@validate.qa/runner 1.0.100 → 1.0.102

package/dist/{chunk-2XD63NU5.mjs → chunk-4WLP3RWN.mjs}

@@ -1,10 +1,10 @@
 import {
   require_survey_network_guard
-} from "./chunk-GIIIVO2W.mjs";
+} from "./chunk-E2RRAE27.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-MBKGTELT.mjs";
+} from "./chunk-3JM6XTSZ.mjs";
 import {
   __commonJS,
   __require,
@@ -348,7 +348,7 @@ var require_run_write_guard = __commonJS({
   "../runner-core/dist/services/run-write-guard.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.RUN_WRITE_RELAYED_LINE = exports.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports.WRITE_HELD_ERROR_PREFIX = exports.RUN_WRITE_UNAVAILABLE_LINE = exports.RUN_WRITE_SAW_LINE = exports.RUN_WRITE_HELD_LINE = exports.RUN_WRITE_GUARD_LINE_PREFIX = exports.RUN_WRITE_SIGNIN_VARS_ENV = exports.RUN_WRITE_POLICY_ENV = exports.NO_KEEPALIVE_INIT_SCRIPT = exports.RUN_WRITE_LEAVING_EVENT = exports.RUN_WRITE_RELAY_KEY = exports.RUN_WRITE_DROPPED_BINDING = exports.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports.WEBSOCKET_NOT_GUARDED = exports.RunWriteGuard = exports.BROKER_TOKEN_TTL_MS = exports.MAX_RUN_WRITE_RECORDS = exports.SHARED_SUFFIX_PATTERN_REASON = exports.FIREBASE_AUTH_HANDLER_PATH = exports.SIGN_IN_SECRET_VARIABLE = exports.MAX_ALLOW_PATTERN_CHARS = exports.MAX_ALLOW_PATTERNS = exports.DEFAULT_RECORD_ONLY_RULES = exports.RECORD_ONLY_CAPABLE_RULES = exports.RUN_WRITE_POLICY_VERSION = void 0;
+    exports.RUN_WRITE_RELAYED_LINE = exports.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports.WRITE_HELD_ERROR_PREFIX = exports.RUN_WRITE_UNAVAILABLE_LINE = exports.RUN_WRITE_SAW_LINE = exports.RUN_WRITE_HELD_LINE = exports.RUN_WRITE_GUARD_LINE_PREFIX = exports.RUN_WRITE_SIGNIN_VARS_ENV = exports.RUN_WRITE_POLICY_ENV = exports.NO_KEEPALIVE_INIT_SCRIPT = exports.RUN_WRITE_LEAVING_EVENT = exports.RUN_WRITE_RELAY_KEY = exports.RUN_WRITE_DROPPED_BINDING = exports.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports.WEBSOCKET_NOT_GUARDED = exports.RunWriteGuard = exports.BROKER_TOKEN_TTL_MS = exports.MAX_RUN_WRITE_RECORDS = exports.SHARED_SUFFIX_PATTERN_REASON = exports.FIREBASE_AUTH_HANDLER_PATH = exports.SIGN_IN_SECRET_VARIABLE = exports.MAX_ALLOW_PATTERN_CHARS = exports.MAX_ALLOW_PATTERNS = exports.MAX_IDP_HOSTS = exports.DEFAULT_RECORD_ONLY_RULES = exports.RECORD_ONLY_CAPABLE_RULES = exports.RUN_WRITE_POLICY_VERSION = void 0;
     exports.parseRunWritePolicy = parseRunWritePolicy;
     exports.signInSecretsOf = signInSecretsOf;
     exports.withRunWritePolicyScope = withRunWritePolicyScope;
@@ -357,6 +357,8 @@ var require_run_write_guard = __commonJS({
     exports.bodyHasSignInSecret = bodyHasSignInSecret;
     exports.compileAllowPattern = compileAllowPattern;
     exports.allowPatternProblem = allowPatternProblem;
+    exports.normaliseIdpHost = normaliseIdpHost;
+    exports.idpHostProblem = idpHostProblem;
     exports.runWritePatternNotes = runWritePatternNotes;
     exports.decideRunWrite = decideRunWrite;
     exports.isGoogleBrokerToken = isGoogleBrokerToken;
@@ -365,6 +367,7 @@ var require_run_write_guard = __commonJS({
     exports.addRunWriteAuthHandler = addRunWriteAuthHandler;
     exports.runWriteContextOptions = runWriteContextOptions;
     exports.clearRunWriteRelay = clearRunWriteRelay;
+    exports.runWriteGuardHopBytesInFlight = runWriteGuardHopBytesInFlight;
     exports.installRunWriteGuard = installRunWriteGuard;
     exports.installNodeFetchGuard = installNodeFetchGuard;
     exports.runWriteGuardRefusal = runWriteGuardRefusal;
@@ -376,7 +379,11 @@ var require_run_write_guard = __commonJS({
     exports.safeWritePatternFor = safeWritePatternFor;
     var node_async_hooks_1 = __require("async_hooks");
     var node_crypto_1 = __require("crypto");
+    var node_http_1 = __require("http");
+    var node_https_1 = __require("https");
     var node_path_1 = __require("path");
+    var node_stream_1 = __require("stream");
+    var node_zlib_1 = __require("zlib");
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var survey_network_guard_js_1 = require_survey_network_guard();
     var bounded_output_js_1 = require_bounded_output();
@@ -384,6 +391,8 @@ var require_run_write_guard = __commonJS({
     exports.RECORD_ONLY_CAPABLE_RULES = ["write-shaped-get"];
     exports.DEFAULT_RECORD_ONLY_RULES = ["write-shaped-get"];
     var MAX_APP_SITES = 16;
+    exports.MAX_IDP_HOSTS = 4;
+    var MAX_IDP_HINTS = 4;
     exports.MAX_ALLOW_PATTERNS = 50;
     exports.MAX_ALLOW_PATTERN_CHARS = 200;
     var MAX_REASON_CHARS = 300;
@@ -411,6 +420,11 @@ var require_run_write_guard = __commonJS({
         const e = x;
         return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
       }) : [];
+      const idpHosts = Array.isArray(v.idpHosts) ? [...new Set(v.idpHosts.filter((h) => typeof h === "string" && normaliseIdpHost(h) === h && idpHostProblem(h) === null))].slice(0, exports.MAX_IDP_HOSTS) : [];
+      const ignoredIdpHosts = Array.isArray(v.ignoredIdpHosts) ? v.ignoredIdpHosts.slice(0, exports.MAX_ALLOW_PATTERNS).flatMap((x) => {
+        const e = x;
+        return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
+      }) : [];
       const recordOnlyRules = Array.isArray(v.recordOnlyRules) ? exports.RECORD_ONLY_CAPABLE_RULES.filter((rule) => v.recordOnlyRules.includes(rule)) : [...exports.DEFAULT_RECORD_ONLY_RULES];
       if (typeof v.reason !== "string")
         return null;
@@ -423,13 +437,17 @@ var require_run_write_guard = __commonJS({
         appSites: appSites.map((s) => s.toLowerCase()),
         allowPatterns,
         ignoredAllowPatterns,
+        // Only when set: a policy without them parses exactly as before.
