@hasna/testers 0.0.47 → 0.0.49

package/dist/cli/index.js

@@ -27025,12 +27025,60 @@ function listTestingWorkflows(filter) {
   const rows = db2.query(`SELECT * FROM testing_workflows${where} ORDER BY created_at DESC`).all(...params);
   return rows.map(workflowFromRow);
 }
+function updateTestingWorkflow(id, input) {
+  const existing = getTestingWorkflow(id);
+  if (!existing)
+    throw new Error(`Testing workflow not found: ${id}`);
+  const fields = [];
+  const values = [];
+  if (input.name !== undefined) {
+    fields.push("name = ?");
+    values.push(input.name);
+  }
+  if (input.description !== undefined) {
+    fields.push("description = ?");
+    values.push(input.description);
+  }
+  if (input.scenarioFilter !== undefined) {
+    fields.push("scenario_filter = ?");
+    values.push(JSON.stringify(normalizeFilter(input.scenarioFilter)));
+  }
+  if (input.personaIds !== undefined) {
+    fields.push("persona_ids = ?");
+    values.push(JSON.stringify(input.personaIds));
+  }
+  if (input.goal !== undefined) {
+    fields.push("goal = ?");
+    values.push(JSON.stringify(normalizeGoal(input.goal)));
+  }
+  if (input.execution !== undefined) {
+    fields.push("execution = ?");
+    values.push(JSON.stringify(normalizeExecution(input.execution)));
+  }
+  if (input.settings !== undefined) {
+    fields.push("settings = ?");
+    values.push(JSON.stringify(input.settings));
+  }
+  if (input.enabled !== undefined) {
+    fields.push("enabled = ?");
+    values.push(input.enabled ? 1 : 0);
+  }
+  if (fields.length === 0)
+    return existing;
+  fields.push("updated_at = ?");
+  values.push(now(), existing.id);
+  db2().query(`UPDATE testing_workflows SET ${fields.join(", ")} WHERE id = ?`).run(...values);
+  return getTestingWorkflow(existing.id);
+}
 function deleteTestingWorkflow(id) {
   const existing = getTestingWorkflow(id);
   if (!existing)
     return false;
   return getDatabase().query("DELETE FROM testing_workflows WHERE id = ?").run(existing.id).changes > 0;
 }
+function db2() {
+  return getDatabase();
+}
 var DEFAULT_EXECUTION;
 var init_workflows = __esm(() => {
   init_types();
@@ -27293,6 +27341,13 @@ function resolveSandboxEnv(env) {
     return;
   const resolved = {};
   for (const [key, value] of Object.entries(env)) {
+    if (value.startsWith("$?")) {
+      const optionalName = value.slice(2).trim();
+      const optionalValue = optionalName ? process.env[optionalName] : undefined;
+      if (optionalValue !== undefined)
+        resolved[key] = optionalValue;
+      continue;
+    }
     const resolvedValue = resolveCredential(value);
     if (resolvedValue === null) {
       throw new Error(`Missing sandbox env value for ${key}`);
@@ -27326,6 +27381,8 @@ var init_workflow_runner = __esm(() => {
     ".next",
     ".turbo",
     ".cache",
+    ".env",
+    ".env.*",
     ".venv",
     "__pycache__"
   ];
@@ -27479,46 +27536,46 @@ __export(exports_sessions, {
   countSessions: () => countSessions
 });
 function createSession(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = input.sessionId ?? uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO sessions (id, tab_id, url, title, entries, entry_count, error_count, console_count, nav_count, status, start_time, end_time, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.tabId, input.url ?? null, input.title ?? null, input.entries, input.entryCount, input.errorCount ?? 0, input.consoleCount ?? 0, input.navCount ?? 0, input.status, input.startTime, input.endTime ?? null, timestamp);
   return getSession(id);
 }
 function getSession(id) {
-  const db2 = getDatabase();
-  let row = db2.query("SELECT * FROM sessions WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  let row = db3.query("SELECT * FROM sessions WHERE id = ?").get(id);
   if (row)
     return sessionFromRow(row);
   const fullId = resolvePartialId("sessions", id);
   if (fullId) {
-    row = db2.query("SELECT * FROM sessions WHERE id = ?").get(fullId);
+    row = db3.query("SELECT * FROM sessions WHERE id = ?").get(fullId);
     if (row)
       return sessionFromRow(row);
   }
   return null;
 }
 function listSessions(limit = 50, offset = 0) {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ? OFFSET ?").all(limit, offset);
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM sessions ORDER BY created_at DESC LIMIT ? OFFSET ?").all(limit, offset);
   return rows.map(sessionFromRow);
 }
 function deleteSession(id) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM sessions WHERE id = ?").run(id);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM sessions WHERE id = ?").run(id);
   return result.changes > 0;
 }
 function searchSessions(query, limit = 20) {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM sessions WHERE url LIKE ? OR title LIKE ? ORDER BY created_at DESC LIMIT ?").all(`%${query}%`, `%${query}%`, limit);
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM sessions WHERE url LIKE ? OR title LIKE ? ORDER BY created_at DESC LIMIT ?").all(`%${query}%`, `%${query}%`, limit);
   return rows.map(sessionFromRow);
 }
 function countSessions() {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT COUNT(*) as count FROM sessions").get();
+  const db3 = getDatabase();
+  const row = db3.query("SELECT COUNT(*) as count FROM sessions").get();
   return row.count;
 }
 function sessionFromRow(row) {
@@ -28046,8 +28103,8 @@ function customRandom(alphabet, defaultSize, getRandom) {
 function customAlphabet(alphabet, size = 21) {
   return customRandom(alphabet, size, random);
 }
-function runMigrations(db2) {
-  db2.run(`
+function runMigrations(db3) {
+  db3.run(`
     CREATE TABLE IF NOT EXISTS _migrations (
       id INTEGER PRIMARY KEY,
       applied_at TEXT NOT NULL DEFAULT (datetime('now'))
@@ -28055,9 +28112,9 @@ function runMigrations(db2) {
   `);
   for (let i = 0;i < MIGRATIONS2.length; i++) {
     const migrationId = i + 1;
-    const exists = db2.query("SELECT id FROM _migrations WHERE id = ?").get(migrationId);
+    const exists = db3.query("SELECT id FROM _migrations WHERE id = ?").get(migrationId);
     if (!exists) {
-      db2.run(MIGRATIONS2[i]);
+      db3.run(MIGRATIONS2[i]);
     }
   }
 }
@@ -28082,11 +28139,11 @@ function ensureDir2(filePath) {
 function getDatabase2(path) {
   if (path) {
     ensureDir2(path);
-    const db2 = new Database4(path);
-    db2.run("PRAGMA journal_mode=WAL");
-    db2.run("PRAGMA foreign_keys=ON");
-    runMigrations(db2);
-    return db2;
+    const db3 = new Database4(path);
+    db3.run("PRAGMA journal_mode=WAL");
+    db3.run("PRAGMA foreign_keys=ON");
+    runMigrations(db3);
+    return db3;
   }
   if (!_db) {
     const dbPath = getDbPath2();
@@ -28154,8 +28211,8 @@ function rowToWorkdir(row) {
 function getMachineId() {
   return process.env["HOSTNAME"] || hostname();
 }
-function addWorkdir(input, db2) {
-  const d = db2 || getDatabase2();
+function addWorkdir(input, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(input.project_id, d);
   if (!project)
     throw new ProjectNotFoundError(input.project_id);
@@ -28172,18 +28229,18 @@ function addWorkdir(input, db2) {
      ON CONFLICT(project_id, path) DO UPDATE SET label = excluded.label, machine_id = excluded.machine_id`, [id, input.project_id, input.path, machineId, input.label ?? "main", isPrimary, ts]);
   return getWorkdir(input.project_id, input.path, d);
 }
-function getWorkdir(projectId, path, db2) {
-  const d = db2 || getDatabase2();
+function getWorkdir(projectId, path, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM project_workdirs WHERE project_id = ? AND path = ?").get(projectId, path);
   return row ? rowToWorkdir(row) : null;
 }
-function listWorkdirs(projectId, db2) {
-  const d = db2 || getDatabase2();
+function listWorkdirs(projectId, db3) {
+  const d = db3 || getDatabase2();
   const rows = d.query("SELECT * FROM project_workdirs WHERE project_id = ? ORDER BY is_primary DESC, created_at ASC").all(projectId);
   return rows.map(rowToWorkdir);
 }
-function removeWorkdir(projectId, path, db2) {
-  const d = db2 || getDatabase2();
+function removeWorkdir(projectId, path, db3) {
+  const d = db3 || getDatabase2();
   d.run("DELETE FROM project_workdirs WHERE project_id = ? AND path = ?", [projectId, path]);
 }
 function generateProjectId() {
@@ -28201,11 +28258,11 @@ function scaffoldProject(path) {
     mkdirSync32(join42(path, dir), { recursive: true });
   }
 }
-function ensureUniqueSlug(base, db2, excludeId) {
+function ensureUniqueSlug(base, db3, excludeId) {
   let candidate = base;
   let suffix = 1;
   while (true) {
-    const row = db2.query("SELECT id FROM projects WHERE slug = ?").get(candidate);
+    const row = db3.query("SELECT id FROM projects WHERE slug = ?").get(candidate);
     if (!row || row.id === excludeId)
       return candidate;
     suffix++;
@@ -28221,8 +28278,8 @@ function rowToProject(row) {
     last_opened_at: row.last_opened_at ?? null
   };
 }
-function createProject2(input, db2) {
-  const d = db2 || getDatabase2();
+function createProject2(input, db3) {
+  const d = db3 || getDatabase2();
   const id = generateProjectId();
   const ts = now2();
   const baseSlug = input.slug || slugify2(input.name);
@@ -28257,23 +28314,23 @@ function createProject2(input, db2) {
   }
   return getProject2(id, d);
 }
-function getProject2(id, db2) {
-  const d = db2 || getDatabase2();
+function getProject2(id, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE id = ?").get(id);
   return row ? rowToProject(row) : null;
 }
-function getProjectBySlug(slug, db2) {
-  const d = db2 || getDatabase2();
