@validate.qa/runner 1.0.63 → 1.0.65

package/dist/cli.js

@@ -3485,6 +3485,135 @@ var init_audit_pricing = __esm({
   }
 });
 
+// ../shared/dist/audit-grouping.js
+var GROUPABLE_CALL_TYPES, GROUP_LABELS, FLOW_PHASE_TYPES, FLOW_SERVER_TYPES, FLOW_PHASE_LABELS;
+var init_audit_grouping = __esm({
+  "../shared/dist/audit-grouping.js"() {
+    "use strict";
+    GROUPABLE_CALL_TYPES = /* @__PURE__ */ new Set([
+      "healIteration",
+      "healOrchestrator",
+      "generateRegressionSuite",
+      "discoveryExplore",
+      "surveyExplore",
+      "featureExplore",
+      "discoveryGenerate",
+      "discoveryPlan",
+      "discoveryGenerateSkeleton",
+      "discoveryGenerateElementContext",
+      "liveGenerate",
+      "scenarioGenerate",
+      "liveSuiteHeal",
+      "captureIteration",
+      "healAPITest",
+      "generateAPITests",
+      // Auth-prologue login-capture run (runLoginCaptureRun) — per-turn rows share a
+      // groupId so they collapse into one "Login Capture" phase card on /audit.
+      "authCapture",
+      // Assistant chat — rounds of one conversation collapse into one card.
+      "assistantChat"
+    ]);
+    GROUP_LABELS = {
+      healIteration: "healSession",
+      healOrchestrator: "healSession",
+      healAPITest: "apiHealSession",
+      generateRegressionSuite: "regressionSession",
+      generateAPITests: "apiTestGenSession",
+      discoveryExplore: "discoveryExploreSession",
+      surveyExplore: "surveyExploreSession",
+      featureExplore: "featureExploreSession",
+      discoveryGenerate: "discoveryGenerateSession",
+      discoveryGenerateSkeleton: "discoveryGenerateSession",
+      discoveryGenerateElementContext: "discoveryGenerateSession",
+      liveGenerate: "liveGenerateSession",
+      scenarioGenerate: "scenarioGenerateSession",
+      discoveryPlan: "discoveryPlanSession",
+      liveSuiteHeal: "liveSuiteHealSession",
+      captureIteration: "captureIterationSession",
+      authCapture: "authCaptureSession",
+      assistantChat: "assistantChatSession"
+    };
+    FLOW_PHASE_TYPES = /* @__PURE__ */ new Set([
+      "surveyExploreSession",
+      "featureExploreSession",
+      "discoveryAIPlanner",
+      "discoveryPlanSession",
+      "scenarioGenerateSession",
+      "liveGenerateSession",
+      "discoveryGenerateSession",
+      // Raw callTypes (for ungrouped single-turn entries like planner)
+      "surveyExplore",
+      "featureExplore",
+      "discoveryPlan",
+      "scenarioGenerate",
+      "liveGenerate",
+      "discoveryGenerate",
+      // Planner repair / retry / strengthen-gate — the one-shot extra planner call
+      // shares the base planner's discoveryFlowId, so it nests as its own phase
+      // instead of dangling as a raw camelCase row.
+      "discoveryAIPlannerRepair",
+      "discoveryAIPlannerRetry",
+      "discoveryAIPlannerStrengthenGate",
+      // Deep-run feature analyst insight (one call per feature discovery).
+      "featureInsight",
+      // Discovery v2 Call-1-authoring pivot — per-test Call 2 spawns. Each session
+      // has its OWN sessionId but shares the parent discoveryFlowId, so grouping by
+      // flowId pulls them under the same Discovery Flow card. `Cleanup` is the
+      // teardown sibling of Fix/Author and nests the same way.
+      "discoveryCall2Fix",
+      "discoveryCall2Author",
+      "discoveryCall2Cleanup",
+      // Auth-prologue login-capture run — grouped label + raw callType.
