}) {
     };
   }
   const orderedPersistence = firstMutLine !== void 0 ? persistence : void 0;
-  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence);
+  const signedIn = signInProofWindow(interactionStmts, interactionStmtsWithLines, lines, blockIds);
+  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn);
   if (proof.kind === "durable") {
     const signals2 = base({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal });
+    const { last, prev } = acts;
+    if (teardown !== null && last !== null && acts.count >= 2 && last.kind !== "fill" && (last.kind === "enter" || isCommitClick(interactionStmts[last.i]) && !(prev?.kind === "click" && isDestructiveClick(interactionStmts[prev.i])))) {
+      const lastLine = interactionStmtsWithLines[last.i].startLine;
+      const clicked = clickedControlNames(interactionStmts);
+      const after = classifyOutcomeProof(checks, mutated, reloaded, clicked, entered, lastLine, orderedPersistence, signedIn);
+      const unproven = after.kind === "none" || after.kind === "notice" && noticeOnlyExemption(clicked, after.noticeText, interactionStmts) === null;
+      if (unproven && lastActionProof === "on") {
+        const line = (keptScaffoldingLines(code.split("\n"))[lastLine - 1] ?? lastLine - 1) + 1;
+        return {
+          ok: false,
+          severity: "block",
+          reason: `the last save (line ${line}) has no outcome check after it (the earlier check proves only the earlier action)`,
+          signals: { ...signals2, lastActionUnproven: true }
+        };
+      }
+      if (unproven)
+        signals2.lastActionUnproven = true;
+    }
     return { ok: true, severity: "none", reason: "proves an outcome (count / diff / value / revealed content)", signals: signals2 };
   }
   if (mutated && proof.kind === "notice") {
@@ -7240,7 +7744,7 @@ function validateAssertionStrength(code, opts = {}) {
         signals
       };
     }
-    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && URL_PROOF.test(s));
+    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && isUrlProof(s));
     if (urlProofAfter) {
       return {
         ok: false,
@@ -7277,7 +7781,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, IN_FLIGHT_TEXT, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -7286,6 +7790,7 @@ var init_assertion_strength = __esm({
     init_assertion_proof();
     init_auth_handoff_coverage();
     init_expect_call();
+    init_auth_plan();
     ERROR_BANNER = /(client-side exception|application error|something (?:went wrong|broke)|unhandled (?:exception|error|rejection)|runtime error|error boundary|an unexpected error|internal server error|\b5\d\d\s+(?:internal\s+)?server error|stack trace|chunkloaderror|hydration failed|maximum update depth exceeded)/i;
     OUTCOME_ALWAYS = [
       /\.toHaveCount\s*\(/,
@@ -7302,8 +7807,8 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /\.toBeDisabled\s*\(/,
-      // a control became DISABLED — a gating/validation outcome
+      /\.(?<!\.not\s*\.)\s*toBeDisabled\s*\(/,
+      // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
       // something the action removed/closed (disappearance proof)
@@ -7311,12 +7816,16 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    POLL_OPEN = /\bexpect\s*\.\s*poll\s*\(/g;
+    POLL_PAGE_URL = /^page\s*\.\s*url\s*\(\s*\)/;
+    POLL_PAGE_URL_ONLY = /^page\s*\.\s*url\s*\(\s*\)$/;
+    POLL_CALLS_MAX = 8;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     TEST_BLOCK_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow|serial|describe\.serial))?\s*\(|^(?:test\.)?(?:beforeEach|beforeAll)\s*\(/;
-    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
+    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=(?:\s*(?!\s)|\s*(?=\s(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\())(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
     EXPECT_OPEN = /\bexpect(?:\.soft)?\s*\(/;
     STATE_MATCHER = /\.(toBeChecked|toBeVisible|toHaveValue|toBeDisabled|toBeEnabled)\s*\(/;
     CHROME_LOCATOR = /getByRole\s*\(\s*['"`](?:heading|navigation|banner|main|contentinfo|complementary|region|search|tablist|tab|button|link|menuitem|textbox|searchbox|combobox|spinbutton)['"`]/i;
@@ -7336,16 +7845,17 @@ var init_assertion_strength = __esm({
     EMPTY_STATE_TEXT = /\bno\b[\s\S]{0,24}?\b(yet|found|results?|items?|favou?rites?|entries|records?|matches|posts?|comments?)\b|nothing (?:here|yet|to show|found)|\bempty\b|\(\s*0\s*\)|\b0\s+(?:favou?rites?|results?|items?|entries|records?|matches|posts?|comments?)\b/i;
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
-    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
+    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*(?:;\s*)?$/;
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
+    NEGATED_ASSERT_NOT = /\.not\s*\.\s*to[A-Z]/;
     CONST_CHAIN_MAX_DEPTH = 5;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
     FAILURE_STATUS_ASSERT = [
       /\.status\s*\(\s*\)[^;]{0,200}\.(?:toBeGreaterThanOrEqual|toBeGreaterThan)\s*\(\s*(?:399|[45]\d\d)\b/,
-      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\))?\s*>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
+      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\)\s*)?>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
       /\bexpect\s*\([^;]{0,200}\.ok\s*\(\s*\)\s*\)\s*\.\s*(?:toBe\s*\(\s*false\s*\)|toBeFalsy\s*\()/
     ];
     FAILED_LIST_ASSERT = /\bexpect\s*\(\s*[^;]{0,200}(?:fail|abort|error)\w{0,40}(?:\.length)?\s*\)\s*\.\s*(?:toBeGreaterThan\s*\(\s*0|toHaveLength\s*\(\s*[1-9]|not\s*\.\s*toHaveLength\s*\(\s*0|not\s*\.\s*toEqual\s*\(\s*\[\s*\])/i;
@@ -7355,8 +7865,15 @@ var init_assertion_strength = __esm({
     CATCH_ALL_PATTERN = /^(['"`])\*\*(?:\/\*)?\1$|^\/\.\*\/[a-z]*$/;
     GUARD_HANDLER = /\bMUTATING\.has\s*\(|blockedbyclient|Read-only guard/;
     ABSENCE_MATCHER = /\.not\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)/;
+    VALUE_ABSENCE = /\.(?:count\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*0\s*\)|toBeLessThan\s*\(\s*1\s*\))|isVisible\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*false\s*\)|toBeFalsy\s*\()|isHidden\s*\(\s*\)[\s)]{0,10}\.(?:(?:toBe|toEqual|toStrictEqual)\s*\(\s*true\s*\)|toBeTruthy\s*\())/;
+    OPTION_ABSENCE = /\.(?:toBeVisible\s*\(\s*\{[^{}()]{0,200}\bvisible|toBeAttached\s*\(\s*\{[^{}()]{0,200}\battached)\s*:\s*false\b/;
+    NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    SCOPING_STEP = /(?:\s*\.\s*(?:first|last|nth)\s*\([^()]*\))*\s*\.\s*(?:getBy[A-Z]\w*|locator|filter)\s*\(/y;
+    NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
+    ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
+    REQUEST_WORD = /\brequest\b/;
     ROLE_NAME_RE = /getByRole\s*\(\s*['"`][a-z]+['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
     INTERACT_VERB = /\.(click|fill|check|uncheck|setChecked|selectOption|pressSequentially)\s*\(/;
     ROLE_SIG_RE = /getByRole\s*\(\s*['"`]([a-z]+)['"`]\s*,\s*\{[^}]*?name\s*:\s*(?:['"`]([^'"`]+)['"`]|\/([^/]+)\/)/gi;
@@ -7377,15 +7894,55 @@ var init_assertion_strength = __esm({
     MATCHER_OPEN = /\s*(?:\.\s*(?:not|resolves|rejects)\s*)*\.\s*[A-Za-z_$][\w$]*\s*\(/y;
     ENTERED_VALUE = /\.(?:fill|pressSequentially)\s*\(\s*['"`]([^'"`]+)['"`]|keyboard\.type\s*\(\s*['"`]([^'"`]+)['"`]|\.selectOption\s*\(\s*(?:\[\s*)?(?:\{\s*(?:label|value)\s*:\s*)?['"`]([^'"`]+)['"`]/g;
     PAGE_NAV = /\.(?:goto|reload)\s*\(/;
+    ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
+    ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
+    HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
+    ACCOUNT_KEYS = TEST_USER_ENV_KEYS.join("|");
+    ACCOUNT_ENV = `process\\.env(?:\\??\\.(?:${ACCOUNT_KEYS})\\b|(?:\\?\\.)?\\[\\s*['"\`](?:${ACCOUNT_KEYS})['"\`]\\s*\\])`;
+    ACCOUNT_CONST = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*(?::\\s*string\\s*)?=\\s*${ACCOUNT_ENV}`, "g");
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
+    LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
+    LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
+    ALWAYS_TRUE_ON_OBJECT = /^\)\s*\.\s*(?:toBeTruthy|toBeDefined|not\s*\.\s*(?:toBeNull|toBeUndefined|toBeFalsy))\s*\(/;
+    COUNT_AT_LEAST_ZERO = /\.(?:count\s*\(\s*\)|length)[\s)]{0,10}\.(?:toBeGreaterThanOrEqual\s*\(\s*0\s*\)|toBeGreaterThan\s*\(\s*-\s*1\s*\))/;
+    DEFINED_VALUE_READ = /\.\s*(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|title|url|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts)\s*\([^()]*\)$/;
+    ALWAYS_DEFINED = /^\)\s*\.\s*(?:toBeDefined|not\s*\.\s*toBeUndefined)\s*\(/;
+    SELF_COMPARE_MATCHER = /^\)\s*\.\s*(toBe|toEqual|toStrictEqual|toHaveCount)\s*\(/;
+    IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
+    PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
+    URL_CHECK_ARG = /\bpage\s*\.\s*waitForURL\s*\(\s*([^,)]+)|\bexpect(?:\s*\.\s*soft)?\s*\(\s*page\s*\)\s*\.\s*toHaveURL\s*\(\s*([^,)]+)/;
+    PLAIN_PAGE_PATH = /^\/[\w\-./~%]*(?:[?#][^\s]*)?$/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
+    ACCOUNT_EMAIL_ENV = /^process\.env(?:(?:\?\.|\.)TEST_USER_EMAIL\b|(?:\?\.)?\[\s*['"]TEST_USER_EMAIL['"]\s*\])/;
+    ENV_PASSWORD_ENTRY = /\.(?:fill|pressSequentially)\s*\(\s*process\.env(?:(?:\?\.|\.)TEST_USER_PASSWORD\b|(?:\?\.)?\[\s*['"]TEST_USER_PASSWORD['"]\s*\])/;
+    ACCOUNT_CONTROL_ROLE = /getByRole\s*\(\s*['"`](?:button|link|menuitem)['"`]\s*,\s*\{/;
+    ASSERT_OR_WAIT = /^(?:await\s+)?(?:expect(?:\.soft|\.poll)?\s*\(|[\w$]+(?:\.[\w$]+)*\.waitFor[A-Za-z]*\s*\()/;
+    ACTS = /\.(?:click|dblclick|tap|press|pressSequentially|fill|clear|type|check|uncheck|setChecked|selectOption|setInputFiles|dispatchEvent|hover|focus|dragTo|goto|reload|goBack|goForward|evaluate|evaluateHandle)\s*\(|\b(?:keyboard|mouse|touchscreen)\s*\.|\.toPass\s*\(/;
+    actLinesOf = /* @__PURE__ */ new WeakMap();
+    CLOSERS_ONLY = /^[})\];,\s]+$/;
+    TEST_BODY_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow))?\s*\(/;
     COPY_CONTROL = /\bcopy\b/i;
     COPIED_NOTICE = /\bcopied\b/i;
     SEND_CONTROL = /\b(send|submit|subscribe|sign up for|contact|feedback|join (the )?waitlist)\b/i;
     SEND_NOTICE = /\b(thank|thanks|sent|subscribed|received|in touch)\b/i;
     MARK_READ_CONTROL = /\bmark(?:ed)? as read\b|\bmark all(?: as)? read\b/i;
     APP_DATA_FIELD = /\b(title|name of|amount|price|quantity|sku|status|due|assignee|project|ticket|invoice|order)\b/i;
+    COMMIT_CONTROL = /\b(?:save|submit|update|apply|add|create|post|send|publish)\b|\bconfirm\s+changes\b/i;
+    NOT_COMMIT_CONTROL = /\b(?:delete|remove|cancel|close|dismiss|discard|back|sign\s*out|log\s*out|logout|done|ok|got\s+it|export|download)\b/i;
+    DESTRUCTIVE_CONTROL = /\b(?:delete|remove|discard)\b/i;
+    ENTER_PRESS = /\.press\s*\(\s*['"`]Enter['"`]/;
+    CONTROL_LABEL = /(?:name\s*:\s*|getBy(?:Text|Label|Title|TestId)\s*\(\s*|has-text\(\s*)(?:(['"`])((?:(?!\1).)*)\1|\/((?:\\.|[^/\\])+)\/)/g;
+    isCommitClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && COMMIT_CONTROL.test(label) && !NOT_COMMIT_CONTROL.test(label) && !EXCLUDE_AFFORDANCE.test(label);
+    };
+    isDestructiveClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && DESTRUCTIVE_CONTROL.test(label);
+    };
+    TEARDOWN_OPEN = /\bfinally\s*\{|^(?:test\.)?(?:after|before)(?:Each|All)\s*\(/;
   }
 });
 
@@ -8733,177 +9290,143 @@ var init_admin_view_return_to = __esm({
   }
 });
 
-// ../shared/dist/auth-plan.js
-function hasInlineLoginSteps(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
-}
-function hasGeneratedAuthGuard(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
+// ../shared/dist/auth-block-detector.js
+function stripEchoLines(text) {
+  return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
 }
-function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
-  if (!sharedAuthInjectEnabled)
-    return false;
-  if (tags.includes("@auth"))
-    return false;
-  if (tags.includes("@api"))
-    return true;
-  if (!tags.includes("@needs-auth"))
-    return false;
-  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
-    return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
-  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+function matchesAny(text, patterns) {
+  return patterns.some((p) => p.test(text));
 }
-function codeReadsStoredCredentials(code) {
-  if (!code)
-    return false;
-  if (/__vqaLogin\b/.test(code))
-    return true;
-  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
-    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
-      return true;
-  }
-  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
-    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
-      return true;
-  }
-  return false;
+function isIntentionalNegativeAuthTest(input) {
+  const meta = [input.testName, input.description].filter(Boolean).join(" ");
+  return matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH);
 }
-function explicitAuthTypeTags(t) {
-  const found = /* @__PURE__ */ new Set();
-  for (const tag of t) {
-    if (AUTH_TYPE_TAGS.includes(tag))
-      found.add(tag);
-    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
-      found.add(AUTH_TAG_ALIASES[tag]);
+function detectAuthBlock(input) {
+  const tags = input.tags ?? [];
+  const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
