@iamu-dev/iamu 0.2.0-beta.7 → 0.2.0-beta.9

package/dist/bin.js

@@ -10488,9 +10488,275 @@ var init_prune = __esm({
   }
 });
 
-// ../../packages/local-store/dist/human-test-link.js
+// ../../packages/local-store/dist/explore-map.js
+import { randomBytes as randomBytes2 } from "crypto";
 import { promises as fs19 } from "fs";
 import path15 from "path";
+function templateToken(token) {
+  if (token === "")
+    return token;
+  if (/^\d+$/.test(token))
+    return ":id";
+  if (UUID.test(token))
+    return ":id";
+  if (DATE.test(token))
+    return ":date";
+  if (/^[0-9a-f]{8,}$/i.test(token) && /\d/.test(token))
+    return ":id";
+  if (token.length >= 16 && /\d/.test(token) && /[a-z]/i.test(token)) {
+    return ":id";
+  }
+  return token;
+}
+function templatePath(pathname) {
+  const trimmed = pathname.length > 1 ? pathname.replace(/\/+$/, "") : pathname || "/";
+  return trimmed.split("/").map((seg) => templateToken(decodeSegment(seg))).join("/");
+}
+function encodeQueryValue(v) {
+  return v.startsWith(":") ? v : encodeURIComponent(v);
+}
+function decodeSegment(seg) {
+  try {
+    return decodeURIComponent(seg);
+  } catch {
+    return seg;
+  }
+}
+function explorePlaceKey(raw) {
+  if (!raw)
+    return null;
+  let u;
+  try {
+    u = new URL(raw);
+  } catch {
+    return null;
+  }
+  if (u.protocol !== "http:" && u.protocol !== "https:")
+    return null;
+  const params = [...u.searchParams.entries()].filter(([k]) => !k.toLowerCase().startsWith("utm_")).map(([k, v]) => [k, templateToken(v)]).sort(([a, av], [b, bv]) => a.localeCompare(b) || av.localeCompare(bv));
+  const query = params.map(([k, v]) => `${encodeURIComponent(k)}=${encodeQueryValue(v)}`).join("&");
+  let key = templatePath(u.pathname);
+  if (query)
+    key += `?${query}`;
+  const route = /^#!?(\/.*)$/.exec(u.hash);
+  if (route) {
+    const [hashPath] = route[1].split("?");
+    key += `#${templatePath(hashPath)}`;
+  }
+  return key;
+}
+function exploreViewSignature(headings) {
+  return headings.map((h) => h.trim().replace(/\s+/g, " ").replace(/\d+/g, "#").toLowerCase()).filter(Boolean).join(" | ");
+}
+function exploreSignature(headings, title) {
+  return exploreViewSignature(headings) || title.trim().toLowerCase();
+}
+function matchExploreSurface(map2, url, signature) {
+  const place = explorePlaceKey(url);
+  if (!place)
+    return null;
+  const atPlace = map2.surfaces.filter((s) => s.place === place);
+  return atPlace.find((s) => s.signature === signature) ?? (atPlace.length === 1 ? atPlace[0] : null);
+}
+function exploreSurfaceKey(place, view) {
+  return view === null ? place : `${place}~${fnv1a(view)}`;
+}
+function fnv1a(s) {
+  let h = 2166136261;
+  for (let i = 0; i < s.length; i++) {
+    h ^= s.charCodeAt(i);
+    h = Math.imul(h, 16777619) >>> 0;
+  }
+  return h.toString(16).padStart(8, "0");
+}
+function exploreDir(projectRoot) {
+  return path15.join(cacheDir(projectRoot), "explore");
+}
+function composeExploreId(now, randomHex) {
+  const ts = now.toISOString().replace(/[:.]/g, "-").replace(/Z$/, "");
+  return `${ts}-${randomHex ?? randomBytes2(3).toString("hex")}`;
+}
+function isValidExploreId(id) {
+  return MAP_ID.test(id);
+}
+function mapPath(projectRoot, id) {
+  if (!isValidExploreId(id))
+    throw new Error(`Not an explore map id: ${id}`);
+  return path15.join(exploreDir(projectRoot), id, "map.json");
+}
+async function writeExploreMap(projectRoot, map2) {
+  const file = mapPath(projectRoot, map2.id);
+  await fs19.mkdir(path15.dirname(file), { recursive: true });
+  await atomicWriteFile(file, `${JSON.stringify(map2, null, 2)}
+`);
+  return file;
+}
+async function readExploreMap(projectRoot, id) {
+  const raw = await fs19.readFile(mapPath(projectRoot, id), "utf8");
+  const map2 = JSON.parse(raw);
+  if (map2?.schema !== EXPLORE_MAP_SCHEMA || !Array.isArray(map2.surfaces)) {
+    throw new Error(`Unreadable explore map: ${id}`);
