@validate.qa/runner 1.0.103 → 1.0.104

package/dist/run-write-guard-preload.js

@@ -114,7 +114,13 @@ function buildSandboxedEnv(processEnv, testVariables) {
   return env;
 }
 function escapeEnvValue(value) {
-  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
+  if (!value.includes("\r")) {
+    for (const quote of ["'", "`"]) {
+      if (!value.includes(quote))
+        return `${quote}${value}${quote}`;
+    }
+  }
+  const escaped = value.replace(/"/g, '\\"').replace(/\n/g, "\\n").replace(/\r/g, "\\r");
   return `"${escaped}"`;
 }
 var API_PREFIX, SUPPORT_EMAIL, PLATFORM_ADMIN_EMAIL, NOREPLY_EMAIL, EMAIL_FROM_IDENTITIES, ADMIN_EMAIL_LIMITS, AUDIO_CHUNK_DURATION_MS, ACTION_BATCH_INTERVAL_MS, ACTION_BATCH_MAX_SIZE, MOBILE_SCREENSHOT_INTERVAL_MS, MOBILE_ACTION_BATCH_MAX_SIZE, MOBILE_BRIDGE_PORT, MOBILE_SNAPSHOT_MAX_SIZE_BYTES, MOBILE_APP_ID_MAX_LENGTH, MOBILE_APP_ID_PATTERN, MOBILE_FOCUS_SETTLE_MS, MOBILE_POST_ACTION_SETTLE_MS, MOBILE_COLD_BOOT_SETTLE_MS, MOBILE_DEFAULT_SWIPE_DISTANCE, MOBILE_MAX_SWIPE_DISTANCE, SELECTOR_PRIORITIES, MOBILE_STEP_TYPES, BLOCKED_ENV_VARS, SPAWNED_ENV_ALLOWLIST, MAX_PLAYWRIGHT_CODE_LENGTH;
@@ -3036,6 +3042,65 @@ var init_discovery_har_decision = __esm({
   }
 });
 
+// ../shared/dist/regex-literal.js
+function opensRegexLiteral(code, i) {
+  let j = i - 1;
+  while (j >= 0 && (code[j] === " " || code[j] === "	"))
+    j--;
+  if (j < 0 || code[j] === "\n" || code[j] === "\r")
+    return true;
+  return regexOpensAfter(code, j);
+}
+function regexOpensAfter(code, j) {
+  const prev = code[j];
+  if (REGEX_OPENERS.includes(prev))
+    return !((prev === "+" || prev === "-") && code[j - 1] === prev);
+  if (!/[a-z]/.test(prev))
+    return false;
+  let start = j;
+  while (start > 0 && /[A-Za-z0-9_$]/.test(code[start - 1]))
+    start--;
+  if (start > 0 && code[start - 1] === ".")
+    return false;
+  return REGEX_KEYWORDS.has(code.slice(start, j + 1));
+}
+function regexLiteralEnd(code, i) {
+  let k = i + 1;
+  let inClass = false;
+  while (k < code.length) {
+    const ch = code[k];
+    if (ch === "\n" || ch === "\r")
+      return k;
+    if (ch === "\\") {
+      if (code[k + 1] === "\n" || code[k + 1] === "\r")
+        return k + 1;
+      k += 2;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]")
+        inClass = false;
+    } else if (ch === "[") {
+      inClass = true;
+    } else if (ch === "/") {
+      k++;
+      while (k < code.length && /[a-z]/i.test(code[k]))
+        k++;
+      return k;
+    }
+    k++;
+  }
+  return code.length;
+}
+var REGEX_OPENERS, REGEX_KEYWORDS;
+var init_regex_literal = __esm({
+  "../shared/dist/regex-literal.js"() {
+    "use strict";
+    REGEX_OPENERS = "(,=:[!&|?{};+-*%~^<>";
+    REGEX_KEYWORDS = /* @__PURE__ */ new Set(["return", "typeof", "case", "do", "else", "in", "of", "new", "delete", "void", "throw", "await", "yield", "instanceof"]);
+  }
+});
+
 // ../shared/dist/assertion-classifier.js
 function isButtonOrLinkLocator(line) {
   return /getByRole\s*\(\s*['"`](?:button|link)['"`]/i.test(line);
@@ -3344,7 +3409,7 @@ function classifyMobileAssertValue(value, context = {}) {
     return { tier: 2, reason: t2[1] };
   return null;
 }
-function regexLiteralEnd(text, start) {
+function regexLiteralEnd2(text, start) {
   let inClass = false;
   for (let i = start + 1; i < text.length; i++) {
     const ch = text[i];
@@ -3370,7 +3435,7 @@ function parenDepthDelta(text) {
   let depth = 0;
   let quote = null;
   let escaped = false;
-  let prev = "";
+  let prevAt = -1;
   let noRegexUntil = -1;
   for (let i = 0; i < text.length; i++) {
     const ch = text[i];
@@ -3385,7 +3450,7 @@ function parenDepthDelta(text) {
     if (quote) {
       if (ch === quote) {
         quote = null;
-        prev = ch;
+        prevAt = i;
       }
       continue;
     }
@@ -3404,11 +3469,11 @@ function parenDepthDelta(text) {
         i = close + 1;
         continue;
       }
-      if (i > noRegexUntil && (prev === "" || REGEX_PRECEDER.has(prev))) {
-        const end = regexLiteralEnd(text, i);
+      if (i > noRegexUntil && (prevAt < 0 || regexOpensAfter(text, prevAt))) {
+        const end = regexLiteralEnd2(text, i);
         if (end > 0) {
           i = end - 1;
-          prev = "a";
+          prevAt = end - 1;
           continue;
         }
         const nl = text.indexOf("\n", i);
@@ -3420,14 +3485,15 @@ function parenDepthDelta(text) {
     else if (ch === ")")
       depth--;
     if (ch !== " " && ch !== "	" && ch !== "\n")
-      prev = ch;
+      prevAt = i;
   }
   return depth;
 }
-var PENDING_STATE_TEXT_REASON, PENDING_STATE_TEXT, TIER1_PATTERNS, TIER2_PATTERNS, TIER4_PATTERNS, SINGLE_QUOTED, DOUBLE_QUOTED, BACKTICK_QUOTED, QUOTED_BODY, LOCATOR_ARG_VALUE, LOCATOR_TEXT_ARG_PATTERNS, EXPECT_TOKEN, REGEX_PRECEDER;
+var PENDING_STATE_TEXT_REASON, PENDING_STATE_TEXT, TIER1_PATTERNS, TIER2_PATTERNS, TIER4_PATTERNS, SINGLE_QUOTED, DOUBLE_QUOTED, BACKTICK_QUOTED, QUOTED_BODY, LOCATOR_ARG_VALUE, LOCATOR_TEXT_ARG_PATTERNS, EXPECT_TOKEN;
 var init_assertion_classifier = __esm({
   "../shared/dist/assertion-classifier.js"() {
     "use strict";
+    init_regex_literal();
     PENDING_STATE_TEXT_REASON = 'pending-state text ("Sending...") is transient';
     PENDING_STATE_TEXT = /\b(?!(?:Billing|Shipping|Pricing|Listing|Meeting|Morning|Evening|Warning|Building|Training|Marketing|Parking|Housing|Reading|Rating|Heading|Ceiling|Wedding|Clothing|Painting|Setting)\b)[A-Z][a-z]{2,}ing(?:\.{3}|…)/;
     TIER1_PATTERNS = [
@@ -3504,7 +3570,6 @@ var init_assertion_classifier = __esm({
       new RegExp(`\\.filter\\s*\\(\\s*\\{[^}]{0,200}?\\bhasText\\s*:\\s*${LOCATOR_ARG_VALUE}`, "gi")
     ];
     EXPECT_TOKEN = /\bexpect\s*[.(]/;
-    REGEX_PRECEDER = /* @__PURE__ */ new Set(["(", ",", "=", ":", "[", "!", "&", "|", "?", "{", "}", ";", "+", "-", "*", "%", "<", ">", "~", "^"]);
   }
 });
 
@@ -3512,14 +3577,80 @@ var init_assertion_classifier = __esm({
 function isExpectCall(code) {
   return EXPECT_CALL_RE.test(code);
 }
+function specCallsExpect(code) {
+  if (EXPECT_CALL_RE.test(code) || SPACED_EXPECT_CALL_RE.test(code) || CONFIGURE_IN_PLACE_RE.test(code))
+    return true;
+  const names = /* @__PURE__ */ new Set();
+  for (const clause of code.matchAll(IMPORT_CLAUSE_RE)) {
+    for (const alias of clause[1].matchAll(EXPECT_ALIAS_RE))
+      names.add(alias[1]);
+  }
+  for (const decl of code.matchAll(DERIVED_EXPECT_DECL_RE)) {
+    if (names.size >= MAX_DERIVED_EXPECT_NAMES)
+      break;
+    const base = decl[2];
+    if (base === void 0 || base === "expect" || names.has(base))
+      names.add(decl[1]);
+  }
+  names.delete("expect");
+  if (names.size === 0)
+    return false;
+  const alts = [...names].map((n) => n.replace(/\$/g, "\\$")).join("|");
+  return new RegExp(String.raw`(?<![\w$.])(?:${alts})${EXPECT_MODIFIERS}`).test(code);
+}
 function asPlainExpect(code) {
   return code.replace(/\bexpect\.soft(\s*\()/g, "expect$1");
 }
-var EXPECT_CALL_RE;
+function expectAliasNames(code) {
+  if (!MAY_ALIAS.test(code))
+    return [];
+  const imported = [];
+  for (const m of code.matchAll(PW_IMPORT)) {
+    for (const a of m[1].matchAll(IMPORT_AS_EXPECT))
+      imported.push(a[1]);
+  }
+  const known = /* @__PURE__ */ new Set(["expect", ...imported]);
+  const derived = [];
+  for (const m of code.matchAll(DECLARATION)) {
+    const rhs = DERIVED.exec(code.slice(m.index + m[0].length, m.index + m[0].length + 200));
+    if (!rhs)
+      continue;
+    const base = rhs[1];
+    const fromKnown = base === void 0 || (rhs[2] ? base === "test" : known.has(base));
+    if (!fromKnown || m[1] === "expect")
+      continue;
+    known.add(m[1]);
+    derived.push(m[1]);
+  }
+  const fromImports = LOCAL_EXPECT.test(code) ? [] : imported;
+  return [.../* @__PURE__ */ new Set([...fromImports, ...derived])].filter((n) => n !== "expect");
+}
+function withExpectAliasesAsExpect(code) {
+  let out = code;
+  for (const name of expectAliasNames(code)) {
+    const escaped = name.replace(/\$/g, "\\$");
+    out = out.replace(new RegExp(`(?<![\\w$.])${escaped}(?=\\s{0,20}(?:\\.\\s{0,20}(?:soft|poll)\\s{0,20})?\\()`, "g"), "expect");
+  }
+  return out;
+}
+var EXPECT_CALL_RE, EXPECT_MODIFIERS, SPACED_EXPECT_CALL_RE, CONFIGURE_IN_PLACE_RE, IMPORT_CLAUSE_RE, EXPECT_ALIAS_RE, DERIVED_EXPECT_DECL_RE, MAX_DERIVED_EXPECT_NAMES, PW_IMPORT, IMPORT_AS_EXPECT, DECLARATION, DERIVED, LOCAL_EXPECT, MAY_ALIAS;
 var init_expect_call = __esm({
   "../shared/dist/expect-call.js"() {
     "use strict";
     EXPECT_CALL_RE = /\bexpect(?:\.(?:soft|poll))?\s*\(/;
+    EXPECT_MODIFIERS = String.raw`\s*(?:\.\s*soft\s*)?(?:\.\s*poll\s*)?\(`;
+    SPACED_EXPECT_CALL_RE = new RegExp(String.raw`\bexpect${EXPECT_MODIFIERS}`);
+    CONFIGURE_IN_PLACE_RE = new RegExp(String.raw`\bexpect\s*\.\s*configure\s*\(\s*(?:\{[^{}()]{0,500}\}\s*)?\)${EXPECT_MODIFIERS}`);
+    IMPORT_CLAUSE_RE = /\bimport\s+(?:type\s+)?\{([^{}]{0,2000})\}/g;
+    EXPECT_ALIAS_RE = /\bexpect\s+as\s+([A-Za-z_$][\w$]*)/g;
+    DERIVED_EXPECT_DECL_RE = /\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*(?:([A-Za-z_$][\w$]*)\s*\.\s*(?:configure|extend)|mergeExpects)\s*\(/g;
+    MAX_DERIVED_EXPECT_NAMES = 20;
+    PW_IMPORT = /\bimport\s{0,20}\{([^}]{0,4000})\}\s{0,20}from\s{0,20}['"]@playwright\/test['"]/g;
+    IMPORT_AS_EXPECT = /(?:^|,)\s{0,20}expect\s{1,20}as\s{1,20}([A-Za-z_$][\w$]{0,99})\s{0,20}(?=,|$)/g;
+    DECLARATION = /\b(?:const|let|var)\s{1,20}([A-Za-z_$][\w$]{0,99})\s{0,20}(?::[^=;\n]{0,200})?=\s{0,20}/g;
+    DERIVED = /^(?:mergeExpects\s{0,20}\(|([A-Za-z_$][\w$]{0,99})(\s{0,20}\.\s{0,20}expect)?\s{0,20}\.\s{0,20}(?:configure|extend)\s{0,20}\(|test\s{0,20}\.\s{0,20}expect\b(?!\s{0,20}[.(]))/;
+    LOCAL_EXPECT = /\b(?:const|let|var)\s{1,20}expect\b/;
+    MAY_ALIAS = /\bexpect\s{1,20}as\b|\.\s{0,20}(?:configure|extend)\s{0,20}\(|\bmergeExpects\b|\btest\s{0,20}\.\s{0,20}expect\b/;
   }
 });
 
@@ -3549,65 +3680,6 @@ var init_braced_clause = __esm({
   }
 });
 
-// ../shared/dist/regex-literal.js
-function opensRegexLiteral(code, i) {
-  let j = i - 1;
-  while (j >= 0 && (code[j] === " " || code[j] === "	"))
-    j--;
-  if (j < 0 || code[j] === "\n" || code[j] === "\r")
-    return true;
-  return regexOpensAfter(code, j);
-}
-function regexOpensAfter(code, j) {
-  const prev = code[j];
-  if (REGEX_OPENERS.includes(prev))
-    return !((prev === "+" || prev === "-") && code[j - 1] === prev);
-  if (!/[a-z]/.test(prev))
-    return false;
-  let start = j;
-  while (start > 0 && /[A-Za-z0-9_$]/.test(code[start - 1]))
-    start--;
-  if (start > 0 && code[start - 1] === ".")
