@validate.qa/runner 1.0.56 → 1.0.57

package/dist/cli.js

@@ -1767,7 +1767,12 @@ var init_constants = __esm({
       "VALIDATE_TASK_ARN",
       "VALIDATE_RUNNER_AUTH",
       "VALIDATE_SERVER_URL",
-      "VALIDATE_LIVE_BROWSER_STATE_PATH"
+      "VALIDATE_LIVE_BROWSER_STATE_PATH",
+      // Register-and-verify test identity (parent-minted per run; see runner-core
+      // test-inbox-broker.ts). A customer variable must never spoof the address a
+      // generated test registers with or the derived account password.
+      "VQA_TEST_INBOX_EMAIL",
+      "VQA_TEST_ACCOUNT_PASSWORD"
     ]);
     SPAWNED_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
       // Runtime essentials - Node.js and Playwright need these to function
@@ -3864,8 +3869,9 @@ function inlineLocatorBindings(stmts) {
 function stripLoginScaffolding(code) {
   const out = [];
   let inAuth = false;
+  let inInbox = false;
   for (const ln of code.split("\n")) {
-    if (!inAuth && AUTH_START.test(ln)) {
+    if (!inAuth && !inInbox && AUTH_START.test(ln)) {
       inAuth = true;
       continue;
     }
@@ -3874,6 +3880,15 @@ function stripLoginScaffolding(code) {
         inAuth = false;
       continue;
     }
+    if (!inInbox && INBOX_START.test(ln)) {
+      inInbox = true;
+      continue;
+    }
+    if (inInbox) {
+      if (INBOX_END.test(ln))
+        inInbox = false;
+      continue;
+    }
     if (LOGIN_CALL_LINE.test(ln))
       continue;
     out.push(ln);
@@ -4262,7 +4277,7 @@ function validateAssertionStrength(code, opts = {}) {
     signals
   };
 }
-var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD, LOCATOR_BINDING, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, HAS_TEXT_FILTER, OUTCOME_TEXT, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, NEGATED_ASSERT, TYPED_INPUT, TITLE_LINE, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES;
+var ERROR_BANNER, OUTCOME_ALWAYS, FORM_INPUT, ANY_CLICK, NAV_LOCATOR, URL_PROOF, RELOAD, EXPECT_STMT, BLOCK_SCAFFOLD, LOCATOR_BINDING, STATE_MATCHER, CHROME_LOCATOR, CONTENT_ROLE, GET_BY_TEXT, HAS_TEXT_FILTER, OUTCOME_TEXT, MESSAGE_SURFACE, TEXT_CONTENT_MATCHER, VISIBILITY_MATCHER, ADDITIVE_AFFORDANCE, EXCLUDE_AFFORDANCE, EMPTY_STATE_TEXT, AUTH_START, AUTH_END, LOGIN_CALL_LINE, INBOX_START, INBOX_END, NEGATED_ASSERT, TYPED_INPUT, TITLE_LINE, ROLE_NAME_RE, INTERACT_VERB, ROLE_SIG_RE, TRANSIENT_CONTROL_ROLES;
 var init_assertion_strength = __esm({
   "../shared/dist/assertion-strength.js"() {
     "use strict";
@@ -4312,6 +4327,8 @@ var init_assertion_strength = __esm({
     AUTH_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_AUTH/;
     AUTH_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_AUTH/;
     LOGIN_CALL_LINE = /^\s*await\s+__vqaLogin\s*\(\s*page\s*\)\s*;?\s*$/;
+    INBOX_START = /^\s*\/\/\s*>>>\s*VALIDATE_QA_INBOX/;
+    INBOX_END = /^\s*\/\/\s*<<<\s*VALIDATE_QA_INBOX/;
     NEGATED_ASSERT = /\.not\.(toBeVisible|toContainText|toHaveText|toBeChecked)\b|\.toBeHidden\s*\(/;
     TYPED_INPUT = /\.(fill|type|pressSequentially|setInputFiles)\s*\(/;
     TITLE_LINE = /^\s*(?:test|describe)(?:\.\w+)?\s*\(/;
@@ -4354,10 +4371,7 @@ function isEnvironmentalError(run2) {
     return false;
   if (run2.status !== "ERROR")
     return false;
-  const err = run2.error;
-  if (typeof err !== "string")
-    return false;
-  return ENVIRONMENTAL_ERROR_PREFIXES.some((p) => err.startsWith(p));
+  return classifyErrorMessage(run2.error) !== null;
 }
 function isCountedFailure(run2) {
   if (!run2)
@@ -4376,9 +4390,10 @@ function environmentalReason(run2) {
 function classifyErrorMessage(error2) {
   if (typeof error2 !== "string")
     return null;
-  if (error2.startsWith("RATE_LIMIT_BLOCKED:"))
+  const normalized = error2.replace(/^\s+/, "").replace(/^Error:\s*/i, "");
+  if (normalized.startsWith("RATE_LIMIT_BLOCKED:"))
     return "rate_limit";
-  if (error2.startsWith("CONFIG_ISSUE:"))
+  if (normalized.startsWith("CONFIG_ISSUE:"))
     return "config_issue";
   return null;
 }
@@ -72600,7 +72615,7 @@ var require_verification_inbox = __commonJS({
       };
     })();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.VerificationInboxReader = void 0;
+    exports2.VerificationInboxReader = exports2.InboxAuthError = void 0;
     exports2.isVerificationInboxConfigured = isVerificationInboxConfigured;
     exports2.describeVerificationInboxConfigGap = describeVerificationInboxConfigGap;
     exports2.loadVerificationInboxConfig = loadVerificationInboxConfig;
@@ -72612,8 +72627,10 @@ var require_verification_inbox = __commonJS({
     exports2.applyPlusTag = applyPlusTag;
     exports2.deriveRegistrationPassword = deriveRegistrationPassword;
     exports2.extractVerificationCode = extractVerificationCode;
+    exports2.extractVerificationCodeDetailed = extractVerificationCodeDetailed;
     exports2.extractVerificationLink = extractVerificationLink;
     exports2.collectMessageUrls = collectMessageUrls;
+    exports2.isInboxAuthFailure = isInboxAuthFailure;
     var node_crypto_1 = require("crypto");
     var DEFAULT_MAILBOX = "INBOX";
     var DEFAULT_GMAIL_SPAM_MAILBOX = "[Gmail]/Spam";
@@ -72786,6 +72803,9 @@ var require_verification_inbox = __commonJS({
     var CODE_TOKEN = new RegExp(`\\b(${CODE_ALT})\\b`, "gi");
     var YEAR_CONTEXT = /(©|\(c\)|copyright|all rights reserved|®)/i;
     function extractVerificationCode(text, html, subject) {
+      return extractVerificationCodeDetailed(text, html, subject).code;
+    }
+    function extractVerificationCodeDetailed(text, html, subject) {
       const subj = collapseSpacedDigits(subject || "");
       const bodies = [text || "", stripHtml(html || "")].map(collapseSpacedDigits);
       const withSubject = [subj, ...bodies];
@@ -72794,7 +72814,7 @@ var require_verification_inbox = __commonJS({
         if (lone) {
           const c = cleanCode(lone[1]);
           if (c)
-            return c;
+            return { code: c, confidence: "subject" };
         }
       }
       for (const body of withSubject) {
@@ -72806,26 +72826,28 @@ var require_verification_inbox = __commonJS({
             continue;
           const m = matchBestCode(line);
           if (m)
-            return m;
+            return { code: m, confidence: "keyword" };
         }
         const windowed = body.match(new RegExp(`${CODE_KEYWORDS.source}[\\s\\S]{0,40}?\\b(${CODE_ALT})\\b`, "i"));
         if (windowed && windowed[1]) {
           const cleaned = cleanCode(windowed[1]);
           if (cleaned && !looksLikeYearOrDate(cleaned))
-            return cleaned;
+            return { code: cleaned, confidence: "keyword" };
         }
       }
+      const distinct = /* @__PURE__ */ new Set();
       for (const body of bodies) {
         if (!body)
           continue;
-        const candidates = body.match(/\b[0-9]{4,8}\b/g);
-        if (!candidates)
-          continue;
-        const real = candidates.find((n) => !looksLikeYearOrDate(n));
-        if (real)
-          return real;
+        for (const n of body.match(/\b[0-9]{4,8}\b/g) ?? []) {
+          if (!looksLikeYearOrDate(n))
+            distinct.add(n);
+        }
       }
-      return null;
+      if (distinct.size === 1) {
+        return { code: distinct.values().next().value ?? null, confidence: "fallback" };
+      }
+      return { code: null, confidence: null };
     }
     function matchBestCode(line) {
       const hasYearContext = YEAR_CONTEXT.test(line);
@@ -72947,6 +72969,28 @@ var require_verification_inbox = __commonJS({
     }
     var MAX_WAIT_CEILING_MS = 18e4;
     var MIN_POLL_MS = 2e3;
+    var InboxAuthError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "InboxAuthError";
+      }
+    };
+    exports2.InboxAuthError = InboxAuthError;
+    function isInboxAuthFailure(error2) {
+      if (!error2)
+        return false;
+      if (error2 instanceof InboxAuthError)
+        return true;
+      const e = error2;
+      if (e.authenticationFailed === true)
+        return true;
+      const hay = `${e.responseText ?? ""} ${e.message ?? ""}`;
+      return /\bAUTHENTICATIONFAILED\b|\bInvalid credentials\b/i.test(hay);
+    }
+    function isPlusTagged(address) {
+      const at = address.indexOf("@");
+      return at > 0 && address.slice(0, at).includes("+");
+    }
     var VerificationInboxReader = class {
       config;
       client = null;
@@ -72976,7 +73020,14 @@ var require_verification_inbox = __commonJS({
           });
           client.on("error", () => {
           });
-          await client.connect();
+          try {
+            await client.connect();
+          } catch (error2) {
+            if (isInboxAuthFailure(error2)) {
+              throw new InboxAuthError(`IMAP authentication rejected for ${this.config.user} \u2014 the inbox app password is revoked or wrong`);
+            }
+            throw error2;
+          }
           this.client = client;
           return client;
         })();
@@ -73021,7 +73072,10 @@ var require_verification_inbox = __commonJS({
           } finally {
             lock.release();
           }
-        } catch {
+        } catch (error2) {
+          if (isInboxAuthFailure(error2)) {
+            throw error2 instanceof InboxAuthError ? error2 : new InboxAuthError(`IMAP authentication rejected for ${this.config.user} \u2014 the inbox app password is revoked or wrong`);
+          }
           return { uid: 0, uidValidity: 0 };
         }
       }
@@ -73072,23 +73126,52 @@ var require_verification_inbox = __commonJS({
         }
       }
       /**
-       * Poll until a matching message arrives or the deadline passes. Returns the
-       * newest matching message or null on timeout.
+       * Poll until a message with a STRONG verification signal (subject/keyword
+       * code or a positive-scoring link) arrives, or the deadline passes.
+       *
+       * Signal-less mail addressed to the same recipient (a welcome email, a
+       * receipt) is remembered but polled PAST — returning it immediately used to
+       * hand welcome-mail order numbers to the caller as "the code" whenever the
+       * welcome email out-raced the verification email. Only at the deadline is
+       * the newest signal-less message surfaced (better than pretending the
+       * mailbox is empty: the caller can still read it and decide).
        */
       async waitForMessage(opts) {
         const maxWaitMs = Math.min(opts.maxWaitMs ?? 9e4, MAX_WAIT_CEILING_MS);
         const pollIntervalMs = Math.max(opts.pollIntervalMs ?? 5e3, MIN_POLL_MS);
         const deadline = startTime() + maxWaitMs;
+        const limit = Math.max(1, Math.min(opts.limit ?? 10, 50));
+        const satisfies = (m) => {
+          if (opts.require === "code")
+            return m.code !== null && m.codeConfidence !== "fallback";
+          if (opts.require === "link")
+            return m.link !== null;
+          return m.hasVerificationSignal;
+        };
+        let weakest = null;
+        const check2 = async () => {
+          if (opts.stats)
+            opts.stats.filteredOut = 0;
+          const messages = await this.fetchMatching({ ...opts, limit }, true);
+          if (!opts.require)
+            return messages[0] ?? null;
+          const strong = messages.find((m) => satisfies(m) && !m.senderMismatch) ?? messages.find(satisfies);
+          if (strong)
+            return strong;
+          if (messages[0])
+            weakest = messages[0];
+          return null;
+        };
         do {
-          const latest = await this.getLatest(opts);
-          if (latest)
-            return latest;
+          const found = await check2();
+          if (found)
+            return found;
           const remaining = deadline - startTime();
           if (remaining <= 0)
             break;
           await sleep(Math.min(pollIntervalMs, remaining));
         } while (startTime() < deadline);
-        return this.getLatest(opts);
+        return await check2() ?? weakest;
       }
       async fetchMatching(opts, withBody) {
         const limit = Math.max(1, Math.min(opts.limit ?? 10, 50));
@@ -73102,7 +73185,7 @@ var require_verification_inbox = __commonJS({
               throw e;
           }
         }
-        results.sort((a, b) => Date.parse(b.date) - Date.parse(a.date));
+        results.sort((a, b) => Number(a.senderMismatch ?? false) - Number(b.senderMismatch ?? false) || Date.parse(b.date) - Date.parse(a.date));
         return results.slice(0, limit);
       }
       async fetchMatchingInMailbox(opts, withBody, mailbox, limit) {
@@ -73110,6 +73193,7 @@ var require_verification_inbox = __commonJS({
         const since = new Date(Math.max(0, opts.sinceMs));
         const lock = await client.getMailboxLock(mailbox);
         const results = [];
+        const taggedRecipient = isPlusTagged(opts.toAddress);
         try {
           try {
             await client.noop();
@@ -73153,17 +73237,23 @@ var require_verification_inbox = __commonJS({
             const receivedMs = (parsed.date ?? msg.envelope?.date ?? /* @__PURE__ */ new Date(0)).getTime();
             if (!useUid && receivedMs < opts.sinceMs - 6e4)
               continue;
-            if (opts.fromMatch && !matchField(parsed.from?.text, opts.fromMatch))
-              continue;
-            if (opts.subjectMatch && !matchField(parsed.subject, opts.subjectMatch))
+            const filterActive = Boolean(opts.fromMatch || opts.subjectMatch);
+            const filterMatched = (!opts.fromMatch || matchField(parsed.from?.text, opts.fromMatch)) && (!opts.subjectMatch || matchField(parsed.subject, opts.subjectMatch));
+            if (filterActive && !filterMatched && !taggedRecipient) {
+              if (opts.stats)
+                opts.stats.filteredOut += 1;
               continue;
-            results.push({ uid: msg.uid, parsed, receivedMs });
+            }
+            results.push({ uid: msg.uid, parsed, receivedMs, senderMismatch: filterActive && !filterMatched });
           }
         } finally {
           lock.release();
         }
-        results.sort((a, b) => b.receivedMs - a.receivedMs);
-        return results.slice(0, limit).map((r) => toMessage(messageId(mailbox, String(r.uid), this.config.mailbox), r.parsed, withBody, mailbox));
+        results.sort((a, b) => Number(a.senderMismatch) - Number(b.senderMismatch) || b.receivedMs - a.receivedMs);
+        return results.slice(0, limit).map((r) => ({
+          ...toMessage(messageId(mailbox, String(r.uid), this.config.mailbox), r.parsed, withBody, mailbox),
+          ...r.senderMismatch ? { senderMismatch: true } : {}
+        }));
       }
       async close() {
         const client = this.client;
@@ -73194,12 +73284,18 @@ var require_verification_inbox = __commonJS({
       const text = parsed.text || "";
       const html = typeof parsed.html === "string" ? parsed.html : "";
       const summary = toSummary({ uid, parsed, mailbox });
+      const { code, confidence } = extractVerificationCodeDetailed(text, html, parsed.subject || "");
+      const link = extractVerificationLink(text, html);
       return {
         ...summary,
         text: withBody ? text : "",
         html: withBody ? html : "",
-        code: extractVerificationCode(text, html, parsed.subject || ""),
-        link: extractVerificationLink(text, html)
+        code,
+        link,
+        codeConfidence: confidence,
+        // A fallback-confidence code is NOT a signal: it is exactly the shape a
+        // welcome/receipt email produces (one stray number, no keyword context).
