@validate.qa/runner 1.0.101 → 1.0.103

package/dist/credential-mcp-server.js

@@ -368,13 +368,13 @@ function isBlockedEnvVar(key) {
 function sanitizeTestVariables(vars) {
   if (!vars)
     return {};
-  const clean2 = {};
+  const clean3 = {};
   for (const [key, value] of Object.entries(vars)) {
     if (!isBlockedEnvVar(key)) {
-      clean2[key] = value;
+      clean3[key] = value;
     }
   }
-  return clean2;
+  return clean3;
 }
 function buildSandboxedEnv(processEnv, testVariables) {
   const env = {};
@@ -1831,9 +1831,40 @@ function semanticTarget(label, platform, base2) {
     }
   };
 }
+function androidResourceOwners(value) {
+  const owners = [];
+  for (const match of value.matchAll(ANDROID_RESOURCE_ID_SUFFIX_RE)) {
+    let runStart = match.index;
+    while (runStart > 0 && /[a-z0-9_.]/i.test(value[runStart - 1]))
+      runStart--;
+    const owner = ownerAtEndOfRun(value.slice(runStart, match.index));
+    if (owner !== null)
+      owners.push(owner);
+  }
+  return owners;
+}
+function ownerAtEndOfRun(run) {
+  const segments = run.split(".");
+  const last = segments.length - 1;
+  const startsWithLetter = (segment) => /^[a-z]/i.test(segment);
+  if (last < 1 || !startsWithLetter(segments[last]))
+    return null;
+  let first = last;
+  while (first > 0 && startsWithLetter(segments[first - 1]))
+    first--;
+  let offset = 0;
+  for (let i = 0; i < first - 1; i++)
+    offset += segments[i].length + 1;
+  if (first > 0) {
+    const letterAt = segments[first - 1].search(/[a-z]/i);
+    if (letterAt >= 0)
+      return run.slice(offset + letterAt);
+    offset += segments[first - 1].length + 1;
+  }
+  return first < last ? run.slice(offset) : null;
+}
 function containsForeignAppPackage(value, targetAppId) {
-  for (const match of value.matchAll(ANDROID_RESOURCE_OWNER_RE)) {
-    const owner = match[1];
+  for (const owner of androidResourceOwners(value)) {
     if (targetAppId && owner !== targetAppId && !owner.startsWith(`${targetAppId}.`))
       return true;
   }
@@ -1970,7 +2001,7 @@ function healMobileTestSteps(input) {
     summary: changed ? uniq(summary).slice(0, 12) : []
   };
 }
-var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_OWNER_RE, COMMON_EXTERNAL_PREFIXES;
+var MOBILE_STEP_ACTIONS, FOREIGN_PACKAGE_RE, ANDROID_RESOURCE_ID_SUFFIX_RE, COMMON_EXTERNAL_PREFIXES;
 var init_mobile_step_healer = __esm({
   "../shared/dist/mobile-step-healer.js"() {
     "use strict";
@@ -1991,7 +2022,7 @@ var init_mobile_step_healer = __esm({
       "assertStateDelta"
     ]);
     FOREIGN_PACKAGE_RE = /\b[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*){2,}\b/gi;
-    ANDROID_RESOURCE_OWNER_RE = /([a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)+):id\//gi;
+    ANDROID_RESOURCE_ID_SUFFIX_RE = /:id\//gi;
     COMMON_EXTERNAL_PREFIXES = [
       "com.android.",
       "com.google.",
@@ -3701,7 +3732,7 @@ var init_assertion_classifier = __esm({
       // toHaveCount(0) stays tier 4 (absence proof) via TIER4_PATTERNS.
       [/\.toHaveCount\s*\(\s*[1-9]\d*\s*\)/, "non-zero toHaveCount asserts a record count that changes between runs"],
       // parenthesised counts like "(3)" or "[12]" in text - but not Playwright method args
-      [/(?<!\.\w{3,20}\s*)\(\s*\d+\s*\)(?!\s*[,;]?\s*\))/i, "parenthesised count is session-specific"],
+      [/\((?<!\.\w{3,20}\s*\()\s*\d+\s*\)(?!\s*(?:[,;]\s*)?\))/i, "parenthesised count is session-specific"],
       // bare email addresses in assertion content
       [/\b[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}\b/i, "email address is user-specific"],
       // currency/balance amounts (dynamic account data)
@@ -3947,7 +3978,7 @@ var init_assertion_proof = __esm({
     PRESENCE_MATCHER = /\.(?:toBeVisible|toBeAttached|toBeEnabled|toBeInViewport|toBeEditable|toBeFocused)\s*\(|\.toHaveCount\s*\(\s*1\s*\)/;
     TEXT_MATCHER = /\.(?:toHaveText|toContainText)\s*\(/;
     ANY_VALUE_SOURCE = /^(?:\.|\\S|\\w|\\d|\[\^\\s\]|\[0-9\]|\[\\d\]|\[\\w\]|\[\\s\\S\])[+*]?\??$/;
-    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*\)/;
+    ANY_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(\s*\/((?:\\.|[^/\\]){1,300})\/[a-z]*\s*[,)]/;
     EMPTY_NOT_VALUE = /\.not\s*\.\s*toHaveValue\s*\(\s*(?:['"`]{2}|\/\^?\$?\/)/;
     TEXT_MATCHER_LITERAL = /\.(?:toHaveText|toContainText)\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
     GET_BY_TEXT_LITERAL = /getByText\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/;
@@ -3964,7 +3995,7 @@ var init_assertion_proof = __esm({
     DATA_ROLE = /getByRole\s*\(\s*['"`](?:dialog|alertdialog|alert|cell|gridcell|row|rowheader|columnheader|listitem|article|option|status|note|tooltip|paragraph|term|definition|log|marquee|timer|meter)['"`]/gi;
     TEXT_LOCATOR = /\.getByText\s*\(|\.filter\s*\(\s*\{\s*hasText\s*:/g;
     CSS_LOCATOR = /\.locator\s*\(\s*(['"`])((?:(?!\1).){1,300})\1/g;
-    SPECIFIC_CSS = /\[[^\]]*=|#[\w-]|has-text|:text/;
+    SPECIFIC_CSS = /\[[^\][=]*=|#[\w-]|has-text|:text/;
   }
 });
 
@@ -4928,22 +4959,37 @@ function classifyAuthHandoffIntent(text) {
 function withoutIdpUrlAsserts(code) {
   return code.replace(/\.(?:toHaveURL|waitForURL)\s*\((?:[^)(]|\([^)]*\))*\)/g, (match) => /accountchooser|accounts\.google|appleid\.apple|login\.microsoftonline|\/v\d+\/signin|oauth/i.test(match) ? "" : match);
 }
+function stripLineComment(line) {
+  let from = line.length;
+  while (from > 0) {
+    const c = line.charCodeAt(from - 1);
+    if (c === 10 || c === 13 || c === 8232 || c === 8233)
+      break;
+    from--;
+  }
+  const at = line.indexOf("//", from);
+  return at < 0 ? line : line.slice(0, at);
+}
 function stripComments(code) {
-  return replaceBlockComments(code, () => "").split("\n").map((line) => line.replace(/\/\/.*$/, "")).join("\n");
+  return replaceBlockComments(code, () => "").split("\n").map(stripLineComment).join("\n");
 }
-function balancedCall(code, start) {
-  const open = code.indexOf("(", start);
-  if (open < 0)
-    return null;
-  let depth = 0;
-  for (let i = open; i < code.length; i++) {
+function closingParens(code) {
+  const close = new Int32Array(code.length).fill(-1);
+  const open = [];
+  for (let i = 0; i < code.length; i++) {
     const c = code[i];
     if (c === "(")
-      depth++;
-    else if (c === ")" && --depth === 0)
-      return { inner: code.slice(open + 1, i), end: i };
+      open.push(i);
+    else if (c === ")" && open.length > 0)
+      close[open.pop()] = i;
   }
-  return null;
+  return close;
+}
+function balancedCall(code, close, start) {
+  const open = code.indexOf("(", start);
+  if (open < 0 || close[open] < 0)
+    return null;
+  return { inner: code.slice(open + 1, close[open]), end: close[open] };
 }
 function resolveLocator(code, subject) {
   const id = subject.trim().match(/^([A-Za-z_$][\w$]*)$/);
@@ -4991,8 +5037,10 @@ function isAuthHandoffDismissCode(code) {
   const expects = [];
   const re = new RegExp(EXPECT_CALL_RE.source, "g");
   let match;
+  let close = null;
   while (match = re.exec(body)) {
-    const found = balancedCall(body, match.index);
+    close ??= closingParens(body);
+    const found = balancedCall(body, close, match.index);
     if (found)
       expects.push({ inner: found.inner, tail: body.slice(found.end, found.end + 48) });
   }
@@ -5037,12 +5085,209 @@ var init_auth_handoff_coverage = __esm({
   }
 });
 