-    return false;
-  return REGEX_KEYWORDS.has(code.slice(start, j + 1));
-}
-function regexLiteralEnd2(code, i) {
-  let k = i + 1;
-  let inClass = false;
-  while (k < code.length) {
-    const ch = code[k];
-    if (ch === "\n" || ch === "\r")
-      return k;
-    if (ch === "\\") {
-      if (code[k + 1] === "\n" || code[k + 1] === "\r")
-        return k + 1;
-      k += 2;
-      continue;
-    }
-    if (inClass) {
-      if (ch === "]")
-        inClass = false;
-    } else if (ch === "[") {
-      inClass = true;
-    } else if (ch === "/") {
-      k++;
-      while (k < code.length && /[a-z]/i.test(code[k]))
-        k++;
-      return k;
-    }
-    k++;
-  }
-  return code.length;
-}
-var REGEX_OPENERS, REGEX_KEYWORDS;
-var init_regex_literal = __esm({
-  "../shared/dist/regex-literal.js"() {
-    "use strict";
-    REGEX_OPENERS = "(,=:[!&|?{};+-*%~^<>";
-    REGEX_KEYWORDS = /* @__PURE__ */ new Set(["return", "typeof", "case", "do", "else", "in", "of", "new", "delete", "void", "throw", "await", "yield", "instanceof"]);
-  }
-});
-
 // ../shared/dist/assertion-proof.js
 function fragmentKindOf(literal, fromText) {
   const text = literal.trim();
@@ -3766,7 +3838,7 @@ function stripCoverageComments(code) {
   let copyFrom = 0;
   let i = 0;
   let quote = null;
-  let prev = "";
+  let prevAt = -1;
   let noRegexBefore = 0;
   while (i < code.length) {
     const ch = code[i];
@@ -3777,17 +3849,18 @@ function stripCoverageComments(code) {
       }
       if (ch === quote || ch === "\n" && quote !== "`") {
         quote = null;
-        prev = ch === "\n" ? prev : ch;
+        if (ch !== "\n")
+          prevAt = i;
       }
       i++;
       continue;
     }
     const next = code[i + 1];
-    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prev === "" || REGEX_PRECEDER2.includes(prev))) {
+    if (ch === "/" && next !== "*" && next !== "/" && i >= noRegexBefore && (prevAt < 0 || regexOpensAfter(code, prevAt))) {
       const end = regexLiteralEnd3(code, i);
       if (end > 0) {
         i = end;
-        prev = "a";
+        prevAt = end - 1;
         continue;
       }
       const eol = code.indexOf("\n", i);
@@ -3812,7 +3885,7 @@ function stripCoverageComments(code) {
     if (ch === '"' || ch === "'" || ch === "`")
       quote = ch;
     if (ch !== " " && ch !== "	" && ch !== "\n" && ch !== "\r")
-      prev = ch;
+      prevAt = i;
     i++;
   }
   out.push(code.slice(copyFrom));
@@ -4501,11 +4574,12 @@ function assessTitleCoverage(title, code) {
   const repeatedHit = [...repeated].some((term) => hay.includes(term));
   return { covered: hit >= needed || repeatedHit, missingTerms };
 }
-var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, REGEX_PRECEDER2, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
+var COVERAGE_STOP_WORDS, MAX_ASSERTION_JOIN_CHARS, MAX_COVERAGE_LINE_CHARS, BLOCK_SCAFFOLD, cachedAssertionInput, cachedAssertionSource, LOCAL_BINDING, ASSERTED_STATUS_RE, MAX_RESOLVED_NAMES_PER_LINE, WORD_CHAR_RE, NOT_CONTAIN_TEXT_RE, PLACE_PHRASE_RE, PLACE_WORD_MIN_CHARS, PLACE_FUNCTION_WORDS, HIDDEN_STATE_TERMS, HIDDEN_ELEMENT_LINE_RE, HIDDEN_LINE_RE, MAX_SHOWN_EARLIER_LINES, SHOWN_EARLIER_LITERAL_RE, SHARED_PREFIX_MIN_CHARS, MAX_SHOWN_EARLIER_LITERALS, VALUE_SHAPE_RE, VALUE_SHAPE_ALL_RE, TITLE_TERM_MIN;
 var init_expected_outcome_coverage = __esm({
   "../shared/dist/expected-outcome-coverage.js"() {
     "use strict";
     init_assertion_classifier();
+    init_regex_literal();
     COVERAGE_STOP_WORDS = /* @__PURE__ */ new Set([
       "after",
       "before",
@@ -4538,7 +4612,6 @@ var init_expected_outcome_coverage = __esm({
     ]);
     MAX_ASSERTION_JOIN_CHARS = 8e3;
     MAX_COVERAGE_LINE_CHARS = 2e3;
-    REGEX_PRECEDER2 = "(,=:[!&|?{};+-*%<>~^";
     BLOCK_SCAFFOLD = /=>|\b(?:test|describe|it|beforeEach|afterEach|beforeAll|afterAll|function)\b/;
     cachedAssertionInput = null;
     cachedAssertionSource = { raw: "", normalized: "", bindings: /* @__PURE__ */ new Map(), bindingRefs: /* @__PURE__ */ new Map() };
@@ -4634,7 +4707,7 @@ function replaceBlockComments(code, replacer) {
       continue;
     const next = code[i + 1];
     if (next !== "/" && next !== "*" && opensRegexLiteral(code, i)) {
-      i = regexLiteralEnd2(code, i) - 1;
+      i = regexLiteralEnd(code, i) - 1;
       continue;
     }
     if (next === "/" && !(code[i - 1] === ":" && /[A-Za-z]/.test(code[i - 2] ?? ""))) {
@@ -4809,10 +4882,41 @@ var init_auth_handoff_coverage = __esm({
 });
 
 // ../shared/dist/auth-plan.js
-function hasInlineLoginSteps(playwrightCode) {
+function stripStampedHelperRegions(code) {
+  let out = code;
+  for (const [open, close] of STAMPED_HELPER_REGIONS) {
+    if (out.indexOf(open) === -1)
+      continue;
+    let kept = "";
+    let i = 0;
+    while (i < out.length) {
+      const start = out.indexOf(open, i);
+      if (start === -1) {
+        kept += out.slice(i);
+        break;
+      }
+      const end = out.indexOf(close, start + open.length);
+      if (end === -1) {
+        kept += out.slice(i);
+        break;
+      }
+      const lineEnd = out.indexOf("\n", end);
+      kept += out.slice(i, start);
+      i = lineEnd === -1 ? out.length : lineEnd + 1;
+    }
+    out = kept;
+  }
+  return out;
+}
+function signsInInline(playwrightCode) {
   if (!playwrightCode)
     return false;
-  return /process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode) && /process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode);
+  if (!/process\.env\.TEST_USER_EMAIL!?/.test(playwrightCode))
+    return false;
+  if (/process\.env\.TEST_USER_PASSWORD!?/.test(playwrightCode))
+    return true;
+  const body = stripStampedHelperRegions(playwrightCode);
+  return /process\.env\.TEST_USER_EMAIL/.test(body) && /__vqaWaitForEmail\s*\(/.test(body);
 }
 function hasGeneratedAuthGuard(playwrightCode) {
   if (!playwrightCode)
@@ -4831,7 +4935,7 @@ function legacyNeedsCookieState(tags, code, sharedAuthInjectEnabled) {
   if (sharedAuthInjectEnabled && tags.includes("@auth-guarded") && hasGeneratedAuthGuard(code))
     return true;
   const isGeneratedVariant = tags.includes("@edge") || tags.includes("@bug");
-  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && hasInlineLoginSteps(code);
+  const hasLegacyInlineLogin = tags.includes("@discovered") && !isGeneratedVariant && signsInInline(code);
   return !tags.includes("@inline-login") && !hasLegacyInlineLogin;
 }
 function codeReadsStoredCredentials(code) {
@@ -4952,7 +5056,7 @@ function authTypeTag(tags) {
   const explicit = explicitAuthTypeTags(t);
   return explicit.length === 1 ? explicit[0] : void 0;
 }
-var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY;
+var AUTH_TAG_COOKIE_STATE, AUTH_TAG_LOGIN_COOKIE, AUTH_TAG_LOGIN_BEARER, AUTH_TAG_STANDING, AUTH_TAG_NONE, AUTH_TAG_UNSUPPORTED, AUTH_TYPE_TAGS, AUTH_TAG_ALIASES, TEST_USER_ENV_KEYS, API_AUTH_HEADERS_ENV_KEY, STAMPED_HELPER_REGIONS;
 var init_auth_plan = __esm({
   "../shared/dist/auth-plan.js"() {
     "use strict";
@@ -4979,6 +5083,10 @@ var init_auth_plan = __esm({
     };
     TEST_USER_ENV_KEYS = ["TEST_USER_EMAIL", "TEST_USER_PASSWORD"];
     API_AUTH_HEADERS_ENV_KEY = "API_AUTH_HEADERS";
+    STAMPED_HELPER_REGIONS = [
+      ["// >>> VALIDATE_QA_INBOX", "// <<< VALIDATE_QA_INBOX"],
+      ["// >>> VALIDATE_QA_SMS", "// <<< VALIDATE_QA_SMS"]
+    ];
   }
 });
 
@@ -4987,6 +5095,9 @@ function parseLastActionProofMode(raw) {
   const v = (raw ?? "").trim().toLowerCase();
   return v === "on" || v === "shadow" ? v : "off";
 }
+function parseAbsenceProofMode(raw) {
+  return parseLastActionProofMode(raw);
+}
 function isUrlProof(stmt) {
   if (URL_PROOF.test(stmt))
     return true;
@@ -5374,6 +5485,65 @@ function isVacuousAccountAbsence(stmt, shown, account) {
   }
   return true;
 }
+function isAbsenceCheck(stmt) {
+  if (!claimsAbsence(stmt))
+    return false;
+  const bare = stmt.replace(NOT_BEFORE_MATCHER, ".");
+  return ABSENCE_READ.test(bare) || VALUE_ABSENCE.test(bare) || OPTION_ABSENCE.test(bare);
+}
+function comparableSubject(subject) {
+  let s = subject.replace(/^\s*await\s+/, "").replace(/\s+/g, "");
+  for (let prev = ""; prev !== s; ) {
+    prev = s;
+    s = s.replace(/\.(?:count|isVisible|isHidden|first|last)\(\)$/, "").replace(/\.nth\(\d+\)$/, "");
+  }
+  return s;
+}
+function subjectsThatExisted(checks, interactionStmts) {
+  const out = [];
+  const bound = locatorBindings(interactionStmts);
+  const resolve = (expr) => {
+    for (let depth = 0; depth < 4; depth++) {
+      const lead = expr.match(/^\s*(?:await\s+)?([A-Za-z_$][\w$]*)(?![\w$(])/);
+      const to = lead ? bound.get(lead[1]) : void 0;
+      if (!lead || to === void 0)
+        break;
+      expr = `${to.replace(/;\s*$/, "")}${expr.slice(lead[0].length)}`;
+    }
+    return expr;
+  };
+  for (const { stmt } of checks) {
+    if (isAbsenceCheck(stmt))
+      continue;
+    const subject = extractExpectSubject(stmt);
+    if (subject)
+      out.push(comparableSubject(subject));
+  }
+  for (const stmt of interactionStmts) {
+    if (EXPECT_CALL_RE.test(stmt))
+      continue;
+    for (const m of stmt.matchAll(LOCATOR_USE)) {
+      if (m[0].includes("waitFor") && /state\s*:\s*['"`](?:hidden|detached)/.test(stmt.slice(m.index)))
+        continue;
+      const before = stmt.slice(0, m.index).replace(/^\s*(?:(?:const|let|var)\s+[\w$]+\s*=|return\b)\s*/, "");
+      if (before.trim())
+        out.push(comparableSubject(resolve(before)));
+    }
+  }
+  return out;
+}
+function isUnshownAbsence(stmt, existed, entered) {
+  if (!isAbsenceCheck(stmt))
+    return false;
+  const raw = extractExpectSubject(stmt);
+  if (!raw || !/\b(?:locator|getBy[A-Z]\w*|frameLocator)\s*\(/.test(raw))
+    return false;
+  const subject = comparableSubject(raw);