+        ...idpHosts.length > 0 ? { idpHosts } : {},
+        ...ignoredIdpHosts.length > 0 ? { ignoredIdpHosts } : {},
         recordOnlyRules,
-        reason: v.reason.slice(0, MAX_REASON_CHARS)
+        reason: v.reason.slice(0, MAX_REASON_CHARS),
+        ...v.pwAgentsGuard === "off" ? { pwAgentsGuard: "off" } : {}
       };
     }
     var policyScope = new node_async_hooks_1.AsyncLocalStorage();
     var MIN_SIGN_IN_SECRET_CHARS = 6;
-    exports.SIGN_IN_SECRET_VARIABLE = /PASS(?:WORD|CODE|PHRASE)?$/i;
+    exports.SIGN_IN_SECRET_VARIABLE = /(?:PASS(?:WORD|CODE|PHRASE)?|[A-Z0-9]_PASSWD|[A-Z0-9]_PWD)$/i;
     function signInSecretsOf(vars) {
       if (!vars || typeof vars !== "object")
         return [];
@@ -446,6 +464,7 @@ var require_run_write_guard = __commonJS({
     }
     var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     var MAX_BODY_CHARS = 262144;
+    var MAX_SIGN_IN_LOG_LINES = 20;
     var CAPTCHA_HOSTS = ["recaptcha.net", "hcaptcha.com", "challenges.cloudflare.com"];
     var SEARCH_POST_HOSTS = ["algolia.net", "algolianet.com", "algolia.io"];
     var PAYMENT_HOSTS = [
@@ -471,7 +490,7 @@ var require_run_write_guard = __commonJS({
     var SEARCH_LAST_SEGMENTS = /* @__PURE__ */ new Set(["search", "autocomplete", "suggest", "suggestions", "typeahead"]);
     var PROVIDER_SIGN_UP_PATH = /(?:\/accounts:signup|\/dbconnections\/signup|\/auth\/v1\/signup|\/v1\/client\/sign_ups)(?:[/?]|$)/i;
     var FIRST_PARTY_SIGN_UP_SEGMENTS = /* @__PURE__ */ new Set(["signup", "sign-up", "sign_up", "register", "registration", "create-account", "createaccount", "sign_ups"]);
-    var NOT_A_SIGN_IN_SEGMENTS = /* @__PURE__ */ new Set([
+    var NOT_A_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
       "delete",
       "destroy",
       "remove",
@@ -480,19 +499,29 @@ var require_run_write_guard = __commonJS({
       "cancel",
       "password",
       "passwords",
-      "change-password",
-      "change_password",
       "reset",
-      "reset-password",
       "update",
       "logout",
       "signout",
-      "sign-out",
       "revoke",
       "transfer",
-      "withdraw"
+      "withdraw",
+      "disable",
+      "enable",
+      "unlink",
+      "change",
+      "erase",
+      "purge",
+      "wipe",
+      "terminate",
+      "suspend",
+      "leave",
+      "disconnect",
+      "deauthorize"
     ]);
-    var SIGN_IN_SHAPED_SEGMENTS = /* @__PURE__ */ new Set([
+    var ACCOUNT_CHANGE_WORDS = /* @__PURE__ */ new Set(["email", "mfa", "2fa", "totp", "otp"]);
+    var ACCOUNT_CHANGE_CONTEXT = /* @__PURE__ */ new Set(["account", "owner", "ownership", "invite"]);
+    var SIGN_IN_LAST_SEGMENTS = /* @__PURE__ */ new Set([
       "session",
       "sessions",
       "login",
@@ -502,25 +531,511 @@ var require_run_write_guard = __commonJS({
       "signin",
       "sign-in",
       "sign_in",
-      "auth",
       "authenticate",
       "authentication",
+      "auth"
+    ]);
+    var SIGN_IN_VERB_SEGMENTS = /* @__PURE__ */ new Set(["login", "log-in", "log_in", "signin", "sign-in", "sign_in"]);
+    var SIGN_IN_CREDENTIAL_KINDS = /* @__PURE__ */ new Set(["email", "username", "phone", "password"]);
+    var SIGN_IN_TAILS = /* @__PURE__ */ new Set(["callback/credentials", "auth/local", "session/new", "sessions/new"]);
+    var PASSWORD_GRANT = /(?:^|[&{,\s"])grant_type"?\s*[=:]\s*"?password(?=["&,}\s]|$)/;
+    var NEW_CREDENTIAL_STEM = "(?:pass(?:word|wd)?|pwd)";
+    var NEW_CREDENTIAL_WORD = `(?:(?:new|old|current|confirm|repeat|verify|retype)[_-]?(?:${NEW_CREDENTIAL_STEM}|email)|${NEW_CREDENTIAL_STEM}[_-]?(?:new|old|current|confirm(?:ation)?|repeat(?:ed)?|verify|verification|again|retype|check|confirmed|2)|email[_-]?confirm(?:ation)?)`;
+    var NEW_CREDENTIAL_NAME = new RegExp(`^${NEW_CREDENTIAL_WORD}$`, "i");
+    var NEW_CREDENTIAL_KEY = new RegExp(`(?:^|["&{,\\s[])${NEW_CREDENTIAL_WORD}(?:["\\]]?\\s*[:=]|"\\s*(?:;|$))`, "im");
+    var PASSWORD_KEY_WORDS = /* @__PURE__ */ new Set(["password", "passwd", "pwd", "pass"]);
+    var PASSWORD_KEY_QUALIFIERS = /* @__PURE__ */ new Set([
+      "new",
+      "old",
+      "current",
+      "confirm",
+      "confirmed",
+      "confirmation",
+      "repeat",
+      "repeated",
+      "verify",
+      "verification",
+      "again",
+      "retype",
+      "check",
+      "2"
+    ]);
+    function isPasswordKey(key) {
+      const words = wordsOf(key);
+      return words.some((w) => PASSWORD_KEY_WORDS.has(w)) && words.every((w) => PASSWORD_KEY_WORDS.has(w) || PASSWORD_KEY_QUALIFIERS.has(w));
+    }
+    function couldBePassword(value) {
+      if (value === void 0)
+        return true;
+      if (typeof value === "number")
+        return Number.isFinite(value);
+      if (typeof value !== "string")
+        return false;
+      const v = value.trim();
+      return v !== "" && !/^(?:true|false|on|off|yes|no|null)$/i.test(v);
+    }
+    var MAX_CREDENTIAL_KEYS = 200;
+    function credentialKeysOf(body, contentType) {
+      const type = (contentType ?? "").toLowerCase();
+      const keys = [];
+      try {
+        if (type.includes("json") || /^\s*[[{]/.test(body)) {
+          const stack = [{ value: JSON.parse(body), under: null }];
+          while (stack.length > 0 && keys.length < MAX_CREDENTIAL_KEYS) {
+            const { value, under } = stack.pop();
+            if (Array.isArray(value))
+              stack.push(...value.slice(0, MAX_CREDENTIAL_KEYS).map((inner) => ({ value: inner, under: null })));
+            else if (value && typeof value === "object") {
+              for (const [key, inner] of Object.entries(value).slice(0, MAX_CREDENTIAL_KEYS)) {
+                const name = under === null ? key : `${under}_${key}`;
+                keys.push({ name, value: inner });
+                if (Array.isArray(inner) && isPasswordKey(name)) {
+                  for (const item of inner.slice(0, MAX_CREDENTIAL_KEYS))
+                    if (item === null || typeof item !== "object")
+                      keys.push({ name, value: item });
+                }
+                const object = inner !== null && typeof inner === "object" && !Array.isArray(inner);
+                stack.push({ value: inner, under: object && isPasswordKey(name) ? name : null });
+              }
+            }
+          }
+        } else if (type.includes("multipart/form-data")) {
+          for (const m of body.matchAll(/(?:^|[;\s])name="([^"]{1,200})"/g))
+            if (keys.push({ name: m[1], value: void 0 }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        } else if (type.includes("x-www-form-urlencoded")) {
+          for (const [name, value] of new URLSearchParams(body))
+            if (keys.push({ name, value }) >= MAX_CREDENTIAL_KEYS)
+              break;
+        }
+      } catch {
+      }
+      return keys.slice(0, MAX_CREDENTIAL_KEYS).map(({ name, value }) => {
+        const bare = name.replace(/\[\]$/, "");
+        const parts = bare.match(/[^[\]]+/g);
+        if (bare.endsWith("]") && parts && parts.length > 1) {
+          const inner = parts[parts.length - 1];
+          const outer = parts[parts.length - 2];
+          if (isPasswordKey(outer)) {
+            if (/^\d+$/.test(inner))
+              return { name: outer, value };
+            if (isPasswordKey(inner) || NEW_CREDENTIAL_NAME.test(inner))
