@validate.qa/runner 1.0.101 → 1.0.102

package/dist/{chunk-BBTK6OX6.mjs → chunk-4WLP3RWN.mjs}

@@ -1,10 +1,10 @@
 import {
   require_survey_network_guard
-} from "./chunk-SN3PN4G4.mjs";
+} from "./chunk-E2RRAE27.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-IGXGSDE3.mjs";
+} from "./chunk-3JM6XTSZ.mjs";
 import {
   __commonJS,
   __require,
@@ -348,7 +348,7 @@ var require_run_write_guard = __commonJS({
   "../runner-core/dist/services/run-write-guard.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
-    exports.RUN_WRITE_RELAYED_LINE = exports.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports.WRITE_HELD_ERROR_PREFIX = exports.RUN_WRITE_UNAVAILABLE_LINE = exports.RUN_WRITE_SAW_LINE = exports.RUN_WRITE_HELD_LINE = exports.RUN_WRITE_GUARD_LINE_PREFIX = exports.RUN_WRITE_SIGNIN_VARS_ENV = exports.RUN_WRITE_POLICY_ENV = exports.NO_KEEPALIVE_INIT_SCRIPT = exports.RUN_WRITE_LEAVING_EVENT = exports.RUN_WRITE_RELAY_KEY = exports.RUN_WRITE_DROPPED_BINDING = exports.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports.WEBSOCKET_NOT_GUARDED = exports.RunWriteGuard = exports.BROKER_TOKEN_TTL_MS = exports.MAX_RUN_WRITE_RECORDS = exports.SHARED_SUFFIX_PATTERN_REASON = exports.FIREBASE_AUTH_HANDLER_PATH = exports.SIGN_IN_SECRET_VARIABLE = exports.MAX_ALLOW_PATTERN_CHARS = exports.MAX_ALLOW_PATTERNS = exports.DEFAULT_RECORD_ONLY_RULES = exports.RECORD_ONLY_CAPABLE_RULES = exports.RUN_WRITE_POLICY_VERSION = void 0;
+    exports.RUN_WRITE_RELAYED_LINE = exports.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports.WRITE_HELD_ERROR_PREFIX = exports.RUN_WRITE_UNAVAILABLE_LINE = exports.RUN_WRITE_SAW_LINE = exports.RUN_WRITE_HELD_LINE = exports.RUN_WRITE_GUARD_LINE_PREFIX = exports.RUN_WRITE_SIGNIN_VARS_ENV = exports.RUN_WRITE_POLICY_ENV = exports.NO_KEEPALIVE_INIT_SCRIPT = exports.RUN_WRITE_LEAVING_EVENT = exports.RUN_WRITE_RELAY_KEY = exports.RUN_WRITE_DROPPED_BINDING = exports.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports.WEBSOCKET_NOT_GUARDED = exports.RunWriteGuard = exports.BROKER_TOKEN_TTL_MS = exports.MAX_RUN_WRITE_RECORDS = exports.SHARED_SUFFIX_PATTERN_REASON = exports.FIREBASE_AUTH_HANDLER_PATH = exports.SIGN_IN_SECRET_VARIABLE = exports.MAX_ALLOW_PATTERN_CHARS = exports.MAX_ALLOW_PATTERNS = exports.MAX_IDP_HOSTS = exports.DEFAULT_RECORD_ONLY_RULES = exports.RECORD_ONLY_CAPABLE_RULES = exports.RUN_WRITE_POLICY_VERSION = void 0;
     exports.parseRunWritePolicy = parseRunWritePolicy;
     exports.signInSecretsOf = signInSecretsOf;
     exports.withRunWritePolicyScope = withRunWritePolicyScope;
@@ -357,6 +357,8 @@ var require_run_write_guard = __commonJS({
     exports.bodyHasSignInSecret = bodyHasSignInSecret;
     exports.compileAllowPattern = compileAllowPattern;
     exports.allowPatternProblem = allowPatternProblem;
+    exports.normaliseIdpHost = normaliseIdpHost;
+    exports.idpHostProblem = idpHostProblem;
     exports.runWritePatternNotes = runWritePatternNotes;
     exports.decideRunWrite = decideRunWrite;
     exports.isGoogleBrokerToken = isGoogleBrokerToken;
@@ -389,6 +391,8 @@ var require_run_write_guard = __commonJS({
     exports.RECORD_ONLY_CAPABLE_RULES = ["write-shaped-get"];
     exports.DEFAULT_RECORD_ONLY_RULES = ["write-shaped-get"];
     var MAX_APP_SITES = 16;
+    exports.MAX_IDP_HOSTS = 4;
+    var MAX_IDP_HINTS = 4;
     exports.MAX_ALLOW_PATTERNS = 50;
     exports.MAX_ALLOW_PATTERN_CHARS = 200;
     var MAX_REASON_CHARS = 300;
@@ -416,6 +420,11 @@ var require_run_write_guard = __commonJS({
         const e = x;
         return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
       }) : [];
+      const idpHosts = Array.isArray(v.idpHosts) ? [...new Set(v.idpHosts.filter((h) => typeof h === "string" && normaliseIdpHost(h) === h && idpHostProblem(h) === null))].slice(0, exports.MAX_IDP_HOSTS) : [];