+        hasVerificationSignal: code !== null && confidence !== "fallback" || link !== null
       };
     }
     function toSummary(input) {
@@ -73397,7 +73493,11 @@ var require_inbox_tools = __commonJS({
     function err(message) {
       return { content: JSON.stringify({ error: message }), didMutate: false };
     }
+    var INBOX_AUTH_DEAD_GUIDANCE = "the inbox authentication is PERMANENTLY rejected (revoked/wrong app password) \u2014 STOP calling inbox tools; none of them can succeed this run. Treat email verification as UNAVAILABLE: hard-stop at any emailed code/link wall, NEVER type a guessed code, and report verification-gated flows as BLOCKED (blockedReason: inbox authentication failed). Continue with publicly reachable coverage.";
     async function dispatchInboxTool(toolName, toolArgs, ctx) {
+      if (ctx.state.authDead) {
+        return err(`${toolName} skipped: ${INBOX_AUTH_DEAD_GUIDANCE}`);
+      }
       try {
         switch (toolName) {
           case "provision_identity":
@@ -73419,6 +73519,10 @@ var require_inbox_tools = __commonJS({
         }
       } catch (e) {
         const message = e instanceof Error ? e.message : String(e);
+        if ((0, verification_inbox_js_1.isInboxAuthFailure)(e)) {
+          ctx.state.authDead = true;
+          return err(`${toolName} failed: ${INBOX_AUTH_DEAD_GUIDANCE}`);
+        }
         return err(`${toolName} failed: ${message}`);
       }
     }
@@ -73476,6 +73580,7 @@ var require_inbox_tools = __commonJS({
         return notReady;
       const maxWaitSeconds = clampNumber(args.maxWaitSeconds, 90, 5, 180);
       const { toAddress, altAddress } = inboxRecipients(ctx.state);
+      const stats = { filteredOut: 0 };
       const msg = await ctx.reader.waitForMessage({
         toAddress,
         altAddress,
@@ -73484,13 +73589,16 @@ var require_inbox_tools = __commonJS({
         sinceUidValidity: ctx.state.sinceUidValidity,
         fromMatch: asStr(args.senderMatch),
         subjectMatch: asStr(args.subjectMatch),
-        maxWaitMs: maxWaitSeconds * 1e3
+        maxWaitMs: maxWaitSeconds * 1e3,
+        stats
       });
       if (!msg) {
+        const filterHint = stats.filteredOut > 0 ? ` NOTE: ${stats.filteredOut} email(s) addressed to you WERE found but were excluded by your senderMatch/subjectMatch filter \u2014 transactional mail often comes from a delivery provider (mailgun/sendgrid/amazonses), so call wait_for_verification again WITHOUT senderMatch.` : "";
         return ok({
           found: false,
           waitedSeconds: maxWaitSeconds,
-          hint: 'No verification email yet \u2014 usually still in transit, not necessarily a failure. Call wait_for_verification AGAIN (safe to repeat; allow 30-90s total) and you may click an in-app "Resend" control AT MOST ONCE. Do NOT re-submit the signup form, do NOT create another account, and do not immediately assume your credentials are wrong \u2014 your account most likely already exists. BUT if you have already re-polled several times AND resent once and still nothing arrives, the signup may have genuinely failed: check the page for an error/validation message and report it (finish / needs-review) rather than re-polling forever \u2014 and still do not re-register. Use check_inbox to see what has arrived.'
+          ...stats.filteredOut > 0 ? { filteredOut: stats.filteredOut } : {},
+          hint: `No verification email yet \u2014 usually still in transit, not necessarily a failure.${filterHint} Call wait_for_verification AGAIN (safe to repeat; allow 30-90s total) and you may click an in-app "Resend" control AT MOST ONCE. Do NOT re-submit the signup form, do NOT create another account, and do not immediately assume your credentials are wrong \u2014 your account most likely already exists. BUT if you have already re-polled several times AND resent once and still nothing arrives, the signup may have genuinely failed: check the page for an error/validation message and report it (finish / needs-review) rather than re-polling forever \u2014 and still do not re-register. Use check_inbox to see what has arrived.`
         }, ctx.maxResultChars);
       }
       rememberLink(ctx.state, msg);
@@ -73502,6 +73610,8 @@ var require_inbox_tools = __commonJS({
         subject: msg.subject,
         from: msg.from,
         code: msg.code,
+        ...msg.codeConfidence === "fallback" ? { codeConfidence: "low", codeNote: "This code was the only number in the email but had no verification keyword next to it \u2014 verify against read_verification_email if entering it fails." } : {},
+        ...msg.senderMismatch ? { senderMismatch: true, senderNote: "This email is addressed to your exact registration address but its sender did not match your senderMatch \u2014 the recipient match is authoritative for your plus-tagged address." } : {},
         link,
         next: msg.code && link ? "Both a code and a confirmation link were found. Prefer typing the code into the verification field; if the app instead wants you to click, call open_verification_link with the link (and if the page it lands on then asks for the code, enter the code there)." : msg.code ? "Type this code into the verification field." : link ? "Call open_verification_link with this link to confirm. It navigates your current tab to the verify page; after it confirms, return to the app to keep exploring." : msg.link ? "A confirmation link was found but points at a private/internal host and was withheld for safety. Read the email body if you need to inspect it." : "No code/link auto-detected \u2014 call read_verification_email to read the body."
       }, ctx.maxResultChars);
@@ -73635,20 +73745,42 @@ var require_inbox_tools = __commonJS({
         return false;
       if (host === "::1" || host.startsWith("fe80:") || host.startsWith("fc") || host.startsWith("fd"))
         return false;
-      const m = host.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
-      if (m) {
-        const [a, b] = [Number(m[1]), Number(m[2])];
-        if (a === 127 || a === 0 || a === 10)
-          return false;
-        if (a === 169 && b === 254)
-          return false;
-        if (a === 192 && b === 168)
+      if (host.includes(":")) {
+        if (host === "::" || host === "::ffff:0:0")
           return false;
-        if (a === 172 && b >= 16 && b <= 31)
-          return false;
-        if (a >= 224)
+        const dotted = host.match(/(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/);
+        if (dotted && !ipv4IsPublic(dotted[1]))
           return false;
+        const mapped = host.match(/^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/);
+        if (mapped) {
+          const hi = parseInt(mapped[1], 16);
+          const lo = parseInt(mapped[2], 16);
+          const ipv4 = `${hi >> 8 & 255}.${hi & 255}.${lo >> 8 & 255}.${lo & 255}`;
+          if (!ipv4IsPublic(ipv4))
+            return false;
+        }
       }
+      if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(host) && !ipv4IsPublic(host))
+        return false;
+      return true;
+    }
+    function ipv4IsPublic(ipv4) {
+      const m = ipv4.match(/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/);
+      if (!m)
+        return true;
+      const [a, b] = [Number(m[1]), Number(m[2])];
+      if (a > 255 || b > 255 || Number(m[3]) > 255 || Number(m[4]) > 255)
+        return false;
+      if (a === 127 || a === 0 || a === 10)
+        return false;
+      if (a === 169 && b === 254)
+        return false;
+      if (a === 192 && b === 168)
+        return false;
+      if (a === 172 && b >= 16 && b <= 31)
+        return false;
+      if (a >= 224)
+        return false;
       return true;
     }
     function clampNumber(v, dflt, min, max) {
@@ -85717,12 +85849,14 @@ var require_run_callback_proxy = __commonJS({
       }
       const runPath = `/api/runner/runs/${encodeURIComponent(input.runId)}`;
       const allowedPaths = /* @__PURE__ */ new Set([`${runPath}/credential`, `${runPath}/auth-state`]);
+      const localPaths = new Map(Object.entries(input.localRoutes ?? {}).map(([suffix, handler]) => [`${runPath}/${suffix}`, handler]));
       const token = (0, node_crypto_1.randomBytes)(32).toString("base64url");
       const authHeader = `Bearer ${token}`;
       const server3 = (0, node_http_1.createServer)(async (req, res) => {
         try {
           const requestUrl = new URL(req.url ?? "/", "http://127.0.0.1");
-          if (req.method !== "POST" || !allowedPaths.has(requestUrl.pathname) || requestUrl.search) {
+          const localHandler = localPaths.get(requestUrl.pathname);
+          if (req.method !== "POST" || !allowedPaths.has(requestUrl.pathname) && !localHandler || requestUrl.search) {
             sendJson(res, 404, { error: "Callback route not available" });
             return;
           }
@@ -85741,6 +85875,11 @@ var require_run_callback_proxy = __commonJS({
             sendJson(res, 400, { error: "Callback body must be a JSON object" });
             return;
           }
+          if (localHandler) {
+            const out = await localHandler(parsedBody);
+            sendJson(res, out.status, out.body);
+            return;
+          }
           const upstreamBody = JSON.stringify({
             ...parsedBody,
             ...input.taskArn ? { taskArn: input.taskArn } : {},
@@ -85799,6 +85938,668 @@ var require_run_callback_proxy = __commonJS({
   }
 });
 
+// ../runner-core/dist/services/discovery-lint-flags.js
+var require_discovery_lint_flags = __commonJS({
+  "../runner-core/dist/services/discovery-lint-flags.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.structuralLocatorLintMode = structuralLocatorLintMode;
+    exports2.isPwMethodPreflightEnabled = isPwMethodPreflightEnabled;
+    exports2.isVqaLoginDedupeEnabled = isVqaLoginDedupeEnabled;
+    exports2.isTestgenEmailVerifyEnabled = isTestgenEmailVerifyEnabled;
+    function strictOn(value) {
+      return value === "true" || value === "1";
+    }
+    function structuralLocatorLintMode() {
+      const v = (process.env.DISCOVERY_STRUCTURAL_LOCATOR_LINT || "").trim().toLowerCase();
+      if (v === "warn")
+        return "warn";
+      if (v === "true" || v === "1" || v === "enforce")
+        return "enforce";
+      return "off";
+    }
+    function isPwMethodPreflightEnabled() {
+      return strictOn(process.env.DISCOVERY_PW_METHOD_PREFLIGHT);
+    }
+    function isVqaLoginDedupeEnabled() {
+      return strictOn(process.env.DISCOVERY_VQALOGIN_DEDUPE);
+    }
+    function isTestgenEmailVerifyEnabled() {
+      return strictOn(process.env.DISCOVERY_TESTGEN_EMAIL_VERIFY);
+    }
+  }
+});
+
+// ../runner-core/dist/services/auth-recipe.js
+var require_auth_recipe = __commonJS({
+  "../runner-core/dist/services/auth-recipe.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = void 0;
+    exports2.computeRecipeHash = computeRecipeHash;
+    exports2.buildAuthRecipe = buildAuthRecipe;
+    exports2.authProofLocator = authProofLocator;
+    exports2.urlProofPredicateExpr = urlProofPredicateExpr;
+    exports2.renderAuthProofAssertion = renderAuthProofAssertion;
+    exports2.renderProofBaselineCheck = renderProofBaselineCheck;
+    exports2.renderAuthFn = renderAuthFn;
+    exports2.isReservedRunnerEnvVar = isReservedRunnerEnvVar;
+    exports2.absoluteRoute = absoluteRoute;
+    exports2.renderReplayClickArrow = renderReplayClickArrow;
+    exports2.renderReplaySettleArrow = renderReplaySettleArrow;
+    exports2.renderAuthUrlWaitLine = renderAuthUrlWaitLine;
+    exports2.commandToReplayStep = commandToReplayStep;
+    exports2.buildReplayPlan = buildReplayPlan;
+    exports2.extractAuthRegion = extractAuthRegion;
+    exports2.stripAuthRegions = stripAuthRegions;
+    exports2.ensureExpectImported = ensureExpectImported;
+    exports2.insertAfterPwImport = insertAfterPwImport;
+    exports2.ensureLoginCall = ensureLoginCall;
+    exports2.upsertAuthBlock = upsertAuthBlock;
+    exports2.buildHealAuthStamp = buildHealAuthStamp;
+    var crypto_1 = require("crypto");
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
+    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    exports2.AUTH_MARKER_VERSION = "v3";
+    var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
+    var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} <<<`;
+    var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
+    var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
+    function computeRecipeHash(input) {
+      const canonical = JSON.stringify({
+        preNavRoute: input.preNavRoute,
+        preNavCmds: input.preNavCmds,
+        route: input.route,
+        cmds: input.cmds,
+        redirectRoute: input.redirectRoute,
+        authProof: input.authProof
+      });
+      return (0, crypto_1.createHash)("sha256").update(canonical).digest("hex").slice(0, 12);
+    }
+    function buildAuthRecipe(login, authProof, verifiedAt) {
+      const preNavRoute = login.preNavRoute ?? "/";
+      const preNavCmds = login.preNavCmds ?? [];
+      const recipeHash = computeRecipeHash({
+        preNavRoute,
+        preNavCmds,
+        route: login.route,
+        cmds: login.cmds,
+        redirectRoute: login.redirectRoute,
+        authProof
+      });
+      return {
+        version: 1,
+        recipeHash,
+        preNavRoute,
+        preNavCmds,
+        route: login.route,
+        cmds: login.cmds,
+        redirectRoute: login.redirectRoute,
+        authProof,
+        replayPlan: login.replayPlan ?? [],
+        verifiedAt
+      };
+    }
+    function authProofLocator(proof) {
+      if (proof.kind === "url" || proof.kind === "endpoint") {
+        throw new Error(`authProofLocator: ${proof.kind} proof has no element locator; callers must branch on proof.kind`);
+      }
+      if (proof.kind === "testid") {
+        return `page.getByTestId(${JSON.stringify(proof.testId)})`;
+      }
+      if (proof.name) {
+        return `page.getByRole(${JSON.stringify(proof.role)}, { name: ${JSON.stringify(proof.name)} })`;
+      }
+      return `page.getByRole(${JSON.stringify(proof.role)}).first()`;
+    }
+    function stripToPathname(route2) {
+      return route2.replace(/[?#].*$/, "").replace(/\/+$/, "") || "/";
+    }
+    function urlProofPredicateExpr(route2, exact = false) {
+      const p = stripToPathname(route2);
+      if (p === "/")
+        return `() => false`;
+      const r = JSON.stringify(p);
+      if (exact)
+        return `(u) => u.pathname === ${r} || u.pathname === ${r} + '/'`;
+      return `(u) => u.pathname === ${r} || u.pathname.startsWith(${r} + '/')`;
+    }
+    function renderStableExactUrlProof(pred, tabs) {
+      return [
+        `await page.waitForURL(${pred}, { timeout: 15000 });`,
+        `if (await page.waitForURL((u) => !(${pred})(u), { timeout: 1500 }).then(() => true, () => false)) throw new Error('__vqa auth-proof: authenticated route was transient (rebounded to a logged-out route)');`,
+        `if (await page.locator('input[type="password"]').first().isVisible().catch(() => false)) throw new Error('__vqa auth-proof: a login form is visible on the authenticated route \u2014 logged out');`
+      ].join(`
+${tabs}`);
+    }
+    var ENDPOINT_ORIGIN_EXPR = `(page.url().match(/^https?:\\/\\/[^/]+/) || [''])[0]`;
+    function renderEndpointProbe(url, tabs, mode, originMode) {
+      const u = JSON.stringify(url);
+      const target = originMode === "pageurl" ? `${ENDPOINT_ORIGIN_EXPR} + ${u}` : u;
+      const lines = [
+        `const __vqaResp = await page.request.get(${target});`,
+        `const __vqaJson = __vqaResp.ok() ? await __vqaResp.json().catch(() => null) : null;`,
+        `const __vqaUser = __vqaJson && (__vqaJson.user ?? __vqaJson.data?.user ?? __vqaJson);`,
+        `const __vqaAuthed = !!(__vqaUser && (__vqaUser.id || __vqaUser.email || __vqaUser.sub));`,
+        mode === "authed" ? `if (!__vqaAuthed) throw new Error('__vqa auth-proof: identity endpoint shows no authenticated user');` : `if (__vqaAuthed) throw new Error('__vqa auth-baseline: identity endpoint shows an authenticated user while logged out');`
+      ];
+      return lines.join(`
+${tabs}`);
+    }
+    function renderAuthProofAssertion(proof) {
+      if (proof.kind === "endpoint") {
+        return renderEndpointProbe(proof.url, "  ", "authed", "baseurl");
+      }
+      if (proof.kind === "url") {
+        const pred = urlProofPredicateExpr(proof.route, proof.exact);
+        if (proof.exact)
+          return renderStableExactUrlProof(pred, "  ");
+        return `await page.waitForURL(${pred}, { timeout: 15000 });`;
+      }
+      return `await expect(${authProofLocator(proof)}).toBeVisible({ timeout: 15000 });`;
+    }
+    var BASELINE_VISIBLE_TIMEOUT_MS = 15e3;
+    function renderProofBaselineCheck(proof, tabs) {
+      if (proof.kind === "endpoint") {
+        return renderEndpointProbe(proof.url, tabs, "anon", "baseurl");
+      }
+      if (proof.kind === "url") {
+        const pred = urlProofPredicateExpr(proof.route, proof.exact);
+        return `if (await page.waitForURL(${pred}, { timeout: 2500 }).then(() => true, () => false)) throw new Error('__vqa auth-baseline: authed route reachable while logged out \u2014 not a discriminating proof');`;
+      }
+      const loc = authProofLocator(proof);
+      return [
+        `if (await ${loc}.waitFor({ state: 'visible', timeout: ${BASELINE_VISIBLE_TIMEOUT_MS} }).then(() => true, () => false)) {`,
+        `  throw new Error('__vqa auth-baseline: authed-only proof visible while logged out \u2014 not a discriminating proof');`,
+        `}`
+      ].join(`
+${tabs}`);
+    }
+    function normalizeCmd(cmd) {
+      let c = cmd.trim();
+      if (c.endsWith(";"))
+        c = c.slice(0, -1);
+      return `  ${c};`;
+    }
+    function renderAuthFn(recipe, opts) {
+      const lines = [];
+      lines.push(START_MARKER);
+      lines.push(`async function __vqaLogin(page) {`);
+      if (opts?.warmGuard) {
+        const warmLanding = recipe.redirectRoute ?? (recipe.authProof.kind === "url" ? recipe.authProof.route : recipe.preNavRoute);
+        const loginRoute = recipe.route ?? recipe.preNavRoute;
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
+        lines.push(`    await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
+        if (recipe.authProof.kind === "endpoint") {
+          lines.push(`    try {`);
+          lines.push(`      ${renderEndpointProbe(recipe.authProof.url, "      ", "authed", "baseurl")}`);
+          lines.push(`      return;`);
+          lines.push(`    } catch {}`);
+        } else if (recipe.authProof.kind === "url") {
+          const pred = urlProofPredicateExpr(recipe.authProof.route, recipe.authProof.exact);
+          lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
+          lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
+        } else if (loginRoute) {
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
+        } else {
+          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
+        }
+        lines.push(`  }`);
+      }
+      lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
+      for (const cmd of recipe.preNavCmds)
+        lines.push(normalizeCmd(cmd));
+      if (recipe.preNavCmds.length === 0 && recipe.route && recipe.route !== recipe.preNavRoute) {
+        lines.push(`  await page.goto(${JSON.stringify(recipe.route)}, { waitUntil: 'domcontentloaded' });`);
+      }
+      for (const cmd of recipe.cmds)
+        lines.push(normalizeCmd(cmd));
+      lines.push(renderAuthUrlWaitLine(recipe.redirectRoute));
+      lines.push(`  ${renderAuthProofAssertion(recipe.authProof)}`);
+      if (opts?.warmGuard) {
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
+        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_CLAIM_EPOCH && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
+        lines.push(`    try {`);
+        lines.push(`      const __vqaState = await page.context().storageState();`);
+        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN, claimEpoch: Number(process.env.VALIDATE_CLAIM_EPOCH) }, timeout: 10000 });`);
+        lines.push(`    } catch {}`);
+        lines.push(`  }`);
+      }
+      lines.push(`}`);
+      lines.push(END_MARKER);
+      return lines.join("\n");
+    }
+    exports2.RESERVED_RUNNER_ENV_VARS = /* @__PURE__ */ new Set([
+      "AUTH_FILE",
+      "SHARED_AUTH_INJECT",
+      "VALIDATE_RUN_ID",
+      "VALIDATE_CLAIM_EPOCH",
+      "VALIDATE_AUTH_CONFIG_HASH",
+      "VALIDATE_TASK_ARN",
+      "VALIDATE_RUNNER_AUTH",
+      "VALIDATE_SERVER_URL",
+      // Register-and-verify tests (VALIDATE_QA_INBOX region, inbox-stamp.ts): the
+      // per-run minted registration address + its DERIVED throwaway-app password,
+      // injected by the parent's test-inbox-broker — never project variables.
