@validate.qa/runner 1.0.47 → 1.0.48

package/dist/cli.js

@@ -5041,6 +5041,191 @@ var init_auth_block_detector = __esm({
   }
 });
 
+// ../shared/dist/auth-state-freshness.js
+function isCsrfTokenName(name) {
+  return /csrf|xsrf|forgery|authenticity|requestverification/.test(name.toLowerCase());
+}
+function isAuthTokenName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|auth|jwt|credential|identity|login|token/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])(?:sid|sess|account|remember)(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspnet",
+    "asp.net",
+    "aspxauth",
+    "sb-",
+    "supabase",
+    "amplify",
+    "cognito",
+    "auth0",
+    "okta",
+    "kc-",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function isSessionClassName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|sess/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])sid(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspxauth",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function decodeBase64UrlToUtf8(segment) {
+  if (typeof atob !== "function")
+    return void 0;
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.length % 4 === 0 ? base64 : base64 + "=".repeat(4 - base64.length % 4);
+  try {
+    const binary = atob(padded);
+    let percentEncoded = "";
+    for (let i = 0; i < binary.length; i += 1) {
+      percentEncoded += `%${binary.charCodeAt(i).toString(16).padStart(2, "0")}`;
+    }
+    return decodeURIComponent(percentEncoded);
+  } catch {
+    return void 0;
+  }
+}
+function jwtExpiryMs(value) {
+  const parts = value.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2])
+    return void 0;
+  const json = decodeBase64UrlToUtf8(parts[1]);
+  if (json === void 0)
+    return void 0;
+  try {
+    const payload = JSON.parse(json);
+    const exp = payload?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function localStorageAuthExpiryMs(value) {
+  const direct = jwtExpiryMs(value);
+  if (direct !== void 0)
+    return direct;
+  let obj;
+  try {
+    obj = JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+  if (!obj || typeof obj !== "object")
+    return void 0;
+  const record = obj;
+  const nested = record.currentSession ?? record.session;
+  const jwtCandidates = [
+    record.access_token,
+    record.accessToken,
+    record.token,
+    record.id_token,
+    record.idToken,
+    nested?.access_token,
+    nested?.accessToken
+  ];
+  for (const candidate of jwtCandidates) {
+    if (typeof candidate === "string") {
+      const exp = jwtExpiryMs(candidate);
+      if (exp !== void 0)
+        return exp;
+    }
+  }
+  const expiresAt = record.expires_at ?? record.expiresAt ?? nested?.expires_at;
+  if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+    return expiresAt < 1e12 ? expiresAt * 1e3 : expiresAt;
+  }
+  return void 0;
+}
+function collectAuthTokens(parsed) {
+  const tokens = [];
+  if (!parsed || typeof parsed !== "object")
+    return tokens;
+  const cookies = parsed.cookies;
+  if (Array.isArray(cookies)) {
+    for (const raw of cookies) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const name = typeof raw.name === "string" ? raw.name : "";
+      const value = typeof raw.value === "string" ? raw.value : "";
+      if (isCsrfTokenName(name))
+        continue;
+      const jwtExp = value ? jwtExpiryMs(value) : void 0;
+      if (jwtExp !== void 0) {
+        tokens.push({ expiryMs: jwtExp, sessionClass: true });
+        continue;
+      }
+      if (isAuthTokenName(name) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > 0) {
+        tokens.push({ expiryMs: raw.expires * 1e3, sessionClass: isSessionClassName(name) });
+      }