+      const ignoredIdpHosts = Array.isArray(v.ignoredIdpHosts) ? v.ignoredIdpHosts.slice(0, exports.MAX_ALLOW_PATTERNS).flatMap((x) => {
+        const e = x;
+        return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
+      }) : [];
       const recordOnlyRules = Array.isArray(v.recordOnlyRules) ? exports.RECORD_ONLY_CAPABLE_RULES.filter((rule) => v.recordOnlyRules.includes(rule)) : [...exports.DEFAULT_RECORD_ONLY_RULES];
       if (typeof v.reason !== "string")
         return null;
@@ -428,6 +437,9 @@ var require_run_write_guard = __commonJS({
         appSites: appSites.map((s) => s.toLowerCase()),
         allowPatterns,
         ignoredAllowPatterns,
+        // Only when set: a policy without them parses exactly as before.
+        ...idpHosts.length > 0 ? { idpHosts } : {},
+        ...ignoredIdpHosts.length > 0 ? { ignoredIdpHosts } : {},
         recordOnlyRules,
         reason: v.reason.slice(0, MAX_REASON_CHARS),
         ...v.pwAgentsGuard === "off" ? { pwAgentsGuard: "off" } : {}
@@ -629,8 +641,153 @@ var require_run_write_guard = __commonJS({
       return named.size + Math.min(bare.size, 2) >= 2;
     }
     var GRAPHQL_SIGN_IN_NAME = /^(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})$/i;
+    var GRAPHQL_SIGN_IN_VERBS = ["login", "signin", "authenticate"];
+    var GRAPHQL_SIGN_IN_PHRASE_WORDS = /* @__PURE__ */ new Set(["with", "via", "by", "using"]);
+    var GRAPHQL_SIGN_IN_TAIL_WORDS = /* @__PURE__ */ new Set([
+      "user",
+      "mutation",
+      "mfa",
+      "otp",
+      "totp",
+      "sso",
+      "anonymous",
+      "anonymously",
+      "email",
+      "password",
+      "phone",
+      "number",
+      "code",
+      "token",
+      "refresh",
+      "custom",
+      "api",
+      "key",
+      "magic",
+      "credentials",
+      "username",
+      "credential",
+      "sms",
+      "pin",
+      "jwt",
+      "mobile",
+      "session",
+      "ticket",
+      "qr",
+      "biometric",
+      "biometrics",
+      "wallet",
+      "identifier",
+      "address",
+      "local",
+      "login",
+      "userid",
+      "passkey",
+      "webauthn",
+      "idp",
+      "oauth",
+      "oidc",
+      "saml",
+      "ldap",
+      "google",
+      "apple",
+      "github",
+      "gitlab",
+      "facebook",
+      "microsoft",
+      "azure",
+      "twitter",
+      "linkedin",
+      "discord",
+      "slack",
+      "twitch",
+      "keycloak",
+      "okta",
+      "ethereum",
+      "firebase",
+      "cognito",
+      "apikey",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme"
+    ]);
+    var GRAPHQL_SIGN_IN_SUBJECT_WORDS = /* @__PURE__ */ new Set(["user", "customer", "admin", "member", "staff", "account"]);
+    var GRAPHQL_SIGN_IN_JOINERS = /* @__PURE__ */ new Set(["and", "or"]);
+    var GRAPHQL_SIGN_IN_JOINED_KINDS = /* @__PURE__ */ new Set([
+      "github",
+      "gitlab",
+      "linkedin",
+      "webauthn",
+      "passkey",
+      "apikey",
+      "idp",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme",
+      "username",
+      "userid"
+    ]);
+    function joinSplitKinds(words) {
+      const out = [];
+      for (let i = 0; i < words.length; i++) {
+        let joined = 0;
+        for (let n = Math.min(3, words.length - i); n >= 2; n--) {
+          const part = words.slice(i, i + n);
+          if (!part.some((w) => GRAPHQL_SIGN_IN_JOINERS.has(w)) && GRAPHQL_SIGN_IN_JOINED_KINDS.has(part.join(""))) {
+            joined = n;
+            break;
+          }
+        }
+        if (joined) {
+          out.push(words.slice(i, i + joined).join(""));
+          i += joined - 1;
+        } else
+          out.push(words[i]);
+      }
+      return out;
+    }
+    var GRAPHQL_SIGN_IN_LINK_KINDS = /* @__PURE__ */ new Set(["magic", "email"]);
+    function graphqlSignInTail(name) {