+      "VQA_TEST_INBOX_EMAIL",
+      "VQA_TEST_ACCOUNT_PASSWORD"
+    ]);
+    function isReservedRunnerEnvVar(key) {
+      return exports2.RESERVED_RUNNER_ENV_VARS.has(key);
+    }
+    function absoluteRoute(route2, baseUrl) {
+      try {
+        return new URL(route2, baseUrl).href;
+      } catch {
+        return route2;
+      }
+    }
+    function renderReplayClickArrow(step) {
+      const loc = step.locator.trim();
+      if (step.kind === "wait") {
+        return `async (page) => {
+  await ${loc}.waitFor({ state: 'visible', timeout: 15000 });
+}`;
+      }
+      if (step.kind === "press") {
+        return `async (page) => {
+  await ${loc}.press(${JSON.stringify(step.key ?? "Enter")});
+}`;
+      }
+      return `async (page) => {
+  await ${loc}.click();
+}`;
+    }
+    function renderReplaySettleArrow(proof) {
+      if (proof.kind === "endpoint") {
+        return `async (page) => {
+  ${renderEndpointProbe(proof.url, "  ", "authed", "pageurl")}
+}`;
+      }
+      if (proof.kind === "url") {
+        const pred = urlProofPredicateExpr(proof.route, proof.exact);
+        const body = proof.exact ? renderStableExactUrlProof(pred, "  ") : `await page.waitForURL(${pred}, { timeout: 15000 });`;
+        return `async (page) => {
+  ${body}
+}`;
+      }
+      return `async (page) => {
+  await ${authProofLocator(proof)}.waitFor({ state: 'visible', timeout: 15000 });
+}`;
+    }
+    function renderAuthUrlWaitLine(redirectRoute) {
+      const opts = `{ waitUntil: 'domcontentloaded', timeout: 8000 }`;
+      const tail = `.catch(() => { /* URL drift \u2014 the auth-proof assertion below is the gate */ });`;
+      const rr = redirectRoute ? stripToPathname(redirectRoute) : null;
+      if (rr && rr !== "/") {
+        const r = JSON.stringify(rr);
+        return `  await page.waitForURL((u) => u.pathname === ${r} || u.pathname.startsWith(${r} + '/'), ${opts})${tail}`;
+      }
+      if (rr === "/") {
+        return `  await page.waitForURL((u) => !/\\/(login|sign-?in)/i.test(u.pathname), ${opts})${tail}`;
+      }
+      return `  await page.waitForURL((u) => u.pathname !== '/' && !/\\/(login|sign-?in)/i.test(u.pathname), ${opts})${tail}`;
+    }
+    function locatorChainOf(cmd) {
+      const m = cmd.match(/\bpage\.[\s\S]*?(?=\.(?:fill|click|check|press|selectOption|setChecked|waitFor)\s*\()/);
+      return m ? m[0].trim() : null;
+    }
+    function parseRoleName(locator) {
+      const role = locator.match(/getByRole\(\s*['"`]([^'"`]+)['"`]/)?.[1];
+      const name = locator.match(/getByRole\([^)]*name:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? locator.match(/getByLabel\(\s*['"`]([^'"`]+)['"`]/)?.[1] ?? locator.match(/getByPlaceholder\(\s*['"`]([^'"`]+)['"`]/)?.[1];
+      return { role, name };
+    }
+    function credentialKeyOf(cmd) {
+      return cmd.match(/\.fill\(\s*process\.env\.([A-Za-z_$][\w$]*)!?\s*\)/)?.[1] ?? null;
+    }
+    function commandToReplayStep(cmd) {
+      const chain = locatorChainOf(cmd);
+      if (!chain)
+        return null;
+      const credKey = credentialKeyOf(cmd);
+      if (cmd.includes(".fill(")) {
+        if (!credKey)
+          return null;
+        const { role, name } = parseRoleName(chain);
+        return { kind: "fill", credentialKey: credKey, locator: chain, role, name, element: name ?? role ?? "credential field" };
+      }
+      if (/\.waitFor\s*\(/.test(cmd))
+        return { kind: "wait", locator: chain };
+      const pressKey = cmd.match(/\.press\(\s*['"`]([^'"`]+)['"`]\s*\)/)?.[1];
+      if (pressKey)
+        return { kind: "press", locator: chain, key: pressKey };
+      if (/\.(?:click|check|setChecked|selectOption)\s*\(/.test(cmd))
+        return { kind: "click", locator: chain };
+      return null;
+    }
+    function buildReplayPlan(login) {
+      const plan = [];
+      const preNavRoute = login.preNavRoute ?? "/";
+      plan.push({ kind: "nav", route: preNavRoute });
+      for (const c of login.preNavCmds ?? []) {
+        const step = commandToReplayStep(c);
+        if (step)
+          plan.push(step);
+      }
+      if ((login.preNavCmds ?? []).length === 0 && login.route && login.route !== preNavRoute) {
+        plan.push({ kind: "nav", route: login.route });
+      }
+      for (const c of login.cmds) {
+        const step = commandToReplayStep(c);
+        if (step)
+          plan.push(step);
+      }
+      return plan;
+    }
+    function extractAuthRegion(code) {
+      const m = code.match(new RegExp(AUTH_REGION_RE.source));
+      return m ? m[0] : null;
+    }
+    function countAuthRegions(code) {
+      const m = code.match(AUTH_REGION_RE);
+      return m ? m.length : 0;
+    }
+    function stripAuthRegions(code) {
+      return code.replace(AUTH_REGION_RE, "");
+    }
+    var PW_IMPORT_RE = /import\s*\{([^}]*)\}\s*from\s*['"]@playwright\/test['"]\s*;?/;
+    function ensureExpectImported(code) {
+      const m = code.match(PW_IMPORT_RE);
+      if (!m)
+        return code;
+      const names = m[1].split(",").map((s) => s.trim()).filter(Boolean);
+      if (names.includes("expect"))
+        return code;
+      const next = [...names, "expect"];
+      return code.replace(PW_IMPORT_RE, `import { ${next.join(", ")} } from '@playwright/test';`);
+    }
+    function insertAfterPwImport(code, block) {
+      const m = code.match(PW_IMPORT_RE);
+      if (!m || m.index === void 0) {
+        return `${block}
+
+${code.replace(/^\r?\n+/, "")}`;
+      }
+      const end = m.index + m[0].length;
+      const head = code.slice(0, end);
+      const tail = code.slice(end).replace(/^\r?\n+/, "");
+      return `${head}
+
+${block}
+
+${tail}`;
+    }
+    var TEST_OPENER_RE = /test(?:\.(?:only|skip|fixme))?\s*\(\s*(['"`])(?:[^\\]|\\.)*?\1\s*,\s*(?:\{[\s\S]*?\}\s*,\s*)?async\s*\(\s*\{[^}]*\}[^)]*\)\s*=>\s*\{/;
+    var LOGIN_CALL_RE = /await\s+__vqaLogin\s*\(\s*page\s*\)/;
+    function ensureLoginCall(code) {
+      if (code.match(new RegExp(TEST_OPENER_RE.source, "g")) === null)
+        return code;
+      let result = code;
+      if ((0, discovery_lint_flags_js_1.isVqaLoginDedupeEnabled)()) {
+        result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
+      }
+      const matches = [...result.matchAll(new RegExp(TEST_OPENER_RE.source, "g"))];
+      for (let i = matches.length - 1; i >= 0; i--) {
+        const m = matches[i];
+        if (m.index === void 0)
+          continue;
+        const insertAt = m.index + m[0].length;
+        const following = result.slice(insertAt, insertAt + 60);
+        if (/^\s*await\s+__vqaLogin\s*\(\s*page\s*\)/.test(following))
+          continue;
+        result = `${result.slice(0, insertAt)}
+  await __vqaLogin(page);${result.slice(insertAt)}`;
+      }
+      return result;
+    }
+    function upsertAuthBlock(code, ctx) {
+      if (ctx.mode === "generate") {
+        if (!ctx.recipe || !ctx.isAuthNeeded)
+          return code;
+        let result = stripAuthRegions(code);
+        result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
+        result = ensureExpectImported(result);
+        const warmGuard = (0, shared_1.isSharedAuthInjectEnabled)();
+        result = insertAfterPwImport(result, renderAuthFn(ctx.recipe, { warmGuard }));
+        result = ensureLoginCall(result);
+        const n = countAuthRegions(result);
+        if (n !== 1) {
+          throw new Error(`upsertAuthBlock(generate): expected exactly 1 auth region after stamp, got ${n}`);
+        }
+        if (!LOGIN_CALL_RE.test(result)) {
+          throw new Error("upsertAuthBlock(generate): stamped __vqaLogin but found no test() opener to inject the call");
+        }
+        return result;
+      }
+      try {
+        if (!ctx.preservedAuthRegion)
+          return code;
+        let result = ensureExpectImported(code);
+        if (countAuthRegions(result) >= 1) {
+          result = result.replace(AUTH_REGION_RE, "");
+          result = insertAfterPwImport(result, ctx.preservedAuthRegion);
+        } else {
+          result = insertAfterPwImport(result, ctx.preservedAuthRegion);
+        }
+        result = ensureLoginCall(result);
+        if (countAuthRegions(result) !== 1) {
+          throw new Error("heal re-stamp produced non-unique auth region");
+        }
+        return result;
+      } catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        ctx.onSignal?.({ type: "auth-stamp-degraded", reason });
+        return code;
+      }
+    }
+    function buildHealAuthStamp(originalCode, failureError, logs2) {
+      const region = extractAuthRegion(originalCode);
+      const loginFailed = !!failureError && /__vqaLogin/.test(failureError);
+      return {
+        mode: "heal",
+        preservedAuthRegion: region && !loginFailed ? region : null,
+        onSignal: logs2 ? (s) => logs2.push(`\u26A0 auth-stamp ${s.type}: ${s.reason}`) : void 0
+      };
+    }
+  }
+});
+
+// ../runner-core/dist/services/inbox-stamp.js
+var require_inbox_stamp = __commonJS({
+  "../runner-core/dist/services/inbox-stamp.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.INBOX_HELPER_TOKEN_RE = exports2.INBOX_HELPER_NAME = exports2.INBOX_REGION_RE = exports2.INBOX_MARKER_VERSION = void 0;
+    exports2.codeUsesInboxHelper = codeUsesInboxHelper;
+    exports2.stripInboxRegions = stripInboxRegions;
+    exports2.renderInboxFn = renderInboxFn;
+    exports2.upsertInboxBlock = upsertInboxBlock;
+    var auth_recipe_js_1 = require_auth_recipe();
+    exports2.INBOX_MARKER_VERSION = "v1";
+    var START_MARKER = `// >>> VALIDATE_QA_INBOX ${exports2.INBOX_MARKER_VERSION} \u2014 generated, do not edit >>>`;
+    var END_MARKER = `// <<< VALIDATE_QA_INBOX ${exports2.INBOX_MARKER_VERSION} <<<`;
+    exports2.INBOX_REGION_RE = /\/\/ >>> VALIDATE_QA_INBOX[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_INBOX[^\n]*\r?\n?/g;
+    exports2.INBOX_HELPER_NAME = "__vqaWaitForEmail";
+    exports2.INBOX_HELPER_TOKEN_RE = /__vqaWaitForEmail\s*\(/;
+    function codeUsesInboxHelper(code) {
+      if (!code)
+        return false;
+      return exports2.INBOX_HELPER_TOKEN_RE.test(code) || /VALIDATE_QA_INBOX/.test(code);
+    }
+    function stripInboxRegions(code) {
+      return code.replace(exports2.INBOX_REGION_RE, "");
+    }
+    function countInboxRegions(code) {
+      const m = code.match(exports2.INBOX_REGION_RE);
+      return m ? m.length : 0;
+    }
+    function renderInboxFn() {
+      const lines = [
+        START_MARKER,
+        `// Reads THIS run's verification email via the runner's inbox broker. The`,
+        `// IMAP credential stays in the runner parent; this helper can only see mail`,
+        `// addressed to the run's own registration address (VQA_TEST_INBOX_EMAIL).`,
+        `// kind: 'code' \u2192 the one-time code, 'link' \u2192 the verification URL,`,
+        `// 'either' / omitted \u2192 { code, link, subject, from } for flexible flows.`,
+        `async function __vqaWaitForEmail(kind, opts) {`,
+        `  const want = kind === 'code' || kind === 'link' ? kind : 'either';`,
+        `  if (!process.env.VQA_TEST_INBOX_EMAIL || !process.env.VALIDATE_SERVER_URL || !process.env.VALIDATE_RUN_ID) {`,
+        `    throw new Error('CONFIG_ISSUE: email verification unavailable - this runner has no verification inbox, so a register-and-verify test cannot run here');`,
+        `  }`,
+        `  const timeoutMs = Math.min(Math.max((opts && opts.timeoutMs) || 150000, 5000), 170000);`,
+        `  const res = await fetch(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + encodeURIComponent(process.env.VALIDATE_RUN_ID) + '/inbox-wait', {`,
+        `    method: 'POST',`,
+        `    headers: { authorization: process.env.VALIDATE_RUNNER_AUTH || '', 'content-type': 'application/json' },`,
+        `    body: JSON.stringify({ kind: want, timeoutMs: timeoutMs }),`,
+        `  });`,
+        `  if (res.status === 404) {`,
+        `    throw new Error('CONFIG_ISSUE: email verification unavailable - the runner inbox broker is not active for this run');`,
+        `  }`,
+        `  let data = null;`,
+        `  try { data = await res.json(); } catch (e) { data = null; }`,
+        `  if (!res.ok || !data) { throw new Error('inbox broker request failed (status ' + res.status + ')'); }`,
+        `  if (!data.found) {`,
+        `    if (data.error) { throw new Error('CONFIG_ISSUE: verification inbox failed on this runner - ' + data.error); }`,
