@validate.qa/runner 1.0.62 → 1.0.64

package/dist/cli.js

@@ -5770,6 +5770,53 @@ var init_analytics_url = __esm({
   }
 });
 
+// ../shared/dist/api-endpoint-hygiene.js
+function isAssetLikePath(path) {
+  return ASSET_SEGMENT_RE.test(path ?? "");
+}
+var ASSET_SEGMENT_RE;
+var init_api_endpoint_hygiene = __esm({
+  "../shared/dist/api-endpoint-hygiene.js"() {
+    "use strict";
+    ASSET_SEGMENT_RE = /(?:^|\/)(?:assets|static|public|img|images|media|fonts|_next|locales)(?:\/|$)/i;
+  }
+});
+
+// ../shared/dist/auth-provider-hosts.js
+function isAuthProviderHost(host) {
+  if (!host)
+    return false;
+  const h = host.toLowerCase();
+  return AUTH_PROVIDER_HOST_SIGNATURES.some((sig) => sig.startsWith(".") ? h.endsWith(sig) : h.includes(sig));
+}
+var AUTH_PROVIDER_HOST_SIGNATURES, AUTH_PATH_SIGNATURE;
+var init_auth_provider_hosts = __esm({
+  "../shared/dist/auth-provider-hosts.js"() {
+    "use strict";
+    AUTH_PROVIDER_HOST_SIGNATURES = [
+      "clerk.",
+      // clerk.<app-domain> — Clerk Frontend API
+      ".auth0.com",
+      ".okta.com",
+      ".oktapreview.com",
+      "cognito-idp.",
+      ".amazoncognito.com",
+      "identitytoolkit.googleapis.com",
+      // Firebase Auth
+      "securetoken.googleapis.com",
+      ".supabase.co",
+      ".stytch.com",
+      ".workos.com",
+      ".frontegg.com",
+      ".kinde.com",
+      "login.microsoftonline.com",
+      ".b2clogin.com",
+      "accounts.google.com"
+    ];
+    AUTH_PATH_SIGNATURE = /(?:sign[_-]?ins?|first_factor|second_factor|prepare_verification|\/oauth\/|\/authorize\b|\/authenticate\b|openid-connect\/token|\/userinfo\b|\/passwordless)/i;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5781,6 +5828,8 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
+  AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -5898,6 +5947,8 @@ __export(dist_exports, {
   isAddonType: () => isAddonType,
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
+  isAssetLikePath: () => isAssetLikePath,
+  isAuthProviderHost: () => isAuthProviderHost,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
@@ -5998,6 +6049,8 @@ var init_dist = __esm({
     init_feature_flags();
     init_env_flags();
     init_analytics_url();
+    init_api_endpoint_hygiene();
+    init_auth_provider_hosts();
   }
 });
 
@@ -73455,6 +73508,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73617,6 +73671,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75458,7 +75515,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -85209,6 +85269,7 @@ var require_api_call_redaction = __commonJS({
     exports2.buildResponseExcerpt = buildResponseExcerpt;
     exports2.isTextExcerptable = isTextExcerptable;
     exports2.buildApiCallSummary = buildApiCallSummary2;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     exports2.STATIC_EXTENSIONS = /* @__PURE__ */ new Set([
       ".js",
       ".css",
@@ -85226,7 +85287,9 @@ var require_api_call_redaction = __commonJS({
       ".webp",
       ".avif",
       ".mp4",
-      ".webm"
+      ".webm",
+      ".lottie",
+      ".webmanifest"
     ]);
     exports2.SECURITY_HEADER_NAMES = /* @__PURE__ */ new Set([
       // CORS & core security
@@ -85315,6 +85378,8 @@ var require_api_call_redaction = __commonJS({
           return false;
         if (path.includes("/api/") || path.includes("/graphql"))
           return true;
+        if (ext.toLowerCase() === ".json" && (0, shared_1.isAssetLikePath)(path))
+          return false;
         if (contentType?.includes("application/json"))
           return true;
         if (contentType?.includes("application/graphql"))
@@ -86869,6 +86934,7 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const configBaseUrl = isApiTest2 && options.apiBaseUrl ? options.apiBaseUrl : baseUrl;
         const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
         const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
@@ -87072,7 +87138,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (!importMatch) {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
-        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!configBaseUrl;
         const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
         if (resolvedExtraHeaders && !useScopedApiHeaders) {
           logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
@@ -87093,10 +87159,10 @@ test.afterEach(async ({ page }, testInfo) => {
         }
         await (0, promises_1.writeFile)((0, path_1.join)(runDir, "test.spec.ts"), instrumentedCode);
         if (useScopedApiHeaders && resolvedExtraHeaders) {
-          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
+          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, configBaseUrl));
         }
         const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
-        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
+        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(configBaseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}${configBaseUrl !== baseUrl ? ` (elected @api origin; app BASE_URL ${JSON.stringify(baseUrl)})` : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
         const absOutputDir = (0, path_1.join)(runDir, "test-results").replace(/\\/g, "/");
@@ -87120,7 +87186,7 @@ module.exports = {
   timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
-    baseURL: ${JSON.stringify(baseUrl)},
+    baseURL: ${JSON.stringify(configBaseUrl)},
     ${storageStateLine}
     ${extraHeadersLine}
     browserName: 'chromium',
@@ -87180,6 +87246,9 @@ module.exports = {
           }
         }
         const childTestVariables = { ...testVariables ?? {} };
+        if (isApiTest2 && options.apiBaseUrl && !childTestVariables["API_BASE_URL"]) {
+          childTestVariables["API_BASE_URL"] = options.apiBaseUrl;
+        }
         const trustedRuntimeEnv = {
           ...isolation.env,
           // Generated callbacks receive only a random loopback capability. The global
@@ -350851,7 +350920,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.62",
+      version: "1.0.64",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -358447,6 +358516,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
     authStandingMode: authPlan.standingHeadersMode,
     storageStatePath: wrapperStorageStatePath,
+    apiBaseUrl: run2.apiBaseUrl,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
@@ -358857,7 +358927,9 @@ ${finalVerifyResult.logs ?? ""}`;
             } else {
               const xo = resolveCrossOriginConfigOverride({
                 appOriginEnabled: isAppOriginResolutionEnabled(),
-                baseUrl: run2.baseUrl,
+                // An @api run anchored on an elected execution origin must be judged against THAT
+                // origin, or a correctly-anchored call reads as "wrong origin" (gate-review tweak).
+                baseUrl: run2.apiBaseUrl ?? run2.baseUrl,
                 composedError,
                 verdicts: enrichedSteps.map((s) => s.verdict),
                 apiCalls: rawSteps.flatMap((s) => s.apiCalls ?? []),