+      const words = wordsOf(name.replace(/(?<=[A-Z0-9][A-Z0-9])(?=[A-Z][a-z])/g, " "));
+      const head = words[0] === "log" || words[0] === "sign" ? words[1] === "in" ? [`${words[0]}in`, ...words.slice(2)] : null : words;
+      if (!head || head.length === 0)
+        return null;
+      const verb = GRAPHQL_SIGN_IN_VERBS.find((v) => head[0].startsWith(v));
+      if (!verb)
+        return null;
+      const glued = head[0].slice(verb.length);
+      return glued ? [glued, ...head.slice(1)] : head.slice(1);
+    }
+    function isGraphqlSignInTail(tail) {
+      const words = joinSplitKinds(tail);
+      let start = 0;
+      while (start < words.length && GRAPHQL_SIGN_IN_SUBJECT_WORDS.has(words[start]))
+        start++;
+      if (start === words.length)
+        return true;
+      let kinds = words.slice(start);
+      const phrase = kinds.findIndex((w) => GRAPHQL_SIGN_IN_PHRASE_WORDS.has(w));
+      if (phrase >= 0) {
+        if (phrase === kinds.length - 1 || phrase > 0 && GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase - 1]) || GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase + 1]))
+          return false;
+        kinds = [...kinds.slice(0, phrase), ...kinds.slice(phrase + 1)];
+      }
+      if (kinds.length === 0)
+        return false;
+      const isKind = (w, before) => GRAPHQL_SIGN_IN_TAIL_WORDS.has(w) || /^v\d{1,3}$/.test(w) || /^\d?fa$/.test(w) || w === "link" && before !== void 0 && GRAPHQL_SIGN_IN_LINK_KINDS.has(before);
+      return kinds.every((w, i) => GRAPHQL_SIGN_IN_JOINERS.has(w) ? i > 0 && i < kinds.length - 1 && !GRAPHQL_SIGN_IN_JOINERS.has(kinds[i - 1]) : isKind(w, i === phrase ? void 0 : kinds[i - 1]));
+    }
     function wordsOf(segment) {
-      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s._/-]+/).filter(Boolean);
+      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s.,_/-]+/).filter(Boolean);
     }
     function rawSegmentsOf(pathname) {
       return pathname.split("/").map((seg) => {
@@ -651,7 +808,10 @@ var require_run_write_guard = __commonJS({
       return words.some((w) => ACCOUNT_CHANGE_WORDS.has(w)) && words.some((w) => ACCOUNT_CHANGE_CONTEXT.has(w));
     }
     function isGraphqlSignInName(name) {
-      return GRAPHQL_SIGN_IN_NAME.test(name) && !changesSomething([name], { passwordIsCredential: true });
+      if (!GRAPHQL_SIGN_IN_NAME.test(name))
+        return false;
+      const tail = graphqlSignInTail(name);
+      return tail !== null && isGraphqlSignInTail(tail) && !changesSomething([name], { passwordIsCredential: true });
     }
     function graphqlSignIn(body) {
       let parsed;
@@ -687,6 +847,173 @@ var require_run_write_guard = __commonJS({
       }
       return signIns > 0 ? "document" : null;
     }
+    var NOT_A_BROKER_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
+      "add",
+      "book",
+      "booking",
+      "bookings",
+      "order",
+      "orders",
+      "reserve",
+      "reservation",
+      "reservations",
+      "submit",
+      "send",
+      "invite",
+      "invites",
+      "invitation",
+      "invitations",
+      "checkout",
+      "purchase",
+      "purchases",
+      "buy",
+      "pay",
+      "payment",
+      "payments",
+      "cart",
+      "subscribe",
+      "subscription",
+      "subscriptions",
+      "publish",
+      "upload",
+      "charge",
+      "charges",
+      "refund",
+      "refunds"
+    ]);
+    var BROKER_MAKE_VERBS = /* @__PURE__ */ new Set(["create", "generate"]);
+    var BROKER_CREDENTIAL_WORDS = /* @__PURE__ */ new Set(["session", "sessions", "login", "logins", "signin", "sign", "token", "tokens", "jwt", "jwts"]);
+    var BROKER_CREDENTIAL_QUALIFIERS = /* @__PURE__ */ new Set([
+      "access",
+      "refresh",
+      "id",
+      "auth",
+      "oauth",