+    }
+  }
+  const origins = parsed.origins;
+  if (Array.isArray(origins)) {
+    for (const origin of origins) {
+      if (!origin || typeof origin !== "object" || !Array.isArray(origin.localStorage))
+        continue;
+      for (const entry of origin.localStorage) {
+        if (!entry || typeof entry !== "object")
+          continue;
+        const key = typeof entry.name === "string" ? entry.name : "";
+        const value = typeof entry.value === "string" ? entry.value : "";
+        if (!key || !value || isCsrfTokenName(key) || !isAuthTokenName(key))
+          continue;
+        const exp = localStorageAuthExpiryMs(value);
+        if (exp !== void 0)
+          tokens.push({ expiryMs: exp, sessionClass: true });
+      }
+    }
+  }
+  return tokens;
+}
+function storageStateExpiredBySkew(stateJson, nowMs, skewMs = AUTH_STATE_EXPIRY_SKEW_MS) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stateJson);
+  } catch {
+    return false;
+  }
+  const tokens = collectAuthTokens(parsed);
+  if (tokens.length === 0)
+    return false;
+  const margin = Number.isFinite(skewMs) ? Math.max(0, skewMs) : AUTH_STATE_EXPIRY_SKEW_MS;
+  const deadline = nowMs + margin;
+  const anyExpired = tokens.some((t) => t.expiryMs <= deadline);
+  if (!anyExpired)
+    return false;
+  const liveSession = tokens.some((t) => t.expiryMs > deadline && t.sessionClass);
+  return !liveSession;
+}
+var AUTH_STATE_EXPIRY_SKEW_MS;
+var init_auth_state_freshness = __esm({
+  "../shared/dist/auth-state-freshness.js"() {
+    "use strict";
+    AUTH_STATE_EXPIRY_SKEW_MS = 3e4;
+  }
+});
+
 // ../shared/dist/skip-coverage-detector.js
 function detectSkippedApiCoverage(steps) {
   const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
@@ -5430,6 +5615,7 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
   AUTH_TAG_LOGIN_COOKIE: () => AUTH_TAG_LOGIN_COOKIE,
@@ -5547,6 +5733,7 @@ __export(dist_exports, {
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
+  isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
@@ -5569,6 +5756,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
@@ -5600,6 +5788,7 @@ __export(dist_exports, {
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
   stepsMissingPlatformLocators: () => stepsMissingPlatformLocators,
   stepsNeedingReviewForPlatform: () => stepsNeedingReviewForPlatform,
+  storageStateExpiredBySkew: () => storageStateExpiredBySkew,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
   sttModelsForProvider: () => sttModelsForProvider,
@@ -5630,6 +5819,7 @@ var init_dist = __esm({
     init_origin_domain();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_state_freshness();
     init_skip_coverage_detector();
     init_redact_needles();
     init_voice_config();
@@ -333991,7 +334181,7 @@ var require_local_auth_state = __commonJS({
     exports2.ensurePrivateDirectory = ensurePrivateDirectory2;
     exports2.isValidStorageState = isValidStorageState;
     exports2.isValidStorageStateJson = isValidStorageStateJson;
-    exports2.isValidLocalAuthStateFile = isValidLocalAuthStateFile;
+    exports2.isValidLocalAuthStateFile = isValidLocalAuthStateFile2;
     exports2.cleanupLocalAuthStateFiles = cleanupLocalAuthStateFiles;
     exports2.cleanupExpiredLocalAuthStateFiles = cleanupExpiredLocalAuthStateFiles2;
     exports2.localAuthStatePaths = localAuthStatePaths2;
@@ -334005,6 +334195,7 @@ var require_local_auth_state = __commonJS({
     var node_fs_1 = require("fs");
     var node_crypto_1 = require("crypto");
     var node_path_1 = require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var auth_recipe_js_1 = require_auth_recipe();
     exports2.LOCAL_AUTH_STATE_MAX_AGE_MS = 60 * 60 * 1e3;