+  if (!isAuthed)
+    return NO_DETECTION;
+  if (isIntentionalNegativeAuthTest(input))
+    return NO_DETECTION;
+  const sources = [];
+  if (input.error)
+    sources.push(stripEchoLines(input.error));
+  if (input.logs)
+    sources.push(stripEchoLines(input.logs));
+  for (const sr of input.stepResults ?? []) {
+    if (sr.error)
+      sources.push(stripEchoLines(sr.error));
   }
-  return [...found];
-}
-function invalidPlan(configurationError) {
-  return {
-    version: 1,
-    source: "invalid",
-    acquisition: "unsupported",
-    presentation: "none",
-    needsCookieState: false,
-    needsStandingHeaders: false,
-    standingHeadersMode: "none",
-    needsLoginCreds: false,
-    requiredEnvKeys: [],
-    configurationError
-  };
-}
-function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
-  return {
-    version: 1,
-    source: "explicit",
-    authTypeTag: authTypeTag2,
-    acquisition,
-    presentation,
-    needsCookieState: opts.cookie,
-    needsStandingHeaders: opts.standingMode === "required",
-    standingHeadersMode: opts.standingMode,
-    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
-    requiredEnvKeys: opts.requiredEnvKeys
-  };
-}
-function deriveAuthPlan(tags, code, opts) {
-  const t = Array.isArray(tags) ? tags : [];
-  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
-  const isApi = t.includes("@api");
-  const explicit = isApi ? explicitAuthTypeTags(t) : [];
-  if (explicit.length > 0) {
-    if (t.includes("@auth")) {
-      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
-    }
-    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
-    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
-      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
-      switch (loginCompose[0]) {
-        case AUTH_TAG_COOKIE_STATE:
-          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_COOKIE:
-          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_BEARER:
-          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-      }
-    }
-    if (explicit.length > 1) {
-      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
-    }
-    switch (explicit[0]) {
-      case AUTH_TAG_UNSUPPORTED:
+  for (const text of sources) {
+    if (!text)
+      continue;
+    for (const sig of AUTH_BLOCK_SIGNATURES) {
+      if (sig.re.test(text)) {
         return {
-          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+          detected: true,
+          reason: sig.reason,
+          evidence: [`login-block signature "${sig.reason}" in: "${text.slice(0, 140).replace(/\s+/g, " ").trim()}"`]
         };
-      case AUTH_TAG_NONE:
-        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
-      case AUTH_TAG_STANDING:
-        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
-      case AUTH_TAG_LOGIN_BEARER:
-        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_LOGIN_COOKIE:
-        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_COOKIE_STATE:
-        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      }
     }
   }
-  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
-  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
-  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
-  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
-  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
+  return NO_DETECTION;
+}
+function detectApiColdSessionBlock(input) {
+  const tags = input.tags ?? [];
+  if (!tags.includes("@api"))
+    return NO_DETECTION;
+  const cookieMissing = input.authStateExpected && !input.authStateInjected;
+  const standingMissing = !!input.needsStandingHeaders && !input.standingHeadersInjected;
+  if (!cookieMissing && !standingMissing)
+    return NO_DETECTION;
+  const has401Status = (input.apiCalls ?? []).some((c) => c && (c.status === 401 || c.status === 403));
+  const texts = [];
+  if (input.error)
+    texts.push(input.error);
+  if (input.logs)
+    texts.push(input.logs);
+  for (const sr of input.stepResults ?? [])
+    if (sr.error)
+      texts.push(sr.error);
+  const has401Text = texts.some((t) => UNAUTHORIZED_TEXT_RE.test(t));
+  if (!has401Status && !has401Text)
+    return NO_DETECTION;
+  const missingAuth = cookieMissing ? "cold injected auth session (401/403 with no storageState)" : "missing standing auth header (401/403 with no API_AUTH_HEADERS installed)";
+  const injectedNoun = cookieMissing ? "injected session was absent/expired" : "standing auth header was not installed";
   return {
-    version: 1,
-    source: "legacy",
-    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
-    presentation: authedLegacy ? "cookie" : "none",
-    needsCookieState: cookie,
-    needsStandingHeaders: false,
-    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
-    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
-    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
-    needsLoginCreds,
-    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+    detected: true,
+    reason: missingAuth,
+    evidence: [
+      has401Status ? `a captured @api call returned 401/403 while the ${injectedNoun}` : `a 401/403 signal in the run error/logs while the ${injectedNoun}`
+    ]
   };
 }
-function authTypeTag(tags) {
-  const t = Array.isArray(tags) ? tags : [];
-  const explicit = explicitAuthTypeTags(t);
-  return explicit.length === 1 ? explicit[0] : void 0;
+function coldSessionConfigMessage(context, reason, evidence) {
+  return `CONFIG_ISSUE: ${context} without valid injected auth (${reason}) \u2014 no session cookie was injected this run. Ensure the project login (auth-setup recipe / prewarm) is configured so the shared session jar warms (a project with no login: set TEST_USER_EMAIL and TEST_USER_PASSWORD in Test Data \u2192 Test Variables so a session can be captured); for endpoints that authenticate with a standing API key or bearer header instead, set them in the project's API_AUTH_HEADERS variable (injected as request headers). Evidence: ${evidence.join("; ")}`;
 }
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
-var init_auth_plan = __esm({
-  "../shared/dist/auth-plan.js"() {
+var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, UNAUTHORIZED_TEXT_RE;
+var init_auth_block_detector = __esm({
+  "../shared/dist/auth-block-detector.js"() {
     "use strict";
-    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
-    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
-    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
-    AUTH_TAG_STANDING = "@auth-standing";
-    AUTH_TAG_NONE = "@auth-none";
-    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
-    AUTH_TYPE_TAGS = [
-      AUTH_TAG_COOKIE_STATE,
-      AUTH_TAG_LOGIN_COOKIE,
-      AUTH_TAG_LOGIN_BEARER,
-      AUTH_TAG_STANDING,
-      AUTH_TAG_NONE,
-      AUTH_TAG_UNSUPPORTED
+    NO_DETECTION = { detected: false, reason: "", evidence: [] };
+    AUTHED_TAGS = ["@needs-auth", "@inline-login"];
+    LOGIN_CTX = "\\b(?:log\\s*in|login|logging\\s+in|sign[\\s-]?in|signing\\s+in|continue)\\b";
+    AUTH_BLOCK_SIGNATURES = [
+      { reason: "incorrect password", re: /\b(incorrect|invalid|wrong|bad)\s+password\b/i },
+      { reason: "password is incorrect", re: /\bpassword\s+(is\s+)?(incorrect|invalid|wrong)\b/i },
+      { reason: "invalid credentials", re: /\b(invalid|incorrect|wrong|bad)\s+(login\s+)?credentials\b/i },
+      { reason: "credentials do not match", re: /\bcredentials\b[^\n]{0,40}\b(do(?:es)?\s*n['’]?t|do\s+not)\s+match\b/i },
+      { reason: "incorrect email or password", re: /\b(incorrect|invalid|wrong)\s+(email|username)\s+or\s+password\b/i },
+      // Require an EXPLICIT negative (codex #21): the old `(not\s+)?(confirmed|verified)` made the negation
+      // optional, so a benign "Email verified" success message / feature assertion matched and hid a real
+      // feature failure as a CONFIG_ISSUE. Only "email not (yet) confirmed/verified" or "unconfirmed/unverified".
+      { reason: "email not confirmed", re: /\b(e-?mail)\b[^\n]{0,30}\b(not\s+(?:yet\s+)?(?:confirmed|verified)|unconfirmed|unverified)\b/i },
+      { reason: "please confirm your email", re: /\bplease\s+(confirm|verify)\s+your\s+(e-?mail)\b/i },
+      // The bare "confirm/verify your email" and "account not found" phrases are ALSO ordinary feature copy
+      // ("Verify your email banner", a 404-style "Account not found" page), so they only count with a
+      // login/sign-in context on the SAME line (either side). "Please confirm/verify your email" above
+      // is already an explicit prompt and stays unconditional.
+      { reason: "confirm your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bconfirm\\s+your\\s+e-?mail\\b|\\bconfirm\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
+      { reason: "verify your email to continue", re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\bverify\\s+your\\s+e-?mail\\b|\\bverify\\s+your\\s+e-?mail\\b[^\\n]{0,80}${LOGIN_CTX}`, "i") },
+      {
+        reason: "account not found",
+        re: new RegExp(`${LOGIN_CTX}[^\\n]{0,80}\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b|\\baccount\\b[^\\n]{0,20}\\b(?:not\\s+found|does(?:n['\u2019]t| not)\\s+exist)\\b[^\\n]{0,80}${LOGIN_CTX}`, "i")
+      },
+      { reason: "authentication failed", re: /\bauthentication\s+failed\b/i },
+      { reason: "login failed", re: /\b(login|log\s*in|sign[\s-]?in)\s+failed\b/i }
     ];
-    AUTH_TAG_ALIASES = {
-      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
-      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
-      "@auth-token": AUTH_TAG_LOGIN_BEARER,
-      "@auth-api-key": AUTH_TAG_STANDING,
-      "@auth-standing-header": AUTH_TAG_STANDING
-    };
-    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
-    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+    INTENTIONAL_NEGATIVE_AUTH = [
+      /\b(invalid|incorrect|wrong|bad)\s+(password|credentials|email|login)\b/i,
+      /\b(negative|unhappy)\s+(login|auth|sign[\s-]?in|path|case|flow|test)\b/i,
+      // "should fail" et al must be TIED to an auth noun (codex #21): a bare `should\s+(fail|reject|deny)`
+      // exempted benign names like "Export should fail gracefully", silently disabling the anti-lockout
+      // protection for them. Require a login/auth noun on either side of the "should fail / fail to log in".
+      /\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password)\b[^\n]{0,40}\bshould\s+(fail|reject|deny)\b/i,
+      /\bshould\s+(fail|reject|deny|not\s+log(?:\s*in)?)\b[^\n]{0,40}\b(login|log\s*in|sign[\s-]?in|auth\w*|credential|password|unauthenticated)\b/i,
+      /\bfailed?\s+login\b/i,
+      /\blogin\s+(error|failure|rejected?)\b/i,
+      /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
+    ];
+    ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
+    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*(?::\s*)?(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+  }
+});
+
+// ../shared/dist/auth-session-stamp.js
+function parseAuthSessionStamp(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const { shared, role, generation } = value;
+  if (shared !== true || role !== "producer" && role !== "follower")
+    return null;
+  return typeof generation === "string" && AUTH_SESSION_GENERATION_RE.test(generation) ? { shared: true, role, generation } : { shared: true, role };
+}
+var AUTH_SESSION_GENERATION_RE;
+var init_auth_session_stamp = __esm({
+  "../shared/dist/auth-session-stamp.js"() {
+    "use strict";
+    AUTH_SESSION_GENERATION_RE = /^[0-9a-z]{1,16}$/;
   }
 });
 
@@ -9084,11 +9607,48 @@ function storageStateExpiredBySkew(stateJson, nowMs, skewMs = AUTH_STATE_EXPIRY_
   const liveSession = tokens2.some((t) => t.expiryMs > deadline && t.sessionClass);
   return !liveSession;
 }
-var AUTH_STATE_EXPIRY_SKEW_MS;
-var init_auth_state_freshness = __esm({
-  "../shared/dist/auth-state-freshness.js"() {
+var AUTH_STATE_EXPIRY_SKEW_MS;
+var init_auth_state_freshness = __esm({
+  "../shared/dist/auth-state-freshness.js"() {
+    "use strict";
+    AUTH_STATE_EXPIRY_SKEW_MS = 3e4;
+  }
+});
+
+// ../shared/dist/skip-coverage-detector.js
+function detectSkippedApiCoverage(steps) {
+  const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
+  if (allSkipped) {
+    if (steps.every((s) => s.skipKind === "fixme")) {
+      return {
+        detected: false,
+        logLine: "All @api tests skipped, but EVERY skip is a deliberate fixme (intentional N/A \u2014 e.g. a UI-only redirect login) \u2014 NOT relabelling CONFIG_ISSUE"
+      };
+    }
+    return {
+      detected: true,
+      error: (
+        // Name BOTH auth mechanisms (item 5d): the all-skipped copy used to say only "refresh the auth
+        // state", which misdirects a @auth-standing operator (whose real gap is a missing API_AUTH_HEADERS
+        // key, not a cold cookie session) to warm a login that was never the problem.
+        "CONFIG_ISSUE: Authenticated @api coverage was NOT exercised \u2014 every test skipped (cold injected session, a missing standing auth header, or an unresolved fixme). Provide the auth the endpoints need \u2014 warm the project login/session cookie (auth-setup recipe / prewarm), or set a standing API key/bearer in the project's API_AUTH_HEADERS variable \u2014 so the assertions actually run."