+      "bearer",
+      "in",
+      "new",
+      "user",
+      "customer",
+      "with",
+      "from",
+      "via",
+      "for",
+      "by",
+      "and",
+      "mutation",
+      "google",
+      "apple",
+      "facebook",
+      "github",
+      "microsoft",
+      "sso",
+      "social",
+      "oidc",
+      "firebase"
+    ]);
+    function namesOnlyACredential(words) {
+      const rest = words.filter((w) => !BROKER_MAKE_VERBS.has(w));
+      return rest.some((w) => BROKER_CREDENTIAL_WORDS.has(w)) && rest.every((w) => BROKER_CREDENTIAL_WORDS.has(w) || BROKER_CREDENTIAL_QUALIFIERS.has(w));
+    }
+    function actsBesidesBrokerSignIn(segments) {
+      return segments.some((seg, i) => {
+        const words = wordsOf(seg);
+        if (words.some((w) => NOT_A_BROKER_SIGN_IN_WORDS.has(w)) || NOT_A_BROKER_SIGN_IN_WORDS.has(words.join("")))
+          return true;
+        if (!words.some((w) => BROKER_MAKE_VERBS.has(w)))
+          return false;
+        if (namesOnlyACredential(words))
+          return false;
+        return !(words.length === 1 && i > 0 && i === segments.length - 1 && namesOnlyACredential(wordsOf(segments[i - 1])));
+      });
+    }
+    function brokerRefuses(segments) {
+      return changesSomething(segments) || actsBesidesBrokerSignIn(segments);
+    }
+    var BROKER_SIGN_IN_NAME_WORDS = /* @__PURE__ */ new Set(["login", "signin", "sign", "auth", "authenticate", "google", "oauth", "sso", "social", "session"]);
+    function isBrokerSignInName(name) {
+      return typeof name === "string" && wordsOf(name).some((w) => BROKER_SIGN_IN_NAME_WORDS.has(w)) && !brokerRefuses([name]);
+    }
+    function graphqlBrokerSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let mutationRoots = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return false;
+        const { query, operationName } = entry;
+        const record = entry;
+        const ids = PERSISTED_ID_KEYS.map((key) => record[key]).filter((n) => n !== void 0);
+        const names = operationName === void 0 ? ids : [operationName, ...ids];
+        if (ids.length > 0 && !names.every(isBrokerSignInName))
+          return false;
+        if (typeof query !== "string") {
+          return !Array.isArray(parsed) && query === void 0 && names.length > 0 && names.every(isBrokerSignInName);
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return false;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && brokerRefuses([operationName]))
+            return false;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.some((root) => brokerRefuses([root])))
+            return false;
+          mutationRoots += roots.length;
+        }
+      }
+      return mutationRoots === 1;
+    }
+    var GRAPHQL_DOCUMENT_START = /^[\s,]*(?:[{#]|(?:query|mutation|subscription|fragment)\b)/;
+    function looksLikeGraphqlDocument(text) {
+      return GRAPHQL_DOCUMENT_START.test(text) || (0, survey_network_guard_js_1.graphqlOperationRoots)(text) !== null;
+    }
+    var PERSISTED_ID_KEYS = ["id", "documentId", "doc_id", "queryId"];
+    var GRAPHQL_ENVELOPE_FIELDS = ["variables", "operationName", "documentId", "doc_id", "queryId", "sha256Hash", "hash", "extensions", "operations"];
+    function hasGraphqlEnvelope(has, queryIsString) {
+      return queryIsString || GRAPHQL_ENVELOPE_FIELDS.some(has);
+    }
+    function carriesGraphql(search, body, contentType) {
+      if (search.getAll("query").some(looksLikeGraphqlDocument))
+        return true;
+      if (/^\s*application\/graphql\b/i.test(contentType ?? ""))
+        return true;
+      if (/multipart\//i.test(contentType ?? "") || /^\s*--/.test(body)) {
+        const parts = new Set([...body.matchAll(/\bname\s*=\s*"?([\w-]+)/gi)].map((m) => m[1]));
+        return hasGraphqlEnvelope((field) => parts.has(field), parts.has("query"));