+function getProjectBySlug(slug, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE slug = ?").get(slug);
   return row ? rowToProject(row) : null;
 }
-function getProjectByPath2(path, db2) {
-  const d = db2 || getDatabase2();
+function getProjectByPath2(path, db3) {
+  const d = db3 || getDatabase2();
   const row = d.query("SELECT * FROM projects WHERE path = ?").get(path);
   return row ? rowToProject(row) : null;
 }
-function listProjects2(filter = {}, db2) {
-  const d = db2 || getDatabase2();
+function listProjects2(filter = {}, db3) {
+  const d = db3 || getDatabase2();
   const conditions = [];
   const params = [];
   if (filter.status) {
@@ -28292,8 +28349,8 @@ function listProjects2(filter = {}, db2) {
   }
   return rows.map(rowToProject);
 }
-function updateProject(id, input, db2) {
-  const d = db2 || getDatabase2();
+function updateProject(id, input, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28342,8 +28399,8 @@ function updateProject(id, input, db2) {
   d.run(`UPDATE projects SET ${sets.join(", ")} WHERE id = ?`, params);
   return getProject2(id, d);
 }
-function setIntegrations(id, integrations, db2) {
-  const d = db2 || getDatabase2();
+function setIntegrations(id, integrations, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28363,16 +28420,16 @@ function setIntegrations(id, integrations, db2) {
   } catch {}
   return getProject2(id, d);
 }
-function archiveProject(id, db2) {
-  const d = db2 || getDatabase2();
+function archiveProject(id, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
   d.run("UPDATE projects SET status = 'archived', updated_at = ? WHERE id = ?", [now2(), id]);
   return getProject2(id, d);
 }
-function unarchiveProject(id, db2) {
-  const d = db2 || getDatabase2();
+function unarchiveProject(id, db3) {
+  const d = db3 || getDatabase2();
   const project = getProject2(id, d);
   if (!project)
     throw new ProjectNotFoundError(id);
@@ -28389,8 +28446,8 @@ function levenshtein(a, b) {
       dp[i][j] = a[i - 1] === b[j - 1] ? dp[i - 1][j - 1] : 1 + Math.min(dp[i - 1][j], dp[i][j - 1], dp[i - 1][j - 1]);
   return dp[m][n];
 }
-function resolveProject(idOrSlug, db2) {
-  const d = db2 || getDatabase2();
+function resolveProject(idOrSlug, db3) {
+  const d = db3 || getDatabase2();
   let project = getProject2(idOrSlug, d);
   if (project)
     return project;
@@ -28413,22 +28470,22 @@ function resolveProject(idOrSlug, db2) {
 function syncRowToLog(row) {
   return { ...row, direction: row.direction, status: row.status };
 }
-function startSyncLog(projectId, direction, db2) {
-  const d = db2 || getDatabase2();
+function startSyncLog(projectId, direction, db3) {
+  const d = db3 || getDatabase2();
   const id = uuid2();
   const ts = now2();
   d.run("INSERT INTO sync_log (id, project_id, direction, status, started_at) VALUES (?, ?, ?, 'running', ?)", [id, projectId, direction, ts]);
   return d.query("SELECT * FROM sync_log WHERE id = ?").get(id);
 }
-function completeSyncLog(id, result, db2) {
-  const d = db2 || getDatabase2();
+function completeSyncLog(id, result, db3) {
+  const d = db3 || getDatabase2();
   const status = result.error ? "failed" : "completed";
   d.run("UPDATE sync_log SET status = ?, files_synced = ?, bytes = ?, error = ?, completed_at = ? WHERE id = ?", [status, result.files_synced ?? 0, result.bytes ?? 0, result.error ?? null, now2(), id]);
   const row = d.query("SELECT * FROM sync_log WHERE id = ?").get(id);
   return syncRowToLog(row);
 }
-function listSyncLogs(projectId, limit = 20, db2) {
-  const d = db2 || getDatabase2();
+function listSyncLogs(projectId, limit = 20, db3) {
+  const d = db3 || getDatabase2();
   const rows = d.query("SELECT * FROM sync_log WHERE project_id = ? ORDER BY started_at DESC LIMIT ?").all(projectId, limit);
   return rows.map(syncRowToLog);
 }
@@ -58796,7 +58853,7 @@ function buildPeriod(days) {
   return { periodStart, periodEnd };
 }
 async function collectComplianceData(options) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const runsInPeriod = listRuns({
     projectId: options.projectId,
     limit: 1e4
@@ -58811,13 +58868,13 @@ async function collectComplianceData(options) {
     scanConditions.push("project_id = ?");
     scanParams.push(options.projectId);
   }
-  const scanIssues = db2.query(`SELECT type, severity FROM scan_issues WHERE ${scanConditions.join(" AND ")}`).all(...scanParams);
+  const scanIssues = db3.query(`SELECT type, severity FROM scan_issues WHERE ${scanConditions.join(" AND ")}`).all(...scanParams);
   const injectionProbesRun = scanIssues.filter((i2) => i2.type === "injection" || i2.type === "sql_injection" || i2.type === "xss").length;
   const injectionVulnsFound = scanIssues.filter((i2) => (i2.type === "injection" || i2.type === "xss") && (i2.severity === "high" || i2.severity === "critical")).length;
   const piiLeaksDetected = scanIssues.filter((i2) => i2.type === "pii" || i2.type === "pii_leak").length;
   let goldenAnswerDriftEvents = 0;
   try {
-    const driftRows = db2.query(`SELECT COUNT(*) as count FROM golden_check_results WHERE drift_detected = 1 AND created_at >= ? AND created_at <= ?`).get(options.periodStart, options.periodEnd);
+    const driftRows = db3.query(`SELECT COUNT(*) as count FROM golden_check_results WHERE drift_detected = 1 AND created_at >= ? AND created_at <= ?`).get(options.periodStart, options.periodEnd);
     goldenAnswerDriftEvents = driftRows?.count ?? 0;
   } catch {
     goldenAnswerDriftEvents = 0;
@@ -58829,7 +58886,7 @@ async function collectComplianceData(options) {
   let flakyScenarioCount = 0;
   if (runIds.length > 0) {
     const placeholders = runIds.map(() => "?").join(", ");
-    const evalResults = db2.query(`SELECT r.status, r.metadata FROM results r
+    const evalResults = db3.query(`SELECT r.status, r.metadata FROM results r
          JOIN scenarios s ON r.scenario_id = s.id
          WHERE r.run_id IN (${placeholders}) AND s.scenario_type = 'eval'`).all(...runIds);
     evalScenariosRun = evalResults.length;
@@ -58842,9 +58899,9 @@ async function collectComplianceData(options) {
         totalEvalScore += er.status === "passed" ? 1 : 0;
       }
     }
-    const a11yRows = db2.query(`SELECT COUNT(*) as count FROM scan_issues WHERE type = 'a11y' AND severity = 'critical' AND first_seen_at >= ? AND first_seen_at <= ?`).get(options.periodStart, options.periodEnd);
+    const a11yRows = db3.query(`SELECT COUNT(*) as count FROM scan_issues WHERE type = 'a11y' AND severity = 'critical' AND first_seen_at >= ? AND first_seen_at <= ?`).get(options.periodStart, options.periodEnd);
     a11yViolationsCritical = a11yRows?.count ?? 0;
-    const flakyRows = db2.query(`SELECT COUNT(DISTINCT scenario_id) as count FROM results WHERE run_id IN (${placeholders}) AND status = 'flaky'`).get(...runIds);
+    const flakyRows = db3.query(`SELECT COUNT(DISTINCT scenario_id) as count FROM results WHERE run_id IN (${placeholders}) AND status = 'flaky'`).get(...runIds);
     flakyScenarioCount = flakyRows?.count ?? 0;
   }
   const averageEvalScore = evalScenariosRun > 0 ? totalEvalScore / evalScenariosRun : 1;
@@ -59093,6 +59150,297 @@ var init_openapi_import = __esm(() => {
   init_api_checks();
 });
 
+// src/lib/next-route-inventory.ts
+var exports_next_route_inventory = {};
+__export(exports_next_route_inventory, {
+  scenarioInputForNextRoute: () => scenarioInputForNextRoute,
+  importNextRouteInventory: () => importNextRouteInventory,
+  discoverNextRouteInventory: () => discoverNextRouteInventory
+});
+import { existsSync as existsSync18, readdirSync as readdirSync6, readFileSync as readFileSync9, statSync as statSync4 } from "fs";
+import { basename as basename3, join as join20, relative as relative4, resolve as resolve3 } from "path";
+function discoverNextRouteInventory(options) {
+  const rootDir = resolve3(options.rootDir);
+  const appDir = resolveAppDir(rootDir, options.appDir);
+  const includePages = options.includePages !== false;
+  const includeApi = options.includeApi !== false;
+  const files = walkRouteFiles(appDir);
+  const items = files.map((file) => routeItemFromFile(rootDir, appDir, file)).filter((item) => Boolean(item)).filter((item) => item.kind === "page" ? includePages : includeApi).sort((a2, b2) => `${a2.kind}:${a2.routePath}:${a2.file}`.localeCompare(`${b2.kind}:${b2.routePath}:${b2.file}`)).slice(0, options.limit);
+  const categories = {};
+  for (const item of items) {
+    categories[item.category] = (categories[item.category] ?? 0) + 1;
+  }
+  return {
+    rootDir,
+    appDir,
+    total: items.length,
+    pages: items.filter((item) => item.kind === "page").length,
+    apiRoutes: items.filter((item) => item.kind === "api").length,
+    dynamic: items.filter((item) => item.dynamic).length,
+    categories,
+    items
+  };
+}
+function scenarioInputForNextRoute(item, projectId) {
+  const label = item.kind === "page" ? "page" : "API route";
+  const methodList = item.methods.length > 0 ? item.methods.join(", ") : "discovered methods";
+  const dynamicStep = item.dynamic ? "Substitute dynamic path parameters with valid fixture values from the target org before opening or calling the route." : undefined;
+  const pageSteps = [
+    dynamicStep,
+    `Open the Next.js ${label} ${item.routePath}.`,
+    "Wait for the route to finish loading and verify it does not show a blank shell, framework error page, or unexpected auth loop.",
+    "Exercise visible primary navigation, tabs, filters, dialogs, forms, and safe buttons on this route.",
+    "Verify the route stays within the expected org/workspace context and does not emit console errors."