package/dist/cli.mjs

@@ -5775,6 +5775,53 @@ var init_analytics_url = __esm({
   }
 });
 
+// ../shared/dist/api-endpoint-hygiene.js
+function isAssetLikePath(path) {
+  return ASSET_SEGMENT_RE.test(path ?? "");
+}
+var ASSET_SEGMENT_RE;
+var init_api_endpoint_hygiene = __esm({
+  "../shared/dist/api-endpoint-hygiene.js"() {
+    "use strict";
+    ASSET_SEGMENT_RE = /(?:^|\/)(?:assets|static|public|img|images|media|fonts|_next|locales)(?:\/|$)/i;
+  }
+});
+
+// ../shared/dist/auth-provider-hosts.js
+function isAuthProviderHost(host) {
+  if (!host)
+    return false;
+  const h = host.toLowerCase();
+  return AUTH_PROVIDER_HOST_SIGNATURES.some((sig) => sig.startsWith(".") ? h.endsWith(sig) : h.includes(sig));
+}
+var AUTH_PROVIDER_HOST_SIGNATURES, AUTH_PATH_SIGNATURE;
+var init_auth_provider_hosts = __esm({
+  "../shared/dist/auth-provider-hosts.js"() {
+    "use strict";
+    AUTH_PROVIDER_HOST_SIGNATURES = [
+      "clerk.",
+      // clerk.<app-domain> — Clerk Frontend API
+      ".auth0.com",
+      ".okta.com",
+      ".oktapreview.com",
+      "cognito-idp.",
+      ".amazoncognito.com",
+      "identitytoolkit.googleapis.com",
+      // Firebase Auth
+      "securetoken.googleapis.com",
+      ".supabase.co",
+      ".stytch.com",
+      ".workos.com",
+      ".frontegg.com",
+      ".kinde.com",
+      "login.microsoftonline.com",
+      ".b2clogin.com",
+      "accounts.google.com"
+    ];
+    AUTH_PATH_SIGNATURE = /(?:sign[_-]?ins?|first_factor|second_factor|prepare_verification|\/oauth\/|\/authorize\b|\/authenticate\b|openid-connect\/token|\/userinfo\b|\/passwordless)/i;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5786,6 +5833,8 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
+  AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -5903,6 +5952,8 @@ __export(dist_exports, {
   isAddonType: () => isAddonType,
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
+  isAssetLikePath: () => isAssetLikePath,
+  isAuthProviderHost: () => isAuthProviderHost,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
@@ -6003,6 +6054,8 @@ var init_dist = __esm({
     init_feature_flags();
     init_env_flags();
     init_analytics_url();
+    init_api_endpoint_hygiene();
+    init_auth_provider_hosts();
   }
 });
 