+              return { name: inner, value };
+            return { name: `${outer}_${inner}`, value };
+          }
+        }
+        return { name: /\[([^[\]]*)\]$/.exec(bare)?.[1] ?? bare, value };
+      });
+    }
+    function namesNewCredential(body, contentType) {
+      if (NEW_CREDENTIAL_KEY.test(body))
+        return true;
+      const type = contentType ?? (/^\s*[[{]/.test(body) ? null : "application/x-www-form-urlencoded");
+      const keys = credentialKeysOf(body, type);
+      if (keys.some(({ name }) => NEW_CREDENTIAL_NAME.test(name)))
+        return true;
+      const found = keys.filter(({ name, value }) => isPasswordKey(name) && couldBePassword(value));
+      const isBare = (name) => wordsOf(name).every((w) => PASSWORD_KEY_WORDS.has(w));
+      const named = new Set(found.filter(({ name }) => !isBare(name)).map(({ name }) => name.toLowerCase()));
+      const bare = new Set(found.filter(({ name }) => isBare(name)).map(({ name, value }) => value === void 0 ? `name:${name.toLowerCase()}` : `value:${String(value)}`));
+      return named.size + Math.min(bare.size, 2) >= 2;
+    }
+    var GRAPHQL_SIGN_IN_NAME = /^(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})$/i;
+    var GRAPHQL_SIGN_IN_VERBS = ["login", "signin", "authenticate"];
+    var GRAPHQL_SIGN_IN_PHRASE_WORDS = /* @__PURE__ */ new Set(["with", "via", "by", "using"]);
+    var GRAPHQL_SIGN_IN_TAIL_WORDS = /* @__PURE__ */ new Set([
+      "user",
+      "mutation",
+      "mfa",
+      "otp",
+      "totp",
+      "sso",
+      "anonymous",
+      "anonymously",
+      "email",
+      "password",
+      "phone",
+      "number",
+      "code",
       "token",
-      "tokens",
+      "refresh",
+      "custom",
+      "api",
+      "key",
+      "magic",
+      "credentials",
+      "username",
+      "credential",
+      "sms",
+      "pin",
+      "jwt",
+      "mobile",
+      "session",
+      "ticket",
+      "qr",
+      "biometric",
+      "biometrics",
+      "wallet",
+      "identifier",
+      "address",
+      "local",
+      "login",
+      "userid",
+      "passkey",
+      "webauthn",
+      "idp",
+      "oauth",
+      "oidc",
+      "saml",
+      "ldap",
+      "google",
+      "apple",
+      "github",
+      "gitlab",
+      "facebook",
+      "microsoft",
+      "azure",
+      "twitter",
+      "linkedin",
+      "discord",
+      "slack",
+      "twitch",
+      "keycloak",
+      "okta",
+      "ethereum",
+      "firebase",
+      "cognito",
+      "apikey",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme"
+    ]);
+    var GRAPHQL_SIGN_IN_SUBJECT_WORDS = /* @__PURE__ */ new Set(["user", "customer", "admin", "member", "staff", "account"]);
+    var GRAPHQL_SIGN_IN_JOINERS = /* @__PURE__ */ new Set(["and", "or"]);
+    var GRAPHQL_SIGN_IN_JOINED_KINDS = /* @__PURE__ */ new Set([
+      "github",
+      "gitlab",
+      "linkedin",
+      "webauthn",
+      "passkey",
+      "apikey",
+      "idp",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme",
+      "username",
+      "userid"
+    ]);
+    function joinSplitKinds(words) {
+      const out = [];
+      for (let i = 0; i < words.length; i++) {
+        let joined = 0;
+        for (let n = Math.min(3, words.length - i); n >= 2; n--) {
+          const part = words.slice(i, i + n);
+          if (!part.some((w) => GRAPHQL_SIGN_IN_JOINERS.has(w)) && GRAPHQL_SIGN_IN_JOINED_KINDS.has(part.join(""))) {
+            joined = n;
+            break;
+          }
+        }
+        if (joined) {
+          out.push(words.slice(i, i + joined).join(""));
+          i += joined - 1;
+        } else
+          out.push(words[i]);
+      }
+      return out;
+    }
+    var GRAPHQL_SIGN_IN_LINK_KINDS = /* @__PURE__ */ new Set(["magic", "email"]);
+    function graphqlSignInTail(name) {
+      const words = wordsOf(name.replace(/(?<=[A-Z0-9][A-Z0-9])(?=[A-Z][a-z])/g, " "));
+      const head = words[0] === "log" || words[0] === "sign" ? words[1] === "in" ? [`${words[0]}in`, ...words.slice(2)] : null : words;
+      if (!head || head.length === 0)
+        return null;
+      const verb = GRAPHQL_SIGN_IN_VERBS.find((v) => head[0].startsWith(v));
+      if (!verb)
+        return null;
+      const glued = head[0].slice(verb.length);
+      return glued ? [glued, ...head.slice(1)] : head.slice(1);
+    }
+    function isGraphqlSignInTail(tail) {
+      const words = joinSplitKinds(tail);
+      let start = 0;
+      while (start < words.length && GRAPHQL_SIGN_IN_SUBJECT_WORDS.has(words[start]))
+        start++;
+      if (start === words.length)
+        return true;
+      let kinds = words.slice(start);
+      const phrase = kinds.findIndex((w) => GRAPHQL_SIGN_IN_PHRASE_WORDS.has(w));
+      if (phrase >= 0) {
+        if (phrase === kinds.length - 1 || phrase > 0 && GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase - 1]) || GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase + 1]))
+          return false;
+        kinds = [...kinds.slice(0, phrase), ...kinds.slice(phrase + 1)];
+      }
+      if (kinds.length === 0)
+        return false;
+      const isKind = (w, before) => GRAPHQL_SIGN_IN_TAIL_WORDS.has(w) || /^v\d{1,3}$/.test(w) || /^\d?fa$/.test(w) || w === "link" && before !== void 0 && GRAPHQL_SIGN_IN_LINK_KINDS.has(before);
+      return kinds.every((w, i) => GRAPHQL_SIGN_IN_JOINERS.has(w) ? i > 0 && i < kinds.length - 1 && !GRAPHQL_SIGN_IN_JOINERS.has(kinds[i - 1]) : isKind(w, i === phrase ? void 0 : kinds[i - 1]));
+    }
+    function wordsOf(segment) {
+      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s.,_/-]+/).filter(Boolean);
+    }
+    function rawSegmentsOf(pathname) {
+      return pathname.split("/").map((seg) => {
+        const raw = seg.split(";")[0];
+        try {
+          return decodeURIComponent(raw);
+        } catch {
+          return raw;
+        }
+      }).filter(Boolean);
+    }
+    function changesSomething(segments, opts = {}) {
+      const words = segments.flatMap(wordsOf);
+      const joined = segments.map((seg) => wordsOf(seg).join(""));
+      const hard = (w) => NOT_A_SIGN_IN_WORDS.has(w) && !(opts.passwordIsCredential && (w === "password" || w === "passwords"));
+      if (words.some(hard) || joined.some(hard))
+        return true;
+      return words.some((w) => ACCOUNT_CHANGE_WORDS.has(w)) && words.some((w) => ACCOUNT_CHANGE_CONTEXT.has(w));
+    }
+    function isGraphqlSignInName(name) {
+      if (!GRAPHQL_SIGN_IN_NAME.test(name))
+        return false;
+      const tail = graphqlSignInTail(name);
+      return tail !== null && isGraphqlSignInTail(tail) && !changesSomething([name], { passwordIsCredential: true });
+    }
+    function graphqlSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let signIns = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return null;
+        const { query, operationName } = entry;
+        if (typeof query !== "string") {
+          if (!Array.isArray(parsed) && query === void 0 && typeof operationName === "string" && isGraphqlSignInName(operationName))
+            return "persisted";
+          return null;
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return null;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && changesSomething([operationName], { passwordIsCredential: true }))