+        `    throw new Error('VERIFICATION_EMAIL_NOT_RECEIVED: no verification email arrived for this test account within ' + Math.round(timeoutMs / 1000) + 's - the app may not have sent it');`,
+        `  }`,
+        `  if (want === 'code' && !data.code) {`,
+        `    throw new Error('VERIFICATION_EMAIL_HAS_NO_CODE: an email arrived (subject: ' + JSON.stringify(data.subject || '') + ') but no one-time code could be extracted');`,
+        `  }`,
+        `  if (want === 'link' && !data.link) {`,
+        `    throw new Error('VERIFICATION_EMAIL_HAS_NO_LINK: an email arrived (subject: ' + JSON.stringify(data.subject || '') + ') but no verification link could be extracted');`,
+        `  }`,
+        `  return want === 'code' ? data.code : want === 'link' ? data.link : data;`,
+        `}`,
+        END_MARKER
+      ];
+      return lines.join("\n");
+    }
+    function upsertInboxBlock(code) {
+      const stripped = stripInboxRegions(code);
+      if (!exports2.INBOX_HELPER_TOKEN_RE.test(stripped))
+        return stripped;
+      const result = (0, auth_recipe_js_1.insertAfterPwImport)(stripped, renderInboxFn());
+      const n = countInboxRegions(result);
+      if (n !== 1) {
+        throw new Error(`upsertInboxBlock: expected exactly 1 inbox region after stamp, got ${n}`);
+      }
+      return result;
+    }
+  }
+});
+
+// ../runner-core/dist/services/test-inbox-broker.js
+var require_test_inbox_broker = __commonJS({
+  "../runner-core/dist/services/test-inbox-broker.js"(exports2) {
+    "use strict";
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.INBOX_WAIT_ROUTE = exports2.TEST_INBOX_PASSWORD_ENV = exports2.TEST_INBOX_EMAIL_ENV = void 0;
+    exports2.deriveTestRunInboxTag = deriveTestRunInboxTag;
+    exports2.mintTestRunInboxIdentity = mintTestRunInboxIdentity;
+    exports2.decideInboxWaitResponse = decideInboxWaitResponse;
+    exports2.startTestInboxBroker = startTestInboxBroker;
+    var node_crypto_1 = require("crypto");
+    var verification_inbox_js_1 = require_verification_inbox();
+    var inbox_tools_js_1 = require_inbox_tools();
+    exports2.TEST_INBOX_EMAIL_ENV = "VQA_TEST_INBOX_EMAIL";
+    exports2.TEST_INBOX_PASSWORD_ENV = "VQA_TEST_ACCOUNT_PASSWORD";
+    exports2.INBOX_WAIT_ROUTE = "inbox-wait";
+    var MIN_WAIT_MS = 5e3;
+    var MAX_WAIT_MS = 17e4;
+    var DEFAULT_WAIT_MS = 15e4;
+    function deriveTestRunInboxTag(seed, projectId, runId) {
+      const hostKey = (0, verification_inbox_js_1.seedToHostKey)(seed || "");
+      const hash = (0, node_crypto_1.createHash)("sha256").update(`testrun|${hostKey}|${projectId ?? ""}|${runId}`).digest("hex").slice(0, 10);
+      return `vqat${hash}`;
+    }
+    function mintTestRunInboxIdentity(config, input) {
+      const tag = deriveTestRunInboxTag(input.baseUrl, input.projectId, input.runId);
+      const email = (0, verification_inbox_js_1.applyPlusTag)(config.address, tag);
+      return { email, password: (0, verification_inbox_js_1.deriveRegistrationPassword)(email), tag };
+    }
+    function decideInboxWaitResponse(msg, publicLink) {
+      const code = msg && msg.code && msg.codeConfidence !== "fallback" ? msg.code : null;
+      const link = publicLink;
+      if (!msg || !code && !link)
+        return { found: false };
+      return { found: true, code, link, subject: msg.subject, from: msg.from };
+    }
+    async function startTestInboxBroker(opts) {
+      const identity = mintTestRunInboxIdentity(opts.config, opts);
+      const reader = new verification_inbox_js_1.VerificationInboxReader(opts.config);
+      const sinceMs = Date.now();
+      let sinceUid = 0;
+      let sinceUidValidity = 0;
+      let authDeadReason = null;
+      try {
+        const wm = await reader.getUidWatermark();
+        sinceUid = wm.uid;
+        sinceUidValidity = wm.uidValidity;
+      } catch (error2) {
+        if ((0, verification_inbox_js_1.isInboxAuthFailure)(error2)) {
+          authDeadReason = error2 instanceof Error ? error2.message : String(error2);
+          opts.log?.(`\u26A0 Inbox broker: IMAP authentication rejected at watermark probe \u2014 email waits will fail as CONFIG_ISSUE (${authDeadReason})`);
+        } else {
+          opts.log?.("\u26A0 Inbox broker: UID watermark unavailable, falling back to the time floor");
+        }
+      }
+      opts.log?.(`\u{1F4EC} Inbox broker active for ${identity.email} (uid watermark ${sinceUid || "none"})`);
+      let waiting = false;
+      const handleWait = async (body) => {
+        if (authDeadReason) {
+          return { status: 200, body: { found: false, error: "inbox authentication failed (revoked/wrong app password)" } };
+        }
+        if (waiting) {
+          return { status: 200, body: { found: false, error: "another verification wait is already in progress for this run" } };
+        }
+        waiting = true;
+        const rawTimeout = typeof body.timeoutMs === "number" && Number.isFinite(body.timeoutMs) ? body.timeoutMs : DEFAULT_WAIT_MS;
+        const timeoutMs = Math.min(Math.max(rawTimeout, MIN_WAIT_MS), MAX_WAIT_MS);
+        const require2 = body.kind === "code" ? "code" : body.kind === "link" ? "link" : "signal";
+        try {
+          const stats = { filteredOut: 0 };
+          const msg = await reader.waitForMessage({
+            toAddress: identity.email,
+            sinceMs,
+            sinceUid,
+            sinceUidValidity,
+            maxWaitMs: timeoutMs,
+            require: require2,
+            stats
+          });
+          const publicLink = msg && msg.link && (0, inbox_tools_js_1.isPublicHttpUrl)(msg.link) ? msg.link : null;
+          const decision = decideInboxWaitResponse(msg, publicLink);
+          if (!decision.found) {
+            opts.log?.(`\u{1F4ED} Inbox broker: no usable verification email for ${identity.tag} within ${Math.round(timeoutMs / 1e3)}s`);
+            return { status: 200, body: { found: false } };
+          }
+          opts.log?.(`\u{1F4EC} Inbox broker: email for ${identity.tag} (code=${decision.code ? "yes" : "no"}, link=${decision.link ? "yes" : "no"})`);
+          return { status: 200, body: { ...decision } };
+        } catch (error2) {
+          if ((0, verification_inbox_js_1.isInboxAuthFailure)(error2)) {
+            authDeadReason = error2 instanceof Error ? error2.message : String(error2);
+            return { status: 200, body: { found: false, error: "inbox authentication failed (revoked/wrong app password)" } };
+          }
+          const message = error2 instanceof Error ? error2.message : String(error2);
+          opts.log?.(`\u26A0 Inbox broker wait failed: ${message}`);
+          return { status: 200, body: { found: false, error: `inbox read failed: ${message}` } };
+        } finally {
+          waiting = false;
+        }
+      };
+      return {
+        identity,
+        childEnv: () => ({
+          [exports2.TEST_INBOX_EMAIL_ENV]: identity.email,
+          [exports2.TEST_INBOX_PASSWORD_ENV]: identity.password
+        }),
+        handleWait,
+        close: () => reader.close()
+      };
+    }
+  }
+});
+
 // ../runner-core/dist/services/playwright-native.js
 var require_playwright_native = __commonJS({
   "../runner-core/dist/services/playwright-native.js"(exports2) {
@@ -85856,6 +86657,9 @@ var require_playwright_native = __commonJS({
     var har_stream_js_1 = require_har_stream();
     var api_auth_headers_js_1 = require_api_auth_headers();
     var run_callback_proxy_js_1 = require_run_callback_proxy();
+    var inbox_stamp_js_1 = require_inbox_stamp();
+    var test_inbox_broker_js_1 = require_test_inbox_broker();
+    var verification_inbox_js_1 = require_verification_inbox();
     var api_auth_headers_js_2 = require_api_auth_headers();
     Object.defineProperty(exports2, "parseApiAuthHeaders", { enumerable: true, get: function() {
       return api_auth_headers_js_2.parseApiAuthHeaders;
@@ -85890,17 +86694,20 @@ var require_playwright_native = __commonJS({
       let runDir = null;
       let standingNeedleMatcher = null;
       let callbackProxy;
+      let inboxBroker;
       try {
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const usesInboxHelper = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
         const resolvedExtraHeaders = (0, api_auth_headers_js_1.resolveApiAuthHeaders)({
           explicit: extraHttpHeaders,
           standingHeadersMode: effectiveStandingMode,
           apiAuthHeadersVar: testVariables?.API_AUTH_HEADERS
         });
-        standingNeedleMatcher = (0, shared_1.buildNeedleMatcher)(resolvedExtraHeaders ? Object.values(resolvedExtraHeaders) : []);
+        const needleValues = resolvedExtraHeaders ? Object.values(resolvedExtraHeaders) : [];
+        standingNeedleMatcher = (0, shared_1.buildNeedleMatcher)(needleValues);
         const cssDisableSetup = `
 const __qaLiveBrowserStateFile = process.env.VALIDATE_LIVE_BROWSER_STATE_PATH;
 let __qaLiveBrowserInterval: ReturnType<typeof setInterval> | null = null;
@@ -86139,7 +86946,7 @@ test.afterEach(async ({ page }, testInfo) => {
 module.exports = {
   testDir: ${JSON.stringify(absTestDir)},
   outputDir: ${JSON.stringify(absOutputDir)},
-  timeout: 60000,
+  timeout: ${usesInboxHelper ? 24e4 : 6e4},
   retries: 0,
   use: {
     baseURL: ${JSON.stringify(baseUrl)},
@@ -86165,6 +86972,27 @@ module.exports = {
         const isolation = await (0, chromium_isolation_js_1.createChromiumIsolation)(runDir);
         const processClaimEpoch = Number(process.env.CLAIM_EPOCH);
         const callbackClaimEpoch = Number.isSafeInteger(validateContext?.claimEpoch) ? validateContext?.claimEpoch : Number.isSafeInteger(processClaimEpoch) && processClaimEpoch >= 0 ? processClaimEpoch : void 0;
+        if (usesInboxHelper && validateContext?.runId) {
+          const inboxConfig = (0, verification_inbox_js_1.loadVerificationInboxConfig)();
+          if (!inboxConfig) {
+            logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but this runner has no verification inbox configured \u2014 the helper will fail as CONFIG_ISSUE");
+          } else {
+            try {
+              inboxBroker = await (0, test_inbox_broker_js_1.startTestInboxBroker)({
+                config: inboxConfig,
+                baseUrl,
+                projectId: options.projectId ?? null,
+                runId: validateContext.runId,
+                log: (line) => logs2.push(line)
+              });
+              standingNeedleMatcher = (0, shared_1.buildNeedleMatcher)([...needleValues, inboxBroker.identity.password]);
+            } catch (error3) {
+              logs2.push(`\u26A0 Inbox broker failed to start: ${error3 instanceof Error ? error3.message : String(error3)}`);
+            }
+          }
+        } else if (usesInboxHelper) {
+          logs2.push("\u{1F4EA} Test uses __vqaWaitForEmail but no run callback context is available \u2014 the helper will fail as CONFIG_ISSUE");
+        }
         if (validateContext?.runId && validateContext.serverUrl && validateContext.authHeader) {
           try {
             callbackProxy = await (0, run_callback_proxy_js_1.startRunCallbackProxy)({
@@ -86173,7 +87001,8 @@ module.exports = {
               upstreamAuthHeader: validateContext.authHeader,
               taskArn: process.env.VALIDATE_TASK_ARN,
               claimEpoch: callbackClaimEpoch,
-              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH
+              authConfigHash: process.env.VALIDATE_AUTH_CONFIG_HASH,
+              ...inboxBroker ? { localRoutes: { [test_inbox_broker_js_1.INBOX_WAIT_ROUTE]: inboxBroker.handleWait } } : {}
             });
           } catch (error3) {
             logs2.push(`Callback proxy unavailable: ${error3 instanceof Error ? error3.message : String(error3)}`);
@@ -86200,14 +87029,19 @@ module.exports = {
           // Preserve an explicit shared-auth kill-switch in the child. Unset defaults on in
           // both parent and generated __vqaLogin code; "false" must still cross this process
           // boundary to disable the early publish POST. It remains a per-run toggle.
-          ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {}
+          ...process.env.SHARED_AUTH_INJECT ? { SHARED_AUTH_INJECT: process.env.SHARED_AUTH_INJECT } : {},
+          // Register-and-verify tests: the run's minted registration identity. An
+          // address + a DERIVED throwaway-app password — never the IMAP secret,
+          // which stays in this parent (test-inbox-broker.ts). Useless without the
+          // loopback proxy the helper reads mail through, hence the guard.