+      "authCaptureSession",
+      "authCapture"
+    ]);
+    FLOW_SERVER_TYPES = /* @__PURE__ */ new Set([
+      "healthAnalysis",
+      "apiSecurityAudit",
+      "apiSecurityAuditVerify",
+      "generateAPITests",
+      "apiTestGenSession",
+      "healAPITest",
+      "apiHealSession",
+      "healSession",
+      "healIteration"
+    ]);
+    FLOW_PHASE_LABELS = {
+      surveyExploreSession: "Survey Explore",
+      featureExploreSession: "Feature Explore",
+      discoveryAIPlanner: "Feature Analyst",
+      discoveryAIPlannerRepair: "Planner Repair",
+      discoveryAIPlannerRetry: "Planner Retry",
+      discoveryAIPlannerStrengthenGate: "Planner Strengthen Gate",
+      discoveryPlanSession: "Survey Planner",
+      scenarioGenerateSession: "Scenario Gen",
+      liveGenerateSession: "Live Browser Gen",
+      discoveryGenerateSession: "Test Generation",
+      surveyExplore: "Survey Explore",
+      featureExplore: "Feature Explore",
+      discoveryPlan: "Planner",
+      scenarioGenerate: "Scenario Gen",
+      liveGenerate: "Live Browser Gen",
+      discoveryGenerate: "Test Generation",
+      discoveryCall2Fix: "Call 2 Fix",
+      discoveryCall2Author: "Call 2 Author",
+      discoveryCall2Cleanup: "Call 2 Cleanup",
+      featureInsight: "Feature Insight",
+      healthAnalysis: "Health Analysis",
+      apiSecurityAudit: "Security Audit",
+      apiSecurityAuditVerify: "Security Verify",
+      generateAPITests: "API Test Gen",
+      apiTestGenSession: "API Test Gen",
+      healAPITest: "API Test Heal",
+      apiHealSession: "API Test Heal",
+      healSession: "Heal Session",
+      healIteration: "Heal",
+      authCapture: "Login Capture",
+      authCaptureSession: "Login Capture"
+    };
+  }
+});
+
 // ../shared/dist/discovery-har-decision.js
 function decideHarPosted(response) {
   if (!response)
@@ -5770,6 +5899,53 @@ var init_analytics_url = __esm({
   }
 });
 
+// ../shared/dist/api-endpoint-hygiene.js
+function isAssetLikePath(path) {
+  return ASSET_SEGMENT_RE.test(path ?? "");
+}
+var ASSET_SEGMENT_RE;
+var init_api_endpoint_hygiene = __esm({
+  "../shared/dist/api-endpoint-hygiene.js"() {
+    "use strict";
+    ASSET_SEGMENT_RE = /(?:^|\/)(?:assets|static|public|img|images|media|fonts|_next|locales)(?:\/|$)/i;
+  }
+});
+
+// ../shared/dist/auth-provider-hosts.js
+function isAuthProviderHost(host) {
+  if (!host)
+    return false;
+  const h = host.toLowerCase();
+  return AUTH_PROVIDER_HOST_SIGNATURES.some((sig) => sig.startsWith(".") ? h.endsWith(sig) : h.includes(sig));
+}
+var AUTH_PROVIDER_HOST_SIGNATURES, AUTH_PATH_SIGNATURE;
+var init_auth_provider_hosts = __esm({
+  "../shared/dist/auth-provider-hosts.js"() {
+    "use strict";
+    AUTH_PROVIDER_HOST_SIGNATURES = [
+      "clerk.",
+      // clerk.<app-domain> — Clerk Frontend API
+      ".auth0.com",
+      ".okta.com",
+      ".oktapreview.com",
+      "cognito-idp.",
+      ".amazoncognito.com",
+      "identitytoolkit.googleapis.com",
+      // Firebase Auth
+      "securetoken.googleapis.com",
+      ".supabase.co",
+      ".stytch.com",
+      ".workos.com",
+      ".frontegg.com",
+      ".kinde.com",
+      "login.microsoftonline.com",
+      ".b2clogin.com",
+      "accounts.google.com"
+    ];
+    AUTH_PATH_SIGNATURE = /(?:sign[_-]?ins?|first_factor|second_factor|prepare_verification|\/oauth\/|\/authorize\b|\/authenticate\b|openid-connect\/token|\/userinfo\b|\/passwordless)/i;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5781,6 +5957,8 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
+  AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -5801,6 +5979,11 @@ __export(dist_exports, {
   DEFAULT_UI_VARIANT: () => DEFAULT_UI_VARIANT,
   EMAIL_FROM_IDENTITIES: () => EMAIL_FROM_IDENTITIES,
   ENVIRONMENTAL_ERROR_PREFIXES: () => ENVIRONMENTAL_ERROR_PREFIXES,
+  FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
+  FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
+  FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
+  GROUPABLE_CALL_TYPES: () => GROUPABLE_CALL_TYPES,
+  GROUP_LABELS: () => GROUP_LABELS,
   LEGACY_TTS_VOICE_ID_MAP: () => LEGACY_TTS_VOICE_ID_MAP,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
@@ -5898,6 +6081,8 @@ __export(dist_exports, {
   isAddonType: () => isAddonType,
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
+  isAssetLikePath: () => isAssetLikePath,
+  isAuthProviderHost: () => isAuthProviderHost,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
@@ -5982,6 +6167,7 @@ var init_dist = __esm({
     init_mobile_deeplink();
     init_plans();
     init_audit_pricing();