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        if (looksLikeGraphqlDocument(body))
+          return true;
+        const form = new URLSearchParams(body);
+        return hasGraphqlEnvelope((field) => form.has(field), form.has("query"));
+      }
+      if (Array.isArray(parsed))
+        return true;
+      if (!parsed || typeof parsed !== "object")
+        return false;
+      const record = parsed;
+      return hasGraphqlEnvelope((field) => record[field] !== void 0, typeof record.query === "string");
+    }
+    function isBrokerSignInShape(pathname, search, postData, contentType) {
+      if (brokerRefuses(rawSegmentsOf(pathname)))
+        return false;
+      if (!isGraphqlPath(pathname) && !(typeof postData === "string" && carriesGraphql(search, postData, contentType)))
+        return true;
+      if ((0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search) || PERSISTED_ID_KEYS.some((key) => search.has(key)) || typeof postData !== "string" || postData.length > MAX_BODY_CHARS)
+        return false;
+      return graphqlBrokerSignIn(postData);
+    }
     function isCredentialSignInShape(pathname, search, postData, contentType) {
       if (typeof postData === "string" && postData.length > MAX_BODY_CHARS)
         return false;
@@ -900,6 +1227,26 @@ var require_run_write_guard = __commonJS({
       }).join("");
       return { method, host, path: new RegExp(`^${body}/?$`, "i") };
     }
+    function normaliseIdpHost(raw) {
+      return raw.trim().toLowerCase().replace(/\.$/, "");
+    }
+    var WILDCARD_DNS_RE = /(?:^|\.)(?:nip\.io|sslip\.io|xip\.io|localtest\.me|lvh\.me|vcap\.me|traefik\.me|localho\.st|localhost\.direct|local\.gd|fuf\.me)$/;
+    function idpHostProblem(host) {
+      if (host.length > 253 || !/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(host))
+        return "not a host name (no scheme, port, path or wildcard)";
+      if (/^[0-9.]+$/.test(host))
+        return "an IP address";
+      if (/(?:^|\.)(?:localhost|local|internal)$/.test(host))
+        return "a local name";
+      if (WILDCARD_DNS_RE.test(host))
+        return "a wildcard-DNS name (it can point at any address)";
+      if ((0, shared_1.isSharedSuffix)(host))
+        return exports.SHARED_SUFFIX_PATTERN_REASON;
+      return null;
+    }
+    function isIdpHost(url, host, policy) {
+      return url.protocol === "https:" && url.port === "" && (policy.idpHosts ?? []).includes(host);
+    }
     function matchesAllowPatterns(method, host, pathname, policy, compiled) {
       const patterns = compiled ?? policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
       return patterns.some((p) => {
@@ -923,7 +1270,10 @@ var require_run_write_guard = __commonJS({
           return reason ? [{ pattern, reason }] : [];
         })
       ];
-      return ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`);
+      return [
+        ...ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`),
+        ...(policy.ignoredIdpHosts ?? []).map(({ pattern, reason }) => `[run-write-guard] AUTH_PROVIDER_HOSTS entry ${JSON.stringify(pattern)} ignored: ${reason}`)
+      ];
     }
     function describe(facts, url, rule) {
       return {
@@ -975,6 +1325,8 @@ var require_run_write_guard = __commonJS({
         return { action: "write", rule: "sign-up", record: describe(facts, url, "sign-up") };
       if (isAuthProviderWrite(method, host, pathname, facts.amzTarget, url.searchParams))
         return { action: "allow", rule: "auth-provider" };
+      if (isIdpHost(url, host, policy) && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "auth-provider" };
       const appSite = isAppSite(host, policy);
       if (facts.registeredAuthHandler && pathname === exports.FIREBASE_AUTH_HANDLER_PATH)
         return { action: "allow", rule: "auth-provider" };
