@validate.qa/runner 1.0.101 → 1.0.103

package/dist/run-write-guard.js

@@ -91,13 +91,13 @@ function isBlockedEnvVar(key) {
 function sanitizeTestVariables(vars) {
   if (!vars)
     return {};
-  const clean2 = {};
+  const clean3 = {};
   for (const [key, value] of Object.entries(vars)) {
     if (!isBlockedEnvVar(key)) {
-      clean2[key] = value;
+      clean3[key] = value;
     }
   }
-  return clean2;
+  return clean3;
 }
 function buildSandboxedEnv(processEnv, testVariables) {
   const env = {};
@@ -1554,9 +1554,40 @@ function semanticTarget(label, platform, base) {
     }
   };
 }
+function androidResourceOwners(value) {
+  const owners = [];
+  for (const match of value.matchAll(ANDROID_RESOURCE_ID_SUFFIX_RE)) {
+    let runStart = match.index;
+    while (runStart > 0 && /[a-z0-9_.]/i.test(value[runStart - 1]))
+      runStart--;
+    const owner = ownerAtEndOfRun(value.slice(runStart, match.index));
+    if (owner !== null)
+      owners.push(owner);
+  }
+  return owners;
+}
+function ownerAtEndOfRun(run) {
+  const segments = run.split(".");
+  const last = segments.length - 1;
+  const startsWithLetter = (segment) => /^[a-z]/i.test(segment);
+  if (last < 1 || !startsWithLetter(segments[last]))
+    return null;
+  let first = last;
+  while (first > 0 && startsWithLetter(segments[first - 1]))
+    first--;
+  let offset = 0;
+  for (let i = 0; i < first - 1; i++)
+    offset += segments[i].length + 1;
+  if (first > 0) {
+    const letterAt = segments[first - 1].search(/[a-z]/i);
+    if (letterAt >= 0)
+      return run.slice(offset + letterAt);
+    offset += segments[first - 1].length + 1;
+  }
+  return first < last ? run.slice(offset) : null;
+}
 function containsForeignAppPackage(value, targetAppId) {
-  for (const match of value.matchAll(ANDROID_RESOURCE_OWNER_RE)) {
-    const owner = match[1];
+  for (const owner of androidResourceOwners(value)) {
     if (targetAppId && owner !== targetAppId && !owner.startsWith(`${targetAppId}.`))
       return true;
   }
@@ -1693,7 +1724,7 @@ function healMobileTestSteps(input) {
     summary: changed ? uniq(summary).slice(0, 12) : []
   };
 }
-var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_OWNER_RE, COMMON_EXTERNAL_PREFIXES;
+var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_ID_SUFFIX_RE, COMMON_EXTERNAL_PREFIXES;
 var init_mobile_step_healer = __esm({
   "../shared/dist/mobile-step-healer.js"() {
     "use strict";
@@ -1714,7 +1745,7 @@ var init_mobile_step_healer = __esm({
       "assertStateDelta"
     ]);
     FOREIGN_PACKAGE_RE = /\b[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){2,}\b/gi;
-    ANDROID_RESOURCE_OWNER_RE = /([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+):id\//gi;
+    ANDROID_RESOURCE_ID_SUFFIX_RE = /:id\//gi;
     COMMON_EXTERNAL_PREFIXES = [
       "com.android.",
       "com.google.",
@@ -3424,7 +3455,7 @@ var init_assertion_classifier = __esm({
       // toHaveCount(0) stays tier 4 (absence proof) via TIER4_PATTERNS.
       [/\.toHaveCount\s*\(\s*[1-9]\d*\s*\)/, "non-zero toHaveCount asserts a record count that changes between runs"],
       // parenthesised counts like "(3)" or "[12]" in text - but not Playwright method args
-      [/(?<!\.\w{3,20}\s*)\(\s*\d+\s*\)(?!\s*[,;]?\s*\))/i, "parenthesised count is session-specific"],
+      [/\((?<!\.\w{3,20}\s*\()\s*\d+\s*\)(?!\s*(?:[,;]\s*)?\))/i, "parenthesised count is session-specific"],
       // bare email addresses in assertion content
       [/\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b/i, "email address is user-specific"],
       // currency/balance amounts (dynamic account data)
@@ -3670,7 +3701,7 @@ var init_assertion_proof = __esm({
     PRESENCE_MATCHER = /\.(?:toBeVisible|toBeAttached|toBeEnabled|toBeInViewport|toBeEditable|toBeFocused)\s*\(|\.toHaveCount\s*\(\s*1\s*\)/;
     TEXT_MATCHER = /\.(?:toHaveText|toContainText)\s*\(/;
     ANY_VALUE_SOURCE = /^(?:\.|\\S|\\w|\\d|\[\^\\s\]|\[0-9\]|\[\\d\]|\[\\w\]|\[\\s\\S\])[+*]?\??$/;
-    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*\)/;
+    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*[,)]/;
     EMPTY_NOT_VALUE = /\.not\s*\.\s*toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/;
     TEXT_MATCHER_LITERAL = /\.(?:toHaveText|toContainText)\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
     GET_BY_TEXT_LITERAL = /getByText\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
@@ -3687,7 +3718,7 @@ var init_assertion_proof = __esm({
     DATA_ROLE = /getByRole\s*\(\s*['"`](?:dialog|alertdialog|alert|cell|gridcell|row|rowheader|columnheader|listitem|article|option|status|note|tooltip|paragraph|term|definition|log|marquee|timer|meter)['"`]/gi;
     TEXT_LOCATOR = /\.getByText\s*\(|\.filter\s*\(\s*\{\s*hasText\s*:/g;
     CSS_LOCATOR = /\.locator\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/g;
-    SPECIFIC_CSS = /\[[^\]]*=|#[\w-]|has-text|:text/;
+    SPECIFIC_CSS = /\[[^\][=]*=|#[\w-]|has-text|:text/;
   }
 });
 
@@ -4651,22 +4682,37 @@ function classifyAuthHandoffIntent(text) {
 function withoutIdpUrlAsserts(code) {
   return code.replace(/\.(?:toHaveURL|waitForURL)\s*\((?:[^)(]|\([^)]*\))*\)/g, (match) => /accountchooser|accounts\.google|appleid\.apple|login\.microsoftonline|\/v\d+\/signin|oauth/i.test(match) ? "" : match);
 }
+function stripLineComment(line) {
+  let from = line.length;
+  while (from > 0) {
+    const c = line.charCodeAt(from - 1);
+    if (c === 10 || c === 13 || c === 8232 || c === 8233)
+      break;
+    from--;
+  }
+  const at = line.indexOf("//", from);
+  return at < 0 ? line : line.slice(0, at);
+}
 function stripComments(code) {
-  return replaceBlockComments(code, () => "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
+  return replaceBlockComments(code, () => "").split("\n").map(stripLineComment).join("\n");
 }
-function balancedCall(code, start) {
-  const open = code.indexOf("(", start);
-  if (open < 0)
-    return null;
-  let depth = 0;
-  for (let i = open; i < code.length; i++) {
+function closingParens(code) {
+  const close = new Int32Array(code.length).fill(-1);
+  const open = [];
+  for (let i = 0; i < code.length; i++) {
     const c = code[i];
     if (c === "(")
-      depth++;
-    else if (c === ")" && --depth === 0)
-      return { inner: code.slice(open + 1, i), end: i };
+      open.push(i);
+    else if (c === ")" && open.length > 0)
+      close[open.pop()] = i;
   }
-  return null;
+  return close;
+}
+function balancedCall(code, close, start) {
+  const open = code.indexOf("(", start);
+  if (open < 0 || close[open] < 0)
+    return null;
+  return { inner: code.slice(open + 1, close[open]), end: close[open] };
 }
 function resolveLocator(code, subject) {
   const id = subject.trim().match(/^([A-Za-z_$][\w$]*)$/);
@@ -4714,8 +4760,10 @@ function isAuthHandoffDismissCode(code) {
   const expects = [];
   const re = new RegExp(EXPECT_CALL_RE.source, "g");
   let match;
+  let close = null;
   while (match = re.exec(body)) {
-    const found = balancedCall(body, match.index);
+    close ??= closingParens(body);
+    const found = balancedCall(body, close, match.index);
     if (found)
       expects.push({ inner: found.inner, tail: body.slice(found.end, found.end + 48) });
   }
@@ -4760,12 +4808,209 @@ var init_auth_handoff_coverage = __esm({
   }
 });
 
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
+}
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
+  if (!sharedAuthInjectEnabled)
+    return false;
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function codeReadsStoredCredentials(code) {
+  if (!code)
+    return false;
+  if (/__vqaLogin\b/.test(code))
+    return true;
+  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
+    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
+      return true;
+  }
+  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
+    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
+      return true;
+  }
+  return false;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
+    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
+      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
+      switch (loginCompose[0]) {
+        case AUTH_TAG_COOKIE_STATE:
+          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_COOKIE:
+          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_BEARER:
+          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+      }
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
+  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
+  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds,
+    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
 // ../shared/dist/assertion-strength.js
+function parseLastActionProofMode(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  return v === "on" || v === "shadow" ? v : "off";
+}
+function isUrlProof(stmt) {
+  if (URL_PROOF.test(stmt))
+    return true;
+  let calls = 0;
+  for (const open of stmt.matchAll(POLL_OPEN)) {
+    if (++calls > POLL_CALLS_MAX)
+      break;
+    const from = open.index + open[0].length;
+    const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+    if (args === null)
+      continue;
+    const subject = pollSubject(args);
+    if (!POLL_PAGE_URL.test(subject))
+      continue;
+    if (!POLL_PAGE_URL_ONLY.test(subject) || PAGE_VALUE_MATCHER.test(stmt.slice(from + args.length)))
+      return true;
+  }
+  return false;
+}
 function liveExpectStatements(uncommented) {
   const masked = maskedOutsideStrings(uncommented).split("\n");
   return accumulateStatements(uncommented.split("\n")).filter((s) => EXPECT_STMT.test(s.stmt) && EXPECT_STMT.test(masked[s.startLine - 1] ?? ""));
 }
-function stripLineComment(ln) {
+function stripLineComment2(ln) {
   let quote = null;
   for (let i = 0; i < ln.length; i++) {
     const c = ln[i];
@@ -4788,7 +5033,7 @@ function splitInteractionStatementsWithLines(lines) {
   let depth = 0;
   let scaffold = false;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!ln)
       continue;
     const isContinuation = out.length > 0 && (ln.startsWith(".") || depth > 0 && !scaffold);
@@ -4812,7 +5057,7 @@ function testBlockIds(lines) {
   let any = false;
   let block = 0;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!open) {
       if (!TEST_BLOCK_OPEN.test(ln))
         continue;
@@ -4896,7 +5141,7 @@ function expectSubjectSpan(stmt) {
   }
   return null;
 }
-function resolveSubjectBindings(stmts, bindings, blockOfLine) {
+function resolveSubjectBindings(stmts, bindings, blockOfLine, boundAt) {
   if (bindings.length === 0)
     return [...stmts];
   return stmts.map((item) => {
@@ -4919,14 +5164,22 @@ function resolveSubjectBindings(stmts, bindings, blockOfLine) {
       subject = `${lead[1]}${found.expr.replace(/;\s*$/, "")}${subject.slice(lead[0].length)}`;
       line = found.line;
     }
-    return { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    const out = { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    if (boundAt !== void 0 && line !== item.startLine)
+      boundAt.set(out, line);
+    return out;
   });
 }
 function stripLoginScaffolding(code) {
-  const out = [];
+  const lines = code.split("\n");
+  return keptScaffoldingLines(lines).map((i) => lines[i]).join("\n");
+}
+function keptScaffoldingLines(lines) {
+  const kept = [];
   let inAuth = false;
   let inInbox = false;
-  for (const ln of code.split("\n")) {
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
     if (!inAuth && !inInbox && AUTH_START.test(ln)) {
       inAuth = true;
       continue;
@@ -4947,9 +5200,9 @@ function stripLoginScaffolding(code) {
     }
     if (LOGIN_CALL_LINE.test(ln))
       continue;
-    out.push(ln);
+    kept.push(i);
   }
-  return out.join("\n");
+  return kept;
 }
 function stripCommentsAndLogs(code) {
   return stripCoverageComments(code).split("\n").filter((ln) => !/^\s*console\./.test(ln)).join("\n");
@@ -5101,6 +5354,41 @@ function isVacuousErrorAbsence(stmt, presence) {
     return false;
   return !presence().includes(m[1]);
 }
+function isVacuousAccountAbsence(stmt, shown, account) {
+  if (!claimsAbsence(stmt))
+    return false;
+  if (!ABSENCE_MATCHER.test(stmt)) {
+    const negated = NEGATED_TEXT.exec(stmt);
+    if (!negated)
+      return false;
+    const read = account.exec(stmt.slice(negated.index));
+    return read !== null && !shown().has(read[0]);
+  }
+  const m = account.exec(stmt);
+  if (!m || shown().has(m[0]))
+    return false;
+  for (let at = endOfEnclosingCall(stmt, m.index + m[0].length); at < stmt.length; at = endOfEnclosingCall(stmt, at)) {
+    SCOPING_STEP.lastIndex = at;
+    if (SCOPING_STEP.test(stmt))
+      return false;
+  }
+  return true;
+}
+function endOfEnclosingCall(stmt, from) {
+  let depth = 0;
+  for (let i = from; i < stmt.length; i++) {
+    const c = stmt[i];
+    if (c === "'" || c === '"') {
+      for (i++; i < stmt.length && stmt[i] !== c; i++)
+        if (stmt[i] === "\\")
+          i++;
+    } else if (c === "(")
+      depth++;
+    else if (c === ")" && depth-- === 0)
+      return i + 1;
+  }
+  return stmt.length;
+}
 function isBareContainerVisibility(stmt) {
   return BARE_CONTAINER_ROLE.test(stmt) && !GET_BY_TEXT.test(stmt) && !HAS_TEXT_FILTER.test(stmt) && !TEXT_CONTENT_MATCHER.test(stmt);
 }
@@ -5182,7 +5470,7 @@ function roleNames(s) {
 function interactedControlNames(lines) {
   const names = /* @__PURE__ */ new Set();
   for (const raw of lines) {
-    const ln = stripLineComment(raw);
+    const ln = stripLineComment2(raw);
     if (!INTERACT_VERB.test(ln))
       continue;
     for (const n of roleNames(ln))
@@ -5378,6 +5666,14 @@ function balancedArguments(code, from, limit = code.length) {
   }
   return null;
 }
+function expectCallTail(stmt) {
+  const at = stmt.search(EXPECT_CALL_RE);
+  if (at < 0)
+    return null;
+  const from = stmt.indexOf("(", at) + 1;
+  const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+  return args === null ? null : stmt.slice(from + args.length).trimStart();
+}
 function matcherArgumentsAreConstant(body, from) {
   MATCHER_OPEN.lastIndex = from;
   const opened = MATCHER_OPEN.exec(body);
@@ -5419,9 +5715,12 @@ function envValueKey(name) {
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
+  const accountConsts = /* @__PURE__ */ new Set();
   for (const { stmt, startLine } of stmts) {
     if (PAGE_NAV.test(stmt))
       navLines.push(startLine);
+    for (const c of stmt.matchAll(ACCOUNT_CONST))
+      accountConsts.add(c[1].replace(/\$/g, "\\$"));
     let m;
     ENTERED_VALUE.lastIndex = 0;
     const add = (value) => {
@@ -5437,7 +5736,8 @@ function enteredValues(stmts) {
     while (m = ENTERED_ENV.exec(stmt))
       add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
-  return { values, navLines };
+  const consts = accountConsts.size > 0 ? `|(?<![\\w$.])(?:${[...accountConsts].join("|")})(?![\\w$])` : "";
+  return { values, navLines, account: new RegExp(`${ACCOUNT_ENV}${consts}`) };
 }
 function countBelow(lines, line) {
   let lo = 0;
@@ -5574,6 +5874,9 @@ function comparesWithItself(subject, tail) {
   return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
 }
 function asPlainAssertion(s) {
+  return plainAssertion(s, false);
+}
+function plainAssertion(s, keepSelfCompare) {
   const { stmt } = s;
   if (COUNT_AT_LEAST_ZERO.test(stmt))
     return [];
@@ -5582,13 +5885,13 @@ function asPlainAssertion(s) {
     return [s];
   const plain = subject.replace(/^await\s+/, "").trim();