     exports2.LOCAL_AUTH_STATE_WAIT_MS = 3 * 60 * 1e3;
@@ -334134,7 +334325,7 @@ var require_local_auth_state = __commonJS({
         return false;
       return isValidStorageState(value);
     }
-    function isValidLocalAuthStateFile(path) {
+    function isValidLocalAuthStateFile2(path) {
       try {
         return isStorageStateShape(JSON.parse((0, node_fs_1.readFileSync)(path, "utf8")));
       } catch {
@@ -334192,11 +334383,22 @@ var require_local_auth_state = __commonJS({
         lockPath: `${cachePath}.lock`
       };
     }
+    function localAuthStateExpiredByAuthMaterial(path, now) {
+      try {
+        return (0, shared_1.storageStateExpiredBySkew)((0, node_fs_1.readFileSync)(path, "utf8"), now);
+      } catch {
+        return false;
+      }
+    }
     function getValidLocalAuthState2(path, now = Date.now(), maxAgeMs = exports2.LOCAL_AUTH_STATE_MAX_AGE_MS) {
       if (!(0, node_fs_1.existsSync)(path))
         return void 0;
       try {
-        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile(path)) {
+        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile2(path)) {
+          removeFile(path);
+          return void 0;
+        }
+        if (localAuthStateExpiredByAuthMaterial(path, now)) {
           removeFile(path);
           return void 0;
         }
@@ -334243,7 +334445,7 @@ var require_local_auth_state = __commonJS({
         removeFile(capturePath);
         return false;
       }
-      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile(capturePath)) {
+      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile2(capturePath)) {
         removeFile(capturePath);
         return false;
       }
@@ -334257,7 +334459,7 @@ var require_local_auth_state = __commonJS({
           return false;
         }
         if ((0, node_fs_1.existsSync)(cachePath)) {
-          if (!replaceExisting && isValidLocalAuthStateFile(cachePath)) {
+          if (!replaceExisting && isValidLocalAuthStateFile2(cachePath)) {
             removeFile(capturePath);
             return true;
           }
@@ -334274,7 +334476,7 @@ var require_local_auth_state = __commonJS({
         }
         return true;
       } catch {
-        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile(cachePath);
+        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile2(cachePath);
         removeFile(capturePath);
         return winnerIsValid;
       }
@@ -346967,7 +347169,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.47",
+      version: "1.0.48",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -356629,7 +356831,7 @@ ${result2.logs}`);
         });
       } finally {
         if (runAuthPath && authPaths) {
-          if ((0, import_runner_core12.getValidLocalAuthState)(runAuthPath)) {
+          if ((0, import_runner_core12.isValidLocalAuthStateFile)(runAuthPath)) {
             const releasePromotionLock = releaseAuthLock ? void 0 : await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
             try {
               const captured = (0, import_runner_core12.promoteLocalAuthStateCapture)(

package/dist/cli.mjs

@@ -5046,6 +5046,191 @@ var init_auth_block_detector = __esm({
   }
 });
 
+// ../shared/dist/auth-state-freshness.js
+function isCsrfTokenName(name) {
+  return /csrf|xsrf|forgery|authenticity|requestverification/.test(name.toLowerCase());
+}
+function isAuthTokenName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|auth|jwt|credential|identity|login|token/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])(?:sid|sess|account|remember)(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspnet",
+    "asp.net",
+    "aspxauth",
+    "sb-",
+    "supabase",