+// ../shared/dist/auth-plan.js
+function hasInlineLoginSteps(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+}
+function hasGeneratedAuthGuard(playwrightCode) {
+  if (!playwrightCode)
+    return false;
+  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
+}
+function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
+  if (!sharedAuthInjectEnabled)
+    return false;
+  if (tags.includes("@auth"))
+    return false;
+  if (tags.includes("@api"))
+    return true;
+  if (!tags.includes("@needs-auth"))
+    return false;
+  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
+    return true;
+  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
+}
+function codeReadsStoredCredentials(code) {
+  if (!code)
+    return false;
+  if (/__vqaLogin\b/.test(code))
+    return true;
+  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
+    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
+      return true;
+  }
+  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
+    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
+      return true;
+  }
+  return false;
+}
+function explicitAuthTypeTags(t) {
+  const found = /* @__PURE__ */ new Set();
+  for (const tag of t) {
+    if (AUTH_TYPE_TAGS.includes(tag))
+      found.add(tag);
+    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
+      found.add(AUTH_TAG_ALIASES[tag]);
+  }
+  return [...found];
+}
+function invalidPlan(configurationError) {
+  return {
+    version: 1,
+    source: "invalid",
+    acquisition: "unsupported",
+    presentation: "none",
+    needsCookieState: false,
+    needsStandingHeaders: false,
+    standingHeadersMode: "none",
+    needsLoginCreds: false,
+    requiredEnvKeys: [],
+    configurationError
+  };
+}
+function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
+  return {
+    version: 1,
+    source: "explicit",
+    authTypeTag: authTypeTag2,
+    acquisition,
+    presentation,
+    needsCookieState: opts.cookie,
+    needsStandingHeaders: opts.standingMode === "required",
+    standingHeadersMode: opts.standingMode,
+    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
+    requiredEnvKeys: opts.requiredEnvKeys
+  };
+}
+function deriveAuthPlan(tags, code, opts) {
+  const t = Array.isArray(tags) ? tags : [];
+  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
+  const isApi = t.includes("@api");
+  const explicit = isApi ? explicitAuthTypeTags(t) : [];
+  if (explicit.length > 0) {
+    if (t.includes("@auth")) {
+      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
+    }
+    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
+    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
+      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
+      switch (loginCompose[0]) {
+        case AUTH_TAG_COOKIE_STATE:
+          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_COOKIE:
+          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+        case AUTH_TAG_LOGIN_BEARER:
+          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
+      }
+    }
+    if (explicit.length > 1) {
+      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
+    }
+    switch (explicit[0]) {
+      case AUTH_TAG_UNSUPPORTED:
+        return {
+          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
+        };
+      case AUTH_TAG_NONE:
+        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
+      case AUTH_TAG_STANDING:
+        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
+      case AUTH_TAG_LOGIN_BEARER:
+        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_LOGIN_COOKIE:
+        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+      case AUTH_TAG_COOKIE_STATE:
+        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
+    }
+  }
+  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
+  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
+  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
+  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
+  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
+  return {
+    version: 1,
+    source: "legacy",
+    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
+    presentation: authedLegacy ? "cookie" : "none",
+    needsCookieState: cookie,
+    needsStandingHeaders: false,
+    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
+    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
+    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
+    needsLoginCreds,
+    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
+  };
+}
+function authTypeTag(tags) {
+  const t = Array.isArray(tags) ? tags : [];
+  const explicit = explicitAuthTypeTags(t);
+  return explicit.length === 1 ? explicit[0] : void 0;
+}
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var init_auth_plan = __esm({
+  "../shared/dist/auth-plan.js"() {
+    "use strict";
+    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
+    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
+    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
+    AUTH_TAG_STANDING = "@auth-standing";
+    AUTH_TAG_NONE = "@auth-none";
+    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
+    AUTH_TYPE_TAGS = [
+      AUTH_TAG_COOKIE_STATE,
+      AUTH_TAG_LOGIN_COOKIE,
+      AUTH_TAG_LOGIN_BEARER,
+      AUTH_TAG_STANDING,
+      AUTH_TAG_NONE,
+      AUTH_TAG_UNSUPPORTED
+    ];
+    AUTH_TAG_ALIASES = {
+      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
+      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
+      "@auth-token": AUTH_TAG_LOGIN_BEARER,
+      "@auth-api-key": AUTH_TAG_STANDING,
+      "@auth-standing-header": AUTH_TAG_STANDING
+    };
+    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
+    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+  }
+});
+
 // ../shared/dist/assertion-strength.js
+function parseLastActionProofMode(raw) {
+  const v = (raw ?? "").trim().toLowerCase();
+  return v === "on" || v === "shadow" ? v : "off";
+}
+function isUrlProof(stmt) {
+  if (URL_PROOF.test(stmt))
+    return true;
+  let calls = 0;
+  for (const open of stmt.matchAll(POLL_OPEN)) {
+    if (++calls > POLL_CALLS_MAX)
+      break;
+    const from = open.index + open[0].length;
+    const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+    if (args === null)
+      continue;
+    const subject = pollSubject(args);
+    if (!POLL_PAGE_URL.test(subject))
+      continue;
+    if (!POLL_PAGE_URL_ONLY.test(subject) || PAGE_VALUE_MATCHER.test(stmt.slice(from + args.length)))
+      return true;
+  }
+  return false;
+}
 function liveExpectStatements(uncommented) {
   const masked = maskedOutsideStrings(uncommented).split("\n");
   return accumulateStatements(uncommented.split("\n")).filter((s) => EXPECT_STMT.test(s.stmt) && EXPECT_STMT.test(masked[s.startLine - 1] ?? ""));
 }
-function stripLineComment(ln) {
+function stripLineComment2(ln) {
   let quote = null;
   for (let i = 0; i < ln.length; i++) {
     const c = ln[i];
@@ -5065,7 +5310,7 @@ function splitInteractionStatementsWithLines(lines) {
   let depth = 0;
   let scaffold = false;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!ln)
       continue;
     const isContinuation = out.length > 0 && (ln.startsWith(".") || depth > 0 && !scaffold);
@@ -5089,7 +5334,7 @@ function testBlockIds(lines) {
   let any = false;
   let block = 0;
   for (let i = 0; i < lines.length; i++) {
-    const ln = stripLineComment(lines[i]).trim();
+    const ln = stripLineComment2(lines[i]).trim();
     if (!open) {
       if (!TEST_BLOCK_OPEN.test(ln))
         continue;
@@ -5173,7 +5418,7 @@ function expectSubjectSpan(stmt) {
   }
   return null;
 }
-function resolveSubjectBindings(stmts, bindings, blockOfLine) {
+function resolveSubjectBindings(stmts, bindings, blockOfLine, boundAt) {
   if (bindings.length === 0)
     return [...stmts];
   return stmts.map((item) => {
@@ -5196,14 +5441,22 @@ function resolveSubjectBindings(stmts, bindings, blockOfLine) {
       subject = `${lead[1]}${found.expr.replace(/;\s*$/, "")}${subject.slice(lead[0].length)}`;
       line = found.line;
     }
-    return { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    const out = { ...item, stmt: `${item.stmt.slice(0, span.from)}${subject}${item.stmt.slice(span.to)}` };
+    if (boundAt !== void 0 && line !== item.startLine)
+      boundAt.set(out, line);
+    return out;
   });
 }
 function stripLoginScaffolding(code) {
-  const out = [];
+  const lines = code.split("\n");
+  return keptScaffoldingLines(lines).map((i) => lines[i]).join("\n");
+}
+function keptScaffoldingLines(lines) {
+  const kept = [];
   let inAuth = false;
   let inInbox = false;
-  for (const ln of code.split("\n")) {
+  for (let i = 0; i < lines.length; i++) {
+    const ln = lines[i];
     if (!inAuth && !inInbox && AUTH_START.test(ln)) {
       inAuth = true;
       continue;
@@ -5224,9 +5477,9 @@ function stripLoginScaffolding(code) {
     }
     if (LOGIN_CALL_LINE.test(ln))
       continue;
-    out.push(ln);
+    kept.push(i);
   }
-  return out.join("\n");
+  return kept;
 }
 function stripCommentsAndLogs(code) {
   return stripCoverageComments(code).split("\n").filter((ln) => !/^\s*console\./.test(ln)).join("\n");
@@ -5378,6 +5631,41 @@ function isVacuousErrorAbsence(stmt, presence) {
     return false;
   return !presence().includes(m[1]);
 }
+function isVacuousAccountAbsence(stmt, shown, account) {
+  if (!claimsAbsence(stmt))
+    return false;
+  if (!ABSENCE_MATCHER.test(stmt)) {
+    const negated = NEGATED_TEXT.exec(stmt);
+    if (!negated)
+      return false;
+    const read = account.exec(stmt.slice(negated.index));
+    return read !== null && !shown().has(read[0]);
+  }
+  const m = account.exec(stmt);
+  if (!m || shown().has(m[0]))
+    return false;
+  for (let at = endOfEnclosingCall(stmt, m.index + m[0].length); at < stmt.length; at = endOfEnclosingCall(stmt, at)) {
+    SCOPING_STEP.lastIndex = at;
+    if (SCOPING_STEP.test(stmt))
+      return false;
+  }
+  return true;
+}
+function endOfEnclosingCall(stmt, from) {
+  let depth = 0;
+  for (let i = from; i < stmt.length; i++) {
+    const c = stmt[i];
+    if (c === "'" || c === '"') {
+      for (i++; i < stmt.length && stmt[i] !== c; i++)
+        if (stmt[i] === "\\")
+          i++;
+    } else if (c === "(")
+      depth++;
+    else if (c === ")" && depth-- === 0)
+      return i + 1;
+  }
+  return stmt.length;
+}
 function isBareContainerVisibility(stmt) {
   return BARE_CONTAINER_ROLE.test(stmt) && !GET_BY_TEXT.test(stmt) && !HAS_TEXT_FILTER.test(stmt) && !TEXT_CONTENT_MATCHER.test(stmt);
 }
@@ -5459,7 +5747,7 @@ function roleNames(s) {
 function interactedControlNames(lines) {
   const names = /* @__PURE__ */ new Set();
   for (const raw of lines) {
-    const ln = stripLineComment(raw);
+    const ln = stripLineComment2(raw);
     if (!INTERACT_VERB.test(ln))
       continue;
     for (const n of roleNames(ln))
@@ -5655,6 +5943,14 @@ function balancedArguments(code, from, limit = code.length) {
   }
   return null;
 }
+function expectCallTail(stmt) {
+  const at = stmt.search(EXPECT_CALL_RE);
+  if (at < 0)
+    return null;
+  const from = stmt.indexOf("(", at) + 1;
+  const args = balancedArguments(stmt, from, MATCHER_ARGS_MAX);
+  return args === null ? null : stmt.slice(from + args.length).trimStart();
+}
 function matcherArgumentsAreConstant(body, from) {
   MATCHER_OPEN.lastIndex = from;
   const opened = MATCHER_OPEN.exec(body);
@@ -5696,9 +5992,12 @@ function envValueKey(name) {
 function enteredValues(stmts) {
   const values = /* @__PURE__ */ new Map();
   const navLines = [];
+  const accountConsts = /* @__PURE__ */ new Set();
   for (const { stmt, startLine } of stmts) {
     if (PAGE_NAV.test(stmt))
       navLines.push(startLine);
+    for (const c of stmt.matchAll(ACCOUNT_CONST))
+      accountConsts.add(c[1].replace(/\$/g, "\\$"));
     let m;
     ENTERED_VALUE.lastIndex = 0;
     const add = (value) => {
@@ -5714,7 +6013,8 @@ function enteredValues(stmts) {
     while (m = ENTERED_ENV.exec(stmt))
       add(envValueKey(m[1] ?? m[2] ?? m[3] ?? m[4]));
   }
-  return { values, navLines };
+  const consts = accountConsts.size > 0 ? `|(?<![\\w$.])(?:${[...accountConsts].join("|")})(?![\\w$])` : "";
+  return { values, navLines, account: new RegExp(`${ACCOUNT_ENV}${consts}`) };
 }
 function countBelow(lines, line) {
   let lo = 0;
@@ -5851,6 +6151,9 @@ function comparesWithItself(subject, tail) {
   return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
 }
 function asPlainAssertion(s) {
+  return plainAssertion(s, false);
+}
+function plainAssertion(s, keepSelfCompare) {
   const { stmt } = s;
   if (COUNT_AT_LEAST_ZERO.test(stmt))
     return [];
@@ -5859,13 +6162,13 @@ function asPlainAssertion(s) {
     return [s];
   const plain = subject.replace(/^await\s+/, "").trim();
   const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
-  const tail = stmt.slice(subjectAt + subject.length).trimStart();
+  const tail = (stmt.startsWith("expect.poll", stmt.search(EXPECT_CALL_RE)) ? expectCallTail(stmt) : null) ?? stmt.slice(subjectAt + subject.length).trimStart();
   const as = (rewritten) => [{ ...s, stmt: rewritten }];
   if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
     return [];
   if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
     return [];
-  if (comparesWithItself(plain, tail))
+  if (!keepSelfCompare && comparesWithItself(plain, tail))
     return [];
   const visible = /^(.+)\.\s*isVisible\s*\(\s*\)$/s.exec(plain);
   if (visible && IS_VISIBLE_TRUE.test(tail))
@@ -5876,6 +6179,9 @@ function asPlainAssertion(s) {
   }
   return [s];
 }
+function assertionStrengthHoistedReadsOn(value = typeof process !== "undefined" ? process.env?.ASSERTION_STRENGTH_HOISTED_READS : void 0) {
+  return /^(1|true|on)$/i.test((value ?? "").trim());
+}
 function creditsOutcomeAlways(stmt, entered, startLine) {
   if (!OUTCOME_ALWAYS.some((re) => re.test(stmt)))
     return false;
@@ -5908,6 +6214,22 @@ function successNoticeQuote(stmt) {
   }
   return null;
 }
+function namedPagePath(arg) {
+  const text = arg.trim();
+  let path;
+  const quoted = /^(['"`])([^'"`]*)\1$/.exec(text);
+  const regex = quoted ? null : /^\/((?:\\.|[^/\\])+)\/[a-z]*$/.exec(text);
+  if (quoted) {
+    path = quoted[2].replace(/^\$\{[^}]*\}/, "").replace(/^\*\*/, "").replace(/^[a-z][a-z\d+.-]*:\/\/[^/]*/i, "").replace(/\/\*\*$/, "/");
+  } else if (regex) {
+    path = regex[1].replace(/^\^/, "").replace(/^\.\*/, "").replace(/\$$/, "").replace(/\\([/.-])/g, "$1");
+  } else {
+    return null;
+  }
+  if (!PLAIN_PAGE_PATH.test(path))
+    return null;
+  return path.length > 1 && path.endsWith("/") ? path.slice(0, -1) : path;
+}
 function provesStoredControlValue(stmt, startLine, persistence) {
   if (!persistence || startLine === void 0)
     return false;
@@ -5934,7 +6256,64 @@ function reopenedAfterSave(startLine, persistence, reopens = persistence.reloadL
   }
   return lo < reopens.length && reopens[lo] < startLine;
 }
-function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence) {
+function actsBetween(withLines, from, to) {
+  let acts = actLinesOf.get(withLines);
+  if (acts === void 0) {
+    acts = withLines.filter((s) => ACTS.test(s.stmt)).map((s) => s.startLine).sort((a, b) => a - b);
+    actLinesOf.set(withLines, acts);
+  }
+  let lo = 0;
+  let hi = acts.length;
+  while (lo < hi) {
+    const mid = lo + hi >> 1;
+    if (acts[mid] <= from)
+      lo = mid + 1;
+    else
+      hi = mid;
+  }
+  return lo < acts.length && acts[lo] < to;
+}
+function signInProofWindow(stmts, withLines, lines, blockIds) {
+  if (blockIds === null)
+    return void 0;
+  const testBodies2 = /* @__PURE__ */ new Set();
+  for (let i = 0; i < lines.length; i++) {
+    const id = blockIds[i];
+    if (id > 0 && (i === 0 || blockIds[i - 1] !== id) && TEST_BODY_OPEN.test(stripLineComment2(lines[i]).trim()))
+      testBodies2.add(id);
+  }
+  const blockOf = (i) => blockIds[withLines[i].startLine - 1];
+  const passwordAt = stmts.findIndex((stmt, i) => testBodies2.has(blockOf(i)) && ENV_PASSWORD_ENTRY.test(stmt));
+  if (passwordAt < 0)
+    return void 0;
+  const body = blockOf(passwordAt);
+  let clickAt = passwordAt + 1;
+  while (clickAt < stmts.length && FORM_INPUT.test(stmts[clickAt]) && !ANY_CLICK.test(stmts[clickAt]))
+    clickAt++;
+  if (clickAt >= stmts.length || blockOf(clickAt) !== body || !ANY_CLICK.test(stmts[clickAt]) || NAV_LOCATOR.test(stmts[clickAt]))
+    return void 0;
+  let end = clickAt + 1;
+  for (; end < stmts.length && blockOf(end) === body; end++) {
+    if (CLOSERS_ONLY.test(stmts[end]))
+      continue;
+    if (!ASSERT_OR_WAIT.test(stmts[end]) || ACTS.test(stmts[end]))
+      return void 0;
+  }
+  return { after: withLines[clickAt].startLine, until: end < stmts.length ? withLines[end].startLine : Number.POSITIVE_INFINITY };
+}
+function isAccountControlCheck(stmt) {
+  if (!VISIBILITY_MATCHER.test(stmt) || NEGATED_ASSERT.test(stmt) || OPTION_ABSENCE.test(stmt))
+    return false;
+  const role = ACCOUNT_CONTROL_ROLE.exec(stmt);
+  if (!role)
+    return false;
+  const rest = stmt.slice(role.index + role[0].length, role.index + role[0].length + 300);
+  const close = rest.indexOf("}");
+  const options = close < 0 ? rest : rest.slice(0, close);
+  const name = options.match(/(?:^|[\s,])name\s*:\s*/);
+  return name !== null && ACCOUNT_EMAIL_ENV.test(options.slice(name.index + name[0].length));
+}
+function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine, persistence, signedIn) {
   if (mutated && hasAttributeTransition(stmts))
     return { kind: "durable" };
   const notices = [];
@@ -5944,6 +6323,13 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
   };
   let presenceText;
   const presence = () => presenceText ??= stmts.filter((o) => !ABSENCE_MATCHER.test(o.stmt) && !NEGATED_ASSERT.test(o.stmt)).map((o) => o.stmt).join("\n");
+  let shownAccounts;
+  const shown = () => {
+    if (shownAccounts)
+      return shownAccounts;
+    const ref = new RegExp(entered.account.source, "g");
+    return shownAccounts = new Set(stmts.filter((o) => !claimsAbsence(o.stmt)).flatMap((o) => Array.from(o.stmt.matchAll(ref), (m) => m[0])));
+  };
   for (const { stmt, startLine } of stmts) {
     if (firstMutLine !== void 0 && startLine !== void 0 && startLine < firstMutLine)
       continue;
@@ -5951,6 +6337,11 @@ function classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstM
       continue;
     if (COUNT_ONE.test(stmt) && quotedAssertedStrings(stmt).some((t) => clicked.has(t.toLowerCase())))
       continue;
+    if (isVacuousAccountAbsence(stmt, shown, entered.account))
+      continue;
+    if (signedIn && startLine !== void 0 && startLine > signedIn.after && startLine < signedIn.until && isAccountControlCheck(stmt)) {
+      return { kind: "durable" };
+    }
     if (creditsOutcomeAlways(stmt, entered, startLine))
       return { kind: "durable" };
     if (mutated && !NEGATED_ASSERT.test(stmt) && MESSAGE_SURFACE.test(stmt) && OUTCOME_TEXT.test(assertedText(stmt))) {
@@ -6032,6 +6423,53 @@ function noticeOnlyExemption(clicked, noticeText, interactionStmts) {
 function detectOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine) {
   return classifyOutcomeProof(stmts, mutated, reloaded, clicked, entered, firstMutLine).kind !== "none";
 }
+function clickLabel(stmt) {
+  let label = null;
+  for (const m of stmt.matchAll(CONTROL_LABEL))
+    label = m[2] ?? m[3] ?? null;
+  return label;
+}
+function teardownLines(lines) {
+  const out = new Array(lines.length).fill(false);
+  let open = false;
+  let depth = 0;
+  for (let i = 0; i < lines.length; i++) {
+    const ln = stripLineComment2(lines[i]).trim();
+    let from = 0;
+    if (!open) {
+      const m = TEARDOWN_OPEN.exec(ln);
+      if (!m)
+        continue;
+      open = true;
+      depth = 0;
+      from = m.index;
+    }
+    out[i] = true;
+    let closed = false;
+    let quote = null;
+    for (let k = from; k < ln.length; k++) {
+      const ch = ln[k];
+      if (quote !== null) {
+        if (ch === "\\")
+          k++;
+        else if (ch === quote)
+          quote = null;
+        continue;
+      }
+      if (ch === "'" || ch === '"' || ch === "`")
+        quote = ch;
+      else if (ch === "{")
+        depth++;
+      else if (ch === "}") {
+        depth--;
+        closed = true;
+      }
+    }
+    if (depth <= 0 && closed)
+      open = false;
+  }
+  return out;
+}
 function validateAssertionStrength(code, opts = {}) {
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
@@ -6075,7 +6513,13 @@ function validateAssertionStrength(code, opts = {}) {
   const interactionStmts = inlineLocatorBindings(interactionStmtsRaw);
   const blockIds = testBlockIds(lines);
   const blockOfLine = (line) => blockIds?.[line - 1] ?? 0;
-  const checks = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine);
+  const hoistedReads = assertionStrengthHoistedReadsOn();
+  const boundAt = hoistedReads ? /* @__PURE__ */ new Map() : void 0;
+  const resolved = resolveSubjectBindings(stmts, scopedLocatorBindings(interactionStmtsWithLines, blockOfLine), blockOfLine, boundAt);
+  const checks = boundAt === void 0 ? resolved : resolved.flatMap((s) => {
+    const from = boundAt.get(s);
+    return plainAssertion(s, from !== void 0 && actsBetween(interactionStmtsWithLines, from, s.startLine));
+  });
   const insideTest = linesInsideTestBlocks(lines);
   const inTestOrder = (i) => insideTest === null || insideTest[interactionStmtsWithLines[i].startLine - 1] === true;
   let mutated = opts.interactionPerformed === true;
@@ -6085,9 +6529,34 @@ function validateAssertionStrength(code, opts = {}) {
   let navClicks = 0;
   const persistence = { mutLines: [], reloadLines: [], reloadCalls: [] };
   const openedPages = /* @__PURE__ */ new Set();
+  let checkedPage = null;
+  const savedOnCheckedPage = /* @__PURE__ */ new Set();
+  const saveAt = (i, at) => {
+    lastMutIdx = i;
+    if (!inTestOrder(i))
+      return;
+    persistence.mutLines.push(at);
+    if (firstMutIdx < 0)
+      firstMutIdx = i;
+    if (checkedPage !== null)
+      savedOnCheckedPage.add(checkedPage);
+  };
+  const lastActionProof = opts.lastActionProof ?? "off";
+  const teardown = lastActionProof === "off" ? null : teardownLines(lines);
+  const acts = { last: null, prev: null, count: 0 };
+  const noteAct = (i, at, kind) => {
+    if (teardown === null || teardown[at - 1] || !inTestOrder(i))
+      return;
+    if (kind !== "enter")
+      acts.count++;
+    acts.prev = acts.last;
+    acts.last = { i, kind };
+  };
   for (let i = 0; i < interactionStmts.length; i++) {
     const ln = interactionStmts[i];
     const at = interactionStmtsWithLines[i].startLine;
+    if (teardown !== null && acts.last?.kind === "fill" && ENTER_PRESS.test(ln))
+      noteAct(i, at, "enter");
     if (RELOAD.test(ln)) {
       persistence.reloadLines.push(at);
       persistence.reloadCalls.push(at);
@@ -6095,32 +6564,31 @@ function validateAssertionStrength(code, opts = {}) {
     const opened = ln.match(/\.goto\s*\(\s*([^,)]+)/);
     if (opened) {
       const page = opened[1].trim();
-      if (openedPages.has(page))
+      const path = namedPagePath(page);
+      if (openedPages.has(page) || path !== null && savedOnCheckedPage.has(path))
         persistence.reloadLines.push(at);
-      else
-        openedPages.add(page);
-    }
+      openedPages.add(page);
+      checkedPage = null;
+    }
+    if (/\bpage\s*\.\s*go(?:Back|Forward)\s*\(/.test(ln))
+      checkedPage = null;
+    const checked = URL_CHECK_ARG.exec(ln);
+    if (checked)
+      checkedPage = namedPagePath(checked[1] ?? checked[2]);
     if (FORM_INPUT.test(ln)) {
       mutated = true;
-      lastMutIdx = i;
-      if (inTestOrder(i)) {
-        persistence.mutLines.push(at);
-        if (firstMutIdx < 0)
-          firstMutIdx = i;
-      }
+      saveAt(i, at);
+      noteAct(i, at, "fill");
       continue;
     }
     if (ANY_CLICK.test(ln)) {
       if (NAV_LOCATOR.test(ln)) {
         navClicks++;
+        checkedPage = null;
       } else {
         mutated = true;
-        lastMutIdx = i;
-        if (inTestOrder(i)) {
-          persistence.mutLines.push(at);
-          if (firstMutIdx < 0)
-            firstMutIdx = i;
-        }
+        saveAt(i, at);
+        noteAct(i, at, "click");
       }
     }
   }
@@ -6153,9 +6621,28 @@ function validateAssertionStrength(code, opts = {}) {
     };
   }
   const orderedPersistence = firstMutLine !== void 0 ? persistence : void 0;
-  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence);
+  const signedIn = signInProofWindow(interactionStmts, interactionStmtsWithLines, lines, blockIds);
+  const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn);
   if (proof.kind === "durable") {
     const signals2 = base2({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal });
+    const { last, prev } = acts;
+    if (teardown !== null && last !== null && acts.count >= 2 && last.kind !== "fill" && (last.kind === "enter" || isCommitClick(interactionStmts[last.i]) && !(prev?.kind === "click" && isDestructiveClick(interactionStmts[prev.i])))) {
+      const lastLine = interactionStmtsWithLines[last.i].startLine;
+      const clicked = clickedControlNames(interactionStmts);
+      const after = classifyOutcomeProof(checks, mutated, reloaded, clicked, entered, lastLine, orderedPersistence, signedIn);
+      const unproven = after.kind === "none" || after.kind === "notice" && noticeOnlyExemption(clicked, after.noticeText, interactionStmts) === null;
+      if (unproven && lastActionProof === "on") {
+        const line = (keptScaffoldingLines(code.split("\n"))[lastLine - 1] ?? lastLine - 1) + 1;
+        return {
+          ok: false,
+          severity: "block",
+          reason: `the last save (line ${line}) has no outcome check after it (the earlier check proves only the earlier action)`,
+          signals: { ...signals2, lastActionUnproven: true }
+        };
+      }
+      if (unproven)
+        signals2.lastActionUnproven = true;
+    }
     return { ok: true, severity: "none", reason: "proves an outcome (count / diff / value / revealed content)", signals: signals2 };
   }
   if (mutated && proof.kind === "notice") {
@@ -6204,7 +6691,7 @@ function validateAssertionStrength(code, opts = {}) {
         signals
       };
     }
-    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && URL_PROOF.test(s));
+    const urlProofAfter = interactionStmts.some((s, i) => i > lastMutIdx && isUrlProof(s));
     if (urlProofAfter) {
       return {
         ok: false,
@@ -6241,7 +6728,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -6250,6 +6737,7 @@ var init_assertion_strength = __esm({
     init_assertion_proof();
     init_auth_handoff_coverage();
     init_expect_call();
+    init_auth_plan();
     ERROR_BANNER = /(client-side exception|application error|something (?:went wrong|broke)|unhandled (?:exception|error|rejection)|runtime error|error boundary|an unexpected error|internal server error|\b5\d\d\s+(?:internal\s+)?server error|stack trace|chunkloaderror|hydration failed|maximum update depth exceeded)/i;
     OUTCOME_ALWAYS = [
       /\.toHaveCount\s*\(/,
@@ -6266,7 +6754,7 @@ var init_assertion_strength = __esm({
       // form field value
       /\.toMatch\s*\(/,
       // string/regex content match (e.g. textContent() vs /[2-9] selected/)
-      /(?<!\.not\s*)\.\s*toBeDisabled\s*\(/,
+      /\.(?<!\.not\s*\.)\s*toBeDisabled\s*\(/,
       // a control became DISABLED — a gating/validation outcome (not.toBeDisabled is the toBeEnabled twin)
       /\.not\.toBeVisible\s*\(/,
       /\.toBeHidden\s*\(/
@@ -6275,12 +6763,16 @@ var init_assertion_strength = __esm({
     FORM_INPUT = /\.(fill|selectOption|setInputFiles|check|uncheck|setChecked|pressSequentially)\s*\(|keyboard\.type\s*\(/;
     ANY_CLICK = /\.click\s*\(/;
     NAV_LOCATOR = /getByRole\s*\(\s*['"`](?:link|menuitem)['"`]/i;
-    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)|\bexpect\s*\.\s*poll\s*\(\s*(?:async\s*)?\(\s*\)\s*=>\s*(?:\{\s*return\s+)?page\s*\.\s*url\s*\(\s*\)/;
+    URL_PROOF = /\.toHaveURL\s*\(|\.waitForURL\s*\(|\bexpect\s*\(\s*(?:await\s+)?page\s*\.\s*url\s*\(\s*\)\s*\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
+    POLL_OPEN = /\bexpect\s*\.\s*poll\s*\(/g;
+    POLL_PAGE_URL = /^page\s*\.\s*url\s*\(\s*\)/;
+    POLL_PAGE_URL_ONLY = /^page\s*\.\s*url\s*\(\s*\)$/;
+    POLL_CALLS_MAX = 8;
     RELOAD = /\.reload\s*\(/;
     EXPECT_STMT = /\bexpect\s*[.(]/;
     BLOCK_SCAFFOLD2 = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     TEST_BLOCK_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow|serial|describe\.serial))?\s*\(|^(?:test\.)?(?:beforeEach|beforeAll)\s*\(/;
-    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
+    LOCATOR_BINDING = /^(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=(?:\s*(?!\s)|\s*(?=\s(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\())(.+?(?:getByRole|getByText|getByLabel|getByPlaceholder|getByTestId|getByAltText|getByTitle|locator)\s*\(.+)$/;
     EXPECT_OPEN = /\bexpect(?:\.soft)?\s*\(/;
     STATE_MATCHER = /\.(toBeChecked|toBeVisible|toHaveValue|toBeDisabled|toBeEnabled)\s*\(/;
     CHROME_LOCATOR = /getByRole\s*\(\s*['"`](?:heading|navigation|banner|main|contentinfo|complementary|region|search|tablist|tab|button|link|menuitem|textbox|searchbox|combobox|spinbutton)['"`]/i;
@@ -6300,7 +6792,7 @@ var init_assertion_strength = __esm({
     EMPTY_STATE_TEXT = /\bno\b[\s\S]{0,24}?\b(yet|found|results?|items?|favou?rites?|entries|records?|matches|posts?|comments?)\b|nothing (?:here|yet|to show|found)|\bempty\b|\(\s*0\s*\)|\b0\s+(?:favou?rites?|results?|items?|entries|records?|matches|posts?|comments?)\b/i;
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
-    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
+    LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*(?:;\s*)?$/;
     INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
     INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\s*\.\s*to[A-Z]\w*|\.toBeHidden\s*\(/;
@@ -6310,7 +6802,7 @@ var init_assertion_strength = __esm({
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
     FAILURE_STATUS_ASSERT = [
       /\.status\s*\(\s*\)[^;]{0,200}\.(?:toBeGreaterThanOrEqual|toBeGreaterThan)\s*\(\s*(?:399|[45]\d\d)\b/,
-      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\))?\s*>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
+      /\bexpect\s*\(\s*[^;]{0,200}\bstatus\s*(?:\(\s*\)\s*)?>=?\s*(?:399|[45]\d\d)\b[^;]{0,200}\)\s*\.\s*(?:toBe\s*\(\s*true|toBeTruthy)/,
       /\bexpect\s*\([^;]{0,200}\.ok\s*\(\s*\)\s*\)\s*\.\s*(?:toBe\s*\(\s*false\s*\)|toBeFalsy\s*\()/
     ];
     FAILED_LIST_ASSERT = /\bexpect\s*\(\s*[^;]{0,200}(?:fail|abort|error)\w{0,40}(?:\.length)?\s*\)\s*\.\s*(?:toBeGreaterThan\s*\(\s*0|toHaveLength\s*\(\s*[1-9]|not\s*\.\s*toHaveLength\s*\(\s*0|not\s*\.\s*toEqual\s*\(\s*\[\s*\])/i;
@@ -6325,6 +6817,7 @@ var init_assertion_strength = __esm({
     NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    SCOPING_STEP = /(?:\s*\.\s*(?:first|last|nth)\s*\([^()]*\))*\s*\.\s*(?:getBy[A-Z]\w*|locator|filter)\s*\(/y;
     NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
     ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
     REQUEST_WORD = /\brequest\b/;
@@ -6351,6 +6844,9 @@ var init_assertion_strength = __esm({
     ENV_READ = String.raw`process\.env(?:(?:\?\.|\.)([A-Za-z_]\w*)|(?:\?\.)?\[\s*['"]([A-Za-z_]\w*)['"]\s*\])`;
     ENTERED_ENV = new RegExp(String.raw`\.(?:fill|pressSequentially)\s*\(\s*${ENV_READ}|keyboard\.type\s*\(\s*${ENV_READ}`, "g");
     HAVE_VALUE_ENV = new RegExp(String.raw`\.toHaveValue\s*\(\s*${ENV_READ}`);
+    ACCOUNT_KEYS = TEST_USER_ENV_KEYS.join("|");
+    ACCOUNT_ENV = `process\\.env(?:\\??\\.(?:${ACCOUNT_KEYS})\\b|(?:\\?\\.)?\\[\\s*['"\`](?:${ACCOUNT_KEYS})['"\`]\\s*\\])`;
+    ACCOUNT_CONST = new RegExp(`\\b(?:const|let|var)\\s+([A-Za-z_$][\\w$]*)\\s*(?::\\s*string\\s*)?=\\s*${ACCOUNT_ENV}`, "g");
     IN_FLIGHT_TEXT = /^(?:(?:sending|saving|loading|searching|checking|processing|submitting|preparing|updating|please wait|working|one moment)\b[^.]{0,40}\.{2,3}|\.{3}|…)$/i;
     LOCATOR_VALUE_READ = /\.(?:count|textContent|innerText|innerHTML|inputValue|getAttribute|isVisible|isHidden|isChecked|isEnabled|isDisabled|isEditable|allTextContents|allInnerTexts|evaluate|evaluateAll|boundingBox|all)\s*\(/;
     LOCATOR_EXPR = /^(?:this\.)?page\s*\.\s*(?:getBy\w+|locator)\s*\(/;
@@ -6362,20 +6858,47 @@ var init_assertion_strength = __esm({
     IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
     PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
     COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
+    URL_CHECK_ARG = /\bpage\s*\.\s*waitForURL\s*\(\s*([^,)]+)|\bexpect(?:\s*\.\s*soft)?\s*\(\s*page\s*\)\s*\.\s*toHaveURL\s*\(\s*([^,)]+)/;
+    PLAIN_PAGE_PATH = /^\/[\w\-./~%]*(?:[?#][^\s]*)?$/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
     CONTROL_VALUE_MATCHER = /\.(?:toHaveValue|toHaveText|toContainText)\s*\(|\.toHaveAttribute\s*\(\s*['"`]aria-checked['"`]/;
+    ACCOUNT_EMAIL_ENV = /^process\.env(?:(?:\?\.|\.)TEST_USER_EMAIL\b|(?:\?\.)?\[\s*['"]TEST_USER_EMAIL['"]\s*\])/;
+    ENV_PASSWORD_ENTRY = /\.(?:fill|pressSequentially)\s*\(\s*process\.env(?:(?:\?\.|\.)TEST_USER_PASSWORD\b|(?:\?\.)?\[\s*['"]TEST_USER_PASSWORD['"]\s*\])/;
+    ACCOUNT_CONTROL_ROLE = /getByRole\s*\(\s*['"`](?:button|link|menuitem)['"`]\s*,\s*\{/;
+    ASSERT_OR_WAIT = /^(?:await\s+)?(?:expect(?:\.soft|\.poll)?\s*\(|[\w$]+(?:\.[\w$]+)*\.waitFor[A-Za-z]*\s*\()/;
+    ACTS = /\.(?:click|dblclick|tap|press|pressSequentially|fill|clear|type|check|uncheck|setChecked|selectOption|setInputFiles|dispatchEvent|hover|focus|dragTo|goto|reload|goBack|goForward|evaluate|evaluateHandle)\s*\(|\b(?:keyboard|mouse|touchscreen)\s*\.|\.toPass\s*\(/;
+    actLinesOf = /* @__PURE__ */ new WeakMap();
+    CLOSERS_ONLY = /^[})\];,\s]+$/;
+    TEST_BODY_OPEN = /^(?:test|it)(?:\.(?:only|skip|fixme|slow))?\s*\(/;
     COPY_CONTROL = /\bcopy\b/i;
     COPIED_NOTICE = /\bcopied\b/i;
     SEND_CONTROL = /\b(send|submit|subscribe|sign up for|contact|feedback|join (the )?waitlist)\b/i;
     SEND_NOTICE = /\b(thank|thanks|sent|subscribed|received|in touch)\b/i;
     MARK_READ_CONTROL = /\bmark(?:ed)? as read\b|\bmark all(?: as)? read\b/i;
     APP_DATA_FIELD = /\b(title|name of|amount|price|quantity|sku|status|due|assignee|project|ticket|invoice|order)\b/i;
+    COMMIT_CONTROL = /\b(?:save|submit|update|apply|add|create|post|send|publish)\b|\bconfirm\s+changes\b/i;
+    NOT_COMMIT_CONTROL = /\b(?:delete|remove|cancel|close|dismiss|discard|back|sign\s*out|log\s*out|logout|done|ok|got\s+it|export|download)\b/i;
+    DESTRUCTIVE_CONTROL = /\b(?:delete|remove|discard)\b/i;
+    ENTER_PRESS = /\.press\s*\(\s*['"`]Enter['"`]/;
+    CONTROL_LABEL = /(?:name\s*:\s*|getBy(?:Text|Label|Title|TestId)\s*\(\s*|has-text\(\s*)(?:(['"`])((?:(?!\1).)*)\1|\/((?:\\.|[^/\\])+)\/)/g;
+    isCommitClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && COMMIT_CONTROL.test(label) && !NOT_COMMIT_CONTROL.test(label) && !EXCLUDE_AFFORDANCE.test(label);
+    };
+    isDestructiveClick = (stmt) => {
+      const label = clickLabel(stmt);
+      return label !== null && DESTRUCTIVE_CONTROL.test(label);
+    };
+    TEARDOWN_OPEN = /\bfinally\s*\{|^(?:test\.)?(?:after|before)(?:Each|All)\s*\(/;
   }
 });
 
