@validate.qa/runner 1.0.65 → 1.0.66

package/dist/cli.js

@@ -73624,6 +73624,7 @@ var require_inbox_tools = __commonJS({
     exports2.buildInboxPromptBlock = buildInboxPromptBlock;
     exports2.guardVerificationCodeFabrication = guardVerificationCodeFabrication;
     exports2.hasRegisterIntent = hasRegisterIntent;
+    exports2.hasSignupTestIntent = hasSignupTestIntent;
     exports2.resolveInboxRegistration = resolveInboxRegistration;
     exports2.applyInboxRegistrationIdentity = applyInboxRegistrationIdentity;
     exports2.isThrowawayRegisterSeedEmail = isThrowawayRegisterSeedEmail;
@@ -74167,6 +74168,9 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       const v = variableContext.allTestVariables?.DISCOVERY_SHOULD_REGISTER ?? variableContext.publicTestVariables?.DISCOVERY_SHOULD_REGISTER ?? "";
       return String(v).trim().toLowerCase() === "true";
     }
+    function hasSignupTestIntent(variableContext) {
+      return variableContext?.allTestVariables?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
     function resolveInboxRegistration(opts) {
       const config = (0, verification_inbox_js_1.loadVerificationInboxConfig)(opts.env ?? process.env);
       if (!config)
@@ -95115,6 +95119,8 @@ var require_discover_generator = __commonJS({
     Object.defineProperty(exports2, "__esModule", { value: true });
     exports2.MIN_BUG_DESCRIPTION_LENGTH = exports2.VALID_PLAYWRIGHT_GETBY_METHODS = exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports2.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
+    exports2.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
+    exports2.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
     exports2.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports2.detectScenarioSignals = detectScenarioSignals;
     exports2.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -95202,6 +95208,19 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
+    function signupFeatureTestingAllowed(credentials) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
+        return false;
+      return credentials?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
+    var SIGNUP_AUTH_ROUTE_RE = /\/(sign-?up|verify-?email|email-?verification|create-?account|confirm-?email)\b/i;
+    function scenarioTouchesSignupAuthSurface(scenario, pages) {
+      const routes = [scenario.entryRoute, ...scenario.targetPages ?? []].filter((r) => !!r);
+      if (routes.some((r) => SIGNUP_AUTH_ROUTE_RE.test(r)))
+        return true;
+      const authRoutes = new Set(pages.filter((p) => (p.pageType ?? "").toUpperCase() === "AUTH").map((p) => p.route));
+      return routes.some((r) => authRoutes.has(r));
+    }
     exports2.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -98313,9 +98332,16 @@ ${tailBlock}`;
           extraAuthEvidence: !!opts?.recipe || hasConfiguredLoginCredentials(credentials)
         });
         const baseSkeletonHadRegression = tags.includes("@regression");
+        const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+        if (selfProvisioningSignupScenario) {
+          for (const prereqTag of ["@needs-auth", "@inline-login", "@auth-guarded"]) {
+            const idx = tags.indexOf(prereqTag);
+            if (idx !== -1)
+              tags.splice(idx, 1);
+          }
+        }
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
-        const projectHasRegisterIntent = credentials?.DISCOVERY_SHOULD_REGISTER === "true";
-        const inboxGenConfig = (0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() && projectHasRegisterIntent && !hasVerifiedRecipe && scenarioLooksLikeRegistration(scenario) ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
+        const inboxGenConfig = selfProvisioningSignupScenario ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
         let genInboxState = null;
         let genInboxCredentials = credentials;
         let genInboxSecret = null;
@@ -99262,7 +99288,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             } catch {
             }
             const recipe = authRecipe;
-            const replayLogin = shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
+            const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+            const replayLogin = !selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
             let effectiveRecipe = null;
             if (replayLogin && recipe) {
               const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(recipe.replayPlan ?? []), credentials);
@@ -99369,7 +99396,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             return;
           }
           let effectiveRecipe = null;
-          if (shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
+          const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+          if (!selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
             const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(authRecipe.replayPlan ?? []), credentials);
             if (planLeaks.length > 0) {
               scenarioLogs.push(`  Warning: login replay plan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login for "${scenario.name}"`);
@@ -335170,6 +335198,7 @@ var require_discover_agent = __commonJS({