+    "amplify",
+    "cognito",
+    "auth0",
+    "okta",
+    "kc-",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function isSessionClassName(name) {
+  const n = name.toLowerCase();
+  if (isCsrfTokenName(n))
+    return false;
+  if (/session|sess/.test(n))
+    return true;
+  if (/(?:^|[^a-z0-9])sid(?:[^a-z0-9]|$)/.test(n))
+    return true;
+  return [
+    "connect.sid",
+    "jsessionid",
+    "phpsessid",
+    "aspxauth",
+    "li_at",
+    "ltpatoken",
+    "wordpress_logged_in"
+  ].some((frag) => n.includes(frag));
+}
+function decodeBase64UrlToUtf8(segment) {
+  if (typeof atob !== "function")
+    return void 0;
+  const base64 = segment.replace(/-/g, "+").replace(/_/g, "/");
+  const padded = base64.length % 4 === 0 ? base64 : base64 + "=".repeat(4 - base64.length % 4);
+  try {
+    const binary = atob(padded);
+    let percentEncoded = "";
+    for (let i = 0; i < binary.length; i += 1) {
+      percentEncoded += `%${binary.charCodeAt(i).toString(16).padStart(2, "0")}`;
+    }
+    return decodeURIComponent(percentEncoded);
+  } catch {
+    return void 0;
+  }
+}
+function jwtExpiryMs(value) {
+  const parts = value.split(".");
+  if (parts.length !== 3 || !parts[0] || !parts[1] || !parts[2])
+    return void 0;
+  const json = decodeBase64UrlToUtf8(parts[1]);
+  if (json === void 0)
+    return void 0;
+  try {
+    const payload = JSON.parse(json);
+    const exp = payload?.exp;
+    return typeof exp === "number" && Number.isFinite(exp) && exp > 0 ? exp * 1e3 : void 0;
+  } catch {
+    return void 0;
+  }
+}
+function localStorageAuthExpiryMs(value) {
+  const direct = jwtExpiryMs(value);
+  if (direct !== void 0)
+    return direct;
+  let obj;
+  try {
+    obj = JSON.parse(value);
+  } catch {
+    return void 0;
+  }
+  if (!obj || typeof obj !== "object")
+    return void 0;
+  const record = obj;
+  const nested = record.currentSession ?? record.session;
+  const jwtCandidates = [
+    record.access_token,
+    record.accessToken,
+    record.token,
+    record.id_token,
+    record.idToken,
+    nested?.access_token,
+    nested?.accessToken
+  ];
+  for (const candidate of jwtCandidates) {
+    if (typeof candidate === "string") {
+      const exp = jwtExpiryMs(candidate);
+      if (exp !== void 0)
+        return exp;
+    }
+  }
+  const expiresAt = record.expires_at ?? record.expiresAt ?? nested?.expires_at;
+  if (typeof expiresAt === "number" && Number.isFinite(expiresAt) && expiresAt > 0) {
+    return expiresAt < 1e12 ? expiresAt * 1e3 : expiresAt;
+  }
+  return void 0;
+}
+function collectAuthTokens(parsed) {
+  const tokens = [];
+  if (!parsed || typeof parsed !== "object")
+    return tokens;
+  const cookies = parsed.cookies;
+  if (Array.isArray(cookies)) {
+    for (const raw of cookies) {
+      if (!raw || typeof raw !== "object")
+        continue;
+      const name = typeof raw.name === "string" ? raw.name : "";
+      const value = typeof raw.value === "string" ? raw.value : "";
+      if (isCsrfTokenName(name))
+        continue;
+      const jwtExp = value ? jwtExpiryMs(value) : void 0;
+      if (jwtExp !== void 0) {
+        tokens.push({ expiryMs: jwtExp, sessionClass: true });
+        continue;
+      }
+      if (isAuthTokenName(name) && typeof raw.expires === "number" && Number.isFinite(raw.expires) && raw.expires > 0) {
+        tokens.push({ expiryMs: raw.expires * 1e3, sessionClass: isSessionClassName(name) });
+      }
+    }
+  }
+  const origins = parsed.origins;
+  if (Array.isArray(origins)) {
+    for (const origin of origins) {
+      if (!origin || typeof origin !== "object" || !Array.isArray(origin.localStorage))
+        continue;