 // ../shared/dist/run-classification.js
-function isUserCancelledError(error2) {
-  return typeof error2 === "string" && error2.trim().startsWith(USER_CANCELLED_RUN_ERROR);
+function isCancelledReason(error2) {
+  if (typeof error2 !== "string")
+    return false;
+  const text = error2.trim();
+  return CANCELLED_REASON_PREFIXES.some((prefix) => text.startsWith(prefix));
 }
 function isHeldHealRun(run) {
   return run?.status === "PASSED" && typeof run.error === "string" && run.error.startsWith(HEAL_PATCH_HELD_RUN_ERROR_PREFIX);
@@ -6408,7 +6931,7 @@ function pickLatestHealthRun(runs) {
   for (const run of runs) {
     if (run.mode === "auth-setup")
       continue;
-    if (run.status === "ERROR" && isUserCancelledError(run.error))
+    if (run.status === "ERROR" && isCancelledReason(run.error))
       continue;
     if (isHeldHealRun(run))
       continue;
@@ -6426,6 +6949,15 @@ function pickDisplayRun(runs) {
     return latest;
   return pickLatestHealthRun(runs) ?? latest;
 }
+function featureRowRunStatus(runs) {
+  const latest = runs.find((run) => run.mode !== "auth-setup");
+  if (!latest)
+    return null;
+  const decisive = pickLatestHealthRun(runs.filter((run) => !isEnvironmentalError(run)));
+  if (decisive)
+    return decisive.status;
+  return latest.status === "PENDING" || latest.status === "RUNNING" ? latest.status : null;
+}
 function isEnvironmentalError(run) {
   if (!run)
     return false;
@@ -6457,7 +6989,7 @@ function classifyErrorMessage(error2) {
     return "config_issue";
   if (EMAIL_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
     return "email_not_received";
-  if (isUserCancelledError(error2))
+  if (isCancelledReason(error2))
     return "cancelled";
   if (isRetriedRunInterruption(error2))
     return "interrupted";
@@ -6492,7 +7024,7 @@ function heldHealRunWhere() {
 function excludeCancelledRunsWhere() {
   return {
     NOT: [
-      { status: "ERROR", error: { not: null, startsWith: USER_CANCELLED_RUN_ERROR } },
+      { status: "ERROR", OR: CANCELLED_REASON_PREFIXES.map((prefix) => ({ error: { not: null, startsWith: prefix } })) },
       heldHealRunWhere()
     ]
   };
@@ -6570,11 +7102,25 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
     USER_CANCELLED_RUN_ERROR = "Cancelled by user";
+    PLATFORM_SUPPORT_CANCELLED_RUN_ERROR = "Cancelled by platform support";
+    PLATFORM_ADMIN_CANCELLED_RUN_ERROR = "Cancelled by platform admin";
+    ADMIN_FORCE_CANCELLED_RUN_ERROR = "Admin force-cancelled all active runs";
+    CHAIN_CANCELLED_RUN_ERROR = "Cancelled: parent run cancelled";
+    RETRY_HELD_RUN_ERROR = "Cancelled: auto generation paused";
+    CANCELLED_REASON_PREFIXES = [
+      USER_CANCELLED_RUN_ERROR,
+      PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
+      PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
+      ADMIN_FORCE_CANCELLED_RUN_ERROR,
+      CHAIN_CANCELLED_RUN_ERROR,
+      RETRY_HELD_RUN_ERROR
+    ];
+    isUserCancelledError = isCancelledReason;
     HEAL_PATCH_HELD_RUN_ERROR_PREFIX = "Heal patch held";
     RUNNER_INTERRUPT_ERROR_PREFIX = "Runner shutting down";
     SERVER_INTERRUPT_ERROR_PREFIX = "Run interrupted by server restart";
@@ -6603,9 +7149,10 @@ var init_run_classification = __esm({
     ];
     ENVIRONMENTAL_ERROR_STORED_PREFIXES = [
       ...ENVIRONMENTAL_ERROR_PREFIXES.flatMap((prefix) => [prefix, `Error: ${prefix}`]),
-      // Written by the cancel routes as is, with no prefix wrapper.
-      USER_CANCELLED_RUN_ERROR
+      // Written by the cancels as is, with no prefix wrapper.
+      ...CANCELLED_REASON_PREFIXES
     ];
+    FEATURE_ROW_RUN_WINDOW = 10;
     BUG_SURFACE_SUPPRESSING_TAGS = ["@rate-limit-blocked", "@quota-exceeded", "@auth-lost"];
     QUARANTINE_CLOSE_TAGS = [
       "@bug-found",
@@ -9014,201 +9561,27 @@ function sanitizeAdminViewReturnTo(value) {
     return ADMIN_VIEW_DEFAULT_RETURN_TO;
   let url;
   try {
-    url = new URL(trimmed, PLACEHOLDER_ORIGIN);
-  } catch {
-    return ADMIN_VIEW_DEFAULT_RETURN_TO;
-  }
-  if (url.origin !== PLACEHOLDER_ORIGIN)
-    return ADMIN_VIEW_DEFAULT_RETURN_TO;
-  if (BLOCKED_PATH_RE.test(url.pathname))
-    return ADMIN_VIEW_DEFAULT_RETURN_TO;
-  const out = `${url.pathname}${url.search}${url.hash}`;
-  if (out.startsWith("//") || out.includes("\\"))
-    return ADMIN_VIEW_DEFAULT_RETURN_TO;
-  return out;
-}
-var ADMIN_VIEW_DEFAULT_RETURN_TO, MAX_RETURN_TO_LENGTH, PLACEHOLDER_ORIGIN, BLOCKED_PATH_RE;
-var init_admin_view_return_to = __esm({
-  "../shared/dist/admin-view-return-to.js"() {
-    "use strict";
-    ADMIN_VIEW_DEFAULT_RETURN_TO = "/sessions";
-    MAX_RETURN_TO_LENGTH = 2048;
-    PLACEHOLDER_ORIGIN = "https://admin-view.invalid";
-    BLOCKED_PATH_RE = /^\/(?:login|admin-view)/i;
-  }
-});
-
-// ../shared/dist/auth-plan.js
-function hasInlineLoginSteps(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
-}
-function hasGeneratedAuthGuard(playwrightCode) {
-  if (!playwrightCode)
-    return false;
-  return /\/\/ >>> VALIDATE_QA_AUTH v(\d+)\b[\s\S]*?process\.env\.AUTH_FILE[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH v\1\b/.test(playwrightCode);
-}
-function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
-  if (!sharedAuthInjectEnabled)
-    return false;
-  if (tags.includes("@auth"))
-    return false;
-  if (tags.includes("@api"))
-    return true;
-  if (!tags.includes("@needs-auth"))
-    return false;
-  if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
-    return true;
-  const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
-  return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
-}
-function codeReadsStoredCredentials(code) {
-  if (!code)
-    return false;
-  if (/__vqaLogin\b/.test(code))
-    return true;
-  for (const m of code.matchAll(/TEST_[A-Z0-9_]+/g)) {
-    if (/_(?:EMAIL|PASSWORD)/.test(m[0]))
-      return true;
-  }
-  for (const m of code.matchAll(/process\.env\s*\[([^\]]*)\]?/g)) {
-    if (!/^\s*(['"])[^'"`]*\1\s*$/.test(m[1]))
-      return true;
-  }
-  return false;
-}
-function explicitAuthTypeTags(t) {
-  const found = /* @__PURE__ */ new Set();
-  for (const tag of t) {
-    if (AUTH_TYPE_TAGS.includes(tag))
-      found.add(tag);
-    else if (Object.hasOwn(AUTH_TAG_ALIASES, tag))
-      found.add(AUTH_TAG_ALIASES[tag]);
-  }
-  return [...found];
-}
-function invalidPlan(configurationError) {
-  return {
-    version: 1,
-    source: "invalid",
-    acquisition: "unsupported",
-    presentation: "none",
-    needsCookieState: false,
-    needsStandingHeaders: false,
-    standingHeadersMode: "none",
-    needsLoginCreds: false,
-    requiredEnvKeys: [],
-    configurationError
-  };
-}
-function explicitPlan(authTypeTag2, acquisition, presentation, opts) {
-  return {
-    version: 1,
-    source: "explicit",
-    authTypeTag: authTypeTag2,
-    acquisition,
-    presentation,
-    needsCookieState: opts.cookie,
-    needsStandingHeaders: opts.standingMode === "required",
-    standingHeadersMode: opts.standingMode,
-    needsLoginCreds: TEST_USER_ENV_KEYS.every((k) => opts.requiredEnvKeys.includes(k)),
-    requiredEnvKeys: opts.requiredEnvKeys
-  };
-}
-function deriveAuthPlan(tags, code, opts) {
-  const t = Array.isArray(tags) ? tags : [];
-  const sharedFlag = opts?.sharedAuthInjectEnabled ?? false;
-  const isApi = t.includes("@api");
-  const explicit = isApi ? explicitAuthTypeTags(t) : [];
-  if (explicit.length > 0) {
-    if (t.includes("@auth")) {
-      return invalidPlan("@auth (self-login UI) cannot be combined with an explicit @api auth-type tag");
-    }
-    const loginCompose = explicit.filter((e) => e === AUTH_TAG_COOKIE_STATE || e === AUTH_TAG_LOGIN_COOKIE || e === AUTH_TAG_LOGIN_BEARER);
-    if (explicit.length === 2 && explicit.includes(AUTH_TAG_STANDING) && loginCompose.length === 1) {
-      const composedKeys = [...TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY];
-      switch (loginCompose[0]) {
-        case AUTH_TAG_COOKIE_STATE:
-          return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_COOKIE:
-          return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-        case AUTH_TAG_LOGIN_BEARER:
-          return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "required", requiredEnvKeys: composedKeys });
-      }
-    }
-    if (explicit.length > 1) {
-      return invalidPlan(`conflicting auth-type tags: ${explicit.join(", ")}`);
-    }
-    switch (explicit[0]) {
-      case AUTH_TAG_UNSUPPORTED:
-        return {
-          ...invalidPlan("auth scheme not yet drivable (e.g. HMAC / mTLS / provider-replay) \u2014 needs manual configuration")
-        };
-      case AUTH_TAG_NONE:
-        return explicitPlan(AUTH_TAG_NONE, "none", "none", { cookie: false, standingMode: "none", requiredEnvKeys: [] });
-      case AUTH_TAG_STANDING:
-        return explicitPlan(AUTH_TAG_STANDING, "standing-secret", "standing-header", { cookie: false, standingMode: "required", requiredEnvKeys: [API_AUTH_HEADERS_ENV_KEY] });
-      case AUTH_TAG_LOGIN_BEARER:
-        return explicitPlan(AUTH_TAG_LOGIN_BEARER, "request-login", "bearer", { cookie: false, standingMode: "none", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_LOGIN_COOKIE:
-        return explicitPlan(AUTH_TAG_LOGIN_COOKIE, "request-login", "cookie", { cookie: false, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-      case AUTH_TAG_COOKIE_STATE:
-        return explicitPlan(AUTH_TAG_COOKIE_STATE, "browser-bootstrap", "cookie", { cookie: sharedFlag, standingMode: "legacy-if-configured", requiredEnvKeys: [...TEST_USER_ENV_KEYS] });
-    }
-  }
-  const cookie = legacyNeedsCookieState(t, code, sharedFlag);
-  const authedLegacy = t.includes("@auth") || t.includes("@needs-auth") || isApi;
-  const selfLoginWithoutStoredCreds = t.includes("@auth") && !t.includes("@needs-auth") && !isApi && !!code?.trim() && !/TEST_USER_EMAIL|TEST_USER_PASSWORD|__vqaLogin\b/.test(code);
-  const apiWithoutStoredCreds = isApi && !t.includes("@auth") && !t.includes("@needs-auth") && !!code?.trim() && !codeReadsStoredCredentials(code);
-  const needsLoginCreds = authedLegacy && !selfLoginWithoutStoredCreds && !apiWithoutStoredCreds;
-  return {
-    version: 1,
-    source: "legacy",
-    acquisition: cookie ? "browser-bootstrap" : authedLegacy ? "request-login" : "none",
-    presentation: authedLegacy ? "cookie" : "none",
-    needsCookieState: cookie,
-    needsStandingHeaders: false,
-    // A legacy bare-@api test keeps injecting standing headers IF the project configured them
-    // (preserving today's behavior) — but does not require them. Non-@api legacy tests never inject.
-    standingHeadersMode: isApi ? "legacy-if-configured" : "none",
-    needsLoginCreds,
-    requiredEnvKeys: needsLoginCreds ? [...TEST_USER_ENV_KEYS] : []
-  };
-}
-function authTypeTag(tags) {
-  const t = Array.isArray(tags) ? tags : [];
-  const explicit = explicitAuthTypeTags(t);
-  return explicit.length === 1 ? explicit[0] : void 0;
+    url = new URL(trimmed, PLACEHOLDER_ORIGIN);
+  } catch {
+    return ADMIN_VIEW_DEFAULT_RETURN_TO;
+  }
+  if (url.origin !== PLACEHOLDER_ORIGIN)
+    return ADMIN_VIEW_DEFAULT_RETURN_TO;
+  if (BLOCKED_PATH_RE.test(url.pathname))
+    return ADMIN_VIEW_DEFAULT_RETURN_TO;
+  const out = `${url.pathname}${url.search}${url.hash}`;
+  if (out.startsWith("//") || out.includes("\\"))
+    return ADMIN_VIEW_DEFAULT_RETURN_TO;
+  return out;
 }
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
-var init_auth_plan = __esm({
-  "../shared/dist/auth-plan.js"() {
+var ADMIN_VIEW_DEFAULT_RETURN_TO, MAX_RETURN_TO_LENGTH, PLACEHOLDER_ORIGIN, BLOCKED_PATH_RE;
+var init_admin_view_return_to = __esm({
+  "../shared/dist/admin-view-return-to.js"() {
     "use strict";
-    AUTH_TAG_COOKIE_STATE = "@auth-cookie-state";
-    AUTH_TAG_LOGIN_COOKIE = "@auth-login-cookie";
-    AUTH_TAG_LOGIN_BEARER = "@auth-login-bearer";
-    AUTH_TAG_STANDING = "@auth-standing";
-    AUTH_TAG_NONE = "@auth-none";
-    AUTH_TAG_UNSUPPORTED = "@auth-unsupported";
-    AUTH_TYPE_TAGS = [
-      AUTH_TAG_COOKIE_STATE,
-      AUTH_TAG_LOGIN_COOKIE,
-      AUTH_TAG_LOGIN_BEARER,
-      AUTH_TAG_STANDING,
-      AUTH_TAG_NONE,
-      AUTH_TAG_UNSUPPORTED
-    ];
-    AUTH_TAG_ALIASES = {
-      "@auth-cookie": AUTH_TAG_COOKIE_STATE,
-      "@auth-bearer": AUTH_TAG_LOGIN_BEARER,
-      "@auth-token": AUTH_TAG_LOGIN_BEARER,
-      "@auth-api-key": AUTH_TAG_STANDING,
-      "@auth-standing-header": AUTH_TAG_STANDING
-    };
-    TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
-    API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+    ADMIN_VIEW_DEFAULT_RETURN_TO = "/sessions";
+    MAX_RETURN_TO_LENGTH = 2048;
+    PLACEHOLDER_ORIGIN = "https://admin-view.invalid";
+    BLOCKED_PATH_RE = /^\/(?:login|admin-view)/i;
   }
 });
 
