Sync public tree to bc3642c

scripts/cli-first-contract-smoke.js

@@ -76,6 +76,21 @@ expect(
   "hosted signup provider and password policy criteria",
   /approved external identity-provider requirement[\s\S]*disasmer_native_password_signup_allowed: false/
 );
+expect(
+  criteria,
+  "hosted provider normalization criteria",
+  /Google sign-in may be treated as OIDC; GitHub sign-in is OAuth2 social login[\s\S]*normalizes Google as `google_oidc` and GitHub as `github_oauth2` from an Authentik-issued OIDC session[\s\S]*does not consume provider-specific tokens directly/
+);
+expect(
+  criteria,
+  "hosted CLI cannot create accounts directly",
+  /The CLI cannot create a hosted account directly[\s\S]*parser coverage rejects `disasmer signup`, `disasmer account create`, and `disasmer login --create-account`/
+);
+expect(
+  criteria,
+  "hosted safe claim failure criteria",
+  /If identity is ambiguous, missing required claims, unverified where required, or blocked by policy[\s\S]*exactly one approved external identity provider[\s\S]*stable subject[\s\S]*verified email/
+);
 expect(
   criteria,
   "hosted signup sanitized failure criteria",