+  ].filter(Boolean);
+  const apiSteps = [
+    dynamicStep,
+    `Call the ${methodList} handler(s) for ${item.routePath} using safe fixture data.`,
+    "Verify expected authentication, authorization, validation, and tenant isolation behavior.",
+    "For mutating methods, use harmless test payloads and confirm the response does not create cross-org side effects.",
+    "Verify response status, JSON shape, and error messages are stable and regression-safe."
+  ].filter(Boolean);
+  return {
+    name: `Next ${label}: ${item.routePath}`,
+    description: `Source-discovered ${label} from ${item.file}. Verify route behavior and regressions for ${item.category}.`,
+    steps: item.kind === "page" ? pageSteps : apiSteps,
+    tags: item.tags,
+    priority: item.priority,
+    targetPath: item.routePath,
+    requiresAuth: item.requiresAuth,
+    assertions: item.kind === "page" ? SAFE_PAGE_ASSERTIONS : [],
+    metadata: {
+      source: "next-route-inventory",
+      routeFile: item.file,
+      routeKind: item.kind,
+      category: item.category,
+      methods: item.methods,
+      dynamic: item.dynamic,
+      groups: item.groups
+    },
+    projectId
+  };
+}
+function importNextRouteInventory(options) {
+  const inventory = discoverNextRouteInventory(options);
+  let created = 0;
+  let updated = 0;
+  let deduped = 0;
+  const scenarios = [];
+  const workflows = [];
+  if (options.createScenarios) {
+    for (const item of inventory.items) {
+      const result = upsertScenario(scenarioInputForNextRoute(item, options.projectId));
+      scenarios.push(result.scenario);
+      if (result.action === "created")
+        created++;
+      else if (result.action === "updated")
+        updated++;
+      else
+        deduped++;
+    }
+  }
+  if (options.createWorkflows) {
+    workflows.push(...upsertRouteInventoryWorkflows(inventory, options));
+  }
+  return { inventory, created, updated, deduped, scenarios, workflows };
+}
+function upsertRouteInventoryWorkflows(inventory, options) {
+  const workflows = [];
+  const categories = Object.keys(inventory.categories).sort();
+  for (const category of categories) {
+    const kinds = new Set(inventory.items.filter((item) => item.category === category).map((item) => item.kind));
+    for (const kind of kinds) {
+      const name = `Next route inventory ${category} ${kind}`;
+      const scenarioTags = ["next-route", `area:${category}`, `route:${kind}`];
+      const execution = {
+        target: options.workflowTarget ?? "sandbox",
+        provider: options.workflowProvider,
+        sandboxCleanup: "delete",
+        sandboxSyncStrategy: "rsync",
+        ...options.workflowExecution
+      };
+      const existing = listTestingWorkflows({ projectId: options.projectId, enabled: undefined }).find((workflow) => workflow.name === name);
+      const input = {
+        name,
+        description: `Source-discovered Next.js ${kind} coverage for ${category} routes.`,
+        projectId: options.projectId,
+        scenarioFilter: { tags: scenarioTags },
+        execution
+      };
+      workflows.push(existing ? updateTestingWorkflow(existing.id, input) : createTestingWorkflow(input));
+    }
+  }
+  return workflows;
+}
+function resolveAppDir(rootDir, appDir) {
+  const candidates = appDir ? [resolve3(rootDir, appDir)] : [
+    join20(rootDir, "packages", "web", "app"),
+    join20(rootDir, "app"),
+    rootDir
+  ];
+  for (const candidate of candidates) {
+    if (existsSync18(candidate) && statSync4(candidate).isDirectory())
+      return candidate;
+  }
+  throw new Error(`Next.js app directory not found under ${rootDir}`);
+}
+function walkRouteFiles(appDir) {
+  const files = [];
+  function walk(dir) {
+    for (const entry of readdirSync6(dir)) {
+      if (WALK_EXCLUDES.has(entry))
+        continue;
+      const fullPath = join20(dir, entry);
+      const stat = statSync4(fullPath);
+      if (stat.isDirectory()) {
+        walk(fullPath);
+      } else if (ROUTE_FILE_NAMES.has(entry)) {
+        files.push(fullPath);
+      }
+    }
+  }
+  walk(appDir);
+  return files;
+}
+function routeItemFromFile(rootDir, appDir, file) {
+  const fileName = basename3(file);
+  const kind = fileName.startsWith("page.") ? "page" : "api";
+  const relativeFile = relative4(rootDir, file);
+  const appRelative = relative4(appDir, file).split(/[\\/]/);
+  const routeSegments = appRelative.slice(0, -1);
+  const groups = routeSegments.filter((segment) => segment.startsWith("(") && segment.endsWith(")")).map((segment) => segment.slice(1, -1));
+  const pathSegments = routeSegments.filter((segment) => !segment.startsWith("(")).filter((segment) => !segment.startsWith("@")).map(normalizeRouteSegment).filter(Boolean);
+  const routePath = `/${pathSegments.join("/")}`.replace(/\/+/g, "/");
+  const normalizedRoutePath = routePath === "/" ? "/" : routePath.replace(/\/$/, "");
+  const methods = kind === "api" ? extractRouteMethods(file) : [];
+  const category = classifyRoute(normalizedRoutePath, groups, relativeFile);
+  const dynamic = routeSegments.some((segment) => segment.includes("["));
+  const requiresAuth = inferRequiresAuth(normalizedRoutePath, groups, kind);
+  return {
+    kind,
+    routePath: normalizedRoutePath,
+    file: relativeFile,
+    category,
+    groups,
+    methods,
+    dynamic,
+    requiresAuth,
+    tags: tagsForRoute({ kind, routePath: normalizedRoutePath, category, groups, dynamic, requiresAuth }),
+    priority: priorityForRoute(normalizedRoutePath, category, kind)
+  };
+}
+function normalizeRouteSegment(segment) {
+  if (segment.startsWith("[[...") && segment.endsWith("]]")) {
+    return `:${segment.slice(5, -2)}*?`;
+  }
+  if (segment.startsWith("[...") && segment.endsWith("]")) {
+    return `:${segment.slice(4, -1)}*`;
+  }
+  if (segment.startsWith("[") && segment.endsWith("]")) {
+    return `:${segment.slice(1, -1)}`;
+  }
+  return segment;
+}
+function extractRouteMethods(file) {
+  const source = readFileSync9(file, "utf8");
+  const methods = new Set;
+  const pattern = /\b(?:export\s+)?(?:async\s+)?function\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b|\bexport\s+const\s+(GET|POST|PUT|PATCH|DELETE|HEAD|OPTIONS)\b/g;
+  for (const match of source.matchAll(pattern)) {
+    const method = match[1] ?? match[2];
+    if (method)
+      methods.add(method);
+  }
+  return [...methods].sort();
+}
+function classifyRoute(routePath, groups, file) {
+  const haystack = `${routePath} ${groups.join(" ")} ${file}`.toLowerCase();
+  if (haystack.includes("admin"))
+    return "admin";
+  if (haystack.includes("auth") || routePath.startsWith("/cli/device"))
+    return "auth";
+  if (haystack.includes("ai-runtime") || /\/(chat|sessions|memories|knowledge|learning|copilot|guardrails)\b/.test(routePath))
+    return "ai-runtime";
+  if (haystack.includes("commerce") || /\/(billing|shop|agent-wallet|domains|whois-profiles)\b/.test(routePath))
+    return "commerce";
+  if (haystack.includes("communications") || /\/(telephony|emails)\b/.test(routePath))
+    return "communications";
+  if (haystack.includes("crm") || routePath.includes("/contacts"))
+    return "crm";
+  if (haystack.includes("integrations") || routePath.includes("/connectors"))
+    return "integrations";
+  if (haystack.includes("dashboard") || routePath.includes(":orgSlug"))
+    return "dashboard";
+  if (haystack.includes("public") || haystack.includes("pages"))
+    return "public";
+  if (routePath.startsWith("/api/"))
+    return "api";
+  return "app";
+}
+function inferRequiresAuth(routePath, groups, kind) {
+  const haystack = `${routePath} ${groups.join(" ")}`.toLowerCase();
+  if (haystack.includes("auth") || haystack.includes("public") || haystack.includes("webhook"))
+    return false;
+  if (routePath.startsWith("/api/v1/auth/"))
+    return false;
+  if (routePath.startsWith("/api/"))
+    return true;
+  return kind === "page" && (haystack.includes("admin") || haystack.includes("dashboard") || routePath.includes(":orgSlug") || routePath.startsWith("/settings"));
+}
+function tagsForRoute(input) {
+  const tags = new Set([
+    "next-route",
+    `route:${input.kind}`,
+    `area:${input.category}`,
+    input.category
+  ]);
+  for (const group of input.groups)
+    tags.add(`group:${group}`);
+  if (input.dynamic)
+    tags.add("dynamic-route");
+  if (input.requiresAuth)
+    tags.add("auth-required");
+  if (input.routePath.startsWith("/api/"))
+    tags.add("api");
+  return [...tags];
+}
+function priorityForRoute(routePath, category, kind) {
+  if (category === "auth")
+    return "critical";
+  if (category === "commerce" || category === "ai-runtime")
+    return "critical";
+  if (category === "admin" || category === "dashboard")
+    return "high";
+  if (kind === "api")
+    return "high";
+  if (routePath === "/" || category === "public")
+    return "medium";
+  return "medium";
+}
+var ROUTE_FILE_NAMES, WALK_EXCLUDES, SAFE_PAGE_ASSERTIONS;
+var init_next_route_inventory = __esm(() => {
+  init_scenarios();
+  init_workflows();
+  ROUTE_FILE_NAMES = new Set([
+    "page.tsx",
+    "page.ts",
+    "page.jsx",
+    "page.js",
+    "page.mdx",
+    "route.ts",
+    "route.js"
+  ]);
+  WALK_EXCLUDES = new Set([
+    ".git",
+    ".next",
+    ".turbo",
+    "node_modules",
+    "dist",
+    "build",
+    "coverage"
+  ]);
+  SAFE_PAGE_ASSERTIONS = [{ type: "no_console_errors" }];
+});
+
 // src/lib/generator.ts
 var exports_generator = {};
 __export(exports_generator, {
@@ -59391,7 +59739,7 @@ async function recordSession(url, options) {
   await Promise.race([
     page.waitForEvent("close").catch(() => {}),
     context.waitForEvent("close").catch(() => {}),
-    new Promise((resolve3) => setTimeout(resolve3, timeout))
+    new Promise((resolve4) => setTimeout(resolve4, timeout))
   ]);
   clearInterval(pollInterval);
   try {
@@ -59663,49 +60011,49 @@ __export(exports_agents, {
   getAgent: () => getAgent
 });
 function registerAgent(input) {
-  const db2 = getDatabase();
-  const existing = db2.query("SELECT * FROM agents WHERE name = ?").get(input.name);
+  const db3 = getDatabase();
+  const existing = db3.query("SELECT * FROM agents WHERE name = ?").get(input.name);
   if (existing) {
-    db2.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), existing.id);
+    db3.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), existing.id);
     return getAgent(existing.id);
   }
   const id = uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO agents (id, name, description, role, metadata, created_at, last_seen_at)
     VALUES (?, ?, ?, ?, '{}', ?, ?)