+  if (existed.some((e) => e === subject || e.startsWith(`${subject}.`)))
+    return false;
+  const named = raw.match(/['"`][^'"`]+['"`]/g) ?? [];
+  return !named.some((q) => entered.values.has(q.slice(1, -1).toLowerCase()));
+}
 function endOfEnclosingCall(stmt, from) {
   let depth = 0;
   for (let i = from; i < stmt.length; i++) {
@@ -5873,10 +6043,31 @@ function comparesWithItself(subject, tail) {
   const expected = squash2(args);
   return expected === squash2(m[1] === "toHaveCount" ? `${subject}.count()` : subject);
 }
+function ariaSnapshotTexts(template) {
+  const out = [];
+  for (const raw of template.split(ARIA_ENTRY_SPLIT)) {
+    const m = ARIA_ENTRY.exec(raw.trim());
+    if (!m || !ARIA_CONTENT_ROLES.has(m[1]))
+      continue;
+    for (const text of [m[2], m[3]]) {
+      const t = text?.replace(/\\(.)/g, "$1").replace(/^["']|["']$/g, "").trim();
+      if (!t || t.startsWith("/") || !/[\p{L}\p{N}]/u.test(t) || /["'`\\]/.test(t))
+        continue;
+      out.push(t);
+    }
+  }
+  return out;
+}
+function presenceTwin(stmt) {
+  return stmt.replace(NOT_HIDDEN, ".toBeVisible(").replace(NOT_COUNT_ZERO, ".toBeVisible(");
+}
 function asPlainAssertion(s) {
   return plainAssertion(s, false);
 }
 function plainAssertion(s, keepSelfCompare) {
+  const twin = presenceTwin(s.stmt);
+  if (twin !== s.stmt)
+    return plainAssertion({ ...s, stmt: twin }, keepSelfCompare);
   const { stmt } = s;
   if (COUNT_AT_LEAST_ZERO.test(stmt))
     return [];
@@ -5887,6 +6078,12 @@ function plainAssertion(s, keepSelfCompare) {
   const subjectAt = stmt.indexOf(subject, stmt.search(EXPECT_CALL_RE));
   const tail = (stmt.startsWith("expect.poll", stmt.search(EXPECT_CALL_RE)) ? expectCallTail(stmt) : null) ?? stmt.slice(subjectAt + subject.length).trimStart();
   const as = (rewritten) => [{ ...s, stmt: rewritten }];
+  const aria = ARIA_TEMPLATE_CALL.exec(tail);
+  if (aria && !NEGATED_ASSERT.test(stmt)) {
+    const texts = ariaSnapshotTexts(aria[2]);
+    if (texts.length > 0)
+      return texts.map((t) => ({ ...s, stmt: `await expect(${plain}).toContainText(${JSON.stringify(t)});` }));
+  }
   if (LOCATOR_EXPR.test(plain) && !LOCATOR_VALUE_READ.test(plain) && ALWAYS_TRUE_ON_OBJECT.test(tail))
     return [];
   if (DEFINED_VALUE_READ.test(plain) && ALWAYS_DEFINED.test(tail))
@@ -6193,7 +6390,8 @@ function teardownLines(lines) {
   }
   return out;
 }
-function validateAssertionStrength(code, opts = {}) {
+function validateAssertionStrength(source, opts = {}) {
+  const code = withExpectAliasesAsExpect(source);
   const body = stripLoginScaffolding(code);
   const lines = body.split("\n");
   const stmts = liveExpectStatements(stripCoverageComments(body)).flatMap(asPlainAssertion);
@@ -6346,8 +6544,23 @@ function validateAssertionStrength(code, opts = {}) {
   const orderedPersistence = firstMutLine !== void 0 ? persistence : void 0;
   const signedIn = signInProofWindow(interactionStmts, interactionStmtsWithLines, lines, blockIds);
   const proof = classifyOutcomeProof(checks, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn);
+  const absenceProof = opts.absenceProof ?? "off";
+  let absenceOnly = false;
+  if (absenceProof !== "off" && proof.kind === "durable") {
+    const existed = subjectsThatExisted(checks, interactionStmtsRaw);
+    const kept = checks.filter(({ stmt }) => !isUnshownAbsence(stmt, existed, entered));
+    absenceOnly = kept.length < checks.length && classifyOutcomeProof(kept, mutated, reloaded, clickedControlNames(interactionStmts), entered, firstMutLine, orderedPersistence, signedIn).kind !== "durable";
+    if (absenceOnly && absenceProof === "on") {
+      return {
+        ok: false,
+        severity: mutated ? "block" : "downgrade",
+        reason: "the only outcome checks are absence checks (not visible / hidden / count 0) of something the test never showed, touched or typed: they pass whether or not the action worked \u2014 assert what the action produced (the new text, value, count or page), or assert the element present before it goes",
+        signals: base({ interacted, mutated, navOnly, hasOutcomeProof: false, terminal, absenceOnly: true })
+      };
+    }
+  }
   if (proof.kind === "durable") {
-    const signals2 = base({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal });
+    const signals2 = base({ interacted, mutated, navOnly, hasOutcomeProof: true, terminal, ...absenceOnly ? { absenceOnly } : {} });
     const { last, prev } = acts;
     if (teardown !== null && last !== null && acts.count >= 2 && last.kind !== "fill" && (last.kind === "enter" || isCommitClick(interactionStmts[last.i]) && !(prev?.kind === "click" && isDestructiveClick(interactionStmts[prev.i])))) {
       const lastLine = interactionStmtsWithLines[last.i].startLine;
@@ -6451,7 +6664,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, POLL_OPEN, POLL_PAGE_URL, POLL_PAGE_URL_ONLY, POLL_CALLS_MAX, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD2, TEST_BLOCK_OPEN, LOCATOR_BINDING, EXPECT_OPEN, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, BARE_CONTAINER_ROLE, HAS_TEXT_FILTER, OUTCOME_TEXT, SUCCESS_NOTICE_TEXT, NOT_A_SUCCESS_NOTICE, ANNOUNCE_ROLE, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, NEGATED_ASSERT_NOT, CONST_CHAIN_MAX_DEPTH, TYPED_INPUT, TITLE_LINE, FAILURE_STATUS_ASSERT, FAILED_LIST_ASSERT, ENDPOINT_DOWN, NAVIGATION_RESPONSE_VAR, DIRECT_REQUEST_VAR, CATCH_ALL_PATTERN, GUARD_HANDLER, ABSENCE_MATCHER, VALUE_ABSENCE, OPTION_ABSENCE, NOT_BEFORE_MATCHER, ERROR_TEXT_WORDS, TEXT_REGEX_ARG, ABSENCE_READ, LOCATOR_USE, SCOPING_STEP, NEGATED_TEXT, ASYNC_DESTRUCTURE_OPEN, REQUEST_WORD, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES, POLL_CALLBACK, CONSTANT_WORD, CONSTANT_GLUE_CHARS, WORD_CHAR, MATCHER_ARGS_MAX, MATCHER_OPEN, ENTERED_VALUE, PAGE_NAV, ENV_READ, ENTERED_ENV, HAVE_VALUE_ENV, ACCOUNT_KEYS, ACCOUNT_ENV, ACCOUNT_CONST, IN_FLIGHT_TEXT, LOCATOR_VALUE_READ, LOCATOR_EXPR, ALWAYS_TRUE_ON_OBJECT, COUNT_AT_LEAST_ZERO, DEFINED_VALUE_READ, ALWAYS_DEFINED, SELF_COMPARE_MATCHER, IS_VISIBLE_TRUE, PAGE_VALUE_MATCHER, COUNT_ONE, ARIA_TEMPLATE_CALL, ARIA_ENTRY_SPLIT, ARIA_CONTENT_ROLES, ARIA_ENTRY, NOT_HIDDEN, NOT_COUNT_ZERO, URL_CHECK_ARG, PLAIN_PAGE_PATH, FORM_CONTROL_LOCATOR, CONTROL_VALUE_MATCHER, ACCOUNT_EMAIL_ENV, ENV_PASSWORD_ENTRY, ACCOUNT_CONTROL_ROLE, ASSERT_OR_WAIT, ACTS, actLinesOf, CLOSERS_ONLY, TEST_BODY_OPEN, COPY_CONTROL, COPIED_NOTICE, SEND_CONTROL, SEND_NOTICE, MARK_READ_CONTROL, APP_DATA_FIELD, COMMIT_CONTROL, NOT_COMMIT_CONTROL, DESTRUCTIVE_CONTROL, ENTER_PRESS, CONTROL_LABEL, isCommitClick, isDestructiveClick, TEARDOWN_OPEN;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -6540,6 +6753,8 @@ var init_assertion_strength = __esm({
     NOT_BEFORE_MATCHER = /\.not\s*\.\s*(?=to[A-Z])/g;
     ERROR_TEXT_WORDS = /error|fail|wrong|try again|unable|could ?n.?t|can.?t|problem|invalid|unavailable/i;
     TEXT_REGEX_ARG = /(?:getByText|hasText|getByRole\([^)]{0,200}name)\s*[:(]\s*(\/(?:\\.|[^/\\\n])+\/[a-z]*)/;
+    ABSENCE_READ = /\.toBeVisible\s*\(|\.toBeHidden\s*\(|\.toHaveCount\s*\(\s*0\s*\)|\.toBeAttached\s*\(|\.toHaveText\s*\(|\.toContainText\s*\(/;
+    LOCATOR_USE = /\.\s*(?:click|dblclick|tap|hover|focus|fill|clear|press|pressSequentially|type|check|uncheck|setChecked|selectOption|setInputFiles|dragTo|selectText|waitFor)\s*\(/g;
     SCOPING_STEP = /(?:\s*\.\s*(?:first|last|nth)\s*\([^()]*\))*\s*\.\s*(?:getBy[A-Z]\w*|locator|filter)\s*\(/y;
     NEGATED_TEXT = /\.not\s*\.\s*(?:toHaveText|toContainText)\s*\(\s*(?:['"`]([^'"`]*)['"`]|\/((?:\\.|[^/\\\n])+)\/)?/;
     ASYNC_DESTRUCTURE_OPEN = /async\s*\(\s*\{/g;
@@ -6581,6 +6796,29 @@ var init_assertion_strength = __esm({
     IS_VISIBLE_TRUE = /^\)*\s*\.\s*(?:toBe\s*\(\s*true\s*\)|toBeTruthy\s*\(\s*\))/;
     PAGE_VALUE_MATCHER = /^\)\s*\.\s*(?:toBe|toEqual|toStrictEqual|toMatch|toContain)\s*\(/;
     COUNT_ONE = /\.\s*toHaveCount\s*\(\s*1\s*\)/;
+    ARIA_TEMPLATE_CALL = /^\)\s*\.\s*toMatchAriaSnapshot\s*\(\s*(['"`])((?:\\[\s\S]|(?!\1)[^\\])*)\1/;
+    ARIA_ENTRY_SPLIT = /(?:^|\s)-\s+(?=\/?[a-z][a-z-]*(?:\s|:|\[|$))/;
+    ARIA_CONTENT_ROLES = /* @__PURE__ */ new Set([
+      "listitem",
+      "row",
+      "cell",
+      "gridcell",
+      "article",
+      "treeitem",
+      "paragraph",
+      "text",
+      "strong",
+      "emphasis",
+      "code",
+      "blockquote",
+      "term",
+      "definition",
+      "alert",
+      "status"
+    ]);
+    ARIA_ENTRY = /^([a-z][a-z-]*)(?:\s+"((?:\\.|[^"\\])*)")?(?:\s*\[[^\]]*\])*\s*(?::\s*(\S.*)?)?$/s;
+    NOT_HIDDEN = /\.not\s*\.\s*toBeHidden\s*\(/g;
+    NOT_COUNT_ZERO = /\.not\s*\.\s*toHaveCount\s*\(\s*0\s*(?:,\s*|(?=\)))/g;
     URL_CHECK_ARG = /\bpage\s*\.\s*waitForURL\s*\(\s*([^,)]+)|\bexpect(?:\s*\.\s*soft)?\s*\(\s*page\s*\)\s*\.\s*toHaveURL\s*\(\s*([^,)]+)/;
     PLAIN_PAGE_PATH = /^\/[\w\-./~%]*(?:[?#][^\s]*)?$/;
     FORM_CONTROL_LOCATOR = /getByRole\s*\(\s*['"`](?:combobox|switch|checkbox|radio|textbox|searchbox|spinbutton|slider)['"`]|getByLabel\s*\(|getByPlaceholder\s*\(/;
@@ -6626,6 +6864,12 @@ function isCancelledReason(error) {
 function isHeldHealRun(run) {
   return run?.status === "PASSED" && typeof run.error === "string" && run.error.startsWith(HEAL_PATCH_HELD_RUN_ERROR_PREFIX);
 }
+function mayBeUnverifiedHealPass(run, tags) {
+  return !!run && run.status === "PASSED" && run.mode === "heal" && !isHeldHealRun(run) && (tags ?? []).includes(NEEDS_REVIEW_TAG);
+}
+function isUnverifiedHealPass(run, tags, healConfidence) {
+  return mayBeUnverifiedHealPass(run, tags) && typeof healConfidence === "string" && UNVERIFIED_HEAL_CONFIDENCES.has(healConfidence);
+}
 function isRunInterruptedError(error) {
   return typeof error === "string" && RUN_INTERRUPTED_ERROR_PREFIXES.some((prefix) => error.startsWith(prefix));
 }
@@ -6712,12 +6956,25 @@ function classifyErrorMessage(error) {