+      for (const entry of origin.localStorage) {
+        if (!entry || typeof entry !== "object")
+          continue;
+        const key = typeof entry.name === "string" ? entry.name : "";
+        const value = typeof entry.value === "string" ? entry.value : "";
+        if (!key || !value || isCsrfTokenName(key) || !isAuthTokenName(key))
+          continue;
+        const exp = localStorageAuthExpiryMs(value);
+        if (exp !== void 0)
+          tokens.push({ expiryMs: exp, sessionClass: true });
+      }
+    }
+  }
+  return tokens;
+}
+function storageStateExpiredBySkew(stateJson, nowMs, skewMs = AUTH_STATE_EXPIRY_SKEW_MS) {
+  let parsed;
+  try {
+    parsed = JSON.parse(stateJson);
+  } catch {
+    return false;
+  }
+  const tokens = collectAuthTokens(parsed);
+  if (tokens.length === 0)
+    return false;
+  const margin = Number.isFinite(skewMs) ? Math.max(0, skewMs) : AUTH_STATE_EXPIRY_SKEW_MS;
+  const deadline = nowMs + margin;
+  const anyExpired = tokens.some((t) => t.expiryMs <= deadline);
+  if (!anyExpired)
+    return false;
+  const liveSession = tokens.some((t) => t.expiryMs > deadline && t.sessionClass);
+  return !liveSession;
+}
+var AUTH_STATE_EXPIRY_SKEW_MS;
+var init_auth_state_freshness = __esm({
+  "../shared/dist/auth-state-freshness.js"() {
+    "use strict";
+    AUTH_STATE_EXPIRY_SKEW_MS = 3e4;
+  }
+});
+
 // ../shared/dist/skip-coverage-detector.js
 function detectSkippedApiCoverage(steps) {
   const allSkipped = steps.length > 0 && steps.every((s) => s.status === "skipped");
@@ -5435,6 +5620,7 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
   AUTH_TAG_LOGIN_COOKIE: () => AUTH_TAG_LOGIN_COOKIE,
@@ -5552,6 +5738,7 @@ __export(dist_exports, {
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
+  isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
   isCountedFailure: () => isCountedFailure,
   isCreditPackAmountCents: () => isCreditPackAmountCents,
@@ -5574,6 +5761,7 @@ __export(dist_exports, {
   isValidSttProvider: () => isValidSttProvider,
   isValidTtsModel: () => isValidTtsModel,
   isValidTtsVoiceId: () => isValidTtsVoiceId,
+  jwtExpiryMs: () => jwtExpiryMs,
   mediumForMobilePlatform: () => mediumForMobilePlatform,
   mobileCredentialPlaceholder: () => mobileCredentialPlaceholder,
   mobilePlatformFromMedium: () => mobilePlatformFromMedium,
@@ -5605,6 +5793,7 @@ __export(dist_exports, {
   stepIsDivergentForPlatform: () => stepIsDivergentForPlatform,
   stepsMissingPlatformLocators: () => stepsMissingPlatformLocators,
   stepsNeedingReviewForPlatform: () => stepsNeedingReviewForPlatform,
+  storageStateExpiredBySkew: () => storageStateExpiredBySkew,
   stripEnvironmentalPrefix: () => stripEnvironmentalPrefix,
   stripLoginScaffolding: () => stripLoginScaffolding,
   sttModelsForProvider: () => sttModelsForProvider,
@@ -5635,6 +5824,7 @@ var init_dist = __esm({
     init_origin_domain();
     init_auth_plan();
     init_auth_block_detector();
+    init_auth_state_freshness();
     init_skip_coverage_detector();
     init_redact_needles();
     init_voice_config();
@@ -333996,7 +334186,7 @@ var require_local_auth_state = __commonJS({
     exports.ensurePrivateDirectory = ensurePrivateDirectory2;
     exports.isValidStorageState = isValidStorageState;
     exports.isValidStorageStateJson = isValidStorageStateJson;
-    exports.isValidLocalAuthStateFile = isValidLocalAuthStateFile;
+    exports.isValidLocalAuthStateFile = isValidLocalAuthStateFile2;
     exports.cleanupLocalAuthStateFiles = cleanupLocalAuthStateFiles;
     exports.cleanupExpiredLocalAuthStateFiles = cleanupExpiredLocalAuthStateFiles2;
     exports.localAuthStatePaths = localAuthStatePaths2;