   `).run(id, input.name, input.description ?? null, input.role ?? null, timestamp, timestamp);
   return getAgent(id);
 }
 function getAgent(id) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM agents WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM agents WHERE id = ?").get(id);
   return row ? agentFromRow(row) : null;
 }
 function getAgentByName(name) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM agents WHERE name = ?").get(name);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM agents WHERE name = ?").get(name);
   return row ? agentFromRow(row) : null;
 }
 function listAgents() {
-  const db2 = getDatabase();
-  const rows = db2.query("SELECT * FROM agents ORDER BY created_at DESC").all();
+  const db3 = getDatabase();
+  const rows = db3.query("SELECT * FROM agents ORDER BY created_at DESC").all();
   return rows.map(agentFromRow);
 }
 function heartbeatAgent(id) {
-  const db2 = getDatabase();
-  const affected = db2.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), id);
+  const db3 = getDatabase();
+  const affected = db3.query("UPDATE agents SET last_seen_at = ? WHERE id = ?").run(now(), id);
   if (affected.changes === 0)
     return null;
   return getAgent(id);
 }
 function setAgentFocus(id, scenarioId) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const agent = getAgent(id);
   if (!agent)
     return null;
   const metadata = { ...agent.metadata ?? {}, focus: scenarioId };
-  db2.query("UPDATE agents SET metadata = ?, last_seen_at = ? WHERE id = ?").run(JSON.stringify(metadata), now(), id);
+  db3.query("UPDATE agents SET metadata = ?, last_seen_at = ? WHERE id = ?").run(JSON.stringify(metadata), now(), id);
   return getAgent(id);
 }
 var init_agents = __esm(() => {
@@ -76959,7 +77307,7 @@ function createProviderToolFactoryWithOutputSchema({
     supportsDeferredResults
   });
 }
-async function resolve3(value) {
+async function resolve4(value) {
   if (typeof value === "function") {
     value = value();
   }
@@ -78646,7 +78994,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
     try {
       const { value } = await getFromApi({
         url: `${this.config.baseURL}/config`,
-        headers: await resolve3(this.config.headers()),
+        headers: await resolve4(this.config.headers()),
         successfulResponseHandler: createJsonResponseHandler(gatewayAvailableModelsResponseSchema),
         failedResponseHandler: createJsonErrorResponseHandler({
           errorSchema: exports_external2.any(),
@@ -78664,7 +79012,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
       const baseUrl = new URL(this.config.baseURL);
       const { value } = await getFromApi({
         url: `${baseUrl.origin}/v1/credits`,
-        headers: await resolve3(this.config.headers()),
+        headers: await resolve4(this.config.headers()),
         successfulResponseHandler: createJsonResponseHandler(gatewayCreditsResponseSchema),
         failedResponseHandler: createJsonErrorResponseHandler({
           errorSchema: exports_external2.any(),
@@ -78710,7 +79058,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
       }
       const { value } = await getFromApi({
         url: `${baseUrl.origin}/v1/report?${searchParams.toString()}`,
-        headers: await resolve3(this.config.headers()),
+        headers: await resolve4(this.config.headers()),
         successfulResponseHandler: createJsonResponseHandler(gatewaySpendReportResponseSchema),
         failedResponseHandler: createJsonErrorResponseHandler({
           errorSchema: exports_external2.any(),
@@ -78732,7 +79080,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
       const baseUrl = new URL(this.config.baseURL);
       const { value } = await getFromApi({
         url: `${baseUrl.origin}/v1/generation?id=${encodeURIComponent(params.id)}`,
-        headers: await resolve3(this.config.headers()),
+        headers: await resolve4(this.config.headers()),
         successfulResponseHandler: createJsonResponseHandler(gatewayGenerationInfoResponseSchema),
         failedResponseHandler: createJsonErrorResponseHandler({
           errorSchema: exports_external2.any(),
@@ -78765,7 +79113,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
   async doGenerate(options) {
     const { args, warnings } = await this.getArgs(options);
     const { abortSignal } = options;
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const {
         responseHeaders,
@@ -78773,7 +79121,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
         rawValue: rawResponse
       } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, options.headers, this.getModelConfigHeaders(this.modelId, false), await resolve3(this.config.o11yHeaders)),
+        headers: combineHeaders(resolvedHeaders, options.headers, this.getModelConfigHeaders(this.modelId, false), await resolve4(this.config.o11yHeaders)),
         body: args,
         successfulResponseHandler: createJsonResponseHandler(exports_external2.any()),
         failedResponseHandler: createJsonErrorResponseHandler({
@@ -78796,11 +79144,11 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
   async doStream(options) {
     const { args, warnings } = await this.getArgs(options);
     const { abortSignal } = options;
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const { value: response, responseHeaders } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, options.headers, this.getModelConfigHeaders(this.modelId, true), await resolve3(this.config.o11yHeaders)),
+        headers: combineHeaders(resolvedHeaders, options.headers, this.getModelConfigHeaders(this.modelId, true), await resolve4(this.config.o11yHeaders)),
         body: args,
         successfulResponseHandler: createEventSourceResponseHandler(exports_external2.any()),
         failedResponseHandler: createJsonErrorResponseHandler({
@@ -78885,7 +79233,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
     providerOptions
   }) {
     var _a92;
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const {
         responseHeaders,
@@ -78893,7 +79241,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
         rawValue
       } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve3(this.config.o11yHeaders)),
+        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve4(this.config.o11yHeaders)),
         body: {
           values,
           ...providerOptions ? { providerOptions } : {}
@@ -78949,7 +79297,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
     abortSignal
   }) {
     var _a92, _b92, _c2, _d2;
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const {
         responseHeaders,
@@ -78957,7 +79305,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
         rawValue
       } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve3(this.config.o11yHeaders)),
+        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve4(this.config.o11yHeaders)),
         body: {
           prompt,
           n: n2,
@@ -79032,11 +79380,11 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
     abortSignal
   }) {
     var _a92;
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const { responseHeaders, value: responseBody } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve3(this.config.o11yHeaders), { accept: "text/event-stream" }),
+        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve4(this.config.o11yHeaders), { accept: "text/event-stream" }),
         body: {
           prompt,
           n: n2,
@@ -79159,7 +79507,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
     abortSignal,
     providerOptions
   }) {
-    const resolvedHeaders = await resolve3(this.config.headers());
+    const resolvedHeaders = await resolve4(this.config.headers());
     try {
       const {
         responseHeaders,
@@ -79167,7 +79515,7 @@ var import_oidc, import_oidc2, marker17 = "vercel.ai.gateway.error", symbol18, _
         rawValue
       } = await postJsonToApi({
         url: this.getUrl(),
-        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve3(this.config.o11yHeaders)),
+        headers: combineHeaders(resolvedHeaders, headers != null ? headers : {}, this.getModelConfigHeaders(), await resolve4(this.config.o11yHeaders)),
         body: {
           documents,
           query,
@@ -88585,7 +88933,7 @@ var import_api2, import_api3, __defProp4, __export4 = (target, all) => {
   const schema = asSchema(inputSchema);
   return {
     name: "object",
-    responseFormat: resolve3(schema.jsonSchema).then((jsonSchema2) => ({
+    responseFormat: resolve4(schema.jsonSchema).then((jsonSchema2) => ({
       type: "json",
       schema: jsonSchema2,
       ...name21 != null && { name: name21 },
@@ -88646,7 +88994,7 @@ var import_api2, import_api3, __defProp4, __export4 = (target, all) => {
   const elementSchema = asSchema(inputElementSchema);
   return {
     name: "array",
-    responseFormat: resolve3(elementSchema.jsonSchema).then((jsonSchema2) => {
+    responseFormat: resolve4(elementSchema.jsonSchema).then((jsonSchema2) => {
       const { $schema, ...itemSchema } = jsonSchema2;
       return {
         type: "json",
@@ -91543,9 +91891,9 @@ var import_api2, import_api3, __defProp4, __export4 = (target, all) => {
     ...options
   }) {
     var _a21, _b16, _c2, _d2, _e2;
-    const resolvedBody = await resolve3(this.body);
-    const resolvedHeaders = await resolve3(this.headers);
-    const resolvedCredentials = await resolve3(this.credentials);
+    const resolvedBody = await resolve4(this.body);
+    const resolvedHeaders = await resolve4(this.headers);
+    const resolvedCredentials = await resolve4(this.credentials);
     const baseHeaders = {
       ...normalizeHeaders(resolvedHeaders),
       ...normalizeHeaders(options.headers)
@@ -91593,9 +91941,9 @@ var import_api2, import_api3, __defProp4, __export4 = (target, all) => {
   }
   async reconnectToStream(options) {
     var _a21, _b16, _c2, _d2, _e2;
-    const resolvedBody = await resolve3(this.body);