+          ...inboxBroker && callbackProxy ? inboxBroker.childEnv() : {}
         };
         delete childTestVariables.API_AUTH_HEADERS;
         logs2.push("\u{1F680} Spawning playwright test...");
         const stopLiveBrowserPolling = liveBrowserStatePath && liveBrowserHandle ? startLiveBrowserStatePolling(liveBrowserStatePath, liveBrowserHandle, onLiveBrowserSnapshot) : null;
         let playResult;
         try {
-          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv);
+          playResult = await runPlaywright(configPath, childTestVariables, trustedRuntimeEnv, usesInboxHelper ? 3e5 : void 0);
         } finally {
           await stopLiveBrowserPolling?.();
         }
@@ -86298,6 +87132,8 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
       } finally {
         await callbackProxy?.close().catch(() => {
         });
+        await inboxBroker?.close().catch(() => {
+        });
         if (runDir) {
           await (0, promises_1.rm)(runDir, { recursive: true, force: true }).catch(() => {
           });
@@ -86349,7 +87185,7 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         stopped = true;
       };
     }
-    function runPlaywright(configPath, testVariables, trustedRuntimeEnv) {
+    function runPlaywright(configPath, testVariables, trustedRuntimeEnv, killAfterMs) {
       return new Promise((resolvePromise) => {
         const sandboxedEnv = buildNativePlaywrightChildEnv(process.env, testVariables, trustedRuntimeEnv);
         const proc = (0, spawn_with_tree_kill_js_1.spawnDetachedGroup)(process.execPath, [PW_CLI, "test", "--config", configPath], {
@@ -86367,11 +87203,13 @@ ${passed ? "\u2705" : "\u274C"} Test ${passed ? "PASSED" : "FAILED"}${error2 ? `
         proc.stderr?.on("data", (chunk) => {
           stderr += chunk.toString();
         });
-        const cancelKill = (0, spawn_with_tree_kill_js_1.scheduleTreeKill)(proc, 12e4, {
+        const killMs = killAfterMs ?? 12e4;
+        const cancelKill = (0, spawn_with_tree_kill_js_1.scheduleTreeKill)(proc, killMs, {
           graceMs: 1e4,
           onTimeout: () => {
             timedOut = true;
-            stderr += "\n[playwright killed after 120s safety timeout]";
+            stderr += `
+[playwright killed after ${Math.round(killMs / 1e3)}s safety timeout]`;
           }
         });
         const settle = (result) => {
@@ -90070,402 +90908,6 @@ var require_anchor_harvester = __commonJS({
   }
 });
 
-// ../runner-core/dist/services/discovery-lint-flags.js
-var require_discovery_lint_flags = __commonJS({
-  "../runner-core/dist/services/discovery-lint-flags.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.structuralLocatorLintMode = structuralLocatorLintMode;
-    exports2.isPwMethodPreflightEnabled = isPwMethodPreflightEnabled;
-    exports2.isVqaLoginDedupeEnabled = isVqaLoginDedupeEnabled;
-    function strictOn(value) {
-      return value === "true" || value === "1";
-    }
-    function structuralLocatorLintMode() {
-      const v = (process.env.DISCOVERY_STRUCTURAL_LOCATOR_LINT || "").trim().toLowerCase();
-      if (v === "warn")
-        return "warn";
-      if (v === "true" || v === "1" || v === "enforce")
-        return "enforce";
-      return "off";
-    }
-    function isPwMethodPreflightEnabled() {
-      return strictOn(process.env.DISCOVERY_PW_METHOD_PREFLIGHT);
-    }
-    function isVqaLoginDedupeEnabled() {
-      return strictOn(process.env.DISCOVERY_VQALOGIN_DEDUPE);
-    }
-  }
-});
-
-// ../runner-core/dist/services/auth-recipe.js
-var require_auth_recipe = __commonJS({
-  "../runner-core/dist/services/auth-recipe.js"(exports2) {
-    "use strict";
-    Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.RESERVED_RUNNER_ENV_VARS = exports2.AUTH_MARKER_VERSION = void 0;
-    exports2.computeRecipeHash = computeRecipeHash;
-    exports2.buildAuthRecipe = buildAuthRecipe;
-    exports2.authProofLocator = authProofLocator;
-    exports2.urlProofPredicateExpr = urlProofPredicateExpr;
-    exports2.renderAuthProofAssertion = renderAuthProofAssertion;
-    exports2.renderAuthFn = renderAuthFn;
-    exports2.isReservedRunnerEnvVar = isReservedRunnerEnvVar;
-    exports2.absoluteRoute = absoluteRoute;
-    exports2.renderReplayClickArrow = renderReplayClickArrow;
-    exports2.renderReplaySettleArrow = renderReplaySettleArrow;
-    exports2.renderAuthUrlWaitLine = renderAuthUrlWaitLine;
-    exports2.commandToReplayStep = commandToReplayStep;
-    exports2.buildReplayPlan = buildReplayPlan;
-    exports2.extractAuthRegion = extractAuthRegion;
-    exports2.stripAuthRegions = stripAuthRegions;
-    exports2.ensureExpectImported = ensureExpectImported;
-    exports2.ensureLoginCall = ensureLoginCall;
-    exports2.upsertAuthBlock = upsertAuthBlock;
-    exports2.buildHealAuthStamp = buildHealAuthStamp;
-    var crypto_1 = require("crypto");
-    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
-    var discovery_lint_flags_js_1 = require_discovery_lint_flags();
-    exports2.AUTH_MARKER_VERSION = "v3";
-    var START_MARKER = `// >>> VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} \u2014 generated, do not edit >>>`;
-    var END_MARKER = `// <<< VALIDATE_QA_AUTH ${exports2.AUTH_MARKER_VERSION} <<<`;
-    var SHARED_AUTH_RUNTIME_ENABLED = `!/^false$/i.test((process.env.SHARED_AUTH_INJECT ?? '').trim())`;
-    var AUTH_REGION_RE = /\/\/ >>> VALIDATE_QA_AUTH[^\n]*\r?\n[\s\S]*?\/\/ <<< VALIDATE_QA_AUTH[^\n]*\r?\n?/g;
-    function computeRecipeHash(input) {
-      const canonical = JSON.stringify({
-        preNavRoute: input.preNavRoute,
-        preNavCmds: input.preNavCmds,
-        route: input.route,
-        cmds: input.cmds,
-        redirectRoute: input.redirectRoute,
-        authProof: input.authProof
-      });
-      return (0, crypto_1.createHash)("sha256").update(canonical).digest("hex").slice(0, 12);
-    }
-    function buildAuthRecipe(login, authProof, verifiedAt) {
-      const preNavRoute = login.preNavRoute ?? "/";
-      const preNavCmds = login.preNavCmds ?? [];
-      const recipeHash = computeRecipeHash({
-        preNavRoute,
-        preNavCmds,
-        route: login.route,
-        cmds: login.cmds,
-        redirectRoute: login.redirectRoute,
-        authProof
-      });
-      return {
-        version: 1,
-        recipeHash,
-        preNavRoute,
-        preNavCmds,
-        route: login.route,
-        cmds: login.cmds,
-        redirectRoute: login.redirectRoute,
-        authProof,
-        replayPlan: login.replayPlan ?? [],
-        verifiedAt
-      };
-    }
-    function authProofLocator(proof) {
-      if (proof.kind === "url") {
-        throw new Error("authProofLocator: url proof has no element locator; callers must branch on proof.kind");
-      }
-      if (proof.kind === "testid") {
-        return `page.getByTestId(${JSON.stringify(proof.testId)})`;
-      }
-      if (proof.name) {
-        return `page.getByRole(${JSON.stringify(proof.role)}, { name: ${JSON.stringify(proof.name)} })`;
-      }
-      return `page.getByRole(${JSON.stringify(proof.role)}).first()`;
-    }
-    function stripToPathname(route2) {
-      return route2.replace(/[?#].*$/, "").replace(/\/+$/, "") || "/";
-    }
-    function urlProofPredicateExpr(route2) {
-      const p = stripToPathname(route2);
-      if (p === "/")
-        return `() => false`;
-      const r = JSON.stringify(p);
-      return `(u) => u.pathname === ${r} || u.pathname.startsWith(${r} + '/')`;
-    }
-    function renderAuthProofAssertion(proof) {
-      if (proof.kind === "url") {
-        return `await page.waitForURL(${urlProofPredicateExpr(proof.route)}, { timeout: 15000 });`;
-      }
-      return `await expect(${authProofLocator(proof)}).toBeVisible({ timeout: 15000 });`;
-    }
-    function normalizeCmd(cmd) {
-      let c = cmd.trim();
-      if (c.endsWith(";"))
-        c = c.slice(0, -1);
-      return `  ${c};`;
-    }
-    function renderAuthFn(recipe, opts) {
-      const lines = [];
-      lines.push(START_MARKER);
-      lines.push(`async function __vqaLogin(page) {`);
-      if (opts?.warmGuard) {
-        const warmLanding = recipe.redirectRoute ?? (recipe.authProof.kind === "url" ? recipe.authProof.route : recipe.preNavRoute);
-        const loginRoute = recipe.route ?? recipe.preNavRoute;
-        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED}) {`);
-        lines.push(`    await page.goto(${JSON.stringify(warmLanding)}, { waitUntil: 'domcontentloaded' }).catch(() => {});`);
-        if (recipe.authProof.kind === "url") {
-          const pred = urlProofPredicateExpr(recipe.authProof.route);
-          lines.push(`    await page.waitForURL((u) => !(${pred})(u), { timeout: 2000 }).catch(() => {});`);
-          lines.push(`    if ((${pred})(new URL(page.url())) && !(await page.locator('input[type="password"]').first().isVisible().catch(() => false))) return;`);
-        } else if (loginRoute) {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false) && new URL(page.url()).pathname !== new URL(${JSON.stringify(loginRoute)}, page.url()).pathname) return;`);
-        } else {
-          lines.push(`    if (await ${authProofLocator(recipe.authProof)}.isVisible().catch(() => false)) return;`);
-        }
-        lines.push(`  }`);
-      }
-      lines.push(`  await page.goto(${JSON.stringify(recipe.preNavRoute)}, { waitUntil: 'domcontentloaded' });`);
-      for (const cmd of recipe.preNavCmds)
-        lines.push(normalizeCmd(cmd));
-      if (recipe.preNavCmds.length === 0 && recipe.route && recipe.route !== recipe.preNavRoute) {
-        lines.push(`  await page.goto(${JSON.stringify(recipe.route)}, { waitUntil: 'domcontentloaded' });`);
-      }
-      for (const cmd of recipe.cmds)
-        lines.push(normalizeCmd(cmd));
-      lines.push(renderAuthUrlWaitLine(recipe.redirectRoute));
-      lines.push(`  ${renderAuthProofAssertion(recipe.authProof)}`);
-      if (opts?.warmGuard) {
-        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.AUTH_FILE) await page.context().storageState({ path: process.env.AUTH_FILE });`);
-        lines.push(`  if (${SHARED_AUTH_RUNTIME_ENABLED} && process.env.VALIDATE_TASK_ARN && process.env.VALIDATE_CLAIM_EPOCH && process.env.VALIDATE_SERVER_URL && process.env.VALIDATE_RUN_ID) {`);
-        lines.push(`    try {`);
-        lines.push(`      const __vqaState = await page.context().storageState();`);
-        lines.push(`      await page.request.post(process.env.VALIDATE_SERVER_URL + '/api/runner/runs/' + process.env.VALIDATE_RUN_ID + '/auth-state', { headers: { Authorization: process.env.VALIDATE_RUNNER_AUTH || '' }, data: { storageState: JSON.stringify(__vqaState), taskArn: process.env.VALIDATE_TASK_ARN, claimEpoch: Number(process.env.VALIDATE_CLAIM_EPOCH) }, timeout: 10000 });`);
-        lines.push(`    } catch {}`);
-        lines.push(`  }`);
-      }
-      lines.push(`}`);
-      lines.push(END_MARKER);
-      return lines.join("\n");
-    }
-    exports2.RESERVED_RUNNER_ENV_VARS = /* @__PURE__ */ new Set([
-      "AUTH_FILE",
-      "SHARED_AUTH_INJECT",
-      "VALIDATE_RUN_ID",
-      "VALIDATE_CLAIM_EPOCH",
-      "VALIDATE_AUTH_CONFIG_HASH",
-      "VALIDATE_TASK_ARN",
-      "VALIDATE_RUNNER_AUTH",
-      "VALIDATE_SERVER_URL"
-    ]);
-    function isReservedRunnerEnvVar(key) {
-      return exports2.RESERVED_RUNNER_ENV_VARS.has(key);
-    }
-    function absoluteRoute(route2, baseUrl) {
-      try {
-        return new URL(route2, baseUrl).href;
-      } catch {
-        return route2;
-      }
-    }
-    function renderReplayClickArrow(step) {
-      const loc = step.locator.trim();
-      if (step.kind === "wait") {
-        return `async (page) => {
-  await ${loc}.waitFor({ state: 'visible', timeout: 15000 });
-}`;
-      }
-      if (step.kind === "press") {
-        return `async (page) => {
-  await ${loc}.press(${JSON.stringify(step.key ?? "Enter")});
-}`;
-      }
-      return `async (page) => {
-  await ${loc}.click();
-}`;
-    }
-    function renderReplaySettleArrow(proof) {
-      if (proof.kind === "url") {
-        return `async (page) => {
-  await page.waitForURL(${urlProofPredicateExpr(proof.route)}, { timeout: 15000 });
-}`;
-      }
-      return `async (page) => {
-  await ${authProofLocator(proof)}.waitFor({ state: 'visible', timeout: 15000 });
-}`;
-    }
-    function renderAuthUrlWaitLine(redirectRoute) {
-      const opts = `{ waitUntil: 'domcontentloaded', timeout: 8000 }`;
-      const tail = `.catch(() => { /* URL drift \u2014 the auth-proof assertion below is the gate */ });`;
-      const rr = redirectRoute ? stripToPathname(redirectRoute) : null;
-      if (rr && rr !== "/") {
-        const r = JSON.stringify(rr);
-        return `  await page.waitForURL((u) => u.pathname === ${r} || u.pathname.startsWith(${r} + '/'), ${opts})${tail}`;
-      }
-      if (rr === "/") {
-        return `  await page.waitForURL((u) => !/\\/(login|sign-?in)/i.test(u.pathname), ${opts})${tail}`;
-      }
-      return `  await page.waitForURL((u) => u.pathname !== '/' && !/\\/(login|sign-?in)/i.test(u.pathname), ${opts})${tail}`;
-    }
-    function locatorChainOf(cmd) {
-      const m = cmd.match(/\bpage\.[\s\S]*?(?=\.(?:fill|click|check|press|selectOption|setChecked|waitFor)\s*\()/);
-      return m ? m[0].trim() : null;
-    }
-    function parseRoleName(locator) {
-      const role = locator.match(/getByRole\(\s*['"`]([^'"`]+)['"`]/)?.[1];
-      const name = locator.match(/getByRole\([^)]*name:\s*['"`]([^'"`]+)['"`]/)?.[1] ?? locator.match(/getByLabel\(\s*['"`]([^'"`]+)['"`]/)?.[1] ?? locator.match(/getByPlaceholder\(\s*['"`]([^'"`]+)['"`]/)?.[1];
-      return { role, name };
-    }
-    function credentialKeyOf(cmd) {
-      return cmd.match(/\.fill\(\s*process\.env\.([A-Za-z_$][\w$]*)!?\s*\)/)?.[1] ?? null;
-    }
-    function commandToReplayStep(cmd) {
-      const chain = locatorChainOf(cmd);
-      if (!chain)
-        return null;
-      const credKey = credentialKeyOf(cmd);
-      if (cmd.includes(".fill(")) {
-        if (!credKey)
-          return null;
-        const { role, name } = parseRoleName(chain);
-        return { kind: "fill", credentialKey: credKey, locator: chain, role, name, element: name ?? role ?? "credential field" };
-      }
-      if (/\.waitFor\s*\(/.test(cmd))
-        return { kind: "wait", locator: chain };
-      const pressKey = cmd.match(/\.press\(\s*['"`]([^'"`]+)['"`]\s*\)/)?.[1];
-      if (pressKey)
-        return { kind: "press", locator: chain, key: pressKey };
-      if (/\.(?:click|check|setChecked|selectOption)\s*\(/.test(cmd))
-        return { kind: "click", locator: chain };
-      return null;
-    }
-    function buildReplayPlan(login) {
-      const plan = [];
-      const preNavRoute = login.preNavRoute ?? "/";
-      plan.push({ kind: "nav", route: preNavRoute });
-      for (const c of login.preNavCmds ?? []) {
-        const step = commandToReplayStep(c);
-        if (step)
-          plan.push(step);
-      }
-      if ((login.preNavCmds ?? []).length === 0 && login.route && login.route !== preNavRoute) {
-        plan.push({ kind: "nav", route: login.route });
-      }
-      for (const c of login.cmds) {
-        const step = commandToReplayStep(c);
-        if (step)
-          plan.push(step);
-      }
-      return plan;
-    }
-    function extractAuthRegion(code) {
-      const m = code.match(new RegExp(AUTH_REGION_RE.source));
-      return m ? m[0] : null;
-    }
-    function countAuthRegions(code) {
-      const m = code.match(AUTH_REGION_RE);
-      return m ? m.length : 0;
-    }
-    function stripAuthRegions(code) {
-      return code.replace(AUTH_REGION_RE, "");
-    }
-    var PW_IMPORT_RE = /import\s*\{([^}]*)\}\s*from\s*['"]@playwright\/test['"]\s*;?/;
-    function ensureExpectImported(code) {