   const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
-  const tail = stmt.slice(subjectAt + subject.length).trimStart();
+  const tail = (stmt.startsWith("expect.poll", stmt.search(EXPECT_CALL_RE)) ? expectCallTail(stmt) : null) ?? stmt.slice(subjectAt + subject.length).trimStart();
   const as = (rewritten) => [{ ...s, stmt: rewritten }];
   if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
     return [];
   if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
     return [];
-  if (comparesWithItself(plain, tail))
+  if (!keepSelfCompare && comparesWithItself(plain, tail))
     return [];
   const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
   if (visible && IS_VISIBLE_TRUE.test(tail))
@@ -5599,6 +5902,9 @@ function asPlainAssertion(s) {
   }
   return [s];
 }
+function assertionStrengthHoistedReadsOn(value = typeof process !== "undefined" ? process.env?.ASSERTION_STRENGTH_HOISTED_READS : void 0) {
+  return /^(1|true|on)$/i.test((value ?? "").trim());
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -5631,6 +5937,22 @@ function successNoticeQuote(stmt) {
   }
   return null;
 }
+function namedPagePath(arg) {
+  const text = arg.trim();
+  let path;
+  const quoted = /^(['"`])([^'"`]*)\1$/.exec(text);
+  const regex = quoted ? null : /^\/((?:\\.|[^/\\])+)\/[a-z]*$/.exec(text);
+  if (quoted) {
+    path = quoted[2].replace(/^\$\{[^}]*\}/, "").replace(/^\*\*/, "").replace(/^[a-z][a-z\d+.-]*:\/\/[^/]*/i, "").replace(/\/\*\*$/, "/");
+  } else if (regex) {
+    path = regex[1].replace(/^\^/, "").replace(/^\.\*/, "").replace(/\$$/, "").replace(/\\([/.-])/g, "$1");
+  } else {
+    return null;
+  }
+  if (!PLAIN_PAGE_PATH.test(path))
+    return null;
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function provesStoredControlValue(stmt, startLine, persistence) {
   if (!persistence || startLine === void 0)
     return false;
@@ -5657,7 +5979,64 @@ function reopenedAfterSave(startLine, persistence, reopens = persistence.reloadL
   }
   return lo < reopens.length && reopens[lo] < startLine;
 }
-function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence) {
+function actsBetween(withLines, from, to) {
+  let acts = actLinesOf.get(withLines);
+  if (acts === void 0) {
+    acts = withLines.filter((s) => ACTS.test(s.stmt)).map((s) => s.startLine).sort((a, b) => a - b);
+    actLinesOf.set(withLines, acts);
+  }
+  let lo = 0;
+  let hi = acts.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (acts[mid] <= from)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo < acts.length && acts[lo] < to;
+}
+function signInProofWindow(stmts, withLines, lines, blockIds) {
+  if (blockIds === null)
+    return void 0;
+  const testBodies2 = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const id = blockIds[i];
+    if (id > 0 && (i === 0 || blockIds[i - 1] !== id) && TEST_BODY_OPEN.test(stripLineComment2(lines[i]).trim()))
+      testBodies2.add(id);
+  }
+  const blockOf = (i) => blockIds[withLines[i].startLine - 1];
+  const passwordAt = stmts.findIndex((stmt, i) => testBodies2.has(blockOf(i)) && ENV_PASSWORD_ENTRY.test(stmt));
+  if (passwordAt < 0)
+    return void 0;
+  const body = blockOf(passwordAt);
+  let clickAt = passwordAt + 1;
+  while (clickAt < stmts.length && FORM_INPUT.test(stmts[clickAt]) && !ANY_CLICK.test(stmts[clickAt]))
+    clickAt++;
+  if (clickAt >= stmts.length || blockOf(clickAt) !== body || !ANY_CLICK.test(stmts[clickAt]) || NAV_LOCATOR.test(stmts[clickAt]))
+    return void 0;
+  let end = clickAt + 1;
+  for (; end < stmts.length && blockOf(end) === body; end++) {
+    if (CLOSERS_ONLY.test(stmts[end]))
+      continue;
+    if (!ASSERT_OR_WAIT.test(stmts[end]) || ACTS.test(stmts[end]))
+      return void 0;
+  }
+  return { after: withLines[clickAt].startLine, until: end < stmts.length ? withLines[end].startLine : Number.POSITIVE_INFINITY };
+}
+function isAccountControlCheck(stmt) {
+  if (!VISIBILITY_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt) || OPTION_ABSENCE.test(stmt))
+    return false;
+  const role = ACCOUNT_CONTROL_ROLE.exec(stmt);
+  if (!role)
+    return false;
+  const rest = stmt.slice(role.index + role[0].length, role.index + role[0].length + 300);
+  const close = rest.indexOf("}");
+  const options = close < 0 ? rest : rest.slice(0, close);
+  const name = options.match(/(?:^|[\s,])name\s*:\s*/);
+  return name !== null && ACCOUNT_EMAIL_ENV.test(options.slice(name.index + name[0].length));
+}
+function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence, signedIn) {
   if (mutated && hasAttributeTransition(stmts))
     return { kind: "durable" };
   const notices = [];
@@ -5667,6 +6046,13 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
   };
   let presenceText;
   const presence = () => presenceText ??= stmts.filter((o) => !ABSENCE_MATCHER.test(o.stmt) && !NEGATED_ASSERT.test(o.stmt)).map((o) => o.stmt).join("\n");
+  let shownAccounts;
+  const shown = () => {
+    if (shownAccounts)
+      return shownAccounts;
+    const ref = new RegExp(entered.account.source, "g");
+    return shownAccounts = new Set(stmts.filter((o) => !claimsAbsence(o.stmt)).flatMap((o) => Array.from(o.stmt.matchAll(ref), (m) => m[0])));
+  };
   for (const { stmt, startLine } of stmts) {
     if (firstMutLine !== void 0 && startLine !== void 0 && startLine < firstMutLine)
       continue;
@@ -5674,6 +6060,11 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       continue;
     if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
       continue;
+    if (isVacuousAccountAbsence(stmt, shown, entered.account))
+      continue;
+    if (signedIn && startLine !== void 0 && startLine > signedIn.after && startLine < signedIn.until && isAccountControlCheck(stmt)) {
+      return { kind: "durable" };
+    }
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -5755,6 +6146,53 @@ function noticeOnlyExemption(clicked, noticeText, interactionStmts) {
 function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine) {
   return classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine).kind !== "none";
 }
+function clickLabel(stmt) {
+  let label = null;
+  for (const m of stmt.matchAll(CONTROL_LABEL))
+    label = m[2] ?? m[3] ?? null;
+  return label;
+}
+function teardownLines(lines) {
+  const out = new Array(lines.length).fill(false);
+  let open = false;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const ln = stripLineComment2(lines[i]).trim();
+    let from = 0;
+    if (!open) {
+      const m = TEARDOWN_OPEN.exec(ln);
+      if (!m)
+        continue;
+      open = true;
+      depth = 0;
+      from = m.index;
+    }
+    out[i] = true;
+    let closed = false;
+    let quote = null;
+    for (let k = from; k < ln.length; k++) {
+      const ch = ln[k];
+      if (quote !== null) {
+        if (ch === "\\")
+          k++;
+        else if (ch === quote)
+          quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`")
+        quote = ch;
+      else if (ch === "{")
+        depth++;
+      else if (ch === "}") {
+        depth--;
+        closed = true;
+      }
+    }
+    if (depth <= 0 && closed)
+      open = false;
+  }
+  return out;
+}
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
@@ -5798,7 +6236,13 @@ function validateAssertionStrength(code, opts = {}) {
   const interactionStmts = inlineLocatorBindings(interactionStmtsRaw);
   const blockIds = testBlockIds(lines);
   const blockOfLine = (line) => blockIds?.[line - 1] ?? 0;
-  const checks = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine);
+  const hoistedReads = assertionStrengthHoistedReadsOn();
+  const boundAt = hoistedReads ? /* @__PURE__ */ new Map() : void 0;
+  const resolved = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine, boundAt);
+  const checks = boundAt === void 0 ? resolved : resolved.flatMap((s) => {
+    const from = boundAt.get(s);
+    return plainAssertion(s, from !== void 0 && actsBetween(interactionStmtsWithLines, from, s.startLine));
+  });
   const insideTest = linesInsideTestBlocks(lines);
   const inTestOrder = (i) => insideTest === null || insideTest[interactionStmtsWithLines[i].startLine - 1] === true;
   let mutated = opts.interactionPerformed === true;
@@ -5808,9 +6252,34 @@ function validateAssertionStrength(code, opts = {}) {
   let navClicks = 0;
   const persistence = { mutLines: [], reloadLines: [], reloadCalls: [] };
   const openedPages = /* @__PURE__ */ new Set();
+  let checkedPage = null;
+  const savedOnCheckedPage = /* @__PURE__ */ new Set();
+  const saveAt = (i, at) => {
+    lastMutIdx = i;
+    if (!inTestOrder(i))
+      return;
+    persistence.mutLines.push(at);
+    if (firstMutIdx < 0)
+      firstMutIdx = i;
+    if (checkedPage !== null)
+      savedOnCheckedPage.add(checkedPage);
+  };
+  const lastActionProof = opts.lastActionProof ?? "off";
+  const teardown = lastActionProof === "off" ? null : teardownLines(lines);
+  const acts = { last: null, prev: null, count: 0 };
+  const noteAct = (i, at, kind) => {
+    if (teardown === null || teardown[at - 1] || !inTestOrder(i))
+      return;
+    if (kind !== "enter")
+      acts.count++;
+    acts.prev = acts.last;
+    acts.last = { i, kind };
+  };
   for (let i = 0; i < interactionStmts.length; i++) {
     const ln = interactionStmts[i];
     const at = interactionStmtsWithLines[i].startLine;
+    if (teardown !== null && acts.last?.kind === "fill" && ENTER_PRESS.test(ln))
+      noteAct(i, at, "enter");
     if (RELOAD.test(ln)) {
       persistence.reloadLines.push(at);
       persistence.reloadCalls.push(at);
@@ -5818,32 +6287,31 @@ function validateAssertionStrength(code, opts = {}) {
     const opened = ln.match(/\.goto\s*\(\s*([^,)]+)/);
     if (opened) {
       const page = opened[1].trim();
-      if (openedPages.has(page))
+      const path = namedPagePath(page);
+      if (openedPages.has(page) || path !== null && savedOnCheckedPage.has(path))
         persistence.reloadLines.push(at);
-      else
-        openedPages.add(page);
-    }
+      openedPages.add(page);
+      checkedPage = null;
+    }
+    if (/\bpage\s*\.\s*go(?:Back|Forward)\s*\(/.test(ln))
+      checkedPage = null;
+    const checked = URL_CHECK_ARG.exec(ln);
+    if (checked)
+      checkedPage = namedPagePath(checked[1] ?? checked[2]);
     if (FORM_INPUT.test(ln)) {
       mutated = true;
-      lastMutIdx = i;
-      if (inTestOrder(i)) {
-        persistence.mutLines.push(at);
-        if (firstMutIdx < 0)
-          firstMutIdx = i;
-      }
+      saveAt(i, at);
+      noteAct(i, at, "fill");
       continue;
     }
     if (ANY_CLICK.test(ln)) {
       if (NAV_LOCATOR.test(ln)) {
         navClicks++;
+        checkedPage = null;
       } else {
         mutated = true;
-        lastMutIdx = i;
-        if (inTestOrder(i)) {
-          persistence.mutLines.push(at);
-          if (firstMutIdx < 0)
-            firstMutIdx = i;
-        }
+        saveAt(i, at);
+        noteAct(i, at, "click");
       }
     }
   }
@@ -5876,9 +6344,28 @@ function validateAssertionStrength(code, opts = {}) {
     };
   }
   const orderedPersistence = firstMutLine !== void 0 ? persistence : void 0;
-  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence);
+  const signedIn = signInProofWindow(interactionStmts, interactionStmtsWithLines, lines, blockIds);
+  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn);
   if (proof.kind === "durable") {
     const signals2 = base({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal });
+    const { last, prev } = acts;
+    if (teardown !== null && last !== null && acts.count >= 2 && last.kind !== "fill" && (last.kind === "enter" || isCommitClick(interactionStmts[last.i]) && !(prev?.kind === "click" && isDestructiveClick(interactionStmts[prev.i])))) {
+      const lastLine = interactionStmtsWithLines[last.i].startLine;
+      const clicked = clickedControlNames(interactionStmts);
+      const after = classifyOutcomeProof(checks, mutated, reloaded, clicked, entered, lastLine, orderedPersistence, signedIn);
+      const unproven = after.kind === "none" || after.kind === "notice" && noticeOnlyExemption(clicked, after.noticeText, interactionStmts) === null;
+      if (unproven && lastActionProof === "on") {
+        const line = (keptScaffoldingLines(code.split("\n"))[lastLine - 1] ?? lastLine - 1) + 1;
+        return {
+          ok: false,
+          severity: "block",
+          reason: `the last save (line ${line}) has no outcome check after it (the earlier check proves only the earlier action)`,
+          signals: { ...signals2, lastActionUnproven: true }
+        };
+      }
+      if (unproven)
+        signals2.lastActionUnproven = true;
+    }
     return { ok: true, severity: "none", reason: "proves an outcome (count / diff / value / revealed content)", signals: signals2 };
   }
   if (mutated && proof.kind === "notice") {
@@ -5927,7 +6414,7 @@ function validateAssertionStrength(code, opts = {}) {
         signals
       };
     }
-    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && URL_PROOF.test(s));
+    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && isUrlProof(s));
     if (urlProofAfter) {
       return {
         ok: false,
@@ -5964,7 +6451,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -5973,6 +6460,7 @@ var init_assertion_strength = __esm({
     init_assertion_proof();
     init_auth_handoff_coverage();
     init_expect_call();
+    init_auth_plan();
     ERROR_BANNER = /(client-side exception|application error|something (?:went wrong|broke)|unhandled (?:exception|error|rejection)|runtime error|error boundary|an unexpected error|internal server error|\b5\d\d\s+(?:internal\s+)?server error|stack trace|chunkloaderror|hydration failed|maximum update depth exceeded)/i;
     OUTCOME_ALWAYS = [
       /\.toHaveCount\s*\(/,
@@ -5989,7 +6477,7 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /(?<!\.not\s*)\.\s*toBeDisabled\s*\(/,
+      /\.(?<!\.not\s*\.)\s*toBeDisabled\s*\(/,
       // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
@@ -5998,12 +6486,16 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)|\bexpect\s*\.\s*poll\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*(?:\{\s*return\s+)?page\s*\.\s*url\s*\(\s*\)/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    POLL_OPEN = /\bexpect\s*\.\s*poll\s*\(/g;
+    POLL_PAGE_URL = /^page\s*\.\s*url\s*\(\s*\)/;
+    POLL_PAGE_URL_ONLY = /^page\s*\.\s*url\s*\(\s*\)$/;
+    POLL_CALLS_MAX = 8;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     TEST_BLOCK_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow|serial|describe\.serial))?\s*\(|^(?:test\.)?(?:beforeEach|beforeAll)\s*\(/;
-    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
+    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=(?:\s*(?!\s)|\s*(?=\s(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\())(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
     EXPECT_OPEN = /\bexpect(?:\.soft)?\s*\(/;
     STATE_MATCHER = /\.(toBeChecked|toBeVisible|toHaveValue|toBeDisabled|toBeEnabled)\s*\(/;
     CHROME_LOCATOR = /getByRole\s*\(\s*['"`](?:heading|navigation|banner|main|contentinfo|complementary|region|search|tablist|tab|button|link|menuitem|textbox|searchbox|combobox|spinbutton)['"`]/i;
@@ -6023,7 +6515,7 @@ var init_assertion_strength = __esm({
     EMPTY_STATE_TEXT = /\bno\b[\s\S]{0,24}?\b(yet|found|results?|items?|favou?rites?|entries|records?|matches|posts?|comments?)\b|nothing (?:here|yet|to show|found)|\bempty\b|\(\s*0\s*\)|\b0\s+(?:favou?rites?|results?|items?|entries|records?|matches|posts?|comments?)\b/i;