+            return null;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.length === 0 || !roots.every(isGraphqlSignInName))
+            return null;
+          signIns += roots.length;
+        }
+      }
+      return signIns > 0 ? "document" : null;
+    }
+    var NOT_A_BROKER_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
+      "add",
+      "book",
+      "booking",
+      "bookings",
+      "order",
+      "orders",
+      "reserve",
+      "reservation",
+      "reservations",
+      "submit",
+      "send",
+      "invite",
+      "invites",
+      "invitation",
+      "invitations",
+      "checkout",
+      "purchase",
+      "purchases",
+      "buy",
+      "pay",
+      "payment",
+      "payments",
+      "cart",
+      "subscribe",
+      "subscription",
+      "subscriptions",
+      "publish",
+      "upload",
+      "charge",
+      "charges",
+      "refund",
+      "refunds"
+    ]);
+    var BROKER_MAKE_VERBS = /* @__PURE__ */ new Set(["create", "generate"]);
+    var BROKER_CREDENTIAL_WORDS = /* @__PURE__ */ new Set(["session", "sessions", "login", "logins", "signin", "sign", "token", "tokens", "jwt", "jwts"]);
+    var BROKER_CREDENTIAL_QUALIFIERS = /* @__PURE__ */ new Set([
+      "access",
+      "refresh",
+      "id",
+      "auth",
       "oauth",
-      "oauth2",
+      "bearer",
+      "in",
+      "new",
+      "user",
+      "customer",
+      "with",
+      "from",
+      "via",
+      "for",
+      "by",
+      "and",
+      "mutation",
+      "google",
+      "apple",
+      "facebook",
+      "github",
+      "microsoft",
       "sso",
-      "identity",
-      "credentials"
+      "social",
+      "oidc",
+      "firebase"
     ]);
-    var GRAPHQL_SIGN_IN = /"operationName"\s*:\s*"(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})"|\bmutation\b[^{]{0,200}\{\s*(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})\s*[({]/i;
-    function isCredentialSignInShape(pathname, postData) {
-      const segs = segmentsOf(pathname);
-      if (segs.some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg)))
+    function namesOnlyACredential(words) {
+      const rest = words.filter((w) => !BROKER_MAKE_VERBS.has(w));
+      return rest.some((w) => BROKER_CREDENTIAL_WORDS.has(w)) && rest.every((w) => BROKER_CREDENTIAL_WORDS.has(w) || BROKER_CREDENTIAL_QUALIFIERS.has(w));
+    }
+    function actsBesidesBrokerSignIn(segments) {
+      return segments.some((seg, i) => {
+        const words = wordsOf(seg);
+        if (words.some((w) => NOT_A_BROKER_SIGN_IN_WORDS.has(w)) || NOT_A_BROKER_SIGN_IN_WORDS.has(words.join("")))
+          return true;
+        if (!words.some((w) => BROKER_MAKE_VERBS.has(w)))
+          return false;
+        if (namesOnlyACredential(words))
+          return false;
+        return !(words.length === 1 && i > 0 && i === segments.length - 1 && namesOnlyACredential(wordsOf(segments[i - 1])));
+      });
+    }
+    function brokerRefuses(segments) {
+      return changesSomething(segments) || actsBesidesBrokerSignIn(segments);
+    }
+    var BROKER_SIGN_IN_NAME_WORDS = /* @__PURE__ */ new Set(["login", "signin", "sign", "auth", "authenticate", "google", "oauth", "sso", "social", "session"]);
+    function isBrokerSignInName(name) {
+      return typeof name === "string" && wordsOf(name).some((w) => BROKER_SIGN_IN_NAME_WORDS.has(w)) && !brokerRefuses([name]);
+    }
+    function graphqlBrokerSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let mutationRoots = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return false;
+        const { query, operationName } = entry;
+        const record = entry;
+        const ids = PERSISTED_ID_KEYS.map((key) => record[key]).filter((n) => n !== void 0);
+        const names = operationName === void 0 ? ids : [operationName, ...ids];
+        if (ids.length > 0 && !names.every(isBrokerSignInName))
+          return false;
+        if (typeof query !== "string") {
+          return !Array.isArray(parsed) && query === void 0 && names.length > 0 && names.every(isBrokerSignInName);
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return false;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && brokerRefuses([operationName]))
+            return false;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.some((root) => brokerRefuses([root])))
+            return false;
+          mutationRoots += roots.length;
+        }
+      }
+      return mutationRoots === 1;
+    }
+    var GRAPHQL_DOCUMENT_START = /^[\s,]*(?:[{#]|(?:query|mutation|subscription|fragment)\b)/;
+    function looksLikeGraphqlDocument(text) {
+      return GRAPHQL_DOCUMENT_START.test(text) || (0, survey_network_guard_js_1.graphqlOperationRoots)(text) !== null;
+    }
+    var PERSISTED_ID_KEYS = ["id", "documentId", "doc_id", "queryId"];
+    var GRAPHQL_ENVELOPE_FIELDS = ["variables", "operationName", "documentId", "doc_id", "queryId", "sha256Hash", "hash", "extensions", "operations"];
+    function hasGraphqlEnvelope(has, queryIsString) {
+      return queryIsString || GRAPHQL_ENVELOPE_FIELDS.some(has);
+    }
+    function carriesGraphql(search, body, contentType) {
+      if (search.getAll("query").some(looksLikeGraphqlDocument))
+        return true;
+      if (/^\s*application\/graphql\b/i.test(contentType ?? ""))
+        return true;
+      if (/multipart\//i.test(contentType ?? "") || /^\s*--/.test(body)) {
+        const parts = new Set([...body.matchAll(/\bname\s*=\s*"?([\w-]+)/gi)].map((m) => m[1]));
+        return hasGraphqlEnvelope((field) => parts.has(field), parts.has("query"));
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        if (looksLikeGraphqlDocument(body))
+          return true;
+        const form = new URLSearchParams(body);
+        return hasGraphqlEnvelope((field) => form.has(field), form.has("query"));
+      }
+      if (Array.isArray(parsed))
+        return true;
+      if (!parsed || typeof parsed !== "object")
+        return false;
+      const record = parsed;
+      return hasGraphqlEnvelope((field) => record[field] !== void 0, typeof record.query === "string");
+    }
+    function isBrokerSignInShape(pathname, search, postData, contentType) {
+      if (brokerRefuses(rawSegmentsOf(pathname)))
+        return false;
+      if (!isGraphqlPath(pathname) && !(typeof postData === "string" && carriesGraphql(search, postData, contentType)))
+        return true;
+      if ((0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search) || PERSISTED_ID_KEYS.some((key) => search.has(key)) || typeof postData !== "string" || postData.length > MAX_BODY_CHARS)
+        return false;
+      return graphqlBrokerSignIn(postData);
+    }
+    function isCredentialSignInShape(pathname, search, postData, contentType) {
+      if (typeof postData === "string" && postData.length > MAX_BODY_CHARS)
+        return false;
+      const body = typeof postData === "string" && postData.length <= MAX_BODY_CHARS ? postData : null;
+      if (body !== null && namesNewCredential(body, contentType))
         return false;
-      if (segs.some((seg) => SIGN_IN_SHAPED_SEGMENTS.has(seg)))
+      const raw = rawSegmentsOf(pathname);
+      const segs = raw.map((seg) => seg.toLowerCase());
+      const last = segs[segs.length - 1] ?? "";
+      const prev = segs[segs.length - 2] ?? "";
+      if (SIGN_IN_VERB_SEGMENTS.has(prev) && SIGN_IN_CREDENTIAL_KINDS.has(last))