+    init_audit_grouping();
     init_discovery_har_decision();
     init_assertion_classifier();
     init_assertion_strength();
@@ -5998,6 +6184,8 @@ var init_dist = __esm({
     init_feature_flags();
     init_env_flags();
     init_analytics_url();
+    init_api_endpoint_hygiene();
+    init_auth_provider_hosts();
   }
 });
 
@@ -85216,6 +85404,7 @@ var require_api_call_redaction = __commonJS({
     exports2.buildResponseExcerpt = buildResponseExcerpt;
     exports2.isTextExcerptable = isTextExcerptable;
     exports2.buildApiCallSummary = buildApiCallSummary2;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     exports2.STATIC_EXTENSIONS = /* @__PURE__ */ new Set([
       ".js",
       ".css",
@@ -85233,7 +85422,9 @@ var require_api_call_redaction = __commonJS({
       ".webp",
       ".avif",
       ".mp4",
-      ".webm"
+      ".webm",
+      ".lottie",
+      ".webmanifest"
     ]);
     exports2.SECURITY_HEADER_NAMES = /* @__PURE__ */ new Set([
       // CORS & core security
@@ -85322,6 +85513,8 @@ var require_api_call_redaction = __commonJS({
           return false;
         if (path.includes("/api/") || path.includes("/graphql"))
           return true;
+        if (ext.toLowerCase() === ".json" && (0, shared_1.isAssetLikePath)(path))
+          return false;
         if (contentType?.includes("application/json"))
           return true;
         if (contentType?.includes("application/graphql"))
@@ -86876,6 +87069,7 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const configBaseUrl = isApiTest2 && options.apiBaseUrl ? options.apiBaseUrl : baseUrl;
         const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
         const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
@@ -87079,7 +87273,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (!importMatch) {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
-        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!configBaseUrl;
         const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
         if (resolvedExtraHeaders && !useScopedApiHeaders) {
           logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
@@ -87100,10 +87294,10 @@ test.afterEach(async ({ page }, testInfo) => {
         }
         await (0, promises_1.writeFile)((0, path_1.join)(runDir, "test.spec.ts"), instrumentedCode);
         if (useScopedApiHeaders && resolvedExtraHeaders) {
-          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
+          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, configBaseUrl));
         }
         const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
-        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
+        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(configBaseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}${configBaseUrl !== baseUrl ? ` (elected @api origin; app BASE_URL ${JSON.stringify(baseUrl)})` : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
         const absOutputDir = (0, path_1.join)(runDir, "test-results").replace(/\\/g, "/");
@@ -87127,7 +87321,7 @@ module.exports = {
   timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
-    baseURL: ${JSON.stringify(baseUrl)},
+    baseURL: ${JSON.stringify(configBaseUrl)},
     ${storageStateLine}
     ${extraHeadersLine}
     browserName: 'chromium',
@@ -87187,6 +87381,9 @@ module.exports = {
           }
         }
         const childTestVariables = { ...testVariables ?? {} };
+        if (isApiTest2 && options.apiBaseUrl && !childTestVariables["API_BASE_URL"]) {
+          childTestVariables["API_BASE_URL"] = options.apiBaseUrl;
+        }
         const trustedRuntimeEnv = {
           ...isolation.env,
           // Generated callbacks receive only a random loopback capability. The global
@@ -350858,7 +351055,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.63",
+      version: "1.0.65",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -358454,6 +358651,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
     authStandingMode: authPlan.standingHeadersMode,
     storageStatePath: wrapperStorageStatePath,
+    apiBaseUrl: run2.apiBaseUrl,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
@@ -358864,7 +359062,9 @@ ${finalVerifyResult.logs ?? ""}`;
             } else {
               const xo = resolveCrossOriginConfigOverride({
                 appOriginEnabled: isAppOriginResolutionEnabled(),
-                baseUrl: run2.baseUrl,
+                // An @api run anchored on an elected execution origin must be judged against THAT
+                // origin, or a correctly-anchored call reads as "wrong origin" (gate-review tweak).
