@validate.qa/runner 1.0.62 → 1.0.63

package/dist/cli.js

@@ -73455,6 +73455,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73617,6 +73618,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75458,7 +75462,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -350851,7 +350858,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.62",
+      version: "1.0.63",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -73460,6 +73460,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73622,6 +73623,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75463,7 +75467,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -350856,7 +350863,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.62",
+      version: "1.0.63",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.62",
+  "version": "1.0.63",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"