-      const m = code.match(PW_IMPORT_RE);
-      if (!m)
-        return code;
-      const names = m[1].split(",").map((s) => s.trim()).filter(Boolean);
-      if (names.includes("expect"))
-        return code;
-      const next = [...names, "expect"];
-      return code.replace(PW_IMPORT_RE, `import { ${next.join(", ")} } from '@playwright/test';`);
-    }
-    function insertAfterPwImport(code, block) {
-      const m = code.match(PW_IMPORT_RE);
-      if (!m || m.index === void 0) {
-        return `${block}
-
-${code.replace(/^\r?\n+/, "")}`;
-      }
-      const end = m.index + m[0].length;
-      const head = code.slice(0, end);
-      const tail = code.slice(end).replace(/^\r?\n+/, "");
-      return `${head}
-
-${block}
-
-${tail}`;
-    }
-    var TEST_OPENER_RE = /test(?:\.(?:only|skip|fixme))?\s*\(\s*(['"`])(?:[^\\]|\\.)*?\1\s*,\s*(?:\{[\s\S]*?\}\s*,\s*)?async\s*\(\s*\{[^}]*\}[^)]*\)\s*=>\s*\{/;
-    var LOGIN_CALL_RE = /await\s+__vqaLogin\s*\(\s*page\s*\)/;
-    function ensureLoginCall(code) {
-      if (code.match(new RegExp(TEST_OPENER_RE.source, "g")) === null)
-        return code;
-      let result = code;
-      if ((0, discovery_lint_flags_js_1.isVqaLoginDedupeEnabled)()) {
-        result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
-      }
-      const matches = [...result.matchAll(new RegExp(TEST_OPENER_RE.source, "g"))];
-      for (let i = matches.length - 1; i >= 0; i--) {
-        const m = matches[i];
-        if (m.index === void 0)
-          continue;
-        const insertAt = m.index + m[0].length;
-        const following = result.slice(insertAt, insertAt + 60);
-        if (/^\s*await\s+__vqaLogin\s*\(\s*page\s*\)/.test(following))
-          continue;
-        result = `${result.slice(0, insertAt)}
-  await __vqaLogin(page);${result.slice(insertAt)}`;
-      }
-      return result;
-    }
-    function upsertAuthBlock(code, ctx) {
-      if (ctx.mode === "generate") {
-        if (!ctx.recipe || !ctx.isAuthNeeded)
-          return code;
-        let result = stripAuthRegions(code);
-        result = result.replace(/^[ \t]*await[ \t]+__vqaLogin[ \t]*\([ \t]*page[ \t]*\)[ \t]*;?[ \t]*\r?\n/gm, "");
-        result = ensureExpectImported(result);
-        const warmGuard = (0, shared_1.isSharedAuthInjectEnabled)();
-        result = insertAfterPwImport(result, renderAuthFn(ctx.recipe, { warmGuard }));
-        result = ensureLoginCall(result);
-        const n = countAuthRegions(result);
-        if (n !== 1) {
-          throw new Error(`upsertAuthBlock(generate): expected exactly 1 auth region after stamp, got ${n}`);
-        }
-        if (!LOGIN_CALL_RE.test(result)) {
-          throw new Error("upsertAuthBlock(generate): stamped __vqaLogin but found no test() opener to inject the call");
-        }
-        return result;
-      }
-      try {
-        if (!ctx.preservedAuthRegion)
-          return code;
-        let result = ensureExpectImported(code);
-        if (countAuthRegions(result) >= 1) {
-          result = result.replace(AUTH_REGION_RE, "");
-          result = insertAfterPwImport(result, ctx.preservedAuthRegion);
-        } else {
-          result = insertAfterPwImport(result, ctx.preservedAuthRegion);
-        }
-        result = ensureLoginCall(result);
-        if (countAuthRegions(result) !== 1) {
-          throw new Error("heal re-stamp produced non-unique auth region");
-        }
-        return result;
-      } catch (err) {
-        const reason = err instanceof Error ? err.message : String(err);
-        ctx.onSignal?.({ type: "auth-stamp-degraded", reason });
-        return code;
-      }
-    }
-    function buildHealAuthStamp(originalCode, failureError, logs2) {
-      const region = extractAuthRegion(originalCode);
-      const loginFailed = !!failureError && /__vqaLogin/.test(failureError);
-      return {
-        mode: "heal",
-        preservedAuthRegion: region && !loginFailed ? region : null,
-        onSignal: logs2 ? (s) => logs2.push(`\u26A0 auth-stamp ${s.type}: ${s.reason}`) : void 0
-      };
-    }
-  }
-});
-
 // ../runner-core/dist/services/auth-replay.js
 var require_auth_replay = __commonJS({
   "../runner-core/dist/services/auth-replay.js"(exports2) {
@@ -94342,9 +94784,41 @@ var require_discover_generator = __commonJS({
     var reveal_diff_js_1 = require_reveal_diff();
     var anchor_harvester_js_1 = require_anchor_harvester();
     var auth_recipe_js_1 = require_auth_recipe();
+    var inbox_stamp_js_1 = require_inbox_stamp();
     var auth_replay_js_1 = require_auth_replay();
     var agentic_discovery_prompts_js_1 = require_agentic_discovery_prompts();
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
+    var inbox_tools_js_1 = require_inbox_tools();
+    var verification_inbox_js_1 = require_verification_inbox();
+    var test_inbox_broker_js_1 = require_test_inbox_broker();
+    var REGISTER_SCENARIO_RE = /\b(register|registration|sign[\s-]?up|create[\s-]?(a[n]?[\s-]?)?(new[\s-]?)?account|verify[\s-]?(your[\s-]?)?email|email[\s-]?verification|confirm[\s-]?(your[\s-]?)?(email|account)|activate[\s-]?(your[\s-]?)?account|new[\s-]?account)\b/i;
+    function scenarioLooksLikeRegistration(scenario) {
+      const hay = `${scenario.name ?? ""} ${scenario.description ?? ""} ${scenario.entryRoute ?? ""} ${(scenario.targetPages ?? []).join(" ")}`;
+      return REGISTER_SCENARIO_RE.test(hay);
+    }
+    function buildEmailVerifyGenBlock(genEmail, genPassword) {
+      return `
+
+## EMAIL VERIFICATION TEST \u2014 register a fresh account and verify it (LIVE, then EMIT)
+This is a signup / email-verification scenario and this runner CAN receive verification email. Prove the full flow live, then emit a test that re-does it on every run.
+
+LIVE (to prove the flow while generating):
+- Register on the app's signup form using this throwaway account:
+  - email: \`${genEmail}\`
+  - password: \`${genPassword}\`
+  Type them with browser_type and submit the form ONCE.
+- If the app then asks for an emailed code or a "verify your email" link, call \`wait_for_verification\` (poll it again if the first call returns found:false \u2014 mail can take 30\u201390s). If it returns a \`code\`, type it into the verification field. If it returns a \`link\`, use \`open_verification_link\`.
+- Reach the verified / signed-in state and confirm it with a browser_verify_* call, so your final assertion is proven.
+
+EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway values above:
+- Use \`process.env.${test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV}!\` for the email and \`process.env.${test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV}!\` for the password. The runner mints a FRESH real account for each execution and injects these \u2014 a hardcoded email would collide with "already registered" on re-runs.
+- Read the verification email at runtime with the injected helper (it is provided for you \u2014 do NOT define it, do NOT import it):
+  - code flow:  \`const code = await __vqaWaitForEmail('code');\`  then type \`code\` into the verification field.
+  - link flow:  \`const link = await __vqaWaitForEmail('link');\`  then \`await page.goto(link);\`.
+  - if unsure: \`const email = await __vqaWaitForEmail();\` returns \`{ code, link, subject, from }\`.
+- Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
+- End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
+    }
     exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -95531,6 +96005,11 @@ ${testOpen}`;
       if (options?.authStamp) {
         result = (0, auth_recipe_js_1.upsertAuthBlock)(result, options.authStamp);
       }
+      try {
+        result = (0, inbox_stamp_js_1.upsertInboxBlock)(result);
+      } catch {
+        result = (0, inbox_stamp_js_1.stripInboxRegions)(result);
+      }
       return result;
     }
     function ensureDiscoveredTag(tags) {
@@ -95617,6 +96096,16 @@ ${testOpen}`;
           logs2?.push(`  \u2717 Rejected "${t.name}": JS parse error \u2014 ${msg}`);
           return false;
         }
+        {
+          const modelBody = (0, inbox_stamp_js_1.stripInboxRegions)(code);
+          if (inbox_stamp_js_1.INBOX_HELPER_TOKEN_RE.test(modelBody)) {
+            const openerCount = (stripStringsAndComments(modelBody).match(/\btest(?:\.(?:only|skip|fixme))?\s*\(/g) ?? []).length;
+            if (openerCount > 1) {
+              logs2?.push(`  \u2717 Rejected "${t.name}": ${openerCount} test() blocks in a register-and-verify spec \u2014 the per-run registration email supports exactly one registration; emit ONE test() per spec`);
+              return false;
+            }
+          }
+        }
         const codeForArgOrderScan = stripStringsAndComments(code);
         if (/test\s*\(\s*,\s*(?:async\s*)?(?:\([^)]*\)|function\s*\([^)]*\))\s*(?:=>)?\s*\{[\s\S]*?\}\s*,\s*\{\s*(?:tags?|annotations)\s*:/.test(codeForArgOrderScan)) {
           logs2?.push(`  \u2717 Rejected "${t.name}": test() arg order is wrong \u2014 Playwright signature is test(name, options, fn), AI emitted test(name, fn, options)`);
@@ -96437,6 +96926,23 @@ ${testOpen}`;
       return { offendingLines: offending };
     }
     var ACTION_METHODS = ["click", "dblclick", "tap", "fill", "type", "pressSequentially", "press", "selectOption", "hover", "check", "uncheck", "setInputFiles", "dragTo", "focus", "goto", "waitForURL"];
+    var DYNAMIC_VERIFICATION_ARG = "<verification-dynamic>";
+    function collectVerificationHelperVars(code) {
+      const vars = /* @__PURE__ */ new Set();
+      const assignRe = /(?:(?:const|let|var)\s+)?([A-Za-z_$][\w$]*)\s*=\s*await\s+__vqaWaitForEmail\s*\(/g;
+      let m;
+      while ((m = assignRe.exec(code)) !== null)
+        vars.add(m[1]);
+      const destructRe = /(?:const|let|var)\s*\{([^}]*)\}\s*=\s*await\s+__vqaWaitForEmail\s*\(/g;
+      while ((m = destructRe.exec(code)) !== null) {
+        for (const part of m[1].split(",")) {
+          const name = part.split(":").pop()?.trim().replace(/\s.*$/, "");
+          if (name && /^[A-Za-z_$][\w$]*$/.test(name))
+            vars.add(name);
+        }
+      }
+      return vars;
+    }
     function extractStringArg(text) {
       const m = text.match(/^\s*(['"`])((?:\\.|(?!\1).)*)\1/);
       if (!m)
@@ -96706,6 +97212,8 @@ ${testOpen}`;
       if (!locatorsMatch(ledger.locator, submitted.locator))
         return false;
       if (ledger.method === "fill" || ledger.method === "type") {
+        if (submitted.arg === DYNAMIC_VERIFICATION_ARG)
+          return true;
         if (ledger.arg === "<env>" || ledger.arg === "<test-value>") {
           return submitted.arg === "<env>" || submitted.arg === "<test-value>";
         }
@@ -96800,6 +97308,25 @@ ${testOpen}`;
         }
       }
       const submittedSigs = extractActionSignatures(playwrightCode, credentials);
+      const helperVars = collectVerificationHelperVars(playwrightCode);
+      if (helperVars.size > 0) {
+        const usesHelperVar = (text) => {
+          for (const v of helperVars) {
+            if (new RegExp(`\\b${v.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`).test(text))
+              return true;
+          }
+          return false;
+        };
+        for (const sub of submittedSigs) {
+          if ((sub.method === "fill" || sub.method === "type") && sub.arg && usesHelperVar(sub.arg)) {
+            sub.arg = DYNAMIC_VERIFICATION_ARG;
+          } else if (sub.method === "goto") {
+            const gotoArg = sub.raw.match(/\.goto\s*\(\s*([^),]+)/);
+            if (gotoArg && usesHelperVar(gotoArg[1]))
+              sub.arg = DYNAMIC_VERIFICATION_ARG;
+          }
+        }
+      }
       const offending = [];
       let firstGotoConsumed = false;
       let cursor = 0;
@@ -96807,6 +97334,8 @@ ${testOpen}`;
       for (const sub of submittedSigs) {
         if (sub.method === "waitForURL")
           continue;
+        if (sub.method === "goto" && sub.arg === DYNAMIC_VERIFICATION_ARG)
+          continue;
         if (sub.method === "goto" && !firstGotoConsumed) {
           firstGotoConsumed = true;
           if (expectedEntry !== null && sub.arg !== expectedEntry) {
@@ -97132,7 +97661,7 @@ expect(secondTitle).toBeTruthy();
 ${tailBlock}`;
     }
     function evaluateAmbiguityGate(finalCode, alreadyAttempted, hasRevisionBudget) {
-      const findings = (0, agentic_discovery_prompts_js_1.scanAmbiguousLocators)((0, auth_recipe_js_1.stripAuthRegions)(finalCode));
+      const findings = (0, agentic_discovery_prompts_js_1.scanAmbiguousLocators)((0, auth_recipe_js_1.stripAuthRegions)((0, inbox_stamp_js_1.stripInboxRegions)(finalCode)));
       return { fire: findings.length > 0 && !alreadyAttempted && hasRevisionBudget, findings };
     }
     async function generateTestFromScenario(mcpClient, scenario, siteMap, baseUrl, credentials, aiClient, agentModel, logs2, onAICall, opts) {
@@ -97156,6 +97685,7 @@ ${tailBlock}`;
           }
         }
       }
+      let genInboxReader = null;
       try {
         const startTime = Date.now();
         const groupId = `scenario-gen-${(0, crypto_1.randomUUID)().slice(0, 8)}`;
@@ -97206,12 +97736,28 @@ ${tailBlock}`;
         });
         const baseSkeletonHadRegression = tags.includes("@regression");
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
-        const systemPrompt = buildScenarioSystemPrompt(scenario, baseUrl, credentials, tags, siteMap.pages, { appBrief: opts?.appBrief, availableVariableKeys: opts?.availableVariableKeys, hasVerifiedRecipe, knowledgeContext: opts?.knowledgeContext });
+        const projectHasRegisterIntent = credentials?.DISCOVERY_SHOULD_REGISTER === "true";
+        const inboxGenConfig = (0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() && projectHasRegisterIntent && !hasVerifiedRecipe && scenarioLooksLikeRegistration(scenario) ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
+        let genInboxState = null;
+        let genInboxCredentials = credentials;
+        let genInboxSecret = null;
+        if (inboxGenConfig) {
+          const genTag = `vqag${(0, crypto_1.createHash)("sha256").update(`testgen|${(0, verification_inbox_js_1.seedToHostKey)(baseUrl)}|${groupId}`).digest("hex").slice(0, 10)}`;
+          const genEmail = (0, verification_inbox_js_1.applyPlusTag)(inboxGenConfig.address, genTag);
+          const genPassword = (0, verification_inbox_js_1.deriveRegistrationPassword)(genEmail);
+          genInboxReader = new verification_inbox_js_1.VerificationInboxReader(inboxGenConfig);
+          genInboxState = (0, inbox_tools_js_1.createInboxRunState)(inboxGenConfig, { tag: genTag, passwordKey: test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV });
+          genInboxCredentials = { ...credentials, [test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV]: genEmail, [test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV]: genPassword };
+          genInboxSecret = genPassword;
+          openaiTools.push(...inbox_tools_js_1.INBOX_TOOLS);
+          logs2.push(`  \u{1F4EC} Email-verification generation ON for "${scenario.name}" \u2014 registering throwaway ${genEmail}`);
+        }
+        const systemPrompt = buildScenarioSystemPrompt(scenario, baseUrl, credentials, tags, siteMap.pages, { appBrief: opts?.appBrief, availableVariableKeys: opts?.availableVariableKeys, hasVerifiedRecipe, knowledgeContext: opts?.knowledgeContext }) + (genInboxState ? buildEmailVerifyGenBlock(genInboxCredentials[test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV], genInboxCredentials[test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV]) : "");
         const messages = [
           { role: "system", content: systemPrompt },
           {
             role: "user",