+        return !changesSomething(raw, { passwordIsCredential: true });
+      if (changesSomething(raw))
+        return false;
+      if (SIGN_IN_LAST_SEGMENTS.has(last) || SIGN_IN_TAILS.has(`${prev}/${last}`))
         return true;
-      return isGraphqlPath(pathname) && typeof postData === "string" && postData.length <= MAX_BODY_CHARS && GRAPHQL_SIGN_IN.test(postData);
+      if (last === "token")
+        return search.get("grant_type") === "password" || body !== null && PASSWORD_GRANT.test(body);
+      if (!isGraphqlPath(pathname) || body === null || (0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search))
+        return false;
+      const graphql = graphqlSignIn(body);
+      return graphql === "persisted" ? graphql : graphql === "document";
     }
     function bodyHasSignInSecret(body, secrets) {
       if (!body || body.length > MAX_BODY_CHARS || secrets.length === 0)
@@ -548,7 +1063,7 @@ var require_run_write_guard = __commonJS({
     var COGNITO_HOSTED_UI_RE = /^\/(?:oauth2\/(?:token|authorize|userinfo|idpresponse)|saml2\/idpresponse|login|logincontinue)$/;
     var CLERK_FAPI_RE = /^\/v1\/(?:client(?:\/(?:sign_ins(?:\/[^/]+\/(?:prepare_first_factor|attempt_first_factor|prepare_second_factor|attempt_second_factor))?|sessions\/[^/]+\/(?:touch|tokens(?:\/[^/]+)?)|handshake|sync|link))?|dev_browser|environment|oauth_callback)$/;
     var SUPABASE_AUTH_RE = /^\/auth\/v1\/(?:token|otp|magiclink|verify|authorize|callback|sso|saml\/acs|reauthenticate|factors\/[^/]+\/(?:challenge|verify))$/;
-    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
+    var AUTH0_AUTH_RE = /^\/(?:oauth\/(?:token|ro)|authorize(?:\/resume)?|co\/authenticate|usernamepassword\/(?:login|challenge)|login\/(?:callback|identifier|password)|passwordless\/(?:start|verify)|userinfo|mfa\/challenge|u\/(?:login(?:\/[^/]+)?|mfa-(?:otp|sms|email|voice|phone|push|webauthn-platform|webauthn-roaming|recovery-code)-challenge(?:-push|-new-code)?|mfa-(?:sms|push|email)-list|mfa-login-options|mfa-detect-browser-capabilities|mfa-country-codes|consent))$/;
     var OKTA_AUTH_RE = /^\/(?:api\/v1\/(?:authn(?:\/(?:factors\/[^/]+\/verify|skip|cancel))?|sessions(?:\/me\/lifecycle\/refresh)?)|oauth2\/(?:[^/]+\/)?v1\/(?:token|authorize|introspect|userinfo|device\/authorize)|idp\/idx\/(?:introspect|identify(?:\/select)?|challenge(?:\/answer|\/poll)?|skip|cancel)|login\/[^/]+(?:\/[^/]+)?)$/;
     var MICROSOFT_AUTH_RE = /\/(?:oauth2\/(?:v2\.0\/)?(?:token|authorize|devicecode)|login|kmsi|getcredentialtype|sas\/(?:processauth|beginauth|endauth)|selfasserted|api\/combinedsigninandsignup\/[^/]+|resume|reprocess|federation\/oauth2)$/;
     var GOOGLE_ACCOUNTS_RE = /^\/(?:o\/oauth2\/(?:token|auth|v2\/auth|iframerpc|postmessagerelay|approval)|gsi\/[^/]+(?:\/[^/]+)?|_\/(?:signin|lookup|identitysigninui|accountssigninui)\/.+|v3\/signin\/.+|signin\/.+|servicelogin|checkcookie|accountchooser)$/;
@@ -614,14 +1129,26 @@ var require_run_write_guard = __commonJS({
       return GENERIC_IDP_AUTH_RE.test(path);
     }
     function isAuthProviderWrite(method, host, pathname, amzTarget, search) {
+      if (!isPlainPost(method, search))
+        return false;
+      if (!(0, shared_1.isAuthProviderHost)(host))
+        return false;
+      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+    }
+    function isPlainPost(method, search) {
       if (method.toUpperCase() !== "POST")
         return false;
       const tunnelled = search.get("_method");
-      if (tunnelled !== null && tunnelled.toUpperCase() !== "POST")
+      return tunnelled === null || tunnelled.toUpperCase() === "POST";
+    }
+    function isAuth0CustomDomainSignIn(method, pathname, search) {
+      if (!isPlainPost(method, search))
         return false;
-      if (!(0, shared_1.isAuthProviderHost)(host))
+      const path = pathname.toLowerCase();
+      if (!AUTH0_AUTH_RE.test(path))
         return false;
-      return isAuthProviderSignIn(host.toLowerCase(), pathname, amzTarget, search);
+      const needsState = path.startsWith("/u/") || path === "/authorize" || path === "/authorize/resume";
+      return !needsState || (search.get("state") ?? "") !== "";
     }
     function isSignUp(host, pathname, amzTarget) {
       if (PROVIDER_SIGN_UP_PATH.test(pathname))
@@ -700,6 +1227,26 @@ var require_run_write_guard = __commonJS({
       }).join("");
       return { method, host, path: new RegExp(`^${body}/?$`, "i") };
     }
+    function normaliseIdpHost(raw) {
+      return raw.trim().toLowerCase().replace(/\.$/, "");
+    }
+    var WILDCARD_DNS_RE = /(?:^|\.)(?:nip\.io|sslip\.io|xip\.io|localtest\.me|lvh\.me|vcap\.me|traefik\.me|localho\.st|localhost\.direct|local\.gd|fuf\.me)$/;
+    function idpHostProblem(host) {
+      if (host.length > 253 || !/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(host))
+        return "not a host name (no scheme, port, path or wildcard)";
+      if (/^[0-9.]+$/.test(host))
+        return "an IP address";
+      if (/(?:^|\.)(?:localhost|local|internal)$/.test(host))
+        return "a local name";
+      if (WILDCARD_DNS_RE.test(host))
+        return "a wildcard-DNS name (it can point at any address)";
+      if ((0, shared_1.isSharedSuffix)(host))
+        return exports.SHARED_SUFFIX_PATTERN_REASON;
+      return null;
+    }
+    function isIdpHost(url, host, policy) {
+      return url.protocol === "https:" && url.port === "" && (policy.idpHosts ?? []).includes(host);
+    }
     function matchesAllowPatterns(method, host, pathname, policy, compiled) {
       const patterns = compiled ?? policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
       return patterns.some((p) => {
@@ -723,7 +1270,10 @@ var require_run_write_guard = __commonJS({
           return reason ? [{ pattern, reason }] : [];
         })
       ];
-      return ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`);
+      return [
+        ...ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`),
+        ...(policy.ignoredIdpHosts ?? []).map(({ pattern, reason }) => `[run-write-guard] AUTH_PROVIDER_HOSTS entry ${JSON.stringify(pattern)} ignored: ${reason}`)
+      ];
     }
     function describe(facts, url, rule) {
       return {
@@ -747,8 +1297,7 @@ var require_run_write_guard = __commonJS({
       const host = url.hostname.toLowerCase().replace(/\.$/, "");
       const pathname = url.pathname;
       if (READ_METHODS.has(method)) {
-        const doc = method === "GET" && isGraphqlPath(pathname) ? url.searchParams.get("query") : null;
-        if (doc !== null && !(0, survey_network_guard_js_1.graphqlDocumentIsQueryOnly)(doc)) {
+        if (method === "GET" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlGetMayWrite)(url, facts.postData)) {
           return { action: "write", rule: "graphql-get-mutation", record: describe(facts, url, "graphql-get-mutation") };
         }
         if (method !== "OPTIONS" && isAppSite(host, policy)) {
@@ -776,20 +1325,24 @@ var require_run_write_guard = __commonJS({
         return { action: "write", rule: "sign-up", record: describe(facts, url, "sign-up") };
       if (isAuthProviderWrite(method, host, pathname, facts.amzTarget, url.searchParams))
         return { action: "allow", rule: "auth-provider" };
+      if (isIdpHost(url, host, policy) && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "auth-provider" };