@@ -9219,13 +9592,16 @@ function stripEchoLines(text) {
 function matchesAny(text, patterns) {
   return patterns.some((p) => p.test(text));
 }
+function isIntentionalNegativeAuthTest(input) {
+  const meta = [input.testName, input.description].filter(Boolean).join(" ");
+  return matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH);
+}
 function detectAuthBlock(input) {
   const tags = input.tags ?? [];
   const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
   if (!isAuthed)
     return NO_DETECTION;
-  const meta = [input.testName, input.description].filter(Boolean).join(" ");
-  if (matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH))
+  if (isIntentionalNegativeAuthTest(input))
     return NO_DETECTION;
   const sources = [];
   if (input.error)
@@ -9328,7 +9704,7 @@ var init_auth_block_detector = __esm({
       /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
     ];
     ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
-    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*:?\s*(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
+    UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*(?::\s*)?(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
   }
 });
 
@@ -10269,12 +10645,70 @@ function isSharedAuthInjectEnabled(value = process.env.SHARED_AUTH_INJECT) {
 function isAuthReadinessGuardEnabled(value = process.env.AUTH_READINESS_GUARD) {
   return value?.trim().toLowerCase() !== "false";
 }
+function visualBaselinesEnabled(projectId, raw = process.env.VISUAL_BASELINES_PROJECTS) {
+  if (typeof projectId !== "string" || projectId.trim() === "")
+    return false;
+  const listed = (raw ?? "").split(",").map((entry) => entry.trim()).filter(Boolean);
+  return listed.includes("*") || listed.includes(projectId);
+}
 var init_feature_flags = __esm({
   "../shared/dist/feature-flags.js"() {
     "use strict";
   }
 });
 
+// ../shared/dist/visual-compare-limits.js
+function isSafeMaskSelector(selector) {
+  if (typeof selector !== "string")
+    return false;
+  if (selector.trim().length === 0)
+    return false;
+  if (selector.length > VISUAL_MASK_SELECTOR_MAX_LENGTH)
+    return false;
+  return !VISUAL_MASK_SELECTOR_FORBIDDEN.test(selector);
+}
+var VISUAL_MASK_SELECTORS_MAX, VISUAL_MASK_SELECTOR_MAX_LENGTH, VISUAL_MASK_SELECTOR_FORBIDDEN;
+var init_visual_compare_limits = __esm({
+  "../shared/dist/visual-compare-limits.js"() {
+    "use strict";
+    VISUAL_MASK_SELECTORS_MAX = 50;
+    VISUAL_MASK_SELECTOR_MAX_LENGTH = 300;
+    VISUAL_MASK_SELECTOR_FORBIDDEN = /[{};@<\r\n]/;
+  }
+});
+
+// ../shared/dist/visual-baseline-identity.js
+function isBrowserVersion(value) {
+  return typeof value === "string" && value.length <= 32 && BROWSER_VERSION.test(value);
+}
+function renderIdentity(flavour, version, image) {
+  if (!/^[a-z][a-z-]{0,31}$/.test(flavour) || !/^[a-z][a-z-]{0,31}$/.test(image) || !isBrowserVersion(version))
+    return null;
+  const identity = `${flavour}/${version}/${image}`;
+  return identity.length <= RENDER_IDENTITY_MAX_LENGTH ? identity : null;
+}
+function v1RenderIdentity(version) {
+  return renderIdentity(VISUAL_V1_IDENTITY.flavour, version, VISUAL_V1_IDENTITY.image);
+}
+function parseRenderIdentity(value) {
+  if (typeof value !== "string" || value.length > RENDER_IDENTITY_MAX_LENGTH)
+    return null;
+  const parts = value.split("/");
+  if (parts.length !== 3)
+    return null;
+  const [flavour, version, image] = parts;
+  return renderIdentity(flavour, version, image) === value ? { flavour, version, image } : null;
+}
+var VISUAL_V1_IDENTITY, RENDER_IDENTITY_MAX_LENGTH, BROWSER_VERSION;
+var init_visual_baseline_identity = __esm({
+  "../shared/dist/visual-baseline-identity.js"() {
+    "use strict";
+    VISUAL_V1_IDENTITY = { platform: "linux", image: "runner-fast", flavour: "headless-shell" };
+    RENDER_IDENTITY_MAX_LENGTH = 64;
+    BROWSER_VERSION = /^\d{1,4}(\.\d{1,6}){0,3}$/;
+  }
+});
+
 // ../shared/dist/analytics-url.js
 function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
@@ -10628,14 +11062,9 @@ function isOpenCodeGoModelId(id) {
 function hasOpenCodeGoPrefix(id) {
   return (id?.trim() ?? "").startsWith(OPENCODE_GO_PREFIX);
 }
-function hasOpenCodeGo2Prefix(id) {
-  return (id?.trim() ?? "").startsWith(OPENCODE_GO_2_PREFIX);
-}
 function openCodeGoWireModel(id) {
   const trimmed = id?.trim() ?? "";
-  if (!isOpenCodeGoModelId(trimmed))
-    return null;
-  return trimmed.slice((hasOpenCodeGo2Prefix(trimmed) ? OPENCODE_GO_2_PREFIX : OPENCODE_GO_PREFIX).length);
+  return isOpenCodeGoModelId(trimmed) ? trimmed.slice(OPENCODE_GO_PREFIX.length) : null;
 }
 function isZaiModelId(id) {
   const trimmed = id?.trim() ?? "";
@@ -10744,7 +11173,7 @@ function museCliContributorMode(env = process.env) {
   const raw = (env.MUSE_CLI_CONTRIBUTOR_MODE ?? "").trim().toLowerCase();
   return raw === "off" || raw === "false" || raw === "0" || raw === "no" ? "off" : "on";
 }
-var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_2_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
+var CLI_ENGINE_MODEL_IDS, BROWSER_CLI_ENGINE_IDS, PIPELINE_STEPS, CLI_ENGINE_RULES, ENGINE_NAMES, OPENROUTER_PREFIX, OPENROUTER_MODEL_PATTERN, OPENCODE_GO_PREFIX, OPENCODE_GO_MODEL_PATTERN, ZAI_PREFIX, ZAI_MODEL_PATTERN;
 var init_engine_spec = __esm({
   "../shared/dist/engine-spec.js"() {
     "use strict";
@@ -10803,8 +11232,7 @@ var init_engine_spec = __esm({
     OPENROUTER_PREFIX = "openrouter:";
     OPENROUTER_MODEL_PATTERN = /^openrouter:[a-z0-9][a-z0-9._-]{0,40}\/[A-Za-z0-9._:-]{1,100}$/;
     OPENCODE_GO_PREFIX = "opencode-go:";
-    OPENCODE_GO_2_PREFIX = "opencode-go-2:";
-    OPENCODE_GO_MODEL_PATTERN = /^opencode-go(?:-2)?:[a-z0-9][a-z0-9._-]{0,100}$/;
+    OPENCODE_GO_MODEL_PATTERN = /^opencode-go:[a-z0-9][a-z0-9._-]{0,100}$/;
     ZAI_PREFIX = "zai:";
     ZAI_MODEL_PATTERN = /^zai:glm-[a-z0-9][a-z0-9._-]{0,60}$/;
   }
@@ -11129,14 +11557,19 @@ function has(map2, key) {
 }
 function providerChainFor(modelId) {
   const key = chainKey(modelId);
+  if (key && has(_overrideHops, key))
+    return _overrideHops[key];
   return key && has(PROVIDER_CHAINS, key) ? PROVIDER_CHAINS[key] : [];
 }
 function providerChainLeadsFor(modelId) {
   const key = chainKey(modelId);
+  if (key && has(_overrideLeads, key))
+    return _overrideLeads[key];
   return key && has(PROVIDER_CHAIN_LEADS, key) ? PROVIDER_CHAIN_LEADS[key] : [];
 }
 function allChains() {
-  return [...Object.entries(PROVIDER_CHAINS), ...Object.entries(PROVIDER_CHAIN_LEADS)];
+  const ordered = (map2, override) => [...Object.entries(map2).filter(([key]) => !has(override, key)), ...Object.entries(override)];
+  return [...ordered(PROVIDER_CHAINS, _overrideHops), ...ordered(PROVIDER_CHAIN_LEADS, _overrideLeads)];
 }
 function isProviderChainHopId(modelId) {
   const id = modelId ?? "";
@@ -11153,14 +11586,24 @@ function providerChainHostOf(value, modelValue) {
     return "own";
   if (hasZaiPrefix(value))
     return "zai";
-  if (hasOpenCodeGo2Prefix(value))
-    return "opencode-go-2";
   if (hasOpenCodeGoPrefix(value))
     return "opencode-go";
   if (hasOpenRouterPrefix(value))
     return "openrouter";
   return "own";
 }
+function providerChainHostProvider(value) {
+  if (typeof value !== "string" || !value)
+    return null;
+  if (hasOpenRouterPrefix(value))
+    return "openrouter";
+  if (hasOpenCodeGoPrefix(value))
+    return "opencode-go";
+  if (hasZaiPrefix(value))
+    return "zai";
+  const key = chainKey(value);
+  return API_MODEL_CATALOG.find((m) => m.id === key)?.provider ?? GEMINI_ASSISTANT_MODELS.find((m) => m.id === key)?.provider ?? null;
+}
 function providerHostPlan(modelId) {
   const key = chainKey(modelId);
   if (!key)
@@ -11178,7 +11621,140 @@ function providerHostPlan(modelId) {
   }
   return steps;
 }
-var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED;
+function providerChainModelKey(modelId) {
+  return chainKey(modelId);
+}
+function hasProviderChainLeadsByDefault(modelId) {
+  const key = chainKey(modelId);
+  return key !== null && has(PROVIDER_CHAIN_LEADS, key);
+}
+function isChainablePrimary(id) {
+  return typeof id === "string" && id !== "" && (has(PROVIDER_CHAINS, id) || has(PROVIDER_CHAIN_LEADS, id));
+}
+function defaultProviderChainEntries(primary) {
+  if (!isChainablePrimary(primary))
+    return [];
+  const leads = has(PROVIDER_CHAIN_LEADS, primary) ? PROVIDER_CHAIN_LEADS[primary] : [];
+  const hops = has(PROVIDER_CHAINS, primary) ? PROVIDER_CHAINS[primary] : [];
+  return [...leads, primary, ...hops].map((hop) => ({ hop, enabled: true }));
+}
+function allowedProviderChainHosts(primary) {
+  return defaultProviderChainEntries(primary).map((entry) => entry.hop);
+}
+function isPlainObject2(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) && Object.getPrototypeOf(value) === Object.prototype;
+}
+function validateProviderChainEntries(primary, entries) {
+  if (!isChainablePrimary(primary))
+    return `${String(primary).slice(0, 80)} has no provider chain to order`;
+  if (!Array.isArray(entries))
+    return `${primary}: the chain must be a list`;
+  if (entries.length > PROVIDER_CHAIN_MAX_ENTRIES)
+    return `${primary}: at most ${PROVIDER_CHAIN_MAX_ENTRIES} hosts`;
+  const allowed = allowedProviderChainHosts(primary);
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of entries) {
+    if (!isPlainObject2(entry))
+      return `${primary}: each host must be { hop, enabled }`;
+    const keys = Object.keys(entry);
+    if (keys.length !== 2 || !keys.includes("hop") || !keys.includes("enabled"))
+      return `${primary}: each host must be { hop, enabled } and nothing else`;
+    const { hop, enabled } = entry;
+    if (typeof enabled !== "boolean")
+      return `${primary}: enabled must be true or false`;
+    if (typeof hop !== "string" || !hop)
+      return `${primary}: hop must be a model value`;
+    if (!allowed.includes(hop))
+      return `${primary}: ${hop.slice(0, 80)} is not a host of this model`;
+    if (seen.has(hop))
+      return `${primary}: ${hop} is listed twice`;
+    if (hop === primary && !enabled)
+      return `${primary}: the model's own value stays on (pick another model on AI Models instead)`;
+    seen.add(hop);
+  }
+  if (!seen.has(primary))
+    return `${primary}: list the model's own value once, where its own host sits`;
+  return null;
+}
+function decodeProviderChains(raw) {
+  let value = raw;
+  if (typeof raw === "string") {
+    if (raw.length > PROVIDER_CHAINS_SETTING_MAX_CHARS)
+      return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+    try {
+      value = JSON.parse(raw);
+    } catch {
+      return { ok: false, error: "AI_PROVIDER_CHAINS must be valid JSON" };
+    }
+  } else if (JSON.stringify(raw ?? null).length > PROVIDER_CHAINS_SETTING_MAX_CHARS) {
+    return { ok: false, error: `AI_PROVIDER_CHAINS is too long (at most ${PROVIDER_CHAINS_SETTING_MAX_CHARS} characters)` };
+  }
+  if (!isPlainObject2(value))
+    return { ok: false, error: 'AI_PROVIDER_CHAINS must be an object: { "<model>": [ { "hop": "<model value>", "enabled": true } ] }' };
+  if (Object.keys(value).length > PROVIDER_CHAIN_MAX_PRIMARIES)
+    return { ok: false, error: `AI_PROVIDER_CHAINS names at most ${PROVIDER_CHAIN_MAX_PRIMARIES} models` };
+  return { ok: true, value };
+}
+function checkedProviderChains(value) {
+  const out = {};
+  for (const [primary, entries] of Object.entries(value)) {
+    const problem = validateProviderChainEntries(primary, entries);
+    if (problem)
+      return { ok: false, error: problem };
+    out[primary] = entries.map(({ hop, enabled }) => ({ hop, enabled }));
+  }
+  return { ok: true, value: out };
+}
+function parseProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  return decoded.ok ? checkedProviderChains(decoded.value) : decoded;
+}
+function parseStoredProviderChainOverrides(raw) {
+  const decoded = decodeProviderChains(raw);
+  if (!decoded.ok)
+    return decoded;
+  const dropped = [];
+  const kept = {};
+  for (const [primary, entries] of Object.entries(decoded.value)) {
+    if (!isChainablePrimary(primary) || !Array.isArray(entries)) {
+      kept[primary] = entries;
+      continue;
+    }
+    const allowed = allowedProviderChainHosts(primary);
+    kept[primary] = entries.filter((entry) => {
+      const hop = isPlainObject2(entry) ? entry.hop : void 0;
+      if (typeof hop !== "string" || hop === "" || allowed.includes(hop))
+        return true;
+      dropped.push({ primary, hop: hop.slice(0, 80) });
+      return false;
+    });
+  }
+  const checked = checkedProviderChains(kept);
+  return checked.ok ? { ...checked, dropped } : checked;
+}
+function validateProviderChainsSetting(raw) {
+  const parsed = parseProviderChainOverrides(raw);
+  return parsed.ok ? null : parsed.error;
+}
+function setProviderChainOverrides(value, onDropped) {
+  const parsed = value === null || value === void 0 || value === "" ? null : parseStoredProviderChainOverrides(value);
+  if (parsed?.ok && parsed.dropped.length > 0)
+    onDropped?.(parsed.dropped);
+  _overrides = parsed?.ok ? parsed.value : null;
+  _overrideLeads = {};
+  _overrideHops = {};
+  for (const [primary, entries] of Object.entries(_overrides ?? {})) {
+    const at = entries.findIndex((entry) => entry.hop === primary);
+    const on = (list) => list.filter((entry) => entry.enabled).map((entry) => entry.hop);
+    _overrideLeads[primary] = on(entries.slice(0, at));
+    _overrideHops[primary] = on(entries.slice(at + 1));
+  }
+  return parsed === null || parsed.ok;
+}
+function getProviderChainOverrides() {
+  return _overrides;
+}
+var PROVIDER_CHAINS, PROVIDER_CHAIN_LEADS, PROVIDER_HOST_NOT_OFFERED, PROVIDER_CHAIN_MAX_ENTRIES, PROVIDER_CHAINS_SETTING_MAX_CHARS, PROVIDER_CHAIN_MAX_PRIMARIES, ALLOWED_PROVIDER_CHAIN_HOPS, _overrides, _overrideLeads, _overrideHops;
 var init_provider_chains = __esm({
   "../shared/dist/provider-chains.js"() {
     "use strict";
@@ -11190,18 +11766,120 @@ var init_provider_chains = __esm({
       "muse-spark-1.3-contributor": ["openrouter:meta/muse-spark-1.3-contributor"],
       "claude-haiku-5-5": ["opencode-go:claude-haiku-5-5", "openrouter:anthropic/claude-haiku-5.5"],
       "gemini-3.1-pro-preview": ["openrouter:google/gemini-3.1-pro-preview"],
-      "deepseek-flash": ["opencode-go-2:deepseek-v4.1-flash", "opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
-      "deepseek-v4-pro": ["opencode-go-2:deepseek-v4-pro", "opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
+      "deepseek-flash": ["opencode-go:deepseek-v4.1-flash", "openrouter:deepseek/deepseek-v4.1-flash"],
+      "deepseek-v4-pro": ["opencode-go:deepseek-v4-pro", "openrouter:deepseek/deepseek-v4-pro"]
     };
     PROVIDER_CHAIN_LEADS = {
-      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go-2:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
-      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go-2:glm-5.3", "opencode-go:glm-5.3"],
-      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go-2:glm-5.2", "opencode-go:glm-5.2"]
+      "openrouter:z-ai/glm-5.3-flash": ["zai:glm-5.3-flash", "opencode-go:glm-5.3-flash"],
+      "openrouter:z-ai/glm-5.3": ["zai:glm-5.3", "opencode-go:glm-5.3"],
+      "openrouter:z-ai/glm-5.2": ["zai:glm-5.2", "opencode-go:glm-5.2"]
     };
     PROVIDER_HOST_NOT_OFFERED = {
       "muse-spark-1.3-contributor": { "opencode-go": "OpenCode Go serves Muse only on its Responses API" },
       "gemini-3.1-pro-preview": { "opencode-go": "OpenCode Go does not serve Gemini" }
     };
+    PROVIDER_CHAIN_MAX_ENTRIES = 8;
+    PROVIDER_CHAINS_SETTING_MAX_CHARS = 16e3;
+    PROVIDER_CHAIN_MAX_PRIMARIES = 32;
+    ALLOWED_PROVIDER_CHAIN_HOPS = /* @__PURE__ */ new Set([
+      ...Object.values(PROVIDER_CHAINS).flat(),
+      ...Object.values(PROVIDER_CHAIN_LEADS).flat()
+    ]);
+    _overrides = null;
+    _overrideLeads = {};
+    _overrideHops = {};
+  }
+});
+
+// ../shared/dist/provider-accounts.js
+function modelNames(modelId) {
+  const value = modelId.trim();
+  const names = /* @__PURE__ */ new Set([value]);
+  for (const prefix of HOST_PREFIXES) {
+    if (!value.startsWith(prefix))
+      continue;
+    const bare = value.slice(prefix.length);
+    names.add(bare);
+    const slash = bare.lastIndexOf("/");
+    if (slash >= 0)
+      names.add(bare.slice(slash + 1));
+  }
+  const canonical = canonicalModelId(value);
+  if (canonical) {
+    names.add(canonical);
+    const entry = API_MODEL_CATALOG.find((m) => m.id === canonical || m.apiModel === canonical);
+    if (entry) {
+      names.add(entry.id);
+      if (entry.apiModel)
+        names.add(entry.apiModel);
+    }
+  }
+  return names;
+}
+function accountServesModel(models, modelId) {
+  if (!models || models.length === 0)
+    return true;
+  if (!modelId)
+    return false;
+  const names = modelNames(modelId);
+  return models.some((model) => names.has(model.trim()));
+}
+function normalizeProviderAccountModels(models) {
+  if (!Array.isArray(models))
+    return null;
+  const out = [];
+  for (const model of models) {
+    if (typeof model !== "string")
+      return null;
+    const trimmed = model.trim();
+    if (!PROVIDER_ACCOUNT_MODEL_PATTERN.test(trimmed) || trimmed.includes(".."))
+      return null;
+    if (!out.includes(trimmed))
+      out.push(trimmed);
+  }
+  return out.length > MAX_PROVIDER_ACCOUNT_MODELS ? null : out;
+}
+function parseProviderAccountLists(value, providers) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    return null;
+  const parsed = {};
+  for (const provider of providers) {
+    const list = value[provider];
+    if (!Array.isArray(list))
+      continue;
+    const accounts = [];
+    for (const raw of list) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const { id, label, key, models } = raw;
+      if (typeof id !== "string" || !id.trim() || typeof key !== "string" || !key.trim())
+        continue;
+      const modelList = Array.isArray(models) ? models.filter((m) => typeof m === "string" && m.trim() !== "").map((m) => m.trim()) : [];
+      accounts.push({ id: id.trim(), label: typeof label === "string" && label.trim() ? label.trim() : null, key: key.trim(), models: modelList });
+    }
+    if (accounts.length > 0)
+      parsed[provider] = accounts;
+  }
+  return parsed;
+}
+var DEFAULT_PROVIDER_ACCOUNT_ID, PROVIDER_ACCOUNT_ID_PATTERN, MAX_PROVIDER_ACCOUNTS, MAX_PROVIDER_ACCOUNT_MODELS, PROVIDER_ACCOUNT_MODEL_PATTERN, OPENCODE_GO_DEEPSEEK_GLM_MODELS, HOST_PREFIXES;
+var init_provider_accounts = __esm({
+  "../shared/dist/provider-accounts.js"() {
+    "use strict";
+    init_api_model_catalog();
+    DEFAULT_PROVIDER_ACCOUNT_ID = "primary";
+    PROVIDER_ACCOUNT_ID_PATTERN = /^[a-z0-9][a-z0-9-]{0,39}$/;
+    MAX_PROVIDER_ACCOUNTS = 10;
+    MAX_PROVIDER_ACCOUNT_MODELS = 50;
+    PROVIDER_ACCOUNT_MODEL_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,120}$/;
+    OPENCODE_GO_DEEPSEEK_GLM_MODELS = [
+      "deepseek-v4.1-flash",
+      "deepseek-v4-pro",
+      "glm-5.3-flash",
+      "glm-5.3",
+      "glm-5.2"
+    ];
+    HOST_PREFIXES = ["opencode-go:", "zai:", "openrouter:"];
   }
 });
 
