Email verification

Most signup and login flows have a step that leaves the browser: a verification email lands somewhere else, and the user has to go get the link or code. Suites that stub the email service jump straight to the "verified" state and never test the part that actually breaks — the wrong sending domain, the dead link in the template, the rate limiter that silently drops the second send.

Record it once, replay against a real inbox

Add an email step to any recording. Under the hood it drives Mailsac — any *@mailsac.com address works with no account. The {{testEmail}} template variable mints a fresh inbox for every replay, so parallel runs never collide.

The step polls that inbox every 2.5 seconds, up to a 60-second ceiling, and can do three things once mail arrives:

• getCode — pull a one-time code out of the body with a regex and drop it into the next input.
• getLink — extract a specific link by index.
• clickLink — follow the first (or matching) link the message contains.

Links are matched against the plain-text part of the message and trailing punctuation is stripped, so "click here." never becomes part of the URL.

What it catches that mocks don't

• A verification email that never sends because a background queue is stalled.
• A link pointing at the wrong environment — a staging URL shipped in a production email.
• A code that expires before your polling window, which tells you the window is too short or the expiry too aggressive.

None of these are exotic. They're the failures that stay green in every stubbed suite and only surface when a real user hits them.