     return "config_issue";
   if (EMAIL_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
     return "email_not_received";
+  if (SMS_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix)))
+    return "email_not_received";
   if (isCancelledReason(error))
     return "cancelled";
   if (isRetriedRunInterruption(error))
     return "interrupted";
   return null;
 }
+function isSmsNotReceivedError(error) {
+  if (typeof error !== "string")
+    return false;
+  const normalized = error.replace(/^\s+/, "").replace(/^Error:\s*/i, "");
+  return SMS_NOT_RECEIVED_PREFIXES.some((prefix) => normalized.startsWith(prefix));
+}
+function blockedRunLogLine(error, durationMs) {
+  const reason = classifyErrorMessage(error);
+  const tail = reason === "rate_limit" ? "rate-limit detected, not counted as failure" : reason === "config_issue" ? "config issue (needs setup or sign-in), not counted as failure" : reason === "email_not_received" ? "verification email not received, not counted as failure" : reason === "cancelled" ? "cancelled, not counted as failure" : reason === "interrupted" ? "run interrupted, not counted as failure" : "run error";
+  return `BLOCKED (${durationMs}ms) \u2014 ${tail}`;
+}
 function stripEnvironmentalPrefix(error) {
   for (const prefix of ENVIRONMENTAL_ERROR_PREFIXES) {
     if (error.startsWith(prefix)) {
@@ -6780,8 +7037,19 @@ function computePassRate(passed, tested) {
 }
 function summarizeHealth(items) {
   const c = { passed: 0, failed: 0, errored: 0, environmental: 0, never_run: 0 };
+  let rateLimited = 0;
+  let configIssue = 0;
   for (const item of items) {
-    c[classifyTestHealth(item.run)] += item.weight ?? 1;
+    const weight = item.weight ?? 1;
+    const bucket = classifyTestHealth(item.run);
+    c[bucket] += weight;
+    if (bucket === "environmental") {
+      const reason = classifyErrorMessage(item.run?.error);
+      if (reason === "rate_limit")
+        rateLimited += weight;
+      else if (isConfigLikeReason(reason))
+        configIssue += weight;
+    }
   }
   const tested = c.passed + c.failed + c.errored;
   return {
@@ -6789,6 +7057,8 @@ function summarizeHealth(items) {
     failed: c.failed,
     errored: c.errored,
     environmental: c.environmental,
+    rateLimited,
+    configIssue,
     neverRun: c.never_run,
     tested,
     total: tested + c.environmental + c.never_run,
@@ -6825,7 +7095,7 @@ function reportedBugWhere() {
 function bugReviewStatus(status) {
   return status === "QUARANTINED" ? "confirmed" : "needs-review";
 }
-var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
+var USER_CANCELLED_RUN_ERROR, PLATFORM_SUPPORT_CANCELLED_RUN_ERROR, PLATFORM_ADMIN_CANCELLED_RUN_ERROR, ADMIN_FORCE_CANCELLED_RUN_ERROR, CHAIN_CANCELLED_RUN_ERROR, RETRY_HELD_RUN_ERROR, CANCELLED_REASON_PREFIXES, isUserCancelledError, HEAL_PATCH_HELD_RUN_ERROR_PREFIX, UNVERIFIED_HEAL_CONFIDENCES, NEEDS_REVIEW_TAG, RUNNER_INTERRUPT_ERROR_PREFIX, SERVER_INTERRUPT_ERROR_PREFIX, RUN_LOST_ERROR_PREFIX, RUN_INTERRUPTED_ERROR_PREFIXES, RUN_INTERRUPTION_RETRIED_MARKER, RUN_INTERRUPTION_NOT_RETRIED_MARKERS, BUG_ASSERTION_TAG, UNEXPECTED_PASS_ERROR_PREFIX, BUG_TEST_BROKEN_ERROR_PREFIX, BUG_TEST_BROKEN_REASON, TEST_DID_NOT_RUN_ERROR, EMAIL_NOT_RECEIVED_PREFIXES, SMS_NOT_RECEIVED_PREFIXES, ENVIRONMENTAL_ERROR_PREFIXES, ENVIRONMENTAL_ERROR_STORED_PREFIXES, FEATURE_ROW_RUN_WINDOW, BUG_SURFACE_SUPPRESSING_TAGS, QUARANTINE_CLOSE_TAGS, BUG_CANDIDATE_TAG, BUG_TEST_BROKEN_TAG;
 var init_run_classification = __esm({
   "../shared/dist/run-classification.js"() {
     "use strict";
@@ -6845,6 +7115,8 @@ var init_run_classification = __esm({
     ];
     isUserCancelledError = isCancelledReason;
     HEAL_PATCH_HELD_RUN_ERROR_PREFIX = "Heal patch held";
+    UNVERIFIED_HEAL_CONFIDENCES = /* @__PURE__ */ new Set(["low", "medium"]);
+    NEEDS_REVIEW_TAG = "@needs-review";
     RUNNER_INTERRUPT_ERROR_PREFIX = "Runner shutting down";
     SERVER_INTERRUPT_ERROR_PREFIX = "Run interrupted by server restart";
     RUN_LOST_ERROR_PREFIX = "Runner lost this run";
@@ -6865,10 +7137,12 @@ var init_run_classification = __esm({
       "VERIFICATION_EMAIL_HAS_NO_CODE:",
       "VERIFICATION_EMAIL_HAS_NO_LINK:"
     ];
+    SMS_NOT_RECEIVED_PREFIXES = ["VERIFICATION_SMS_NOT_RECEIVED:"];
     ENVIRONMENTAL_ERROR_PREFIXES = [
       "RATE_LIMIT_BLOCKED:",
       "CONFIG_ISSUE:",
-      ...EMAIL_NOT_RECEIVED_PREFIXES
+      ...EMAIL_NOT_RECEIVED_PREFIXES,
+      ...SMS_NOT_RECEIVED_PREFIXES
     ];
     ENVIRONMENTAL_ERROR_STORED_PREFIXES = [
       ...ENVIRONMENTAL_ERROR_PREFIXES.flatMap((prefix) => [prefix, `Error: ${prefix}`]),
@@ -9253,6 +9527,19 @@ function googleBrokerUnavailableLine(lines, testError) {
   }
   return last;
 }
+function googleSignInRefusedLine(lines) {
+  let last = null;
+  for (const raw of lines ?? []) {
+    for (const line of String(raw).split("\n")) {
+      const text = line.trim();
+      if (GOOGLE_SIGN_IN_REFUSED.test(text))
+        last = text;
+      else if (GOOGLE_SIGNED_IN.test(text))
+        last = null;
+    }
+  }
+  return last;
+}
 function stepConsoleLines(result) {
   const steps = Array.isArray(result) ? result : result && typeof result === "object" && Array.isArray(result.stepResults) ? result.stepResults : [];
   return steps.flatMap((step) => {
@@ -9260,7 +9547,23 @@ function stepConsoleLines(result) {
     return Array.isArray(logs) ? logs.filter((line) => typeof line === "string") : [];
   });
 }
-var GOOGLE_BROKER_UNAVAILABLE, GOOGLE_BROKER_ASKED, GOOGLE_SIGNED_IN, TIMEOUT_ERROR;
+function googleSignInRefusedReason(lines) {
+  let reason = null;
+  for (const raw of lines ?? []) {
+    for (const line of String(raw).split("\n")) {
+      const text = line.trim();
+      if (GOOGLE_SIGNED_IN.test(text)) {
+        reason = null;
+        continue;
+      }
+      const m = GOOGLE_SIGN_IN_ANSWER.exec(text);
+      if (m)
+        reason = m[1];
+    }
+  }
+  return reason;
+}
+var GOOGLE_BROKER_UNAVAILABLE, GOOGLE_BROKER_ASKED, GOOGLE_SIGNED_IN, TIMEOUT_ERROR, GOOGLE_SIGN_IN_REFUSED, GOOGLE_SIGN_IN_ANSWER;
 var init_google_broker_lines = __esm({
   "../shared/dist/google-broker-lines.js"() {
     "use strict";
@@ -9268,6 +9571,8 @@ var init_google_broker_lines = __esm({
     GOOGLE_BROKER_ASKED = /^\[google-sign-in\] the app started Google sign-in; asking the broker/;
     GOOGLE_SIGNED_IN = /^\[google-sign-in\] returned to the app with Google sign-in/;
     TIMEOUT_ERROR = /Test timeout of \d+ms exceeded|TimeoutError|Timeout:? \d+ ?ms/i;
+    GOOGLE_SIGN_IN_REFUSED = /^\[google-sign-in\] (?:not_seeded|not_enabled|expired|needs_reseed|device_approval|needs_verification|policy_rejected|unsupported_flow|unsupported_one_tap): /;
+    GOOGLE_SIGN_IN_ANSWER = /^\[google-sign-in\] ([a-z][a-z0-9_]*): /;
   }
 });
 
@@ -9319,22 +9624,87 @@ function isIntentionalNegativeAuthTest(input) {
   const meta = [input.testName, input.description].filter(Boolean).join(" ");
   return matchesAny(meta, INTENTIONAL_NEGATIVE_AUTH);
 }
+function signInStepPassedBeforeFailure(steps) {
+  const list = steps ?? [];
+  const failedAt = list.findIndex((step) => typeof step.status === "string" && step.status !== "passed" && step.status !== "skipped");
+  if (failedAt <= 0)
+    return false;
+  if (SIGN_IN_STEP_TITLE.test(list[failedAt].title ?? ""))
+    return false;
+  return list.slice(0, failedAt).some((step) => step.status === "passed" && SIGN_IN_STEP_TITLE.test(step.title ?? ""));
+}
+function loginFormAlertTexts(body) {
+  const text = body.length > ERROR_CONTEXT_CAP ? body.slice(0, ERROR_CONTEXT_CAP) : body;
+  const blocks = [];
+  let open = null;
+  for (const line of text.split("\n")) {
+    const fence = /^```(\w*)$/.exec(line.trim());
+    if (fence) {
+      if (open) {
+        blocks.push(open);
+        open = null;
+      } else if (fence[1].toLowerCase() === "yaml")
+        open = [];
+      continue;
+    }
+    if (open)
+      open.push(line);
+  }
+  const alerts = [];
+  for (const lines of blocks) {
+    if (!lines.some((l) => SNAPSHOT_PASSWORD_FIELD.test(l)))
+      continue;
+    for (let i = 0; i < lines.length && alerts.length < MAX_ALERTS; i++) {
+      const m = SNAPSHOT_ALERT.exec(lines[i]);
+      if (!m)
+        continue;
+      const indent = m[1].length;
+      const parts = [m[2]];
+      let j = i + 1;
+      for (; j < lines.length; j++) {
+        const lead = /^\s*/.exec(lines[j])?.[0].length ?? 0;
+        if (lines[j].trim() === "" || lead <= indent)
+          break;
+        parts.push(lines[j].trim());
+      }
+      alerts.push(parts.join(" ").slice(0, MAX_ALERT_CHARS));
+      i = j - 1;
+    }
+  }
+  return alerts;
+}
+function stepLoginFormAlerts(steps) {
+  const out = [];
+  for (const sr of steps ?? []) {
+    for (const a of sr.attachments ?? []) {
+      if (a?.name === "error-context" && typeof a.body === "string")
+        out.push(...loginFormAlertTexts(a.body));
+    }
+  }
+  return out;
+}
 function detectAuthBlock(input) {
   const tags = input.tags ?? [];
   const isAuthed = tags.some((t) => AUTHED_TAGS.includes(t));
-  if (!isAuthed)
+  const signsInInline2 = !isAuthed && codeReadsStoredCredentials(input.code);
+  if (!isAuthed && !signsInInline2)
     return NO_DETECTION;
   if (isIntentionalNegativeAuthTest(input))
     return NO_DETECTION;
+  if (signInStepPassedBeforeFailure(input.stepResults))
+    return NO_DETECTION;
   const sources = [];
-  if (input.error)
-    sources.push(stripEchoLines(input.error));
-  if (input.logs)
-    sources.push(stripEchoLines(input.logs));
-  for (const sr of input.stepResults ?? []) {
-    if (sr.error)
-      sources.push(stripEchoLines(sr.error));
+  if (isAuthed) {
+    if (input.error)
+      sources.push(stripEchoLines(input.error));
+    if (input.logs)
+      sources.push(stripEchoLines(input.logs));