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
-    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
+    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*(?:;\s*)?$/;
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
@@ -6033,7 +6525,7 @@ var init_assertion_strength = __esm({
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
     FAILURE_STATUS_ASSERT = [
       /\.status\s*\(\s*\)[^;]{0,200}\.(?:toBeGreaterThanOrEqual|toBeGreaterThan)\s*\(\s*(?:399|[45]\d\d)\b/,
-      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\))?\s*>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
+      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\)\s*)?>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
       /\bexpect\s*\([^;]{0,200}\.ok\s*\(\s*\)\s*\)\s*\.\s*(?:toBe\s*\(\s*false\s*\)|toBeFalsy\s*\()/
     ];
     FAILED_LIST_ASSERT = /\bexpect\s*\(\s*[^;]{0,200}(?:fail|abort|error)\w{0,40}(?:\.length)?\s*\)\s*\.\s*(?:toBeGreaterThan\s*\(\s*0|toHaveLength\s*\(\s*[1-9]|not\s*\.\s*toHaveLength\s*\(\s*0|not\s*\.\s*toEqual\s*\(\s*\[\s*\])/i;
@@ -6048,6 +6540,7 @@ var init_assertion_strength = __esm({
     NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    SCOPING_STEP = /(?:\s*\.\s*(?:first|last|nth)\s*\([^()]*\))*\s*\.\s*(?:getBy[A-Z]\w*|locator|filter)\s*\(/y;
     NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
     ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
     REQUEST_WORD = /\brequest\b/;
@@ -6074,6 +6567,9 @@ var init_assertion_strength = __esm({
     ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
     ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
     HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
+    ACCOUNT_KEYS = TEST_USER_ENV_KEYS.join("|");
+    ACCOUNT_ENV = `process\\.env(?:\\??\\.(?:${ACCOUNT_KEYS})\\b|(?:\\?\\.)?\\[\\s*['"\`](?:${ACCOUNT_KEYS})['"\`]\\s*\\])`;
+    ACCOUNT_CONST = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*(?::\\s*string\\s*)?=\\s*${ACCOUNT_ENV}`, "g");
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
     LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
     LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
@@ -6085,20 +6581,47 @@ var init_assertion_strength = __esm({
     IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
     PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
     COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
+    URL_CHECK_ARG = /\bpage\s*\.\s*waitForURL\s*\(\s*([^,)]+)|\bexpect(?:\s*\.\s*soft)?\s*\(\s*page\s*\)\s*\.\s*toHaveURL\s*\(\s*([^,)]+)/;
+    PLAIN_PAGE_PATH = /^\/[\w\-./~%]*(?:[?#][^\s]*)?$/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
+    ACCOUNT_EMAIL_ENV = /^process\.env(?:(?:\?\.|\.)TEST_USER_EMAIL\b|(?:\?\.)?\[\s*['"]TEST_USER_EMAIL['"]\s*\])/;
+    ENV_PASSWORD_ENTRY = /\.(?:fill|pressSequentially)\s*\(\s*process\.env(?:(?:\?\.|\.)TEST_USER_PASSWORD\b|(?:\?\.)?\[\s*['"]TEST_USER_PASSWORD['"]\s*\])/;
+    ACCOUNT_CONTROL_ROLE = /getByRole\s*\(\s*['"`](?:button|link|menuitem)['"`]\s*,\s*\{/;
+    ASSERT_OR_WAIT = /^(?:await\s+)?(?:expect(?:\.soft|\.poll)?\s*\(|[\w$]+(?:\.[\w$]+)*\.waitFor[A-Za-z]*\s*\()/;
+    ACTS = /\.(?:click|dblclick|tap|press|pressSequentially|fill|clear|type|check|uncheck|setChecked|selectOption|setInputFiles|dispatchEvent|hover|focus|dragTo|goto|reload|goBack|goForward|evaluate|evaluateHandle)\s*\(|\b(?:keyboard|mouse|touchscreen)\s*\.|\.toPass\s*\(/;
+    actLinesOf = /* @__PURE__ */ new WeakMap();
+    CLOSERS_ONLY = /^[})\];,\s]+$/;
+    TEST_BODY_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow))?\s*\(/;
     COPY_CONTROL = /\bcopy\b/i;
     COPIED_NOTICE = /\bcopied\b/i;
     SEND_CONTROL = /\b(send|submit|subscribe|sign up for|contact|feedback|join (the )?waitlist)\b/i;
     SEND_NOTICE = /\b(thank|thanks|sent|subscribed|received|in touch)\b/i;
     MARK_READ_CONTROL = /\bmark(?:ed)? as read\b|\bmark all(?: as)? read\b/i;
     APP_DATA_FIELD = /\b(title|name of|amount|price|quantity|sku|status|due|assignee|project|ticket|invoice|order)\b/i;
+    COMMIT_CONTROL = /\b(?:save|submit|update|apply|add|create|post|send|publish)\b|\bconfirm\s+changes\b/i;
+    NOT_COMMIT_CONTROL = /\b(?:delete|remove|cancel|close|dismiss|discard|back|sign\s*out|log\s*out|logout|done|ok|got\s+it|export|download)\b/i;
+    DESTRUCTIVE_CONTROL = /\b(?:delete|remove|discard)\b/i;
+    ENTER_PRESS = /\.press\s*\(\s*['"`]Enter['"`]/;
+    CONTROL_LABEL = /(?:name\s*:\s*|getBy(?:Text|Label|Title|TestId)\s*\(\s*|has-text\(\s*)(?:(['"`])((?:(?!\1).)*)\1|\/((?:\\.|[^/\\])+)\/)/g;
+    isCommitClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && COMMIT_CONTROL.test(label) && !NOT_COMMIT_CONTROL.test(label) && !EXCLUDE_AFFORDANCE.test(label);
+    };
+    isDestructiveClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && DESTRUCTIVE_CONTROL.test(label);
+    };
+    TEARDOWN_OPEN = /\bfinally\s*\{|^(?:test\.)?(?:after|before)(?:Each|All)\s*\(/;
   }
 });
 
 // ../shared/dist/run-classification.js
-function isUserCancelledError(error) {
-  return typeof error === "string" && error.trim().startsWith(USER_CANCELLED_RUN_ERROR);
+function isCancelledReason(error) {
+  if (typeof error !== "string")
+    return false;
+  const text = error.trim();
+  return CANCELLED_REASON_PREFIXES.some((prefix) => text.startsWith(prefix));
 }
 function isHeldHealRun(run) {
   return run?.status === "PASSED" && typeof run.error === "string" && run.error.startsWith(HEAL_PATCH_HELD_RUN_ERROR_PREFIX);
@@ -6131,7 +6654,7 @@ function pickLatestHealthRun(runs) {
   for (const run of runs) {
     if (run.mode === "auth-setup")
       continue;
-    if (run.status === "ERROR" && isUserCancelledError(run.error))
+    if (run.status === "ERROR" && isCancelledReason(run.error))
       continue;
     if (isHeldHealRun(run))
       continue;
@@ -6149,6 +6672,15 @@ function pickDisplayRun(runs) {
     return latest;
   return pickLatestHealthRun(runs) ?? latest;
 }
+function featureRowRunStatus(runs) {
+  const latest = runs.find((run) => run.mode !== "auth-setup");
+  if (!latest)
+    return null;
+  const decisive = pickLatestHealthRun(runs.filter((run) => !isEnvironmentalError(run)));
+  if (decisive)
+    return decisive.status;
+  return latest.status === "PENDING" || latest.status === "RUNNING" ? latest.status : null;
+}
 function isEnvironmentalError(run) {
   if (!run)
     return false;
@@ -6180,7 +6712,7 @@ function classifyErrorMessage(error) {
     return "config_issue";
   if (EMAIL_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
     return "email_not_received";
-  if (isUserCancelledError(error))
+  if (isCancelledReason(error))
     return "cancelled";
   if (isRetriedRunInterruption(error))
     return "interrupted";
@@ -6215,7 +6747,7 @@ function heldHealRunWhere() {
 function excludeCancelledRunsWhere() {
   return {
     NOT: [
-      { status: "ERROR", error: { not: null, startsWith: USER_CANCELLED_RUN_ERROR } },
+      { status: "ERROR", OR: CANCELLED_REASON_PREFIXES.map((prefix) => ({ error: { not: null, startsWith: prefix } })) },
       heldHealRunWhere()
     ]
   };
@@ -6293,11 +6825,25 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
     USER_CANCELLED_RUN_ERROR = "Cancelled by user";
+    PLATFORM_SUPPORT_CANCELLED_RUN_ERROR = "Cancelled by platform support";
+    PLATFORM_ADMIN_CANCELLED_RUN_ERROR = "Cancelled by platform admin";
+    ADMIN_FORCE_CANCELLED_RUN_ERROR = "Admin force-cancelled all active runs";
+    CHAIN_CANCELLED_RUN_ERROR = "Cancelled: parent run cancelled";
+    RETRY_HELD_RUN_ERROR = "Cancelled: auto generation paused";
+    CANCELLED_REASON_PREFIXES = [
+      USER_CANCELLED_RUN_ERROR,
+      PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
+      PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
+      ADMIN_FORCE_CANCELLED_RUN_ERROR,
+      CHAIN_CANCELLED_RUN_ERROR,
+      RETRY_HELD_RUN_ERROR
+    ];
+    isUserCancelledError = isCancelledReason;
     HEAL_PATCH_HELD_RUN_ERROR_PREFIX = "Heal patch held";
     RUNNER_INTERRUPT_ERROR_PREFIX = "Runner shutting down";
     SERVER_INTERRUPT_ERROR_PREFIX = "Run interrupted by server restart";
@@ -6326,9 +6872,10 @@ var init_run_classification = __esm({
     ];
     ENVIRONMENTAL_ERROR_STORED_PREFIXES = [
       ...ENVIRONMENTAL_ERROR_PREFIXES.flatMap((prefix) => [prefix, `Error: ${prefix}`]),
-      // Written by the cancel routes as is, with no prefix wrapper.
-      USER_CANCELLED_RUN_ERROR
+      // Written by the cancels as is, with no prefix wrapper.
+      ...CANCELLED_REASON_PREFIXES
     ];
+    FEATURE_ROW_RUN_WINDOW = 10;
     BUG_SURFACE_SUPPRESSING_TAGS = ["@rate-limit-blocked", "@quota-exceeded", "@auth-lost"];
     QUARANTINE_CLOSE_TAGS = [
       "@bug-found",
@@ -8761,180 +9308,6 @@ var init_admin_view_return_to = __esm({
   }
 });
 
-// ../shared/dist/auth-plan.js
-function hasInlineLoginSteps(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
-}
-function hasGeneratedAuthGuard(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
-}
-function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
-  if (!sharedAuthInjectEnabled)
-    return false;
-  if (tags.includes("@auth"))
-    return false;
-  if (tags.includes("@api"))
-    return true;
-  if (!tags.includes("@needs-auth"))
-    return false;
-  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
-    return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
-  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
-}
-function codeReadsStoredCredentials(code) {
-  if (!code)
-    return false;
-  if (/__vqaLogin\b/.test(code))
-    return true;
-  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
-    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
-      return true;
-  }
-  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
-    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
-      return true;
-  }
-  return false;
-}
-function explicitAuthTypeTags(t) {
-  const found = /* @__PURE__ */ new Set();
-  for (const tag of t) {
-    if (AUTH_TYPE_TAGS.includes(tag))
-      found.add(tag);
-    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
-      found.add(AUTH_TAG_ALIASES[tag]);
-  }
-  return [...found];
-}
-function invalidPlan(configurationError) {
-  return {
-    version: 1,
-    source: "invalid",
-    acquisition: "unsupported",
-    presentation: "none",
-    needsCookieState: false,
-    needsStandingHeaders: false,
-    standingHeadersMode: "none",
-    needsLoginCreds: false,
-    requiredEnvKeys: [],
-    configurationError
-  };
-}
-function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
-  return {
-    version: 1,
-    source: "explicit",
-    authTypeTag: authTypeTag2,
-    acquisition,
-    presentation,
-    needsCookieState: opts.cookie,
-    needsStandingHeaders: opts.standingMode === "required",
-    standingHeadersMode: opts.standingMode,
-    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
-    requiredEnvKeys: opts.requiredEnvKeys
-  };
-}
-function deriveAuthPlan(tags, code, opts) {
-  const t = Array.isArray(tags) ? tags : [];
-  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
-  const isApi = t.includes("@api");
-  const explicit = isApi ? explicitAuthTypeTags(t) : [];
-  if (explicit.length > 0) {
-    if (t.includes("@auth")) {
-      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
-    }
-    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
-    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
-      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
-      switch (loginCompose[0]) {
-        case AUTH_TAG_COOKIE_STATE:
-          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_COOKIE:
-          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_BEARER:
-          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-      }
-    }
-    if (explicit.length > 1) {
-      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
-    }
-    switch (explicit[0]) {
-      case AUTH_TAG_UNSUPPORTED:
-        return {
-          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
-        };
-      case AUTH_TAG_NONE:
-        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
-      case AUTH_TAG_STANDING:
-        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
-      case AUTH_TAG_LOGIN_BEARER:
-        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_LOGIN_COOKIE:
-        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_COOKIE_STATE:
-        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-    }
-  }
-  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
-  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
-  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
-  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
-  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
-  return {
-    version: 1,
-    source: "legacy",
-    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
-    presentation: authedLegacy ? "cookie" : "none",
-    needsCookieState: cookie,
-    needsStandingHeaders: false,
-    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
-    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
-    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
-    needsLoginCreds,
-    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
-  };
-}
-function authTypeTag(tags) {
-  const t = Array.isArray(tags) ? tags : [];
-  const explicit = explicitAuthTypeTags(t);
-  return explicit.length === 1 ? explicit[0] : void 0;
-}
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
-var init_auth_plan = __esm({
-  "../shared/dist/auth-plan.js"() {
-    "use strict";
-    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
-    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
-    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
-    AUTH_TAG_STANDING = "@auth-standing";
-    AUTH_TAG_NONE = "@auth-none";
-    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
-    AUTH_TYPE_TAGS = [
-      AUTH_TAG_COOKIE_STATE,
-      AUTH_TAG_LOGIN_COOKIE,
-      AUTH_TAG_LOGIN_BEARER,
-      AUTH_TAG_STANDING,
-      AUTH_TAG_NONE,
-      AUTH_TAG_UNSUPPORTED
-    ];
-    AUTH_TAG_ALIASES = {
-      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
-      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
-      "@auth-token": AUTH_TAG_LOGIN_BEARER,
-      "@auth-api-key": AUTH_TAG_STANDING,
-      "@auth-standing-header": AUTH_TAG_STANDING
-    };
-    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
-    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
-  }
-});
-
 // ../shared/dist/auth-block-detector.js
 function stripEchoLines(text) {
   return text.split("\n").filter((line) => !ECHO_LINE_RE.test(line)).join("\n");
@@ -8942,13 +9315,16 @@ function stripEchoLines(text) {
 function matchesAny(text, patterns) {
   return patterns.some((p) => p.test(text));
 }
+function isIntentionalNegativeAuthTest(input) {
+  const meta = [input.testName, input.description].filter(Boolean).join(" ");
+  return matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH);
+}
 function detectAuthBlock(input) {
   const tags = input.tags ?? [];
   const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
   if (!isAuthed)
     return NO_DETECTION;
-  const meta = [input.testName, input.description].filter(Boolean).join(" ");
-  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
+  if (isIntentionalNegativeAuthTest(input))
     return NO_DETECTION;
   const sources = [];