-            content: hasVerifiedRecipe ? `Start generating the test for scenario: "${scenario.name}". You are ALREADY logged in \u2014 \`await __vqaLogin(page);\` is injected as the first line of your test body, so do NOT author any login steps. Begin from the authenticated app and reach ${baseUrl}${findFirstNonAuthRoute(scenario.targetPages) || scenario.targetPages[0] || "/"} via visible navigation or a direct goto. Execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.` : tags.includes("@needs-auth") ? `Start generating the test for scenario: "${scenario.name}". Begin at ${baseUrl}${scenario.entryRoute}. Complete the AUTH SETUP from the app's own visible flow (do NOT deep-link directly to auth unless the start route exposes no usable entry), then continue to ${baseUrl}${findFirstNonAuthRoute(scenario.targetPages) || scenario.targetPages[0] || "/"}. Execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.` : `Start generating the test for scenario: "${scenario.name}". Begin by navigating to ${baseUrl}${scenario.entryRoute} using browser_navigate. From there, use the app's own navigation to reach the scenario flow. Do NOT deep-link directly to ${baseUrl}${scenario.targetPages[0] || "/"} unless the start route immediately redirects there or no visible navigation path exists. Then execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.`
+            content: genInboxState ? `Start generating the register-and-verify test for scenario: "${scenario.name}". Begin at ${baseUrl}${scenario.entryRoute}. Follow the "EMAIL VERIFICATION TEST" section: register the throwaway account LIVE, complete email verification via wait_for_verification, reach the signed-in state and verify it \u2014 then emit a test that uses process.env.${test_inbox_broker_js_1.TEST_INBOX_EMAIL_ENV}!/process.env.${test_inbox_broker_js_1.TEST_INBOX_PASSWORD_ENV}! and __vqaWaitForEmail(...) as instructed.` : hasVerifiedRecipe ? `Start generating the test for scenario: "${scenario.name}". You are ALREADY logged in \u2014 \`await __vqaLogin(page);\` is injected as the first line of your test body, so do NOT author any login steps. Begin from the authenticated app and reach ${baseUrl}${findFirstNonAuthRoute(scenario.targetPages) || scenario.targetPages[0] || "/"} via visible navigation or a direct goto. Execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.` : tags.includes("@needs-auth") ? `Start generating the test for scenario: "${scenario.name}". Begin at ${baseUrl}${scenario.entryRoute}. Complete the AUTH SETUP from the app's own visible flow (do NOT deep-link directly to auth unless the start route exposes no usable entry), then continue to ${baseUrl}${findFirstNonAuthRoute(scenario.targetPages) || scenario.targetPages[0] || "/"}. Execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.` : `Start generating the test for scenario: "${scenario.name}". Begin by navigating to ${baseUrl}${scenario.entryRoute} using browser_navigate. From there, use the app's own navigation to reach the scenario flow. Do NOT deep-link directly to ${baseUrl}${scenario.targetPages[0] || "/"} unless the start route immediately redirects there or no visible navigation path exists. Then execute each step from the scenario plan, verifying with browser_verify_* tools at transition points.`
           }
         ];
         let iteration = 0;
@@ -97339,6 +97885,15 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
           const iterStart = Date.now();
           const requestMessageCount = messages.length;
           const requestMessages = messages.slice();
+          const scrubAudit = (payload) => {
+            if (!genInboxSecret)
+              return payload;
+            try {
+              return JSON.parse(JSON.stringify(payload).split(genInboxSecret).join("[REDACTED:VQA_TEST_ACCOUNT_PASSWORD]"));
+            } catch {
+              return payload;
+            }
+          };
           let response;
           try {
             response = await (0, ai_retry_js_1.resilientAICall)((signal, arm) => (0, ai_queue_js_1.queuedAICall)(() => {
@@ -97380,7 +97935,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
           messages.push(assistantMessage);
           if (!assistantMessage.tool_calls || assistantMessage.tool_calls.length === 0) {
             try {
-              onAICall?.({
+              onAICall?.(scrubAudit({
                 iteration,
                 groupId,
                 callType: "scenarioGenerate",
@@ -97394,7 +97949,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                 requestMessageCount,
                 requestMessages,
                 ledger: actionLedger.slice()
-              });
+              }));
             } catch {
             }
             logs2.push(`    No tool calls \u2014 agent stopped`);
@@ -97421,7 +97976,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
               const suspectedBugDeclared = toolArgs.suspectedBug === true;
               const bugDescription = String(toolArgs.bugDescription || "").slice(0, 500).replace(/[\u0000-\u001F\u007F]+/g, " ").replace(/\s+/g, " ").trim();
               const testObj = { name, description, playwrightCode: code, tags };
-              const validated = validateTests([testObj], logs2, { sensitiveEnvMap: credentials, authRecipe: opts?.recipe ?? null, basePath: gotoBasePathFromBaseUrl(baseUrl) });
+              const validated = validateTests([testObj], logs2, { sensitiveEnvMap: genInboxCredentials, authRecipe: opts?.recipe ?? null, basePath: gotoBasePathFromBaseUrl(baseUrl) });
               if (validated.length > 0) {
                 if (actionLedger.length > lastRenderedLedgerEntryCount && actionLedger.length > 0) {
                   const renderedLedger = renderSessionRecording(actionLedger, credentials);
@@ -97473,7 +98028,7 @@ Do NOT add steps you did not execute. Do NOT skip steps from the recording.${led
                   });
                   continue;
                 }
-                const actionCheck = validateFinalActionFidelity(code, actionLedger, credentials, { entryRoute: scenario.entryRoute });
+                const actionCheck = validateFinalActionFidelity(code, actionLedger, genInboxCredentials, { entryRoute: scenario.entryRoute });
                 if (actionCheck.offendingActions.length > 0 && !actionRevisionAttempted) {
                   actionRevisionAttempted = true;
                   const renderedLedger = actionLedger.length > 0 ? renderSessionRecording(actionLedger, credentials) : "";
@@ -97786,6 +98341,15 @@ Do NOT assert that the button/tab/heading you interacted with is merely visible
               });
               continue;
             }
+            if (genInboxReader && genInboxState && inbox_tools_js_1.INBOX_TOOL_NAMES.has(toolName)) {
+              const inboxResult = await (0, inbox_tools_js_1.dispatchInboxTool)(toolName, toolArgs, {
+                reader: genInboxReader,
+                state: genInboxState,
+                mcpClient
+              });
+              toolResults.push({ role: "tool", tool_call_id: toolCall.id, content: inboxResult.content });
+              continue;
+            }
             let toolResultContent = "";
             try {
               const mcpResult = await mcpClient.callTool({ name: toolName, arguments: toolArgs });
@@ -97948,7 +98512,7 @@ WARNING: index-based locator (.nth/.first) \u2014 order-dependent and fragile on
               tool: assistantMessage.tool_calls?.find((tc) => tc.id === tr.tool_call_id)?.function.name ?? "unknown",
               result: typeof tr.content === "string" ? tr.content.slice(0, 5e4) : String(tr.content).slice(0, 5e4)
             }));
-            onAICall?.({
+            onAICall?.(scrubAudit({
               iteration,
               groupId,
               callType: "scenarioGenerate",
@@ -97964,7 +98528,7 @@ WARNING: index-based locator (.nth/.first) \u2014 order-dependent and fragile on
               requestMessageCount,
               requestMessages,
               ledger: actionLedger.slice()
-            });
+            }));
           } catch {
           }
           messages.push(...toolResults);
@@ -97972,8 +98536,12 @@ WARNING: index-based locator (.nth/.first) \u2014 order-dependent and fragile on
         if (!result) {
           logs2.push(`    Scenario generation did not produce a test after ${iteration} iterations`);
         }
+        await genInboxReader?.close().catch(() => {
+        });
         return result;
       } catch (err) {
+        await genInboxReader?.close().catch(() => {
+        });
         const msg = err instanceof Error ? err.message : String(err);
         logs2.push(`  Scenario generation failed: ${msg}`);
         if ((0, ai_retry_js_1.isAIProviderError)(err)) {
@@ -324908,7 +325476,7 @@ ${currentSummary}`;
               const distinctPathsVisited = new Set([...state2.visitedRoutes].map((r) => (0, exploration_parser_js_1.normalizeRouteForFocusScope)(r))).size;
               const fb = (0, survey_link_frontier_js_1.evaluateFinishBounce)(finishBounce, distinctPathsVisited);
               finishBounce = fb.state;
-              const forceAcceptFinish = fb.escape;
+              const forceAcceptFinish = fb.escape && !finishStreakCountedThisBatch;
               if (forceAcceptFinish) {
                 const stuck = adaptiveActive ? adaptiveDebtRoutes() : (0, survey_link_frontier_js_1.getFinishBlockingFrontier)(state2).map((i) => i.route);
                 const reasonText = String(toolArgs.summary || "").replace(/\s+/g, " ").trim().slice(0, 400);
@@ -325030,7 +325598,7 @@ Exploration complete: ${summary}`);
               continue;
             }
             if (toolName === "fill_credential" || toolName === "fill_credential_form") {
-              if (emailVerificationUnavailable) {
+              if (emailVerificationUnavailable || inboxState?.authDead) {
                 const codeGuard = (0, inbox_tools_js_1.guardVerificationCodeFabrication)(toolName, toolArgs);
                 if (codeGuard.blocked) {
                   logs2.push(`   BLOCKED ${toolName}: verification-code field in email-verification-unavailable mode (field="${codeGuard.matchedField}")`);
@@ -325124,7 +325692,7 @@ Exploration complete: ${summary}`);
                 continue;
               }
             }
-            if (emailVerificationUnavailable) {
+            if (emailVerificationUnavailable || inboxState?.authDead) {
               const codeGuard = (0, inbox_tools_js_1.guardVerificationCodeFabrication)(toolName, toolArgs);
               if (codeGuard.blocked) {
                 logs2.push(`   BLOCKED ${toolName}: verification-code field in email-verification-unavailable mode (field="${codeGuard.matchedField}")`);
@@ -326539,7 +327107,10 @@ var require_auth_capture_run = __commonJS({
     exports2.getAuthCaptureTimeoutMs = getAuthCaptureTimeoutMs;
     exports2.getAuthCaptureRunRetryMaxAttempts = getAuthCaptureRunRetryMaxAttempts;
     exports2.classifyCaptureMiss = classifyCaptureMiss;
+    exports2.harvestCollapsedAuthProof = harvestCollapsedAuthProof;
+    exports2.selectAuthLandingRoute = selectAuthLandingRoute;
     exports2.harvestAuthProofLive = harvestAuthProofLive;
+    exports2.detectRedirectBackCollapse = detectRedirectBackCollapse;
     exports2.findCredentialLiteralLeaks = findCredentialLiteralLeaks;
     exports2.runLoginCaptureRunWithOutcome = runLoginCaptureRunWithOutcome;
     exports2.runLoginCaptureRun = runLoginCaptureRun;
@@ -326660,35 +327231,26 @@ ${keyLines || "- (none provided)"}
         return false;
       return true;
     }
-    function harvestAuthProofLive(siteMap, redirectRoute, loginRoute, credentials, logs2) {
-      const LOGOUT_RE = /\b(log\s?out|sign\s?out)\b/i;
-      const ACCOUNT_RE = /\b(account|profile|settings|avatar|notifications?|dashboard|inbox|my\s+account|user\s+menu)\b/i;
-      const GREETING_RE = /\b(welcome|hello|hey|good\s+(morning|afternoon|evening|day))\b/i;
-      const AUTH_ROUTE_RE = /\/(log[\s_-]?in|sign[\s_-]?in|sign[\s_-]?up|register|auth|forgot|reset)\b/i;
-      const isLoginPage = (route2) => loginRoute != null && route2 === loginRoute || AUTH_ROUTE_RE.test(route2 ?? "");
-      const authedPages = siteMap.pages.filter((p) => (p.requiresAuth || redirectRoute !== null && p.route === redirectRoute) && !isLoginPage(p.route));
-      const landing = (redirectRoute !== null ? authedPages.find((p) => p.route === redirectRoute) : void 0) ?? authedPages[0] ?? null;
-      if (!landing) {
-        logs2("  \u26A0 auth-proof: no authenticated landing page captured \u2014 cannot derive a durable proof");
-        return null;
-      }
-      const loginRoleNames = /* @__PURE__ */ new Set();
-      const loginTestIds = /* @__PURE__ */ new Set();
-      for (const p of siteMap.pages) {
-        if (!isLoginPage(p.route) || p.route === landing.route)
-          continue;
-        for (const el of p.elements ?? []) {
-          const nm = (el.label ?? "").trim().toLowerCase();
-          if (el.role && nm)
-            loginRoleNames.add(`${el.role}|${nm}`);
-          if (el.testId)
-            loginTestIds.add(el.testId);
-        }
-      }
+    var LOGOUT_RE = /\b(log\s?out|sign\s?out)\b/i;
+    var ACCOUNT_RE = /\b(account|profile|settings|avatar|notifications?|dashboard|inbox|my\s+account|user\s+menu)\b/i;
+    var GREETING_RE = /\b(welcome|hello|hey|good\s+(morning|afternoon|evening|day))\b/i;
+    function describeAuthProof(proof) {
+      switch (proof.kind) {
+        case "role":
+          return `role:${proof.role}${proof.name ? `(${proof.name})` : ""}`;
+        case "testid":
+          return `testid:${proof.testId}`;
+        case "endpoint":
+          return `endpoint:${proof.url}`;
+        case "url":
+          return `url:${proof.route}`;
+      }
+    }
+    function rankDurableAuthProof(landingElements, loginRoleNames, loginTestIds, credentials, logs2) {
       const haveLoginDiff = loginRoleNames.size > 0 || loginTestIds.size > 0;
       const roleNameFreq = /* @__PURE__ */ new Map();
       const testIdFreq = /* @__PURE__ */ new Map();
-      for (const el of landing.elements ?? []) {
+      for (const el of landingElements) {
         const nm = (el.label ?? "").trim().toLowerCase();
         if (el.role && nm)
           roleNameFreq.set(`${el.role}|${nm}`, (roleNameFreq.get(`${el.role}|${nm}`) ?? 0) + 1);
@@ -326728,7 +327290,7 @@ ${keyLines || "- (none provided)"}
         return true;
       };
       const ranked = [];
-      for (const el of landing.elements ?? []) {
+      for (const el of landingElements) {
         const label = (el.label ?? "").trim();
         const role = el.role ?? "";
         const testId = el.testId ?? "";
@@ -326740,7 +327302,7 @@ ${keyLines || "- (none provided)"}
           const r = role === "link" ? "link" : "button";
           ranked.push({ tier: 1, proof: { kind: "role", role: r, name: label }, desc: `${r} "${label}" (logout control)` });
         }
-        if (label && ACCOUNT_RE.test(label) && !personalized && uniqueRoleName && (role === "button" || role === "link") && absentOnLogin(roleNameKey, "")) {
+        if (label && ACCOUNT_RE.test(label) && !personalized && uniqueRoleName && haveLoginDiff && (role === "button" || role === "link") && absentOnLogin(roleNameKey, "")) {
           ranked.push({ tier: 2, proof: { kind: "role", role, name: label }, desc: `${role} "${label}" (account control)` });
         }
         if (testId && isSemanticTestId(testId) && uniqueTestId && haveLoginDiff && absentOnLogin("", testId)) {
@@ -326754,25 +327316,110 @@ ${keyLines || "- (none provided)"}
         }
       }
       if (ranked.length === 0) {
-        const loginPathname = loginRoute ? loginRoute.replace(/[?#].*$/, "").replace(/\/+$/, "") : null;
-        const toProofPathname = (r) => {
-          if (!r)
-            return null;
-          const p = r.replace(/[?#].*$/, "").replace(/\/+$/, "");