@@ -11320,6 +11998,25 @@ var init_project_engine_overrides = __esm({
   }
 });
 
+// ../shared/dist/trailing-slashes.js
+function stripTrailingSlashes(value) {
+  let end = value.length;
+  while (end > 0 && value.charCodeAt(end - 1) === 47)
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+function stripTrailingChars(value, isTrailing) {
+  let end = value.length;
+  while (end > 0 && isTrailing.test(value[end - 1]))
+    end--;
+  return end === value.length ? value : value.slice(0, end);
+}
+var init_trailing_slashes = __esm({
+  "../shared/dist/trailing-slashes.js"() {
+    "use strict";
+  }
+});
+
 // ../shared/dist/gemini-visual.js
 function visualProDailyBudget(raw) {
   const parsed = raw && /^\s*\d{1,6}\s*$/.test(raw) ? Number(raw.trim()) : NaN;
@@ -11333,7 +12030,7 @@ function isRetiredGeminiModel(id) {
 }
 function geminiNativeModelsUrl(base2 = process.env.GEMINI_API_BASE) {
   const raw = base2 && base2.trim() || GEMINI_OPENAI_BASE;
-  const native = raw.replace(/\/openai\/?$/, "/").replace(/\/+$/, "");
+  const native = stripTrailingSlashes(raw.replace(/\/openai\/?$/, "/"));
   return `${native}/models?pageSize=1000`;
 }
 function asRecord(value) {
@@ -11453,6 +12150,7 @@ var KNOWN_INPUT_USD_PER_M, GEMINI_OPENAI_BASE, DEFAULT_GEMINI_SCREEN_MODEL, DEFA
 var init_gemini_visual = __esm({
   "../shared/dist/gemini-visual.js"() {
     "use strict";
+    init_trailing_slashes();
     KNOWN_INPUT_USD_PER_M = {
       "gemini-2.5-flash-lite": 0.1,
       "gemini-3.1-flash-lite": 0.25,
@@ -12816,12 +13514,13 @@ function truncateAtWord(text, max) {
   const slice = trimmed.slice(0, room + 1);
   const lastSpace = slice.lastIndexOf(" ");
   const cut = lastSpace > room * 0.5 ? slice.slice(0, lastSpace) : trimmed.slice(0, room);
-  return `${cut.replace(/[\s,;:.\-–—]+$/u, "")}\u2026`;
+  return `${stripTrailingChars(cut, TRAILING_PUNCTUATION)}\u2026`;
 }
-var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE;
+var CANVAS_UNSUPPORTED_CODE, CANVAS_UNSUPPORTED_TITLE, CANVAS_UNSUPPORTED_BODY, CANVAS_UNSUPPORTED_NOT_CHARGED, CANVAS_UNSUPPORTED_OVERRIDE_HINT, GAME_ENGINES, RENDERER_ENGINES, ENGINE_TEXT_SIGNATURES, GAME_LIBRARY_TEXT_PATTERNS, ENGINE_PACKAGES, GAME_HINT_PACKAGES, MAX_TAG_CHARS, MAX_CSS_SELECTOR_CHARS, MAX_CSS_BLOCK_CHARS, TAG_NAME_RE, ATTR_RE, INTERACTIVE_TAGS, INTERACTIVE_ROLES, ROOT_SELECTOR_RE, OVERFLOW_HIDDEN_RE, TOUCH_NONE_RE, CODE_TAGS, STATIC_STANDARD_MIN_INTERACTIVE, TRAILING_PUNCTUATION;
 var init_canvas_support = __esm({
   "../shared/dist/canvas-support.js"() {
     "use strict";
+    init_trailing_slashes();
     CANVAS_UNSUPPORTED_CODE = "canvas_unsupported";
     CANVAS_UNSUPPORTED_TITLE = "Games and canvas apps aren't supported yet";
     CANVAS_UNSUPPORTED_BODY = "This app draws its screen on a canvas (like a game), so there are no page elements for Validate.QA to read and test. Support for games and canvas apps is coming.";
@@ -12946,6 +13645,7 @@ var init_canvas_support = __esm({
     TOUCH_NONE_RE = /touch-action\s{0,8}:\s{0,8}none/;
     CODE_TAGS = /* @__PURE__ */ new Set(["script", "link", "flt-glass-pane", "flutter-view", "flt-scene-host"]);
     STATIC_STANDARD_MIN_INTERACTIVE = 3;
+    TRAILING_PUNCTUATION = /[\s,;:.\-–—]/u;
   }
 });
 
@@ -13128,22 +13828,22 @@ function joinChainedLines(code) {
     const trimmed = lines[i].trimStart();
     if (last !== -1 && trimmed.startsWith(".") && !trimmed.startsWith("...")) {
       if (!lastStripped) {
-        lines[last] = stripLineComment2(lines[last]).trimEnd();
+        lines[last] = stripLineComment3(lines[last]).trimEnd();
         lastStripped = true;
       }
       if (lines[last].length <= MAX_LINE_CHARS)
-        lines[last] = `${lines[last]} ${stripLineComment2(trimmed).trimEnd()}`;
+        lines[last] = `${lines[last]} ${stripLineComment3(trimmed).trimEnd()}`;
       lines[i] = "";
       continue;
     }
-    if (stripLineComment2(lines[i]).trim()) {
+    if (stripLineComment3(lines[i]).trim()) {
       last = i;
       lastStripped = false;
     }
   }
   return lines.join("\n");
 }
-function stripLineComment2(rawLine) {
+function stripLineComment3(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -13192,7 +13892,7 @@ function analyzeReadinessPolling(rawCode) {
     offset += rawLine.length + 1;
     if (rawLine.length > MAX_LINE_CHARS)
       continue;
-    const line = stripLineComment2(rawLine);
+    const line = stripLineComment3(rawLine);
     if (!line.trim())
       continue;
     const literals = literalsOf(line);
@@ -13304,7 +14004,7 @@ function blankBlockComments2(code) {
     from = close + 2;
   }
 }
-function stripLineComment3(rawLine) {
+function stripLineComment4(rawLine) {
   if (rawLine.trimStart().startsWith("//"))
     return "";
   const at = rawLine.indexOf(" // ");
@@ -13315,7 +14015,7 @@ function logicalLines(code) {
   for (const raw of code.split("\n")) {
     if (raw.length > MAX_LINE_CHARS2)
       continue;
-    const line = stripLineComment3(raw).trimEnd();
+    const line = stripLineComment4(raw).trimEnd();
     if (!line.trim())
       continue;
     const trimmed = line.trimStart();
@@ -13677,8 +14377,19 @@ function short4(text, max) {
   const flat = text.replace(/\s+/g, " ").trim();
   return flat.length > max ? `${flat.slice(0, max - 1)}\u2026` : flat;
 }
+function stripFractionZeros(s) {
+  let end = s.length;
+  while (end > 0 && s[end - 1] === "0")
+    end--;
+  if (end === s.length)
+    return s;
+  const dot = s.lastIndexOf(".");
+  if (dot < 0)
+    return s;
+  return s.slice(0, end === dot + 1 ? dot : end);
+}
 function digitsOf(token) {
-  return token.replace(/[^\d.]/g, "").replace(/\.0+$|(\.\d*?)0+$/, "$1").replace(/^0+(?=\d)/, "");
+  return stripFractionZeros(token.replace(/[^\d.]/g, "")).replace(/^0+(?=\d)/, "");
 }
 function computes(line) {
   const code = line.replace(STRING_RE, '""').replace(REGEX_LITERAL_RE, "$1RX").replace(LITERAL_ARITH_RE, "N");
@@ -13896,7 +14607,7 @@ function findExpectCalls(code) {
     if (!subj)
       continue;
     const rest = code.slice(subj.end + 1, subj.end + 1 + 80);
-    const mm = /^\s*((?:\.\s*not)?\s*\.\s*(\w+))\s{0,20}\(/.exec(rest);
+    const mm = /^\s*((?:\.\s*not\s*)?\.\s*(\w+))\s{0,20}\(/.exec(rest);
     if (!mm)
       continue;
     const argStart = subj.end + 1 + mm[0].length;
@@ -15846,6 +16557,28 @@ function startsWithRegexLiteral(text) {
   const t = text.trimStart();
   return t[0] === "/" && t[1] !== "/" && t[1] !== "*" && regexLiteralEnd4(t, 0) !== -1;
 }
+function isBareRegexLiteral(text) {
+  const t = text.trimStart();
+  if (t[0] !== "/" || t[1] === "/" || t[1] === "*")
+    return false;
+  const end = regexLiteralEnd4(t, 0);
+  if (end === -1)
+    return false;
+  let i = end;
+  while (i < t.length && /[a-z]/.test(t[i]))
+    i++;
+  while (i < t.length && /\s/.test(t[i]))
+    i++;
+  return i >= t.length || t[i] === ",";
+}
+function regexDeclaredNames(code) {
+  const names = /* @__PURE__ */ new Set();
+  const decl = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,80})\s{0,20}=\s{0,20}(?:\/(?![/*])|new\s{1,20}RegExp\b)/g;
+  let m;
+  while ((m = decl.exec(code)) !== null)
+    names.add(m[1]);
+  return names;
+}
 function afterFirstArg(args) {
   let depth = 0;
   let quote = null;
@@ -15883,6 +16616,7 @@ function analyzeRegexMatchers(rawCode) {
   let examined = 0;
   let line = 1;
   let lineAt2 = 0;
+  let regexNames;
   while ((m = re.exec(code)) !== null && examined++ < MAX_CALLS && out.length < MAX_REGEX_MATCHER_FINDINGS) {
     const subj = readBalanced(code, m.index + m[0].length);
     if (!subj)
@@ -15894,10 +16628,18 @@ function analyzeRegexMatchers(rawCode) {
     if (!args)
       continue;
     const expected = mm[2] === "toHaveJSProperty" ? afterFirstArg(args.text) : args.text;
-    if (!startsWithRegexLiteral(expected))
-      continue;
-    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain" && (startsWithRegexLiteral(subj.text) || /^new\s+RegExp\b/.test(subj.text.trim())))
+    if (!isBareRegexLiteral(expected))
       continue;
+    if (mm[2] !== "toHaveJSProperty" && mm[2] !== "toContain") {
+      const subject = subj.text.trim();
+      if (startsWithRegexLiteral(subject) || /^new\s+RegExp\b/.test(subject))
+        continue;
+      if (/^[A-Za-z_$][\w$]{0,80}$/.test(subject)) {
+        regexNames ??= regexDeclaredNames(code);
+        if (regexNames.has(subject))
+          continue;
+      }
+    }
     for (let i = code.indexOf("\n", lineAt2); i !== -1 && i < m.index; i = code.indexOf("\n", i + 1)) {
       line++;
       lineAt2 = i + 1;
@@ -15907,9 +16649,12 @@ function analyzeRegexMatchers(rawCode) {
   return out;
 }
 function formatRegexMatcherNote(findings) {
-  const lines = findings.map((f) => `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? "always passes (a regex never equals the value), so it checks nothing" : "can never pass: this matcher compares by equality and a regex never equals a value"}.`);
+  const lines = findings.map((f) => {
+    const negated = f.matcher === "toContain" ? "throws on a string and otherwise always passes (a regex never equals an item), so it checks nothing" : "always passes (a regex never equals the value), so it checks nothing";
+    return `Line ${f.line}: .${f.negated ? "not." : ""}${f.matcher}(\u2026 /regex/ \u2026) ${f.negated ? negated : "can never pass: this matcher compares by equality and a regex never equals a value"}.`;
+  });
   return `${lines.join("\n")}
-A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For a DOM property read it first: expect(await loc.evaluate((n) => n.<prop>)).toMatch(/re/). Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
+A regex only works in toMatch, toHaveText, toContainText, toHaveValue and similar text matchers. For the \`value\` of an input, textarea or select, use await expect(loc).toHaveValue(/re/). For any other DOM property (or element), poll it so the check still retries: await expect.poll(() => loc.evaluate((n) => n.<prop>)).toMatch(/re/). Never read it once with expect(await loc.evaluate(\u2026)), which sees the value before the page updates it. Or give toHaveJSProperty the exact string (or boolean) the page shows. Keep every other line as-is.`;
 }
 function lintTestQuality(rawCode, opts = {}) {
   if (!rawCode || typeof rawCode !== "string")
@@ -16658,19 +17403,6 @@ var init_fence_runs = __esm({
   }
 });
 