   if (input.error)
@@ -9051,7 +9427,7 @@ var init_auth_block_detector = __esm({
       /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
     ];
     ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
-    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*(?::\s*)?(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
   }
 });
 
@@ -9992,12 +10368,70 @@ function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
 function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
   return value?.trim().toLowerCase() !== "false";
 }
+function visualBaselinesEnabled(projectId, raw = process.env.VISUAL_BASELINES_PROJECTS) {
+  if (typeof projectId !== "string" || projectId.trim() === "")
+    return false;
+  const listed = (raw ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return listed.includes("*") || listed.includes(projectId);
+}
 var init_feature_flags = __esm({
   "../shared/dist/feature-flags.js"() {
     "use strict";
   }
 });
 
+// ../shared/dist/visual-compare-limits.js
+function isSafeMaskSelector(selector) {
+  if (typeof selector !== "string")
+    return false;
+  if (selector.trim().length === 0)
+    return false;
+  if (selector.length > VISUAL_MASK_SELECTOR_MAX_LENGTH)
+    return false;
+  return !VISUAL_MASK_SELECTOR_FORBIDDEN.test(selector);
+}
+var VISUAL_MASK_SELECTORS_MAX, VISUAL_MASK_SELECTOR_MAX_LENGTH, VISUAL_MASK_SELECTOR_FORBIDDEN;
+var init_visual_compare_limits = __esm({
+  "../shared/dist/visual-compare-limits.js"() {
+    "use strict";
+    VISUAL_MASK_SELECTORS_MAX = 50;
+    VISUAL_MASK_SELECTOR_MAX_LENGTH = 300;
+    VISUAL_MASK_SELECTOR_FORBIDDEN = /[{};@<\r\n]/;
+  }
+});
+
+// ../shared/dist/visual-baseline-identity.js
+function isBrowserVersion(value) {
+  return typeof value === "string" && value.length <= 32 && BROWSER_VERSION.test(value);
+}
+function renderIdentity(flavour, version, image) {
+  if (!/^[a-z][a-z-]{0,31}$/.test(flavour) || !/^[a-z][a-z-]{0,31}$/.test(image) || !isBrowserVersion(version))
+    return null;
+  const identity = `${flavour}/${version}/${image}`;
+  return identity.length <= RENDER_IDENTITY_MAX_LENGTH ? identity : null;
+}
+function v1RenderIdentity(version) {
+  return renderIdentity(VISUAL_V1_IDENTITY.flavour, version, VISUAL_V1_IDENTITY.image);
+}
+function parseRenderIdentity(value) {
+  if (typeof value !== "string" || value.length > RENDER_IDENTITY_MAX_LENGTH)
+    return null;
+  const parts = value.split("/");
+  if (parts.length !== 3)
+    return null;
+  const [flavour, version, image] = parts;
+  return renderIdentity(flavour, version, image) === value ? { flavour, version, image } : null;
+}
+var VISUAL_V1_IDENTITY, RENDER_IDENTITY_MAX_LENGTH, BROWSER_VERSION;
+var init_visual_baseline_identity = __esm({
+  "../shared/dist/visual-baseline-identity.js"() {
+    "use strict";
+    VISUAL_V1_IDENTITY = { platform: "linux", image: "runner-fast", flavour: "headless-shell" };
+    RENDER_IDENTITY_MAX_LENGTH = 64;
+    BROWSER_VERSION = /^\d{1,4}(\.\d{1,6}){0,3}$/;
+  }
+});
+
 // ../shared/dist/analytics-url.js
 function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
@@ -10351,14 +10785,9 @@ function isOpenCodeGoModelId(id) {
 function hasOpenCodeGoPrefix(id) {
   return (id?.trim() ?? "").startsWith(OPENCODE_GO_PREFIX);
 }
-function hasOpenCodeGo2Prefix(id) {
-  return (id?.trim() ?? "").startsWith(OPENCODE_GO_2_PREFIX);
-}
 function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
-  if (!isOpenCodeGoModelId(trimmed))
-    return null;
-  return trimmed.slice((hasOpenCodeGo2Prefix(trimmed) ? OPENCODE_GO_2_PREFIX : OPENCODE_GO_PREFIX).length);
+  return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
 }
 function isZaiModelId(id) {
   const trimmed = id?.trim() ?? "";
@@ -10467,7 +10896,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_2_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10526,8 +10955,7 @@ var init_engine_spec = __esm({
     OPENROUTER_PREFIX = "openrouter:";
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
-    OPENCODE_GO_2_PREFIX = "opencode-go-2:";
-    OPENCODE_GO_MODEL_PATTERN = /^opencode-go(?:-2)?:[a-z0-9][a-z0-9._-]{0,100}$/;
+    OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
     ZAI_PREFIX = "zai:";
     ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
@@ -10852,14 +11280,19 @@ function has(map, key) {
 }
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
+  if (key && has(_overrideHops, key))
+    return _overrideHops[key];
   return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
 }
 function providerChainLeadsFor(modelId) {
   const key = chainKey(modelId);
+  if (key && has(_overrideLeads, key))
+    return _overrideLeads[key];
   return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
 }
 function allChains() {
-  return [...Object.entries(PROVIDER_CHAINS), ...Object.entries(PROVIDER_CHAIN_LEADS)];
+  const ordered = (map, override) => [...Object.entries(map).filter(([key]) => !has(override, key)), ...Object.entries(override)];
+  return [...ordered(PROVIDER_CHAINS, _overrideHops), ...ordered(PROVIDER_CHAIN_LEADS, _overrideLeads)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
@@ -10876,14 +11309,24 @@ function providerChainHostOf(value, modelValue) {
     return "own";
   if (hasZaiPrefix(value))
     return "zai";
-  if (hasOpenCodeGo2Prefix(value))
-    return "opencode-go-2";
   if (hasOpenCodeGoPrefix(value))
     return "opencode-go";
   if (hasOpenRouterPrefix(value))
     return "openrouter";
   return "own";
 }
+function providerChainHostProvider(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasZaiPrefix(value))
+    return "zai";
+  const key = chainKey(value);
+  return API_MODEL_CATALOG.find((m) => m.id === key)?.provider ?? GEMINI_ASSISTANT_MODELS.find((m) => m.id === key)?.provider ?? null;
+}
 function providerHostPlan(modelId) {
   const key = chainKey(modelId);
   if (!key)
@@ -10901,7 +11344,140 @@ function providerHostPlan(modelId) {
   }
   return steps;
 }
-var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED;
+function providerChainModelKey(modelId) {
+  return chainKey(modelId);
+}
+function hasProviderChainLeadsByDefault(modelId) {
+  const key = chainKey(modelId);
+  return key !== null && has(PROVIDER_CHAIN_LEADS, key);
+}
+function isChainablePrimary(id) {
+  return typeof id === "string" && id !== "" && (has(PROVIDER_CHAINS, id) || has(PROVIDER_CHAIN_LEADS, id));
+}
+function defaultProviderChainEntries(primary) {
+  if (!isChainablePrimary(primary))
+    return [];
+  const leads = has(PROVIDER_CHAIN_LEADS, primary) ? PROVIDER_CHAIN_LEADS[primary] : [];
+  const hops = has(PROVIDER_CHAINS, primary) ? PROVIDER_CHAINS[primary] : [];
+  return [...leads, primary, ...hops].map((hop) => ({ hop, enabled: true }));
+}
+function allowedProviderChainHosts(primary) {
+  return defaultProviderChainEntries(primary).map((entry) => entry.hop);
+}
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function validateProviderChainEntries(primary, entries) {
+  if (!isChainablePrimary(primary))
+    return `${String(primary).slice(0, 80)} has no provider chain to order`;
+  if (!Array.isArray(entries))
+    return `${primary}: the chain must be a list`;
+  if (entries.length > PROVIDER_CHAIN_MAX_ENTRIES)
+    return `${primary}: at most ${PROVIDER_CHAIN_MAX_ENTRIES} hosts`;
+  const allowed = allowedProviderChainHosts(primary);
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!isPlainObject2(entry))
+      return `${primary}: each host must be { hop, enabled }`;
+    const keys = Object.keys(entry);
+    if (keys.length !== 2 || !keys.includes("hop") || !keys.includes("enabled"))
+      return `${primary}: each host must be { hop, enabled } and nothing else`;
+    const { hop, enabled } = entry;
+    if (typeof enabled !== "boolean")
+      return `${primary}: enabled must be true or false`;
+    if (typeof hop !== "string" || !hop)
+      return `${primary}: hop must be a model value`;
+    if (!allowed.includes(hop))
+      return `${primary}: ${hop.slice(0, 80)} is not a host of this model`;
+    if (seen.has(hop))
+      return `${primary}: ${hop} is listed twice`;
+    if (hop === primary && !enabled)
+      return `${primary}: the model's own value stays on (pick another model on AI Models instead)`;
+    seen.add(hop);
+  }
+  if (!seen.has(primary))
+    return `${primary}: list the model's own value once, where its own host sits`;
+  return null;
+}
+function decodeProviderChains(raw) {
+  let value = raw;
+  if (typeof raw === "string") {
+    if (raw.length > PROVIDER_CHAINS_SETTING_MAX_CHARS)
+      return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return { ok: false, error: "AI_PROVIDER_CHAINS must be valid JSON" };
+    }
+  } else if (JSON.stringify(raw ?? null).length > PROVIDER_CHAINS_SETTING_MAX_CHARS) {
+    return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+  }
+  if (!isPlainObject2(value))
+    return { ok: false, error: 'AI_PROVIDER_CHAINS must be an object: { "<model>": [ { "hop": "<model value>", "enabled": true } ] }' };
+  if (Object.keys(value).length > PROVIDER_CHAIN_MAX_PRIMARIES)
+    return { ok: false, error: `AI_PROVIDER_CHAINS names at most ${PROVIDER_CHAIN_MAX_PRIMARIES} models` };
+  return { ok: true, value };
+}
+function checkedProviderChains(value) {
+  const out = {};
+  for (const [primary, entries] of Object.entries(value)) {
+    const problem = validateProviderChainEntries(primary, entries);
+    if (problem)
+      return { ok: false, error: problem };
+    out[primary] = entries.map(({ hop, enabled }) => ({ hop, enabled }));
+  }
+  return { ok: true, value: out };
+}
+function parseProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  return decoded.ok ? checkedProviderChains(decoded.value) : decoded;
+}
+function parseStoredProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  if (!decoded.ok)
+    return decoded;
+  const dropped = [];
+  const kept = {};
+  for (const [primary, entries] of Object.entries(decoded.value)) {
+    if (!isChainablePrimary(primary) || !Array.isArray(entries)) {
+      kept[primary] = entries;
+      continue;
+    }
+    const allowed = allowedProviderChainHosts(primary);
+    kept[primary] = entries.filter((entry) => {
+      const hop = isPlainObject2(entry) ? entry.hop : void 0;
+      if (typeof hop !== "string" || hop === "" || allowed.includes(hop))
+        return true;
+      dropped.push({ primary, hop: hop.slice(0, 80) });
+      return false;
+    });
+  }
+  const checked = checkedProviderChains(kept);
+  return checked.ok ? { ...checked, dropped } : checked;
+}
+function validateProviderChainsSetting(raw) {
+  const parsed = parseProviderChainOverrides(raw);
+  return parsed.ok ? null : parsed.error;
+}
+function setProviderChainOverrides(value, onDropped) {
+  const parsed = value === null || value === void 0 || value === "" ? null : parseStoredProviderChainOverrides(value);
+  if (parsed?.ok && parsed.dropped.length > 0)
+    onDropped?.(parsed.dropped);
+  _overrides = parsed?.ok ? parsed.value : null;
+  _overrideLeads = {};
+  _overrideHops = {};
+  for (const [primary, entries] of Object.entries(_overrides ?? {})) {
+    const at = entries.findIndex((entry) => entry.hop === primary);
+    const on = (list) => list.filter((entry) => entry.enabled).map((entry) => entry.hop);
+    _overrideLeads[primary] = on(entries.slice(0, at));
+    _overrideHops[primary] = on(entries.slice(at + 1));
+  }
+  return parsed === null || parsed.ok;
+}
+function getProviderChainOverrides() {
+  return _overrides;
+}
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED, PROVIDER_CHAIN_MAX_ENTRIES, PROVIDER_CHAINS_SETTING_MAX_CHARS, PROVIDER_CHAIN_MAX_PRIMARIES, ALLOWED_PROVIDER_CHAIN_HOPS, _overrides, _overrideLeads, _overrideHops;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
@@ -10913,18 +11489,120 @@ var init_provider_chains = __esm({
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
       "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
       "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
-      "deepseek-flash": ["opencode-go-2:deepseek-v4.1-flash", "opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
-      "deepseek-v4-pro": ["opencode-go-2:deepseek-v4-pro", "opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
+      "deepseek-flash": ["opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
     };
     PROVIDER_CHAIN_LEADS = {
-      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go-2:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go-2:glm-5.3", "opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go-2:glm-5.2", "opencode-go:glm-5.2"]
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go:glm-5.2"]
     };
     PROVIDER_HOST_NOT_OFFERED = {
       "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
       "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
     };
+    PROVIDER_CHAIN_MAX_ENTRIES = 8;
+    PROVIDER_CHAINS_SETTING_MAX_CHARS = 16e3;
+    PROVIDER_CHAIN_MAX_PRIMARIES = 32;
+    ALLOWED_PROVIDER_CHAIN_HOPS = /* @__PURE__ */ new Set([
+      ...Object.values(PROVIDER_CHAINS).flat(),
+      ...Object.values(PROVIDER_CHAIN_LEADS).flat()
+    ]);
+    _overrides = null;
+    _overrideLeads = {};
+    _overrideHops = {};
+  }
+});
+
+// ../shared/dist/provider-accounts.js
+function modelNames(modelId) {
+  const value = modelId.trim();
+  const names = /* @__PURE__ */ new Set([value]);
+  for (const prefix of HOST_PREFIXES) {
+    if (!value.startsWith(prefix))
+      continue;
+    const bare = value.slice(prefix.length);
+    names.add(bare);
+    const slash = bare.lastIndexOf("/");
+    if (slash >= 0)
+      names.add(bare.slice(slash + 1));
+  }
+  const canonical = canonicalModelId(value);
+  if (canonical) {
+    names.add(canonical);
+    const entry = API_MODEL_CATALOG.find((m) => m.id === canonical || m.apiModel === canonical);
+    if (entry) {
+      names.add(entry.id);
+      if (entry.apiModel)
+        names.add(entry.apiModel);
+    }
+  }
+  return names;
+}
+function accountServesModel(models, modelId) {
+  if (!models || models.length === 0)
+    return true;
+  if (!modelId)
+    return false;
+  const names = modelNames(modelId);
+  return models.some((model) => names.has(model.trim()));
+}
+function normalizeProviderAccountModels(models) {
+  if (!Array.isArray(models))
+    return null;
+  const out = [];
+  for (const model of models) {
+    if (typeof model !== "string")
+      return null;
+    const trimmed = model.trim();
+    if (!PROVIDER_ACCOUNT_MODEL_PATTERN.test(trimmed) || trimmed.includes(".."))
+      return null;
+    if (!out.includes(trimmed))
+      out.push(trimmed);
+  }
+  return out.length > MAX_PROVIDER_ACCOUNT_MODELS ? null : out;
+}
+function parseProviderAccountLists(value, providers) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const parsed = {};
+  for (const provider of providers) {
+    const list = value[provider];
+    if (!Array.isArray(list))
+      continue;
+    const accounts = [];
+    for (const raw of list) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const { id, label, key, models } = raw;
+      if (typeof id !== "string" || !id.trim() || typeof key !== "string" || !key.trim())
+        continue;
+      const modelList = Array.isArray(models) ? models.filter((m) => typeof m === "string" && m.trim() !== "").map((m) => m.trim()) : [];
+      accounts.push({ id: id.trim(), label: typeof label === "string" && label.trim() ? label.trim() : null, key: key.trim(), models: modelList });