+    for (const sr of input.stepResults ?? []) {
+      if (sr.error)
+        sources.push(stripEchoLines(sr.error));
+    }
   }
+  sources.push(...stepLoginFormAlerts(input.stepResults));
   for (const text of sources) {
     if (!text)
       continue;
@@ -9383,10 +9753,11 @@ function detectApiColdSessionBlock(input) {
 function coldSessionConfigMessage(context, reason, evidence) {
   return `CONFIG_ISSUE: ${context} without valid injected auth (${reason}) \u2014 no session cookie was injected this run. Ensure the project login (auth-setup recipe / prewarm) is configured so the shared session jar warms (a project with no login: set TEST_USER_EMAIL and TEST_USER_PASSWORD in Test Data \u2192 Test Variables so a session can be captured); for endpoints that authenticate with a standing API key or bearer header instead, set them in the project's API_AUTH_HEADERS variable (injected as request headers). Evidence: ${evidence.join("; ")}`;
 }
-var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, UNAUTHORIZED_TEXT_RE;
+var NO_DETECTION, AUTHED_TAGS, LOGIN_CTX, AUTH_BLOCK_SIGNATURES, INTENTIONAL_NEGATIVE_AUTH, ECHO_LINE_RE, SIGN_IN_STEP_TITLE, ERROR_CONTEXT_CAP, MAX_ALERTS, MAX_ALERT_CHARS, SNAPSHOT_PASSWORD_FIELD, SNAPSHOT_ALERT, UNAUTHORIZED_TEXT_RE;
 var init_auth_block_detector = __esm({
   "../shared/dist/auth-block-detector.js"() {
     "use strict";
+    init_auth_plan();
     NO_DETECTION = { detected: false, reason: "", evidence: [] };
     AUTHED_TAGS = ["@needs-auth", "@inline-login"];
     LOGIN_CTX = "\\b(?:log\\s*in|login|logging\\s+in|sign[\\s-]?in|signing\\s+in|continue)\\b";
@@ -9396,6 +9767,10 @@ var init_auth_block_detector = __esm({
       { reason: "invalid credentials", re: /\b(invalid|incorrect|wrong|bad)\s+(login\s+)?credentials\b/i },
       { reason: "credentials do not match", re: /\bcredentials\b[^\n]{0,40}\b(do(?:es)?\s*n['’]?t|do\s+not)\s+match\b/i },
       { reason: "incorrect email or password", re: /\b(incorrect|invalid|wrong)\s+(email|username)\s+or\s+password\b/i },
+      { reason: "username and password do not match", re: /\b(?:user\s*name|e-?mail)\s+and\s+password\s+(?:do(?:es)?\s*n['’]?t|do(?:es)?\s+not)\s+match\b/i },
+      // A locked account is a blocker of the same kind: the configured user can't sign in until it is unlocked. The
+      // rate-limit detector keeps the timed lockouts ("temporarily locked", "too many attempts").
+      { reason: "account locked out", re: /\b(?:user|account)\b[^\n]{0,30}\b(?:has\s+been|is)\s+locked\s+out\b/i },
       // Require an EXPLICIT negative (codex #21): the old `(not\s+)?(confirmed|verified)` made the negation
       // optional, so a benign "Email verified" success message / feature assertion matched and hid a real
       // feature failure as a CONFIG_ISSUE. Only "email not (yet) confirmed/verified" or "unconfirmed/unverified".
@@ -9427,6 +9802,12 @@ var init_auth_block_detector = __esm({
       /\b(reject|deny|denied|block(ed)?)\b[^\n]{0,20}\b(login|sign[\s-]?in|auth|credential|password)\b/i
     ];
     ECHO_LINE_RE = /^\s*(?:(?:📋|🎭|🌐|⚙️?)|(?:stderr:\s*|stdout:\s*)?Locator:)/u;
+    SIGN_IN_STEP_TITLE = /\b(?:log(?:ging)?\s*in(?:to)?|sign(?:ing)?[\s-]?in(?:to)?|authenticat(?:e|es|ed|ing|ion))\b/i;
+    ERROR_CONTEXT_CAP = 64 * 1024;
+    MAX_ALERTS = 20;
+    MAX_ALERT_CHARS = 1e3;
+    SNAPSHOT_PASSWORD_FIELD = /^\s*- textbox "[^"\n]{0,80}\bpass(?:word|code)?\b/i;
+    SNAPSHOT_ALERT = /^(\s*)- alert\b(.*)$/;
     UNAUTHORIZED_TEXT_RE = /(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|gives?|sends?|yield(?:s|ed|ing)?|results?\s+in)\s+(?:a\s+|an\s+|the\s+)?(?:401|403)\b|\bstatus(?:\s+code)?\s*(?::\s*)?(?:401|403)\b|\bHTTP\/[\d.]+\s+(?:401|403)\b|(?:401|403)['’]d\b|(?:[→⇒]|->)\s*(?:401|403)\b|(?:return(?:s|ed|ing)?|respond(?:s|ed|ing)?|got|receiv(?:e|ed|ing)|threw|throws?)\s+(?:a\s+|an\s+)?(?:unauthorized|forbidden)\b|\bnot\s+authenticated\b/i;
   }
 });
@@ -9861,6 +10242,77 @@ var init_redact_needles = __esm({
   }
 });
 
+// ../shared/dist/credential-header-scrub.js
+function scrubCredentialHeaders(text) {
+  if (text.length < 6)
+    return text;
+  let out = text.replace(HEADER_LINE, (match, keyQuote, name, sep, value) => {
+    if (value === "" || ALREADY_REDACTED.test(value))
+      return match;
+    if (COOKIE_NAME.test(name) && !value.includes("="))
+      return match;
+    if (AUTHORIZATION_NAME.test(name) && WORDS_ONLY.test(value))
+      return match;
+    const q = value[0] === '"' || value[0] === "'" ? value[0] : "";
+    return `${keyQuote}${name}${keyQuote}${sep}${q}${REDACTED2}${q}`;
+  });
+  out = out.replace(SET_COOKIE_PAIR, `$1${REDACTED2}`);
+  return out;
+}
+function isCredentialHeaderName(name) {
+  return name.length <= 100 && HEADER_NAME_ONLY.test(name);
+}
+function scrubCredentialHeaderValue(value) {
+  if (typeof value === "string")
+    return value === REDACTED2 || value === "" ? value : REDACTED2;
+  if (Array.isArray(value) && value.every((item) => typeof item === "string")) {
+    const next = value.map((item) => item === REDACTED2 || item === "" ? item : REDACTED2);
+    return next.every((item, i) => item === value[i]) ? value : next;
+  }
+  return value;
+}
+function scrubCredentialHeadersDeep(value) {
+  if (typeof value === "string")
+    return scrubCredentialHeaders(value);
+  if (Array.isArray(value)) {
+    let changed = false;
+    const next = value.map((item) => {
+      const scrubbed = scrubCredentialHeadersDeep(item);
+      if (scrubbed !== item)
+        changed = true;
+      return scrubbed;
+    });
+    return changed ? next : value;
+  }
+  if (value !== null && typeof value === "object") {
+    let changed = false;
+    const next = {};
+    for (const [k, v] of Object.entries(value)) {
+      const scrubbed = isCredentialHeaderName(k) ? scrubCredentialHeaderValue(v) : scrubCredentialHeadersDeep(v);
+      if (scrubbed !== v)
+        changed = true;
+      next[k] = scrubbed;
+    }
+    return changed ? next : value;
+  }
+  return value;
+}
+var REDACTED2, HEADER_NAMES, COOKIE_NAME, AUTHORIZATION_NAME, WORDS_ONLY, HEADER_NAME_ONLY, HEADER_LINE, ALREADY_REDACTED, SET_COOKIE_PAIR;
+var init_credential_header_scrub = __esm({
+  "../shared/dist/credential-header-scrub.js"() {
+    "use strict";
+    REDACTED2 = "[REDACTED]";
+    HEADER_NAMES = "cookie2?|set-cookie2?|proxy-authorization|authorization|api-?key|(?:x-)?(?:csrf|xsrf)[a-z0-9-]{0,30}|x-[a-z0-9-]{0,40}?(?:token|session|secret|key|auth)[a-z0-9-]{0,40}";
+    COOKIE_NAME = /^(?:set-)?cookie2?$/i;
+    AUTHORIZATION_NAME = /^(?:proxy-)?authorization$/i;
+    WORDS_ONLY = /^[A-Za-z]+(?: [A-Za-z]+){0,3}$/;
+    HEADER_NAME_ONLY = new RegExp(`^(?:${HEADER_NAMES})$`, "i");
+    HEADER_LINE = new RegExp(`(?<![A-Za-z0-9_-])(["']?)(${HEADER_NAMES})\\1(\\s*:\\s*)("(?:[^"\\\\\\r\\n]|\\\\.)*"|'(?:[^'\\\\\\r\\n]|\\\\.)*'|[^\\r\\n\\x1b]*)`, "gi");
+    ALREADY_REDACTED = /^["']?(?:[A-Za-z][\w-]*\s+)?\[REDACTED\]["']?[,;]?\s*$/;
+    SET_COOKIE_PAIR = /(?<![A-Za-z0-9_-])([A-Za-z0-9_.%-]{1,64}=)(?!\[REDACTED\])([^\s;,"'<>]{6,2048})(?=;\s*(?:Path|Domain|Expires|Max-Age|HttpOnly|Secure|SameSite|Partitioned)\b)/gi;
+  }
+});
+
 // ../shared/dist/deepgram-voices.js
 function voice(family, name, gender, accent, description) {
   const label = name.charAt(0).toUpperCase() + name.slice(1);
@@ -10437,13 +10889,13 @@ function isSensitiveQueryKey(key) {
   return SENSITIVE_QUERY_KEY_RE.test(key);
 }
 function redactSecretValues(value) {
-  return value.replace(MCP_SECRET_VALUE_RE, REDACTED2);
+  return value.replace(MCP_SECRET_VALUE_RE, REDACTED3);
 }
 function scrubReturnUrlValue(value, depth) {
   if (!/[?%]/.test(value))
     return value;
   if (depth >= MAX_NESTED_URL_DEPTH)
-    return REDACTED2;
+    return REDACTED3;
   const q = value.indexOf("?");
   if (q !== -1) {
     const hashIdx = value.indexOf("#", q);
@@ -10465,7 +10917,7 @@ function scrubReturnUrlValue(value, depth) {
   try {
     return encodeURIComponent(scrubbed);
   } catch {
-    return REDACTED2;
+    return REDACTED3;
   }
 }
 function scrubQuery(search, depth) {
@@ -10481,7 +10933,7 @@ function scrubQuery(search, depth) {
     params.forEach((value, key) => {
       let scrubbed = value;
       if (isSensitiveQueryKey(key)) {
-        scrubbed = REDACTED2;
+        scrubbed = REDACTED3;
       } else {
         if (RETURN_URL_QUERY_KEY_RE.test(key))
           scrubbed = scrubReturnUrlValue(scrubbed, depth);
@@ -10593,12 +11045,12 @@ function scrubUrlPropertyBag(props) {
   } catch {
   }
 }
-var SENSITIVE_QUERY_KEY_RE, REDACTED2, MCP_SECRET_VALUE_RE, RETURN_URL_QUERY_KEY_RE, MAX_NESTED_URL_DEPTH, MAX_PROPERTY_SWEEP_DEPTH;
+var SENSITIVE_QUERY_KEY_RE, REDACTED3, MCP_SECRET_VALUE_RE, RETURN_URL_QUERY_KEY_RE, MAX_NESTED_URL_DEPTH, MAX_PROPERTY_SWEEP_DEPTH;
 var init_analytics_url = __esm({
   "../shared/dist/analytics-url.js"() {
     "use strict";
     SENSITIVE_QUERY_KEY_RE = /^(access_token|refresh_token|id_token|token|code|state|password|secret|api[_-]?key|auth|authorization|session|jwt|otp|email|phone|magic[_-]?link)$|token|secret|password|credential|email|phone|(^|[_-])(otp|verification|auth)[_-]?code($|[_-])|(^|[_-])(state|session|grant)$/i;
-    REDACTED2 = "[redacted]";
+    REDACTED3 = "[redacted]";
     MCP_SECRET_VALUE_RE = /mcp_(consent|code|at|rt)_[A-Za-z0-9]+/g;
     RETURN_URL_QUERY_KEY_RE = /^(next|redirect|return|continue)([_-]?(to|url|uri|path))?$/i;
     MAX_NESTED_URL_DEPTH = 5;
@@ -13428,8 +13880,19 @@ function successContradicted(text) {
   }
   return SUCCESS_NO_STATUS_RE.test(text) || OFF_BY_RE.test(text);
 }
+function negatedSafeguard(text) {
+  for (const match of matches(NEGATED_SAFEGUARD_RE, text)) {
+    if (!NOT_KEPT_RE.test(match[1]))
+      return true;
+    const head = text.slice(Math.max(0, match.index - SAFEGUARD_LOOKBEHIND), match.index);