     var discover_ai_planner_js_1 = require_discover_ai_planner();
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     var verification_inbox_js_1 = require_verification_inbox();
+    var inbox_tools_js_1 = require_inbox_tools();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports2, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -335183,11 +335212,16 @@ var require_discover_agent = __commonJS({
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
     function plannerEmailVerifyArmed(ctx) {
-      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
-        return false;
-      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
         return false;
-      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+      return (0, inbox_tools_js_1.hasSignupTestIntent)(ctx.variableContext);
+    }
+    var PLANNER_AUTH_NAME_RE = /\b(auth|authentication|log[\s-]?in|sign[\s-]?in|sign[\s-]?up|signup|account|password|verify[\s-]?email)\b/i;
+    var PLANNER_AUTH_ROUTE_RE = /\/(auth|login|sign-?in|sign-?up|signup|verify-?email|create-?account)\b/i;
+    function featureLooksLikeAuth(featureName, focusRoutes) {
+      if (featureName && PLANNER_AUTH_NAME_RE.test(featureName))
+        return true;
+      return (focusRoutes ?? []).some((r) => PLANNER_AUTH_ROUTE_RE.test(r));
     }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
@@ -335839,6 +335873,11 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           // Email-verify capability — only for scenario-producing modes; a survey emits
           // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          // This site serves survey + FULL mode. Full mode is app-wide (no single feature
+          // identity here), so we deliberately do NOT apply the auth-feature scope: the
+          // per-scenario generator gates (scenarioLooksLikeRegistration +
+          // scenarioTouchesSignupAuthSurface) still isolate non-auth scenarios. The
+          // auth-feature scope IS applied at the DEEP call site where ctx.featureName is known.
           emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
@@ -336427,9 +336466,10 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // Email-verify capability: when armed, let the planner plan the full
             // register→verify and forgot-password→reset round trips to completion
             // (see the planner's "## Verification Inbox Available" block). Armed on the
-            // SAME project-level predicate the generator uses (flag + register intent +
+            // SAME project-level predicate the generator uses (flag + consent +
             // configured inbox), so the planner never promises what generation can't do.
-            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
+            // Scoped to AUTH features: a non-auth feature has no signup surface to test.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx) && featureLooksLikeAuth(ctx.featureName, augmentedFeatureFocusAreas),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -351055,7 +351095,7 @@ var require_package4 = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.65",
+      version: "1.0.66",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/dist/cli.mjs

@@ -73629,6 +73629,7 @@ var require_inbox_tools = __commonJS({
     exports.buildInboxPromptBlock = buildInboxPromptBlock;
     exports.guardVerificationCodeFabrication = guardVerificationCodeFabrication;
     exports.hasRegisterIntent = hasRegisterIntent;
+    exports.hasSignupTestIntent = hasSignupTestIntent;
     exports.resolveInboxRegistration = resolveInboxRegistration;
     exports.applyInboxRegistrationIdentity = applyInboxRegistrationIdentity;
     exports.isThrowawayRegisterSeedEmail = isThrowawayRegisterSeedEmail;
@@ -74172,6 +74173,9 @@ This project asked to REGISTER a new account, but this runner CANNOT receive ema
       const v = variableContext.allTestVariables?.DISCOVERY_SHOULD_REGISTER ?? variableContext.publicTestVariables?.DISCOVERY_SHOULD_REGISTER ?? "";
       return String(v).trim().toLowerCase() === "true";
     }
+    function hasSignupTestIntent(variableContext) {
+      return variableContext?.allTestVariables?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
     function resolveInboxRegistration(opts) {
       const config = (0, verification_inbox_js_1.loadVerificationInboxConfig)(opts.env ?? process.env);
       if (!config)
@@ -95120,6 +95124,8 @@ var require_discover_generator = __commonJS({
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.MIN_BUG_DESCRIPTION_LENGTH = exports.VALID_PLAYWRIGHT_GETBY_METHODS = exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = void 0;
     exports.scenarioLooksLikeRegistration = scenarioLooksLikeRegistration;
+    exports.signupFeatureTestingAllowed = signupFeatureTestingAllowed;
+    exports.scenarioTouchesSignupAuthSurface = scenarioTouchesSignupAuthSurface;
     exports.filterMcpToolsForScenarioGen = filterMcpToolsForScenarioGen;
     exports.detectScenarioSignals = detectScenarioSignals;
     exports.scenarioStepsCoverAuth = scenarioStepsCoverAuth;
@@ -95207,6 +95213,19 @@ EMIT (the code you put in finish_generate) \u2014 do NOT hardcode the throwaway
 - Tag the test \`@email-verify\`. Emit EXACTLY ONE test() in this file (one registration per run).