+    }
+    if (accounts.length > 0)
+      parsed[provider] = accounts;
+  }
+  return parsed;
+}
+var DEFAULT_PROVIDER_ACCOUNT_ID, PROVIDER_ACCOUNT_ID_PATTERN, MAX_PROVIDER_ACCOUNTS, MAX_PROVIDER_ACCOUNT_MODELS, PROVIDER_ACCOUNT_MODEL_PATTERN, OPENCODE_GO_DEEPSEEK_GLM_MODELS, HOST_PREFIXES;
+var init_provider_accounts = __esm({
+  "../shared/dist/provider-accounts.js"() {
+    "use strict";
+    init_api_model_catalog();
+    DEFAULT_PROVIDER_ACCOUNT_ID = "primary";
+    PROVIDER_ACCOUNT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    MAX_PROVIDER_ACCOUNTS = 10;
+    MAX_PROVIDER_ACCOUNT_MODELS = 50;
+    PROVIDER_ACCOUNT_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,120}$/;
+    OPENCODE_GO_DEEPSEEK_GLM_MODELS = [
+      "deepseek-v4.1-flash",
+      "deepseek-v4-pro",
+      "glm-5.3-flash",
+      "glm-5.3",
+      "glm-5.2"
+    ];
+    HOST_PREFIXES = ["opencode-go:", "zai:", "openrouter:"];
   }
 });
 
@@ -11043,6 +11721,25 @@ var init_project_engine_overrides = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+function stripTrailingChars(value, isTrailing) {
+  let end = value.length;
+  while (end > 0 && isTrailing.test(value[end - 1]))
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/gemini-visual.js
 function visualProDailyBudget(raw) {
   const parsed = raw && /^\s*\d{1,6}\s*$/.test(raw) ? Number(raw.trim()) : NaN;
@@ -11056,7 +11753,7 @@ function isRetiredGeminiModel(id) {
 }
 function geminiNativeModelsUrl(base = process.env.GEMINI_API_BASE) {
   const raw = base && base.trim() || GEMINI_OPENAI_BASE;
-  const native = raw.replace(/\/openai\/?$/, "/").replace(/\/+$/, "");
+  const native = stripTrailingSlashes(raw.replace(/\/openai\/?$/, "/"));
   return `${native}/models?pageSize=1000`;
 }
 function asRecord(value) {
@@ -11176,6 +11873,7 @@ var KNOWN_INPUT_USD_PER_M, GEMINI_OPENAI_BASE, DEFAULT_GEMINI_SCREEN_MODEL, DEFA
 var init_gemini_visual = __esm({
   "../shared/dist/gemini-visual.js"() {
     "use strict";
+    init_trailing_slashes();
     KNOWN_INPUT_USD_PER_M = {
       "gemini-2.5-flash-lite": 0.1,
       "gemini-3.1-flash-lite": 0.25,
@@ -12539,12 +13237,13 @@ function truncateAtWord(text, max) {
   const slice = trimmed.slice(0, room + 1);
   const lastSpace = slice.lastIndexOf(" ");
   const cut = lastSpace > room * 0.5 ? slice.slice(0, lastSpace) : trimmed.slice(0, room);
-  return `${cut.replace(/[\s,;:.\-–—]+$/u, "")}\u2026`;
+  return `${stripTrailingChars(cut, TRAILING_PUNCTUATION)}\u2026`;
 }
-var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE;
+var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE, TRAILING_PUNCTUATION;
 var init_canvas_support = __esm({
   "../shared/dist/canvas-support.js"() {
     "use strict";
+    init_trailing_slashes();
     CANVAS_UNSUPPORTED_CODE = "canvas_unsupported";
     CANVAS_UNSUPPORTED_TITLE = "Games and canvas apps aren't supported yet";
     CANVAS_UNSUPPORTED_BODY = "This app draws its screen on a canvas (like a game), so there are no page elements for Validate.QA to read and test. Support for games and canvas apps is coming.";
@@ -12669,6 +13368,7 @@ var init_canvas_support = __esm({
     TOUCH_NONE_RE = /touch-action\s{0,8}:\s{0,8}none/;
     CODE_TAGS = /* @__PURE__ */ new Set(["script", "link", "flt-glass-pane", "flutter-view", "flt-scene-host"]);
     STATIC_STANDARD_MIN_INTERACTIVE = 3;
+    TRAILING_PUNCTUATION = /[\s,;:.\-–—]/u;
   }
 });
 
@@ -12851,22 +13551,22 @@ function joinChainedLines(code) {
     const trimmed = lines[i].trimStart();
     if (last !== -1 && trimmed.startsWith(".") && !trimmed.startsWith("...")) {
       if (!lastStripped) {
-        lines[last] = stripLineComment2(lines[last]).trimEnd();
+        lines[last] = stripLineComment3(lines[last]).trimEnd();
         lastStripped = true;
       }
       if (lines[last].length <= MAX_LINE_CHARS)
-        lines[last] = `${lines[last]} ${stripLineComment2(trimmed).trimEnd()}`;
+        lines[last] = `${lines[last]} ${stripLineComment3(trimmed).trimEnd()}`;
       lines[i] = "";
       continue;
     }
-    if (stripLineComment2(lines[i]).trim()) {
+    if (stripLineComment3(lines[i]).trim()) {
       last = i;
       lastStripped = false;
     }
   }
   return lines.join("\n");
 }
-function stripLineComment2(rawLine) {
+function stripLineComment3(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -12915,7 +13615,7 @@ function analyzeReadinessPolling(rawCode) {
     offset += rawLine.length + 1;
     if (rawLine.length > MAX_LINE_CHARS)
       continue;
-    const line = stripLineComment2(rawLine);
+    const line = stripLineComment3(rawLine);
     if (!line.trim())
       continue;
     const literals = literalsOf(line);
@@ -13027,7 +13727,7 @@ function blankBlockComments2(code) {
     from = close + 2;
   }
 }
-function stripLineComment3(rawLine) {
+function stripLineComment4(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -13038,7 +13738,7 @@ function logicalLines(code) {
   for (const raw of code.split("\n")) {
     if (raw.length > MAX_LINE_CHARS2)
       continue;
-    const line = stripLineComment3(raw).trimEnd();
+    const line = stripLineComment4(raw).trimEnd();
     if (!line.trim())
       continue;
     const trimmed = line.trimStart();
@@ -13400,8 +14100,19 @@ function short4(text, max) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
 }
+function stripFractionZeros(s) {
+  let end = s.length;
+  while (end > 0 && s[end - 1] === "0")
+    end--;
+  if (end === s.length)
+    return s;
+  const dot = s.lastIndexOf(".");
+  if (dot < 0)
+    return s;
+  return s.slice(0, end === dot + 1 ? dot : end);
+}
 function digitsOf(token) {
-  return token.replace(/[^\d.]/g, "").replace(/\.0+$|(\.\d*?)0+$/, "$1").replace(/^0+(?=\d)/, "");
+  return stripFractionZeros(token.replace(/[^\d.]/g, "")).replace(/^0+(?=\d)/, "");
 }
 function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
@@ -13619,7 +14330,7 @@ function findExpectCalls(code) {
     if (!subj)
       continue;
     const rest = code.slice(subj.end + 1, subj.end + 1 + 80);
-    const mm = /^\s*((?:\.\s*not)?\s*\.\s*(\w+))\s{0,20}\(/.exec(rest);
+    const mm = /^\s*((?:\.\s*not\s*)?\.\s*(\w+))\s{0,20}\(/.exec(rest);
     if (!mm)
       continue;
     const argStart = subj.end + 1 + mm[0].length;
@@ -15569,6 +16280,28 @@ function startsWithRegexLiteral(text) {
   const t = text.trimStart();
   return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
 }
+function isBareRegexLiteral(text) {
+  const t = text.trimStart();
+  if (t[0] !== "/" || t[1] === "/" || t[1] === "*")
+    return false;
+  const end = regexLiteralEnd4(t, 0);
+  if (end === -1)
+    return false;
+  let i = end;
+  while (i < t.length && /[a-z]/.test(t[i]))
+    i++;
+  while (i < t.length && /\s/.test(t[i]))
+    i++;
+  return i >= t.length || t[i] === ",";
+}
+function regexDeclaredNames(code) {
+  const names = /* @__PURE__ */ new Set();
+  const decl = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,80})\s{0,20}=\s{0,20}(?:\/(?![/*])|new\s{1,20}RegExp\b)/g;
+  let m;
+  while ((m = decl.exec(code)) !== null)
+    names.add(m[1]);
+  return names;
+}
 function afterFirstArg(args) {
   let depth = 0;
   let quote = null;
@@ -15606,6 +16339,7 @@ function analyzeRegexMatchers(rawCode) {
   let examined = 0;
   let line = 1;
   let lineAt2 = 0;
+  let regexNames;
   while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
     const subj = readBalanced(code, m.index + m[0].length);
     if (!subj)
@@ -15617,10 +16351,18 @@ function analyzeRegexMatchers(rawCode) {
     if (!args)
       continue;
     const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
-    if (!startsWithRegexLiteral(expected))
-      continue;
-    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain" && (startsWithRegexLiteral(subj.text) || /^new\s+RegExp\b/.test(subj.text.trim())))
+    if (!isBareRegexLiteral(expected))
       continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain") {
+      const subject = subj.text.trim();
+      if (startsWithRegexLiteral(subject) || /^new\s+RegExp\b/.test(subject))
+        continue;
+      if (/^[A-Za-z_$][\w$]{0,80}$/.test(subject)) {
+        regexNames ??= regexDeclaredNames(code);
+        if (regexNames.has(subject))
+          continue;
+      }
+    }
     for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
       line++;
       lineAt2 = i + 1;
@@ -15630,9 +16372,12 @@ function analyzeRegexMatchers(rawCode) {
   return out;
 }
 function formatRegexMatcherNote(findings) {
-  const lines = findings.map((f) => `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? "always passes (a regex never equals the value), so it checks nothing" : "can never pass: this matcher compares by equality and a regex never equals a value"}.`);
+  const lines = findings.map((f) => {
+    const negated = f.matcher === "toContain" ? "throws on a string and otherwise always passes (a regex never equals an item), so it checks nothing" : "always passes (a regex never equals the value), so it checks nothing";
+    return `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? negated : "can never pass: this matcher compares by equality and a regex never equals a value"}.`;
+  });
   return `${lines.join("\n")}
-A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For a DOM property read it first: expect(await loc.evaluate((n) => n.<prop>)).toMatch(/re/). Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For the \`value\` of an input, textarea or select, use await expect(loc).toHaveValue(/re/). For any other DOM property (or element), poll it so the check still retries: await expect.poll(() => loc.evaluate((n) => n.<prop>)).toMatch(/re/). Never read it once with expect(await loc.evaluate(\u2026)), which sees the value before the page updates it. Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
 }
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
@@ -16381,19 +17126,6 @@ var init_fence_runs = __esm({
   }
 });
 
-// ../shared/dist/trailing-slashes.js
-function stripTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value.charCodeAt(end - 1) === 47)
-    end--;
-  return end === value.length ? value : value.slice(0, end);
-}
-var init_trailing_slashes = __esm({
-  "../shared/dist/trailing-slashes.js"() {
-    "use strict";
-  }
-});
-
 // ../shared/dist/survey-bug-signature.js
 function normalizeWords(text) {
   return text.toLowerCase().replace(UUID, " id ").replace(PREFIXED_ID, " id ").replace(HEX_RUN, (run) => /\d/.test(run) ? " id " : run).replace(NUMBER_RUN, " # ").replace(/[^\p{L}\p{N}#]+/gu, " ").replace(/\s+/g, " ").trim();
@@ -16417,14 +17149,17 @@ function requestSignatures(text) {
   const statuses = [...text.matchAll(HTTP_STATUS)].map((m) => ({ status: m[1], at: m.index ?? 0, end: (m.index ?? 0) + m[0].length }));
   if (statuses.length === 0)
     return [];
-  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => ({
-    method: m[1] ?? null,
-    path: normalizeBugPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "")),
-    // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
-    incidental: isIncidentalAssetPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "").split(/[?#]/, 1)[0].toLowerCase()),
-    at: m.index ?? 0,
-    end: (m.index ?? 0) + m[0].length
-  })).filter((p) => p.path.length > 1);
+  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => {
+    const rawPath = stripTrailingChars(m[2] ?? m[3] ?? "", PATH_TRAILING_PUNCTUATION);
+    return {
+      method: m[1] ?? null,
+      path: normalizeBugPath(rawPath),
+      // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
+      incidental: isIncidentalAssetPath(rawPath.split(/[?#]/, 1)[0].toLowerCase()),
+      at: m.index ?? 0,
+      end: (m.index ?? 0) + m[0].length
+    };
+  }).filter((p) => p.path.length > 1);
   const out = /* @__PURE__ */ new Map();
   for (const { status, at, end } of statuses) {
     const lead = STATUS_TO_PATH.exec(text.slice(end, end + 40));
@@ -16534,11 +17269,12 @@ function dedupeSiteWideSuspectedBugs(drafts) {
       delete plans.suspectedBugs;
   }
 }
-var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
+var PATH_TRAILING_PUNCTUATION, SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
     init_trailing_slashes();
+    PATH_TRAILING_PUNCTUATION = /[.,;:]/;
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -17869,7 +18605,7 @@ function pathIdsIn(text) {
 function findCounterIdPins(code) {
   if (code.length > CLOCK_MAX_CODE_CHARS)
     return [];
-  const clean2 = stripLineComments(blankBlockComments3(code));
+  const clean3 = stripLineComments(blankBlockComments3(code));
   const fillValues = [];
   const candidates = [];
   let seenWrite = false;
@@ -17877,24 +18613,24 @@ function findCounterIdPins(code) {
   CALL_RE.lastIndex = 0;
   let m;
   let calls = 0;
-  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean2)) !== null) {
+  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean3)) !== null) {
     const name = m[1];
     const open = m.index + m[0].length - 1;
     if (VALUE_WRITES.has(name)) {
       seenWrite = true;
-      const args2 = argsAt(clean2, open);
+      const args2 = argsAt(clean3, open);
       if (args2 !== null)
         fillValues.push(...staticStrings(args2));
       continue;
     }
     if (createIndex === -1) {
-      if (name === "click" && seenWrite && isCreateClick(clean2, m.index))
+      if (name === "click" && seenWrite && isCreateClick(clean3, m.index))
         createIndex = m.index;
       continue;
     }
     if (name === "click")
       continue;
-    const args = argsAt(clean2, open);
+    const args = argsAt(clean3, open);
     if (args === null)
       continue;
     const isUrl = URL_SINKS.has(name);
@@ -17913,7 +18649,7 @@ function findCounterIdPins(code) {
   }
   if (createIndex === -1)
     return [];
-  const before = clean2.slice(0, createIndex);
+  const before = clean3.slice(0, createIndex);
   let pathIdsBefore = null;
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -17937,7 +18673,7 @@ function findCounterIdPins(code) {
           continue;
       }
     }
-    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean2, c.index) });
+    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean3, c.index) });
   }
   return findings;
 }
@@ -18232,7 +18968,7 @@ var init_suspicious_expectation = __esm({
     NOT_STUCK_RE = /\b(?:not|never|no longer|isn't|doesn't|don't|without)\s+(?:\w+\s+){0,2}?(?:stuck|hang|hangs|hung|freeze|freezes|frozen|spin|spins|spinning)\b/i;
     LISTS_STUCK_RE = /\b(?:appears? in (?:the )?[\w ]{0,25}(?:report|list|dashboard|queue)|(?:lists?|monitors?|shows?|reports?) (?:\w+ ){0,2}(?:that|which|whose) (?:are |is )?(?:stuck|hangs?|hung|frozen)|can (?:retry|re-?run) (?:\w+ ){0,2}(?:that (?:are )?)?stuck)\b/i;
     STUCK_VETO_RE = new RegExp(`${NOT_STUCK_RE.source}|${LISTS_STUCK_RE.source}`, "i");
-    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:fail(?:s|ing|ed)?|ignor\w*)?\s*silent(?:ly)?\b/i;
+    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:(?:fail(?:s|ing|ed)?|ignor\w*)\s*)?silent(?:ly)?\b/i;
     PENDING_WORD = "(?:sending|loading|saving|searching|checking(?!\\s+(?:account|balance|out|in)\\b)|syncing|refreshing|fetching|validating|processing|submitting|uploading|posting|publishing|creating|updating|deleting|connecting|verifying|signing in|logging in)";
     ELLIPSIS = "(?:\\.{3}|\u2026)";
     NOT_STAY_RE = /\b(?:not|never|no longer|without|n't|cannot)\s+(?:\w+\s+){0,2}?(?:stay|stays|stayed|remain|remains|remained|leave|leaves|left)\b/i;