+                baseUrl: run2.apiBaseUrl ?? run2.baseUrl,
                 composedError,
                 verdicts: enrichedSteps.map((s) => s.verdict),
                 apiCalls: rawSteps.flatMap((s) => s.apiCalls ?? []),
@@ -359451,13 +359651,14 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           }
         }
+        const auditStatus = info.exitReason === "abort" || info.exitReason === "timeout" ? "ERROR" : "SUCCESS";
         pushAudit({
           projectId: ctx.projectId,
           sessionId: ctx.sessionId,
           callType: info.callType,
           model: info.model,
           provider: info.provider,
-          status: "SUCCESS",
+          status: auditStatus,
           durationMs: info.durationMs,
           promptTokens: info.promptTokens,
           completionTokens: info.completionTokens,
@@ -359474,6 +359675,11 @@ ${finalVerifyResult.logs ?? ""}`;
             discoveryFlowId: run2.runId,
             ...info.callType === "authCapture" ? { featureName: "Login" } : ctx.featureName ? { featureName: ctx.featureName } : {},
             ...ctx.mode ? { discoveryMode: ctx.mode } : {},
+            // Per-session identity for Call-2 rows (parity with execute-run.ts) so
+            // Fix/Author/Cleanup phases are distinguishable in the flow card.
+            ...info.scenarioName ? { scenarioName: info.scenarioName } : {},
+            ...info.sessionKind ? { sessionKind: info.sessionKind } : {},
+            ...info.exitReason ? { exitReason: info.exitReason } : {},
             ...cliCostUsd !== void 0 ? { cliCostUsd } : {},
             ...ledgerAudit ? {
               ledger: ledgerAudit.entries,

package/dist/cli.mjs

@@ -3490,6 +3490,135 @@ var init_audit_pricing = __esm({
   }
 });
 
+// ../shared/dist/audit-grouping.js
+var GROUPABLE_CALL_TYPES, GROUP_LABELS, FLOW_PHASE_TYPES, FLOW_SERVER_TYPES, FLOW_PHASE_LABELS;
+var init_audit_grouping = __esm({
+  "../shared/dist/audit-grouping.js"() {
+    "use strict";
+    GROUPABLE_CALL_TYPES = /* @__PURE__ */ new Set([
+      "healIteration",
+      "healOrchestrator",
+      "generateRegressionSuite",
+      "discoveryExplore",
+      "surveyExplore",
+      "featureExplore",
+      "discoveryGenerate",
+      "discoveryPlan",
+      "discoveryGenerateSkeleton",
+      "discoveryGenerateElementContext",
+      "liveGenerate",
+      "scenarioGenerate",
+      "liveSuiteHeal",
+      "captureIteration",
+      "healAPITest",
+      "generateAPITests",
+      // Auth-prologue login-capture run (runLoginCaptureRun) — per-turn rows share a
+      // groupId so they collapse into one "Login Capture" phase card on /audit.
+      "authCapture",
+      // Assistant chat — rounds of one conversation collapse into one card.
+      "assistantChat"
+    ]);
+    GROUP_LABELS = {
+      healIteration: "healSession",
+      healOrchestrator: "healSession",
+      healAPITest: "apiHealSession",
+      generateRegressionSuite: "regressionSession",
+      generateAPITests: "apiTestGenSession",
+      discoveryExplore: "discoveryExploreSession",
+      surveyExplore: "surveyExploreSession",
+      featureExplore: "featureExploreSession",
+      discoveryGenerate: "discoveryGenerateSession",
+      discoveryGenerateSkeleton: "discoveryGenerateSession",
+      discoveryGenerateElementContext: "discoveryGenerateSession",
+      liveGenerate: "liveGenerateSession",
+      scenarioGenerate: "scenarioGenerateSession",
+      discoveryPlan: "discoveryPlanSession",
+      liveSuiteHeal: "liveSuiteHealSession",
+      captureIteration: "captureIterationSession",
+      authCapture: "authCaptureSession",
+      assistantChat: "assistantChatSession"
+    };
+    FLOW_PHASE_TYPES = /* @__PURE__ */ new Set([
+      "surveyExploreSession",
+      "featureExploreSession",
+      "discoveryAIPlanner",
+      "discoveryPlanSession",
+      "scenarioGenerateSession",
+      "liveGenerateSession",
+      "discoveryGenerateSession",
+      // Raw callTypes (for ungrouped single-turn entries like planner)
+      "surveyExplore",
+      "featureExplore",
+      "discoveryPlan",
+      "scenarioGenerate",
+      "liveGenerate",
+      "discoveryGenerate",
+      // Planner repair / retry / strengthen-gate — the one-shot extra planner call
+      // shares the base planner's discoveryFlowId, so it nests as its own phase
+      // instead of dangling as a raw camelCase row.