       const appSite = isAppSite(host, policy);
       if (facts.registeredAuthHandler && pathname === exports.FIREBASE_AUTH_HANDLER_PATH)
         return { action: "allow", rule: "auth-provider" };
       if (appSite && (0, survey_network_guard_js_1.isSignInPathWrite)(method, pathname))
         return { action: "allow", rule: "sign-in" };
-      if (appSite && method === "POST" && facts.brokerTokenInBody && !segmentsOf(pathname).some((seg) => NOT_A_SIGN_IN_SEGMENTS.has(seg))) {
+      if (appSite && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "sign-in" };
+      if (appSite && method === "POST" && facts.brokerTokenInBody && isBrokerSignInShape(pathname, url.searchParams, facts.postData, facts.contentType)) {
         return { action: "allow", rule: "broker-sign-in" };
       }
       if (appSite && isEvidencedTokenRefresh(method, pathname, facts.postData))
         return { action: "allow", rule: "token-refresh" };
-      if (appSite && method === "POST" && facts.signInSecretInBody && isCredentialSignInShape(pathname, facts.postData)) {
-        return { action: "allow", rule: "credential-sign-in" };
-      }
-      if (method === "POST" && isGraphqlPath(pathname) && isGraphqlQueryOnlyBody(facts.postData))
+      const signIn = appSite && method === "POST" && facts.signInSecretInBody ? isCredentialSignInShape(pathname, url.searchParams, facts.postData, facts.contentType) : false;
+      if (signIn)
+        return { action: "allow", rule: "credential-sign-in", ...signIn === "persisted" ? { persisted: true } : {} };
+      if (method === "POST" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlUrlQueriesAreReads)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
         return { action: "allow", rule: "graphql-query" };
       if (method === "POST" && hostIs(host, SEARCH_POST_HOSTS))
         return { action: "allow", rule: "search-post" };
@@ -834,6 +1387,8 @@ var require_run_write_guard = __commonJS({
       recordOnly;
       log;
       signInSecrets;
+      /** The deadline of one request the guard sends itself, all its hops together (sendCheckingRedirect). */
+      redirectCheckTimeoutMs;
       /** Tokens the Google sign-in broker handed this context, each until its expiry (epoch ms). */
       brokerTokens = [];
       /** Origins of the Firebase Auth handlers the broker registered for this context. */
@@ -842,12 +1397,18 @@ var require_run_write_guard = __commonJS({
       relayIds = /* @__PURE__ */ new Set();
       relayed = 0;
       relayRejected = 0;
+      /** Credential sign-ins already said in the run log (observe mode; method, host and path shape). */
+      signInsLogged = /* @__PURE__ */ new Set();
+      /** Hosts already named in the run log as a possible AUTH_PROVIDER_HOSTS entry (at most MAX_IDP_HINTS). */
+      idpHintsLogged = /* @__PURE__ */ new Set();
       constructor(policy, opts = {}) {
         this.policy = policy;
         this.compiled = policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
         this.recordOnly = new Set((policy.recordOnlyRules ?? exports.DEFAULT_RECORD_ONLY_RULES).filter((rule) => exports.RECORD_ONLY_CAPABLE_RULES.includes(rule)));
         this.log = opts.onLog;
         this.signInSecrets = (opts.signInSecrets ?? []).filter((v) => typeof v === "string" && v.length >= MIN_SIGN_IN_SECRET_CHARS);
+        const ms = opts.redirectCheckTimeoutMs;
+        this.redirectCheckTimeoutMs = typeof ms === "number" && ms > 0 ? Math.min(ms, REDIRECT_CHECK_TIMEOUT_MS) : REDIRECT_CHECK_TIMEOUT_MS;
       }
       decide(facts) {
         const signInSecretInBody = facts.signInSecretInBody ?? bodyHasSignInSecret(facts.postData, this.signInSecrets);
@@ -870,8 +1431,28 @@ var require_run_write_guard = __commonJS({
           consumedBrokerTokens.add(brokerToken.value);
           this.brokerTokens = this.brokerTokens.filter((t) => t !== brokerToken);
         }
+        if (decision.rule === "credential-sign-in" && this.policy.mode === "observe")
+          this.noteCredentialSignIn(facts, decision.persisted === true);
         return decision;
       }
+      /**
+       * Observe mode says where each credential sign-in went, once per path and kind (the lead): the
+       * method, host and masked path only, never the body, so the rule can be checked against real runs
+       * before a site is blocked. A GraphQL persisted query is marked unverified.
+       */
+      noteCredentialSignIn(facts, persisted) {
+        let host = "";
+        try {
+          host = new URL(facts.url).hostname.toLowerCase();
+        } catch {
+          return;
+        }
+        const line = `${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} [credential-sign-in${persisted ? " (persisted, unverified)" : ""}]`;
+        if (this.signInsLogged.has(line) || this.signInsLogged.size >= MAX_SIGN_IN_LOG_LINES)
+          return;
+        this.signInsLogged.add(line);
+        this.log?.(`[run-write-guard] allowed ${line}`);
+      }
       /**
        * A code or ID token the Google sign-in broker hands this context: the first POST that carries it
        * to the app in the next BROKER_TOKEN_TTL_MS is the sign-in. Anything not shaped like a Google code
@@ -917,6 +1498,22 @@ var require_run_write_guard = __commonJS({
         const verb = held ? "held" : "saw";
         const why = record.writeShaped ? `${record.rule}, ${record.writeShaped}` : record.rule;
         this.log?.(`[run-write-guard] ${verb} ${record.method} ${record.host}${record.path}${record.keys.length ? ` (${record.keys.join(", ")})` : ""} [${why}]`);
+        this.hintIdpHost(record);
+      }
+      /**
+       * An Auth0 sign-in step (by path) posted to another site was a third-party write: the tenant may
+       * answer on a custom domain of its own. Said once per host, for at most MAX_IDP_HINTS hosts, so a
+       * person knows AUTH_PROVIDER_HOSTS exists; the guard never names the host itself.
+       */
+      hintIdpHost(record) {
+        if (record.rule !== "third-party-write" || record.method !== "POST")
+          return;
+        if (this.idpHintsLogged.has(record.host) || this.idpHintsLogged.size >= MAX_IDP_HINTS)
+          return;
+        if ((this.policy.idpHosts ?? []).includes(record.host) || !AUTH0_AUTH_RE.test(record.path.toLowerCase()))
+          return;
+        this.idpHintsLogged.add(record.host);
+        this.log?.(`[run-write-guard] note: ${record.host} looks like an Auth0 sign-in on another site; if it is the app's own sign-in, a project admin can name it in AUTH_PROVIDER_HOSTS in Test Data`);
       }
       /**
        * A page sent a message over a WebSocket to the app's site. The guard cannot tell a read from a
@@ -931,8 +1528,9 @@ var require_run_write_guard = __commonJS({
       }
       /**
        * A hop the guard fetched itself (sendCheckingRedirect) failed, so the request fails in the page.
-       * Said in the run log, with the timeout when it was that: a slow allowed upload or stream is cut
-       * at REDIRECT_CHECK_TIMEOUT_MS, and the page only sees a network error.
+       * Said in the run log, with the reason when it was the guard's own limit: a slow allowed upload or
+       * stream is cut at its deadline, an answer over MAX_GUARD_HOP_BYTES as it streams in, and the page
+       * only sees a network error.