@@ -18388,7 +19124,7 @@ function outcomeNamedByAssertion(outcome, code) {
 function namedByStatements(outcome, statements) {
   const text = outcomeText(outcome);
   if (outcome.type === "url") {
-    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => r.replace(/[.,;:!?)]+$/, "")).filter((r) => r.length > 1);
+    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => stripTrailingChars(r, ROUTE_TRAILING_PUNCTUATION)).filter((r) => r.length > 1);
     return statements.some((stmt) => {
       if (!/\.(?:waitForURL|toHaveURL)\s{0,20}\(/.test(stmt))
         return false;
@@ -18560,7 +19296,7 @@ function evaluatePromotionGate(input, checks = PROMOTION_QUALITY_CHECKS) {
     ...suspiciousTagged ? { suspiciousPass: { mode: suspicious, covered: suspiciousCovered, wouldHold: suspiciousHold } } : {}
   };
 }
-var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
+var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
 var init_promotion_quality_gate = __esm({
   "../shared/dist/promotion-quality-gate.js"() {
     "use strict";
@@ -18575,11 +19311,12 @@ var init_promotion_quality_gate = __esm({
     init_run_classification();
     init_expected_outcome_coverage();
     init_expect_call();
+    init_trailing_slashes();
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, tags, strengthGate, flagContradictedAdditions }) {
-        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
+      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof }) {
+        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
         const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
@@ -18597,7 +19334,7 @@ var init_promotion_quality_gate = __esm({
     MAX_STATEMENTS = 500;
     MAX_STATEMENT_CHARS = 400;
     LITERAL_OR_IDENTIFIER = /'(?:[^'\\\n]|\\.){0,500}'|"(?:[^"\\\n]|\\.){0,500}"|`(?:[^`\\]|\\.){0,2000}`|(?<![\w$.])[A-Za-z_$][\w$]{0,60}/g;
-    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
+    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
     FEEDBACK_REGION = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/i;
     ONE_SHOT_MESSAGE_REASON = "one-shot success/error banner text";
     FEEDBACK_REGION_ALL = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/gi;
@@ -18656,6 +19393,7 @@ var init_promotion_quality_gate = __esm({
       "element-hidden": /\.(?:toBeHidden|not\s{0,20}\.\s{0,20}toBeVisible|not\s{0,20}\.\s{0,20}toBeAttached|not\s{0,20}\.\s{0,20}toContainText)\s{0,20}\(|\.toHaveCount\s{0,20}\(\s{0,20}0\s{0,20}\)/
     };
     ROUTE_TERM = /\/[A-Za-z0-9_./?&=#-]{1,200}/g;
+    ROUTE_TRAILING_PUNCTUATION = /[.,;:!?)]/;
     QUOTED_LITERAL = /'([^'\\\n]{3,200})'|"([^"\\\n]{3,200})"|`([^`\\$\n]{3,200})`/g;
     GENERIC_LITERAL = /^(?:true|false|button|link|heading|dialog|alertdialog|article|main|region|status|alert|textbox|combobox|checkbox|radio|tab|tabpanel|option|list|listitem|row|cell|img|navigation|banner|complementary|contentinfo|form|search|menu|menuitem|visible|hidden|attached|detached|domcontentloaded|load|networkidle)$/i;
     MAX_OUTCOME_STATEMENTS = 300;
@@ -18775,8 +19513,8 @@ ${goalText}`);
         return count3 > 0 ? [{ check: "locator-fragment", detail: String(count3), soft: true }] : [];
       }
     };
-    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|press)\s*\(/i;
-    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s*\(/;
+    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|setChecked|press)\s*\(/i;
+    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s*\(/;
     REDUCTION_PROOF = /\.toHaveCount\s*\(|\.not\s*\.\s*(?:toBeVisible|toBeAttached|toContainText|toHaveText)\s*\(|\.toBeHidden\s*\(|\bShowing\b|\bof \d+\b|\b\d+ (?:results?|rows?|items?|candidates?|entries|matches|records)\b|\bNo (?:[\w'-]+ ){0,3}(?:match|matches|results?|found|left|remain|yet)\b|\bNothing (?:to show|found|matches)\b|\bis empty\b|\btoHaveURL\b/i;
     MAX_FILTER_LINES = 2e3;
     MAX_FILTER_LINE_CHARS = 600;
@@ -18891,7 +19629,7 @@ ${goalText}`);
 });
 
 // ../shared/dist/regex-alternation.js
-function closingParens(source) {
+function closingParens2(source) {
   const close = new Int32Array(source.length).fill(-1);
   const open = [];
   let inClass = false;
@@ -18916,7 +19654,7 @@ function closingParens(source) {
   return close;
 }
 function alternatesAtTop(source) {
-  const close = closingParens(source);
+  const close = closingParens2(source);
   let start = source.startsWith("^") ? 1 : 0;
   let end = source.endsWith("$") ? source.length - 1 : source.length;
   while (start < end && source[start] === "(" && close[start] === end - 1) {
@@ -18965,6 +19703,124 @@ var init_page_evidence = __esm({
   }
 });
 
+// ../shared/dist/stated-limits.js
+function validDate(v) {
+  const [y, m, d] = v.split("-").map(Number);
+  const t = new Date(Date.UTC(y, m - 1, d));
+  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;
+}
+function isoFor(type, v) {
+  const re = DATE_RE[type];
+  if (!re || !re.test(v))
+    return false;
+  if (type === "date")
+    return validDate(v);
+  if (type === "datetime-local")
+    return validDate(v.slice(0, 10)) && Number(v.slice(11, 13)) < 24 && Number(v.slice(14, 16)) < 60;
+  if (type === "time")
+    return Number(v.slice(0, 2)) < 24 && Number(v.slice(3, 5)) < 60;
+  if (type === "month")
+    return Number(v.slice(5, 7)) >= 1 && Number(v.slice(5, 7)) <= 12;
+  return Number(v.slice(6, 8)) >= 1 && Number(v.slice(6, 8)) <= 53;
+}
+function clean2(raw) {
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function statedLimitsFromAttrs(attrs, inputType) {
+  const type = (inputType ?? "").trim().toLowerCase();
+  const limits = [];
+  const add = (k, v) => {
+    limits.push({ k, v });
+  };
+  if (NUMBER_TYPES.has(type)) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (NUMBER_RE.test(v))
+        add(k, v);
+    }
+    const step = clean2(attrs.step);
+    if (NUMBER_RE.test(step) && Number(step) > 0)
+      add("step", step);
+  } else if (type in DATE_RE) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (isoFor(type, v))
+        add(k, v);
+    }
+  } else if (TEXT_TYPES.has(type)) {
+    for (const [attr, k] of [["minlength", "minLength"], ["maxlength", "maxLength"]]) {
+      const v = clean2(attrs[attr]);
+      if (LENGTH_RE.test(v))
+        add(k, String(Number(v)));
+    }
+    const pattern = cleanPattern(clean2(attrs.pattern).slice(0, STATED_PATTERN_MAX));
+    if (pattern)
+      add("pattern", pattern);
+  }
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+function cleanPattern(text) {
+  return text.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "");
+}
+function readStatedLimits(stored) {
+  if (!stored || typeof stored !== "object" || Array.isArray(stored))
+    return [];
+  const rec = stored;
+  if (rec.v !== STATED_LIMITS_VERSION || !Array.isArray(rec.limits))
+    return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of rec.limits.slice(0, MAX_LIMITS * 2)) {
+    if (!item || typeof item !== "object")
+      continue;
+    const { k, v } = item;
+    if (typeof k !== "string" || typeof v !== "string" || !KINDS.includes(k) || seen.has(k))
+      continue;
+    if (v.length === 0 || v.length > STATED_PATTERN_MAX)
+      continue;
+    const text = k === "pattern" ? cleanPattern(v) : v;
+    if (text === "")
+      continue;
+    if (k === "minLength" || k === "maxLength") {
+      if (!LENGTH_RE.test(v))
+        continue;
+    } else if (k === "step") {
+      if (!NUMBER_RE.test(v))
+        continue;
+    } else if (k === "min" || k === "max") {
+      if (!NUMBER_RE.test(v) && !Object.values(DATE_RE).some((re) => re.test(v)))
+        continue;
+    }
+    seen.add(k);
+    out.push({ k, v: text });
+  }
+  return out;
+}
+function statedLimitsRecord(limits) {
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+var STATED_LIMITS_VERSION, STATED_PATTERN_MAX, KINDS, MAX_LIMITS, TEXT_TYPES, NUMBER_TYPES, DATE_RE, NUMBER_RE, LENGTH_RE;
+var init_stated_limits = __esm({
+  "../shared/dist/stated-limits.js"() {
+    "use strict";
+    STATED_LIMITS_VERSION = 1;
+    STATED_PATTERN_MAX = 200;
+    KINDS = ["min", "max", "minLength", "maxLength", "step", "pattern"];
+    MAX_LIMITS = KINDS.length;
+    TEXT_TYPES = /* @__PURE__ */ new Set(["text", "search", "email", "url", "tel", "password", "textarea", ""]);
+    NUMBER_TYPES = /* @__PURE__ */ new Set(["number", "range"]);
+    DATE_RE = {
+      date: /^\d{4}-\d{2}-\d{2}$/,
+      "datetime-local": /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?$/,
+      time: /^\d{2}:\d{2}(?::\d{2})?$/,
+      month: /^\d{4}-\d{2}$/,
+      week: /^\d{4}-W\d{2}$/
+    };
+    NUMBER_RE = /^-?\d{1,15}(?:\.\d{1,10})?$/;
+    LENGTH_RE = /^\d{1,7}$/;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -18972,9 +19828,11 @@ __export(dist_exports, {
   ACTION_BATCH_MAX_SIZE: () => ACTION_BATCH_MAX_SIZE,
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
+  ADMIN_FORCE_CANCELLED_RUN_ERROR: () => ADMIN_FORCE_CANCELLED_RUN_ERROR,
   ADMIN_VIEW_DEFAULT_RETURN_TO: () => ADMIN_VIEW_DEFAULT_RETURN_TO,
   AGENT_AI_PROVIDER_PREFIXES: () => AGENT_AI_PROVIDER_PREFIXES,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  ALLOWED_PROVIDER_CHAIN_HOPS: () => ALLOWED_PROVIDER_CHAIN_HOPS,
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_MODEL_CATALOG: () => API_MODEL_CATALOG,
   API_MODEL_FIELDS: () => API_MODEL_FIELDS,
@@ -19014,12 +19872,14 @@ __export(dist_exports, {
   BUG_TEST_BROKEN_REASON: () => BUG_TEST_BROKEN_REASON,
   BUG_TEST_BROKEN_TAG: () => BUG_TEST_BROKEN_TAG,
   CACHE_PRICE_PER_M: () => CACHE_PRICE_PER_M,
+  CANCELLED_REASON_PREFIXES: () => CANCELLED_REASON_PREFIXES,
   CANVAS_UNSUPPORTED_BODY: () => CANVAS_UNSUPPORTED_BODY,
   CANVAS_UNSUPPORTED_CODE: () => CANVAS_UNSUPPORTED_CODE,
   CANVAS_UNSUPPORTED_NOT_CHARGED: () => CANVAS_UNSUPPORTED_NOT_CHARGED,
   CANVAS_UNSUPPORTED_OVERRIDE_HINT: () => CANVAS_UNSUPPORTED_OVERRIDE_HINT,
   CANVAS_UNSUPPORTED_TITLE: () => CANVAS_UNSUPPORTED_TITLE,
   CAPTURE_JSON_STRUCTURE_LIMITS: () => CAPTURE_JSON_STRUCTURE_LIMITS,
+  CHAIN_CANCELLED_RUN_ERROR: () => CHAIN_CANCELLED_RUN_ERROR,
   CHAT_FAILOVER_KEY: () => CHAT_FAILOVER_KEY,
   CLAUDE_CLI_DEFAULT_EFFORT: () => CLAUDE_CLI_DEFAULT_EFFORT,
   CLAUDE_CLI_DEFAULT_MODEL: () => CLAUDE_CLI_DEFAULT_MODEL,
@@ -19056,6 +19916,7 @@ __export(dist_exports, {
   DEFAULT_GEMINI_SCREEN_MODEL: () => DEFAULT_GEMINI_SCREEN_MODEL,
   DEFAULT_JSON_STRUCTURE_LIMITS: () => DEFAULT_JSON_STRUCTURE_LIMITS,
   DEFAULT_PLATFORM_DB_POOL_SIZE: () => DEFAULT_PLATFORM_DB_POOL_SIZE,
+  DEFAULT_PROVIDER_ACCOUNT_ID: () => DEFAULT_PROVIDER_ACCOUNT_ID,
   DEFAULT_SHARED_DB_POOL_SIZE: () => DEFAULT_SHARED_DB_POOL_SIZE,
   DEFAULT_STT_MODEL: () => DEFAULT_STT_MODEL,
   DEFAULT_STT_MODEL_BY_PROVIDER: () => DEFAULT_STT_MODEL_BY_PROVIDER,
@@ -19072,6 +19933,7 @@ __export(dist_exports, {
   ENVIRONMENTAL_ERROR_STORED_PREFIXES: () => ENVIRONMENTAL_ERROR_STORED_PREFIXES,
   EVIDENCE_NOTE_PREFIXES: () => EVIDENCE_NOTE_PREFIXES,
   EXPECT_CALL_RE: () => EXPECT_CALL_RE,
+  FEATURE_ROW_RUN_WINDOW: () => FEATURE_ROW_RUN_WINDOW,
   FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
   FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
   FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
@@ -19139,6 +20001,8 @@ __export(dist_exports, {
   MAX_ORG_NAME_LENGTH: () => MAX_ORG_NAME_LENGTH,
   MAX_PASSWORD_BYTES: () => MAX_PASSWORD_BYTES,
   MAX_PLAYWRIGHT_CODE_LENGTH: () => MAX_PLAYWRIGHT_CODE_LENGTH,
+  MAX_PROVIDER_ACCOUNTS: () => MAX_PROVIDER_ACCOUNTS,
+  MAX_PROVIDER_ACCOUNT_MODELS: () => MAX_PROVIDER_ACCOUNT_MODELS,
   MAX_SURVEY_ENTRY_URLS: () => MAX_SURVEY_ENTRY_URLS,
   MAX_SURVEY_ENTRY_URL_LENGTH: () => MAX_SURVEY_ENTRY_URL_LENGTH,
   MCP_ARMY_LIMITS: () => MCP_ARMY_LIMITS,
@@ -19174,7 +20038,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
-  OPENCODE_GO_2_PREFIX: () => OPENCODE_GO_2_PREFIX,
+  OPENCODE_GO_DEEPSEEK_GLM_MODELS: () => OPENCODE_GO_DEEPSEEK_GLM_MODELS,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -19194,10 +20058,12 @@ __export(dist_exports, {
   PLAN_FEATURES: () => PLAN_FEATURES,
   PLAN_FEATURE_LOCKED_CODE: () => PLAN_FEATURE_LOCKED_CODE,
   PLAN_ORDER: () => PLAN_ORDER,
+  PLATFORM_ADMIN_CANCELLED_RUN_ERROR: () => PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
   PLATFORM_DEFAULT_PROVIDER: () => PLATFORM_DEFAULT_PROVIDER,
   PLATFORM_PLAN_BILLING: () => PLATFORM_PLAN_BILLING,
   PLATFORM_SERVER_APPLICATION_NAME: () => PLATFORM_SERVER_APPLICATION_NAME,
+  PLATFORM_SUPPORT_CANCELLED_RUN_ERROR: () => PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
   POST_SPECIAL_TRIAL_DAYS: () => POST_SPECIAL_TRIAL_DAYS,
   PRESET_DIRECT_FALLBACK: () => PRESET_DIRECT_FALLBACK,
   PRODUCTION_READ_ONLY_GUARD_TEMPLATE: () => PRODUCTION_READ_ONLY_GUARD_TEMPLATE,
@@ -19209,8 +20075,12 @@ __export(dist_exports, {
   PROJECT_OVERRIDE_FIELDS: () => PROJECT_OVERRIDE_FIELDS,
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
+  PROVIDER_ACCOUNT_ID_PATTERN: () => PROVIDER_ACCOUNT_ID_PATTERN,
+  PROVIDER_ACCOUNT_MODEL_PATTERN: () => PROVIDER_ACCOUNT_MODEL_PATTERN,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAINS_SETTING_MAX_CHARS: () => PROVIDER_CHAINS_SETTING_MAX_CHARS,
   PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_CHAIN_MAX_ENTRIES: () => PROVIDER_CHAIN_MAX_ENTRIES,
   PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
@@ -19218,10 +20088,12 @@ __export(dist_exports, {
   READ_ONLY_TAGS: () => READ_ONLY_TAGS,
   RECHECKED_NOTES: () => RECHECKED_NOTES,
   RECORDING_VALUE_PLACEHOLDERS: () => RECORDING_VALUE_PLACEHOLDERS,
+  RENDER_IDENTITY_MAX_LENGTH: () => RENDER_IDENTITY_MAX_LENGTH,
   REPOSITORY_CLIS: () => REPOSITORY_CLIS,
   RESERVED_PROJECT_KEYS: () => RESERVED_PROJECT_KEYS,
   RESULT_STRUCTURE_TOO_COSTLY_CODE: () => RESULT_STRUCTURE_TOO_COSTLY_CODE,
   RETRIED_ATTEMPTS_KEY: () => RETRIED_ATTEMPTS_KEY,
+  RETRY_HELD_RUN_ERROR: () => RETRY_HELD_RUN_ERROR,
   RUNNER_INTERRUPT_ERROR_PREFIX: () => RUNNER_INTERRUPT_ERROR_PREFIX,
   RUN_INTERRUPTED_ERROR_PREFIXES: () => RUN_INTERRUPTED_ERROR_PREFIXES,
   RUN_INTERRUPTION_NOT_RETRIED_MARKERS: () => RUN_INTERRUPTION_NOT_RETRIED_MARKERS,
@@ -19234,6 +20106,8 @@ __export(dist_exports, {
   SHARED_SERVER_APPLICATION_NAME: () => SHARED_SERVER_APPLICATION_NAME,
   SPEND_SOURCE_KEY: () => SPEND_SOURCE_KEY,
   SPEND_SOURCE_SERVER: () => SPEND_SOURCE_SERVER,
+  STATED_LIMITS_VERSION: () => STATED_LIMITS_VERSION,
+  STATED_PATTERN_MAX: () => STATED_PATTERN_MAX,
   STATIC_STANDARD_MIN_INTERACTIVE: () => STATIC_STANDARD_MIN_INTERACTIVE,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   SUCCESS_NOTICE_TEXT: () => SUCCESS_NOTICE_TEXT,
@@ -19263,14 +20137,20 @@ __export(dist_exports, {
   UI_VARIANTS: () => UI_VARIANTS,
   UNEXPECTED_PASS_ERROR_PREFIX: () => UNEXPECTED_PASS_ERROR_PREFIX,
   USER_CANCELLED_RUN_ERROR: () => USER_CANCELLED_RUN_ERROR,
+  VISUAL_MASK_SELECTORS_MAX: () => VISUAL_MASK_SELECTORS_MAX,
+  VISUAL_MASK_SELECTOR_FORBIDDEN: () => VISUAL_MASK_SELECTOR_FORBIDDEN,
+  VISUAL_MASK_SELECTOR_MAX_LENGTH: () => VISUAL_MASK_SELECTOR_MAX_LENGTH,
+  VISUAL_V1_IDENTITY: () => VISUAL_V1_IDENTITY,
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
   ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
   ZAI_PREFIX: () => ZAI_PREFIX,
+  accountServesModel: () => accountServesModel,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
+  allowedProviderChainHosts: () => allowedProviderChainHosts,
   alternatesAtTop: () => alternatesAtTop,