+  }
+  return map2;
+}
+async function listExploreMaps(projectRoot) {
+  try {
+    const entries = await fs19.readdir(exploreDir(projectRoot), {
+      withFileTypes: true
+    });
+    return entries.filter((e) => e.isDirectory() && isValidExploreId(e.name)).map((e) => e.name).sort();
+  } catch (err) {
+    if (err.code === "ENOENT")
+      return [];
+    throw err;
+  }
+}
+function exploreCoverage(map2, steps) {
+  const byPlace = /* @__PURE__ */ new Map();
+  for (const s of map2.surfaces) {
+    byPlace.set(s.place, [...byPlace.get(s.place) ?? [], s]);
+  }
+  const reachedBy = /* @__PURE__ */ new Map();
+  const unresolvedBy = /* @__PURE__ */ new Map();
+  const runOnlyBy = /* @__PURE__ */ new Map();
+  const add = (m, k, s) => m.set(k, [...m.get(k) ?? [], s]);
+  for (const step of steps) {
+    const place = explorePlaceKey(step.url);
+    if (!place)
+      continue;
+    const atPlace = byPlace.get(place);
+    if (!atPlace) {
+      add(runOnlyBy, place, step);
+      continue;
+    }
+    const hit = tieStep(map2, atPlace, step);
+    if (hit.length === 0)
+      add(unresolvedBy, place, step);
+    for (const s of hit)
+      add(reachedBy, s.key, step);
+  }
+  const surfaces = map2.surfaces.map((s) => {
+    const base = {
+      key: s.key,
+      label: s.label,
+      place: s.place,
+      url: s.url,
+      depth: s.depth
+    };
+    const reached = reachedBy.get(s.key);
+    if (reached)
+      return { ...base, status: "reached", runs: distinctRuns(reached) };
+    const unresolved = unresolvedBy.get(s.place);
+    if (unresolved) {
+      return { ...base, status: "place_only", runs: distinctRuns(unresolved) };
+    }
+    return { ...base, status: "unreached", runs: [] };
+  });
+  const runOnly = [...runOnlyBy].map(([place, list2]) => ({
+    place,
+    steps: list2.length,
+    runs: distinctRuns(list2)
+  }));
+  runOnly.sort((a, b) => b.steps - a.steps || a.place.localeCompare(b.place));
+  return {
+    map_id: map2.id,
+    runs: new Set(steps.map((s) => s.run_id)).size,
+    steps: steps.length,
+    reached: surfaces.filter((s) => s.status === "reached").length,
+    place_only: surfaces.filter((s) => s.status === "place_only").length,
+    unreached: surfaces.filter((s) => s.status === "unreached").length,
+    surfaces,
+    run_only_places: runOnly
+  };
+}
+function tieStep(map2, atPlace, step) {
+  if (typeof step.signature === "string") {
+    const m = matchExploreSurface(map2, step.url, step.signature);
+    return m ? [m] : [];
+  }
+  if (atPlace.length === 1)
+    return [atPlace[0]];
+  const name = step.surface?.trim();
+  if (!name)
+    return [];
+  return atPlace.filter((s) => [s.label, ...s.headings].filter(Boolean).some((n) => surfaceMatches(n, name) || surfaceMatches(name, n)));
+}
+function distinctRuns(steps) {
+  return [...new Set(steps.map((s) => s.run_id))].sort();
+}
+async function readAllRunSteps(projectRoot) {
+  const out = [];
+  for (const runId of await listRuns(projectRoot)) {
+    let steps;
+    try {
+      steps = await readStepsForRun(projectRoot, runId);
+    } catch {
+      continue;
+    }
+    for (const s of steps) {
+      out.push({ run_id: runId, url: s.url, surface: s.surface });
+    }
+  }
+  return out;
+}
+function actionSignature(a) {
+  const where = a.outcome.kind === "surface" ? a.outcome.surface : a.outcome.kind === "skipped" ? `skipped:${a.outcome.reason}` : a.outcome.kind === "external" ? `external:${a.outcome.url}` : a.outcome.kind;
+  return `${a.role} "${a.name}" \u2192 ${where}`;
+}
+function diffExploreMaps(a, b) {
+  const aByKey = new Map(a.surfaces.map((s) => [s.key, s]));
+  const bByKey = new Map(b.surfaces.map((s) => [s.key, s]));
+  const ref = (s) => ({
+    key: s.key,
+    label: s.label
+  });
+  const onlyA = a.surfaces.filter((s) => !bByKey.has(s.key)).map(ref);
+  const onlyB = b.surfaces.filter((s) => !aByKey.has(s.key)).map(ref);
+  const changed = [];