-    const resolvedHeaders = await resolve3(this.headers);
-    const resolvedCredentials = await resolve3(this.credentials);
+    const resolvedBody = await resolve4(this.body);
+    const resolvedHeaders = await resolve4(this.headers);
+    const resolvedCredentials = await resolve4(this.credentials);
     const baseHeaders = {
       ...normalizeHeaders(resolvedHeaders),
       ...normalizeHeaders(options.headers)
@@ -93816,7 +94164,7 @@ __export(exports_session_converter, {
   convertSessionToScenario: () => convertSessionToScenario,
   convertSessionFile: () => convertSessionFile
 });
-import { readFileSync as readFileSync9 } from "fs";
+import { readFileSync as readFileSync10 } from "fs";
 import { extname } from "path";
 function parseRrwebSession(events) {
   const result = [];
@@ -94001,7 +94349,7 @@ ${condensed}`;
   };
 }
 async function convertSessionFile(filePath, format, options) {
-  const raw = readFileSync9(filePath, "utf-8");
+  const raw = readFileSync10(filePath, "utf-8");
   let parsed;
   try {
     parsed = JSON.parse(raw);
@@ -94035,7 +94383,7 @@ function detectSessionFormat(filePath) {
   if (ext === ".har")
     return "har";
   try {
-    const content = readFileSync9(filePath, "utf-8").trim();
+    const content = readFileSync10(filePath, "utf-8").trim();
     const parsed = JSON.parse(content);
     if (Array.isArray(parsed) && parsed[0]?.type !== undefined && typeof parsed[0]?.timestamp === "number") {
       return "rrweb";
@@ -94089,28 +94437,28 @@ function checkResultFromRow(row) {
   };
 }
 function createGoldenAnswer(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const short_id = shortUuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO golden_answers (id, short_id, project_id, question, golden_answer, constraints, endpoint, judge_model, enabled, created_at, updated_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, short_id, input.projectId ?? null, input.question, input.goldenAnswer, JSON.stringify(input.constraints ?? []), input.endpoint, input.judgeModel ?? null, input.enabled === false ? 0 : 1, timestamp, timestamp);
   return getGoldenAnswer(id);
 }
 function getGoldenAnswer(id) {
-  const db2 = getDatabase();
-  let row = db2.query("SELECT * FROM golden_answers WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  let row = db3.query("SELECT * FROM golden_answers WHERE id = ?").get(id);
   if (row)
     return goldenFromRow(row);
-  row = db2.query("SELECT * FROM golden_answers WHERE short_id = ?").get(id);
+  row = db3.query("SELECT * FROM golden_answers WHERE short_id = ?").get(id);
   if (row)
     return goldenFromRow(row);
   return null;
 }
 function listGoldenAnswers(filter2) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const conditions = [];
   const params = [];
   if (filter2?.projectId) {
@@ -94126,11 +94474,11 @@ function listGoldenAnswers(filter2) {
     sql += " WHERE " + conditions.join(" AND ");
   }
   sql += " ORDER BY created_at DESC";
-  const rows = db2.query(sql).all(...params);
+  const rows = db3.query(sql).all(...params);
   return rows.map(goldenFromRow);
 }
 function updateGoldenAnswer(id, input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const timestamp = now();
   const sets = ["updated_at = ?"];
   const params = [timestamp];
@@ -94159,26 +94507,26 @@ function updateGoldenAnswer(id, input) {
     params.push(input.enabled ? 1 : 0);
   }
   params.push(id);
-  db2.query(`UPDATE golden_answers SET ${sets.join(", ")} WHERE id = ? OR short_id = ?`).run(...params, id);
+  db3.query(`UPDATE golden_answers SET ${sets.join(", ")} WHERE id = ? OR short_id = ?`).run(...params, id);
   return getGoldenAnswer(id);
 }
 function deleteGoldenAnswer(id) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM golden_answers WHERE id = ? OR short_id = ?").run(id, id);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM golden_answers WHERE id = ? OR short_id = ?").run(id, id);
   return (result.changes ?? 0) > 0;
 }
 function createGoldenCheckResult(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const timestamp = now();
-  db2.query(`
+  db3.query(`
     INSERT INTO golden_check_results (id, golden_id, response, similarity_score, passed, drift_detected, judge_model, provider, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.goldenId, input.response, input.similarityScore ?? null, input.passed ? 1 : 0, input.driftDetected ? 1 : 0, input.judgeModel ?? null, input.provider ?? null, timestamp);
   return listGoldenCheckResults(input.goldenId, { limit: 1 })[0];
 }
 function listGoldenCheckResults(goldenId, options) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const params = [goldenId];
   let sql = "SELECT * FROM golden_check_results WHERE golden_id = ?";
   if (options?.since) {
@@ -94190,7 +94538,7 @@ function listGoldenCheckResults(goldenId, options) {
     sql += " LIMIT ?";
     params.push(options.limit);
   }
-  const rows = db2.query(sql).all(...params);
+  const rows = db3.query(sql).all(...params);
   return rows.map(checkResultFromRow);
 }
 function getLatestGoldenCheckResult(goldenId) {
@@ -94479,7 +94827,7 @@ import chalk6 from "chalk";
 // package.json
 var package_default = {
   name: "@hasna/testers",
-  version: "0.0.47",
+  version: "0.0.49",
   description: "AI-powered QA testing CLI \u2014 spawns cheap AI agents to test web apps with headless browsers",
   type: "module",
   main: "dist/index.js",
@@ -94578,9 +94926,9 @@ init_todos_connector();
 init_browser();
 import { render, Box, Text, useInput, useApp } from "ink";
 import React, { useState } from "react";
-import { readFileSync as readFileSync10, readdirSync as readdirSync6, writeFileSync as writeFileSync7 } from "fs";
+import { readFileSync as readFileSync11, readdirSync as readdirSync7, writeFileSync as writeFileSync7 } from "fs";
 import { createInterface } from "readline";
-import { join as join20, resolve as resolve4 } from "path";
+import { join as join21, resolve as resolve5 } from "path";
 
 // src/lib/init.ts
 init_paths();
@@ -96613,51 +96961,51 @@ function fromRow3(row) {
   };
 }
 function createEnvironment(input) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   const id = uuid();
   const timestamp = now();
   const meta = JSON.stringify({ variables: input.variables ?? {} });
-  db2.query(`
+  db3.query(`
     INSERT INTO environments (id, name, url, auth_preset_name, project_id, is_default, metadata, created_at)
     VALUES (?, ?, ?, ?, ?, ?, ?, ?)
   `).run(id, input.name, input.url, input.authPresetName ?? null, input.projectId ?? null, input.isDefault ? 1 : 0, meta, timestamp);
   return getEnvironmentById(id);
 }
 function getEnvironmentById(id) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE id = ?").get(id);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE id = ?").get(id);
   return row ? fromRow3(row) : null;
 }
 function getEnvironment(name) {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE name = ?").get(name);
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE name = ?").get(name);
   return row ? fromRow3(row) : null;
 }
 function listEnvironments(projectId) {
-  const db2 = getDatabase();
+  const db3 = getDatabase();
   if (projectId) {
-    const rows2 = db2.query("SELECT * FROM environments WHERE project_id = ? ORDER BY is_default DESC, created_at DESC").all(projectId);
+    const rows2 = db3.query("SELECT * FROM environments WHERE project_id = ? ORDER BY is_default DESC, created_at DESC").all(projectId);
     return rows2.map(fromRow3);
   }
-  const rows = db2.query("SELECT * FROM environments ORDER BY is_default DESC, created_at DESC").all();
+  const rows = db3.query("SELECT * FROM environments ORDER BY is_default DESC, created_at DESC").all();
   return rows.map(fromRow3);
 }
 function deleteEnvironment(name) {
-  const db2 = getDatabase();
-  const result = db2.query("DELETE FROM environments WHERE name = ?").run(name);
+  const db3 = getDatabase();
+  const result = db3.query("DELETE FROM environments WHERE name = ?").run(name);
   return result.changes > 0;
 }
 function setDefaultEnvironment(name) {
-  const db2 = getDatabase();
-  db2.exec("UPDATE environments SET is_default = 0");
-  const result = db2.query("UPDATE environments SET is_default = 1 WHERE name = ?").run(name);
+  const db3 = getDatabase();
+  db3.exec("UPDATE environments SET is_default = 0");
+  const result = db3.query("UPDATE environments SET is_default = 1 WHERE name = ?").run(name);
   if (result.changes === 0) {
     throw new Error(`Environment not found: ${name}`);
   }
 }
 function getDefaultEnvironment() {
-  const db2 = getDatabase();
-  const row = db2.query("SELECT * FROM environments WHERE is_default = 1 LIMIT 1").get();
+  const db3 = getDatabase();
+  const row = db3.query("SELECT * FROM environments WHERE is_default = 1 LIMIT 1").get();
   return row ? fromRow3(row) : null;
 }
 
@@ -96666,7 +97014,7 @@ init_ci();
 init_assertions();
 init_paths();
 init_sessions();
-import { existsSync as existsSync18, mkdirSync as mkdirSync15 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync15 } from "fs";
 
 // src/lib/repo-discovery.ts
 init_paths();
@@ -97224,12 +97572,12 @@ async function runRepoTests(opts) {
     specResults.push(result);
     const resultId = uuid();
     const timestamp = now();
-    const db2 = getDatabase();
-    db2.exec("PRAGMA foreign_keys = OFF");
+    const db3 = getDatabase();
+    db3.exec("PRAGMA foreign_keys = OFF");
     try {
       const reasoning = result.status === "passed" ? "All tests passed" : (result.error ?? "").slice(0, 500) || null;
       const errorStr = result.status !== "passed" ? result.error ?? null : null;
-      db2.query(`
+      db3.query(`
         INSERT INTO results (id, run_id, scenario_id, status, reasoning, error, steps_completed, steps_total, duration_ms, model, tokens_used, cost_cents, metadata, created_at, persona_id, persona_name)
         VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0, 0, ?, ?, NULL, NULL)