   analyzeDerivedValues: () => analyzeDerivedValues,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
@@ -19283,6 +20163,7 @@ __export(dist_exports, {
   analyzeUnreachedUrlWaits: () => analyzeUnreachedUrlWaits,
   analyzeUrlWaits: () => analyzeUrlWaits,
   analyzeWriteResponse: () => analyzeWriteResponse,
+  androidResourceOwners: () => androidResourceOwners,
   apiModelCardsFromConfig: () => apiModelCardsFromConfig,
   apiModelsForProvider: () => apiModelsForProvider,
   apiProviderModelLabel: () => apiProviderModelLabel,
@@ -19293,6 +20174,7 @@ __export(dist_exports, {
   applyLaunchSpecialPlan: () => applyLaunchSpecialPlan,
   asPlainExpect: () => asPlainExpect,
   assertionOnlyCode: () => assertionOnlyCode,
+  assertionStrengthHoistedReadsOn: () => assertionStrengthHoistedReadsOn,
   assertionsReadVisibleContent: () => assertionsReadVisibleContent,
   assessCodeOutcomeCoverage: () => assessCodeOutcomeCoverage,
   assessTitleCoverage: () => assessTitleCoverage,
@@ -19376,6 +20258,7 @@ __export(dist_exports, {
   deepgramSpeak: () => deepgramSpeak,
   deepgramTranscribe: () => deepgramTranscribe,
   defaultConfirmModel: () => defaultConfirmModel,
+  defaultProviderChainEntries: () => defaultProviderChainEntries,
   defaultScreenModel: () => defaultScreenModel,
   defaultVoiceForTtsModel: () => defaultVoiceForTtsModel,
   deriveAuthPlan: () => deriveAuthPlan,
@@ -19418,6 +20301,7 @@ __export(dist_exports, {
   extractOutcomeSearchTerms: () => extractOutcomeSearchTerms,
   featureForAiCallType: () => featureForAiCallType,
   featureForMcpTool: () => featureForMcpTool,
+  featureRowRunStatus: () => featureRowRunStatus,
   findBracedClause: () => findBracedClause,
   findCounterIdPins: () => findCounterIdPins,
   findCredentialTextLeftover: () => findCredentialTextLeftover,
@@ -19466,6 +20350,7 @@ __export(dist_exports, {
   getPlanChangeType: () => getPlanChangeType,
   getPlanDefinition: () => getPlanDefinition,
   getPlanLabel: () => getPlanLabel,
+  getProviderChainOverrides: () => getProviderChainOverrides,
   getTrialDaysRemaining: () => getTrialDaysRemaining,
   googleBrokerNavigationUrl: () => googleBrokerNavigationUrl,
   googleBrokerUnavailableLine: () => googleBrokerUnavailableLine,
@@ -19479,10 +20364,10 @@ __export(dist_exports, {
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
   hasOnlyConstantAssertions: () => hasOnlyConstantAssertions,
-  hasOpenCodeGo2Prefix: () => hasOpenCodeGo2Prefix,
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
+  hasProviderChainLeadsByDefault: () => hasProviderChainLeadsByDefault,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
@@ -19508,8 +20393,11 @@ __export(dist_exports, {
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isBrowserCliEngine: () => isBrowserCliEngine,
+  isBrowserVersion: () => isBrowserVersion,
   isBugTestBrokenError: () => isBugTestBrokenError,
+  isCancelledReason: () => isCancelledReason,
   isCanvasUnsupportedMessage: () => isCanvasUnsupportedMessage,
+  isChainablePrimary: () => isChainablePrimary,
   isCliEngineModelId: () => isCliEngineModelId,
   isCliEngineSpec: () => isCliEngineSpec,
   isCodeFactNote: () => isCodeFactNote,
@@ -19533,6 +20421,7 @@ __export(dist_exports, {
   isIdentityMobileXpath: () => isIdentityMobileXpath,
   isIdentityProviderSurface: () => isIdentityProviderSurface,
   isIncidentalAssetPath: () => isIncidentalAssetPath,
+  isIntentionalNegativeAuthTest: () => isIntentionalNegativeAuthTest,
   isIpOrLocalhost: () => isIpOrLocalhost,
   isKnownPageType: () => isKnownPageType,
   isLaunchSpecialActive: () => isLaunchSpecialActive,
@@ -19560,6 +20449,7 @@ __export(dist_exports, {
   isRunInterruptedError: () => isRunInterruptedError,
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
+  isSafeMaskSelector: () => isSafeMaskSelector,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
   isSelectableApiModel: () => isSelectableApiModel,
   isSelfServePlan: () => isSelfServePlan,
@@ -19623,6 +20513,7 @@ __export(dist_exports, {
   normalizeFinishReason: () => normalizeFinishReason,
   normalizeNoteText: () => normalizeNoteText,
   normalizePageType: () => normalizePageType,
+  normalizeProviderAccountModels: () => normalizeProviderAccountModels,
   normalizeTtsModel: () => normalizeTtsModel,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   noteChatFailover: () => noteChatFailover,
@@ -19647,13 +20538,18 @@ __export(dist_exports, {
   parseGeminiModelsPayload: () => parseGeminiModelsPayload,
   parseGoogleAuthorizeUrl: () => parseGoogleAuthorizeUrl,
   parseGoogleGisRequestUrl: () => parseGoogleGisRequestUrl,
+  parseLastActionProofMode: () => parseLastActionProofMode,
   parseLimitParam: () => parseLimitParam,
   parseOffsetParam: () => parseOffsetParam,
   parsePageParam: () => parsePageParam,
   parsePgIntSetting: () => parsePgIntSetting,
   parseProjectEngineOverrides: () => parseProjectEngineOverrides,
   parsePromotionGateMode: () => parsePromotionGateMode,
+  parseProviderAccountLists: () => parseProviderAccountLists,
+  parseProviderChainOverrides: () => parseProviderChainOverrides,
   parseRecheckClearMode: () => parseRecheckClearMode,
+  parseRenderIdentity: () => parseRenderIdentity,
+  parseStoredProviderChainOverrides: () => parseStoredProviderChainOverrides,
   parseSurveyEntryUrls: () => parseSurveyEntryUrls,
   parseSuspiciousPassMode: () => parseSuspiciousPassMode,
   parseTaskModelUpdate: () => parseTaskModelUpdate,
@@ -19684,7 +20580,9 @@ __export(dist_exports, {
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
   providerChainHostOf: () => providerChainHostOf,
+  providerChainHostProvider: () => providerChainHostProvider,
   providerChainLeadsFor: () => providerChainLeadsFor,
+  providerChainModelKey: () => providerChainModelKey,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
   providerHostPlan: () => providerHostPlan,
   readBalanced: () => readBalanced,
@@ -19694,6 +20592,7 @@ __export(dist_exports, {
   readEnabledEngines: () => readEnabledEngines,
   readProjectEngineOverrides: () => readProjectEngineOverrides,
   readRetriedAttempts: () => readRetriedAttempts,
+  readStatedLimits: () => readStatedLimits,
   readStaticPageCanvasSignals: () => readStaticPageCanvasSignals,
   readSurveyEntryUrls: () => readSurveyEntryUrls,
   readSurveyNotes: () => readSurveyNotes,
@@ -19706,6 +20605,7 @@ __export(dist_exports, {
   regexLiteralEnd: () => regexLiteralEnd2,
   regexOpensAfter: () => regexOpensAfter,
   registrableDomain: () => registrableDomain,
+  renderIdentity: () => renderIdentity,
   renderSurveyNotesForPrompt: () => renderSurveyNotesForPrompt,
   repairPageType: () => repairPageType,
   replaceBlockComments: () => replaceBlockComments,
@@ -19753,11 +20653,14 @@ __export(dist_exports, {
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
   setAgenticCliRuntime: () => setAgenticCliRuntime,
+  setProviderChainOverrides: () => setProviderChainOverrides,
   signupPlanFor: () => signupPlanFor,
   simplifyMobileWanderingInPlace: () => simplifyMobileWanderingInPlace,
   siteOf: () => siteOf,
   specItemsFromTestPlans: () => specItemsFromTestPlans,
   splitAnswerLines: () => splitAnswerLines,
+  statedLimitsFromAttrs: () => statedLimitsFromAttrs,
+  statedLimitsRecord: () => statedLimitsRecord,
   stepAppliesToPlatform: () => stepAppliesToPlatform,
   stepConsoleLines: () => stepConsoleLines,
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
@@ -19769,7 +20672,10 @@ __export(dist_exports, {
   stripCodeFactPrefix: () => stripCodeFactPrefix,
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
+  stripFractionZeros: () => stripFractionZeros,
+  stripLineComment: () => stripLineComment,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingChars: () => stripTrailingChars,
   stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
@@ -19787,10 +20693,14 @@ __export(dist_exports, {
   ttsFallbackModel: () => ttsFallbackModel,
   ttsProviderForModel: () => ttsProviderForModel,
   unexpectedPassError: () => unexpectedPassError,
+  v1RenderIdentity: () => v1RenderIdentity,
   validateAppMapDocument: () => validateAppMapDocument,
   validateAssertionStrength: () => validateAssertionStrength,
   validateEngineSpec: () => validateEngineSpec,
+  validateProviderChainEntries: () => validateProviderChainEntries,
+  validateProviderChainsSetting: () => validateProviderChainsSetting,
   validateTaskModelId: () => validateTaskModelId,
+  visualBaselinesEnabled: () => visualBaselinesEnabled,
   visualProDailyBudget: () => visualProDailyBudget,
   voiceMatchesTtsModel: () => voiceMatchesTtsModel,
   voicesForTtsModel: () => voicesForTtsModel,
@@ -19853,11 +20763,14 @@ var init_dist = __esm({
     init_deepgram_voices();
     init_feature_flags();
     init_env_flags();
+    init_visual_compare_limits();
+    init_visual_baseline_identity();
     init_analytics_url();
     init_agentic_cli_runtime();
     init_api_model_catalog();
     init_engine_spec();
     init_provider_chains();
+    init_provider_accounts();
     init_project_engine_overrides();
     init_ai_profiles();
     init_openrouter_usage();
@@ -19899,6 +20812,7 @@ var init_dist = __esm({
     init_regex_alternation();
     init_page_evidence();
     init_trailing_slashes();
+    init_stated_limits();
   }
 });
 
@@ -19919,6 +20833,7 @@ var require_survey_network_guard = __commonJS({
     exports2.isTokenRefreshWrite = isTokenRefreshWrite;
     exports2.isSignInPathWrite = isSignInPathWrite;
     exports2.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
+    exports2.graphqlUrlQueriesAreReads = graphqlUrlQueriesAreReads;
     exports2.graphqlGetMayWrite = graphqlGetMayWrite;
     exports2.writeShapedGet = writeShapedGet;
     exports2.decideSurveyRequest = decideSurveyRequest;
@@ -20477,6 +21392,9 @@ var require_survey_network_guard = __commonJS({
     function graphqlUrlCarriesQuery(params) {
       return params.has("query");
     }
+    function graphqlUrlQueriesAreReads(params) {
+      return params.getAll("query").every((doc) => doc.trim() !== "" && graphqlDocumentIsQueryOnly(doc));
+    }
     function graphqlGetMayWrite(url, body) {
       const docs = url.searchParams.getAll("query");
       return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
@@ -20720,7 +21638,7 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: "extra-pattern", reason: extra.reason, record };
       if (graphqlGet)
         return { action: "block", rule: "app-write", record };
-      if (method === "POST" && isGraphqlEndpoint(url, s) && !graphqlUrlCarriesQuery(url.searchParams) && isGraphqlQueryOnly(req.postData))
+      if (method === "POST" && isGraphqlEndpoint(url, s) && graphqlUrlQueriesAreReads(url.searchParams) && isGraphqlQueryOnly(req.postData))
         return { action: "allow", rule: "graphql-query", record };
       const passive = s.lastNavigationAt > 0 && (s.lastActionAt === 0 || s.lastNavigationAt >= s.lastActionAt) && s.now - s.lastNavigationAt <= s.passiveWindowMs;
       const signature = learnableSignature(req, url, record, s);
@@ -21400,7 +22318,7 @@ var require_run_write_guard = __commonJS({
   "../runner-core/dist/services/run-write-guard.js"(exports2) {
     "use strict";
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.RUN_WRITE_RELAYED_LINE = exports2.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports2.WRITE_HELD_ERROR_PREFIX = exports2.RUN_WRITE_UNAVAILABLE_LINE = exports2.RUN_WRITE_SAW_LINE = exports2.RUN_WRITE_HELD_LINE = exports2.RUN_WRITE_GUARD_LINE_PREFIX = exports2.RUN_WRITE_SIGNIN_VARS_ENV = exports2.RUN_WRITE_POLICY_ENV = exports2.NO_KEEPALIVE_INIT_SCRIPT = exports2.RUN_WRITE_LEAVING_EVENT = exports2.RUN_WRITE_RELAY_KEY = exports2.RUN_WRITE_DROPPED_BINDING = exports2.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports2.WEBSOCKET_NOT_GUARDED = exports2.RunWriteGuard = exports2.BROKER_TOKEN_TTL_MS = exports2.MAX_RUN_WRITE_RECORDS = exports2.SHARED_SUFFIX_PATTERN_REASON = exports2.FIREBASE_AUTH_HANDLER_PATH = exports2.SIGN_IN_SECRET_VARIABLE = exports2.MAX_ALLOW_PATTERN_CHARS = exports2.MAX_ALLOW_PATTERNS = exports2.DEFAULT_RECORD_ONLY_RULES = exports2.RECORD_ONLY_CAPABLE_RULES = exports2.RUN_WRITE_POLICY_VERSION = void 0;
+    exports2.RUN_WRITE_RELAYED_LINE = exports2.WRITE_GUARD_UNAVAILABLE_ERROR_PREFIX = exports2.WRITE_HELD_ERROR_PREFIX = exports2.RUN_WRITE_UNAVAILABLE_LINE = exports2.RUN_WRITE_SAW_LINE = exports2.RUN_WRITE_HELD_LINE = exports2.RUN_WRITE_GUARD_LINE_PREFIX = exports2.RUN_WRITE_SIGNIN_VARS_ENV = exports2.RUN_WRITE_POLICY_ENV = exports2.NO_KEEPALIVE_INIT_SCRIPT = exports2.RUN_WRITE_LEAVING_EVENT = exports2.RUN_WRITE_RELAY_KEY = exports2.RUN_WRITE_DROPPED_BINDING = exports2.RUN_WRITE_BLOCK_CONTEXT_OPTIONS = exports2.WEBSOCKET_NOT_GUARDED = exports2.RunWriteGuard = exports2.BROKER_TOKEN_TTL_MS = exports2.MAX_RUN_WRITE_RECORDS = exports2.SHARED_SUFFIX_PATTERN_REASON = exports2.FIREBASE_AUTH_HANDLER_PATH = exports2.SIGN_IN_SECRET_VARIABLE = exports2.MAX_ALLOW_PATTERN_CHARS = exports2.MAX_ALLOW_PATTERNS = exports2.MAX_IDP_HOSTS = exports2.DEFAULT_RECORD_ONLY_RULES = exports2.RECORD_ONLY_CAPABLE_RULES = exports2.RUN_WRITE_POLICY_VERSION = void 0;
     exports2.parseRunWritePolicy = parseRunWritePolicy;
     exports2.signInSecretsOf = signInSecretsOf;
     exports2.withRunWritePolicyScope = withRunWritePolicyScope;
@@ -21409,6 +22327,8 @@ var require_run_write_guard = __commonJS({
     exports2.bodyHasSignInSecret = bodyHasSignInSecret;
     exports2.compileAllowPattern = compileAllowPattern;
     exports2.allowPatternProblem = allowPatternProblem;
+    exports2.normaliseIdpHost = normaliseIdpHost;
+    exports2.idpHostProblem = idpHostProblem;
     exports2.runWritePatternNotes = runWritePatternNotes;
     exports2.decideRunWrite = decideRunWrite;
     exports2.isGoogleBrokerToken = isGoogleBrokerToken;
@@ -21441,6 +22361,8 @@ var require_run_write_guard = __commonJS({
     exports2.RECORD_ONLY_CAPABLE_RULES = ["write-shaped-get"];
     exports2.DEFAULT_RECORD_ONLY_RULES = ["write-shaped-get"];
     var MAX_APP_SITES = 16;
+    exports2.MAX_IDP_HOSTS = 4;
+    var MAX_IDP_HINTS = 4;
     exports2.MAX_ALLOW_PATTERNS = 50;
     exports2.MAX_ALLOW_PATTERN_CHARS = 200;
     var MAX_REASON_CHARS = 300;
@@ -21468,6 +22390,11 @@ var require_run_write_guard = __commonJS({
         const e = x;
         return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports2.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
       }) : [];
+      const idpHosts = Array.isArray(v.idpHosts) ? [...new Set(v.idpHosts.filter((h) => typeof h === "string" && normaliseIdpHost(h) === h && idpHostProblem(h) === null))].slice(0, exports2.MAX_IDP_HOSTS) : [];
+      const ignoredIdpHosts = Array.isArray(v.ignoredIdpHosts) ? v.ignoredIdpHosts.slice(0, exports2.MAX_ALLOW_PATTERNS).flatMap((x) => {
+        const e = x;
+        return e && typeof e.pattern === "string" && typeof e.reason === "string" ? [{ pattern: e.pattern.slice(0, exports2.MAX_ALLOW_PATTERN_CHARS), reason: e.reason.slice(0, MAX_REASON_CHARS) }] : [];
+      }) : [];
       const recordOnlyRules = Array.isArray(v.recordOnlyRules) ? exports2.RECORD_ONLY_CAPABLE_RULES.filter((rule) => v.recordOnlyRules.includes(rule)) : [...exports2.DEFAULT_RECORD_ONLY_RULES];
       if (typeof v.reason !== "string")
         return null;
@@ -21480,6 +22407,9 @@ var require_run_write_guard = __commonJS({
         appSites: appSites.map((s) => s.toLowerCase()),
         allowPatterns,
         ignoredAllowPatterns,
+        // Only when set: a policy without them parses exactly as before.