-// ../shared/dist/trailing-slashes.js
-function stripTrailingSlashes(value) {
-  let end = value.length;
-  while (end > 0 && value.charCodeAt(end - 1) === 47)
-    end--;
-  return end === value.length ? value : value.slice(0, end);
-}
-var init_trailing_slashes = __esm({
-  "../shared/dist/trailing-slashes.js"() {
-    "use strict";
-  }
-});
-
 // ../shared/dist/survey-bug-signature.js
 function normalizeWords(text) {
   return text.toLowerCase().replace(UUID, " id ").replace(PREFIXED_ID, " id ").replace(HEX_RUN, (run) => /\d/.test(run) ? " id " : run).replace(NUMBER_RUN, " # ").replace(/[^\p{L}\p{N}#]+/gu, " ").replace(/\s+/g, " ").trim();
@@ -16694,14 +17426,17 @@ function requestSignatures(text) {
   const statuses = [...text.matchAll(HTTP_STATUS)].map((m) => ({ status: m[1], at: m.index ?? 0, end: (m.index ?? 0) + m[0].length }));
   if (statuses.length === 0)
     return [];
-  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => ({
-    method: m[1] ?? null,
-    path: normalizeBugPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "")),
-    // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
-    incidental: isIncidentalAssetPath((m[2] ?? m[3] ?? "").replace(/[.,;:]+$/, "").split(/[?#]/, 1)[0].toLowerCase()),
-    at: m.index ?? 0,
-    end: (m.index ?? 0) + m[0].length
-  })).filter((p) => p.path.length > 1);
+  const paths = [...text.matchAll(PATH_IN_TEXT)].map((m) => {
+    const rawPath = stripTrailingChars(m[2] ?? m[3] ?? "", PATH_TRAILING_PUNCTUATION);
+    return {
+      method: m[1] ?? null,
+      path: normalizeBugPath(rawPath),
+      // Before normalisation, which turns a segment with a digit (favicon-32x32.png) into :id.
+      incidental: isIncidentalAssetPath(rawPath.split(/[?#]/, 1)[0].toLowerCase()),
+      at: m.index ?? 0,
+      end: (m.index ?? 0) + m[0].length
+    };
+  }).filter((p) => p.path.length > 1);
   const out = /* @__PURE__ */ new Map();
   for (const { status, at, end } of statuses) {
     const lead = STATUS_TO_PATH.exec(text.slice(end, end + 40));
@@ -16811,11 +17546,12 @@ function dedupeSiteWideSuspectedBugs(drafts) {
       delete plans.suspectedBugs;
   }
 }
-var SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
+var PATH_TRAILING_PUNCTUATION, SIGNATURE_SOURCE_MAX_CHARS, UUID, PREFIXED_ID, HEX_RUN, NUMBER_RUN, GENERIC_JS_MESSAGES, GENERIC_JS_PREFIXES, JS_ERROR, MESSAGE_CLAUSE_END, HTTP_STATUS, PATH_IN_TEXT, STATUS_TO_PATH, INCIDENTAL_ASSET;
 var init_survey_bug_signature = __esm({
   "../shared/dist/survey-bug-signature.js"() {
     "use strict";
     init_trailing_slashes();
+    PATH_TRAILING_PUNCTUATION = /[.,;:]/;
     SIGNATURE_SOURCE_MAX_CHARS = 800;
     UUID = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/g;
     PREFIXED_ID = /\b[a-z]{1,8}[-_]\d+\b/g;
@@ -18146,7 +18882,7 @@ function pathIdsIn(text) {
 function findCounterIdPins(code) {
   if (code.length > CLOCK_MAX_CODE_CHARS)
     return [];
-  const clean2 = stripLineComments(blankBlockComments3(code));
+  const clean3 = stripLineComments(blankBlockComments3(code));
   const fillValues = [];
   const candidates = [];
   let seenWrite = false;
@@ -18154,24 +18890,24 @@ function findCounterIdPins(code) {
   CALL_RE.lastIndex = 0;
   let m;
   let calls = 0;
-  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean2)) !== null) {
+  while (calls++ < MAX_CALLS2 && (m = CALL_RE.exec(clean3)) !== null) {
     const name = m[1];
     const open = m.index + m[0].length - 1;
     if (VALUE_WRITES.has(name)) {
       seenWrite = true;
-      const args2 = argsAt(clean2, open);
+      const args2 = argsAt(clean3, open);
       if (args2 !== null)
         fillValues.push(...staticStrings(args2));
       continue;
     }
     if (createIndex === -1) {
-      if (name === "click" && seenWrite && isCreateClick(clean2, m.index))
+      if (name === "click" && seenWrite && isCreateClick(clean3, m.index))
         createIndex = m.index;
       continue;
     }
     if (name === "click")
       continue;
-    const args = argsAt(clean2, open);
+    const args = argsAt(clean3, open);
     if (args === null)
       continue;
     const isUrl = URL_SINKS.has(name);
@@ -18190,7 +18926,7 @@ function findCounterIdPins(code) {
   }
   if (createIndex === -1)
     return [];
-  const before = clean2.slice(0, createIndex);
+  const before = clean3.slice(0, createIndex);
   let pathIdsBefore = null;
   const findings = [];
   const seen = /* @__PURE__ */ new Set();
@@ -18214,7 +18950,7 @@ function findCounterIdPins(code) {
           continue;
       }
     }
-    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean2, c.index) });
+    findings.push({ kind: c.kind, literal: c.literal, line: lineAt(clean3, c.index) });
   }
   return findings;
 }
@@ -18509,7 +19245,7 @@ var init_suspicious_expectation = __esm({
     NOT_STUCK_RE = /\b(?:not|never|no longer|isn't|doesn't|don't|without)\s+(?:\w+\s+){0,2}?(?:stuck|hang|hangs|hung|freeze|freezes|frozen|spin|spins|spinning)\b/i;
     LISTS_STUCK_RE = /\b(?:appears? in (?:the )?[\w ]{0,25}(?:report|list|dashboard|queue)|(?:lists?|monitors?|shows?|reports?) (?:\w+ ){0,2}(?:that|which|whose) (?:are |is )?(?:stuck|hangs?|hung|frozen)|can (?:retry|re-?run) (?:\w+ ){0,2}(?:that (?:are )?)?stuck)\b/i;
     STUCK_VETO_RE = new RegExp(`${NOT_STUCK_RE.source}|${LISTS_STUCK_RE.source}`, "i");
-    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:fail(?:s|ing|ed)?|ignor\w*)?\s*silent(?:ly)?\b/i;
+    NOT_SILENT_RE = /\b(?:not|never|\w+n't|instead of|rather than|avoids?|prevents?)\s+(?:\w+\s+){0,1}?(?:(?:fail(?:s|ing|ed)?|ignor\w*)\s*)?silent(?:ly)?\b/i;
     PENDING_WORD = "(?:sending|loading|saving|searching|checking(?!\\s+(?:account|balance|out|in)\\b)|syncing|refreshing|fetching|validating|processing|submitting|uploading|posting|publishing|creating|updating|deleting|connecting|verifying|signing in|logging in)";
     ELLIPSIS = "(?:\\.{3}|\u2026)";
     NOT_STAY_RE = /\b(?:not|never|no longer|without|n't|cannot)\s+(?:\w+\s+){0,2}?(?:stay|stays|stayed|remain|remains|remained|leave|leaves|left)\b/i;
@@ -18665,7 +19401,7 @@ function outcomeNamedByAssertion(outcome, code) {
 function namedByStatements(outcome, statements) {
   const text = outcomeText(outcome);
   if (outcome.type === "url") {
-    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => r.replace(/[.,;:!?)]+$/, "")).filter((r) => r.length > 1);
+    const routes = (text.match(ROUTE_TERM) ?? []).map((r) => stripTrailingChars(r, ROUTE_TRAILING_PUNCTUATION)).filter((r) => r.length > 1);
     return statements.some((stmt) => {
       if (!/\.(?:waitForURL|toHaveURL)\s{0,20}\(/.test(stmt))
         return false;
@@ -18837,7 +19573,7 @@ function evaluatePromotionGate(input, checks = PROMOTION_QUALITY_CHECKS) {
     ...suspiciousTagged ? { suspiciousPass: { mode: suspicious, covered: suspiciousCovered, wouldHold: suspiciousHold } } : {}
   };
 }
-var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
+var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
 var init_promotion_quality_gate = __esm({
   "../shared/dist/promotion-quality-gate.js"() {
     "use strict";
@@ -18852,11 +19588,12 @@ var init_promotion_quality_gate = __esm({
     init_run_classification();
     init_expected_outcome_coverage();
     init_expect_call();
+    init_trailing_slashes();
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, tags, strengthGate, flagContradictedAdditions }) {
-        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true });
+      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof }) {
+        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
         const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
@@ -18874,7 +19611,7 @@ var init_promotion_quality_gate = __esm({
     MAX_STATEMENTS = 500;
     MAX_STATEMENT_CHARS = 400;
     LITERAL_OR_IDENTIFIER = /'(?:[^'\\\n]|\\.){0,500}'|"(?:[^"\\\n]|\\.){0,500}"|`(?:[^`\\]|\\.){0,2000}`|(?<![\w$.])[A-Za-z_$][\w$]{0,60}/g;
-    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
+    MUTATING_ACTION = /\.(?:click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s{0,20}\(|\brequest\s{0,20}\.\s{0,20}(?:post|put|patch|delete|fetch)\s{0,20}\(/;
     FEEDBACK_REGION = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/i;
     ONE_SHOT_MESSAGE_REASON = "one-shot success/error banner text";
     FEEDBACK_REGION_ALL = /getByRole\s{0,20}\(\s{0,20}['"`](?:alert|status)['"`]|\baria-live\b|\btoast|\bsnackbar\b|\bflash.?message\b/gi;
@@ -18933,6 +19670,7 @@ var init_promotion_quality_gate = __esm({
       "element-hidden": /\.(?:toBeHidden|not\s{0,20}\.\s{0,20}toBeVisible|not\s{0,20}\.\s{0,20}toBeAttached|not\s{0,20}\.\s{0,20}toContainText)\s{0,20}\(|\.toHaveCount\s{0,20}\(\s{0,20}0\s{0,20}\)/
     };
     ROUTE_TERM = /\/[A-Za-z0-9_./?&=#-]{1,200}/g;
+    ROUTE_TRAILING_PUNCTUATION = /[.,;:!?)]/;
     QUOTED_LITERAL = /'([^'\\\n]{3,200})'|"([^"\\\n]{3,200})"|`([^`\\$\n]{3,200})`/g;
     GENERIC_LITERAL = /^(?:true|false|button|link|heading|dialog|alertdialog|article|main|region|status|alert|textbox|combobox|checkbox|radio|tab|tabpanel|option|list|listitem|row|cell|img|navigation|banner|complementary|contentinfo|form|search|menu|menuitem|visible|hidden|attached|detached|domcontentloaded|load|networkidle)$/i;
     MAX_OUTCOME_STATEMENTS = 300;
@@ -19052,8 +19790,8 @@ ${goalText}`);
         return count3 > 0 ? [{ check: "locator-fragment", detail: String(count3), soft: true }] : [];
       }
     };
-    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|press)\s*\(/i;
-    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|selectOption|setInputFiles|dragTo|clear)\s*\(/;
+    FILTER_STEP = /\.(?:getByLabel|getByPlaceholder|getByRole|getByTitle)\s*\([^)\n]{0,200}?\b(?:filter|sort|search|status|delete|remove|dismiss|archive|clear)\b[^)\n]{0,200}\)[^\n]{0,200}\.(?:selectOption|fill|type|pressSequentially|click|check|uncheck|setChecked|press)\s*\(/i;
+    NEXT_ACTION = /\.(?:goto|reload|click|dblclick|tap|fill|type|pressSequentially|press|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|dragAndDrop|clear)\s*\(/;
     REDUCTION_PROOF = /\.toHaveCount\s*\(|\.not\s*\.\s*(?:toBeVisible|toBeAttached|toContainText|toHaveText)\s*\(|\.toBeHidden\s*\(|\bShowing\b|\bof \d+\b|\b\d+ (?:results?|rows?|items?|candidates?|entries|matches|records)\b|\bNo (?:[\w'-]+ ){0,3}(?:match|matches|results?|found|left|remain|yet)\b|\bNothing (?:to show|found|matches)\b|\bis empty\b|\btoHaveURL\b/i;
     MAX_FILTER_LINES = 2e3;
     MAX_FILTER_LINE_CHARS = 600;
@@ -19168,7 +19906,7 @@ ${goalText}`);
 });
 
 // ../shared/dist/regex-alternation.js
-function closingParens(source) {
+function closingParens2(source) {
   const close = new Int32Array(source.length).fill(-1);
   const open = [];
   let inClass = false;
@@ -19193,7 +19931,7 @@ function closingParens(source) {
   return close;
 }
 function alternatesAtTop(source) {
-  const close = closingParens(source);
+  const close = closingParens2(source);
   let start = source.startsWith("^") ? 1 : 0;
   let end = source.endsWith("$") ? source.length - 1 : source.length;
   while (start < end && source[start] === "(" && close[start] === end - 1) {
@@ -19242,6 +19980,124 @@ var init_page_evidence = __esm({
   }
 });
 