+      "discoveryAIPlannerRepair",
+      "discoveryAIPlannerRetry",
+      "discoveryAIPlannerStrengthenGate",
+      // Deep-run feature analyst insight (one call per feature discovery).
+      "featureInsight",
+      // Discovery v2 Call-1-authoring pivot — per-test Call 2 spawns. Each session
+      // has its OWN sessionId but shares the parent discoveryFlowId, so grouping by
+      // flowId pulls them under the same Discovery Flow card. `Cleanup` is the
+      // teardown sibling of Fix/Author and nests the same way.
+      "discoveryCall2Fix",
+      "discoveryCall2Author",
+      "discoveryCall2Cleanup",
+      // Auth-prologue login-capture run — grouped label + raw callType.
+      "authCaptureSession",
+      "authCapture"
+    ]);
+    FLOW_SERVER_TYPES = /* @__PURE__ */ new Set([
+      "healthAnalysis",
+      "apiSecurityAudit",
+      "apiSecurityAuditVerify",
+      "generateAPITests",
+      "apiTestGenSession",
+      "healAPITest",
+      "apiHealSession",
+      "healSession",
+      "healIteration"
+    ]);
+    FLOW_PHASE_LABELS = {
+      surveyExploreSession: "Survey Explore",
+      featureExploreSession: "Feature Explore",
+      discoveryAIPlanner: "Feature Analyst",
+      discoveryAIPlannerRepair: "Planner Repair",
+      discoveryAIPlannerRetry: "Planner Retry",
+      discoveryAIPlannerStrengthenGate: "Planner Strengthen Gate",
+      discoveryPlanSession: "Survey Planner",
+      scenarioGenerateSession: "Scenario Gen",
+      liveGenerateSession: "Live Browser Gen",
+      discoveryGenerateSession: "Test Generation",
+      surveyExplore: "Survey Explore",
+      featureExplore: "Feature Explore",
+      discoveryPlan: "Planner",
+      scenarioGenerate: "Scenario Gen",
+      liveGenerate: "Live Browser Gen",
+      discoveryGenerate: "Test Generation",
+      discoveryCall2Fix: "Call 2 Fix",
+      discoveryCall2Author: "Call 2 Author",
+      discoveryCall2Cleanup: "Call 2 Cleanup",
+      featureInsight: "Feature Insight",
+      healthAnalysis: "Health Analysis",
+      apiSecurityAudit: "Security Audit",
+      apiSecurityAuditVerify: "Security Verify",
+      generateAPITests: "API Test Gen",
+      apiTestGenSession: "API Test Gen",
+      healAPITest: "API Test Heal",
+      apiHealSession: "API Test Heal",
+      healSession: "Heal Session",
+      healIteration: "Heal",
+      authCapture: "Login Capture",
+      authCaptureSession: "Login Capture"
+    };
+  }
+});
+
 // ../shared/dist/discovery-har-decision.js
 function decideHarPosted(response) {
   if (!response)
@@ -5775,6 +5904,53 @@ var init_analytics_url = __esm({
   }
 });
 
+// ../shared/dist/api-endpoint-hygiene.js
+function isAssetLikePath(path) {
+  return ASSET_SEGMENT_RE.test(path ?? "");
+}
+var ASSET_SEGMENT_RE;
+var init_api_endpoint_hygiene = __esm({
+  "../shared/dist/api-endpoint-hygiene.js"() {
+    "use strict";
+    ASSET_SEGMENT_RE = /(?:^|\/)(?:assets|static|public|img|images|media|fonts|_next|locales)(?:\/|$)/i;
+  }
+});
+
+// ../shared/dist/auth-provider-hosts.js
+function isAuthProviderHost(host) {
+  if (!host)
+    return false;
+  const h = host.toLowerCase();
+  return AUTH_PROVIDER_HOST_SIGNATURES.some((sig) => sig.startsWith(".") ? h.endsWith(sig) : h.includes(sig));
+}
+var AUTH_PROVIDER_HOST_SIGNATURES, AUTH_PATH_SIGNATURE;
+var init_auth_provider_hosts = __esm({
+  "../shared/dist/auth-provider-hosts.js"() {
+    "use strict";
+    AUTH_PROVIDER_HOST_SIGNATURES = [