+    const sentence = head.slice(Math.max(head.lastIndexOf("."), head.lastIndexOf(";"), head.lastIndexOf("\n")) + 1);
+    if (!REFUSED_INPUT_RE.test(sentence))
+      return true;
+  }
+  return false;
+}
 function claimsDefect(text) {
-  if (BUG_LABEL_RE.test(text) || SILENT_RE.test(text) || CONCESSION_RE.test(text) || successContradicted(text) || NEGATED_SAFEGUARD_RE.test(text)) {
+  if (BUG_LABEL_RE.test(text) || SILENT_RE.test(text) || CONCESSION_RE.test(text) || successContradicted(text) || negatedSafeguard(text)) {
     return true;
   }
   return BAD_VALUE_RE.test(text) && !REFUSAL_RE.test(text);
@@ -13437,7 +13900,7 @@ function claimsDefect(text) {
 function hasTestFailContract(code) {
   return TEST_FAIL_CONTRACT_RE.test(code);
 }
-var BUG_LABEL_RE, SILENT_RE, CONCESSION_RE, SUCCESS_REPORT, SUCCESS_CONTRADICTED_RE, CONTRADICTION_VETO_RE, NOTHING_PROVIDED_RE, UNTOUCHED_SUBSETS, ACTION_LOOKBEHIND, TRAILING_ACTION_RE, ADJECTIVE_BEFORE_NOUN_RE, SUCCESS_SAME_STATE_RE, GENERIC_REPORT_RE, SAME_STATE, OTHER_ITEM_RE, SUCCESS_STATUS_RE, STATUS_ACTION_RE, SUCCESS_WITHOUT_EFFECT_RE, COUNT_UNCHANGED_RE, CLEARING_ACTION_RE, NOT_A_CLEARING_RE, SUCCESS_NO_STATUS_RE, OFF_BY_RE, NEGATED_SAFEGUARD_RE, BAD_VALUE_RE, REFUSAL_RE, TEST_FAIL_CONTRACT_RE;
+var BUG_LABEL_RE, SILENT_RE, CONCESSION_RE, SUCCESS_REPORT, SUCCESS_CONTRADICTED_RE, CONTRADICTION_VETO_RE, NOTHING_PROVIDED_RE, UNTOUCHED_SUBSETS, ACTION_LOOKBEHIND, TRAILING_ACTION_RE, ADJECTIVE_BEFORE_NOUN_RE, SUCCESS_SAME_STATE_RE, GENERIC_REPORT_RE, SAME_STATE, OTHER_ITEM_RE, SUCCESS_STATUS_RE, STATUS_ACTION_RE, SUCCESS_WITHOUT_EFFECT_RE, COUNT_UNCHANGED_RE, CLEARING_ACTION_RE, NOT_A_CLEARING_RE, SUCCESS_NO_STATUS_RE, OFF_BY_RE, NEGATED_SAFEGUARD_RE, NOT_KEPT_RE, REFUSED_INPUT_RE, SAFEGUARD_LOOKBEHIND, BAD_VALUE_RE, REFUSAL_RE, TEST_FAIL_CONTRACT_RE;
 var init_claims_defect = __esm({
   "../shared/dist/claims-defect.js"() {
     "use strict";
@@ -13481,7 +13944,10 @@ var init_claims_defect = __esm({
     NOT_A_CLEARING_RE = /\b(?:cancel|refresh|reload|preview|open|view|fail|hover|scroll|sort|filter|search)\w*/i;
     SUCCESS_NO_STATUS_RE = /\bsuccess\w*\b[^.;\n]{0,30}?\b(?:(?:do|does|did) not|don't|doesn't|didn't) (?:change|update|move)\b[^.;\n]{0,20}?\bstatus\b/i;
     OFF_BY_RE = /\boff[- ]by[- ](?:one|two|\d{1,3})\b/i;
-    NEGATED_SAFEGUARD_RE = /\bnot (?:rejected|validated|enforced|applied|persisted|saved)\b/i;
+    NEGATED_SAFEGUARD_RE = /\bnot (rejected|validated|enforced|applied|persisted|saved)\b/gi;
+    NOT_KEPT_RE = /^(?:applied|persisted|saved)$/i;
+    REFUSED_INPUT_RE = /\b(?:blank|empty|whitespace|invalid|malformed|expired|duplicate[sd]?|too (?:long|short)|cancel(?:s|led|ed|ling|ing)?|discard\w*|escape)\b/i;
+    SAFEGUARD_LOOKBEHIND = 80;
     BAD_VALUE_RE = /\b(?:incorrect|wrong|stale|negative|epoch|unix) (?:total|amount|value|date|count|price|label|plan|balance)\b/i;
     REFUSAL_RE = /\b(?<!not )(?:rejected|refused|denied|blocked|disallowed|prevented)\b|\breturns? (?:4\d\d|an? (?:error|validation))\b|\bshows (?:an? )?(?:error|validation)\b/i;
     TEST_FAIL_CONTRACT_RE = /\btest\.fail\s{0,20}\(/;
@@ -14340,7 +14806,7 @@ function findExpectCalls(code) {
   return out;
 }
 function countExpectCalls(code) {
-  return findExpectCalls(stripComments2(code)).length;
+  return findExpectCalls(stripComments2(withExpectAliasesAsExpect(code))).length;
 }
 function countActionCalls(code) {
   return [...stripComments2(code).matchAll(ACTION_CALL)].length;
@@ -16669,6 +17135,7 @@ var init_test_authoring_quality = __esm({
   "../shared/dist/test-authoring-quality.js"() {
     "use strict";
     init_claims_defect();
+    init_expect_call();
     init_readiness_poll();
     init_persistence_reread();
     init_write_response_check();
@@ -16795,7 +17262,7 @@ var init_test_authoring_quality = __esm({
     MAX_BALANCED_SCAN = 2048;
     MAX_CALLS = 500;
     MAX_SEEN_SCAN = 200;
-    ACTION_CALL = /\.(?:click|dblclick|fill|press|pressSequentially|type|check|uncheck|selectOption|setInputFiles|hover|tap|dragTo|goto)\s*\(/g;
+    ACTION_CALL = /\.(?:(?:click|dblclick|fill|clear|press|pressSequentially|type|check|uncheck|setChecked|selectOption|setInputFiles|hover|tap|dragTo|dragAndDrop|dispatchEvent|goto)|(?:keyboard|mouse)\s*\.\s*(?:down|up|insertText|move|wheel))\s*\(/g;
     BY_NAME_LOCATOR = /\.getByRole\(\s{0,20}['"][^'"\n]{1,100}['"]\s{0,20},\s{0,20}\{[^}\n]{0,200}\bname\s{0,20}:|\.getByText\(|\.getByLabel\(|\.getByTitle\(|\.getByAltText\(|\.getByPlaceholder\(/;
     ACTION_AFTER = /^\s{0,20}\.\s{0,20}(?:click|fill|check|uncheck|press|type|hover|focus|selectOption|setInputFiles|dblclick|tap)\s{0,20}\(/;
     MAX_CONTACTS = 200;
@@ -18304,7 +18771,7 @@ function credentialEntries(maps) {
 }
 function replacePattern(value, form) {
   const escaped = form.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-  return new RegExp(value.length < WHOLE_WORD_BELOW ? `(?<![A-Za-z0-9_])${escaped}(?![A-Za-z0-9_])` : escaped, "gi");
+  return value.length < WHOLE_WORD_BELOW ? `(?<![A-Za-z0-9_])${escaped}(?![A-Za-z0-9_])` : escaped;
 }
 function findCredentialTextLeftover(text, maps) {
   const bare = text.split(WITHHELD_CREDENTIAL_TEXT).join(" ").replace(REFERENCE, " ").toLowerCase();
@@ -18318,11 +18785,17 @@ function scrubCredentialText(text, maps) {
   const entries = credentialEntries(maps);
   if (entries.length === 0)
     return text;
-  let out = text;
+  const alternatives = [];
   for (const [key, value] of entries) {
     for (const form of credentialValueForms(value))
-      out = out.replace(replacePattern(value, form), `{{secret:${key}}}`);
+      alternatives.push({ pattern: replacePattern(value, form), key, length: form.length });
   }
+  alternatives.sort((a, b) => b.length - a.length);
+  const matcher = new RegExp([REFERENCE.source, ...alternatives.map((alt) => `(${alt.pattern})`)].join("|"), "gi");
+  const out = text.replace(matcher, (...args) => {
+    const index = args.slice(1, 1 + alternatives.length).findIndex((group) => group !== void 0);
+    return index < 0 ? String(args[0]) : `{{secret:${alternatives[index].key}}}`;
+  });
   return findCredentialTextLeftover(out, maps) ? WITHHELD_CREDENTIAL_TEXT : out;
 }
 function scrubCredentialStringsIn(value, maps) {
@@ -18816,10 +19289,24 @@ function onlyUrlAfter(code, writeAt) {
     i = at + 6;
   }
 }
+function readsOrderAfter(code, writeAt) {
+  const rest = code.slice(writeAt + 1);
+  if (ORDER_READ_MARKERS.some((m) => rest.includes(m)) && nextExpect(code, writeAt + 1) >= 0)
+    return true;
+  for (let i = writeAt + 1; ; ) {
+    const at = nextExpect(code, i);
+    if (at < 0)
+      return false;
+    if (ORDERED_ARRAY_EXPECT.test(expectStatement(code, at)))
+      return true;
+    i = at + 6;
+  }
+}
 function assessTitlePromiseShape(claimText, code) {
   const persistence = PERSISTENCE_RE.test(claimText);
   const refusal = REFUSAL_RE2.test(claimText);
-  if (!persistence && !refusal)
+  const order = ORDER_RE.test(claimText) || ORDER_RE_CASED.test(claimText);
+  if (!persistence && !refusal && !order)
     return [];
   const blank = blankCommentsAndStringLiterals(code);
   const writeAt = proofAnchor(blank);
@@ -18832,9 +19319,12 @@ function assessTitlePromiseShape(claimText, code) {
   if (refusal && onlyUrlAfter(blank, writeAt)) {
     findings.push({ rule: "rejection-only-url", reason: REFUSAL_REASON });
   }
+  if (order && !readsOrderAfter(blank, writeAt)) {
+    findings.push({ rule: "sort-without-order", reason: ORDER_REASON });
+  }
   return findings;
 }
-var PERSIST_REASON, REFUSAL_REASON, PERSISTENCE_RE, REFUSAL_RE2, WRITE_MARKERS, VALUE_WRITE_MARKERS, REREAD_MARKERS;
+var PERSIST_REASON, REFUSAL_REASON, PERSISTENCE_RE, REFUSAL_RE2, ORDER_REASON, ORDER_RE, ORDER_RE_CASED, ORDER_READ_MARKERS, ORDERED_ARRAY_EXPECT, WRITE_MARKERS, VALUE_WRITE_MARKERS, REREAD_MARKERS;
 var init_title_promise_shape = __esm({
   "../shared/dist/title-promise-shape.js"() {
     "use strict";
@@ -18843,6 +19333,21 @@ var init_title_promise_shape = __esm({
     REFUSAL_REASON = "The title says the app refuses the input, but the only check after submitting is the URL: assert the error message, the field's invalid state or the response status.";
     PERSISTENCE_RE = /\b(?:is|are|gets|stays)\s{1,20}saved\b|\b(?:is|are)\s{1,20}persisted\b|\bpersists\s{1,20}(?:after|across|through)\s{1,20}(?:a\s{1,20})?(?:reloads?|refresh(?:es)?|sessions?)\b|\bis\s{1,20}(?:stored|kept|remembered)\b|\bafter\s{1,20}(?:a\s{1,20})?reload\b|\bafter\s{1,20}refresh\b|\bsurvives\s{1,20}(?:a\s{1,20})?reload\b/i;
     REFUSAL_RE2 = /\b(?:rejects|rejected|refuses|refused|prevents|prevented|disallows)\b|\b(?:is|are|gets)\s{1,20}blocked\b|\bis\s{1,20}denied\b|\bshows\s{1,20}an\s{1,20}error\b|\bshows\s{1,20}a\s{1,20}validation\b|\bshows\s{1,20}validation\b|\breturns\s{1,20}4\d\d\b/i;
+    ORDER_REASON = "The title says the list is sorted, but no check after the sort reads the order: assert the items in order (toHaveText([...]) on the list, the first and last item, or allTextContents() compared with a sorted copy).";
+    ORDER_RE = /\bsort(?:s|ed|ing)?\b[^\n.]{0,60}?\bby\b|\b(?:ascending|descending)\b|\b(?:low|lowest)\s{1,20}to\s{1,20}(?:high|highest)\b|\b(?:high|highest)\s{1,20}to\s{1,20}(?:low|lowest)\b|\balphabetical(?:ly)?\b|\b(?:newest|oldest)\s{1,20}first\b/i;
+    ORDER_RE_CASED = /\b[AZ]\s{0,3}(?:to|-|→)\s{0,3}[AZ]\b/;
+    ORDER_READ_MARKERS = [
+      ".allTextContents(",
+      ".allInnerTexts(",
+      ".evaluateAll(",
+      ".toMatchAriaSnapshot(",
+      ".sort(",
+      ".toSorted(",
+      ".first()",
+      ".last()",
+      ".nth("
+    ];
+    ORDERED_ARRAY_EXPECT = /\.(?:toHaveText|toContainText|toEqual|toStrictEqual)\s*\(\s*\[/;
     WRITE_MARKERS = [
       ".fill(",
       ".click(",