+// ../shared/dist/stated-limits.js
+function validDate(v) {
+  const [y, m, d] = v.split("-").map(Number);
+  const t = new Date(Date.UTC(y, m - 1, d));
+  return t.getUTCFullYear() === y && t.getUTCMonth() === m - 1 && t.getUTCDate() === d;
+}
+function isoFor(type, v) {
+  const re = DATE_RE[type];
+  if (!re || !re.test(v))
+    return false;
+  if (type === "date")
+    return validDate(v);
+  if (type === "datetime-local")
+    return validDate(v.slice(0, 10)) && Number(v.slice(11, 13)) < 24 && Number(v.slice(14, 16)) < 60;
+  if (type === "time")
+    return Number(v.slice(0, 2)) < 24 && Number(v.slice(3, 5)) < 60;
+  if (type === "month")
+    return Number(v.slice(5, 7)) >= 1 && Number(v.slice(5, 7)) <= 12;
+  return Number(v.slice(6, 8)) >= 1 && Number(v.slice(6, 8)) <= 53;
+}
+function clean2(raw) {
+  return typeof raw === "string" ? raw.trim() : "";
+}
+function statedLimitsFromAttrs(attrs, inputType) {
+  const type = (inputType ?? "").trim().toLowerCase();
+  const limits = [];
+  const add = (k, v) => {
+    limits.push({ k, v });
+  };
+  if (NUMBER_TYPES.has(type)) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (NUMBER_RE.test(v))
+        add(k, v);
+    }
+    const step = clean2(attrs.step);
+    if (NUMBER_RE.test(step) && Number(step) > 0)
+      add("step", step);
+  } else if (type in DATE_RE) {
+    for (const [attr, k] of [["min", "min"], ["max", "max"]]) {
+      const v = clean2(attrs[attr]);
+      if (isoFor(type, v))
+        add(k, v);
+    }
+  } else if (TEXT_TYPES.has(type)) {
+    for (const [attr, k] of [["minlength", "minLength"], ["maxlength", "maxLength"]]) {
+      const v = clean2(attrs[attr]);
+      if (LENGTH_RE.test(v))
+        add(k, String(Number(v)));
+    }
+    const pattern = cleanPattern(clean2(attrs.pattern).slice(0, STATED_PATTERN_MAX));
+    if (pattern)
+      add("pattern", pattern);
+  }
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+function cleanPattern(text) {
+  return text.replace(/[\u0000-\u001f\u007f]/g, "").replace(/[\ud800-\udbff](?![\udc00-\udfff])|(?<![\ud800-\udbff])[\udc00-\udfff]/g, "");
+}
+function readStatedLimits(stored) {
+  if (!stored || typeof stored !== "object" || Array.isArray(stored))
+    return [];
+  const rec = stored;
+  if (rec.v !== STATED_LIMITS_VERSION || !Array.isArray(rec.limits))
+    return [];
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const item of rec.limits.slice(0, MAX_LIMITS * 2)) {
+    if (!item || typeof item !== "object")
+      continue;
+    const { k, v } = item;
+    if (typeof k !== "string" || typeof v !== "string" || !KINDS.includes(k) || seen.has(k))
+      continue;
+    if (v.length === 0 || v.length > STATED_PATTERN_MAX)
+      continue;
+    const text = k === "pattern" ? cleanPattern(v) : v;
+    if (text === "")
+      continue;
+    if (k === "minLength" || k === "maxLength") {
+      if (!LENGTH_RE.test(v))
+        continue;
+    } else if (k === "step") {
+      if (!NUMBER_RE.test(v))
+        continue;
+    } else if (k === "min" || k === "max") {
+      if (!NUMBER_RE.test(v) && !Object.values(DATE_RE).some((re) => re.test(v)))
+        continue;
+    }
+    seen.add(k);
+    out.push({ k, v: text });
+  }
+  return out;
+}
+function statedLimitsRecord(limits) {
+  return limits.length > 0 ? { v: STATED_LIMITS_VERSION, limits } : null;
+}
+var STATED_LIMITS_VERSION, STATED_PATTERN_MAX, KINDS, MAX_LIMITS, TEXT_TYPES, NUMBER_TYPES, DATE_RE, NUMBER_RE, LENGTH_RE;
+var init_stated_limits = __esm({
+  "../shared/dist/stated-limits.js"() {
+    "use strict";
+    STATED_LIMITS_VERSION = 1;
+    STATED_PATTERN_MAX = 200;
+    KINDS = ["min", "max", "minLength", "maxLength", "step", "pattern"];
+    MAX_LIMITS = KINDS.length;
+    TEXT_TYPES = /* @__PURE__ */ new Set(["text", "search", "email", "url", "tel", "password", "textarea", ""]);
+    NUMBER_TYPES = /* @__PURE__ */ new Set(["number", "range"]);
+    DATE_RE = {
+      date: /^\d{4}-\d{2}-\d{2}$/,
+      "datetime-local": /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2})?$/,
+      time: /^\d{2}:\d{2}(?::\d{2})?$/,
+      month: /^\d{4}-\d{2}$/,
+      week: /^\d{4}-W\d{2}$/
+    };
+    NUMBER_RE = /^-?\d{1,15}(?:\.\d{1,10})?$/;
+    LENGTH_RE = /^\d{1,7}$/;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -19249,9 +20105,11 @@ __export(dist_exports, {
   ACTION_BATCH_MAX_SIZE: () => ACTION_BATCH_MAX_SIZE,
   ADDON_DEFINITIONS: () => ADDON_DEFINITIONS,
   ADMIN_EMAIL_LIMITS: () => ADMIN_EMAIL_LIMITS,
+  ADMIN_FORCE_CANCELLED_RUN_ERROR: () => ADMIN_FORCE_CANCELLED_RUN_ERROR,
   ADMIN_VIEW_DEFAULT_RETURN_TO: () => ADMIN_VIEW_DEFAULT_RETURN_TO,
   AGENT_AI_PROVIDER_PREFIXES: () => AGENT_AI_PROVIDER_PREFIXES,
   AI_CREDIT_MARGIN: () => AI_CREDIT_MARGIN,
+  ALLOWED_PROVIDER_CHAIN_HOPS: () => ALLOWED_PROVIDER_CHAIN_HOPS,
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_MODEL_CATALOG: () => API_MODEL_CATALOG,
   API_MODEL_FIELDS: () => API_MODEL_FIELDS,
@@ -19291,12 +20149,14 @@ __export(dist_exports, {
   BUG_TEST_BROKEN_REASON: () => BUG_TEST_BROKEN_REASON,
   BUG_TEST_BROKEN_TAG: () => BUG_TEST_BROKEN_TAG,
   CACHE_PRICE_PER_M: () => CACHE_PRICE_PER_M,
+  CANCELLED_REASON_PREFIXES: () => CANCELLED_REASON_PREFIXES,
   CANVAS_UNSUPPORTED_BODY: () => CANVAS_UNSUPPORTED_BODY,
   CANVAS_UNSUPPORTED_CODE: () => CANVAS_UNSUPPORTED_CODE,
   CANVAS_UNSUPPORTED_NOT_CHARGED: () => CANVAS_UNSUPPORTED_NOT_CHARGED,
   CANVAS_UNSUPPORTED_OVERRIDE_HINT: () => CANVAS_UNSUPPORTED_OVERRIDE_HINT,
   CANVAS_UNSUPPORTED_TITLE: () => CANVAS_UNSUPPORTED_TITLE,
   CAPTURE_JSON_STRUCTURE_LIMITS: () => CAPTURE_JSON_STRUCTURE_LIMITS,
+  CHAIN_CANCELLED_RUN_ERROR: () => CHAIN_CANCELLED_RUN_ERROR,
   CHAT_FAILOVER_KEY: () => CHAT_FAILOVER_KEY,
   CLAUDE_CLI_DEFAULT_EFFORT: () => CLAUDE_CLI_DEFAULT_EFFORT,
   CLAUDE_CLI_DEFAULT_MODEL: () => CLAUDE_CLI_DEFAULT_MODEL,
@@ -19333,6 +20193,7 @@ __export(dist_exports, {
   DEFAULT_GEMINI_SCREEN_MODEL: () => DEFAULT_GEMINI_SCREEN_MODEL,
   DEFAULT_JSON_STRUCTURE_LIMITS: () => DEFAULT_JSON_STRUCTURE_LIMITS,
   DEFAULT_PLATFORM_DB_POOL_SIZE: () => DEFAULT_PLATFORM_DB_POOL_SIZE,
+  DEFAULT_PROVIDER_ACCOUNT_ID: () => DEFAULT_PROVIDER_ACCOUNT_ID,
   DEFAULT_SHARED_DB_POOL_SIZE: () => DEFAULT_SHARED_DB_POOL_SIZE,
   DEFAULT_STT_MODEL: () => DEFAULT_STT_MODEL,
   DEFAULT_STT_MODEL_BY_PROVIDER: () => DEFAULT_STT_MODEL_BY_PROVIDER,
@@ -19349,6 +20210,7 @@ __export(dist_exports, {
   ENVIRONMENTAL_ERROR_STORED_PREFIXES: () => ENVIRONMENTAL_ERROR_STORED_PREFIXES,
   EVIDENCE_NOTE_PREFIXES: () => EVIDENCE_NOTE_PREFIXES,
   EXPECT_CALL_RE: () => EXPECT_CALL_RE,
+  FEATURE_ROW_RUN_WINDOW: () => FEATURE_ROW_RUN_WINDOW,
   FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
   FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
   FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
@@ -19416,6 +20278,8 @@ __export(dist_exports, {
   MAX_ORG_NAME_LENGTH: () => MAX_ORG_NAME_LENGTH,
   MAX_PASSWORD_BYTES: () => MAX_PASSWORD_BYTES,
   MAX_PLAYWRIGHT_CODE_LENGTH: () => MAX_PLAYWRIGHT_CODE_LENGTH,
+  MAX_PROVIDER_ACCOUNTS: () => MAX_PROVIDER_ACCOUNTS,
+  MAX_PROVIDER_ACCOUNT_MODELS: () => MAX_PROVIDER_ACCOUNT_MODELS,
   MAX_SURVEY_ENTRY_URLS: () => MAX_SURVEY_ENTRY_URLS,
   MAX_SURVEY_ENTRY_URL_LENGTH: () => MAX_SURVEY_ENTRY_URL_LENGTH,
   MCP_ARMY_LIMITS: () => MCP_ARMY_LIMITS,
@@ -19451,7 +20315,7 @@ __export(dist_exports, {
   MUSE_ENGINE_DEFAULT_MODEL: () => MUSE_ENGINE_DEFAULT_MODEL,
   MUSE_ENGINE_MODELS: () => MUSE_ENGINE_MODELS,
   NOREPLY_EMAIL: () => NOREPLY_EMAIL,
-  OPENCODE_GO_2_PREFIX: () => OPENCODE_GO_2_PREFIX,
+  OPENCODE_GO_DEEPSEEK_GLM_MODELS: () => OPENCODE_GO_DEEPSEEK_GLM_MODELS,
   OPENCODE_GO_MODEL_PATTERN: () => OPENCODE_GO_MODEL_PATTERN,
   OPENCODE_GO_PREFIX: () => OPENCODE_GO_PREFIX,
   OPENROUTER_MAX_CALL_COST_USD: () => OPENROUTER_MAX_CALL_COST_USD,
@@ -19471,10 +20335,12 @@ __export(dist_exports, {
   PLAN_FEATURES: () => PLAN_FEATURES,
   PLAN_FEATURE_LOCKED_CODE: () => PLAN_FEATURE_LOCKED_CODE,
   PLAN_ORDER: () => PLAN_ORDER,
+  PLATFORM_ADMIN_CANCELLED_RUN_ERROR: () => PLATFORM_ADMIN_CANCELLED_RUN_ERROR,
   PLATFORM_ADMIN_EMAIL: () => PLATFORM_ADMIN_EMAIL,
   PLATFORM_DEFAULT_PROVIDER: () => PLATFORM_DEFAULT_PROVIDER,
   PLATFORM_PLAN_BILLING: () => PLATFORM_PLAN_BILLING,
   PLATFORM_SERVER_APPLICATION_NAME: () => PLATFORM_SERVER_APPLICATION_NAME,
+  PLATFORM_SUPPORT_CANCELLED_RUN_ERROR: () => PLATFORM_SUPPORT_CANCELLED_RUN_ERROR,
   POST_SPECIAL_TRIAL_DAYS: () => POST_SPECIAL_TRIAL_DAYS,
   PRESET_DIRECT_FALLBACK: () => PRESET_DIRECT_FALLBACK,
   PRODUCTION_READ_ONLY_GUARD_TEMPLATE: () => PRODUCTION_READ_ONLY_GUARD_TEMPLATE,
@@ -19486,8 +20352,12 @@ __export(dist_exports, {
   PROJECT_OVERRIDE_FIELDS: () => PROJECT_OVERRIDE_FIELDS,
   PROMOTION_GATE_MAX_CODE_CHARS: () => PROMOTION_GATE_MAX_CODE_CHARS,
   PROMOTION_QUALITY_CHECKS: () => PROMOTION_QUALITY_CHECKS,
+  PROVIDER_ACCOUNT_ID_PATTERN: () => PROVIDER_ACCOUNT_ID_PATTERN,
+  PROVIDER_ACCOUNT_MODEL_PATTERN: () => PROVIDER_ACCOUNT_MODEL_PATTERN,
   PROVIDER_CHAINS: () => PROVIDER_CHAINS,
+  PROVIDER_CHAINS_SETTING_MAX_CHARS: () => PROVIDER_CHAINS_SETTING_MAX_CHARS,
   PROVIDER_CHAIN_LEADS: () => PROVIDER_CHAIN_LEADS,
+  PROVIDER_CHAIN_MAX_ENTRIES: () => PROVIDER_CHAIN_MAX_ENTRIES,
   PROVIDER_HOST_NOT_OFFERED: () => PROVIDER_HOST_NOT_OFFERED,
   PUBLIC_PLANS: () => PUBLIC_PLANS,
   QUARANTINE_CLOSE_TAGS: () => QUARANTINE_CLOSE_TAGS,
@@ -19495,10 +20365,12 @@ __export(dist_exports, {
   READ_ONLY_TAGS: () => READ_ONLY_TAGS,
   RECHECKED_NOTES: () => RECHECKED_NOTES,
   RECORDING_VALUE_PLACEHOLDERS: () => RECORDING_VALUE_PLACEHOLDERS,
+  RENDER_IDENTITY_MAX_LENGTH: () => RENDER_IDENTITY_MAX_LENGTH,
   REPOSITORY_CLIS: () => REPOSITORY_CLIS,
   RESERVED_PROJECT_KEYS: () => RESERVED_PROJECT_KEYS,
   RESULT_STRUCTURE_TOO_COSTLY_CODE: () => RESULT_STRUCTURE_TOO_COSTLY_CODE,
   RETRIED_ATTEMPTS_KEY: () => RETRIED_ATTEMPTS_KEY,
+  RETRY_HELD_RUN_ERROR: () => RETRY_HELD_RUN_ERROR,
   RUNNER_INTERRUPT_ERROR_PREFIX: () => RUNNER_INTERRUPT_ERROR_PREFIX,
   RUN_INTERRUPTED_ERROR_PREFIXES: () => RUN_INTERRUPTED_ERROR_PREFIXES,
   RUN_INTERRUPTION_NOT_RETRIED_MARKERS: () => RUN_INTERRUPTION_NOT_RETRIED_MARKERS,
@@ -19511,6 +20383,8 @@ __export(dist_exports, {
   SHARED_SERVER_APPLICATION_NAME: () => SHARED_SERVER_APPLICATION_NAME,
   SPEND_SOURCE_KEY: () => SPEND_SOURCE_KEY,
   SPEND_SOURCE_SERVER: () => SPEND_SOURCE_SERVER,
+  STATED_LIMITS_VERSION: () => STATED_LIMITS_VERSION,
+  STATED_PATTERN_MAX: () => STATED_PATTERN_MAX,
   STATIC_STANDARD_MIN_INTERACTIVE: () => STATIC_STANDARD_MIN_INTERACTIVE,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   SUCCESS_NOTICE_TEXT: () => SUCCESS_NOTICE_TEXT,
@@ -19540,14 +20414,20 @@ __export(dist_exports, {
   UI_VARIANTS: () => UI_VARIANTS,
   UNEXPECTED_PASS_ERROR_PREFIX: () => UNEXPECTED_PASS_ERROR_PREFIX,
   USER_CANCELLED_RUN_ERROR: () => USER_CANCELLED_RUN_ERROR,
+  VISUAL_MASK_SELECTORS_MAX: () => VISUAL_MASK_SELECTORS_MAX,
+  VISUAL_MASK_SELECTOR_FORBIDDEN: () => VISUAL_MASK_SELECTOR_FORBIDDEN,
+  VISUAL_MASK_SELECTOR_MAX_LENGTH: () => VISUAL_MASK_SELECTOR_MAX_LENGTH,
+  VISUAL_V1_IDENTITY: () => VISUAL_V1_IDENTITY,
   VOICE_PREVIEW_SAMPLE: () => VOICE_PREVIEW_SAMPLE,
   WEB_PROXY_CHAIN_HEADER: () => WEB_PROXY_CHAIN_HEADER,
   WITHHELD_CREDENTIAL_TEXT: () => WITHHELD_CREDENTIAL_TEXT,
   ZAI_MODEL_PATTERN: () => ZAI_MODEL_PATTERN,
   ZAI_PREFIX: () => ZAI_PREFIX,
+  accountServesModel: () => accountServesModel,
   accumulateStatements: () => accumulateStatements,
   adoptBrokerFailover: () => adoptBrokerFailover,
   aiCostToCreditCents: () => aiCostToCreditCents,
+  allowedProviderChainHosts: () => allowedProviderChainHosts,
   alternatesAtTop: () => alternatesAtTop,
   analyzeDerivedValues: () => analyzeDerivedValues,
   analyzeMobileSelectorQuality: () => analyzeMobileSelectorQuality,
@@ -19560,6 +20440,7 @@ __export(dist_exports, {
   analyzeUnreachedUrlWaits: () => analyzeUnreachedUrlWaits,
   analyzeUrlWaits: () => analyzeUrlWaits,
   analyzeWriteResponse: () => analyzeWriteResponse,
+  androidResourceOwners: () => androidResourceOwners,
   apiModelCardsFromConfig: () => apiModelCardsFromConfig,
   apiModelsForProvider: () => apiModelsForProvider,
   apiProviderModelLabel: () => apiProviderModelLabel,
@@ -19570,6 +20451,7 @@ __export(dist_exports, {
   applyLaunchSpecialPlan: () => applyLaunchSpecialPlan,
   asPlainExpect: () => asPlainExpect,
   assertionOnlyCode: () => assertionOnlyCode,
+  assertionStrengthHoistedReadsOn: () => assertionStrengthHoistedReadsOn,
   assertionsReadVisibleContent: () => assertionsReadVisibleContent,
   assessCodeOutcomeCoverage: () => assessCodeOutcomeCoverage,
   assessTitleCoverage: () => assessTitleCoverage,
@@ -19653,6 +20535,7 @@ __export(dist_exports, {
   deepgramSpeak: () => deepgramSpeak,
   deepgramTranscribe: () => deepgramTranscribe,
   defaultConfirmModel: () => defaultConfirmModel,
+  defaultProviderChainEntries: () => defaultProviderChainEntries,
   defaultScreenModel: () => defaultScreenModel,
   defaultVoiceForTtsModel: () => defaultVoiceForTtsModel,
   deriveAuthPlan: () => deriveAuthPlan,
@@ -19695,6 +20578,7 @@ __export(dist_exports, {
   extractOutcomeSearchTerms: () => extractOutcomeSearchTerms,
   featureForAiCallType: () => featureForAiCallType,
   featureForMcpTool: () => featureForMcpTool,
+  featureRowRunStatus: () => featureRowRunStatus,
   findBracedClause: () => findBracedClause,
   findCounterIdPins: () => findCounterIdPins,
   findCredentialTextLeftover: () => findCredentialTextLeftover,
@@ -19743,6 +20627,7 @@ __export(dist_exports, {
   getPlanChangeType: () => getPlanChangeType,
   getPlanDefinition: () => getPlanDefinition,
   getPlanLabel: () => getPlanLabel,
+  getProviderChainOverrides: () => getProviderChainOverrides,
   getTrialDaysRemaining: () => getTrialDaysRemaining,
   googleBrokerNavigationUrl: () => googleBrokerNavigationUrl,
   googleBrokerUnavailableLine: () => googleBrokerUnavailableLine,
@@ -19756,10 +20641,10 @@ __export(dist_exports, {
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
   hasOnlyConstantAssertions: () => hasOnlyConstantAssertions,
-  hasOpenCodeGo2Prefix: () => hasOpenCodeGo2Prefix,
   hasOpenCodeGoPrefix: () => hasOpenCodeGoPrefix,
   hasOpenRouterPrefix: () => hasOpenRouterPrefix,
   hasPlatformLocator: () => hasPlatformLocator,
+  hasProviderChainLeadsByDefault: () => hasProviderChainLeadsByDefault,
   hasReadOnlyMarker: () => hasReadOnlyMarker,
   hasSurveyNotes: () => hasSurveyNotes,
   hasTestFailContract: () => hasTestFailContract,
@@ -19785,8 +20670,11 @@ __export(dist_exports, {
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isBrowserCliEngine: () => isBrowserCliEngine,
+  isBrowserVersion: () => isBrowserVersion,
   isBugTestBrokenError: () => isBugTestBrokenError,
+  isCancelledReason: () => isCancelledReason,
   isCanvasUnsupportedMessage: () => isCanvasUnsupportedMessage,
+  isChainablePrimary: () => isChainablePrimary,
   isCliEngineModelId: () => isCliEngineModelId,
   isCliEngineSpec: () => isCliEngineSpec,
   isCodeFactNote: () => isCodeFactNote,
@@ -19810,6 +20698,7 @@ __export(dist_exports, {
   isIdentityMobileXpath: () => isIdentityMobileXpath,
   isIdentityProviderSurface: () => isIdentityProviderSurface,
   isIncidentalAssetPath: () => isIncidentalAssetPath,
+  isIntentionalNegativeAuthTest: () => isIntentionalNegativeAuthTest,
   isIpOrLocalhost: () => isIpOrLocalhost,
   isKnownPageType: () => isKnownPageType,
   isLaunchSpecialActive: () => isLaunchSpecialActive,
@@ -19837,6 +20726,7 @@ __export(dist_exports, {
   isRunInterruptedError: () => isRunInterruptedError,
   isRunnableStep: () => isRunnableStep,
   isSafeDeepLink: () => isSafeDeepLink,
+  isSafeMaskSelector: () => isSafeMaskSelector,
   isSameRegistrableDomainHost: () => isSameRegistrableDomainHost,
   isSelectableApiModel: () => isSelectableApiModel,
   isSelfServePlan: () => isSelfServePlan,
@@ -19900,6 +20790,7 @@ __export(dist_exports, {
   normalizeFinishReason: () => normalizeFinishReason,
   normalizeNoteText: () => normalizeNoteText,
   normalizePageType: () => normalizePageType,
+  normalizeProviderAccountModels: () => normalizeProviderAccountModels,
   normalizeTtsModel: () => normalizeTtsModel,
   normalizeTtsVoiceId: () => normalizeTtsVoiceId,
   noteChatFailover: () => noteChatFailover,
@@ -19924,13 +20815,18 @@ __export(dist_exports, {
   parseGeminiModelsPayload: () => parseGeminiModelsPayload,
   parseGoogleAuthorizeUrl: () => parseGoogleAuthorizeUrl,
   parseGoogleGisRequestUrl: () => parseGoogleGisRequestUrl,
+  parseLastActionProofMode: () => parseLastActionProofMode,
   parseLimitParam: () => parseLimitParam,
   parseOffsetParam: () => parseOffsetParam,
   parsePageParam: () => parsePageParam,
   parsePgIntSetting: () => parsePgIntSetting,
   parseProjectEngineOverrides: () => parseProjectEngineOverrides,
   parsePromotionGateMode: () => parsePromotionGateMode,
+  parseProviderAccountLists: () => parseProviderAccountLists,
+  parseProviderChainOverrides: () => parseProviderChainOverrides,
   parseRecheckClearMode: () => parseRecheckClearMode,
+  parseRenderIdentity: () => parseRenderIdentity,
+  parseStoredProviderChainOverrides: () => parseStoredProviderChainOverrides,
   parseSurveyEntryUrls: () => parseSurveyEntryUrls,
   parseSuspiciousPassMode: () => parseSuspiciousPassMode,
   parseTaskModelUpdate: () => parseTaskModelUpdate,
@@ -19961,7 +20857,9 @@ __export(dist_exports, {
   projectAppHosts: () => projectAppHosts,
   providerChainFor: () => providerChainFor,
   providerChainHostOf: () => providerChainHostOf,
+  providerChainHostProvider: () => providerChainHostProvider,
   providerChainLeadsFor: () => providerChainLeadsFor,
+  providerChainModelKey: () => providerChainModelKey,
   providerChainPrimariesForHop: () => providerChainPrimariesForHop,
   providerHostPlan: () => providerHostPlan,
   readBalanced: () => readBalanced,
@@ -19971,6 +20869,7 @@ __export(dist_exports, {
   readEnabledEngines: () => readEnabledEngines,
   readProjectEngineOverrides: () => readProjectEngineOverrides,
   readRetriedAttempts: () => readRetriedAttempts,
+  readStatedLimits: () => readStatedLimits,
   readStaticPageCanvasSignals: () => readStaticPageCanvasSignals,
   readSurveyEntryUrls: () => readSurveyEntryUrls,
   readSurveyNotes: () => readSurveyNotes,
@@ -19983,6 +20882,7 @@ __export(dist_exports, {
   regexLiteralEnd: () => regexLiteralEnd2,
   regexOpensAfter: () => regexOpensAfter,
   registrableDomain: () => registrableDomain,
+  renderIdentity: () => renderIdentity,
   renderSurveyNotesForPrompt: () => renderSurveyNotesForPrompt,
   repairPageType: () => repairPageType,
   replaceBlockComments: () => replaceBlockComments,
@@ -20030,11 +20930,14 @@ __export(dist_exports, {
   selectorCandidatesForStep: () => selectorCandidatesForStep,
   selectorForValue: () => selectorForValue,
   setAgenticCliRuntime: () => setAgenticCliRuntime,
+  setProviderChainOverrides: () => setProviderChainOverrides,
   signupPlanFor: () => signupPlanFor,
   simplifyMobileWanderingInPlace: () => simplifyMobileWanderingInPlace,
   siteOf: () => siteOf,
   specItemsFromTestPlans: () => specItemsFromTestPlans,
   splitAnswerLines: () => splitAnswerLines,
+  statedLimitsFromAttrs: () => statedLimitsFromAttrs,
+  statedLimitsRecord: () => statedLimitsRecord,
   stepAppliesToPlatform: () => stepAppliesToPlatform,
   stepConsoleLines: () => stepConsoleLines,
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
@@ -20046,7 +20949,10 @@ __export(dist_exports, {
   stripCodeFactPrefix: () => stripCodeFactPrefix,
   stripCoverageComments: () => stripCoverageComments,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
+  stripFractionZeros: () => stripFractionZeros,
+  stripLineComment: () => stripLineComment,
   stripLoginScaffolding: () => stripLoginScaffolding,
+  stripTrailingChars: () => stripTrailingChars,
   stripTrailingSlashes: () => stripTrailingSlashes,
   strongerNeedsReviewSource: () => strongerNeedsReviewSource,
   sttModelsForProvider: () => sttModelsForProvider,
@@ -20064,10 +20970,14 @@ __export(dist_exports, {
   ttsFallbackModel: () => ttsFallbackModel,
   ttsProviderForModel: () => ttsProviderForModel,
   unexpectedPassError: () => unexpectedPassError,
+  v1RenderIdentity: () => v1RenderIdentity,
   validateAppMapDocument: () => validateAppMapDocument,
   validateAssertionStrength: () => validateAssertionStrength,
   validateEngineSpec: () => validateEngineSpec,
+  validateProviderChainEntries: () => validateProviderChainEntries,
+  validateProviderChainsSetting: () => validateProviderChainsSetting,
   validateTaskModelId: () => validateTaskModelId,
+  visualBaselinesEnabled: () => visualBaselinesEnabled,
   visualProDailyBudget: () => visualProDailyBudget,
   voiceMatchesTtsModel: () => voiceMatchesTtsModel,
   voicesForTtsModel: () => voicesForTtsModel,
@@ -20130,11 +21040,14 @@ var init_dist = __esm({
     init_deepgram_voices();
     init_feature_flags();
     init_env_flags();
+    init_visual_compare_limits();
+    init_visual_baseline_identity();
     init_analytics_url();
     init_agentic_cli_runtime();
     init_api_model_catalog();
     init_engine_spec();
     init_provider_chains();
+    init_provider_accounts();
     init_project_engine_overrides();
     init_ai_profiles();
     init_openrouter_usage();
@@ -20176,6 +21089,7 @@ var init_dist = __esm({
     init_regex_alternation();
     init_page_evidence();
     init_trailing_slashes();
+    init_stated_limits();
   }
 });
 