+      "clerk.",
+      // clerk.<app-domain> — Clerk Frontend API
+      ".auth0.com",
+      ".okta.com",
+      ".oktapreview.com",
+      "cognito-idp.",
+      ".amazoncognito.com",
+      "identitytoolkit.googleapis.com",
+      // Firebase Auth
+      "securetoken.googleapis.com",
+      ".supabase.co",
+      ".stytch.com",
+      ".workos.com",
+      ".frontegg.com",
+      ".kinde.com",
+      "login.microsoftonline.com",
+      ".b2clogin.com",
+      "accounts.google.com"
+    ];
+    AUTH_PATH_SIGNATURE = /(?:sign[_-]?ins?|first_factor|second_factor|prepare_verification|\/oauth\/|\/authorize\b|\/authenticate\b|openid-connect\/token|\/userinfo\b|\/passwordless)/i;
+  }
+});
+
 // ../shared/dist/index.js
 var dist_exports = {};
 __export(dist_exports, {
@@ -5786,6 +5962,8 @@ __export(dist_exports, {
   API_AUTH_HEADERS_ENV_KEY: () => API_AUTH_HEADERS_ENV_KEY,
   API_PREFIX: () => API_PREFIX,
   AUDIO_CHUNK_DURATION_MS: () => AUDIO_CHUNK_DURATION_MS,
+  AUTH_PATH_SIGNATURE: () => AUTH_PATH_SIGNATURE,
+  AUTH_PROVIDER_HOST_SIGNATURES: () => AUTH_PROVIDER_HOST_SIGNATURES,
   AUTH_STATE_EXPIRY_SKEW_MS: () => AUTH_STATE_EXPIRY_SKEW_MS,
   AUTH_TAG_COOKIE_STATE: () => AUTH_TAG_COOKIE_STATE,
   AUTH_TAG_LOGIN_BEARER: () => AUTH_TAG_LOGIN_BEARER,
@@ -5806,6 +5984,11 @@ __export(dist_exports, {
   DEFAULT_UI_VARIANT: () => DEFAULT_UI_VARIANT,
   EMAIL_FROM_IDENTITIES: () => EMAIL_FROM_IDENTITIES,
   ENVIRONMENTAL_ERROR_PREFIXES: () => ENVIRONMENTAL_ERROR_PREFIXES,
+  FLOW_PHASE_LABELS: () => FLOW_PHASE_LABELS,
+  FLOW_PHASE_TYPES: () => FLOW_PHASE_TYPES,
+  FLOW_SERVER_TYPES: () => FLOW_SERVER_TYPES,
+  GROUPABLE_CALL_TYPES: () => GROUPABLE_CALL_TYPES,
+  GROUP_LABELS: () => GROUP_LABELS,
   LEGACY_TTS_VOICE_ID_MAP: () => LEGACY_TTS_VOICE_ID_MAP,
   MAX_CREDIT_TOPUP_CENTS: () => MAX_CREDIT_TOPUP_CENTS,
   MAX_DEEPLINK_LENGTH: () => MAX_DEEPLINK_LENGTH,
@@ -5903,6 +6086,8 @@ __export(dist_exports, {
   isAddonType: () => isAddonType,
   isApiTest: () => isApiTest,
   isAppOriginResolutionEnabled: () => isAppOriginResolutionEnabled,
+  isAssetLikePath: () => isAssetLikePath,
+  isAuthProviderHost: () => isAuthProviderHost,
   isAuthReadinessGuardEnabled: () => isAuthReadinessGuardEnabled,
   isAuthTokenName: () => isAuthTokenName,
   isBlockedEnvVar: () => isBlockedEnvVar,
@@ -5987,6 +6172,7 @@ var init_dist = __esm({
     init_mobile_deeplink();
     init_plans();
     init_audit_pricing();
+    init_audit_grouping();
     init_discovery_har_decision();
     init_assertion_classifier();
     init_assertion_strength();
@@ -6003,6 +6189,8 @@ var init_dist = __esm({
     init_feature_flags();
     init_env_flags();
     init_analytics_url();
+    init_api_endpoint_hygiene();
+    init_auth_provider_hosts();
   }
 });
 
@@ -85221,6 +85409,7 @@ var require_api_call_redaction = __commonJS({
     exports.buildResponseExcerpt = buildResponseExcerpt;
     exports.isTextExcerptable = isTextExcerptable;
     exports.buildApiCallSummary = buildApiCallSummary2;
+    var shared_1 = (init_dist(), __toCommonJS(dist_exports));
     exports.STATIC_EXTENSIONS = /* @__PURE__ */ new Set([
       ".js",
       ".css",
@@ -85238,7 +85427,9 @@ var require_api_call_redaction = __commonJS({
       ".webp",
       ".avif",
       ".mp4",
-      ".webm"
+      ".webm",
+      ".lottie",
+      ".webmanifest"
     ]);
     exports.SECURITY_HEADER_NAMES = /* @__PURE__ */ new Set([