 - End with a DURABLE assertion of the post-verification signed-in state (e.g. a Logout control, an account/dashboard landmark) in your OWN test body \u2014 the helper call is not itself a proof.`;
     }
+    function signupFeatureTestingAllowed(credentials) {
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
+        return false;
+      return credentials?.DISCOVERY_ALLOW_SIGNUP_TESTS !== "false";
+    }
+    var SIGNUP_AUTH_ROUTE_RE = /\/(sign-?up|verify-?email|email-?verification|create-?account|confirm-?email)\b/i;
+    function scenarioTouchesSignupAuthSurface(scenario, pages) {
+      const routes = [scenario.entryRoute, ...scenario.targetPages ?? []].filter((r) => !!r);
+      if (routes.some((r) => SIGNUP_AUTH_ROUTE_RE.test(r)))
+        return true;
+      const authRoutes = new Set(pages.filter((p) => (p.pageType ?? "").toUpperCase() === "AUTH").map((p) => p.route));
+      return routes.some((r) => authRoutes.has(r));
+    }
     exports.BLOCKED_MCP_TOOLS_SCENARIO_GEN = /* @__PURE__ */ new Set([
       "browser_install",
       "browser_close",
@@ -98318,9 +98337,16 @@ ${tailBlock}`;
           extraAuthEvidence: !!opts?.recipe || hasConfiguredLoginCredentials(credentials)
         });
         const baseSkeletonHadRegression = tags.includes("@regression");
+        const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+        if (selfProvisioningSignupScenario) {
+          for (const prereqTag of ["@needs-auth", "@inline-login", "@auth-guarded"]) {
+            const idx = tags.indexOf(prereqTag);
+            if (idx !== -1)
+              tags.splice(idx, 1);
+          }
+        }
         const hasVerifiedRecipe = !!opts?.recipe && tags.includes("@needs-auth");
-        const projectHasRegisterIntent = credentials?.DISCOVERY_SHOULD_REGISTER === "true";
-        const inboxGenConfig = (0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() && projectHasRegisterIntent && !hasVerifiedRecipe && scenarioLooksLikeRegistration(scenario) ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
+        const inboxGenConfig = selfProvisioningSignupScenario ? (0, verification_inbox_js_1.loadVerificationInboxConfig)() : null;
         let genInboxState = null;
         let genInboxCredentials = credentials;
         let genInboxSecret = null;
@@ -99267,7 +99293,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             } catch {
             }
             const recipe = authRecipe;
-            const replayLogin = shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
+            const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+            const replayLogin = !selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, recipe);
             let effectiveRecipe = null;
             if (replayLogin && recipe) {
               const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(recipe.replayPlan ?? []), credentials);
@@ -99374,7 +99401,8 @@ Scenario: "${scenario.name}" (${scenario.type})`);
             return;
           }
           let effectiveRecipe = null;
-          if (shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
+          const selfProvisioningSignupScenario = signupFeatureTestingAllowed(credentials) && scenarioLooksLikeRegistration(scenario) && scenarioTouchesSignupAuthSurface(scenario, siteMap.pages);
+          if (!selfProvisioningSignupScenario && shouldReplayAuthRecipe(scenario.targetPages, siteMap.pages, authRecipe) && authRecipe) {
             const planLeaks = findSensitiveLiteralLeaks(JSON.stringify(authRecipe.replayPlan ?? []), credentials);
             if (planLeaks.length > 0) {
               scenarioLogs.push(`  Warning: login replay plan contains literal credential value(s) for ${planLeaks.join(", ")} \u2014 falling back to model-authored login for "${scenario.name}"`);
@@ -335175,6 +335203,7 @@ var require_discover_agent = __commonJS({
     var discover_ai_planner_js_1 = require_discover_ai_planner();
     var discovery_lint_flags_js_1 = require_discovery_lint_flags();
     var verification_inbox_js_1 = require_verification_inbox();
+    var inbox_tools_js_1 = require_inbox_tools();
     var sitemap_builder_js_1 = require_sitemap_builder();