@@ -20263,7 +21177,7 @@ var require_runs_dir = __commonJS({
       } catch (error2) {
         if (error2.code === "EEXIST" && resolvesFrom(runsDir) === own)
           return;
-        throw new Error(`Could not link ${link} to the runner's node_modules (${error2.message}). Set RUNS_DIR to a writable folder outside node_modules that can resolve @playwright/test.`);
+        throw new Error(`Could not link ${link} to the runner's node_modules (${error2.message}). Set RUNS_DIR to a writable folder outside node_modules that can resolve @playwright/test.`, { cause: error2 });
       }
     }
   }
@@ -21866,23 +22780,79 @@ var require_harness_init_script = __commonJS({
     exports2.isHarnessInitConsoleLine = isHarnessInitConsoleLine;
     exports2.stripHarnessConsoleEntries = stripHarnessConsoleEntries;
     var node_crypto_1 = require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     exports2.HARNESS_INIT_SOURCE_URL = `vqa-harness-init-${(0, node_crypto_1.randomBytes)(4).toString("hex")}.js`;
+    var TRANSITION_LOOP_LIMIT = 8;
+    var TRANSITION_LOOP_WINDOW_MS = 1e3;
     function withHarnessSourceUrl(content) {
       return `${content}
 //# sourceURL=${exports2.HARNESS_INIT_SOURCE_URL}`;
     }
     function buildAnimationDisablingSource(opts) {
+      const finishTransitions = opts.finishTransitions ?? (0, shared_1.parseBoolFlag)(process.env.HARNESS_FINISH_CSS_TRANSITIONS);
+      const css = finishTransitions ? "*, *::before, *::after { animation-duration: 0s !important; animation-delay: 0s !important; }" : "*, *::before, *::after { transition-duration: 0s !important; animation-duration: 0s !important; transition-delay: 0s !important; animation-delay: 0s !important; }";
       return withHarnessSourceUrl(`(() => {
+  // An error the browser throws for the page's own value, passed through one of the wrappers below (a bad
+  // adoptedStyleSheets list, animate timing it refuses), is the app's: stock Playwright reports it as a page error.
+  // Thrown from our wrapper, its top frame would be this script, and the console evidence drops such an error as
+  // the runner's own. Our frames come out of its stack, so the app's call is the top frame, as without the harness.
+  // (Under Error.stackTraceLimit the stack then has one or two frames fewer than stock's; the top frame is right.)
+  const own = ${JSON.stringify(exports2.HARNESS_INIT_SOURCE_URL)};
+  const appError = (e) => {
+    try {
+      const stack = e !== null && typeof e === 'object' ? e.stack : undefined;
+      if (typeof stack === 'string' && stack.includes(own)) e.stack = stack.split('\\n').filter((line) => !line.includes(own)).join('\\n');
+    } catch (x) {}
+    return e;
+  };
   // Layer 1: CSS transitions and animations - instant, not removed
   // (duration 0s preserves final state; 'none' would prevent keyframes from completing)
+  // The rule goes in a constructed stylesheet on document.adoptedStyleSheets, which adds no node to the DOM:
+  // a <style> element changed what the test sees (locator('style') and 'head > *' counts, document.styleSheets,
+  // an iframe's empty head), so a spec stock Playwright passes failed. The <style> is the fallback for a
+  // browser with no constructable stylesheets.
+  let adopted = false;
   try {
+    if (typeof CSSStyleSheet === 'function' && typeof Document === 'function' && 'adoptedStyleSheets' in Document.prototype) {
+      const sheet = new CSSStyleSheet();
+      sheet.replaceSync(${JSON.stringify(css)});
+      document.adoptedStyleSheets = [...document.adoptedStyleSheets, sheet];
+      adopted = true;
+      // A page that assigns the list without spreading it (document.adoptedStyleSheets = [mine]) would drop the
+      // harness sheet and bring animations back: keep it, last, on every assignment. A bad value (not iterable,
+      // or a list the browser refuses) goes to the browser, which throws its own error as the app's (appError).
+      try {
+        const desc = Object.getOwnPropertyDescriptor(Document.prototype, 'adoptedStyleSheets');
+        if (desc && desc.get && desc.set) {
+          Object.defineProperty(document, 'adoptedStyleSheets', {
+            configurable: true,
+            enumerable: desc.enumerable,
+            get() { return desc.get.call(document); },
+            set(value) {
+              try {
+                if (value === null || (typeof value !== 'object' && typeof value !== 'function') || typeof value[Symbol.iterator] !== 'function') {
+                  desc.set.call(document, value);
+                  return;
+                }
+                const list = [...value];
+                desc.set.call(document, list.includes(sheet) ? list : [...list, sheet]);
+              } catch (e) {
+                throw appError(e);
+              }
+            },
+          });
+        }
+      } catch (e) {}
+    }
+  } catch (e) {}
+  if (!adopted) try {
     let applied = false;
     const apply = () => {
       if (applied) return true;
       const root = document.head || document.documentElement;
       if (!root) return false;
       const style = document.createElement('style');
-      style.textContent = '*, *::before, *::after { transition-duration: 0s !important; animation-duration: 0s !important; transition-delay: 0s !important; animation-delay: 0s !important; }';
+      style.textContent = ${JSON.stringify(css)};
       root.appendChild(style);
       applied = true;
       return true;
@@ -21904,19 +22874,96 @@ ${opts.hideWebdriver ? `
   try {
     Object.defineProperty(navigator, 'webdriver', { get: () => undefined });
   } catch (e) {}
+` : ""}
+${finishTransitions ? `
+  // Layer 1b: CSS transitions run, and are finished as they start, so transitionend fires.
+  // - finish() is deferred to a task: called inside the transitionrun dispatch (or a microtask of it) after a
+  //   real input event, Chromium finishes the transition but never fires its transitionstart/transitionend.
+  // - setTimeout and performance.now are the ones present when this script runs, before the page's own
+  //   scripts: fake timers the page installs later cannot hold a finish back.
+  // - The subtree is walked only for a pseudo-element's transition (its animations hang off the element).
+  // - An element whose same transition restarts more than ${TRANSITION_LOOP_LIMIT} times within ${TRANSITION_LOOP_WINDOW_MS} ms (an app that starts it again on
+  //   each transitionend: carousel, pulse) is left to run at its own pace from then on, instead of cycling at
+  //   frame rate for the rest of the run.
+  try {
+    const st = setTimeout;
+    const perf = typeof performance === 'object' && performance && typeof performance.now === 'function' ? performance : null;
+    const now = perf ? perf.now.bind(perf) : Date.now;
+    const seen = new WeakMap();
+    const looping = (el, key) => {
+      let byKey = seen.get(el);
+      if (!byKey) { byKey = new Map(); seen.set(el, byKey); }
+      const t = now();
+      let s = byKey.get(key);
+      if (s && s.loop) return true;
+      if (!s || t - s.since > ${TRANSITION_LOOP_WINDOW_MS}) { s = { n: 0, since: t, loop: false }; byKey.set(key, s); }
+      s.n += 1;
+      if (s.n > ${TRANSITION_LOOP_LIMIT}) s.loop = true;
+      return s.loop;
+    };
+    window.addEventListener('transitionrun', (ev) => {
+      try {
+        const el = ev && ev.target;
+        if (!el || typeof el.getAnimations !== 'function' || typeof CSSTransition !== 'function') return;
+        const pseudo = ev.pseudoElement || '';
+        if (looping(el, ev.propertyName + '|' + pseudo)) return;
+        for (const a of (pseudo ? el.getAnimations({ subtree: true }) : el.getAnimations())) {
+          if (a instanceof CSSTransition && a.transitionProperty === ev.propertyName && a.effect
+            && a.effect.target === el && (a.effect.pseudoElement || '') === pseudo) {
+            st(() => { try { a.finish(); } catch (e) {} }, 0);
+          }
+        }
+      } catch (e) {}
+    }, true);
+  } catch (e) {}
 ` : ""}
   // Layer 2: Web Animations API - make instant instead of no-op
   // (preserves animation completion callbacks that app code may depend on)
+  // Timing the browser refuses (a negative, NaN or non-'auto' duration, a delay that is not finite) goes to the
+  // browser as the page wrote it: zeroed, it raised no TypeError, so a page error stock Playwright reports was hidden.
+  // Options that are not a plain object (an array, a class instance) keep what they inherit: the browser reads
+  // every timing member through the prototype chain, and an array's inherited fill() is a TypeError. A copy kept
+  // only own properties, so the error was hidden; a proxy overrides only duration and delay.
   try {
     const origAnimate = Element.prototype.animate;
+    const refused = (options) => {
+      try {
+        if (options === undefined || options === null) return false;
+        if (typeof options !== 'object' && typeof options !== 'function') return !(Number(options) >= 0);
+        const duration = options.duration;
+        if (duration !== undefined && duration !== 'auto' && !(typeof duration === 'number' && duration >= 0)) return true;
+        const delay = options.delay;
+        return delay !== undefined && !Number.isFinite(Number(delay));
+      } catch (e) {
+        return true;
+      }
+    };
+    const instant = (options) => {
+      try {
+        // Plain: its prototype is null or an Object.prototype (of any frame's realm), so it inherits no timing.
+        const proto = Object.getPrototypeOf(options);
+        if (proto !== null && Object.getPrototypeOf(proto) !== null && typeof Proxy === 'function') {
+          // The proxy's target is an empty object, not the options: a target with a read-only, non-configurable
+          // duration or delay (a frozen instance, Object.create with a descriptor) would make returning 0 a proxy
+          // invariant TypeError. Every other member is read from the options, the options as the receiver.
+          return new Proxy({}, { get: (_target, key) => (key === 'duration' || key === 'delay' ? 0 : Reflect.get(options, key)) });
+        }
+      } catch (e) {}
+      return Object.assign({}, options, { duration: 0, delay: 0 });
+    };
     if (typeof origAnimate === 'function') {
       Element.prototype.animate = function (keyframes, options) {
-        if (typeof options === 'object' && options !== null) {
-          options = Object.assign({}, options, { duration: 0, delay: 0 });
-        } else {
-          options = 0; // covers number, undefined, and any other type
+        try {
+          if (refused(options)) return origAnimate.call(this, keyframes, options);
+          if (typeof options === 'object' && options !== null) {
+            options = instant(options);
+          } else {
+            options = 0; // covers number, undefined, and any other type
+          }
+          return origAnimate.call(this, keyframes, options);
+        } catch (e) {
+          throw appError(e);
         }
-        return origAnimate.call(this, keyframes, options);
       };
     }
   } catch (e) {}
@@ -22795,6 +23842,7 @@ var require_browser_config = __commonJS({
     exports2.fullChromiumCloudLaunch = fullChromiumCloudLaunch;
     exports2.chooseCloudBrowser = chooseCloudBrowser;
     exports2.appTimezoneConfigLine = appTimezoneConfigLine;
+    exports2.discoveryTimezoneId = discoveryTimezoneId;
     exports2.getMCPBrowserConfig = getMCPBrowserConfig;
     exports2.getPlaywrightLaunchOptions = getPlaywrightLaunchOptions;
     exports2.getLaunchOptions = getLaunchOptions;
@@ -23013,7 +24061,7 @@ var require_browser_config = __commonJS({
         try {
           (0, fs_1.cpSync)(localStateSrc, (0, path_1.join)(tempDir, "Local State"));
         } catch (err) {
-          throw new Error(`Cannot copy Chrome profile (${err instanceof Error ? err.message : String(err)}). Quit Google Chrome completely, or use getChromeUserDataDirSource() for seeding.`);
+          throw new Error(`Cannot copy Chrome profile (${err instanceof Error ? err.message : String(err)}). Quit Google Chrome completely, or use getChromeUserDataDirSource() for seeding.`, { cause: err });
         }
       }
       for (const file of essentialFiles) {
@@ -23204,6 +24252,10 @@ var require_browser_config = __commonJS({
       const zone = (0, shared_1.appTimezoneFromVariables)(vars);
       return zone ? `timezoneId: ${JSON.stringify(zone)},` : "";
     }
+    function discoveryTimezoneId(ctx) {
+      const vars = ctx.variableContext;
+      return (0, shared_1.appTimezoneFromVariables)(vars?.publicTestVariables) ?? (0, shared_1.appTimezoneFromVariables)(vars?.allTestVariables);
+    }
     function getMCPBrowserConfig(opts) {
       const userDataDir = opts?.forceIsolated ? null : getTestUserDataDir();
       const timezoneOption = opts?.timezoneId ? { timezoneId: opts.timezoneId } : {};
@@ -23990,7 +25042,7 @@ var require_survey_door_harvester = __commonJS({
         }
         if (!payload)
           continue;
-        const cleaned = payload.replace(/^\s*```(json)?\s*\n?/, "").replace(/\n?```\s*$/, "").trim();
+        const cleaned = payload.replace(/^\s*```(json)?\s*\n?/i, "").replace(/\n?```\s*$/, "").trim();
         if (!cleaned)
           continue;
         try {