-          return p && p !== "/" && !isLoginPage(p) && p !== loginPathname ? p : null;
-        };
-        const urlRoute = toProofPathname(redirectRoute) ?? toProofPathname(landing.route);
-        if (urlRoute) {
-          logs2(`  \u2713 url auth-proof: authenticated landing route ${urlRoute} (no durable element proof on the default-state page)`);
-          return { kind: "url", route: urlRoute };
-        }
-        logs2("  \u26A0 auth-proof: no durable element proof and no concrete authed landing route \u2014 falling back to model-authored login (no blind navigation default)");
+        logs2("  \u26A0 auth-proof: no durable login-absent element proof on the authenticated page (no url fallback \u2014 coverage deferred to a positive proof)");
         return null;
       }
       ranked.sort((a, b) => a.tier - b.tier);
       logs2(`  \u2713 live auth-proof: ${ranked[0].desc}`);
       return ranked[0].proof;
     }
+    function harvestCollapsedAuthProof(landingElements, loginAbsentElements, credentials, logs2) {
+      const loginRoleNames = /* @__PURE__ */ new Set();
+      const loginTestIds = /* @__PURE__ */ new Set();
+      for (const el of loginAbsentElements) {
+        const nm = (el.label ?? "").trim().toLowerCase();
+        if (el.role && nm)
+          loginRoleNames.add(`${el.role}|${nm}`);
+        if (el.testId)
+          loginTestIds.add(el.testId);
+      }
+      return rankDurableAuthProof(landingElements, loginRoleNames, loginTestIds, credentials, logs2);
+    }
+    function pickAuthLandingPage(siteMap, redirectRoute, loginRoute) {
+      const isLoginPage = (route2) => loginRoute != null && route2 === loginRoute || AUTH_ROUTE_RE.test(route2 ?? "");
+      const authedPages = siteMap.pages.filter((p) => (p.requiresAuth || redirectRoute !== null && p.route === redirectRoute) && !isLoginPage(p.route));
+      return (redirectRoute !== null ? authedPages.find((p) => p.route === redirectRoute) : void 0) ?? authedPages[0] ?? null;
+    }
+    function selectAuthLandingRoute(siteMap, redirectRoute, loginRoute) {
+      return pickAuthLandingPage(siteMap, redirectRoute, loginRoute)?.route ?? null;
+    }
+    function harvestAuthProofLive(siteMap, redirectRoute, loginRoute, credentials, logs2) {
+      const isLoginPage = (route2) => loginRoute != null && route2 === loginRoute || AUTH_ROUTE_RE.test(route2 ?? "");
+      const landing = pickAuthLandingPage(siteMap, redirectRoute, loginRoute);
+      if (!landing) {
+        logs2("  \u26A0 auth-proof: no authenticated landing page captured \u2014 cannot derive a durable proof");
+        return null;
+      }
+      const loginRoleNames = /* @__PURE__ */ new Set();
+      const loginTestIds = /* @__PURE__ */ new Set();
+      for (const p of siteMap.pages) {
+        if (!isLoginPage(p.route) || p.route === landing.route)
+          continue;
+        for (const el of p.elements ?? []) {
+          const nm = (el.label ?? "").trim().toLowerCase();
+          if (el.role && nm)
+            loginRoleNames.add(`${el.role}|${nm}`);
+          if (el.testId)
+            loginTestIds.add(el.testId);
+        }
+      }
+      return rankDurableAuthProof(landing.elements ?? [], loginRoleNames, loginTestIds, credentials, logs2);
+    }
+    var AUTH_ROUTE_RE = /\/(log[\s_-]?in|sign[\s_-]?in|sign[\s_-]?up|register|auth|forgot|reset)\b/i;
+    var AUTO_NAV_TRIGGERS = /* @__PURE__ */ new Set(["AUTO", "REDIRECT"]);
+    var USER_ACTION_TRIGGERS = /* @__PURE__ */ new Set(["CLICK", "SUBMIT", "NAVIGATION"]);
+    var stripToBarePath = (route2) => {
+      if (!route2)
+        return null;
+      let path = route2;
+      if (/^[a-z][a-z0-9+.-]*:\/\//i.test(route2)) {
+        try {
+          path = new URL(route2).pathname;
+        } catch {
+        }
+      }
+      const p = path.replace(/[?#].*$/, "").replace(/\/+$/, "");
+      return p || "/";
+    };
+    function detectRedirectBackCollapse(baseUrl, transitions) {
+      let basePath;
+      try {
+        basePath = stripToBarePath(new URL(baseUrl).pathname);
+      } catch {
+        return null;
+      }
+      if (!basePath || basePath === "/" || AUTH_ROUTE_RE.test(basePath))
+        return null;
+      const userActionEdges = new Set(transitions.filter((t) => USER_ACTION_TRIGGERS.has(t.triggerType)).map((t) => `${stripToBarePath(t.fromRoute) ?? ""} ${stripToBarePath(t.toRoute) ?? ""}`));
+      const bounceIdx = transitions.findIndex((t) => AUTO_NAV_TRIGGERS.has(t.triggerType) && stripToBarePath(t.fromRoute) === basePath && AUTH_ROUTE_RE.test(stripToBarePath(t.toRoute) ?? "") && !userActionEdges.has(`${basePath} ${stripToBarePath(t.toRoute) ?? ""}`));
+      if (bounceIdx < 0)
+        return null;
+      const authRoute = stripToBarePath(transitions[bounceIdx].toRoute);
+      if (!authRoute)
+        return null;
+      const returned = transitions.slice(bounceIdx + 1).some((t) => AUTH_ROUTE_RE.test(stripToBarePath(t.fromRoute) ?? "") && stripToBarePath(t.toRoute) === basePath);
+      if (!returned)
+        return null;
+      return { basePath, authRoute };
+    }
+    function pickRouteElements(routeElements, wantRoute) {
+      const want = stripToBarePath(wantRoute);
+      for (const [route2, els] of routeElements) {
+        if (stripToBarePath(route2) === want && (els?.length ?? 0) > 0)
+          return els;
+      }
+      return [];
+    }
+    function pickLoginFormElements(routeElements, authRoute) {
+      const exact = pickRouteElements(routeElements, authRoute);
+      if (exact.length > 0)
+        return exact;
+      for (const [route2, els] of routeElements) {
+        if (AUTH_ROUTE_RE.test(stripToBarePath(route2) ?? "") && (els?.length ?? 0) > 0)
+          return els;
+      }
+      return [];
+    }
     function findCredentialLiteralLeaks(rendered, credentials) {
       const leaked = [];
       for (const [key, value] of Object.entries(credentials)) {
@@ -326785,12 +327432,22 @@ ${keyLines || "- (none provided)"}
       return leaked;
     }
     async function verifyAuthRecipe(recipe, baseUrl, credentials, logs2) {
+      const baselineRoute = recipe.redirectRoute ?? baseUrl;
       const spec = [
         `import { test, expect } from '@playwright/test';`,
         ``,
         (0, auth_recipe_js_1.renderAuthFn)(recipe),
         ``,
         `test('__vqa_auth_verify', async ({ page }) => {`,
+        `  // DIFFERENTIAL BASELINE (logged out): the durable proof must NOT already hold here, else it`,
+        `  // does not discriminate an authenticated session from an anonymous one \u2014 reject rather than`,
+        `  // publish a proof that passes while logged out (the cardinal invariant). The goto is NOT`,
+        `  // .catch-swallowed: a genuine navigation failure must fail the verify (fail-closed) rather than`,
+        `  // leave the baseline running on about:blank where the proof is vacuously "absent". An auth-gated`,
+        `  // route resolves fine (it follows the redirect to /login).`,
+        `  await page.goto(${JSON.stringify(baselineRoute)}, { waitUntil: 'domcontentloaded' });`,
+        `  ${(0, auth_recipe_js_1.renderProofBaselineCheck)(recipe.authProof, "  ")}`,
+        `  // AUTHED: real login + the durable proof assertion (inside __vqaLogin).`,
         `  await __vqaLogin(page);`,
         `});`,
         ``
@@ -326892,21 +327549,50 @@ ${keyLines || "- (none provided)"}
           cmds: login.cmds.map((c) => (0, scrub_credentials_js_1.scrubCredentials)(c, credentials)),
           preNavCmds: login.preNavCmds?.map((c) => (0, scrub_credentials_js_1.scrubCredentials)(c, credentials))
         };
-        const authProof = harvestAuthProofLive(loginSiteMap, scrubbedLogin.redirectRoute, scrubbedLogin.route, credentials, logs2);
+        let authProof = harvestAuthProofLive(loginSiteMap, scrubbedLogin.redirectRoute, scrubbedLogin.route, credentials, logs2);
+        let effectiveLogin = scrubbedLogin;
+        if (authProof && (authProof.kind === "role" || authProof.kind === "testid")) {
+          const landingRoute = selectAuthLandingRoute(loginSiteMap, scrubbedLogin.redirectRoute, scrubbedLogin.route);
+          if (landingRoute)
+            effectiveLogin = { ...effectiveLogin, redirectRoute: landingRoute };
+        }
         if (!authProof) {
-          logs2("  \u26A0 auth unverified (no durable signed-in proof on the authenticated page) \u2014 falling back to model-authored login");
-          return { recipe: null, outcome: exploreMiss("verify_failed") };
+          const collapse = detectRedirectBackCollapse(baseUrl, exploreResult.collectedTransitions);
+          if (collapse) {
+            const landingEls = pickRouteElements(handle.routeElements, collapse.basePath);
+            const loginEls = pickLoginFormElements(handle.routeElements, collapse.authRoute);
+            const collapsedProof = harvestCollapsedAuthProof(landingEls, loginEls, credentials, logs2);
+            if (collapsedProof) {
+              logs2(`  \u2713 collapsed-entry element auth-proof (redirect-back-to-entry): ${JSON.stringify(collapsedProof)} on ${collapse.basePath} (${landingEls.length} authed / ${loginEls.length} login-form elements differenced)`);
+              authProof = collapsedProof;
+              effectiveLogin = { ...effectiveLogin, redirectRoute: collapse.basePath };
+            } else {
+              logs2("  \u26A0 redirect-back-to-entry collapse detected but no durable authed-only element differenced (no url fallback) \u2014 deferring to model-authored login");
+            }
+          }
         }
-        const candidate = { ...(0, auth_recipe_js_1.buildAuthRecipe)(scrubbedLogin, authProof, (/* @__PURE__ */ new Date()).toISOString()), appOrigin: loginRedirectAppOrigin };
-        const rendered = (0, auth_recipe_js_1.renderAuthFn)(candidate);
-        const leaks = findCredentialLiteralLeaks(rendered, credentials);
-        if (leaks.length > 0) {
-          logs2(`  \u26A0 auth recipe rejected: rendered __vqaLogin contains literal credential value(s) for ${leaks.join(", ")} \u2014 falling back to model-authored login`);
-          return { recipe: null, outcome: "credential_leak" };
+        let identityEndpointProof = null;
+        try {
+          const cookies = await handle.page.context().cookies();
+          if (cookies.some((c) => /(next-auth|authjs)\.session-token/.test(c.name))) {
+            identityEndpointProof = { kind: "endpoint", url: "/api/auth/session" };
+            logs2("  \u2139 NextAuth/Auth.js session cookie detected \u2014 trying an identity-endpoint proof (/api/auth/session) before the element proof");
+          }
+        } catch {
+        }
+        const proofCandidates = [];
+        if (identityEndpointProof)
+          proofCandidates.push(identityEndpointProof);
+        if (authProof)
+          proofCandidates.push(authProof);
+        if (proofCandidates.length === 0) {
+          logs2("  \u26A0 auth unverified (no positive proof \u2014 no identity endpoint, no login-absent element) \u2014 falling back to model-authored login");
+          return { recipe: null, outcome: exploreMiss("verify_failed") };
         }
-        const planLeaks = findCredentialLiteralLeaks(JSON.stringify(candidate.replayPlan ?? []), credentials);
-        if (planLeaks.length > 0) {
-          logs2(`  \u26A0 auth recipe rejected: structured replayPlan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login`);
+        const loginText = [...effectiveLogin.cmds, ...effectiveLogin.preNavCmds ?? []].join("\n") + "\n" + JSON.stringify(effectiveLogin.replayPlan ?? []);
+        const loginLeaks = findCredentialLiteralLeaks(loginText, credentials);
+        if (loginLeaks.length > 0) {
+          logs2(`  \u26A0 auth recipe rejected: login sequence contains literal credential value(s) for ${loginLeaks.join(", ")} \u2014 falling back to model-authored login`);
           return { recipe: null, outcome: "credential_leak" };
         }
         try {
@@ -326914,14 +327600,25 @@ ${keyLines || "- (none provided)"}
         } catch {
         }
         handle = null;
-        const ok = await verifyAuthRecipe(candidate, baseUrl, credentials, logs2);
-        if (!ok) {
-          logs2("  \u26A0 auth unverified (live-verify replay failed \u2014 fleet-config drift) \u2014 falling back to model-authored login");
-          return { recipe: null, outcome: exploreMiss("verify_failed") };
+        let lastReject = "no candidate verified";
+        for (const proof of proofCandidates) {
+          const candidate = { ...(0, auth_recipe_js_1.buildAuthRecipe)(effectiveLogin, proof, (/* @__PURE__ */ new Date()).toISOString()), appOrigin: loginRedirectAppOrigin };
+          const renderLeaks = findCredentialLiteralLeaks((0, auth_recipe_js_1.renderAuthFn)(candidate), credentials);
+          if (renderLeaks.length > 0) {
+            lastReject = `${describeAuthProof(proof)} render coincidentally matched credential value(s) ${renderLeaks.join(", ")}`;
+            logs2(`  \u26A0 auth-proof candidate skipped (${lastReject}) \u2014 trying the next candidate`);
+            continue;
+          }
+          const ok = await verifyAuthRecipe(candidate, baseUrl, credentials, logs2);
+          if (ok) {
+            logs2(`  \u2713 auth recipe verified (hash ${candidate.recipeHash}, proof ${describeAuthProof(proof)}, ${(candidate.replayPlan ?? []).length} replay steps) \u2014 stamping into @needs-auth tests`);
+            return { recipe: candidate, outcome: "captured" };
+          }
+          lastReject = `${describeAuthProof(proof)} failed the differential verify`;
+          logs2(`  \u26A0 auth-proof candidate rejected (${lastReject}) \u2014 trying the next candidate`);
         }
-        const proofDesc = authProof.kind === "role" ? `role:${authProof.role}${authProof.name ? `(${authProof.name})` : ""}` : authProof.kind === "testid" ? `testid:${authProof.testId}` : `url:${authProof.route}`;
-        logs2(`  \u2713 auth recipe verified (hash ${candidate.recipeHash}, proof ${proofDesc}, ${(candidate.replayPlan ?? []).length} replay steps) \u2014 stamping into @needs-auth tests`);
-        return { recipe: candidate, outcome: "captured" };
+        logs2(`  \u26A0 auth unverified (all proof candidates failed: ${lastReject}) \u2014 falling back to model-authored login`);
+        return { recipe: null, outcome: exploreMiss("verify_failed") };
       } catch (err) {
         logs2(`  \u26A0 auth-capture run failed: ${err instanceof Error ? err.message : String(err)} \u2014 falling back to model-authored login`);
         return { recipe: null, outcome: (0, ai_retry_js_1.isTransientRateError)(err) ? "rate_limited" : "error" };
@@ -334048,8 +334745,13 @@ Respond with ONLY valid JSON:
       if (!(0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) && ctx.mode !== "capture")
         return null;
       if (ctx.authRecipe) {
-        pushLog(`auth-prologue: reusing persisted login recipe ${ctx.authRecipe.recipeHash} \u2014 skipping capture`);
-        return Promise.resolve(ctx.authRecipe);
+        if (ctx.authRecipe.authProof?.kind === "url") {
+          pushLog(`auth-prologue: persisted recipe ${ctx.authRecipe.recipeHash} uses a demoted url proof \u2014 re-capturing with the differential pipeline (legacy invalidation)`);
+          ctx.authRecipe = void 0;
+        } else {
+          pushLog(`auth-prologue: reusing persisted login recipe ${ctx.authRecipe.recipeHash} \u2014 skipping capture`);
+          return Promise.resolve(ctx.authRecipe);
+        }
       }
       const exploreModel = ctx.exploreModel ?? "";
       const authCaptureModel = ctx.authCaptureModel ?? "";
@@ -349596,7 +350298,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.56",
+      version: "1.0.57",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"