@@ -73460,6 +73513,7 @@ var require_inbox_tools = __commonJS({
         legacyEmail,
         tag,
         usePlusTag: email !== baseEmail,
+        allowPlainFallback: opts.allowPlainFallback ?? true,
         passwordKey: opts.passwordKey ?? "TEST_USER_PASSWORD",
         provisioned: false,
         // Floor reads at run start so a verification email from a PRIOR run (the
@@ -73622,6 +73676,9 @@ var require_inbox_tools = __commonJS({
       const { state: state2 } = ctx;
       const plain = args.plain === true || args.plain === "true";
       const restore = args.plain === false || args.plain === "false";
+      if (plain && !state2.allowPlainFallback) {
+        return err("The bare inbox address is unavailable for this brokered run because it is shared across projects. Keep using the project-scoped +tag address; if the app rejects plus-addressing, report email verification as blocked.");
+      }
       if (plain && state2.usePlusTag) {
         state2.email = state2.baseEmail;
         state2.usePlusTag = false;
@@ -75463,7 +75520,10 @@ ${existingScreens.slice(0, 100).map((s) => `- ${s.screenId}${s.name ? ` "${s.nam
       } else if (registerRequested && ctx.inboxBroker?.address && ctx.inboxBrokerRead) {
         inboxState = (0, inbox_tools_js_1.createInboxRunState)({ address: ctx.inboxBroker.address }, {
           tagSeed: targetAppId ?? ctx.projectId,
-          projectScope: ctx.projectId
+          projectScope: ctx.projectId,
+          // A user-controlled local runner must never read the shared bare inbox:
+          // only the project-scoped +tag is an authorization boundary.
+          allowPlainFallback: false
         });
         inboxReader = new brokered_inbox_reader_js_1.BrokeredInboxReader(ctx.inboxBrokerRead);
         await (0, inbox_tools_js_1.applyAndPersistInboxIdentity)({
@@ -85214,6 +85274,7 @@ var require_api_call_redaction = __commonJS({
     exports.buildResponseExcerpt = buildResponseExcerpt;
     exports.isTextExcerptable = isTextExcerptable;
     exports.buildApiCallSummary = buildApiCallSummary2;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     exports.STATIC_EXTENSIONS = /* @__PURE__ */ new Set([
       ".js",
       ".css",
@@ -85231,7 +85292,9 @@ var require_api_call_redaction = __commonJS({
       ".webp",
       ".avif",
       ".mp4",
-      ".webm"
+      ".webm",
+      ".lottie",
+      ".webmanifest"
     ]);
     exports.SECURITY_HEADER_NAMES = /* @__PURE__ */ new Set([
       // CORS & core security
@@ -85320,6 +85383,8 @@ var require_api_call_redaction = __commonJS({
           return false;
         if (path.includes("/api/") || path.includes("/graphql"))
           return true;
+        if (ext.toLowerCase() === ".json" && (0, shared_1.isAssetLikePath)(path))
+          return false;
         if (contentType?.includes("application/json"))
           return true;
         if (contentType?.includes("application/graphql"))
@@ -86874,6 +86939,7 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const configBaseUrl = isApiTest2 && options.apiBaseUrl ? options.apiBaseUrl : baseUrl;
         const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
         const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
@@ -87077,7 +87143,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (!importMatch) {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
-        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!configBaseUrl;
         const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
         if (resolvedExtraHeaders && !useScopedApiHeaders) {
           logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
@@ -87098,10 +87164,10 @@ test.afterEach(async ({ page }, testInfo) => {
         }
         await (0, promises_1.writeFile)((0, path_1.join)(runDir, "test.spec.ts"), instrumentedCode);
         if (useScopedApiHeaders && resolvedExtraHeaders) {
-          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
+          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, configBaseUrl));
         }
         const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
-        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
+        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(configBaseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}${configBaseUrl !== baseUrl ? ` (elected @api origin; app BASE_URL ${JSON.stringify(baseUrl)})` : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
         const absOutputDir = (0, path_1.join)(runDir, "test-results").replace(/\\/g, "/");
@@ -87125,7 +87191,7 @@ module.exports = {
   timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
-    baseURL: ${JSON.stringify(baseUrl)},
+    baseURL: ${JSON.stringify(configBaseUrl)},
     ${storageStateLine}
     ${extraHeadersLine}
     browserName: 'chromium',
@@ -87185,6 +87251,9 @@ module.exports = {
           }
         }
         const childTestVariables = { ...testVariables ?? {} };
+        if (isApiTest2 && options.apiBaseUrl && !childTestVariables["API_BASE_URL"]) {
+          childTestVariables["API_BASE_URL"] = options.apiBaseUrl;
+        }
         const trustedRuntimeEnv = {
           ...isolation.env,
           // Generated callbacks receive only a random loopback capability. The global
@@ -350856,7 +350925,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.62",
+      version: "1.0.64",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -358455,6 +358524,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
     authStandingMode: authPlan.standingHeadersMode,
     storageStatePath: wrapperStorageStatePath,
+    apiBaseUrl: run2.apiBaseUrl,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
@@ -358865,7 +358935,9 @@ ${finalVerifyResult.logs ?? ""}`;
             } else {
               const xo = resolveCrossOriginConfigOverride({
                 appOriginEnabled: isAppOriginResolutionEnabled(),
-                baseUrl: run2.baseUrl,
+                // An @api run anchored on an elected execution origin must be judged against THAT
+                // origin, or a correctly-anchored call reads as "wrong origin" (gate-review tweak).
+                baseUrl: run2.apiBaseUrl ?? run2.baseUrl,
                 composedError,
                 verdicts: enrichedSteps.map((s) => s.verdict),
                 apiCalls: rawSteps.flatMap((s) => s.apiCalls ?? []),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.62",
+  "version": "1.0.64",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"