@@ -982,7 +1334,7 @@ var require_run_write_guard = __commonJS({
         return { action: "allow", rule: "sign-in" };
       if (appSite && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
         return { action: "allow", rule: "sign-in" };
-      if (appSite && method === "POST" && facts.brokerTokenInBody && !changesSomething(rawSegmentsOf(pathname))) {
+      if (appSite && method === "POST" && facts.brokerTokenInBody && isBrokerSignInShape(pathname, url.searchParams, facts.postData, facts.contentType)) {
         return { action: "allow", rule: "broker-sign-in" };
       }
       if (appSite && isEvidencedTokenRefresh(method, pathname, facts.postData))
@@ -990,7 +1342,7 @@ var require_run_write_guard = __commonJS({
       const signIn = appSite && method === "POST" && facts.signInSecretInBody ? isCredentialSignInShape(pathname, url.searchParams, facts.postData, facts.contentType) : false;
       if (signIn)
         return { action: "allow", rule: "credential-sign-in", ...signIn === "persisted" ? { persisted: true } : {} };
-      if (method === "POST" && isGraphqlPath(pathname) && !(0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
+      if (method === "POST" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlUrlQueriesAreReads)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
         return { action: "allow", rule: "graphql-query" };
       if (method === "POST" && hostIs(host, SEARCH_POST_HOSTS))
         return { action: "allow", rule: "search-post" };
@@ -1047,6 +1399,8 @@ var require_run_write_guard = __commonJS({
       relayRejected = 0;
       /** Credential sign-ins already said in the run log (observe mode; method, host and path shape). */
       signInsLogged = /* @__PURE__ */ new Set();
+      /** Hosts already named in the run log as a possible AUTH_PROVIDER_HOSTS entry (at most MAX_IDP_HINTS). */
+      idpHintsLogged = /* @__PURE__ */ new Set();
       constructor(policy, opts = {}) {
         this.policy = policy;
         this.compiled = policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
@@ -1144,6 +1498,22 @@ var require_run_write_guard = __commonJS({
         const verb = held ? "held" : "saw";
         const why = record.writeShaped ? `${record.rule}, ${record.writeShaped}` : record.rule;
         this.log?.(`[run-write-guard] ${verb} ${record.method} ${record.host}${record.path}${record.keys.length ? ` (${record.keys.join(", ")})` : ""} [${why}]`);
+        this.hintIdpHost(record);
+      }
+      /**
+       * An Auth0 sign-in step (by path) posted to another site was a third-party write: the tenant may
+       * answer on a custom domain of its own. Said once per host, for at most MAX_IDP_HINTS hosts, so a
+       * person knows AUTH_PROVIDER_HOSTS exists; the guard never names the host itself.
+       */
+      hintIdpHost(record) {
+        if (record.rule !== "third-party-write" || record.method !== "POST")
+          return;
+        if (this.idpHintsLogged.has(record.host) || this.idpHintsLogged.size >= MAX_IDP_HINTS)
+          return;
+        if ((this.policy.idpHosts ?? []).includes(record.host) || !AUTH0_AUTH_RE.test(record.path.toLowerCase()))
+          return;
+        this.idpHintsLogged.add(record.host);
+        this.log?.(`[run-write-guard] note: ${record.host} looks like an Auth0 sign-in on another site; if it is the app's own sign-in, a project admin can name it in AUTH_PROVIDER_HOSTS in Test Data`);
       }
       /**
        * A page sent a message over a WebSocket to the app's site. The guard cannot tell a read from a
@@ -1951,8 +2321,9 @@ var require_run_write_guard = __commonJS({
       };
       Object.assign(context, {
         route: async (url, handler, options) => {
-          await route(url, handler, options);
+          const disposable = await route(url, handler, options);