@@ -334010,6 +334200,7 @@ var require_local_auth_state = __commonJS({
     var node_fs_1 = __require("fs");
     var node_crypto_1 = __require("crypto");
     var node_path_1 = __require("path");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     var auth_recipe_js_1 = require_auth_recipe();
     exports.LOCAL_AUTH_STATE_MAX_AGE_MS = 60 * 60 * 1e3;
     exports.LOCAL_AUTH_STATE_WAIT_MS = 3 * 60 * 1e3;
@@ -334139,7 +334330,7 @@ var require_local_auth_state = __commonJS({
         return false;
       return isValidStorageState(value);
     }
-    function isValidLocalAuthStateFile(path) {
+    function isValidLocalAuthStateFile2(path) {
       try {
         return isStorageStateShape(JSON.parse((0, node_fs_1.readFileSync)(path, "utf8")));
       } catch {
@@ -334197,11 +334388,22 @@ var require_local_auth_state = __commonJS({
         lockPath: `${cachePath}.lock`
       };
     }
+    function localAuthStateExpiredByAuthMaterial(path, now) {
+      try {
+        return (0, shared_1.storageStateExpiredBySkew)((0, node_fs_1.readFileSync)(path, "utf8"), now);
+      } catch {
+        return false;
+      }
+    }
     function getValidLocalAuthState2(path, now = Date.now(), maxAgeMs = exports.LOCAL_AUTH_STATE_MAX_AGE_MS) {
       if (!(0, node_fs_1.existsSync)(path))
         return void 0;
       try {
-        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile(path)) {
+        if (now - (0, node_fs_1.statSync)(path).mtimeMs >= maxAgeMs || !isValidLocalAuthStateFile2(path)) {
+          removeFile(path);
+          return void 0;
+        }
+        if (localAuthStateExpiredByAuthMaterial(path, now)) {
           removeFile(path);
           return void 0;
         }
@@ -334248,7 +334450,7 @@ var require_local_auth_state = __commonJS({
         removeFile(capturePath);
         return false;
       }
-      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile(capturePath)) {
+      if (!(0, node_fs_1.existsSync)(capturePath) || !isValidLocalAuthStateFile2(capturePath)) {
         removeFile(capturePath);
         return false;
       }
@@ -334262,7 +334464,7 @@ var require_local_auth_state = __commonJS({
           return false;
         }
         if ((0, node_fs_1.existsSync)(cachePath)) {
-          if (!replaceExisting && isValidLocalAuthStateFile(cachePath)) {
+          if (!replaceExisting && isValidLocalAuthStateFile2(cachePath)) {
             removeFile(capturePath);
             return true;
           }
@@ -334279,7 +334481,7 @@ var require_local_auth_state = __commonJS({
         }
         return true;
       } catch {
-        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile(cachePath);
+        const winnerIsValid = (0, node_fs_1.existsSync)(cachePath) && isValidLocalAuthStateFile2(cachePath);
         removeFile(capturePath);
         return winnerIsValid;
       }
@@ -346972,7 +347174,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.47",
+      version: "1.0.48",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -356637,7 +356839,7 @@ ${result2.logs}`);
         });
       } finally {
         if (runAuthPath && authPaths) {
-          if ((0, import_runner_core12.getValidLocalAuthState)(runAuthPath)) {
+          if ((0, import_runner_core12.isValidLocalAuthStateFile)(runAuthPath)) {
             const releasePromotionLock = releaseAuthLock ? void 0 : await (0, import_runner_core12.acquireLocalAuthStateLock)(authPaths.lockKey, authPaths.lockPath);
             try {
               const captured = (0, import_runner_core12.promoteLocalAuthStateCapture)(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.47",
+  "version": "1.0.48",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"