       `).run(resultId, run.id, "__repo__", result.status, reasoning, errorStr, result.testResults.filter((t) => t.status === "passed").length, result.testResults.length || 1, result.durationMs, "repo-native", JSON.stringify({
@@ -97238,7 +97586,7 @@ async function runRepoTests(opts) {
         testResults: result.testResults
       }), timestamp);
     } finally {
-      db2.exec("PRAGMA foreign_keys = ON");
+      db3.exec("PRAGMA foreign_keys = ON");
     }
     const resultRecord = { id: resultId };
     if (result.stdout || result.stderr) {
@@ -97385,21 +97733,31 @@ function envCredentialRef(value) {
     return;
   return trimmed.startsWith("$") ? trimmed : `$${trimmed}`;
 }
-function parseSandboxEnv(values) {
-  if (!values?.length)
+function assertEnvVarName(key, rawValue) {
+  if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+    throw new Error(`Invalid sandbox env var name: ${key || rawValue}`);
+  }
+}
+function parseSandboxEnv(values, optionalValues = []) {
+  if (!values?.length && !optionalValues?.length)
     return;
   const env = {};
-  for (const value of values) {
+  for (const value of values ?? []) {
     const trimmed = value.trim();
     if (!trimmed)
       continue;
     const separator = trimmed.indexOf("=");
     const key = separator >= 0 ? trimmed.slice(0, separator).trim() : trimmed;
-    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
-      throw new Error(`Invalid sandbox env var name: ${key || value}`);
-    }
+    assertEnvVarName(key, value);
     env[key] = separator >= 0 ? trimmed.slice(separator + 1) : `$${key}`;
   }
+  for (const value of optionalValues ?? []) {
+    const key = value.trim();
+    if (!key)
+      continue;
+    assertEnvVarName(key, value);
+    env[key] = `$?${key}`;
+  }
   return Object.keys(env).length > 0 ? env : undefined;
 }
 function AddForm({ onComplete }) {
@@ -97675,18 +98033,18 @@ program2.command("prod-debug <target>").description("Create a safe production de
   }, config2.prodDebug);
   const output = opts.json ? JSON.stringify(plan, null, 2) : formatProdDebugPlan(plan);
   if (opts.output) {
-    writeFileSync7(resolve4(opts.output), output + `
+    writeFileSync7(resolve5(opts.output), output + `
 `);
   } else {
     log(output);
   }
 });
 var CONFIG_DIR5 = getTestersDir();
-var CONFIG_PATH4 = join20(CONFIG_DIR5, "config.json");
+var CONFIG_PATH4 = join21(CONFIG_DIR5, "config.json");
 function getActiveProject() {
   try {
-    if (existsSync18(CONFIG_PATH4)) {
-      const raw = JSON.parse(readFileSync10(CONFIG_PATH4, "utf-8"));
+    if (existsSync19(CONFIG_PATH4)) {
+      const raw = JSON.parse(readFileSync11(CONFIG_PATH4, "utf-8"));
       return raw.activeProject ?? undefined;
     }
   } catch {}
@@ -97893,7 +98251,7 @@ program2.command("delete <id>").description("Delete a scenario").option("-y, --y
     }
     if (!opts.yes) {
       process.stdout.write(chalk6.yellow(`Delete scenario ${scenario.shortId} "${scenario.name}"? [y/N] `));
-      const answer = await new Promise((resolve5) => {
+      const answer = await new Promise((resolve6) => {
         let buf = "";
         process.stdin.setRawMode?.(true);
         process.stdin.resume();
@@ -97903,7 +98261,7 @@ program2.command("delete <id>").description("Delete a scenario").option("-y, --y
           process.stdin.pause();
           process.stdout.write(`
 `);
-          resolve5(buf);
+          resolve6(buf);
         });
       });
       if (answer !== "y" && answer !== "yes") {
@@ -97932,7 +98290,7 @@ program2.command("remove <id>").alias("uninstall").description("Remove a scenari
     }
     if (!opts.yes) {
       process.stdout.write(chalk6.yellow(`Remove scenario ${scenario.shortId} "${scenario.name}"? [y/N] `));
-      const answer = await new Promise((resolve5) => {
+      const answer = await new Promise((resolve6) => {
         let buf = "";
         process.stdin.setRawMode?.(true);
         process.stdin.resume();
@@ -97942,7 +98300,7 @@ program2.command("remove <id>").alias("uninstall").description("Remove a scenari
           process.stdin.pause();
           process.stdout.write(`
 `);
-          resolve5(buf);
+          resolve6(buf);
         });
       });
       if (answer !== "y" && answer !== "yes") {
@@ -98145,7 +98503,7 @@ program2.command("run [url] [description]").alias("test").description("Run test
 `);
           }
         };
-        await new Promise((resolve5) => {
+        await new Promise((resolve6) => {
           const poll = setInterval(() => {
             const run3 = getRun(runId);
             if (!run3)
@@ -98153,7 +98511,7 @@ program2.command("run [url] [description]").alias("test").description("Run test
             renderTable();
             if (DONE_STATUSES.has(run3.status)) {
               clearInterval(poll);
-              resolve5();
+              resolve6();
             }
           }, POLL_INTERVAL);
         });
@@ -98548,15 +98906,15 @@ program2.command("screenshots <id>").description("List screenshots for a run or
 });
 program2.command("import <dir>").description("Import markdown test files as scenarios").action((dir) => {
   try {
-    const absDir = resolve4(dir);
-    const files = readdirSync6(absDir).filter((f2) => f2.endsWith(".md"));
+    const absDir = resolve5(dir);
+    const files = readdirSync7(absDir).filter((f2) => f2.endsWith(".md"));
     if (files.length === 0) {
       log(chalk6.dim("No .md files found in directory."));
       return;
     }
     let imported = 0;
     for (const file2 of files) {
-      const content = readFileSync10(join20(absDir, file2), "utf-8");
+      const content = readFileSync11(join21(absDir, file2), "utf-8");
       const lines = content.split(`
 `);
       let name21 = file2.replace(/\.md$/, "");
@@ -98612,11 +98970,11 @@ program2.command("export [format]").description("Export scenarios as JSON (defau
       const outputPath = opts.output ?? "testers-export.json";
       const data = JSON.stringify(scenarios, null, 2);
       writeFileSync7(outputPath, data, "utf-8");
-      log(chalk6.green(`Exported ${scenarios.length} scenario(s) to ${resolve4(outputPath)}`));
+      log(chalk6.green(`Exported ${scenarios.length} scenario(s) to ${resolve5(outputPath)}`));
       return;
     }
     const outputDir = opts.output ?? ".";
-    if (!existsSync18(outputDir)) {
+    if (!existsSync19(outputDir)) {
       mkdirSync15(outputDir, { recursive: true });
     }
     for (const s2 of scenarios) {
@@ -98644,13 +99002,13 @@ program2.command("export [format]").description("Export scenarios as JSON (defau
         lines.push("");
       }
       const safeFilename = s2.name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 80);
-      const filePath = join20(outputDir, `${s2.shortId}-${safeFilename}.md`);
+      const filePath = join21(outputDir, `${s2.shortId}-${safeFilename}.md`);
       writeFileSync7(filePath, lines.join(`
 `), "utf-8");
       log(chalk6.dim(`  ${s2.shortId}: ${s2.name} \u2192 ${filePath}`));
     }
     log(chalk6.green(`
-Exported ${scenarios.length} scenario(s) as markdown to ${resolve4(outputDir)}`));
+Exported ${scenarios.length} scenario(s) as markdown to ${resolve5(outputDir)}`));
   } catch (error40) {
     logError(chalk6.red(`Error: ${error40 instanceof Error ? error40.message : String(error40)}`));
     process.exit(1);
@@ -98669,7 +99027,7 @@ program2.command("status").description("Show database and auth status").action((
   try {
     const config2 = loadConfig();
     const hasApiKey = !!config2.anthropicApiKey || !!process.env["ANTHROPIC_API_KEY"];
-    const dbPath = join20(getTestersDir(), "testers.db");
+    const dbPath = join21(getTestersDir(), "testers.db");
     log("");
     log(chalk6.bold("  Open Testers Status"));
     log("");
@@ -98819,13 +99177,13 @@ projectCmd.command("export-open <id>").description("Register a testers project i
 projectCmd.command("use <name>").description("Set active project (find or create)").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const project = ensureProject(name21, process.cwd());
-    if (!existsSync18(CONFIG_DIR5)) {
+    if (!existsSync19(CONFIG_DIR5)) {
       mkdirSync15(CONFIG_DIR5, { recursive: true });
     }
     let config2 = {};
-    if (existsSync18(CONFIG_PATH4)) {
+    if (existsSync19(CONFIG_PATH4)) {
       try {
-        config2 = JSON.parse(readFileSync10(CONFIG_PATH4, "utf-8"));
+        config2 = JSON.parse(readFileSync11(CONFIG_PATH4, "utf-8"));
       } catch {}
     }
     config2.activeProject = project.id;
@@ -98843,7 +99201,7 @@ projectCmd.command("use <name>").description("Set active project (find or create
 var repoCmd = program2.command("repo").description("Discover and run repo-native Playwright tests");
 repoCmd.command("discover [path]").alias("scan").description("Discover Playwright tests in a repo").option("--refresh", "Force a fresh scan, ignoring cache", false).option("--json", "Output as JSON", false).option("--base-url <url>", "Override the suggested base URL").action((path, opts) => {
   try {
-    const repoPath = resolve4(path ?? process.cwd());
+    const repoPath = resolve5(path ?? process.cwd());
     const snapshot = discoverRepo({
       repoPath,
       refresh: opts.refresh,
@@ -98909,7 +99267,7 @@ repoCmd.command("discover [path]").alias("scan").description("Discover Playwrigh
 });
 repoCmd.command("prepare [path]").alias("prep").description("Install dependencies and browsers for repo tests").option("--all", "Run all prep steps (install, browsers, build, seed)", false).option("--install", "Install dependencies", false).option("--browsers", "Install Playwright browsers", false).option("--build", "Build the app", false).option("--seed", "Seed the database", false).option("--refresh", "Force fresh discovery scan", false).option("--json", "Output as JSON", false).action((path, opts) => {
   try {
-    const repoPath = resolve4(path ?? process.cwd());
+    const repoPath = resolve5(path ?? process.cwd());