           others.push({ url, handler });
+          return disposable;
         },
         unroute: async (url, handler) => {
           if (handler === void 0 && sameRouteUrl(url, GUARD_ROUTE)) {
@@ -2285,6 +2656,7 @@ var require_run_write_guard = __commonJS({
     }
     function buildRunWriteGuardHook(policy, modulePath, signInSecretNames = [], opts = {}) {
       const withContext = opts.browserContext !== false;
+      const hookTest = opts.hookTest ?? "test";
       const names = signInSecretNames.filter((n) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(n)).slice(0, 16);
       return `
 import { createRequire as __qaWriteGuardRequire } from 'node:module';
@@ -2307,7 +2679,7 @@ try {
 } catch (err) {
   __qaWriteGuardError = err;
 }
-test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
+${hookTest}.beforeEach(async (${withContext ? "{ context }" : ""}) => {
   try {
     if (__qaWriteGuardError) throw __qaWriteGuardError;
     ${withContext ? "await __qaWriteGuard.installRunWriteGuard(context, __qaWriteGuardPolicy, { onLog: (line) => console.log(line), signInSecrets: __qaWriteGuardSecrets });" : "// an @api test: no browser context, only Node's fetch is guarded"}
@@ -2316,7 +2688,7 @@ test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
     ${policy.mode === "block" ? "throw err;" : "// observe: never fail the test"}
   }
 });${withContext && policy.mode === "block" ? `
-test.afterEach(async ({ context }) => {
+${hookTest}.afterEach(async ({ context }) => {
   try { if (__qaWriteGuard) await __qaWriteGuard.clearRunWriteRelay(context); } catch { /* the context closes next */ }
 });` : ""}
 `;

package/dist/{chunk-XZUUBMP3.mjs → chunk-5DFBEL72.mjs}

@@ -1,7 +1,7 @@
 import {
   require_test_inbox_broker,
   require_verification_inbox
-} from "./chunk-FQUH2PU2.mjs";
+} from "./chunk-CBVHPYVJ.mjs";
 import {
   __commonJS,
   __require

package/dist/{chunk-M3VZGHZQ.mjs → chunk-BXLEPT4M.mjs}

@@ -1,13 +1,13 @@
 import {
   require_route_manifest
-} from "./chunk-CO5KHIVX.mjs";
+} from "./chunk-PWFWMVZU.mjs";
 import {
   require_survey_network_guard
-} from "./chunk-SN3PN4G4.mjs";
+} from "./chunk-E2RRAE27.mjs";
 import {
   dist_exports,
   init_dist
-} from "./chunk-IGXGSDE3.mjs";
+} from "./chunk-3JM6XTSZ.mjs";
 import {
   __commonJS,
   __toCommonJS
@@ -20,6 +20,7 @@ var require_exploration_parser = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.extractCodeLines = extractCodeLines;
     exports.extractProvenLocator = extractProvenLocator;
+    exports.maskTypedValues = maskTypedValues;
     exports.sanitizePromptCodeLine = sanitizePromptCodeLine;
     exports.extractPageUrl = extractPageUrl;
     exports.extractPageTitle = extractPageTitle;
@@ -34,7 +35,7 @@ var require_exploration_parser = __commonJS({
     var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     function extractCodeLines(toolResultContent) {
       const isPlaywrightLine = (l) => l.startsWith("await page.") || l.startsWith("await expect(");
-      const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n([\s\S]*?)(?=\n###|\n$|$)/);
+      const codeSection = toolResultContent.match(/###\s*Ran Playwright code\s*\n(?![^\S\n]*\n)([\s\S]*?)(?=\n###|\n$|$)/);
       if (codeSection) {
         return codeSection[1].split("\n").map((l) => l.trim()).filter(isPlaywrightLine).map((l) => l.replace(/;$/, ""));
       }
@@ -78,7 +79,7 @@ var require_exploration_parser = __commonJS({
           cut = idx;
       }
       let locator = cut > start ? codeLine.slice(start, cut) : codeLine.slice(start);
-      locator = locator.trim().replace(/;+\s*$/, "").trim();
+      locator = locator.trim().replace(/(?<!;);+\s*$/, "").trim();
       if (!locator.includes("("))
         return null;
       if (!/^(getBy\w+|locator)\(/.test(locator))