+      ),
+      logLine: "All @api tests skipped \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so zero authenticated coverage is visible, not silent green"
+    };
+  }
+  const runtimeSkipped = steps.filter((s) => s.status === "skipped" && s.skipKind === "skip");
+  if (runtimeSkipped.length === 0)
+    return { detected: false };
+  const reasons = [...new Set(runtimeSkipped.map((s) => `"${s.title ?? "test"}"${s.skipReason ? ` (${s.skipReason})` : ""}`))].join("; ");
+  return {
+    detected: true,
+    error: `CONFIG_ISSUE: ${runtimeSkipped.length} of ${steps.length} @api tests skipped at runtime \u2014 that coverage was NOT exercised. Skipped: ${reasons}`,
+    logLine: `${runtimeSkipped.length}/${steps.length} @api tests skipped at runtime \u2014 posting ERROR/CONFIG_ISSUE (not PASSED) so the coverage hole is visible, not silent green`
+  };
+}
+var init_skip_coverage_detector = __esm({
+  "../shared/dist/skip-coverage-detector.js"() {
     "use strict";
-    AUTH_STATE_EXPIRY_SKEW_MS = 3e4;
   }
 });
 
@@ -9783,6 +10343,77 @@ var init_deepgram_speech = __esm({
   }
 });
 
+// ../shared/dist/feature-flags.js
+function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
+  return value?.trim().toLowerCase() !== "false";
+}
+function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
+  return value?.trim().toLowerCase() !== "false";
+}
+function visualBaselinesEnabled(projectId, raw = process.env.VISUAL_BASELINES_PROJECTS) {
+  if (typeof projectId !== "string" || projectId.trim() === "")
+    return false;
+  const listed = (raw ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return listed.includes("*") || listed.includes(projectId);
+}
+var init_feature_flags = __esm({
+  "../shared/dist/feature-flags.js"() {
+    "use strict";
+  }
+});
+
+// ../shared/dist/visual-compare-limits.js
+function isSafeMaskSelector(selector) {
+  if (typeof selector !== "string")
+    return false;
+  if (selector.trim().length === 0)
+    return false;
+  if (selector.length > VISUAL_MASK_SELECTOR_MAX_LENGTH)
+    return false;
+  return !VISUAL_MASK_SELECTOR_FORBIDDEN.test(selector);
+}
+var VISUAL_MASK_SELECTORS_MAX, VISUAL_MASK_SELECTOR_MAX_LENGTH, VISUAL_MASK_SELECTOR_FORBIDDEN;
+var init_visual_compare_limits = __esm({
+  "../shared/dist/visual-compare-limits.js"() {
+    "use strict";
+    VISUAL_MASK_SELECTORS_MAX = 50;
+    VISUAL_MASK_SELECTOR_MAX_LENGTH = 300;
+    VISUAL_MASK_SELECTOR_FORBIDDEN = /[{};@<\r\n]/;
+  }
+});
+
+// ../shared/dist/visual-baseline-identity.js
+function isBrowserVersion(value) {
+  return typeof value === "string" && value.length <= 32 && BROWSER_VERSION.test(value);
+}
+function renderIdentity(flavour, version, image) {
+  if (!/^[a-z][a-z-]{0,31}$/.test(flavour) || !/^[a-z][a-z-]{0,31}$/.test(image) || !isBrowserVersion(version))
+    return null;
+  const identity = `${flavour}/${version}/${image}`;
+  return identity.length <= RENDER_IDENTITY_MAX_LENGTH ? identity : null;
+}
+function v1RenderIdentity(version) {
+  return renderIdentity(VISUAL_V1_IDENTITY.flavour, version, VISUAL_V1_IDENTITY.image);
+}
+function parseRenderIdentity(value) {
+  if (typeof value !== "string" || value.length > RENDER_IDENTITY_MAX_LENGTH)
+    return null;
+  const parts = value.split("/");
+  if (parts.length !== 3)
+    return null;
+  const [flavour, version, image] = parts;
+  return renderIdentity(flavour, version, image) === value ? { flavour, version, image } : null;
+}
+var VISUAL_V1_IDENTITY, RENDER_IDENTITY_MAX_LENGTH, BROWSER_VERSION;
+var init_visual_baseline_identity = __esm({
+  "../shared/dist/visual-baseline-identity.js"() {
+    "use strict";
+    VISUAL_V1_IDENTITY = { platform: "linux", image: "runner-fast", flavour: "headless-shell" };
+    RENDER_IDENTITY_MAX_LENGTH = 64;
+    BROWSER_VERSION = /^\d{1,4}(\.\d{1,6}){0,3}$/;
+  }
+});
+
 // ../shared/dist/analytics-url.js
 function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
@@ -10085,7 +10716,7 @@ var init_agentic_cli_runtime = __esm({
     GROK_CLI_DEFAULT_MODEL = "grok-4.7";
     GROK_CLI_DEFAULT_REASONING_EFFORT = "high";
     CLAUDE_CLI_DEFAULT_MODEL = "claude-sonnet-5-5";
-    CLAUDE_CLI_DEFAULT_EFFORT = "max";
+    CLAUDE_CLI_DEFAULT_EFFORT = "high";
     MUSE_CLI_DEFAULT_MODEL = "muse-spark-1.3-contributor";
     MUSE_CLI_DEFAULT_EFFORT = "high";
     CODEX_CLI_DEFAULT_MODEL = "gpt-6.1-sol";
@@ -10140,6 +10771,17 @@ function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
   return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
 }
+function isZaiModelId(id) {
+  const trimmed = id?.trim() ?? "";
+  return ZAI_MODEL_PATTERN.test(trimmed) && !trimmed.includes("..");
+}
+function hasZaiPrefix(id) {
+  return (id?.trim() ?? "").startsWith(ZAI_PREFIX);
+}
+function zaiWireModel(id) {
+  const trimmed = id?.trim() ?? "";
+  return isZaiModelId(trimmed) ? trimmed.slice(ZAI_PREFIX.length) : null;
+}
 function isEngineId(value) {
   return CLI_ENGINE_MODEL_IDS.includes(value);
 }
@@ -10236,7 +10878,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10296,6 +10938,8 @@ var init_engine_spec = __esm({
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
     OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
+    ZAI_PREFIX = "zai:";
+    ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
 });
 
@@ -10580,6 +11224,8 @@ var init_api_model_catalog = __esm({
       authCaptureModel: "Login capture",
       plannerModel: "Scenario Planner",
       plannerGateModel: "Planner Gate",
+      pwAgentsHealerModel: "Test Healer (Playwright agents)",
+      pwAgentsReviewModel: "Plan Review (Playwright agents)",
       generationModel: "Code Generation",
       reviewModel: "Code Review",
       apiTestModel: "API Test Generator",
@@ -10604,11 +11250,6 @@ var init_api_model_catalog = __esm({
 });
 
 // ../shared/dist/provider-chains.js
-function isClaudeModel(id) {
-  if (/claude|anthropic/i.test(id))
-    return true;
-  return API_MODEL_CATALOG.some((m) => m.provider === "anthropic" && (m.id === id || m.apiModel === id));
-}
 function chainKey(modelId) {
   const id = canonicalModelId(modelId);
   if (!id)
@@ -10616,35 +11257,334 @@ function chainKey(modelId) {
   const entry = API_MODEL_CATALOG.find((m) => m.id === id || m.apiModel === id);
   return entry?.id ?? id;
 }
+function has(map, key) {
+  return Object.prototype.hasOwnProperty.call(map, key);
+}
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
-  if (!key || isClaudeModel(key))
-    return [];
-  return Object.prototype.hasOwnProperty.call(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+  if (key && has(_overrideHops, key))
+    return _overrideHops[key];
+  return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
+}
+function providerChainLeadsFor(modelId) {
+  const key = chainKey(modelId);
+  if (key && has(_overrideLeads, key))
+    return _overrideLeads[key];
+  return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
+}
+function allChains() {
+  const ordered = (map, override) => [...Object.entries(map).filter(([key]) => !has(override, key)), ...Object.entries(override)];
+  return [...ordered(PROVIDER_CHAINS, _overrideHops), ...ordered(PROVIDER_CHAIN_LEADS, _overrideLeads)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
-  return id !== "" && Object.values(PROVIDER_CHAINS).some((hops) => hops.includes(id));
+  return id !== "" && allChains().some(([, hops]) => hops.includes(id));
 }
 function providerChainPrimariesForHop(hopId) {
   const id = hopId ?? "";
   if (!id)
     return [];
-  return Object.entries(PROVIDER_CHAINS).filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+  return allChains().filter(([, hops]) => hops.includes(id)).map(([primary]) => primary);
+}
+function providerChainHostOf(value, modelValue) {
+  if (value === modelValue)
+    return "own";
+  if (hasZaiPrefix(value))
+    return "zai";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  return "own";
+}
+function providerChainHostProvider(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasZaiPrefix(value))
+    return "zai";
+  const key = chainKey(value);
+  return API_MODEL_CATALOG.find((m) => m.id === key)?.provider ?? GEMINI_ASSISTANT_MODELS.find((m) => m.id === key)?.provider ?? null;
+}
+function providerHostPlan(modelId) {
+  const key = chainKey(modelId);
+  if (!key)
+    return [];
+  const own = { host: hasOpenRouterPrefix(key) ? "openrouter" : "own", value: key };
+  const steps = [
+    ...providerChainLeadsFor(key).map((value) => ({ host: providerChainHostOf(value, key), value })),
+    own,
+    ...providerChainFor(key).map((value) => ({ host: providerChainHostOf(value, key), value }))
+  ];
+  const notOffered = Object.prototype.hasOwnProperty.call(PROVIDER_HOST_NOT_OFFERED, key) ? PROVIDER_HOST_NOT_OFFERED[key] : {};
+  for (const [host, reason] of Object.entries(notOffered)) {
+    const at = steps.findIndex((step) => step === own) + 1;
+    steps.splice(at, 0, { host, value: null, notOffered: reason });
+  }
+  return steps;
+}
+function providerChainModelKey(modelId) {
+  return chainKey(modelId);
+}
+function hasProviderChainLeadsByDefault(modelId) {
+  const key = chainKey(modelId);
+  return key !== null && has(PROVIDER_CHAIN_LEADS, key);
+}
+function isChainablePrimary(id) {
+  return typeof id === "string" && id !== "" && (has(PROVIDER_CHAINS, id) || has(PROVIDER_CHAIN_LEADS, id));
+}
+function defaultProviderChainEntries(primary) {
+  if (!isChainablePrimary(primary))
+    return [];
+  const leads = has(PROVIDER_CHAIN_LEADS, primary) ? PROVIDER_CHAIN_LEADS[primary] : [];
+  const hops = has(PROVIDER_CHAINS, primary) ? PROVIDER_CHAINS[primary] : [];
+  return [...leads, primary, ...hops].map((hop) => ({ hop, enabled: true }));
+}
+function allowedProviderChainHosts(primary) {
+  return defaultProviderChainEntries(primary).map((entry) => entry.hop);
+}
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function validateProviderChainEntries(primary, entries) {
+  if (!isChainablePrimary(primary))
+    return `${String(primary).slice(0, 80)} has no provider chain to order`;
+  if (!Array.isArray(entries))
+    return `${primary}: the chain must be a list`;
+  if (entries.length > PROVIDER_CHAIN_MAX_ENTRIES)
+    return `${primary}: at most ${PROVIDER_CHAIN_MAX_ENTRIES} hosts`;
+  const allowed = allowedProviderChainHosts(primary);
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!isPlainObject2(entry))
+      return `${primary}: each host must be { hop, enabled }`;
+    const keys = Object.keys(entry);
+    if (keys.length !== 2 || !keys.includes("hop") || !keys.includes("enabled"))
+      return `${primary}: each host must be { hop, enabled } and nothing else`;
+    const { hop, enabled } = entry;
+    if (typeof enabled !== "boolean")
+      return `${primary}: enabled must be true or false`;
+    if (typeof hop !== "string" || !hop)
+      return `${primary}: hop must be a model value`;
+    if (!allowed.includes(hop))
+      return `${primary}: ${hop.slice(0, 80)} is not a host of this model`;
+    if (seen.has(hop))
+      return `${primary}: ${hop} is listed twice`;
+    if (hop === primary && !enabled)
+      return `${primary}: the model's own value stays on (pick another model on AI Models instead)`;
+    seen.add(hop);
+  }
+  if (!seen.has(primary))
+    return `${primary}: list the model's own value once, where its own host sits`;
+  return null;
+}
+function decodeProviderChains(raw) {
+  let value = raw;
+  if (typeof raw === "string") {
+    if (raw.length > PROVIDER_CHAINS_SETTING_MAX_CHARS)
+      return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return { ok: false, error: "AI_PROVIDER_CHAINS must be valid JSON" };
+    }
+  } else if (JSON.stringify(raw ?? null).length > PROVIDER_CHAINS_SETTING_MAX_CHARS) {
+    return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+  }
+  if (!isPlainObject2(value))
+    return { ok: false, error: 'AI_PROVIDER_CHAINS must be an object: { "<model>": [ { "hop": "<model value>", "enabled": true } ] }' };
+  if (Object.keys(value).length > PROVIDER_CHAIN_MAX_PRIMARIES)
+    return { ok: false, error: `AI_PROVIDER_CHAINS names at most ${PROVIDER_CHAIN_MAX_PRIMARIES} models` };
+  return { ok: true, value };
+}
+function checkedProviderChains(value) {
+  const out = {};
+  for (const [primary, entries] of Object.entries(value)) {
+    const problem = validateProviderChainEntries(primary, entries);
+    if (problem)
+      return { ok: false, error: problem };
+    out[primary] = entries.map(({ hop, enabled }) => ({ hop, enabled }));
+  }
+  return { ok: true, value: out };
+}
+function parseProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  return decoded.ok ? checkedProviderChains(decoded.value) : decoded;
+}
+function parseStoredProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  if (!decoded.ok)
+    return decoded;
+  const dropped = [];
+  const kept = {};
+  for (const [primary, entries] of Object.entries(decoded.value)) {
+    if (!isChainablePrimary(primary) || !Array.isArray(entries)) {
+      kept[primary] = entries;
+      continue;
+    }
+    const allowed = allowedProviderChainHosts(primary);
+    kept[primary] = entries.filter((entry) => {
+      const hop = isPlainObject2(entry) ? entry.hop : void 0;
+      if (typeof hop !== "string" || hop === "" || allowed.includes(hop))
+        return true;
+      dropped.push({ primary, hop: hop.slice(0, 80) });
+      return false;
+    });
+  }
+  const checked = checkedProviderChains(kept);
+  return checked.ok ? { ...checked, dropped } : checked;
+}
+function validateProviderChainsSetting(raw) {
+  const parsed = parseProviderChainOverrides(raw);
+  return parsed.ok ? null : parsed.error;
 }
-var PROVIDER_CHAINS;
+function setProviderChainOverrides(value, onDropped) {
+  const parsed = value === null || value === void 0 || value === "" ? null : parseStoredProviderChainOverrides(value);
+  if (parsed?.ok && parsed.dropped.length > 0)
+    onDropped?.(parsed.dropped);
+  _overrides = parsed?.ok ? parsed.value : null;
+  _overrideLeads = {};
+  _overrideHops = {};
+  for (const [primary, entries] of Object.entries(_overrides ?? {})) {
+    const at = entries.findIndex((entry) => entry.hop === primary);
+    const on = (list) => list.filter((entry) => entry.enabled).map((entry) => entry.hop);
+    _overrideLeads[primary] = on(entries.slice(0, at));
+    _overrideHops[primary] = on(entries.slice(at + 1));
+  }
+  return parsed === null || parsed.ok;
+}
+function getProviderChainOverrides() {
+  return _overrides;
+}
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED, PROVIDER_CHAIN_MAX_ENTRIES, PROVIDER_CHAINS_SETTING_MAX_CHARS, PROVIDER_CHAIN_MAX_PRIMARIES, ALLOWED_PROVIDER_CHAIN_HOPS, _overrides, _overrideLeads, _overrideHops;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
     init_api_model_catalog();
+    init_engine_spec();
     PROVIDER_CHAINS = {
-      "minimax-m3": ["openrouter:minimax/minimax-m3", "opencode-go:minimax-m3"],
-      "minimax-m3.1-flash": ["openrouter:minimax/minimax-m3.1-flash", "opencode-go:minimax-m3.1-flash"],
+      "minimax-m3": ["opencode-go:minimax-m3", "openrouter:minimax/minimax-m3"],
+      "minimax-m3.1-flash": ["opencode-go:minimax-m3.1-flash", "openrouter:minimax/minimax-m3.1-flash"],
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
-      "openrouter:z-ai/glm-5.3-flash": ["opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["opencode-go:glm-5.2"]
+      "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
+      "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
+      "deepseek-flash": ["opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
     };
+    PROVIDER_CHAIN_LEADS = {
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go:glm-5.2"]
+    };
+    PROVIDER_HOST_NOT_OFFERED = {
+      "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
+      "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
+    };
+    PROVIDER_CHAIN_MAX_ENTRIES = 8;
+    PROVIDER_CHAINS_SETTING_MAX_CHARS = 16e3;
+    PROVIDER_CHAIN_MAX_PRIMARIES = 32;
+    ALLOWED_PROVIDER_CHAIN_HOPS = /* @__PURE__ */ new Set([
+      ...Object.values(PROVIDER_CHAINS).flat(),
+      ...Object.values(PROVIDER_CHAIN_LEADS).flat()
+    ]);
+    _overrides = null;
+    _overrideLeads = {};
+    _overrideHops = {};
+  }
+});
+
+// ../shared/dist/provider-accounts.js
+function modelNames(modelId) {
+  const value = modelId.trim();
+  const names = /* @__PURE__ */ new Set([value]);
+  for (const prefix of HOST_PREFIXES) {
+    if (!value.startsWith(prefix))
+      continue;
+    const bare = value.slice(prefix.length);
+    names.add(bare);
+    const slash = bare.lastIndexOf("/");
+    if (slash >= 0)
+      names.add(bare.slice(slash + 1));
+  }
+  const canonical = canonicalModelId(value);
+  if (canonical) {
+    names.add(canonical);
+    const entry = API_MODEL_CATALOG.find((m) => m.id === canonical || m.apiModel === canonical);
+    if (entry) {
+      names.add(entry.id);
+      if (entry.apiModel)
+        names.add(entry.apiModel);
+    }
+  }
+  return names;
+}
+function accountServesModel(models, modelId) {
+  if (!models || models.length === 0)
+    return true;
+  if (!modelId)
+    return false;
+  const names = modelNames(modelId);
+  return models.some((model) => names.has(model.trim()));
+}
+function normalizeProviderAccountModels(models) {
+  if (!Array.isArray(models))
+    return null;
+  const out = [];
+  for (const model of models) {
+    if (typeof model !== "string")
+      return null;
+    const trimmed = model.trim();
+    if (!PROVIDER_ACCOUNT_MODEL_PATTERN.test(trimmed) || trimmed.includes(".."))