     Object.defineProperty(exports, "buildInMemorySiteMap", { enumerable: true, get: function() {
       return sitemap_builder_js_1.buildInMemorySiteMap;
@@ -335188,11 +335217,16 @@ var require_discover_agent = __commonJS({
     var canvas_detector_js_1 = require_canvas_detector();
     var auth_recipe_js_1 = require_auth_recipe();
     function plannerEmailVerifyArmed(ctx) {
-      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)())
-        return false;
-      if (ctx.variableContext?.allTestVariables?.DISCOVERY_SHOULD_REGISTER !== "true")
+      if (!(0, discovery_lint_flags_js_1.isTestgenEmailVerifyEnabled)() || !(0, verification_inbox_js_1.loadVerificationInboxConfig)())
         return false;
-      return (0, verification_inbox_js_1.isVerificationInboxConfigured)();
+      return (0, inbox_tools_js_1.hasSignupTestIntent)(ctx.variableContext);
+    }
+    var PLANNER_AUTH_NAME_RE = /\b(auth|authentication|log[\s-]?in|sign[\s-]?in|sign[\s-]?up|signup|account|password|verify[\s-]?email)\b/i;
+    var PLANNER_AUTH_ROUTE_RE = /\/(auth|login|sign-?in|sign-?up|signup|verify-?email|create-?account)\b/i;
+    function featureLooksLikeAuth(featureName, focusRoutes) {
+      if (featureName && PLANNER_AUTH_NAME_RE.test(featureName))
+        return true;
+      return (focusRoutes ?? []).some((r) => PLANNER_AUTH_ROUTE_RE.test(r));
     }
     async function runCanvasPreflight(ctx, sharedBrowser, log2) {
       const cached = ctx.appRenderType ?? null;
@@ -335844,6 +335878,11 @@ Explore complete: ${exploreResult.pagesDiscovered} pages, ${exploreResult.elemen
           authRedirectRoute: (0, shared_1.parseBoolFlag)(process.env.AUTH_RECIPE_STAMP) ? ctx.authRecipe?.redirectRoute ?? void 0 : void 0,
           // Email-verify capability — only for scenario-producing modes; a survey emits
           // featureGroups (no scenarios), so keep its prompt free of the round-trip block.
+          // This site serves survey + FULL mode. Full mode is app-wide (no single feature
+          // identity here), so we deliberately do NOT apply the auth-feature scope: the
+          // per-scenario generator gates (scenarioLooksLikeRegistration +
+          // scenarioTouchesSignupAuthSurface) still isolate non-auth scenarios. The
+          // auth-feature scope IS applied at the DEEP call site where ctx.featureName is known.
           emailVerifyArmed: mode !== "survey" && plannerEmailVerifyArmed(ctx),
           testBudget
         }, {
@@ -336432,9 +336471,10 @@ Plan (reused): ${resumeSavedScenarios.length} scenarios from the paused run.`);
             // Email-verify capability: when armed, let the planner plan the full
             // register→verify and forgot-password→reset round trips to completion
             // (see the planner's "## Verification Inbox Available" block). Armed on the
-            // SAME project-level predicate the generator uses (flag + register intent +
+            // SAME project-level predicate the generator uses (flag + consent +
             // configured inbox), so the planner never promises what generation can't do.
-            emailVerifyArmed: plannerEmailVerifyArmed(ctx),
+            // Scoped to AUTH features: a non-auth feature has no signup surface to test.
+            emailVerifyArmed: plannerEmailVerifyArmed(ctx) && featureLooksLikeAuth(ctx.featureName, augmentedFeatureFocusAreas),
             testBudget: featureTestBudget
           }, {
             modelOverride: ctx.planModel ?? ctx.generateModel,
@@ -351060,7 +351100,7 @@ var require_package4 = __commonJS({
   "package.json"(exports, module) {
     module.exports = {
       name: "@validate.qa/runner",
-      version: "1.0.65",
+      version: "1.0.66",
       description: "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
       bin: {
         "validate-runner": "dist/cli.js"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@validate.qa/runner",
-  "version": "1.0.65",
+  "version": "1.0.66",
   "description": "validate local test runner - execute Playwright tests on your machine, connected to validate.qa cloud.",
   "bin": {
     "validate-runner": "dist/cli.js"