@@ -158,13 +159,16 @@ var require_exploration_parser = __commonJS({
         return false;
       return RECORD_TITLE_WITH_COMPANY.test(name);
     }
+    var TYPED_VALUE_CALL_RE = /\.(fill|type|pressSequentially|insertText)\(\s*(['"])(?:\\.|(?!\2)[^\\])*\2(\s*,\s*\{[^{}]*\})?\s*\)/g;
+    function maskTypedValues(codeLine, mask) {
+      return codeLine.replace(TYPED_VALUE_CALL_RE, (_all, method, _quote, options) => `.${method}(${mask}${options ?? ""})`);
+    }
     function sanitizePromptCodeLine(codeLine) {
       let sanitized = codeLine;
       sanitized = sanitized.replace(/getByRole\('(textbox|searchbox|combobox|spinbutton)',\s*\{\s*name:\s*['"]([^'"]*)['"]\s*\}\)/g, (match, role, name, _offset, line) => looksDynamicFieldLabel(name, line) ? `getByRole('${role}')` : match);
       sanitized = sanitized.replace(/getByLabel\(\s*(['"])([^'"]*)\1\s*\)(?=\)?\.(?:fill|type|toHaveValue|inputValue|press)\()/g, (match, _quote, label, _offset, line) => looksDynamicFieldLabel(label, line) ? "getByRole('textbox')" : match);
       sanitized = sanitized.replace(/getByLabel\(\s*(['"])([^'"]*)\1\s*\)(?=\)?\.selectOption\()/g, (match, _quote, label, _offset, line) => looksDynamicFieldLabel(label, line) ? "getByRole('combobox')" : match);
-      sanitized = sanitized.replace(/\.fill\(\s*(['"]).*?\1\s*\)/g, ".fill('<test-value>')");
-      sanitized = sanitized.replace(/\.type\(\s*(['"]).*?\1\s*\)/g, ".type('<test-value>')");
+      sanitized = maskTypedValues(sanitized, "'<test-value>'");
       sanitized = sanitized.replace(/\.toHaveValue\(\s*(['"]).*?\1\s*\)/g, ".toHaveValue(/./)");
       sanitized = sanitized.replace(/getByRole\('heading',\s*\{\s*name:\s*'([^']*)'\s*\}\)/g, (match, name) => looksDynamicRecordTitle(name) ? "getByRole('heading')" : match);
       sanitized = sanitized.replace(/getByRole\('heading',\s*\{\s*name:\s*"([^"]*)"\s*\}\)/g, (match, name) => looksDynamicRecordTitle(name) ? "getByRole('heading')" : match);
@@ -188,7 +192,7 @@ var require_exploration_parser = __commonJS({
       return match ? match[1].trim() : null;
     }
     function extractSnapshotSection(content) {
-      const match = content.match(/###\s*Snapshot\s*\n([\s\S]*?)(?=\n###|$)/);
+      const match = content.match(/###\s*Snapshot\s*\n(?![^\S\n]*\n)([\s\S]*?)(?=\n###|$)/);
       if (!match)
         return null;
       if (/^\s*- \[Snapshot\]\([^)\n]*\)\s*$/.test(match[1]))
@@ -256,7 +260,7 @@ var require_exploration_parser = __commonJS({
       return hints;
     }
     function extractFirstAlert(snapshotYaml) {
-      const match = snapshotYaml.match(/^\s*-\s+(?:alert|status)\s+"([^"]+)"/m);
+      const match = snapshotYaml.match(/^[^\S\n\r\u2028\u2029]*-\s+(?:alert|status)\s+"([^"]+)"/m);
       return match ? match[1] : null;
     }
     function buildInteractionLogEntry(toolName, toolArgs, codeLines, pageUrl, pageTitle, snapshotSection) {
@@ -297,6 +301,12 @@ var require_exploration_parser = __commonJS({
         return /^\d{10,}$/.test(value);
       return false;
     }
+    function hashRouterPathWithoutTrailingSlash(hash) {
+      const q = hash.indexOf("?");
+      const path = q < 0 ? hash : hash.slice(0, q);
+      const stripped = (0, shared_1.stripTrailingSlashes)(path);
+      return stripped === "#" || stripped === "" ? hash : stripped + (q < 0 ? "" : hash.slice(q));
+    }
     function normalizeRoute(url) {
       let route = url.pathname;
       const encodeQueryPart = (part) => part.replace(/[%&=#+?]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`);
@@ -315,7 +325,7 @@ var require_exploration_parser = __commonJS({
         }
       }
       if (url.hash && url.hash !== "#" && url.hash !== "#/") {
-        route += url.hash;
+        route += url.hash.startsWith("#/") ? hashRouterPathWithoutTrailingSlash(url.hash) : url.hash;
       }
       return route;
     }