+      return null;
+    if (!out.includes(trimmed))
+      out.push(trimmed);
+  }
+  return out.length > MAX_PROVIDER_ACCOUNT_MODELS ? null : out;
+}
+function parseProviderAccountLists(value, providers) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const parsed = {};
+  for (const provider of providers) {
+    const list = value[provider];
+    if (!Array.isArray(list))
+      continue;
+    const accounts = [];
+    for (const raw of list) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const { id, label, key, models } = raw;
+      if (typeof id !== "string" || !id.trim() || typeof key !== "string" || !key.trim())
+        continue;
+      const modelList = Array.isArray(models) ? models.filter((m) => typeof m === "string" && m.trim() !== "").map((m) => m.trim()) : [];
+      accounts.push({ id: id.trim(), label: typeof label === "string" && label.trim() ? label.trim() : null, key: key.trim(), models: modelList });
+    }
+    if (accounts.length > 0)
+      parsed[provider] = accounts;
+  }
+  return parsed;
+}
+var DEFAULT_PROVIDER_ACCOUNT_ID, PROVIDER_ACCOUNT_ID_PATTERN, MAX_PROVIDER_ACCOUNTS, MAX_PROVIDER_ACCOUNT_MODELS, PROVIDER_ACCOUNT_MODEL_PATTERN, OPENCODE_GO_DEEPSEEK_GLM_MODELS, HOST_PREFIXES;
+var init_provider_accounts = __esm({
+  "../shared/dist/provider-accounts.js"() {
+    "use strict";
+    init_api_model_catalog();
+    DEFAULT_PROVIDER_ACCOUNT_ID = "primary";
+    PROVIDER_ACCOUNT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    MAX_PROVIDER_ACCOUNTS = 10;
+    MAX_PROVIDER_ACCOUNT_MODELS = 50;
+    PROVIDER_ACCOUNT_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,120}$/;
+    OPENCODE_GO_DEEPSEEK_GLM_MODELS = [
+      "deepseek-v4.1-flash",
+      "deepseek-v4-pro",
+      "glm-5.3-flash",
+      "glm-5.3",
+      "glm-5.2"
+    ];
+    HOST_PREFIXES = ["opencode-go:", "zai:", "openrouter:"];
   }
 });
 
@@ -10763,6 +11703,25 @@ var init_project_engine_overrides = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+function stripTrailingChars(value, isTrailing) {
+  let end = value.length;
+  while (end > 0 && isTrailing.test(value[end - 1]))
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/gemini-visual.js
 function visualProDailyBudget(raw) {
   const parsed = raw && /^\s*\d{1,6}\s*$/.test(raw) ? Number(raw.trim()) : NaN;
@@ -10776,7 +11735,7 @@ function isRetiredGeminiModel(id) {
 }
 function geminiNativeModelsUrl(base = process.env.GEMINI_API_BASE) {
   const raw = base && base.trim() || GEMINI_OPENAI_BASE;
-  const native = raw.replace(/\/openai\/?$/, "/").replace(/\/+$/, "");
+  const native = stripTrailingSlashes(raw.replace(/\/openai\/?$/, "/"));
   return `${native}/models?pageSize=1000`;
 }
 function asRecord(value) {
@@ -10896,6 +11855,7 @@ var KNOWN_INPUT_USD_PER_M, GEMINI_OPENAI_BASE, DEFAULT_GEMINI_SCREEN_MODEL, DEFA
 var init_gemini_visual = __esm({
   "../shared/dist/gemini-visual.js"() {
     "use strict";
+    init_trailing_slashes();
     KNOWN_INPUT_USD_PER_M = {
       "gemini-2.5-flash-lite": 0.1,
       "gemini-3.1-flash-lite": 0.25,
@@ -12238,12 +13198,13 @@ function truncateAtWord(text, max) {
   const slice = trimmed.slice(0, room + 1);
   const lastSpace = slice.lastIndexOf(" ");
   const cut = lastSpace > room * 0.5 ? slice.slice(0, lastSpace) : trimmed.slice(0, room);
-  return `${cut.replace(/[\s,;:.\-–—]+$/u, "")}\u2026`;
+  return `${stripTrailingChars(cut, TRAILING_PUNCTUATION)}\u2026`;
 }
-var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE;
+var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE, TRAILING_PUNCTUATION;
 var init_canvas_support = __esm({
   "../shared/dist/canvas-support.js"() {
     "use strict";
+    init_trailing_slashes();
     CANVAS_UNSUPPORTED_CODE = "canvas_unsupported";
     CANVAS_UNSUPPORTED_TITLE = "Games and canvas apps aren't supported yet";
     CANVAS_UNSUPPORTED_BODY = "This app draws its screen on a canvas (like a game), so there are no page elements for Validate.QA to read and test. Support for games and canvas apps is coming.";
@@ -12368,6 +13329,7 @@ var init_canvas_support = __esm({
     TOUCH_NONE_RE = /touch-action\s{0,8}:\s{0,8}none/;
     CODE_TAGS = /* @__PURE__ */ new Set(["script", "link", "flt-glass-pane", "flutter-view", "flt-scene-host"]);
     STATIC_STANDARD_MIN_INTERACTIVE = 3;
+    TRAILING_PUNCTUATION = /[\s,;:.\-–—]/u;
   }
 });
 
@@ -12550,22 +13512,22 @@ function joinChainedLines(code) {
     const trimmed = lines[i].trimStart();
     if (last !== -1 && trimmed.startsWith(".") && !trimmed.startsWith("...")) {
       if (!lastStripped) {
-        lines[last] = stripLineComment2(lines[last]).trimEnd();
+        lines[last] = stripLineComment3(lines[last]).trimEnd();
         lastStripped = true;
       }
       if (lines[last].length <= MAX_LINE_CHARS)
-        lines[last] = `${lines[last]} ${stripLineComment2(trimmed).trimEnd()}`;
+        lines[last] = `${lines[last]} ${stripLineComment3(trimmed).trimEnd()}`;
       lines[i] = "";
       continue;
     }
-    if (stripLineComment2(lines[i]).trim()) {
+    if (stripLineComment3(lines[i]).trim()) {
       last = i;
       lastStripped = false;
     }
   }
   return lines.join("\n");
 }
-function stripLineComment2(rawLine) {
+function stripLineComment3(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -12581,7 +13543,7 @@ function stateLiteralsOf(line) {
   const out = [];
   for (const m of line.matchAll(STRING_LITERAL_RE)) {
     const text = m[1] ?? m[2] ?? m[3] ?? "";
-    if (text.includes("placeholder="))
+    if (PLACEHOLDER_ATTR_RE.test(text))
       continue;
     if (PLACEHOLDER_CALL_TAIL_RE.test(line.slice(Math.max(0, m.index - 40), m.index)))
       continue;
@@ -12614,7 +13576,7 @@ function analyzeReadinessPolling(rawCode) {
     offset += rawLine.length + 1;
     if (rawLine.length > MAX_LINE_CHARS)
       continue;
-    const line = stripLineComment2(rawLine);
+    const line = stripLineComment3(rawLine);
     if (!line.trim())
       continue;
     const literals = literalsOf(line);
@@ -12677,7 +13639,7 @@ function formatReadinessPollAdvisory(findings) {
   const where = findings.length === 1 ? "One place" : `${findings.length} places`;
   return `${where} re-check a background state once and assert the finished state at once (${short(first.line, 90)} then ${short(first.assertion, 90)}). ${first.reason}`;
 }
-var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
+var READINESS_POLL_MAX_CODE_CHARS, MAX_LINE_CHARS, MAX_FINDINGS, ASSERTION_WINDOW_LINES, MAX_BLOCK_CHARS, MAX_HEAD_CHARS, STRING_LITERAL_RE, RECHECK_NAME_RE, RETRY_NAME_RE, PENDING_STATE_RE, LOCATOR_LINE_RE, CLICK_RE, RELOAD_RE, GOTO_RE, ACTION_RE, EXPECT_RE, NEGATED_RE, PENDING_ENDED_RE, POSITIVE_MATCHER_RE, ZERO_COUNT_RE, TEST_END_RE, TEST_START_RE, POLL_OPEN_RE, PLACEHOLDER_ATTR_RE, PLACEHOLDER_CALL_TAIL_RE, POLL_SHAPE;
 var init_readiness_poll = __esm({
   "../shared/dist/readiness-poll.js"() {
     "use strict";
@@ -12690,7 +13652,7 @@ var init_readiness_poll = __esm({
     STRING_LITERAL_RE = /'((?:\\.|[^'\\\n]){0,300})'|"((?:\\.|[^"\\\n]){0,300})"|`((?:\\.|[^`\\\n]){0,300})`/g;
     RECHECK_NAME_RE = /^\s{0,10}(?:check again|check (?:status|availability|now|for updates|progress)|re-?check(?: status)?|update status|see (?:latest|updates))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
     RETRY_NAME_RE = /^\s{0,10}(?:refresh(?: (?:status|list|page|results|now))?|reload(?: (?:page|results|list))?|try again|retry|load (?:again|latest))\s{0,10}(?:\.\.\.|…)?\s{0,10}$/i;
-    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b[a-z]{3,40}(?<!th)ing(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
+    PENDING_STATE_RE = /\b(?:searching|checking|sending|pending|processing|queued|in progress|loading|generating|calculating|preparing|verifying|syncing|refreshing|not ready|please wait|waiting)\b|\b(?:saving|uploading|downloading|signing|logging|submitting|creating|updating|deleting|importing|exporting|publishing|connecting|redirecting|authenticating|installing|retrieving|fetching|analy[sz]ing|running|rendering|restarting|building|compiling|booting|provisioning|deploying|indexing|migrating|launching|initiali[sz]ing|optimi[sz]ing|converting|processing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}(?:starting|scanning|working|applying|finishing)(?:\s{1,3}[a-z]{1,20}){0,2}\s{0,3}(?:\.\.\.|…)\s{0,10}$|^\s{0,10}[a-z]{3,40}(?<!th)ing\s{0,3}(?:\.\.\.|…)\s{0,10}$/i;
     LOCATOR_LINE_RE = /\.(?:getBy[A-Z]\w{0,30}|locator|toHaveText|toContainText)\s{0,20}\(/;
     CLICK_RE = /\.(?:click|dblclick|tap)\s{0,20}\(/;
     RELOAD_RE = /\bpage\.reload\s{0,20}\(/;
@@ -12704,6 +13666,7 @@ var init_readiness_poll = __esm({
     TEST_END_RE = /^\s{0,20}\}\s{0,20}\)\s{0,20};?\s{0,20}$/;
     TEST_START_RE = /\btest(?:\.\w{1,20})?\s{0,20}\(/;
     POLL_OPEN_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}async\b|\bexpect\.poll\s{0,20}\(|\bfor\s{0,20}\(|\bwhile\s{0,20}\(|\bdo\s{0,20}\{/g;
+    PLACEHOLDER_ATTR_RE = /placeholder\s{0,4}[*^$~|]?=/;
     PLACEHOLDER_CALL_TAIL_RE = /getByPlaceholder\s{0,20}\(\s{0,20}$/;
     POLL_SHAPE = "await expect(async () => { await page.reload(); await expect(<the finished state>).toBeVisible({ timeout: 1500 }); }).toPass({ timeout: 20000 });";
   }
@@ -12725,7 +13688,7 @@ function blankBlockComments2(code) {
     from = close + 2;
   }
 }
-function stripLineComment3(rawLine) {
+function stripLineComment4(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -12736,7 +13699,7 @@ function logicalLines(code) {
   for (const raw of code.split("\n")) {
     if (raw.length > MAX_LINE_CHARS2)
       continue;
-    const line = stripLineComment3(raw).trimEnd();
+    const line = stripLineComment4(raw).trimEnd();
     if (!line.trim())
       continue;
     const trimmed = line.trimStart();
@@ -13098,13 +14061,33 @@ function short4(text, max) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
 }
+function stripFractionZeros(s) {
+  let end = s.length;
+  while (end > 0 && s[end - 1] === "0")
+    end--;
+  if (end === s.length)
+    return s;
+  const dot = s.lastIndexOf(".");
+  if (dot < 0)
+    return s;
+  return s.slice(0, end === dot + 1 ? dot : end);
+}
 function digitsOf(token) {
-  return token.replace(/[^\d.]/g, "").replace(/\.0+$|(\.\d*?)0+$/, "$1").replace(/^0+(?=\d)/, "");
+  return stripFractionZeros(token.replace(/[^\d.]/g, "")).replace(/^0+(?=\d)/, "");
 }
 function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
   return COMPUTE_RE.test(code) || RELATIONAL_RE.test(line);
 }
+function identifiersIn(line) {
+  const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX");
+  return [code, ...[...line.matchAll(TEMPLATE_EXPR_RE)].map((m) => m[1])].flatMap((part) => part.match(IDENTIFIER_RE) ?? []);
+}
+function addTyped(typed, value) {
+  const d = digitsOf(value);
+  if (/\d/.test(d))
+    typed.add(d);
+}
 function reasonFor4(kind, label, value) {
   const what = kind === "derived-value-shape-only" ? `The ${label} is checked only for its shape, so any amount passes, including a wrongly computed one.` : `The ${label} is checked against a number written into the test (${value}). That number was read off the page, so when the page computes it wrong the check still passes.`;
   return `${what} Instead, ${COMPUTE_SHAPE} If the number is not computed from other values (a list price, an id, a fixed fee), leave it as it is. Keep the existing checks.`;
@@ -13116,25 +14099,32 @@ function analyzeDerivedValues(rawCode) {
   for (const body of testBodies(rawCode)) {
     if (findings.length >= MAX_FINDINGS4)
       break;
-    if (body.some(computes))
-      continue;
     const typed = /* @__PURE__ */ new Set();
     const definitions = /* @__PURE__ */ new Map();
+    const computed = /* @__PURE__ */ new Set();
