fix: harden GoPay and 5sim PR paths

tests/background-step-registry.test.js

@@ -8,6 +8,11 @@ test('background imports step registry and shared step definitions', () => {
   assert.match(source, /data\/step-definitions\.js/);
   assert.match(source, /MultiPageStepDefinitions\?\.getSteps/);
   assert.match(source, /getStepRegistryForState\(state\)/);
+  assert.match(source, /PLUS_PAYPAL_STEP_DEFINITIONS/);
+  assert.match(source, /PLUS_GOPAY_STEP_DEFINITIONS/);
+  assert.match(source, /plusPayPalStepRegistry/);
+  assert.match(source, /plusGoPayStepRegistry/);
+  assert.match(source, /normalizePlusPaymentMethod\(state\?\.plusPaymentMethod\) === PLUS_PAYMENT_METHOD_GOPAY/);
   assert.match(source, /activeStepRegistry\.executeStep\(step,\s*\{/);
   assert.match(source, /background\/steps\/create-plus-checkout\.js/);
   assert.match(source, /background\/steps\/fill-plus-checkout\.js/);

tests/five-sim-provider.test.js

@@ -127,9 +127,9 @@ test('5sim provider buys, checks, finishes, cancels, bans, and reuses activation
   );
 });
 
-test('5sim provider prefers buy-compatible products price over operator detail price', async () => {
-  const requests = [];
-  const provider = api.createProvider({
+test('5sim provider prefers buy-compatible products price over operator detail price', async () => {
+  const requests = [];
+  const provider = api.createProvider({
     fetchImpl: async (url, options = {}) => {
       const parsed = new URL(url);
       requests.push({ url: parsed, options });
@@ -172,11 +172,35 @@ test('5sim provider prefers buy-compatible products price over operator detail p
       '/v1/guest/prices',
       '/v1/user/buy/activation/vietnam/any/openai',
     ]
-  );
-});
-
-test('5sim provider reports raw buy payload when HTTP 200 response has no activation', async () => {
-  const provider = api.createProvider({
+  );
+});
+
+test('5sim provider rejects maxPrice with custom operator before buying', async () => {
+  const requests = [];
+  const provider = api.createProvider({
+    fetchImpl: async (url) => {
+      requests.push(url);
+      throw new Error(`unexpected request ${url}`);
+    },
+    sleepWithStop: async () => {},
+    throwIfStopped: () => {},
+  });
+
+  await assert.rejects(
+    () => provider.requestActivation({
+      fiveSimApiKey: 'demo-key',
+      fiveSimCountryId: 'vietnam',
+      fiveSimCountryLabel: '瓒婂崡 (Vietnam)',
+      fiveSimMaxPrice: '12',
+      fiveSimOperator: 'virtual21',
+    }),
+    /maxPrice only works when operator is "any"/
+  );
+  assert.deepStrictEqual(requests, []);
+});
+
+test('5sim provider reports raw buy payload when HTTP 200 response has no activation', async () => {
+  const provider = api.createProvider({
     fetchImpl: async (url) => {
       const parsed = new URL(url);
       if (parsed.pathname === '/v1/guest/products/vietnam/any') {

tests/gopay-approve-source.test.js

@@ -69,7 +69,16 @@ test('GoPay approve handles final payment details iframe as an action frame', ()
   assert.match(source, /最终 Bayar 确认/);
 });
 
-test('GoPay approve treats merchant validate-pin iframe as PIN entry frame', () => {
+test('GoPay debugger click does not reuse iframe-relative rects as top-level coordinates', () => {
+  const body = extractFunction('clickGoPayTargetWithDebugger');
+  assert.match(body, /Number\.isInteger\(frameId\)/);
+  assert.match(body, /debugger_click_skipped_for_frame_target/);
+  assert.ok(
+    body.indexOf('debugger_click_skipped_for_frame_target') < body.indexOf('clickWithDebugger(tabId, rect)')
+  );
+});
+
+test('GoPay approve treats merchant validate-pin iframe as PIN entry frame', () => {
   assert.match(source, /GOPAY_PIN_FRAME_URL_PATTERN/);
   assert.match(source, /payment\\\/validate-pin/);
   assert.match(source, /kind: 'pin'/);

tests/phone-verification-flow.test.js

@@ -969,6 +969,43 @@ test('phone verification helper acquires a number from 5sim with fallback countr
   assert.equal(requests[3].pathname, '/v1/user/buy/activation/england/any/openai');
 });
 
+test('phone verification helper rejects 5sim maxPrice with custom operator before buying', async () => {
+  const requests = [];
+  const helpers = api.createPhoneVerificationHelpers({
+    addLog: async () => {},
+    ensureStep8SignupPageReady: async () => {},
+    fetchImpl: async (url) => {
+      requests.push(url);
+      throw new Error(`Unexpected 5sim request: ${url}`);
+    },
+    getState: async () => ({
+      phoneSmsProvider: '5sim',
+      fiveSimApiKey: 'five-token',
+      fiveSimCountryOrder: ['vietnam'],
+      fiveSimOperator: 'virtual21',
+      fiveSimMaxPrice: '0.1',
+      heroSmsActivationRetryRounds: 1,
+    }),
+    sendToContentScriptResilient: async () => ({}),
+    setState: async () => {},
+    sleepWithStop: async () => {},
+    throwIfStopped: () => {},
+  });
+
+  await assert.rejects(
+    () => helpers.requestPhoneActivation({
+      phoneSmsProvider: '5sim',
+      fiveSimApiKey: 'five-token',
+      fiveSimCountryOrder: ['vietnam'],
+      fiveSimOperator: 'virtual21',
+      fiveSimMaxPrice: '0.1',
+      heroSmsActivationRetryRounds: 1,
+    }),
+    /maxPrice only works when operator is "any"/
+  );
+  assert.deepStrictEqual(requests, []);
+});
+
 test('phone verification helper honors price-priority ordering for 5sim countries', async () => {
   const requests = [];
   const helpers = api.createPhoneVerificationHelpers({