@@ -19174,7 +19679,7 @@ function assertionsReadVisibleContent(code) {
   });
 }
 function isLegacyReviewFlag(tags, activity) {
-  const flagged = tags.includes(NEEDS_REVIEW_TAG) || activity?.needsReview === true;
+  const flagged = tags.includes(NEEDS_REVIEW_TAG2) || activity?.needsReview === true;
   const source = activity?.needsReviewSource;
   return flagged && !(typeof source === "string" && source in SOURCE_RANK);
 }
@@ -19236,7 +19741,7 @@ function recheckGeneratorNotes(notes, input) {
 }
 function reviewHolds(tags, activity, cleared = /* @__PURE__ */ new Set()) {
   const out = [];
-  const tagged = tags.includes(NEEDS_REVIEW_TAG);
+  const tagged = tags.includes(NEEDS_REVIEW_TAG2);
   const generatorAsked = activity?.needsReview === true;
   if (tagged) {
     if (activity?.needsReviewSource === "human")
@@ -19296,7 +19801,7 @@ function evaluatePromotionGate(input, checks = PROMOTION_QUALITY_CHECKS) {
     ...suspiciousTagged ? { suspiciousPass: { mode: suspicious, covered: suspiciousCovered, wouldHold: suspiciousHold } } : {}
   };
 }
-var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
+var SOURCE_RANK, strengthCheck, STRING_CONST, TYPED_VALUE, TYPED_CONSTANT, MAX_STATEMENTS, MAX_STATEMENT_CHARS, LITERAL_OR_IDENTIFIER, MUTATING_ACTION, FEEDBACK_REGION, ONE_SHOT_MESSAGE_REASON, FEEDBACK_REGION_ALL, dynamicAssertionCheck, OUTCOME_KIND_MATCHER, ROUTE_TERM, ROUTE_TRAILING_PUNCTUATION, QUOTED_LITERAL, GENERIC_LITERAL, MAX_OUTCOME_STATEMENTS, MAX_OUTCOMES, MAX_OUTCOME_TEXT_CHARS, expectedOutcomeCheck, testDataCheck, sharedAccountCheck, clockLiteralCheck, readinessPollCheck, knownBugTestCheck, bugClaimContractCheck, suspiciousExpectationCheck, bugCandidateCheck, conventionOutcomesCheck, pendingHook, locatorFragmentCheck, FILTER_STEP, NEXT_ACTION, REDUCTION_PROOF, MAX_FILTER_LINES, MAX_FILTER_LINE_CHARS, filterPositiveOnlyCheck, PROMOTION_QUALITY_CHECKS, PROMOTION_GATE_MAX_CODE_CHARS, NOT_EVALUATED, SUSPICIOUS_PASS_TAG, NOT_CONTENT_MATCHER, CONTENT_PROOF, NAMED_ELEMENT, NEEDS_REVIEW_TAG2, count2, RECHECKED_NOTES, EVIDENCE_NOTE_PREFIXES, PENDING_RECHECK_NOTE_PREFIXES, STRENGTH_RANK;
 var init_promotion_quality_gate = __esm({
   "../shared/dist/promotion-quality-gate.js"() {
     "use strict";
@@ -19315,8 +19820,8 @@ var init_promotion_quality_gate = __esm({
     SOURCE_RANK = { generator: 0, classifier: 0, healer: 1, human: 2 };
     strengthCheck = {
       id: "assertion-strength",
-      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof }) {
-        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof });
+      run({ code, tags, strengthGate, flagContradictedAdditions, lastActionProof, absenceProof }) {
+        const verdict = validateAssertionStrength(code, { flagContradictedAdditions: flagContradictedAdditions === true, lastActionProof, absenceProof });
         if (verdict.severity === "route-bug")
           return [{ check: "route-bug" }];
         const authDowngrade = verdict.severity === "downgrade" && tags.some((t) => t.toLowerCase() === "@auth");
@@ -19574,7 +20079,7 @@ ${goalText}`);
     NOT_CONTENT_MATCHER = /\.(?:toHaveURL|toHaveTitle|toBeOK)\s*\(|\bwaitForURL\s*\(|\.(?:status|ok)\s*\(\s*\)/;
     CONTENT_PROOF = /* @__PURE__ */ new Set(["controlled", "revealed", "value"]);
     NAMED_ELEMENT = /\bgetByRole\s*\(\s*['"`](?!(?:navigation|banner|main|contentinfo|complementary|region|search)['"`])\w{1,30}['"`]\s*,\s*\{[^}]{0,200}?\bname\s*:\s*(['"`])[^'"`$\n]{1,200}\1|\bgetByLabel\s*\(\s*(['"`])[^'"`$\n]{1,200}\2/;
-    NEEDS_REVIEW_TAG = "@needs-review";
+    NEEDS_REVIEW_TAG2 = "@needs-review";
     count2 = (v) => typeof v === "number" && Number.isFinite(v) ? v : 0;
     RECHECKED_NOTES = [
       {
@@ -19695,11 +20200,18 @@ var init_regex_alternation = __esm({
 function isPageEvidenceEntry(entry) {
   return typeof entry === "object" && entry !== null && entry.outcomeType === PAGE_LOADING_OUTCOME_TYPE;
 }
-var PAGE_LOADING_OUTCOME_TYPE;
+function pageScreenshotKey(projectId, safeName, stillLoading = false) {
+  return `discovery/${projectId}/screenshots/${stillLoading ? `${STILL_LOADING_SCREENSHOT_DIR}/` : ""}${safeName}.png`;
+}
+function isStillLoadingScreenshotKey(key) {
+  return typeof key === "string" && key.includes(`/screenshots/${STILL_LOADING_SCREENSHOT_DIR}/`);
+}
+var PAGE_LOADING_OUTCOME_TYPE, STILL_LOADING_SCREENSHOT_DIR;
 var init_page_evidence = __esm({
   "../shared/dist/page-evidence.js"() {
     "use strict";
     PAGE_LOADING_OUTCOME_TYPE = "LOADING";
+    STILL_LOADING_SCREENSHOT_DIR = "still-loading";
   }
 });
 
@@ -20104,11 +20616,13 @@ __export(dist_exports, {
   SERVER_INTERRUPT_ERROR_PREFIX: () => SERVER_INTERRUPT_ERROR_PREFIX,
   SHARED_PRICING_PLAN_MAP: () => SHARED_PRICING_PLAN_MAP,
   SHARED_SERVER_APPLICATION_NAME: () => SHARED_SERVER_APPLICATION_NAME,
+  SMS_NOT_RECEIVED_PREFIXES: () => SMS_NOT_RECEIVED_PREFIXES,
   SPEND_SOURCE_KEY: () => SPEND_SOURCE_KEY,
   SPEND_SOURCE_SERVER: () => SPEND_SOURCE_SERVER,
   STATED_LIMITS_VERSION: () => STATED_LIMITS_VERSION,
   STATED_PATTERN_MAX: () => STATED_PATTERN_MAX,
   STATIC_STANDARD_MIN_INTERACTIVE: () => STATIC_STANDARD_MIN_INTERACTIVE,
+  STILL_LOADING_SCREENSHOT_DIR: () => STILL_LOADING_SCREENSHOT_DIR,
   STT_MODEL_OPTIONS: () => STT_MODEL_OPTIONS,
   SUCCESS_NOTICE_TEXT: () => SUCCESS_NOTICE_TEXT,
   SUPPORT_EMAIL: () => SUPPORT_EMAIL,
@@ -20136,6 +20650,7 @@ __export(dist_exports, {
   TTS_VOICE_OPTIONS: () => TTS_VOICE_OPTIONS,
   UI_VARIANTS: () => UI_VARIANTS,
   UNEXPECTED_PASS_ERROR_PREFIX: () => UNEXPECTED_PASS_ERROR_PREFIX,
+  UNVERIFIED_HEAL_CONFIDENCES: () => UNVERIFIED_HEAL_CONFIDENCES,
   USER_CANCELLED_RUN_ERROR: () => USER_CANCELLED_RUN_ERROR,
   VISUAL_MASK_SELECTORS_MAX: () => VISUAL_MASK_SELECTORS_MAX,
   VISUAL_MASK_SELECTOR_FORBIDDEN: () => VISUAL_MASK_SELECTOR_FORBIDDEN,
@@ -20189,6 +20704,7 @@ __export(dist_exports, {
   blankBlockComments: () => blankBlockComments3,
   blankCommentsAndStringLiterals: () => blankCommentsAndStringLiterals,
   blankKeepingLines: () => blankKeepingLines,
+  blockedRunLogLine: () => blockedRunLogLine,
   boundedCallCostUsd: () => boundedCallCostUsd,
   brokerResponseBody: () => brokerResponseBody,
   bugFoundQuarantineWhere: () => bugFoundQuarantineWhere,
@@ -20294,6 +20810,7 @@ __export(dist_exports, {
   evaluatePromotionGate: () => evaluatePromotionGate,
   excludeCancelledRunsAnd: () => excludeCancelledRunsAnd,
   excludeCancelledRunsWhere: () => excludeCancelledRunsWhere,
+  expectAliasNames: () => expectAliasNames,
   explicitAgenticCliOverrideError: () => explicitAgenticCliOverrideError,
   extractAssertedControlSignatures: () => extractAssertedControlSignatures,
   extractMuseAssistantJson: () => extractMuseAssistantJson,
@@ -20360,6 +20877,8 @@ __export(dist_exports, {
   googleGisRequestUrl: () => googleGisRequestUrl,
   googleSignInLimitLines: () => googleSignInLimitLines,
   googleSignInPolicyProblems: () => googleSignInPolicyProblems,
+  googleSignInRefusedLine: () => googleSignInRefusedLine,
+  googleSignInRefusedReason: () => googleSignInRefusedReason,
   hasCrossPlatformIdentity: () => hasCrossPlatformIdentity,
   hasEncodedRequestBody: () => hasEncodedRequestBody,
   hasEngineSpecParts: () => hasEngineSpecParts,
@@ -20403,6 +20922,7 @@ __export(dist_exports, {
   isCodeFactNote: () => isCodeFactNote,
   isConfigLikeReason: () => isConfigLikeReason,
   isCountedFailure: () => isCountedFailure,
+  isCredentialHeaderName: () => isCredentialHeaderName,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
   isDbPricingPlan: () => isDbPricingPlan,
   isDeniedGoogleBrokerRedirectHost: () => isDeniedGoogleBrokerRedirectHost,
@@ -20458,8 +20978,10 @@ __export(dist_exports, {
   isSharedAuthTenantHost: () => isSharedAuthTenantHost,
   isSharedSuffix: () => isSharedSuffix,
   isSingleEmailAddress: () => isSingleEmailAddress,
+  isSmsNotReceivedError: () => isSmsNotReceivedError,
   isSoftOutcome: () => isSoftOutcome,
   isStateValueMobileClassName: () => isStateValueMobileClassName,
+  isStillLoadingScreenshotKey: () => isStillLoadingScreenshotKey,
   isSttModelForProvider: () => isSttModelForProvider,
   isTestReadyForPlatform: () => isTestReadyForPlatform,
   isTestVariableSecretKey: () => isTestVariableSecretKey,
@@ -20467,6 +20989,7 @@ __export(dist_exports, {
   isUIVariant: () => isUIVariant,
   isUnexpectedPassError: () => isUnexpectedPassError,
   isUnsafePrecondition: () => isUnsafePrecondition,
+  isUnverifiedHealPass: () => isUnverifiedHealPass,
   isUsableDeepgramKey: () => isUsableDeepgramKey,
   isUserCancelledError: () => isUserCancelledError,
   isValidAgenticCliModel: () => isValidAgenticCliModel,
@@ -20491,8 +21014,10 @@ __export(dist_exports, {
   lintTestData: () => lintTestData,
   lintTestQuality: () => lintTestQuality,
   literalUrlRegex: () => literalUrlRegex,
+  loginFormAlertTexts: () => loginFormAlertTexts,
   longCredentialValues: () => longCredentialValues,
   maskedOutsideStrings: () => maskedOutsideStrings,
+  mayBeUnverifiedHealPass: () => mayBeUnverifiedHealPass,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mergePageType: () => mergePageType,
   mergeSuspectedBugsAcrossSurveys: () => mergeSuspectedBugsAcrossSurveys,
@@ -20526,7 +21051,9 @@ __export(dist_exports, {
   opensRegexLiteral: () => opensRegexLiteral,
   otherMobilePlatform: () => otherMobilePlatform,
   outcomeNamedByAssertion: () => outcomeNamedByAssertion,
+  pageScreenshotKey: () => pageScreenshotKey,
   parenDepthDelta: () => parenDepthDelta,
+  parseAbsenceProofMode: () => parseAbsenceProofMode,
   parseApiCardModelUpdate: () => parseApiCardModelUpdate,
   parseAppTimezone: () => parseAppTimezone,
   parseAuditGroupScopeId: () => parseAuditGroupScopeId,
@@ -20602,7 +21129,7 @@ __export(dist_exports, {
   redactNeedlesText: () => redactNeedlesText,
   redirectOnAppSite: () => redirectOnAppSite,