+    const usesComputed = (text) => identifiersIn(text).some((id) => computed.has(id));
     for (const line of body) {
       if (FILL_RE2.test(line) && !EXPECT_RE3.test(line)) {
-        for (const m of line.matchAll(/['"`]([^'"`\n]{0,40})['"`]/g)) {
-          const d = digitsOf(m[1]);
-          if (/\d/.test(d))
-            typed.add(d);
-        }
+        for (const m of line.matchAll(QUOTED_RE))
+          addTyped(typed, m[1]);
+        const arg = FILL_ARG_RE.exec(line)?.[1];
+        const literal = arg === void 0 ? null : LITERAL_VALUE_RE.exec(definitions.get(arg) ?? "");
+        const value = literal?.slice(1).find((v) => v !== void 0);
+        if (value !== void 0)
+          addTyped(typed, value);
       }
       const def = DEFINITION_RE.exec(line);
-      if (def)
+      if (def) {
         definitions.set(def[1], def[2]);
+        if (computes(def[2]) || usesComputed(def[2]))
+          computed.add(def[1]);
+      }
     }
     for (const line of body) {
       if (!EXPECT_RE3.test(line) || !VALUE_MATCHER_RE2.test(line) || /\.not\s{0,20}\./.test(line))
         continue;
+      if (computes(line) || usesComputed(line))
+        continue;
       const subject = EXPECT_SUBJECT_RE.exec(line)?.[1];
       const label = DERIVED_WORD_RE.exec(`${line} ${(subject && definitions.get(subject)) ?? ""}`)?.[0];
       if (!label)
@@ -13164,7 +14154,7 @@ function formatDerivedValueAdvisory(findings) {
   const where = findings.length === 1 ? "One computed value is" : `${findings.length} computed values are`;
   return `${where} checked against a copied number or only its shape (${short4(first.line, 90)}). ${first.reason}`;
 }
-var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, COMPUTE_SHAPE;
+var MAX_FINDINGS4, EXPECT_RE3, DERIVED_WORD_RE, VALUE_MATCHER_RE2, MONEY_TOKEN_RE, SHAPE_ARG_RE, FILL_RE2, EXPECT_MESSAGE_RE, STRING_RE, REGEX_LITERAL_RE, COMPUTE_RE, RELATIONAL_RE, DEFINITION_RE, EXPECT_SUBJECT_RE, LITERAL_ARITH_RE, TEMPLATE_EXPR_RE, IDENTIFIER_RE, QUOTED_RE, FILL_ARG_RE, LITERAL_VALUE_RE, COMPUTE_SHAPE;
 var init_derived_value_check = __esm({
   "../shared/dist/derived-value-check.js"() {
     "use strict";
@@ -13184,6 +14174,11 @@ var init_derived_value_check = __esm({
     DEFINITION_RE = /\b(?:const|let)\s{1,10}([\w$]{1,60})\s{0,10}=\s{0,10}([^\n]{0,300})/;
     EXPECT_SUBJECT_RE = /\bexpect(?:\.soft)?\s{0,20}\(\s{0,20}([\w$]{1,60})/;
     LITERAL_ARITH_RE = /\b\d[\d_.]{0,15}(?:\s{0,5}[*/+-]\s{0,5}\d[\d_.]{0,15}){1,8}\b/g;
+    TEMPLATE_EXPR_RE = /\$\{([^{}\n]{0,200})\}/g;
+    IDENTIFIER_RE = /[A-Za-z_$][\w$]{0,60}/g;
+    QUOTED_RE = /['"`]([^'"`\n]{0,40})['"`]/g;
+    FILL_ARG_RE = /\.(?:fill|type|pressSequentially|selectOption)\s{0,20}\(\s{0,20}([A-Za-z_$][\w$]{0,60})\s{0,20}[,)]/;
+    LITERAL_VALUE_RE = /^\s{0,10}(?:'([^'\n]{0,40})'|"([^"\n]{0,40})"|`([^`$\n]{0,40})`|(\d[\d_,]{0,15}(?:\.\d{1,4})?))\s{0,10};?\s{0,10}$/;
     COMPUTE_SHAPE = "compute the expected value in the test from its inputs (the values the test typed, or each input read from the page) and compare: const toNumber = (s) => Number(s.replace(/[^\\d.-]/g, '')); const unit = toNumber(await <unit price locator>.innerText()); then expect(toNumber(await <shown value locator>.innerText())).toBeCloseTo(unit * quantity, 2); for several lines, read them all and sum them with reduce. For a comma-decimal price like \u20AC1.234,56, drop the dots and turn the comma into a point before Number, since the replace above would read it as 1.23456.";
   }
 });
@@ -13296,7 +14291,7 @@ function findExpectCalls(code) {
     if (!subj)
       continue;
     const rest = code.slice(subj.end + 1, subj.end + 1 + 80);
-    const mm = /^\s*((?:\.\s*not)?\s*\.\s*(\w+))\s{0,20}\(/.exec(rest);
+    const mm = /^\s*((?:\.\s*not\s*)?\.\s*(\w+))\s{0,20}\(/.exec(rest);
     if (!mm)
       continue;
     const argStart = subj.end + 1 + mm[0].length;
@@ -15218,6 +16213,133 @@ function formatStaleAfterSubmitAdvisory(rawCode) {
   const more = described.length > 3 ? ` (+${described.length - 3} more)` : "";
   return `stale-after-submit: ${described.slice(0, 3).join("; ")}${more}; these pass before the request lands and still pass if the server rejects or ignores the save. Wait for the result instead: page.waitForResponse around the click, or assert something the submit creates (the new row, the confirmation message, a path with an end anchor such as /\\/orders\\/\\d+$/)`;
 }
+function regexLiteralEnd4(text, at) {
+  let inClass = false;
+  for (let i = at + 1; i < text.length; i++) {
+    const ch = text[i];
+    if (ch === "\n")
+      return -1;
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "/")
+      return i + 1;
+  }
+  return -1;
+}
+function startsWithRegexLiteral(text) {
+  const t = text.trimStart();
+  return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
+}
+function isBareRegexLiteral(text) {
+  const t = text.trimStart();
+  if (t[0] !== "/" || t[1] === "/" || t[1] === "*")
+    return false;
+  const end = regexLiteralEnd4(t, 0);
+  if (end === -1)
+    return false;
+  let i = end;
+  while (i < t.length && /[a-z]/.test(t[i]))
+    i++;
+  while (i < t.length && /\s/.test(t[i]))
+    i++;
+  return i >= t.length || t[i] === ",";
+}
+function regexDeclaredNames(code) {
+  const names = /* @__PURE__ */ new Set();
+  const decl = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,80})\s{0,20}=\s{0,20}(?:\/(?![/*])|new\s{1,20}RegExp\b)/g;
+  let m;
+  while ((m = decl.exec(code)) !== null)
+    names.add(m[1]);
+  return names;
+}
+function afterFirstArg(args) {
+  let depth = 0;
+  let quote = null;
+  for (let i = 0; i < args.length; i++) {
+    const ch = args[i];
+    if (quote) {
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (ch === quote)
+        quote = null;
+      continue;
+    }
+    if (ch === '"' || ch === "'" || ch === "`") {
+      quote = ch;
+      continue;
+    }
+    if (ch === "(" || ch === "[" || ch === "{")
+      depth++;
+    else if (ch === ")" || ch === "]" || ch === "}")
+      depth--;
+    else if (ch === "," && depth === 0)
+      return args.slice(i + 1);
+  }
+  return "";
+}
+function analyzeRegexMatchers(rawCode) {
+  if (!rawCode || typeof rawCode !== "string")
+    return [];
+  const code = stripComments2(rawCode.slice(0, MAX_LINT_INPUT));
+  const out = [];
+  const re = /\bexpect(?:\.soft)?\s{0,20}\(/g;
+  let m;
+  let examined = 0;
+  let line = 1;
+  let lineAt2 = 0;
+  let regexNames;
+  while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
+    const subj = readBalanced(code, m.index + m[0].length);
+    if (!subj)
+      continue;
+    const mm = /^\s{0,20}(\.\s{0,20}not)?\s{0,20}\.\s{0,20}(\w{1,40})\s{0,20}\(/.exec(code.slice(subj.end + 1, subj.end + 1 + 80));
+    if (!mm || !REGEX_EQUALITY_MATCHERS.has(mm[2]))
+      continue;
+    const args = readBalanced(code, subj.end + 1 + mm[0].length);
+    if (!args)
+      continue;
+    const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
+    if (!isBareRegexLiteral(expected))
+      continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain") {
+      const subject = subj.text.trim();
+      if (startsWithRegexLiteral(subject) || /^new\s+RegExp\b/.test(subject))
+        continue;
+      if (/^[A-Za-z_$][\w$]{0,80}$/.test(subject)) {
+        regexNames ??= regexDeclaredNames(code);
+        if (regexNames.has(subject))
+          continue;
+      }
+    }
+    for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
+      line++;
+      lineAt2 = i + 1;
+    }
+    out.push({ line, matcher: mm[2], negated: mm[1] !== void 0 });
+  }
+  return out;
+}
+function formatRegexMatcherNote(findings) {
+  const lines = findings.map((f) => {
+    const negated = f.matcher === "toContain" ? "throws on a string and otherwise always passes (a regex never equals an item), so it checks nothing" : "always passes (a regex never equals the value), so it checks nothing";
+    return `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? negated : "can never pass: this matcher compares by equality and a regex never equals a value"}.`;
+  });
+  return `${lines.join("\n")}
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For the \`value\` of an input, textarea or select, use await expect(loc).toHaveValue(/re/). For any other DOM property (or element), poll it so the check still retries: await expect.poll(() => loc.evaluate((n) => n.<prop>)).toMatch(/re/). Never read it once with expect(await loc.evaluate(\u2026)), which sees the value before the page updates it. Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+}
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
     return [];
@@ -15225,6 +16347,10 @@ function lintTestQuality(rawCode, opts = {}) {
     return lintTestData(rawCode, { pageContacts: opts.pageContacts });
   if (opts.only === "test-data-blocking")
     return analyzeTestData(rawCode, { pageContacts: opts.pageContacts }).blocking;
+  if (opts.only === "regex-matcher") {
+    const found = analyzeRegexMatchers(rawCode);
+    return found.length > 0 ? [formatRegexMatcherNote(found)] : [];
+  }
   const warnings = [];
   if (rawCode.length > MAX_LINT_INPUT) {
     warnings.push(`The code is ${Math.round(rawCode.length / 1024)} KB; the quality lint checked only the first ${MAX_LINT_INPUT / 1e3} KB. Split it into smaller tests (one behaviour per test).`);
@@ -15499,7 +16625,7 @@ function specItemsFromTestPlans(testPlans) {
   }
   return [...new Set(out)].slice(0, 200);
 }
-var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, STOP, SYNONYMS, AREA_TOKENS;
+var READ_ONLY_TAGS, PRODUCTION_READ_ONLY_GUARD_TEMPLATE, HOST_AGNOSTIC_URL_TEMPLATE, TEST_QUALITY_CONVENTIONS, NON_PROD_HOST_LABEL, NON_PROD_HOST_TOKEN, TRANSIENT_TEXT, STRING_LITERAL, FIRST_LITERAL, GET_BY_TEXT_LITERAL2, ROLE_NAME_LITERAL2, MAX_LINT_INPUT, MAX_BALANCED_SCAN, MAX_CALLS, MAX_SEEN_SCAN, ACTION_CALL, BY_NAME_LOCATOR, ACTION_AFTER, MAX_CONTACTS, MAX_SNAPSHOT_SCAN, PHONE_IN_TEXT, EMAIL_IN_TEXT, TEL_HREF, MAILTO_HREF, FIELD_LINE, INBOX_EMAIL_READ, MAIL_READ_CALL, RESERVED_EMAIL_TLD, PHONE_LABEL, NON_PHONE_NUMBER_LABEL, IDENTITY_LABEL, LOOKUP_LABEL, NON_NAME_SUFFIX_LABEL, DATE_LIKE, SIGNUP_ACTION_NAME, SIGNUP_SUBMIT_NAME, LOGIN_ACTION_NAME, SIGNUP_GOTO, LOGIN_GOTO, MINTED_INBOX_ALIAS, STAMP_EVAL, RECORDING_VALUE_PLACEHOLDERS, NEGATIVE_TEST_TITLE, NEGATIVE_SIGNUP_ASSERT, STORED_LOGIN_RE, CONFIRM_CLICK_RE, SAVE_UPDATE_RE, NOT_A_CONFIRM_RE, ENTITY_WORDS, CREATE_ENTITY_CLICK_RE, RESTORE_CLICK_RE, MAX_ACCOUNT_ACTIONS, MAX_TRY_BLOCKS, MAX_STATEMENT_LOOKBACK, MAX_FINDINGS5, MAX_TRY_BODY, AUTH_REGION_START, AUTH_REGION_END, INBOX_REGION_START, INBOX_REGION_END, ACCOUNT_ROUTE_RE, ENTITY_WORD_RES, PERSIST_CALL_RE, FILL_IDENT_ARG_RE, PERSIST_ARGS_RE, HOST_IN_URL_ARG, URL_WAIT_TOKEN, GLOB_ESCAPED, URL_WAIT_MAX_PATH, URL_WAIT_MAX_GLOB_STARS, UNREACHED_MAX_PATHS, UNREACHED_MATCH_BUDGET, STALE_TOKEN, RESULT_WAIT, WRITE_CALL_PRESENT, SUBMIT_CALL_PRESENT, TEST_CALL, VALUE_WRITE_CALLS, SUBMIT_CALLS, DISTINCT_PAGE_CALLS, OWN_CONTROL_MATCHERS, OUTCOME_CONTENT_MATCHERS, OUTCOME_STATE_MATCHERS, ANY_CONTENT_ARG, ROOT_SUBJECT, LITERAL_SUBJECT, MATCHER_AFTER_EXPECT, STALE_MAX_EVENTS, CHECKED, UNCHECKED, squash, NOT_JUDGED, STALE_REASON_TEXT, LIVE_WRITE_NAME, BUNDLED_CHECKS_BEFORE_WRITE, MAX_REGEX_MATCHER_FINDINGS, REGEX_EQUALITY_MATCHERS, STOP, SYNONYMS, AREA_TOKENS;
 var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
@@ -15731,6 +16857,8 @@ var init_test_authoring_quality = __esm({
     };
     LIVE_WRITE_NAME = /\b(?:submit|place|book|reserve|confirm|pay|send|checkout|order|register|sign\s?up|create account)\b/i;
     BUNDLED_CHECKS_BEFORE_WRITE = 5;
+    MAX_REGEX_MATCHER_FINDINGS = 10;
+    REGEX_EQUALITY_MATCHERS = /* @__PURE__ */ new Set(["toBe", "toEqual", "toStrictEqual", "toContain", "toHaveJSProperty"]);