       // CORS & core security
@@ -85327,6 +85518,8 @@ var require_api_call_redaction = __commonJS({
           return false;
         if (path.includes("/api/") || path.includes("/graphql"))
           return true;
+        if (ext.toLowerCase() === ".json" && (0, shared_1.isAssetLikePath)(path))
+          return false;
         if (contentType?.includes("application/json"))
           return true;
         if (contentType?.includes("application/graphql"))
@@ -86881,6 +87074,7 @@ var require_playwright_native = __commonJS({
         runDir = (0, path_1.join)(RUNS_DIR, (0, crypto_1.randomUUID)());
         await (0, promises_1.mkdir)(runDir, { recursive: true });
         const isApiTest2 = playwrightCode.includes("@api") || playwrightCode.includes("{ request }") && !playwrightCode.includes("{ page");
+        const configBaseUrl = isApiTest2 && options.apiBaseUrl ? options.apiBaseUrl : baseUrl;
         const usesRealInboxWait = !isApiTest2 && (0, inbox_stamp_js_1.codeUsesInboxHelper)(playwrightCode);
         const selfProvisionsRegistration = !isApiTest2 && (0, inbox_stamp_js_1.codeSelfProvisionsRegistration)(playwrightCode);
         const effectiveStandingMode = isApiTest2 ? authStandingMode ?? "legacy-if-configured" : "none";
@@ -87084,7 +87278,7 @@ test.afterEach(async ({ page }, testInfo) => {
         if (!importMatch) {
           logs2.push("\u26A0 Could not find @playwright/test import - animation disabling NOT injected");
         }
-        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!baseUrl;
+        const useScopedApiHeaders = isApiTest2 && !!resolvedExtraHeaders && !!importMatch && !!configBaseUrl;
         const authDelivery = { standingHeadersConfigured: !!resolvedExtraHeaders, standingHeadersInjected: useScopedApiHeaders };
         if (resolvedExtraHeaders && !useScopedApiHeaders) {
           logs2.push("\u26A0 Standing API auth headers were configured but could not be installed origin-scoped \u2014 failing closed (no global fallback).");
@@ -87105,10 +87299,10 @@ test.afterEach(async ({ page }, testInfo) => {
         }
         await (0, promises_1.writeFile)((0, path_1.join)(runDir, "test.spec.ts"), instrumentedCode);
         if (useScopedApiHeaders && resolvedExtraHeaders) {
-          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, baseUrl));
+          await (0, promises_1.writeFile)((0, path_1.join)(runDir, "qa-api-fixtures.ts"), (0, api_auth_headers_js_1.buildOriginScopedApiFixtures)(resolvedExtraHeaders, configBaseUrl));
         }
         const headless = (0, shared_1.parseBoolFlag)(process.env.PLAYWRIGHT_HEADLESS) || process.env.NODE_ENV === "production" || IS_CLOUD2;
-        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(baseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}`);
+        logs2.push(`\u2699\uFE0F  Config: baseURL=${JSON.stringify(configBaseUrl)}, headless=${headless}${isApiTest2 ? ", API mode (no screenshot/video)" : ""}${configBaseUrl !== baseUrl ? ` (elected @api origin; app BASE_URL ${JSON.stringify(baseUrl)})` : ""}`);
         const absTestDir = runDir.replace(/\\/g, "/");
         const absResultsFile = (0, path_1.join)(runDir, "results.json").replace(/\\/g, "/");
         const absOutputDir = (0, path_1.join)(runDir, "test-results").replace(/\\/g, "/");
@@ -87132,7 +87326,7 @@ module.exports = {
   timeout: ${usesRealInboxWait ? 24e4 : 6e4},
   retries: 0,
   use: {
-    baseURL: ${JSON.stringify(baseUrl)},