   refuseEncodedRequestBodies: () => refuseEncodedRequestBodies,
-  regexLiteralEnd: () => regexLiteralEnd2,
+  regexLiteralEnd: () => regexLiteralEnd,
   regexOpensAfter: () => regexOpensAfter,
   registrableDomain: () => registrableDomain,
   renderIdentity: () => renderIdentity,
@@ -20644,6 +21171,9 @@ __export(dist_exports, {
   saveOpensConfirm: () => saveOpensConfirm,
   scanClockDependentLiterals: () => scanClockDependentLiterals,
   scanHtmlTags: () => scanHtmlTags,
+  scrubCredentialHeaderValue: () => scrubCredentialHeaderValue,
+  scrubCredentialHeaders: () => scrubCredentialHeaders,
+  scrubCredentialHeadersDeep: () => scrubCredentialHeadersDeep,
   scrubCredentialStringsIn: () => scrubCredentialStringsIn,
   scrubCredentialText: () => scrubCredentialText,
   scrubSearchParams: () => scrubSearchParams,
@@ -20654,9 +21184,12 @@ __export(dist_exports, {
   selectorForValue: () => selectorForValue,
   setAgenticCliRuntime: () => setAgenticCliRuntime,
   setProviderChainOverrides: () => setProviderChainOverrides,
+  signInStepPassedBeforeFailure: () => signInStepPassedBeforeFailure,
+  signsInInline: () => signsInInline,
   signupPlanFor: () => signupPlanFor,
   simplifyMobileWanderingInPlace: () => simplifyMobileWanderingInPlace,
   siteOf: () => siteOf,
+  specCallsExpect: () => specCallsExpect,
   specItemsFromTestPlans: () => specItemsFromTestPlans,
   splitAnswerLines: () => splitAnswerLines,
   statedLimitsFromAttrs: () => statedLimitsFromAttrs,
@@ -20704,6 +21237,7 @@ __export(dist_exports, {
   visualProDailyBudget: () => visualProDailyBudget,
   voiceMatchesTtsModel: () => voiceMatchesTtsModel,
   voicesForTtsModel: () => voicesForTtsModel,
+  withExpectAliasesAsExpect: () => withExpectAliasesAsExpect,
   withGeneratorReviewSource: () => withGeneratorReviewSource,
   withReviewSource: () => withReviewSource,
   withoutNotChargedClaim: () => withoutNotChargedClaim,
@@ -20758,6 +21292,7 @@ var init_dist = __esm({
     init_encoded_forms();
     init_block_comments();
     init_redact_needles();
+    init_credential_header_scrub();
     init_voice_config();
     init_deepgram_speech();
     init_deepgram_voices();
@@ -20835,6 +21370,7 @@ var require_survey_network_guard = __commonJS({
     exports2.graphqlUrlCarriesQuery = graphqlUrlCarriesQuery;
     exports2.graphqlUrlQueriesAreReads = graphqlUrlQueriesAreReads;
     exports2.graphqlGetMayWrite = graphqlGetMayWrite;
+    exports2.queryMethodMayWrite = queryMethodMayWrite;
     exports2.writeShapedGet = writeShapedGet;
     exports2.decideSurveyRequest = decideSurveyRequest;
     exports2.installSurveyNetworkGuard = installSurveyNetworkGuard;
@@ -21399,6 +21935,12 @@ var require_survey_network_guard = __commonJS({
       const docs = url.searchParams.getAll("query");
       return docs.length > 0 && (typeof body === "string" && body.length > 0 || docs.some((doc) => !graphqlDocumentIsQueryOnly(doc)));
     }
+    function queryMethodMayWrite(url, body, graphqlEndpoint) {
+      if (graphqlEndpoint)
+        return true;
+      const operation = /\b(?:mutation|subscription)\b/i;
+      return typeof body === "string" && operation.test(body) || [...url.searchParams.values()].some((v) => operation.test(v));
+    }
     function isGraphqlGetWrite(url, s, body) {
       return isGraphqlEndpoint(url, s) && graphqlGetMayWrite(url, body);
     }
@@ -21426,6 +21968,7 @@ var require_survey_network_guard = __commonJS({
       "log-out"
     ]);
     exports2.AMBIGUOUS_WRITE_VERBS = /* @__PURE__ */ new Set(["archive", "confirm", "disable"]);
+    var LABEL_PAGE_NOUNS = /* @__PURE__ */ new Set(["archive"]);
     var RESET_PAGE_WORDS = /* @__PURE__ */ new Set(["reset-password", "password-reset", "reset_password", "password_reset", "resetpassword", "forgot-password"]);
     var isTokenLikeSegment = (seg) => exports2.ID_SEGMENT_RE.test(seg) || /^[A-Za-z0-9_-]{20,}$/.test(seg);
     var WRITE_SHAPED_STATIC_EXTENSIONS = [
@@ -21571,6 +22114,8 @@ var require_survey_network_guard = __commonJS({
       if (oneTimeToken)
         return { reason: "one-time-token" };
       const verb = opts.triggerLabel ? labelVerb(opts.triggerLabel) : void 0;
+      if (verb && LABEL_PAGE_NOUNS.has(verb) && last === verb && params.length === 0)
+        return null;
       return verb && !opts.ignoreVerbs?.has(verb) ? { reason: "label", verb } : null;
     }
     function writeShapedText(w) {
@@ -21605,9 +22150,10 @@ var require_survey_network_guard = __commonJS({
         return { action: "allow", rule: readMethod ? "read" : "non-http" };
       const appSite = isAppSite(url.hostname, s.appBaseUrl);
       const graphqlGet = method === "GET" && isGraphqlGetWrite(url, s, req.postData);
+      const queryRead = method === "QUERY" && !queryMethodMayWrite(url, req.postData, isGraphqlEndpoint(url, s));
       const inActionWindow = s.lastActionAt > 0 && s.now - s.lastActionAt <= ACTION_NAVIGATION_WINDOW_MS;
       const typedLoad = s.agentLoad === true && req.resourceType === "document";
-      const writeShaped = method === "GET" && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
+      const writeShaped = (method === "GET" || queryRead) && appSite && !graphqlGet && (inActionWindow || typedLoad) ? writeShapedGet(req.url, {
         appSites: appSitesOf(s.appBaseUrl),
         resourceType: req.resourceType ?? "",
         // A label says what a click opens: it only judges a page load, never the app's own fetches, and never a typed URL.
@@ -21615,7 +22161,7 @@ var require_survey_network_guard = __commonJS({
       }) : null;
       if (writeShaped)
         return decideWriteShapedGet(req, s, writeShaped);
-      if (readMethod && !graphqlGet)
+      if ((readMethod || queryRead) && !graphqlGet)
         return { action: "allow", rule: "read" };
       if (!appSite && ((0, shared_1.isAuthProviderHost)(url.hostname) || isTelemetryHost(url.hostname)))
         return { action: "allow", rule: "third-party" };
@@ -22432,6 +22978,13 @@ var require_run_write_guard = __commonJS({
     function currentRunSignInSecrets() {
       return policyScope.getStore()?.signInSecrets ?? [];
     }
+    function isSocketIoPollingPost(pathname, search) {
+      if (pathname !== "/socket.io" && pathname !== "/socket.io/")
+        return false;
+      const eio = search.getAll("EIO");
+      const transport = search.getAll("transport");
+      return eio.length === 1 && /^[0-9]{1,2}$/.test(eio[0]) && transport.length === 1 && transport[0] === "polling";
+    }
     var READ_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
     var MAX_BODY_CHARS = 262144;
     var MAX_SIGN_IN_LOG_LINES = 20;
@@ -23266,7 +23819,8 @@ var require_run_write_guard = __commonJS({
       const method = facts.method.toUpperCase();
       const host = url.hostname.toLowerCase().replace(/\.$/, "");
       const pathname = url.pathname;
-      if (READ_METHODS.has(method)) {
+      const queryRead = method === "QUERY" && !(0, survey_network_guard_js_1.queryMethodMayWrite)(url, facts.postData, isGraphqlPath(pathname));
+      if (READ_METHODS.has(method) || queryRead) {
         if (method === "GET" && isGraphqlPath(pathname) && (0, survey_network_guard_js_1.graphqlGetMayWrite)(url, facts.postData)) {
           return { action: "write", rule: "graphql-get-mutation", record: describe(facts, url, "graphql-get-mutation") };
         }
@@ -23321,6 +23875,8 @@ var require_run_write_guard = __commonJS({
         if (segs.length > 0 && SEARCH_LAST_SEGMENTS.has(segs[segs.length - 1]))
           return { action: "allow", rule: "search-post" };
       }
+      if (appSite && method === "POST" && isSocketIoPollingPost(pathname, url.searchParams))
+        return { action: "allow", rule: "realtime-poll" };
       if (hostIs(host, PAYMENT_HOSTS))
         return { action: "write", rule: "payment", record: describe(facts, url, "payment") };
       if (appSite)
@@ -24125,6 +24681,32 @@ var require_run_write_guard = __commonJS({
         return false;
       }
     }
+    function contextStartsOffline(context) {
+      try {
+        return context._options?.offline === true;
+      } catch {
+        return false;
+      }
+    }
+    function trackOffline(context) {
+      const state = { offline: contextStartsOffline(context) };
+      const original = context.setOffline;
+      if (typeof original === "function") {
+        Object.assign(context, {
+          setOffline: async (offline) => {
+            const before = state.offline;
+            state.offline = offline === true;
+            try {
+              await original.call(context, offline);
+            } catch (err) {
+              state.offline = before;
+              throw err;
+            }
+          }
+        });
+      }
+      return state;
+    }
     function hopRequestHeaders(pageHeaders, cookie) {
       const out = { accept: "*/*" };
       for (const [name, value] of Object.entries(pageHeaders)) {
@@ -24454,6 +25036,7 @@ var require_run_write_guard = __commonJS({
         return existing;
       const guard = new RunWriteGuard(policy, opts);
       countAppWebSocketMessages(context, guard);
+      const emulated = policy.mode === "block" ? trackOffline(context) : { offline: false };
       if (policy.mode === "observe") {
         context.on("request", (request) => {
           try {
@@ -24486,6 +25069,11 @@ var require_run_write_guard = __commonJS({
             }
           }
           if (decision.action === "allow" && !READ_METHODS.has(request.method().toUpperCase()) && checksRedirect(decision.rule, request.url(), guard.policy)) {
+            if (emulated.offline) {
+              await route.fallback().catch(() => {
+              });
+              return;
+            }
             await sendCheckingRedirect(route, guard, context);
             return;
           }