     STOP = /* @__PURE__ */ new Set([
       "a",
       "an",
@@ -15969,7 +17097,7 @@ function normalizeBugPath(route) {
   if (hash >= 0 && path[hash + 1] !== "/")
     path = path.slice(0, hash);
   const segments = path.toLowerCase().split("/").map((segment) => /\d/.test(segment) ? ":id" : segment);
-  const joined = segments.join("/").replace(/\/+$/, "");
+  const joined = stripTrailingSlashes(segments.join("/"));
   return joined || (path.startsWith("/") ? "/" : "");
 }
 function isGenericConsoleMessage(message) {
@@ -15982,14 +17110,17 @@ function requestSignatures(text) {
   const statuses = [...text.matchAll(HTTP_STATUS)].map((m) => ({ status: m[1], at: m.index ?? 0, end: (m.index ?? 0) + m[0].length }));
   if (statuses.length === 0)
     return [];
-  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => ({
-    method: m[1] ?? null,
-    path: normalizeBugPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "")),
-    // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
-    incidental: isIncidentalAssetPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "").split(/[?#]/, 1)[0].toLowerCase()),
-    at: m.index ?? 0,
-    end: (m.index ?? 0) + m[0].length
-  })).filter((p) => p.path.length > 1);
+  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => {
+    const rawPath = stripTrailingChars(m[2] ?? m[3] ?? "", PATH_TRAILING_PUNCTUATION);
+    return {
+      method: m[1] ?? null,
+      path: normalizeBugPath(rawPath),
+      // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
+      incidental: isIncidentalAssetPath(rawPath.split(/[?#]/, 1)[0].toLowerCase()),
+      at: m.index ?? 0,
+      end: (m.index ?? 0) + m[0].length
+    };
+  }).filter((p) => p.path.length > 1);
   const out = /* @__PURE__ */ new Map();
   for (const { status, at, end } of statuses) {
     const lead = STATUS_TO_PATH.exec(text.slice(end, end + 40));
@@ -16099,10 +17230,12 @@ function dedupeSiteWideSuspectedBugs(drafts) {
       delete plans.suspectedBugs;
   }
 }
-var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
+var PATH_TRAILING_PUNCTUATION, SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
+    init_trailing_slashes();
+    PATH_TRAILING_PUNCTUATION = /[.,;:]/;
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17383,9 +18516,9 @@ function lastLocatorLabels(chain) {
       if (t)
         labels.push(t[1]);
     }
-    const has = optionText(last.args, HAS_TEXT_OPTION_RE);
-    if (has !== null)
-      labels.push(has);
+    const has2 = optionText(last.args, HAS_TEXT_OPTION_RE);
+    if (has2 !== null)
+      labels.push(has2);
   }
   return labels.map((l) => l.replace(/^[\s^(?:]+/, "").trim());
 }
@@ -17433,7 +18566,7 @@ function pathIdsIn(text) {
 function findCounterIdPins(code) {
   if (code.length > CLOCK_MAX_CODE_CHARS)
     return [];
-  const clean2 = stripLineComments(blankBlockComments3(code));
+  const clean3 = stripLineComments(blankBlockComments3(code));
   const fillValues = [];
   const candidates = [];
   let seenWrite = false;
@@ -17441,24 +18574,24 @@ function findCounterIdPins(code) {
   CALL_RE.lastIndex = 0;
   let m;
   let calls = 0;
-  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean2)) !== null) {
+  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean3)) !== null) {
     const name = m[1];
     const open = m.index + m[0].length - 1;
     if (VALUE_WRITES.has(name)) {
       seenWrite = true;
-      const args2 = argsAt(clean2, open);
+      const args2 = argsAt(clean3, open);
       if (args2 !== null)
         fillValues.push(...staticStrings(args2));
       continue;
     }
     if (createIndex === -1) {
-      if (name === "click" && seenWrite && isCreateClick(clean2, m.index))
+      if (name === "click" && seenWrite && isCreateClick(clean3, m.index))
         createIndex = m.index;
       continue;
     }
     if (name === "click")
       continue;
-    const args = argsAt(clean2, open);
+    const args = argsAt(clean3, open);
     if (args === null)
       continue;
     const isUrl = URL_SINKS.has(name);
@@ -17477,7 +18610,7 @@ function findCounterIdPins(code) {
   }
   if (createIndex === -1)
     return [];
-  const before = clean2.slice(0, createIndex);
+  const before = clean3.slice(0, createIndex);
   let pathIdsBefore = null;
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -17501,7 +18634,7 @@ function findCounterIdPins(code) {
           continue;
       }
     }
-    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean2, c.index) });
+    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean3, c.index) });
   }
   return findings;
 }
@@ -17796,7 +18929,7 @@ var init_suspicious_expectation = __esm({
     NOT_STUCK_RE = /\b(?:not|never|no longer|isn't|doesn't|don't|without)\s+(?:\w+\s+){0,2}?(?:stuck|hang|hangs|hung|freeze|freezes|frozen|spin|spins|spinning)\b/i;
     LISTS_STUCK_RE = /\b(?:appears? in (?:the )?[\w ]{0,25}(?:report|list|dashboard|queue)|(?:lists?|monitors?|shows?|reports?) (?:\w+ ){0,2}(?:that|which|whose) (?:are |is )?(?:stuck|hangs?|hung|frozen)|can (?:retry|re-?run) (?:\w+ ){0,2}(?:that (?:are )?)?stuck)\b/i;
     STUCK_VETO_RE = new RegExp(`${NOT_STUCK_RE.source}|${LISTS_STUCK_RE.source}`, "i");
-    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:fail(?:s|ing|ed)?|ignor\w*)?\s*silent(?:ly)?\b/i;
+    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:(?:fail(?:s|ing|ed)?|ignor\w*)\s*)?silent(?:ly)?\b/i;
     PENDING_WORD = "(?:sending|loading|saving|searching|checking(?!\\s+(?:account|balance|out|in)\\b)|syncing|refreshing|fetching|validating|processing|submitting|uploading|posting|publishing|creating|updating|deleting|connecting|verifying|signing in|logging in)";
     ELLIPSIS = "(?:\\.{3}|\u2026)";
     NOT_STAY_RE = /\b(?:not|never|no longer|without|n't|cannot)\s+(?:\w+\s+){0,2}?(?:stay|stays|stayed|remain|remains|remained|leave|leaves|left)\b/i;
@@ -17952,7 +19085,7 @@ function outcomeNamedByAssertion(outcome, code) {
 function namedByStatements(outcome, statements) {
   const text = outcomeText(outcome);
   if (outcome.type === "url") {
-    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => r.replace(/[.,;:!?)]+$/, "")).filter((r) => r.length > 1);
+    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => stripTrailingChars(r, ROUTE_TRAILING_PUNCTUATION)).filter((r) => r.length > 1);
     return statements.some((stmt) => {
       if (!/\.(?:waitForURL|toHaveURL)\s{0,20}\(/.test(stmt))
         return false;
@@ -18124,7 +19257,7 @@ function evaluatePromotionGate(input, checks = PROMOTION_QUALITY_CHECKS) {
     ...suspiciousTagged ? { suspiciousPass: { mode: suspicious, covered: suspiciousCovered, wouldHold: suspiciousHold } } : {}
   };
 }
-var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
+var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
 var init_promotion_quality_gate = __esm({
   "../shared/dist/promotion-quality-gate.js"() {
     "use strict";
@@ -18139,17 +19272,21 @@ var init_promotion_quality_gate = __esm({
     init_run_classification();
     init_expected_outcome_coverage();
     init_expect_call();
+    init_trailing_slashes();
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, strengthGate, flagContradictedAdditions }) {
-        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
+      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof }) {
+        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
-        if (verdict.severity !== "block")
+        const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
+        if (verdict.severity !== "block" && !authDowngrade)
           return [];
         const revealed = strengthGate?.severity === "none" && strengthGate.revealEvidence === "revealed" && strengthGate.source !== "heal";
-        return revealed ? [] : [{ check: "strength-block" }];
+        if (revealed)
+          return [];
+        return [{ check: authDowngrade ? "strength-downgrade-auth" : "strength-block" }];
       }
     };
     STRING_CONST = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,60})\s{0,20}=\s{0,20}(?:'([^'\\\n]{0,300})'|"([^"\\\n]{0,300})"|`([^`\\$\n]{0,300})`)\s{0,20}[;\n]/g;
@@ -18158,7 +19295,7 @@ var init_promotion_quality_gate = __esm({
     MAX_STATEMENTS = 500;
     MAX_STATEMENT_CHARS = 400;
     LITERAL_OR_IDENTIFIER = /'(?:[^'\\\n]|\\.){0,500}'|"(?:[^"\\\n]|\\.){0,500}"|`(?:[^`\\]|\\.){0,2000}`|(?<![\w$.])[A-Za-z_$][\w$]{0,60}/g;
-    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
+    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
     FEEDBACK_REGION = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/i;
     ONE_SHOT_MESSAGE_REASON = "one-shot success/error banner text";
     FEEDBACK_REGION_ALL = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/gi;
@@ -18217,6 +19354,7 @@ var init_promotion_quality_gate = __esm({
       "element-hidden": /\.(?:toBeHidden|not\s{0,20}\.\s{0,20}toBeVisible|not\s{0,20}\.\s{0,20}toBeAttached|not\s{0,20}\.\s{0,20}toContainText)\s{0,20}\(|\.toHaveCount\s{0,20}\(\s{0,20}0\s{0,20}\)/
     };
     ROUTE_TERM = /\/[A-Za-z0-9_./?&=#-]{1,200}/g;
+    ROUTE_TRAILING_PUNCTUATION = /[.,;:!?)]/;
     QUOTED_LITERAL = /'([^'\\\n]{3,200})'|"([^"\\\n]{3,200})"|`([^`\\$\n]{3,200})`/g;
     GENERIC_LITERAL = /^(?:true|false|button|link|heading|dialog|alertdialog|article|main|region|status|alert|textbox|combobox|checkbox|radio|tab|tabpanel|option|list|listitem|row|cell|img|navigation|banner|complementary|contentinfo|form|search|menu|menuitem|visible|hidden|attached|detached|domcontentloaded|load|networkidle)$/i;
     MAX_OUTCOME_STATEMENTS = 300;
@@ -18336,8 +19474,8 @@ ${goalText}`);
         return count3 > 0 ? [{ check: "locator-fragment", detail: String(count3), soft: true }] : [];
       }
     };
-    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|press)\s*\(/i;
-    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s*\(/;
+    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|setChecked|press)\s*\(/i;
+    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s*\(/;
     REDUCTION_PROOF = /\.toHaveCount\s*\(|\.not\s*\.\s*(?:toBeVisible|toBeAttached|toContainText|toHaveText)\s*\(|\.toBeHidden\s*\(|\bShowing\b|\bof \d+\b|\b\d+ (?:results?|rows?|items?|candidates?|entries|matches|records)\b|\bNo (?:[\w'-]+ ){0,3}(?:match|matches|results?|found|left|remain|yet)\b|\bNothing (?:to show|found|matches)\b|\bis empty\b|\btoHaveURL\b/i;
     MAX_FILTER_LINES = 2e3;
     MAX_FILTER_LINE_CHARS = 600;
@@ -18452,7 +19590,7 @@ ${goalText}`);
 });
 
 // ../shared/dist/regex-alternation.js
-function closingParens(source) {
+function closingParens2(source) {
   const close = new Int32Array(source.length).fill(-1);
   const open = [];
   let inClass = false;
@@ -18477,7 +19615,7 @@ function closingParens(source) {
   return close;
 }
 function alternatesAtTop(source) {
-  const close = closingParens(source);
+  const close = closingParens2(source);
   let start = source.startsWith("^") ? 1 : 0;
   let end = source.endsWith("$") ? source.length - 1 : source.length;
   while (start < end && source[start] === "(" && close[start] === end - 1) {
@@ -18526,6 +19664,124 @@ var init_page_evidence = __esm({
   }
 });
 
+// ../shared/dist/stated-limits.js
+function validDate(v) {
+  const [y, m, d] = v.split("-").map(Number);
+  const t = new Date(Date.UTC(y, m - 1, d));
+  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;
+}
+function isoFor(type, v) {
+  const re = DATE_RE[type];
+  if (!re || !re.test(v))
+    return false;
+  if (type === "date")
+    return validDate(v);
+  if (type === "datetime-local")
+    return validDate(v.slice(0, 10)) && Number(v.slice(11, 13)) < 24 && Number(v.slice(14, 16)) < 60;