+    baseURL: ${JSON.stringify(configBaseUrl)},
     ${storageStateLine}
     ${extraHeadersLine}
     browserName: 'chromium',
@@ -87192,6 +87386,9 @@ module.exports = {
           }
         }
         const childTestVariables = { ...testVariables ?? {} };
+        if (isApiTest2 && options.apiBaseUrl && !childTestVariables["API_BASE_URL"]) {
+          childTestVariables["API_BASE_URL"] = options.apiBaseUrl;
+        }
         const trustedRuntimeEnv = {
           ...isolation.env,
           // Generated callbacks receive only a random loopback capability. The global
@@ -350863,7 +351060,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.63",
+      version: "1.0.65",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"
@@ -358462,6 +358659,7 @@ async function executeRun(run2, opts, headers, requestLiveBrowserHeartbeat = ()
   const runNativeWithLiveBrowser = (nativeOptions) => (0, import_runner_core.executeTestViaNativePlaywright)({
     authStandingMode: authPlan.standingHeadersMode,
     storageStatePath: wrapperStorageStatePath,
+    apiBaseUrl: run2.apiBaseUrl,
     ...nativeOptions,
     liveBrowserHandle,
     onLiveBrowserSnapshot: requestLiveBrowserHeartbeat
@@ -358872,7 +359070,9 @@ ${finalVerifyResult.logs ?? ""}`;
             } else {
               const xo = resolveCrossOriginConfigOverride({
                 appOriginEnabled: isAppOriginResolutionEnabled(),
-                baseUrl: run2.baseUrl,
+                // An @api run anchored on an elected execution origin must be judged against THAT
+                // origin, or a correctly-anchored call reads as "wrong origin" (gate-review tweak).
+                baseUrl: run2.apiBaseUrl ?? run2.baseUrl,
                 composedError,
                 verdicts: enrichedSteps.map((s) => s.verdict),
                 apiCalls: rawSteps.flatMap((s) => s.apiCalls ?? []),
@@ -359459,13 +359659,14 @@ ${finalVerifyResult.logs ?? ""}`;
             }
           }
         }
+        const auditStatus = info.exitReason === "abort" || info.exitReason === "timeout" ? "ERROR" : "SUCCESS";
         pushAudit({
           projectId: ctx.projectId,
           sessionId: ctx.sessionId,
           callType: info.callType,
           model: info.model,
           provider: info.provider,
-          status: "SUCCESS",
+          status: auditStatus,
           durationMs: info.durationMs,
           promptTokens: info.promptTokens,
           completionTokens: info.completionTokens,
@@ -359482,6 +359683,11 @@ ${finalVerifyResult.logs ?? ""}`;
             discoveryFlowId: run2.runId,
             ...info.callType === "authCapture" ? { featureName: "Login" } : ctx.featureName ? { featureName: ctx.featureName } : {},
             ...ctx.mode ? { discoveryMode: ctx.mode } : {},
+            // Per-session identity for Call-2 rows (parity with execute-run.ts) so
+            // Fix/Author/Cleanup phases are distinguishable in the flow card.
+            ...info.scenarioName ? { scenarioName: info.scenarioName } : {},
+            ...info.sessionKind ? { sessionKind: info.sessionKind } : {},
+            ...info.exitReason ? { exitReason: info.exitReason } : {},
             ...cliCostUsd !== void 0 ? { cliCostUsd } : {},
             ...ledgerAudit ? {
               ledger: ledgerAudit.entries,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.63",
+  "version": "1.0.65",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"