     const snapshot = discoverRepo({ repoPath, refresh: opts.refresh });
     const steps = [];
     if (opts.all) {
@@ -98987,7 +99345,7 @@ repoCmd.command("run [path]").description("Run discovered Playwright tests nativ
   return acc;
 }, []).option("--timeout <ms>", "Timeout per spec file", "300000").option("--url <url>", "Dev server URL").option("--project <id>", "Project ID for result storage").option("--label <text>", "Run label").option("--json", "Output as JSON", false).action(async (path, opts) => {
   try {
-    const repoPath = resolve4(path ?? process.cwd());
+    const repoPath = resolve5(path ?? process.cwd());
     const snapshot = discoverRepo({
       repoPath,
       refresh: opts.refresh,
@@ -99053,7 +99411,7 @@ repoCmd.command("run [path]").description("Run discovered Playwright tests nativ
 repoCmd.command("cache [path]").description("Manage discovery cache").option("--clear", "Clear discovery cache", false).option("--status", "Show cache status", false).action((path, opts) => {
   try {
     if (opts.clear) {
-      const repoPath2 = path ? resolve4(path) : undefined;
+      const repoPath2 = path ? resolve5(path) : undefined;
       clearDiscoveryCache(repoPath2);
       if (repoPath2) {
         log(chalk6.green("Discovery cache cleared for this repo."));
@@ -99063,7 +99421,7 @@ repoCmd.command("cache [path]").description("Manage discovery cache").option("--
       return;
     }
     if (opts.status) {
-      const repoPath2 = resolve4(path ?? process.cwd());
+      const repoPath2 = resolve5(path ?? process.cwd());
       const info2 = getDiscoveryCacheInfo(repoPath2);
       if (!info2) {
         log(chalk6.dim("No discovery cache for this repo."));
@@ -99077,7 +99435,7 @@ repoCmd.command("cache [path]").description("Manage discovery cache").option("--
       log("");
       return;
     }
-    const repoPath = resolve4(path ?? process.cwd());
+    const repoPath = resolve5(path ?? process.cwd());
     const info = getDiscoveryCacheInfo(repoPath);
     if (!info) {
       log(chalk6.dim("No discovery cache. Run 'testers repo discover' to create one."));
@@ -99166,8 +99524,8 @@ sessionCmd.command("show <id>").description("Show details of a recorded session"
 });
 sessionCmd.command("import <file>").description("Import a session JSON file exported from the Chrome extension").action(async (file2) => {
   try {
-    const { readFileSync: readFileSync11 } = await import("fs");
-    const raw = readFileSync11(file2, "utf-8");
+    const { readFileSync: readFileSync12 } = await import("fs");
+    const raw = readFileSync12(file2, "utf-8");
     const data = JSON.parse(raw);
     const items = Array.isArray(data) ? data : [data];
     const { createSession: createSession2 } = await Promise.resolve().then(() => (init_sessions(), exports_sessions));
@@ -99407,7 +99765,7 @@ program2.command("daemon").description("Start the scheduler daemon").option("--i
         } catch (err) {
           logError(chalk6.red(`Daemon error: ${err instanceof Error ? err.message : String(err)}`));
         }
-        await new Promise((resolve5) => setTimeout(resolve5, intervalMs));
+        await new Promise((resolve6) => setTimeout(resolve6, intervalMs));
       }
     };
     process.on("SIGINT", () => {
@@ -99436,9 +99794,9 @@ program2.command("ci [provider]").description("Print or write a CI workflow (def
   }
   const workflow = generateGitHubActionsWorkflow();
   if (opts.output) {
-    const outPath = resolve4(opts.output);
+    const outPath = resolve5(opts.output);
     const outDir = outPath.replace(/\/[^/]*$/, "");
-    if (outDir && !existsSync18(outDir)) {
+    if (outDir && !existsSync19(outDir)) {
       mkdirSync15(outDir, { recursive: true });
     }
     writeFileSync7(outPath, workflow, "utf-8");
@@ -99472,11 +99830,11 @@ program2.command("init").description("Initialize a new testing project").option(
       log(`    ${chalk6.dim(s2.shortId)} ${s2.name} ${chalk6.dim(`[${s2.tags.join(", ")}]`)}`);
     }
     if (opts.ci === "github") {
-      const workflowDir = join20(process.cwd(), ".github", "workflows");
-      if (!existsSync18(workflowDir)) {
+      const workflowDir = join21(process.cwd(), ".github", "workflows");
+      if (!existsSync19(workflowDir)) {
         mkdirSync15(workflowDir, { recursive: true });
       }
-      const workflowPath = join20(workflowDir, "testers.yml");
+      const workflowPath = join21(workflowDir, "testers.yml");
       writeFileSync7(workflowPath, generateGitHubActionsWorkflow(), "utf-8");
       log(`  CI:         ${chalk6.green("GitHub Actions workflow written to .github/workflows/testers.yml")}`);
     } else if (opts.ci) {
@@ -99486,7 +99844,7 @@ program2.command("init").description("Initialize a new testing project").option(
     if (opts.yes)
       return;
     const rl2 = createInterface({ input: process.stdin, output: process.stdout });
-    const ask = (q2) => new Promise((resolve5) => rl2.question(q2, resolve5));
+    const ask = (q2) => new Promise((resolve6) => rl2.question(q2, resolve6));
     try {
       const envAnswer = await ask("  Would you like to configure environments? [y/N] ");
       if (envAnswer.trim().toLowerCase() === "y") {
@@ -99670,14 +100028,14 @@ program2.command("quick-qa <url>").alias("quick-check").description("Run a fast
       wcagLevel
     });
     if (opts.output) {
-      writeFileSync7(resolve4(opts.output), JSON.stringify(result, null, 2));
+      writeFileSync7(resolve5(opts.output), JSON.stringify(result, null, 2));
     }
     if (opts.json) {
       log(JSON.stringify(result, null, 2));
     } else {
       log(formatQuickQaReport(result));
       if (opts.output)
-        log(chalk6.dim(`Wrote JSON results to ${resolve4(opts.output)}`));
+        log(chalk6.dim(`Wrote JSON results to ${resolve5(opts.output)}`));
     }
     process.exit(getQuickQaExitCode(result));
   } catch (error40) {
@@ -99722,7 +100080,7 @@ program2.command("report [run-id]").description("Generate HTML test report or co
       });
       if (opts.output && opts.output !== "report.html") {
         writeFileSync7(opts.output, content, "utf-8");
-        const absPath2 = resolve4(opts.output);
+        const absPath2 = resolve5(opts.output);
         log(chalk6.green(`Compliance report written to ${absPath2}`));
       } else {
         log(content);
@@ -99736,7 +100094,7 @@ program2.command("report [run-id]").description("Generate HTML test report or co
       html = generateHtmlReport(runId);
     }
     writeFileSync7(opts.output, html, "utf-8");
-    const absPath = resolve4(opts.output);
+    const absPath = resolve5(opts.output);
     log(chalk6.green(`Report generated: ${absPath}`));
     if (opts.open) {
       const openCmd = process.platform === "darwin" ? "open" : "xdg-open";
@@ -100093,6 +100451,62 @@ Imported ${imported} scenarios from API spec:`));
     process.exit(1);
   }
 });
+var inventoryCmd = program2.command("inventory").description("Discover source-derived app route/action inventories");
+inventoryCmd.command("next [root]").description("Discover Next.js app routes and optionally import route coverage scenarios").option("--app-dir <path>", "Next.js app directory relative to root (default: packages/web/app or app)").option("--project <id>", "Project ID").option("--no-pages", "Do not include page.tsx/page.ts routes").option("--no-api", "Do not include route.ts/route.js API routes").option("--limit <n>", "Limit discovered routes").option("--create-scenarios", "Upsert source-derived route coverage scenarios", false).option("--create-workflows", "Upsert grouped workflows by area and route kind", false).option("--workflow-target <target>", "Workflow execution target: local or sandbox", "sandbox").option("--sandbox-provider <provider>", "Sandbox provider for created workflows", "e2b").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-env-optional <name>", "Optional sandbox env var; forwards host NAME only when set (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--timeout <ms>", "Workflow timeout in milliseconds").option("--json", "Output as JSON", false).action(async (root, opts) => {
+  try {
+    const { importNextRouteInventory: importNextRouteInventory2 } = await Promise.resolve().then(() => (init_next_route_inventory(), exports_next_route_inventory));
+    const projectId = resolveProject2(opts.project) ?? undefined;
+    const env = parseSandboxEnv(undefined, opts.sandboxEnvOptional);
+    const result = importNextRouteInventory2({
+      rootDir: root ?? process.cwd(),
+      appDir: opts.appDir,
+      projectId,
+      includePages: opts.pages !== false,
+      includeApi: opts.api !== false,
+      limit: opts.limit ? parseInt(opts.limit, 10) : undefined,
+      createScenarios: opts.createScenarios,
+      createWorkflows: opts.createWorkflows,
+      workflowTarget: opts.workflowTarget,
+      workflowProvider: opts.workflowTarget === "sandbox" ? opts.sandboxProvider : undefined,
+      workflowExecution: {
+        target: opts.workflowTarget,
+        provider: opts.workflowTarget === "sandbox" ? opts.sandboxProvider : undefined,
+        sandboxCleanup: opts.sandboxCleanup,
+        sandboxSyncStrategy: opts.sandboxSync,
+        timeoutMs: opts.timeout ? parseInt(opts.timeout, 10) : undefined,
+        env
+      }
+    });
+    if (opts.json) {
+      log(JSON.stringify(result, null, 2));
+      return;
+    }
+    log("");
+    log(chalk6.bold("  Next.js Route Inventory"));
+    log(chalk6.dim(`  Root: ${result.inventory.rootDir}`));
+    log(chalk6.dim(`  App:  ${result.inventory.appDir}`));
+    log("");
+    log(`  Routes: ${chalk6.cyan(String(result.inventory.total))} (${result.inventory.pages} pages, ${result.inventory.apiRoutes} API, ${result.inventory.dynamic} dynamic)`);
+    log(`  Scenarios: ${chalk6.green(String(result.created))} created, ${chalk6.yellow(String(result.updated))} updated, ${chalk6.dim(String(result.deduped))} deduped`);
+    log(`  Workflows: ${result.workflows.length}`);