+  let common2 = 0;
+  for (const sa of a.surfaces) {
+    const sb = bByKey.get(sa.key);
+    if (!sb)
+      continue;
+    common2++;
+    const setA = new Set(sa.actions.map(actionSignature));
+    const setB = new Set(sb.actions.map(actionSignature));
+    const inA = [...setA].filter((x) => !setB.has(x)).sort();
+    const inB = [...setB].filter((x) => !setA.has(x)).sort();
+    if (inA.length > 0 || inB.length > 0) {
+      changed.push({ ...ref(sa), only_a: inA, only_b: inB });
+    }
+  }
+  const union = common2 + onlyA.length + onlyB.length;
+  return {
+    a: a.id,
+    b: b.id,
+    common: common2,
+    only_a: onlyA,
+    only_b: onlyB,
+    surface_overlap: union === 0 ? 1 : common2 / union,
+    changed_actions: changed
+  };
+}
+var EXPLORE_MAP_SCHEMA, UUID, DATE, MAP_ID;
+var init_explore_map = __esm({
+  "../../packages/local-store/dist/explore-map.js"() {
+    "use strict";
+    init_atomic();
+    init_paths();
+    init_revisit();
+    init_runs();
+    init_walkthrough_canonical2();
+    EXPLORE_MAP_SCHEMA = 1;
+    UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+    DATE = /^\d{4}-\d{2}-\d{2}$/;
+    MAP_ID = /^\d{4}-\d{2}-\d{2}T\d{2}-\d{2}-\d{2}-\d{3}-[0-9a-f]{6}$/;
+  }
+});
+
+// ../../packages/local-store/dist/human-test-link.js
+import { promises as fs20 } from "fs";
+import path16 from "path";
 function humanTestLinks(verdicts) {
   const best = /* @__PURE__ */ new Map();
   for (const v of verdicts) {
@@ -10513,7 +10779,7 @@ async function linkFindingsToHumanTests(projectRoot, runId, verdicts) {
   const dir = entityDirPath(projectRoot, "finding");
   let names;
   try {
-    names = await fs19.readdir(dir);
+    names = await fs20.readdir(dir);
   } catch {
     return [];
   }
@@ -10521,11 +10787,11 @@ async function linkFindingsToHumanTests(projectRoot, runId, verdicts) {
   for (const name of names) {
     if (!name.endsWith(".md") || name.startsWith("."))
       continue;
-    const file = path15.join(dir, name);
+    const file = path16.join(dir, name);
     let raw;
     let fm;
     try {
-      raw = await fs19.readFile(file, "utf8");
+      raw = await fs20.readFile(file, "utf8");
       fm = parseFrontmatter(raw).frontmatter;
     } catch {
       continue;
@@ -10756,14 +11022,14 @@ var init_cloud_client = __esm({
 });
 
 // ../../packages/local-store/dist/last-pull.js
-import { promises as fs20 } from "fs";
-import path16 from "path";
+import { promises as fs21 } from "fs";
+import path17 from "path";
 function lastPullPath(projectRoot) {
-  return path16.join(cacheDir(projectRoot), "last-pull.json");
+  return path17.join(cacheDir(projectRoot), "last-pull.json");
 }
 async function readLastPull(projectRoot) {
   try {
-    const raw = await fs20.readFile(lastPullPath(projectRoot), "utf8");
+    const raw = await fs21.readFile(lastPullPath(projectRoot), "utf8");
     const parsed = JSON.parse(raw);
     if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
       return parsed;
@@ -11049,7 +11315,7 @@ var init_frontmatter2 = __esm({
 });
 
 // ../../packages/local-store/dist/pull/write.js
-import { promises as fs21 } from "fs";
+import { promises as fs22 } from "fs";
 async function loadLocalIndex(projectRoot, type2) {
   const byId = /* @__PURE__ */ new Map();
   const bySlug = /* @__PURE__ */ new Map();
@@ -11078,7 +11344,7 @@ async function classifyExisting(projectRoot, type2, cloudId, localSlug, targetSl
   if (localSlug !== targetSlug)
     return "untracked";
   const lastSynced = localIndex.lastPushById[cloudId];
-  const bytes = await fs21.readFile(entityFilePath(projectRoot, type2, localSlug), "utf8");
+  const bytes = await fs22.readFile(entityFilePath(projectRoot, type2, localSlug), "utf8");
   return lastSynced && hashNormalizedContent(bytes) === lastSynced ? "fast_forward" : "diverged";
 }
 async function writeOrSkip(projectRoot, type2, cloudId, slug, frontmatter, body, localIndex, mode, cloudVersion) {