+        ...idpHosts.length > 0 ? { idpHosts } : {},
+        ...ignoredIdpHosts.length > 0 ? { ignoredIdpHosts } : {},
         recordOnlyRules,
         reason: v.reason.slice(0, MAX_REASON_CHARS),
         ...v.pwAgentsGuard === "off" ? { pwAgentsGuard: "off" } : {}
@@ -21681,8 +22611,153 @@ var require_run_write_guard = __commonJS({
       return named.size + Math.min(bare.size, 2) >= 2;
     }
     var GRAPHQL_SIGN_IN_NAME = /^(?:log_?in|sign_?in|authenticate|login\w{0,40}|signin\w{0,40})$/i;
+    var GRAPHQL_SIGN_IN_VERBS = ["login", "signin", "authenticate"];
+    var GRAPHQL_SIGN_IN_PHRASE_WORDS = /* @__PURE__ */ new Set(["with", "via", "by", "using"]);
+    var GRAPHQL_SIGN_IN_TAIL_WORDS = /* @__PURE__ */ new Set([
+      "user",
+      "mutation",
+      "mfa",
+      "otp",
+      "totp",
+      "sso",
+      "anonymous",
+      "anonymously",
+      "email",
+      "password",
+      "phone",
+      "number",
+      "code",
+      "token",
+      "refresh",
+      "custom",
+      "api",
+      "key",
+      "magic",
+      "credentials",
+      "username",
+      "credential",
+      "sms",
+      "pin",
+      "jwt",
+      "mobile",
+      "session",
+      "ticket",
+      "qr",
+      "biometric",
+      "biometrics",
+      "wallet",
+      "identifier",
+      "address",
+      "local",
+      "login",
+      "userid",
+      "passkey",
+      "webauthn",
+      "idp",
+      "oauth",
+      "oidc",
+      "saml",
+      "ldap",
+      "google",
+      "apple",
+      "github",
+      "gitlab",
+      "facebook",
+      "microsoft",
+      "azure",
+      "twitter",
+      "linkedin",
+      "discord",
+      "slack",
+      "twitch",
+      "keycloak",
+      "okta",
+      "ethereum",
+      "firebase",
+      "cognito",
+      "apikey",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme"
+    ]);
+    var GRAPHQL_SIGN_IN_SUBJECT_WORDS = /* @__PURE__ */ new Set(["user", "customer", "admin", "member", "staff", "account"]);
+    var GRAPHQL_SIGN_IN_JOINERS = /* @__PURE__ */ new Set(["and", "or"]);
+    var GRAPHQL_SIGN_IN_JOINED_KINDS = /* @__PURE__ */ new Set([
+      "github",
+      "gitlab",
+      "linkedin",
+      "webauthn",
+      "passkey",
+      "apikey",
+      "idp",
+      "appleid",
+      "auth0",
+      "faceid",
+      "touchid",
+      "twofactor",
+      "backupcode",
+      "recoverycode",
+      "rememberme",
+      "username",
+      "userid"
+    ]);
+    function joinSplitKinds(words) {
+      const out = [];
+      for (let i = 0; i < words.length; i++) {
+        let joined = 0;
+        for (let n = Math.min(3, words.length - i); n >= 2; n--) {
+          const part = words.slice(i, i + n);
+          if (!part.some((w) => GRAPHQL_SIGN_IN_JOINERS.has(w)) && GRAPHQL_SIGN_IN_JOINED_KINDS.has(part.join(""))) {
+            joined = n;
+            break;
+          }
+        }
+        if (joined) {
+          out.push(words.slice(i, i + joined).join(""));
+          i += joined - 1;
+        } else
+          out.push(words[i]);
+      }
+      return out;
+    }
+    var GRAPHQL_SIGN_IN_LINK_KINDS = /* @__PURE__ */ new Set(["magic", "email"]);
+    function graphqlSignInTail(name) {
+      const words = wordsOf(name.replace(/(?<=[A-Z0-9][A-Z0-9])(?=[A-Z][a-z])/g, " "));
+      const head = words[0] === "log" || words[0] === "sign" ? words[1] === "in" ? [`${words[0]}in`, ...words.slice(2)] : null : words;
+      if (!head || head.length === 0)
+        return null;
+      const verb = GRAPHQL_SIGN_IN_VERBS.find((v) => head[0].startsWith(v));
+      if (!verb)
+        return null;
+      const glued = head[0].slice(verb.length);
+      return glued ? [glued, ...head.slice(1)] : head.slice(1);
+    }
+    function isGraphqlSignInTail(tail) {
+      const words = joinSplitKinds(tail);
+      let start = 0;
+      while (start < words.length && GRAPHQL_SIGN_IN_SUBJECT_WORDS.has(words[start]))
+        start++;
+      if (start === words.length)
+        return true;
+      let kinds = words.slice(start);
+      const phrase = kinds.findIndex((w) => GRAPHQL_SIGN_IN_PHRASE_WORDS.has(w));
+      if (phrase >= 0) {
+        if (phrase === kinds.length - 1 || phrase > 0 && GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase - 1]) || GRAPHQL_SIGN_IN_JOINERS.has(kinds[phrase + 1]))
+          return false;
+        kinds = [...kinds.slice(0, phrase), ...kinds.slice(phrase + 1)];
+      }
+      if (kinds.length === 0)
+        return false;
+      const isKind = (w, before) => GRAPHQL_SIGN_IN_TAIL_WORDS.has(w) || /^v\d{1,3}$/.test(w) || /^\d?fa$/.test(w) || w === "link" && before !== void 0 && GRAPHQL_SIGN_IN_LINK_KINDS.has(before);
+      return kinds.every((w, i) => GRAPHQL_SIGN_IN_JOINERS.has(w) ? i > 0 && i < kinds.length - 1 && !GRAPHQL_SIGN_IN_JOINERS.has(kinds[i - 1]) : isKind(w, i === phrase ? void 0 : kinds[i - 1]));
+    }
     function wordsOf(segment) {
-      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s._/-]+/).filter(Boolean);
+      return segment.replace(/([a-z])(?=[A-Z0-9])/g, "$1 ").toLowerCase().split(/[\s.,_/-]+/).filter(Boolean);
     }
     function rawSegmentsOf(pathname) {
       return pathname.split("/").map((seg) => {
@@ -21703,7 +22778,10 @@ var require_run_write_guard = __commonJS({
       return words.some((w) => ACCOUNT_CHANGE_WORDS.has(w)) && words.some((w) => ACCOUNT_CHANGE_CONTEXT.has(w));
     }
     function isGraphqlSignInName(name) {
-      return GRAPHQL_SIGN_IN_NAME.test(name) && !changesSomething([name], { passwordIsCredential: true });
+      if (!GRAPHQL_SIGN_IN_NAME.test(name))
+        return false;
+      const tail = graphqlSignInTail(name);
+      return tail !== null && isGraphqlSignInTail(tail) && !changesSomething([name], { passwordIsCredential: true });
     }
     function graphqlSignIn(body) {
       let parsed;
@@ -21739,6 +22817,173 @@ var require_run_write_guard = __commonJS({
       }
       return signIns > 0 ? "document" : null;
     }
+    var NOT_A_BROKER_SIGN_IN_WORDS = /* @__PURE__ */ new Set([
+      "add",
+      "book",
+      "booking",
+      "bookings",
+      "order",
+      "orders",
+      "reserve",
+      "reservation",
+      "reservations",
+      "submit",
+      "send",
+      "invite",
+      "invites",
+      "invitation",
+      "invitations",
+      "checkout",
+      "purchase",
+      "purchases",
+      "buy",
+      "pay",
+      "payment",
+      "payments",
+      "cart",
+      "subscribe",
+      "subscription",
+      "subscriptions",
+      "publish",
+      "upload",
+      "charge",
+      "charges",
+      "refund",
+      "refunds"
+    ]);
+    var BROKER_MAKE_VERBS = /* @__PURE__ */ new Set(["create", "generate"]);
+    var BROKER_CREDENTIAL_WORDS = /* @__PURE__ */ new Set(["session", "sessions", "login", "logins", "signin", "sign", "token", "tokens", "jwt", "jwts"]);
+    var BROKER_CREDENTIAL_QUALIFIERS = /* @__PURE__ */ new Set([
+      "access",
+      "refresh",
+      "id",
+      "auth",
+      "oauth",
+      "bearer",
+      "in",
+      "new",
+      "user",
+      "customer",
+      "with",
+      "from",
+      "via",
+      "for",
+      "by",
+      "and",
+      "mutation",
+      "google",
+      "apple",
+      "facebook",
+      "github",
+      "microsoft",
+      "sso",
+      "social",
+      "oidc",
+      "firebase"
+    ]);
+    function namesOnlyACredential(words) {
+      const rest = words.filter((w) => !BROKER_MAKE_VERBS.has(w));
+      return rest.some((w) => BROKER_CREDENTIAL_WORDS.has(w)) && rest.every((w) => BROKER_CREDENTIAL_WORDS.has(w) || BROKER_CREDENTIAL_QUALIFIERS.has(w));
+    }
+    function actsBesidesBrokerSignIn(segments) {
+      return segments.some((seg, i) => {
+        const words = wordsOf(seg);
+        if (words.some((w) => NOT_A_BROKER_SIGN_IN_WORDS.has(w)) || NOT_A_BROKER_SIGN_IN_WORDS.has(words.join("")))
+          return true;
+        if (!words.some((w) => BROKER_MAKE_VERBS.has(w)))
+          return false;
+        if (namesOnlyACredential(words))
+          return false;
+        return !(words.length === 1 && i > 0 && i === segments.length - 1 && namesOnlyACredential(wordsOf(segments[i - 1])));
+      });
+    }
+    function brokerRefuses(segments) {
+      return changesSomething(segments) || actsBesidesBrokerSignIn(segments);
+    }
+    var BROKER_SIGN_IN_NAME_WORDS = /* @__PURE__ */ new Set(["login", "signin", "sign", "auth", "authenticate", "google", "oauth", "sso", "social", "session"]);
+    function isBrokerSignInName(name) {
+      return typeof name === "string" && wordsOf(name).some((w) => BROKER_SIGN_IN_NAME_WORDS.has(w)) && !brokerRefuses([name]);
+    }
+    function graphqlBrokerSignIn(body) {
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        parsed = { query: body };
+      }
+      const entries = Array.isArray(parsed) ? parsed : [parsed];
+      let mutationRoots = 0;
+      for (const entry of entries) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry))
+          return false;
+        const { query, operationName } = entry;
+        const record = entry;
+        const ids = PERSISTED_ID_KEYS.map((key) => record[key]).filter((n) => n !== void 0);
+        const names = operationName === void 0 ? ids : [operationName, ...ids];
+        if (ids.length > 0 && !names.every(isBrokerSignInName))
+          return false;
+        if (typeof query !== "string") {
+          return !Array.isArray(parsed) && query === void 0 && names.length > 0 && names.every(isBrokerSignInName);
+        }
+        const ops = (0, survey_network_guard_js_1.graphqlOperationRoots)(query);
+        if (!ops)
+          return false;
+        for (const op of ops) {
+          if (op.kind === "query")
+            continue;
+          if (typeof operationName === "string" && brokerRefuses([operationName]))
+            return false;
+          const roots = op.roots.filter((root) => root !== "__typename");
+          if (roots.some((root) => brokerRefuses([root])))
+            return false;
+          mutationRoots += roots.length;
+        }
+      }
+      return mutationRoots === 1;
+    }
+    var GRAPHQL_DOCUMENT_START = /^[\s,]*(?:[{#]|(?:query|mutation|subscription|fragment)\b)/;
+    function looksLikeGraphqlDocument(text) {
+      return GRAPHQL_DOCUMENT_START.test(text) || (0, survey_network_guard_js_1.graphqlOperationRoots)(text) !== null;
+    }
+    var PERSISTED_ID_KEYS = ["id", "documentId", "doc_id", "queryId"];
+    var GRAPHQL_ENVELOPE_FIELDS = ["variables", "operationName", "documentId", "doc_id", "queryId", "sha256Hash", "hash", "extensions", "operations"];
+    function hasGraphqlEnvelope(has2, queryIsString) {
+      return queryIsString || GRAPHQL_ENVELOPE_FIELDS.some(has2);
+    }
+    function carriesGraphql(search, body, contentType) {
+      if (search.getAll("query").some(looksLikeGraphqlDocument))
+        return true;
+      if (/^\s*application\/graphql\b/i.test(contentType ?? ""))
+        return true;
+      if (/multipart\//i.test(contentType ?? "") || /^\s*--/.test(body)) {
+        const parts = new Set([...body.matchAll(/\bname\s*=\s*"?([\w-]+)/gi)].map((m) => m[1]));
+        return hasGraphqlEnvelope((field) => parts.has(field), parts.has("query"));
+      }
+      let parsed;
+      try {
+        parsed = JSON.parse(body);
+      } catch {
+        if (looksLikeGraphqlDocument(body))
+          return true;
+        const form = new URLSearchParams(body);
+        return hasGraphqlEnvelope((field) => form.has(field), form.has("query"));
+      }
+      if (Array.isArray(parsed))
+        return true;
+      if (!parsed || typeof parsed !== "object")
+        return false;
+      const record = parsed;
+      return hasGraphqlEnvelope((field) => record[field] !== void 0, typeof record.query === "string");
+    }
+    function isBrokerSignInShape(pathname, search, postData, contentType) {
+      if (brokerRefuses(rawSegmentsOf(pathname)))
+        return false;
+      if (!isGraphqlPath(pathname) && !(typeof postData === "string" && carriesGraphql(search, postData, contentType)))
+        return true;
+      if ((0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(search) || PERSISTED_ID_KEYS.some((key) => search.has(key)) || typeof postData !== "string" || postData.length > MAX_BODY_CHARS)
+        return false;
+      return graphqlBrokerSignIn(postData);
+    }
     function isCredentialSignInShape(pathname, search, postData, contentType) {
       if (typeof postData === "string" && postData.length > MAX_BODY_CHARS)
         return false;
@@ -21952,6 +23197,26 @@ var require_run_write_guard = __commonJS({
       }).join("");
       return { method, host, path: new RegExp(`^${body}/?$`, "i") };
     }
+    function normaliseIdpHost(raw) {
+      return raw.trim().toLowerCase().replace(/\.$/, "");
+    }
+    var WILDCARD_DNS_RE = /(?:^|\.)(?:nip\.io|sslip\.io|xip\.io|localtest\.me|lvh\.me|vcap\.me|traefik\.me|localho\.st|localhost\.direct|local\.gd|fuf\.me)$/;
+    function idpHostProblem(host) {
+      if (host.length > 253 || !/^[a-z0-9-]+(?:\.[a-z0-9-]+)+$/.test(host))
+        return "not a host name (no scheme, port, path or wildcard)";
+      if (/^[0-9.]+$/.test(host))
+        return "an IP address";
+      if (/(?:^|\.)(?:localhost|local|internal)$/.test(host))
+        return "a local name";
+      if (WILDCARD_DNS_RE.test(host))
+        return "a wildcard-DNS name (it can point at any address)";
+      if ((0, shared_1.isSharedSuffix)(host))
+        return exports2.SHARED_SUFFIX_PATTERN_REASON;
+      return null;
+    }
+    function isIdpHost(url, host, policy) {
+      return url.protocol === "https:" && url.port === "" && (policy.idpHosts ?? []).includes(host);
+    }
     function matchesAllowPatterns(method, host, pathname, policy, compiled) {
       const patterns = compiled ?? policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
       return patterns.some((p) => {
@@ -21975,7 +23240,10 @@ var require_run_write_guard = __commonJS({
           return reason ? [{ pattern, reason }] : [];
         })
       ];
-      return ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`);
+      return [
+        ...ignored.map(({ pattern, reason }) => `[run-write-guard] SAFE_WRITE_PATTERNS entry ${JSON.stringify(pattern)} ignored: ${reason}`),
+        ...(policy.ignoredIdpHosts ?? []).map(({ pattern, reason }) => `[run-write-guard] AUTH_PROVIDER_HOSTS entry ${JSON.stringify(pattern)} ignored: ${reason}`)
+      ];
     }
     function describe(facts, url, rule) {
       return {
@@ -22027,6 +23295,8 @@ var require_run_write_guard = __commonJS({
         return { action: "write", rule: "sign-up", record: describe(facts, url, "sign-up") };
       if (isAuthProviderWrite(method, host, pathname, facts.amzTarget, url.searchParams))
         return { action: "allow", rule: "auth-provider" };
+      if (isIdpHost(url, host, policy) && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
+        return { action: "allow", rule: "auth-provider" };
       const appSite = isAppSite(host, policy);
       if (facts.registeredAuthHandler && pathname === exports2.FIREBASE_AUTH_HANDLER_PATH)
         return { action: "allow", rule: "auth-provider" };
@@ -22034,7 +23304,7 @@ var require_run_write_guard = __commonJS({
         return { action: "allow", rule: "sign-in" };
       if (appSite && isAuth0CustomDomainSignIn(method, pathname, url.searchParams))
         return { action: "allow", rule: "sign-in" };
-      if (appSite && method === "POST" && facts.brokerTokenInBody && !changesSomething(rawSegmentsOf(pathname))) {
+      if (appSite && method === "POST" && facts.brokerTokenInBody && isBrokerSignInShape(pathname, url.searchParams, facts.postData, facts.contentType)) {
         return { action: "allow", rule: "broker-sign-in" };
       }
       if (appSite && isEvidencedTokenRefresh(method, pathname, facts.postData))
@@ -22042,7 +23312,7 @@ var require_run_write_guard = __commonJS({
       const signIn = appSite && method === "POST" && facts.signInSecretInBody ? isCredentialSignInShape(pathname, url.searchParams, facts.postData, facts.contentType) : false;
       if (signIn)
         return { action: "allow", rule: "credential-sign-in", ...signIn === "persisted" ? { persisted: true } : {} };
-      if (method === "POST" && isGraphqlPath(pathname) && !(0, survey_network_guard_js_1.graphqlUrlCarriesQuery)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
+      if (method === "POST" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlUrlQueriesAreReads)(url.searchParams) && isGraphqlQueryOnlyBody(facts.postData))
         return { action: "allow", rule: "graphql-query" };
       if (method === "POST" && hostIs(host, SEARCH_POST_HOSTS))
         return { action: "allow", rule: "search-post" };
@@ -22099,6 +23369,8 @@ var require_run_write_guard = __commonJS({
       relayRejected = 0;
       /** Credential sign-ins already said in the run log (observe mode; method, host and path shape). */
       signInsLogged = /* @__PURE__ */ new Set();
+      /** Hosts already named in the run log as a possible AUTH_PROVIDER_HOSTS entry (at most MAX_IDP_HINTS). */
+      idpHintsLogged = /* @__PURE__ */ new Set();
       constructor(policy, opts = {}) {
         this.policy = policy;
         this.compiled = policy.allowPatterns.map(compileAllowPattern).filter((p) => p !== null);
@@ -22196,6 +23468,22 @@ var require_run_write_guard = __commonJS({
         const verb = held ? "held" : "saw";
         const why = record.writeShaped ? `${record.rule}, ${record.writeShaped}` : record.rule;
         this.log?.(`[run-write-guard] ${verb} ${record.method} ${record.host}${record.path}${record.keys.length ? ` (${record.keys.join(", ")})` : ""} [${why}]`);
+        this.hintIdpHost(record);
+      }
+      /**
+       * An Auth0 sign-in step (by path) posted to another site was a third-party write: the tenant may
+       * answer on a custom domain of its own. Said once per host, for at most MAX_IDP_HINTS hosts, so a
+       * person knows AUTH_PROVIDER_HOSTS exists; the guard never names the host itself.
+       */
+      hintIdpHost(record) {
+        if (record.rule !== "third-party-write" || record.method !== "POST")
+          return;
+        if (this.idpHintsLogged.has(record.host) || this.idpHintsLogged.size >= MAX_IDP_HINTS)
+          return;
+        if ((this.policy.idpHosts ?? []).includes(record.host) || !AUTH0_AUTH_RE.test(record.path.toLowerCase()))
+          return;
+        this.idpHintsLogged.add(record.host);
+        this.log?.(`[run-write-guard] note: ${record.host} looks like an Auth0 sign-in on another site; if it is the app's own sign-in, a project admin can name it in AUTH_PROVIDER_HOSTS in Test Data`);
       }
       /**
        * A page sent a message over a WebSocket to the app's site. The guard cannot tell a read from a
@@ -23003,8 +24291,9 @@ var require_run_write_guard = __commonJS({
       };
       Object.assign(context, {
         route: async (url, handler, options) => {
-          await route(url, handler, options);
+          const disposable = await route(url, handler, options);
           others.push({ url, handler });
+          return disposable;
         },
         unroute: async (url, handler) => {
           if (handler === void 0 && sameRouteUrl(url, GUARD_ROUTE)) {
@@ -23337,6 +24626,7 @@ var require_run_write_guard = __commonJS({
     }
     function buildRunWriteGuardHook(policy, modulePath, signInSecretNames = [], opts = {}) {
       const withContext = opts.browserContext !== false;
+      const hookTest = opts.hookTest ?? "test";
       const names = signInSecretNames.filter((n) => /^[A-Za-z_][A-Za-z0-9_]{0,63}$/.test(n)).slice(0, 16);
       return `
 import { createRequire as __qaWriteGuardRequire } from 'node:module';
@@ -23359,7 +24649,7 @@ try {
 } catch (err) {
   __qaWriteGuardError = err;
 }
-test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
+${hookTest}.beforeEach(async (${withContext ? "{ context }" : ""}) => {
   try {
     if (__qaWriteGuardError) throw __qaWriteGuardError;
     ${withContext ? "await __qaWriteGuard.installRunWriteGuard(context, __qaWriteGuardPolicy, { onLog: (line) => console.log(line), signInSecrets: __qaWriteGuardSecrets });" : "// an @api test: no browser context, only Node's fetch is guarded"}
@@ -23368,7 +24658,7 @@ test.beforeEach(async (${withContext ? "{ context }" : ""}) => {
     ${policy.mode === "block" ? "throw err;" : "// observe: never fail the test"}
   }
 });${withContext && policy.mode === "block" ? `
-test.afterEach(async ({ context }) => {
+${hookTest}.afterEach(async ({ context }) => {
   try { if (__qaWriteGuard) await __qaWriteGuard.clearRunWriteRelay(context); } catch { /* the context closes next */ }
 });` : ""}
 `;