        */
       noteRedirectCheckFailed(facts, err, timeoutMs) {
         let host = "";
@@ -940,8 +1538,8 @@ var require_run_write_guard = __commonJS({
           host = new URL(facts.url).hostname.toLowerCase();
         } catch {
         }
-        const timedOut = err instanceof Error && (err.name === "TimeoutError" || /\btimeout\b/i.test(err.message));
-        const why = timedOut ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : "the guard's redirect check failed";
+        const reason = err instanceof GuardHopError ? err.reason : null;
+        const why = reason === "timeout" ? `the guard's redirect check timed out after ${Math.round(timeoutMs / 1e3)} s (REDIRECT_CHECK_TIMEOUT_MS)` : reason === "over-cap" ? `the answer was over ${MAX_GUARD_HOP_BYTES / (1024 * 1024)} MB (MAX_GUARD_HOP_BYTES), cut as it came in` : "the guard's redirect check failed";
         this.log?.(`[run-write-guard] note: ${facts.method.toUpperCase()} ${host}${(0, survey_network_guard_js_1.maskedPath)(facts.url)} failed in the page: ${why}`);
       }
       /** A request still undecided when its page closed (see guardPageClose): it is failed in the page, so the browser never sends it. */
@@ -1389,66 +1987,321 @@ var require_run_write_guard = __commonJS({
       }
     }
     var MAX_GUARD_REDIRECTS = 5;
-    var REDIRECT_CHECK_TIMEOUT_MS = 6e4;
+    var REDIRECT_CHECK_TIMEOUT_MS = 3e4;
+    var MAX_GUARD_HOP_BYTES = 16 * 1024 * 1024;
+    var MAX_GUARD_BUFFERED_BYTES = 128 * 1024 * 1024;
+    var SEND_HTTP = node_http_1.request;
+    var SEND_HTTPS = node_https_1.request;
+    var HOP_ONLY_HEADERS = /* @__PURE__ */ new Set([
+      "connection",
+      "keep-alive",
+      "proxy-connection",
+      "transfer-encoding",
+      "te",
+      "trailer",
+      "upgrade",
+      "proxy-authorization",
+      "proxy-authenticate",
+      "host",
+      "content-length"
+    ]);
+    var hopBytesInFlight = 0;
+    var hopsInFlight = /* @__PURE__ */ new Set();
+    var hopBudgetWaiters = [];
+    function releaseHopBytes(hop, bytes) {
+      hopsInFlight.delete(hop);
+      hopBytesInFlight -= bytes;
+      for (const wake of hopBudgetWaiters.splice(0))
+        wake();
+    }
+    function runWriteGuardHopBytesInFlight() {
+      return hopBytesInFlight;
+    }
+    var GuardHopError = class extends Error {
+      reason;
+      constructor(reason, message) {
+        super(message);
+        this.reason = reason;
+        this.name = "GuardHopError";
+      }
+    };
+    function sendGuardHop(hop) {
+      return new Promise((resolve, reject) => {
+        let url;
+        try {
+          url = new URL(hop.url);
+        } catch (err) {
+          reject(err);
+          return;
+        }
+        const send = url.protocol === "https:" ? SEND_HTTPS : url.protocol === "http:" ? SEND_HTTP : null;
+        if (!send) {
+          reject(new Error(`the guard sends only http(s), not ${url.protocol}`));
+          return;
+        }
+        const id = /* @__PURE__ */ Symbol("guard hop");
+        hopsInFlight.add(id);
+        let held = 0;
+        let settled = false;
+        let req = null;
+        const chunks = [];
+        const fail = (err) => {
+          if (settled)
+            return;
+          settled = true;
+          clearTimeout(timer);
+          req?.destroy();
+          releaseHopBytes(id, held);
+          held = 0;
+          reject(err);
+        };
+        const overCap = () => new GuardHopError("over-cap", `answer over ${MAX_GUARD_HOP_BYTES} bytes`);
+        const timer = setTimeout(() => fail(new GuardHopError("timeout", "the guard hop passed its deadline")), Math.max(0, hop.deadline - Date.now()));
+        try {
+          req = send(url, { method: hop.method, headers: hop.headers, rejectUnauthorized: !hop.ignoreHTTPSErrors, agent: false }, (res) => {
+            const encoding = String(res.headers["content-encoding"] ?? "").trim().toLowerCase();
+            const decoder = encoding === "gzip" || encoding === "x-gzip" ? (0, node_zlib_1.createGunzip)({ flush: node_zlib_1.constants.Z_SYNC_FLUSH, finishFlush: node_zlib_1.constants.Z_SYNC_FLUSH }) : encoding === "br" ? (0, node_zlib_1.createBrotliDecompress)({ flush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH, finishFlush: node_zlib_1.constants.BROTLI_OPERATION_FLUSH }) : encoding === "deflate" ? (0, node_zlib_1.createInflate)() : null;
+            const body = decoder ? (0, node_stream_1.pipeline)(res, decoder, (err) => {
+              if (err)
+                fail(err);
+            }) : res;
+            const parked = [];
+            let paused = false;
+            let ended = false;
+            const take = (chunk) => {
+              if (settled)
+                return;
+              if (paused) {
+                parked.push(chunk);
+                return;
+              }
+              if (held + chunk.length > MAX_GUARD_HOP_BYTES) {
+                fail(overCap());
+                return;
+              }
+              const oldest = hopsInFlight.values().next().value === id;
+              const room = oldest ? MAX_GUARD_BUFFERED_BYTES : MAX_GUARD_BUFFERED_BYTES - MAX_GUARD_HOP_BYTES;
+              if (hopBytesInFlight + chunk.length > room) {
+                paused = true;
+                body.pause();
+                parked.push(chunk);
+                hopBudgetWaiters.push(drain);
+                return;
+              }
+              hopBytesInFlight += chunk.length;
+              held += chunk.length;
+              chunks.push(chunk);
+            };
+            const drain = () => {
+              paused = false;
+              const queued = parked.splice(0);
+              for (let i = 0; i < queued.length; i++) {
+                take(queued[i]);
+                if (settled)
+                  return;
+                if (paused) {
+                  parked.push(...queued.slice(i + 1));
+                  return;
+                }
+              }
+              if (ended)
+                finish();
+              else
+                body.resume();
+            };
+            body.on("data", take);
+            body.on("error", (err) => fail(err));
+            res.on("error", (err) => fail(err));
+            body.on("end", () => {
+              ended = true;
+              if (!paused)
+                finish();
+            });
+            const finish = () => {
+              if (settled)
+                return;
+              settled = true;
+              clearTimeout(timer);
+              const kept = held;
+              let released = false;
+              const headers = [];
+              for (let i = 0; i + 1 < res.rawHeaders.length; i += 2)
+                headers.push([res.rawHeaders[i], res.rawHeaders[i + 1]]);
+              resolve({
+                status: res.statusCode ?? 0,
+                headers,
+                body: Buffer.concat(chunks, kept),
+                decoded: decoder !== null,
+                release: () => {
+                  if (!released) {
+                    released = true;
+                    releaseHopBytes(id, kept);
+                  }
+                }
+              });
+            };
+          });
+          req.on("error", (err) => fail(err));
+          req.end(hop.body ?? void 0);
+        } catch (err) {
+          fail(err instanceof Error ? err : new Error(String(err)));
+        }
+      });
+    }
+    function contextIgnoresHttpsErrors(context) {
+      try {
+        return context._options?.ignoreHTTPSErrors === true;
+      } catch {
+        return false;
+      }
+    }
+    function hopRequestHeaders(pageHeaders, cookie) {
+      const out = { accept: "*/*" };
+      for (const [name, value] of Object.entries(pageHeaders)) {
+        const key = name.toLowerCase();
+        if (key.startsWith(":") || HOP_ONLY_HEADERS.has(key) || key === "cookie")
+          continue;
+        out[key] = value;
+      }
+      out["accept-encoding"] = "gzip, deflate, br";
+      if (cookie)
+        out.cookie = cookie;
+      return out;
+    }
+    function cookiePairs(header) {
+      return header.split(";").flatMap((part) => {
+        const eq = part.indexOf("=");
+        return eq > 0 ? [[part.slice(0, eq).trim(), part.slice(eq + 1).trim()]] : [];
+      });
+    }
+    function hopCookie(pageCookie, contextCookies, setCookies) {
+      const jar = /* @__PURE__ */ new Map();
+      if (pageCookie)
+        for (const [name, value] of cookiePairs(pageCookie))
+          jar.set(name, value);
+      else
+        for (const c of contextCookies)
+          jar.set(c.name, c.value);
+      for (const line of setCookies) {
+        const [pair, ...attrs] = line.split(";");
+        const eq = pair.indexOf("=");
+        if (eq <= 0)
+          continue;
+        const name = pair.slice(0, eq).trim();