+  if (type === "time")
+    return Number(v.slice(0, 2)) < 24 && Number(v.slice(3, 5)) < 60;
+  if (type === "month")
+    return Number(v.slice(5, 7)) >= 1 && Number(v.slice(5, 7)) <= 12;
+  return Number(v.slice(6, 8)) >= 1 && Number(v.slice(6, 8)) <= 53;
+}
+function clean2(raw) {
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function statedLimitsFromAttrs(attrs, inputType) {
+  const type = (inputType ?? "").trim().toLowerCase();
+  const limits = [];
+  const add = (k, v) => {
+    limits.push({ k, v });
+  };
+  if (NUMBER_TYPES.has(type)) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (NUMBER_RE.test(v))
+        add(k, v);
+    }
+    const step = clean2(attrs.step);
+    if (NUMBER_RE.test(step) && Number(step) > 0)
+      add("step", step);
+  } else if (type in DATE_RE) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (isoFor(type, v))
+        add(k, v);
+    }
+  } else if (TEXT_TYPES.has(type)) {
+    for (const [attr, k] of [["minlength", "minLength"], ["maxlength", "maxLength"]]) {
+      const v = clean2(attrs[attr]);
+      if (LENGTH_RE.test(v))
+        add(k, String(Number(v)));
+    }
+    const pattern = cleanPattern(clean2(attrs.pattern).slice(0, STATED_PATTERN_MAX));
+    if (pattern)
+      add("pattern", pattern);
+  }
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+function cleanPattern(text) {
+  return text.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "");
+}
+function readStatedLimits(stored) {
+  if (!stored || typeof stored !== "object" || Array.isArray(stored))
+    return [];
+  const rec = stored;
+  if (rec.v !== STATED_LIMITS_VERSION || !Array.isArray(rec.limits))
+    return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of rec.limits.slice(0, MAX_LIMITS * 2)) {
+    if (!item || typeof item !== "object")
+      continue;
+    const { k, v } = item;
+    if (typeof k !== "string" || typeof v !== "string" || !KINDS.includes(k) || seen.has(k))
+      continue;
+    if (v.length === 0 || v.length > STATED_PATTERN_MAX)
+      continue;
+    const text = k === "pattern" ? cleanPattern(v) : v;
+    if (text === "")
+      continue;
+    if (k === "minLength" || k === "maxLength") {
+      if (!LENGTH_RE.test(v))
+        continue;
+    } else if (k === "step") {
+      if (!NUMBER_RE.test(v))
+        continue;
+    } else if (k === "min" || k === "max") {
+      if (!NUMBER_RE.test(v) && !Object.values(DATE_RE).some((re) => re.test(v)))
+        continue;
+    }
+    seen.add(k);
+    out.push({ k, v: text });
+  }
+  return out;
+}
+function statedLimitsRecord(limits) {
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+var STATED_LIMITS_VERSION, STATED_PATTERN_MAX, KINDS, MAX_LIMITS, TEXT_TYPES, NUMBER_TYPES, DATE_RE, NUMBER_RE, LENGTH_RE;
+var init_stated_limits = __esm({
+  "../shared/dist/stated-limits.js"() {
+    "use strict";
+    STATED_LIMITS_VERSION = 1;
+    STATED_PATTERN_MAX = 200;
+    KINDS = ["min", "max", "minLength", "maxLength", "step", "pattern"];
+    MAX_LIMITS = KINDS.length;
+    TEXT_TYPES = /* @__PURE__ */ new Set(["text", "search", "email", "url", "tel", "password", "textarea", ""]);
+    NUMBER_TYPES = /* @__PURE__ */ new Set(["number", "range"]);
+    DATE_RE = {
+      date: /^\d{4}-\d{2}-\d{2}$/,
+      "datetime-local": /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?$/,
+      time: /^\d{2}:\d{2}(?::\d{2})?$/,
+      month: /^\d{4}-\d{2}$/,
+      week: /^\d{4}-W\d{2}$/
+    };
+    NUMBER_RE = /^-?\d{1,15}(?:\.\d{1,10})?$/;
+    LENGTH_RE = /^\d{1,7}$/;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -18533,9 +19789,11 @@ __export(dist_exports, {
   ACTION_BATCH_MAX_SIZE: () => ACTION_BATCH_MAX_SIZE,
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
+  ADMIN_FORCE_CANCELLED_RUN_ERROR: () => ADMIN_FORCE_CANCELLED_RUN_ERROR,
   ADMIN_VIEW_DEFAULT_RETURN_TO: () => ADMIN_VIEW_DEFAULT_RETURN_TO,
   AGENT_AI_PROVIDER_PREFIXES: () => AGENT_AI_PROVIDER_PREFIXES,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  ALLOWED_PROVIDER_CHAIN_HOPS: () => ALLOWED_PROVIDER_CHAIN_HOPS,
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_MODEL_CATALOG: () => API_MODEL_CATALOG,
   API_MODEL_FIELDS: () => API_MODEL_FIELDS,
@@ -18556,6 +19814,7 @@ __export(dist_exports, {
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
   AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
   AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
+  AUTH_SESSION_GENERATION_RE: () => AUTH_SESSION_GENERATION_RE,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -18574,12 +19833,14 @@ __export(dist_exports, {
   BUG_TEST_BROKEN_REASON: () => BUG_TEST_BROKEN_REASON,
   BUG_TEST_BROKEN_TAG: () => BUG_TEST_BROKEN_TAG,
   CACHE_PRICE_PER_M: () => CACHE_PRICE_PER_M,
+  CANCELLED_REASON_PREFIXES: () => CANCELLED_REASON_PREFIXES,
   CANVAS_UNSUPPORTED_BODY: () => CANVAS_UNSUPPORTED_BODY,
   CANVAS_UNSUPPORTED_CODE: () => CANVAS_UNSUPPORTED_CODE,
   CANVAS_UNSUPPORTED_NOT_CHARGED: () => CANVAS_UNSUPPORTED_NOT_CHARGED,
   CANVAS_UNSUPPORTED_OVERRIDE_HINT: () => CANVAS_UNSUPPORTED_OVERRIDE_HINT,
   CANVAS_UNSUPPORTED_TITLE: () => CANVAS_UNSUPPORTED_TITLE,
   CAPTURE_JSON_STRUCTURE_LIMITS: () => CAPTURE_JSON_STRUCTURE_LIMITS,
+  CHAIN_CANCELLED_RUN_ERROR: () => CHAIN_CANCELLED_RUN_ERROR,
   CHAT_FAILOVER_KEY: () => CHAT_FAILOVER_KEY,
   CLAUDE_CLI_DEFAULT_EFFORT: () => CLAUDE_CLI_DEFAULT_EFFORT,
   CLAUDE_CLI_DEFAULT_MODEL: () => CLAUDE_CLI_DEFAULT_MODEL,
@@ -18616,6 +19877,7 @@ __export(dist_exports, {
   DEFAULT_GEMINI_SCREEN_MODEL: () => DEFAULT_GEMINI_SCREEN_MODEL,
   DEFAULT_JSON_STRUCTURE_LIMITS: () => DEFAULT_JSON_STRUCTURE_LIMITS,
   DEFAULT_PLATFORM_DB_POOL_SIZE: () => DEFAULT_PLATFORM_DB_POOL_SIZE,
+  DEFAULT_PROVIDER_ACCOUNT_ID: () => DEFAULT_PROVIDER_ACCOUNT_ID,
   DEFAULT_SHARED_DB_POOL_SIZE: () => DEFAULT_SHARED_DB_POOL_SIZE,
   DEFAULT_STT_MODEL: () => DEFAULT_STT_MODEL,
   DEFAULT_STT_MODEL_BY_PROVIDER: () => DEFAULT_STT_MODEL_BY_PROVIDER,
@@ -18632,6 +19894,7 @@ __export(dist_exports, {
   ENVIRONMENTAL_ERROR_STORED_PREFIXES: () => ENVIRONMENTAL_ERROR_STORED_PREFIXES,
   EVIDENCE_NOTE_PREFIXES: () => EVIDENCE_NOTE_PREFIXES,
   EXPECT_CALL_RE: () => EXPECT_CALL_RE,
+  FEATURE_ROW_RUN_WINDOW: () => FEATURE_ROW_RUN_WINDOW,
   FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
   FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
   FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
@@ -18688,6 +19951,8 @@ __export(dist_exports, {
   LIVE_FRAME_STALE_MS: () => LIVE_FRAME_STALE_MS,
   LIVE_FRAME_UNFOCUSED_INTERVAL_MS: () => LIVE_FRAME_UNFOCUSED_INTERVAL_MS,
   LIVE_THUMBNAIL_MAX_BASE64_BYTES: () => LIVE_THUMBNAIL_MAX_BASE64_BYTES,
+  MAX_BALANCED_SCAN: () => MAX_BALANCED_SCAN,
+  MAX_CALLS: () => MAX_CALLS,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
   MAX_EMAIL_ADDRESS_LENGTH: () => MAX_EMAIL_ADDRESS_LENGTH,
@@ -18697,6 +19962,8 @@ __export(dist_exports, {
   MAX_ORG_NAME_LENGTH: () => MAX_ORG_NAME_LENGTH,
   MAX_PASSWORD_BYTES: () => MAX_PASSWORD_BYTES,
   MAX_PLAYWRIGHT_CODE_LENGTH: () => MAX_PLAYWRIGHT_CODE_LENGTH,
+  MAX_PROVIDER_ACCOUNTS: () => MAX_PROVIDER_ACCOUNTS,
+  MAX_PROVIDER_ACCOUNT_MODELS: () => MAX_PROVIDER_ACCOUNT_MODELS,
   MAX_SURVEY_ENTRY_URLS: () => MAX_SURVEY_ENTRY_URLS,
   MAX_SURVEY_ENTRY_URL_LENGTH: () => MAX_SURVEY_ENTRY_URL_LENGTH,
   MCP_ARMY_LIMITS: () => MCP_ARMY_LIMITS,
@@ -18732,6 +19999,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
+  OPENCODE_GO_DEEPSEEK_GLM_MODELS: () => OPENCODE_GO_DEEPSEEK_GLM_MODELS,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -18751,10 +20019,12 @@ __export(dist_exports, {
   PLAN_FEATURES: () => PLAN_FEATURES,
   PLAN_FEATURE_LOCKED_CODE: () => PLAN_FEATURE_LOCKED_CODE,
   PLAN_ORDER: () => PLAN_ORDER,
+  PLATFORM_ADMIN_CANCELLED_RUN_ERROR: () => PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
   PLATFORM_DEFAULT_PROVIDER: () => PLATFORM_DEFAULT_PROVIDER,
   PLATFORM_PLAN_BILLING: () => PLATFORM_PLAN_BILLING,
   PLATFORM_SERVER_APPLICATION_NAME: () => PLATFORM_SERVER_APPLICATION_NAME,
+  PLATFORM_SUPPORT_CANCELLED_RUN_ERROR: () => PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
   POST_SPECIAL_TRIAL_DAYS: () => POST_SPECIAL_TRIAL_DAYS,
   PRESET_DIRECT_FALLBACK: () => PRESET_DIRECT_FALLBACK,
   PRODUCTION_READ_ONLY_GUARD_TEMPLATE: () => PRODUCTION_READ_ONLY_GUARD_TEMPLATE,
@@ -18766,17 +20036,25 @@ __export(dist_exports, {
   PROJECT_OVERRIDE_FIELDS: () => PROJECT_OVERRIDE_FIELDS,
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
+  PROVIDER_ACCOUNT_ID_PATTERN: () => PROVIDER_ACCOUNT_ID_PATTERN,
+  PROVIDER_ACCOUNT_MODEL_PATTERN: () => PROVIDER_ACCOUNT_MODEL_PATTERN,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAINS_SETTING_MAX_CHARS: () => PROVIDER_CHAINS_SETTING_MAX_CHARS,
+  PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_CHAIN_MAX_ENTRIES: () => PROVIDER_CHAIN_MAX_ENTRIES,
+  PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
   READINESS_POLL_MAX_CODE_CHARS: () => READINESS_POLL_MAX_CODE_CHARS,
   READ_ONLY_TAGS: () => READ_ONLY_TAGS,
   RECHECKED_NOTES: () => RECHECKED_NOTES,
   RECORDING_VALUE_PLACEHOLDERS: () => RECORDING_VALUE_PLACEHOLDERS,
+  RENDER_IDENTITY_MAX_LENGTH: () => RENDER_IDENTITY_MAX_LENGTH,
   REPOSITORY_CLIS: () => REPOSITORY_CLIS,
   RESERVED_PROJECT_KEYS: () => RESERVED_PROJECT_KEYS,
   RESULT_STRUCTURE_TOO_COSTLY_CODE: () => RESULT_STRUCTURE_TOO_COSTLY_CODE,
   RETRIED_ATTEMPTS_KEY: () => RETRIED_ATTEMPTS_KEY,
+  RETRY_HELD_RUN_ERROR: () => RETRY_HELD_RUN_ERROR,
   RUNNER_INTERRUPT_ERROR_PREFIX: () => RUNNER_INTERRUPT_ERROR_PREFIX,
   RUN_INTERRUPTED_ERROR_PREFIXES: () => RUN_INTERRUPTED_ERROR_PREFIXES,
   RUN_INTERRUPTION_NOT_RETRIED_MARKERS: () => RUN_INTERRUPTION_NOT_RETRIED_MARKERS,
@@ -18789,6 +20067,8 @@ __export(dist_exports, {
   SHARED_SERVER_APPLICATION_NAME: () => SHARED_SERVER_APPLICATION_NAME,
   SPEND_SOURCE_KEY: () => SPEND_SOURCE_KEY,
   SPEND_SOURCE_SERVER: () => SPEND_SOURCE_SERVER,
+  STATED_LIMITS_VERSION: () => STATED_LIMITS_VERSION,
+  STATED_PATTERN_MAX: () => STATED_PATTERN_MAX,
   STATIC_STANDARD_MIN_INTERACTIVE: () => STATIC_STANDARD_MIN_INTERACTIVE,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   SUCCESS_NOTICE_TEXT: () => SUCCESS_NOTICE_TEXT,
@@ -18805,6 +20085,7 @@ __export(dist_exports, {
   SURVEY_NOTES_RENDER_MAX_CHARS: () => SURVEY_NOTES_RENDER_MAX_CHARS,
   SURVEY_NOTE_KEYS: () => SURVEY_NOTE_KEYS,
   SUSPICIOUS_PASS_TAG: () => SUSPICIOUS_PASS_TAG,
+  TEST_DID_NOT_RUN_ERROR: () => TEST_DID_NOT_RUN_ERROR,
   TEST_QUALITY_CONVENTIONS: () => TEST_QUALITY_CONVENTIONS,
   TEST_USER_ENV_KEYS: () => TEST_USER_ENV_KEYS,
   TEST_VARIABLE_SECRET_KEY_PATTERN: () => TEST_VARIABLE_SECRET_KEY_PATTERN,
@@ -18817,23 +20098,33 @@ __export(dist_exports, {
   UI_VARIANTS: () => UI_VARIANTS,
   UNEXPECTED_PASS_ERROR_PREFIX: () => UNEXPECTED_PASS_ERROR_PREFIX,
   USER_CANCELLED_RUN_ERROR: () => USER_CANCELLED_RUN_ERROR,
+  VISUAL_MASK_SELECTORS_MAX: () => VISUAL_MASK_SELECTORS_MAX,
+  VISUAL_MASK_SELECTOR_FORBIDDEN: () => VISUAL_MASK_SELECTOR_FORBIDDEN,
+  VISUAL_MASK_SELECTOR_MAX_LENGTH: () => VISUAL_MASK_SELECTOR_MAX_LENGTH,
+  VISUAL_V1_IDENTITY: () => VISUAL_V1_IDENTITY,
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
+  ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
+  ZAI_PREFIX: () => ZAI_PREFIX,
+  accountServesModel: () => accountServesModel,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
+  allowedProviderChainHosts: () => allowedProviderChainHosts,
   alternatesAtTop: () => alternatesAtTop,
   analyzeDerivedValues: () => analyzeDerivedValues,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
   analyzePersistenceReread: () => analyzePersistenceReread,
   analyzeReadinessPolling: () => analyzeReadinessPolling,