+    log("");
+    for (const [category, count] of Object.entries(result.inventory.categories).sort()) {
+      log(`  ${category.padEnd(18)} ${count}`);
+    }
+    log("");
+    if (!opts.createScenarios)
+      log(chalk6.dim("  Add --create-scenarios to upsert route scenarios."));
+    if (!opts.createWorkflows)
+      log(chalk6.dim("  Add --create-workflows to upsert grouped workflows."));
+    log("");
+  } catch (error40) {
+    logError(chalk6.red(`Error: ${error40 instanceof Error ? error40.message : String(error40)}`));
+    process.exit(1);
+  }
+});
 program2.command("generate <url>").description("Crawl app and synthesize test scenarios using AI (any provider)").option("--max <n>", "Max scenarios to generate", "10").option("--max-pages <n>", "Max pages to crawl", "10").option("--focus <topic>", "Focus on specific area e.g. 'auth flows', 'checkout'").option("--persona <desc>", "Persona perspective e.g. 'first-time user'").option("--model <model>", "AI model (claude-haiku, gpt-4o-mini, gemini-2.0-flash, etc.)").option("--save", "Persist generated scenarios to DB", false).option("--project <id>", "Project ID").option("--headed", "Run browser in headed mode", false).option("--json", "Output as JSON", false).action(async (url2, opts) => {
   try {
     const { generateScenarios: generateScenarios2 } = await Promise.resolve().then(() => (init_generator(), exports_generator));
@@ -100555,11 +100969,11 @@ program2.command("doctor").description("Check system setup and configuration").a
     log(chalk6.red("\u2717") + " ANTHROPIC_API_KEY is not set (required for AI-powered tests)");
     allPassed = false;
   }
-  const dbPath = join20(getTestersDir(), "testers.db");
+  const dbPath = join21(getTestersDir(), "testers.db");
   try {
     const { Database: Database5 } = await import("bun:sqlite");
-    const db2 = new Database5(dbPath, { create: true });
-    db2.close();
+    const db3 = new Database5(dbPath, { create: true });
+    db3.close();
     log(chalk6.green("\u2713") + ` Database accessible: ${dbPath}`);
   } catch (err) {
     log(chalk6.red("\u2717") + ` Database not accessible at ${dbPath}: ${err instanceof Error ? err.message : String(err)}`);
@@ -100609,7 +101023,7 @@ program2.command("serve").description("Start the Open Testers web dashboard").op
   try {
     const port = parseInt(opts.port, 10);
     const url2 = `http://localhost:${port}`;
-    const serverBin = join20(resolve4(process.execPath, ".."), "..", "dist", "server", "index.js");
+    const serverBin = join21(resolve5(process.execPath, ".."), "..", "dist", "server", "index.js");
     const { join: pathJoin, resolve: pathResolve, dirname: dirname7 } = await import("path");
     const { fileURLToPath: fileURLToPath2 } = await import("url");
     const serverPath = pathJoin(dirname7(fileURLToPath2(import.meta.url)), "..", "server", "index.js");
@@ -101028,6 +101442,9 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
 }, []).option("--max-iterations <n>", "Goal-loop iteration cap", "10").option("--target <target>", "Execution target: local or sandbox", "local").option("--sandbox-provider <provider>", "Sandbox provider: e2b, daytona, or modal").option("--sandbox-image <image>", "Sandbox image/template").option("--sandbox-remote-dir <path>", "Remote working directory for sandbox runs").option("--sandbox-cleanup <mode>", "Sandbox cleanup mode: delete, stop, or keep", "delete").option("--sandbox-sync <strategy>", "Sandbox upload sync strategy: rsync or archive", "rsync").option("--sandbox-setup-command <command>", "Shell command to run before testers in the sandbox").option("--sandbox-package <spec>", "Package spec to execute in the sandbox", "@hasna/testers").option("--sandbox-env <assignment>", "Sandbox env var; KEY forwards host KEY, KEY=value stores value (repeatable)", (val, acc) => {
   acc.push(val);
   return acc;
+}, []).option("--sandbox-env-optional <name>", "Optional sandbox env var; forwards host NAME only when set (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
 }, []).option("--sandbox-app-source <path>", "Local app source directory to upload into the sandbox").option("--sandbox-app-remote-dir <path>", "Remote app directory inside the sandbox (default: <sandbox-remote-dir>/app)").option("--sandbox-app-start-command <command>", "Shell command to start the app before testers runs").option("--sandbox-app-url <url>", "URL testers should target inside the sandbox after the app starts").option("--sandbox-app-wait-url <url>", "URL to poll before starting testers (defaults to --sandbox-app-url)").option("--sandbox-app-wait-timeout <ms>", "App readiness wait timeout in milliseconds").option("--e2b-template <name>", "Legacy alias for --sandbox-image").option("--timeout <ms>", "Workflow timeout").option("--json", "Output as JSON", false).action((name21, opts) => {
   try {
     const workflow = createTestingWorkflow({
@@ -101054,7 +101471,7 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
         sandboxSyncStrategy: opts.sandboxSync,
         setupCommand: opts.sandboxSetupCommand,
         packageSpec: opts.sandboxPackage,
-        env: parseSandboxEnv(opts.sandboxEnv),
+        env: parseSandboxEnv(opts.sandboxEnv, opts.sandboxEnvOptional),
         appSourceDir: opts.sandboxAppSource,
         appRemoteDir: opts.sandboxAppRemoteDir,
         appStartCommand: opts.sandboxAppStartCommand,
@@ -101073,6 +101490,36 @@ workflowCmd.command("create <name>").description("Save a reusable testing workfl
     process.exit(1);
   }
 });
+workflowCmd.command("update <id>").description("Update a saved testing workflow").option("--sandbox-env <assignment>", "Sandbox env var; KEY forwards host KEY, KEY=value stores value (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--sandbox-env-optional <name>", "Optional sandbox env var; forwards host NAME only when set (repeatable)", (val, acc) => {
+  acc.push(val);
+  return acc;
+}, []).option("--clear-sandbox-env", "Replace existing sandbox env vars instead of merging", false).option("--json", "Output as JSON", false).action((id, opts) => {
+  try {
+    const workflow = getTestingWorkflow(id);
+    if (!workflow) {
+      logError(chalk6.red(`Workflow not found: ${id}`));
+      process.exit(1);
+    }
+    const envPatch = parseSandboxEnv(opts.sandboxEnv, opts.sandboxEnvOptional);
+    const execution = {
+      ...workflow.execution,
+      env: opts.clearSandboxEnv ? envPatch : { ...workflow.execution.env ?? {}, ...envPatch ?? {} }
+    };
+    if (Object.keys(execution.env ?? {}).length === 0)
+      delete execution.env;
+    const updated = updateTestingWorkflow(workflow.id, { execution });
+    if (opts.json)
+      log(JSON.stringify(updated, null, 2));
+    else
+      log(chalk6.green(`Workflow updated: ${chalk6.bold(updated.id.slice(0, 8))} \u2014 ${updated.name}`));
+  } catch (error40) {
+    logError(chalk6.red(`Error: ${error40 instanceof Error ? error40.message : String(error40)}`));
+    process.exit(1);
+  }
+});
 workflowCmd.command("list").description("List saved testing workflows").option("--project <id>", "Project ID").option("--all", "Include disabled workflows", false).option("--json", "Output as JSON", false).action((opts) => {
   const workflows = listTestingWorkflows({
     projectId: opts.project ? resolveProject2(opts.project) : undefined,
@@ -101342,7 +101789,7 @@ personaCmd.command("delete <id>").description("Delete a persona").option("-y, --
     }
     if (!opts.yes) {
       process.stdout.write(chalk6.yellow(`Delete persona ${persona.shortId} "${persona.name}"? [y/N] `));
-      const answer = await new Promise((resolve5) => {
+      const answer = await new Promise((resolve6) => {
         let buf = "";
         process.stdin.setRawMode?.(true);
         process.stdin.resume();
@@ -101352,7 +101799,7 @@ personaCmd.command("delete <id>").description("Delete a persona").option("-y, --
           process.stdin.pause();
           process.stdout.write(`
 `);
-          resolve5(buf);
+          resolve6(buf);
         });
       });
       if (answer !== "y" && answer !== "yes") {
@@ -101513,7 +101960,7 @@ evalCmd.command("rag <url>").description("Run RAG quality evaluation \u2014 fait
     let ragTestCases = [];
     if (opts.docs) {
       try {
-        const raw = readFileSync10(opts.docs, "utf-8");
+        const raw = readFileSync11(opts.docs, "utf-8");
         ragTestCases = JSON.parse(raw);
       } catch {
         logError(chalk6.red(`Failed to read docs file: ${opts.docs}`));
@@ -101603,9 +102050,9 @@ Created golden answer check ${chalk6.bold(golden2.shortId)}`));
     }
     const ask = (prompt) => {
       const rl2 = createInterface({ input: process.stdin, output: process.stdout });
-      return new Promise((resolve5) => rl2.question(prompt, (ans) => {
+      return new Promise((resolve6) => rl2.question(prompt, (ans) => {
         rl2.close();
-        resolve5(ans.trim());
+        resolve6(ans.trim());
       }));
     };
     const question = await ask("Question (what this endpoint should answer): ");
@@ -101766,9 +102213,9 @@ program2.command("run-many <url>").description("Run scenarios \xD7 personas matr
 });
 program2.command("run-script <file>").description("Run a hybrid test script (.ts) that exports an array of HybridScenario objects").option("--url <url>", "Base URL to run against").option("--json", "Output as JSON", false).action(async (file2, opts) => {
   try {
-    const { resolve: resolve5 } = await import("path");
+    const { resolve: resolve6 } = await import("path");
     const { runHybridScenario: runHybridScenario2 } = await Promise.resolve().then(() => (init_hybrid_runner(), exports_hybrid_runner));
-    const scriptPath = resolve5(process.cwd(), file2);
+    const scriptPath = resolve6(process.cwd(), file2);
     const mod = await import(scriptPath);
     const scenarios = mod.scenarios ?? mod.default ?? [];
     if (!Array.isArray(scenarios) || scenarios.length === 0) {