+        const gone = attrs.some((a) => {
+          const [k, v = ""] = a.split("=");
+          const key = k.trim().toLowerCase();
+          return key === "max-age" && Number(v.trim()) <= 0 || key === "expires" && Date.parse(v.trim()) < Date.now();
+        });
+        if (gone)
+          jar.delete(name);
+        else
+          jar.set(name, pair.slice(eq + 1).trim());
+      }
+      return [...jar].map(([name, value]) => `${name}=${value}`).join("; ");
+    }
+    function setCookiesOf(answer) {
+      return answer.headers.filter(([name]) => name.toLowerCase() === "set-cookie").map(([, value]) => value);
+    }
+    function fulfillHeaders(answer, earlierSetCookies) {
+      const out = {};
+      const cookies = [...earlierSetCookies];
+      for (const [name, value] of answer.headers) {
+        const key = name.toLowerCase();
+        if (HOP_ONLY_HEADERS.has(key) || answer.decoded && key === "content-encoding")
+          continue;
+        if (key === "set-cookie") {
+          cookies.push(value);
+          continue;
+        }
+        out[key] = key in out ? `${out[key]}, ${value}` : value;
+      }
+      if (cookies.length > 0)
+        out["set-cookie"] = cookies.join("\n");
+      return out;
+    }
     var cutAtClose = /* @__PURE__ */ new WeakSet();
-    async function sendCheckingRedirect(route, guard) {
-      const first = factsOf(route.request());
+    async function sendCheckingRedirect(route, guard, context) {
+      const request = route.request();
+      const first = factsOf(request);
+      const deadline = Date.now() + guard.redirectCheckTimeoutMs;
       let facts = first;
+      let pageHeaders = {};
+      let postBody = null;
+      const setCookies = [];
       for (let hop = 0; ; hop++) {
-        let response;
+        let answer;
         try {
-          response = await route.fetch(hop === 0 ? { maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS } : { url: facts.url, maxRedirects: 0, timeout: REDIRECT_CHECK_TIMEOUT_MS });
+          if (hop === 0) {
+            pageHeaders = request.headers();
+            postBody = request.postDataBuffer();
+          }
+          const pageCookie = hop === 0 ? Object.entries(pageHeaders).find(([name]) => name.toLowerCase() === "cookie")?.[1] : void 0;
+          const cookie = hopCookie(pageCookie, pageCookie ? [] : await context.cookies(facts.url), setCookies);
+          answer = await sendGuardHop({
+            url: facts.url,
+            method: facts.method,
+            headers: hopRequestHeaders(pageHeaders, cookie),
+            body: postBody,
+            ignoreHTTPSErrors: contextIgnoresHttpsErrors(context),
+            deadline
+          });
         } catch (err) {
           if (cutAtClose.has(route))
             return;
-          guard.noteRedirectCheckFailed(facts, err, REDIRECT_CHECK_TIMEOUT_MS);
+          guard.noteRedirectCheckFailed(facts, err, guard.redirectCheckTimeoutMs);
           await route.abort("failed").catch(() => {
           });
           return;
         }
-        if (cutAtClose.has(route))
-          return;
-        const status = response.status();
-        const location = response.headers()["location"];
-        const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
-        if (!next) {
-          await route.fulfill({ response }).catch(() => {
-          });
-          return;
-        }
-        let decision;
         try {
-          decision = guard.decide(next);
-        } catch {
-          decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
-        }
-        if (decision.action === "write") {
-          if (decision.record)
-            guard.note(decision.record);
-          if (guard.holds(decision.rule)) {
+          if (cutAtClose.has(route))
+            return;
+          const status = answer.status;
+          const location = answer.headers.find(([name]) => name.toLowerCase() === "location")?.[1];
+          const next = REDIRECT_STATUSES.has(status) && location ? redirectFacts(facts, status, location) : null;
+          if (!next) {
+            await route.fulfill({ status, headers: fulfillHeaders(answer, setCookies), body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          let decision;
+          try {
+            decision = guard.decide(next);
+          } catch {
+            decision = { action: "write", rule: "decision-error", record: { method: next.method, host: "", path: (0, survey_network_guard_js_1.maskedPath)(next.url), keys: [], rule: "decision-error" } };
+          }
+          if (decision.action === "write") {
+            if (decision.record)
+              guard.note(decision.record);
+            if (guard.holds(decision.rule)) {
+              await route.abort("blockedbyclient").catch(() => {
+              });
+              return;
+            }
+          }
+          if (READ_METHODS.has(next.method.toUpperCase())) {
+            await route.fulfill({ status, headers: { ...fulfillHeaders(answer, setCookies), location: next.url }, body: answer.body }).catch(() => {
+            });
+            return;
+          }
+          if (!sameOrigin(next.url, first.url)) {
+            const target = new URL(next.url);
+            guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
             await route.abort("blockedbyclient").catch(() => {
             });
             return;
           }
+          if (hop + 1 >= MAX_GUARD_REDIRECTS) {
+            await route.abort("failed").catch(() => {
+            });
+            return;
+          }
+          setCookies.push(...setCookiesOf(answer));
+          facts = next;
+        } finally {
+          answer.release();
         }
-        if (READ_METHODS.has(next.method.toUpperCase())) {
-          await route.fulfill({ response, headers: { ...response.headers(), location: next.url } }).catch(() => {
-          });
-          return;
-        }
-        if (!sameOrigin(next.url, first.url)) {
-          const target = new URL(next.url);
-          guard.note(describe(next, target, isAppSite(target.hostname.toLowerCase(), guard.policy) ? "app-write" : "third-party-write"));
-          await route.abort("blockedbyclient").catch(() => {
-          });
-          return;
-        }
-        if (hop + 1 >= MAX_GUARD_REDIRECTS) {
-          await route.abort("failed").catch(() => {
-          });
-          return;
-        }
-        facts = next;
       }
     }
     function sameRouteUrl(a, b) {
@@ -1468,8 +2321,9 @@ var require_run_write_guard = __commonJS({
       };
       Object.assign(context, {
         route: async (url, handler, options) => {
-          await route(url, handler, options);
+          const disposable = await route(url, handler, options);
           others.push({ url, handler });
+          return disposable;
         },
         unroute: async (url, handler) => {
           if (handler === void 0 && sameRouteUrl(url, GUARD_ROUTE)) {
@@ -1662,7 +2516,7 @@ var require_run_write_guard = __commonJS({
             }
           }
           if (decision.action === "allow" && !READ_METHODS.has(request.method().toUpperCase()) && checksRedirect(decision.rule, request.url(), guard.policy)) {
-            await sendCheckingRedirect(route, guard);
+            await sendCheckingRedirect(route, guard, context);
             return;
           }
           await route.fallback().catch(() => {
@@ -1802,6 +2656,7 @@ var require_run_write_guard = __commonJS({
     }
     function buildRunWriteGuardHook(policy, modulePath, signInSecretNames = [], opts = {}) {
       const withContext = opts.browserContext !== false;
+      const hookTest = opts.hookTest ?? "test";
       const names = signInSecretNames.filter((n) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(n)).slice(0, 16);
       return `
 import { createRequire as __qaWriteGuardRequire } from 'node:module';
@@ -1824,7 +2679,7 @@ try {
 } catch (err) {
   __qaWriteGuardError = err;
 }
-test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
+${hookTest}.beforeEach(async (${withContext ? "{ context }" : ""}) => {
   try {
     if (__qaWriteGuardError) throw __qaWriteGuardError;
     ${withContext ? "await __qaWriteGuard.installRunWriteGuard(context, __qaWriteGuardPolicy, { onLog: (line) => console.log(line), signInSecrets: __qaWriteGuardSecrets });" : "// an @api test: no browser context, only Node's fetch is guarded"}
@@ -1833,7 +2688,7 @@ test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
     ${policy.mode === "block" ? "throw err;" : "// observe: never fail the test"}
   }
 });${withContext && policy.mode === "block" ? `
-test.afterEach(async ({ context }) => {
+${hookTest}.afterEach(async ({ context }) => {
   try { if (__qaWriteGuard) await __qaWriteGuard.clearRunWriteRelay(context); } catch { /* the context closes next */ }
 });` : ""}
 `;