+  analyzeRegexMatchers: () => analyzeRegexMatchers,
   analyzeSharedAccountUse: () => analyzeSharedAccountUse,
   analyzeStaleAfterSubmit: () => analyzeStaleAfterSubmit,
   analyzeTestData: () => analyzeTestData,
   analyzeUnreachedUrlWaits: () => analyzeUnreachedUrlWaits,
   analyzeUrlWaits: () => analyzeUrlWaits,
   analyzeWriteResponse: () => analyzeWriteResponse,
+  androidResourceOwners: () => androidResourceOwners,
   apiModelCardsFromConfig: () => apiModelCardsFromConfig,
   apiModelsForProvider: () => apiModelsForProvider,
   apiProviderModelLabel: () => apiProviderModelLabel,
@@ -18844,6 +20135,7 @@ __export(dist_exports, {
   applyLaunchSpecialPlan: () => applyLaunchSpecialPlan,
   asPlainExpect: () => asPlainExpect,
   assertionOnlyCode: () => assertionOnlyCode,
+  assertionStrengthHoistedReadsOn: () => assertionStrengthHoistedReadsOn,
   assertionsReadVisibleContent: () => assertionsReadVisibleContent,
   assessCodeOutcomeCoverage: () => assessCodeOutcomeCoverage,
   assessTitleCoverage: () => assessTitleCoverage,
@@ -18927,6 +20219,7 @@ __export(dist_exports, {
   deepgramSpeak: () => deepgramSpeak,
   deepgramTranscribe: () => deepgramTranscribe,
   defaultConfirmModel: () => defaultConfirmModel,
+  defaultProviderChainEntries: () => defaultProviderChainEntries,
   defaultScreenModel: () => defaultScreenModel,
   defaultVoiceForTtsModel: () => defaultVoiceForTtsModel,
   deriveAuthPlan: () => deriveAuthPlan,
@@ -18969,6 +20262,7 @@ __export(dist_exports, {
   extractOutcomeSearchTerms: () => extractOutcomeSearchTerms,
   featureForAiCallType: () => featureForAiCallType,
   featureForMcpTool: () => featureForMcpTool,
+  featureRowRunStatus: () => featureRowRunStatus,
   findBracedClause: () => findBracedClause,
   findCounterIdPins: () => findCounterIdPins,
   findCredentialTextLeftover: () => findCredentialTextLeftover,
@@ -18991,6 +20285,7 @@ __export(dist_exports, {
   formatPersistenceRereadAdvisory: () => formatPersistenceRereadAdvisory,
   formatPoolBudgetLine: () => formatPoolBudgetLine,
   formatReadinessPollAdvisory: () => formatReadinessPollAdvisory,
+  formatRegexMatcherNote: () => formatRegexMatcherNote,
   formatStaleAfterSubmitAdvisory: () => formatStaleAfterSubmitAdvisory,
   formatSuspiciousExpectation: () => formatSuspiciousExpectation,
   formatUrlWaitAdvisory: () => formatUrlWaitAdvisory,
@@ -19016,6 +20311,7 @@ __export(dist_exports, {
   getPlanChangeType: () => getPlanChangeType,
   getPlanDefinition: () => getPlanDefinition,
   getPlanLabel: () => getPlanLabel,
+  getProviderChainOverrides: () => getProviderChainOverrides,
   getTrialDaysRemaining: () => getTrialDaysRemaining,
   googleBrokerNavigationUrl: () => googleBrokerNavigationUrl,
   googleBrokerUnavailableLine: () => googleBrokerUnavailableLine,
@@ -19032,9 +20328,11 @@ __export(dist_exports, {
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
+  hasProviderChainLeadsByDefault: () => hasProviderChainLeadsByDefault,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
+  hasZaiPrefix: () => hasZaiPrefix,
   healMobileTestSteps: () => healMobileTestSteps,
   healthRunWhere: () => healthRunWhere,
   heldCodeRecord: () => heldCodeRecord,
@@ -19056,8 +20354,11 @@ __export(dist_exports, {
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isBrowserCliEngine: () => isBrowserCliEngine,
+  isBrowserVersion: () => isBrowserVersion,
   isBugTestBrokenError: () => isBugTestBrokenError,
+  isCancelledReason: () => isCancelledReason,
   isCanvasUnsupportedMessage: () => isCanvasUnsupportedMessage,
+  isChainablePrimary: () => isChainablePrimary,
   isCliEngineModelId: () => isCliEngineModelId,
   isCliEngineSpec: () => isCliEngineSpec,
   isCodeFactNote: () => isCodeFactNote,
@@ -19081,6 +20382,7 @@ __export(dist_exports, {
   isIdentityMobileXpath: () => isIdentityMobileXpath,
   isIdentityProviderSurface: () => isIdentityProviderSurface,
   isIncidentalAssetPath: () => isIncidentalAssetPath,
+  isIntentionalNegativeAuthTest: () => isIntentionalNegativeAuthTest,
   isIpOrLocalhost: () => isIpOrLocalhost,
   isKnownPageType: () => isKnownPageType,
   isLaunchSpecialActive: () => isLaunchSpecialActive,
@@ -19108,6 +20410,7 @@ __export(dist_exports, {
   isRunInterruptedError: () => isRunInterruptedError,
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
+  isSafeMaskSelector: () => isSafeMaskSelector,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
   isSelectableApiModel: () => isSelectableApiModel,
   isSelfServePlan: () => isSelfServePlan,
@@ -19138,6 +20441,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  isZaiModelId: () => isZaiModelId,
   jsEscapedForms: () => jsEscapedForms,
   jsonStructureRefusalOf: () => jsonStructureRefusalOf,
   jsonStructureVerify: () => jsonStructureVerify,
@@ -19170,6 +20474,7 @@ __export(dist_exports, {
   normalizeFinishReason: () => normalizeFinishReason,
   normalizeNoteText: () => normalizeNoteText,
   normalizePageType: () => normalizePageType,
+  normalizeProviderAccountModels: () => normalizeProviderAccountModels,
   normalizeTtsModel: () => normalizeTtsModel,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   noteChatFailover: () => noteChatFailover,
@@ -19186,6 +20491,7 @@ __export(dist_exports, {
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
+  parseAuthSessionStamp: () => parseAuthSessionStamp,
   parseBoolFlag: () => parseBoolFlag,
   parseDbPoolSize: () => parseDbPoolSize,
   parseDeepgramListenResponse: () => parseDeepgramListenResponse,
@@ -19193,13 +20499,18 @@ __export(dist_exports, {
   parseGeminiModelsPayload: () => parseGeminiModelsPayload,
   parseGoogleAuthorizeUrl: () => parseGoogleAuthorizeUrl,
   parseGoogleGisRequestUrl: () => parseGoogleGisRequestUrl,
+  parseLastActionProofMode: () => parseLastActionProofMode,
   parseLimitParam: () => parseLimitParam,
   parseOffsetParam: () => parseOffsetParam,
   parsePageParam: () => parsePageParam,
   parsePgIntSetting: () => parsePgIntSetting,
   parseProjectEngineOverrides: () => parseProjectEngineOverrides,
   parsePromotionGateMode: () => parsePromotionGateMode,
+  parseProviderAccountLists: () => parseProviderAccountLists,
+  parseProviderChainOverrides: () => parseProviderChainOverrides,
   parseRecheckClearMode: () => parseRecheckClearMode,
+  parseRenderIdentity: () => parseRenderIdentity,
+  parseStoredProviderChainOverrides: () => parseStoredProviderChainOverrides,
   parseSurveyEntryUrls: () => parseSurveyEntryUrls,
   parseSuspiciousPassMode: () => parseSuspiciousPassMode,
   parseTaskModelUpdate: () => parseTaskModelUpdate,
@@ -19229,13 +20540,20 @@ __export(dist_exports, {
   profileKeyRoute: () => profileKeyRoute,
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
+  providerChainHostOf: () => providerChainHostOf,
+  providerChainHostProvider: () => providerChainHostProvider,
+  providerChainLeadsFor: () => providerChainLeadsFor,
+  providerChainModelKey: () => providerChainModelKey,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
+  providerHostPlan: () => providerHostPlan,
+  readBalanced: () => readBalanced,
   readChatFailover: () => readChatFailover,
   readChatReasoningTokens: () => readChatReasoningTokens,
   readChatUsage: () => readChatUsage,
   readEnabledEngines: () => readEnabledEngines,
   readProjectEngineOverrides: () => readProjectEngineOverrides,
   readRetriedAttempts: () => readRetriedAttempts,
+  readStatedLimits: () => readStatedLimits,
   readStaticPageCanvasSignals: () => readStaticPageCanvasSignals,
   readSurveyEntryUrls: () => readSurveyEntryUrls,
   readSurveyNotes: () => readSurveyNotes,
@@ -19248,6 +20566,7 @@ __export(dist_exports, {
   regexLiteralEnd: () => regexLiteralEnd2,
   regexOpensAfter: () => regexOpensAfter,
   registrableDomain: () => registrableDomain,
+  renderIdentity: () => renderIdentity,
   renderSurveyNotesForPrompt: () => renderSurveyNotesForPrompt,
   repairPageType: () => repairPageType,
   replaceBlockComments: () => replaceBlockComments,
@@ -19295,11 +20614,14 @@ __export(dist_exports, {
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
   setAgenticCliRuntime: () => setAgenticCliRuntime,
+  setProviderChainOverrides: () => setProviderChainOverrides,
   signupPlanFor: () => signupPlanFor,
   simplifyMobileWanderingInPlace: () => simplifyMobileWanderingInPlace,
   siteOf: () => siteOf,
   specItemsFromTestPlans: () => specItemsFromTestPlans,
   splitAnswerLines: () => splitAnswerLines,
+  statedLimitsFromAttrs: () => statedLimitsFromAttrs,
+  statedLimitsRecord: () => statedLimitsRecord,
   stepAppliesToPlatform: () => stepAppliesToPlatform,
   stepConsoleLines: () => stepConsoleLines,
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
@@ -19311,7 +20633,11 @@ __export(dist_exports, {
   stripCodeFactPrefix: () => stripCodeFactPrefix,
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
+  stripFractionZeros: () => stripFractionZeros,
+  stripLineComment: () => stripLineComment,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingChars: () => stripTrailingChars,
+  stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
   summarizeHealth: () => summarizeHealth,
@@ -19328,10 +20654,14 @@ __export(dist_exports, {
   ttsFallbackModel: () => ttsFallbackModel,
   ttsProviderForModel: () => ttsProviderForModel,
   unexpectedPassError: () => unexpectedPassError,
+  v1RenderIdentity: () => v1RenderIdentity,
   validateAppMapDocument: () => validateAppMapDocument,
   validateAssertionStrength: () => validateAssertionStrength,
   validateEngineSpec: () => validateEngineSpec,
+  validateProviderChainEntries: () => validateProviderChainEntries,
+  validateProviderChainsSetting: () => validateProviderChainsSetting,
   validateTaskModelId: () => validateTaskModelId,
+  visualBaselinesEnabled: () => visualBaselinesEnabled,
   visualProDailyBudget: () => visualProDailyBudget,
   voiceMatchesTtsModel: () => voiceMatchesTtsModel,
   voicesForTtsModel: () => voicesForTtsModel,
@@ -19339,7 +20669,8 @@ __export(dist_exports, {
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
   withoutServerOnlySpendFields: () => withoutServerOnlySpendFields,
-  withoutSurveyNotes: () => withoutSurveyNotes
+  withoutSurveyNotes: () => withoutSurveyNotes,
+  zaiWireModel: () => zaiWireModel
 });
 var init_dist = __esm({
   "../shared/dist/index.js"() {
@@ -19381,6 +20712,7 @@ var init_dist = __esm({
     init_admin_view_return_to();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_session_stamp();
     init_auth_state_freshness();
     init_skip_coverage_detector();
     init_feature_coverage();
@@ -19392,11 +20724,14 @@ var init_dist = __esm({
     init_deepgram_voices();
     init_feature_flags();
     init_env_flags();
+    init_visual_compare_limits();
+    init_visual_baseline_identity();
     init_analytics_url();
     init_agentic_cli_runtime();
     init_api_model_catalog();
     init_engine_spec();
     init_provider_chains();
+    init_provider_accounts();
     init_project_engine_overrides();
     init_ai_profiles();
     init_openrouter_usage();
@@ -19437,6 +20772,8 @@ var init_dist = __esm({
     init_promotion_quality_gate();
     init_regex_alternation();
     init_page_evidence();
+    init_trailing_slashes();
+    init_stated_limits();
   }
 });
 
@@ -19465,17 +20802,12 @@ export {
   stepsNeedingReviewForPlatform,
   parseBoolFlag,
   decideHarPosted,
+  deriveAuthPlan,
   isConfigLikeReason,
   classifyErrorMessage,
   isAppOriginResolutionEnabled,
   resolveCrossOriginConfigOverride,
-  deriveAuthPlan,
-  detectAuthBlock,
-  detectApiColdSessionBlock,
-  coldSessionConfigMessage,
-  detectSkippedApiCoverage,
   isSharedAuthInjectEnabled,
-  isAuthReadinessGuardEnabled,
   isRepositoryCli,
   repositoryCliLabel,
   dist_exports,