@@ -11139,13 +11405,13 @@ async function writeOrSkip(projectRoot, type2, cloudId, slug, frontmatter, body,
   }
   if (existingSlugForId && existingSlugForId !== slug) {
     try {
-      await fs21.unlink(entityFilePath(projectRoot, type2, existingSlugForId));
+      await fs22.unlink(entityFilePath(projectRoot, type2, existingSlugForId));
       localIndex.bySlug.delete(existingSlugForId);
     } catch {
     }
   }
   await writeEntity(projectRoot, type2, frontmatter, text);
-  const bytes = await fs21.readFile(entityFilePath(projectRoot, type2, slug), "utf8");
+  const bytes = await fs22.readFile(entityFilePath(projectRoot, type2, slug), "utf8");
   const hash = hashNormalizedContent(bytes);
   localIndex.byId.set(cloudId, slug);
   localIndex.bySlug.set(slug, cloudId);
@@ -11199,7 +11465,7 @@ var init_write = __esm({
 });
 
 // ../../packages/local-store/dist/pull/entities.js
-import { promises as fs22 } from "fs";
+import { promises as fs23 } from "fs";
 function buildContextFrontmatter(payload) {
   const cloudCtx = payload.context ?? {};
   const glossary = (payload.glossary ?? []).map((g) => ({
@@ -11254,7 +11520,7 @@ async function pullContext(projectRoot, cloud, projectId, mode, result) {
   const frontmatter = buildContextFrontmatter(payload);
   let hasLocal = false;
   try {
-    await fs22.access(contextPath(projectRoot));
+    await fs23.access(contextPath(projectRoot));
     hasLocal = true;
   } catch {
     hasLocal = false;
@@ -11284,7 +11550,7 @@ async function pullContext(projectRoot, cloud, projectId, mode, result) {
       frontmatter,
       notes_body: existingNotes
     });
-    const bytes = await fs22.readFile(contextPath(projectRoot), "utf8");
+    const bytes = await fs23.readFile(contextPath(projectRoot), "utf8");
     const hash = hashNormalizedContent(bytes);
     await recordLastPull(projectRoot, "context:root", hash);
     await recordLastPush(projectRoot, "context:root", hash);
@@ -11814,6 +12080,7 @@ var init_dist2 = __esm({
     init_prune();
     init_fix_state();
     init_revisit();
+    init_explore_map();
     init_walkthrough_canonical2();
     init_journey_diff();
     init_finding_match();
@@ -11845,15 +12112,15 @@ function resolveApiUrl(configured) {
   assertSecureApiUrl(url, configured ? "API URL" : "IAMU_API_URL");
   return url;
 }
-function parseStore(raw, path28) {
+function parseStore(raw, path30) {
   let parsed;
   try {
     parsed = JSON.parse(raw);
   } catch (err) {
-    throw new CredentialsFileError(path28, "not valid JSON", err);
+    throw new CredentialsFileError(path30, "not valid JSON", err);
   }
   if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
-    throw new CredentialsFileError(path28, "expected a JSON object");
+    throw new CredentialsFileError(path30, "expected a JSON object");
   }
   return parsed;
 }
@@ -11861,26 +12128,26 @@ function isNotFound(err) {
   return typeof err === "object" && err !== null && err.code === "ENOENT";
 }
 async function readCredentialsStore() {
-  const path28 = getCredentialsPath();
+  const path30 = getCredentialsPath();
   let raw;
   try {
-    raw = await readFile(path28, "utf-8");
+    raw = await readFile(path30, "utf-8");
   } catch (err) {
     if (isNotFound(err)) return {};
     warnUnreadableStoreOnce(err);
     throw err;
   }
   try {
-    return parseStore(raw, path28);
+    return parseStore(raw, path30);
   } catch (err) {
     warnUnreadableStoreOnce(err);
     throw err;
   }
 }
 async function writeCredentialsStore(store) {
-  const path28 = getCredentialsPath();
-  await mkdir(dirname(path28), { recursive: true, mode: 448 });
-  await atomicWriteFile(path28, `${JSON.stringify(store, null, 2)}
+  const path30 = getCredentialsPath();
+  await mkdir(dirname(path30), { recursive: true, mode: 448 });
+  await atomicWriteFile(path30, `${JSON.stringify(store, null, 2)}
 `, {
     mode: 384
   });
@@ -11900,16 +12167,16 @@ function resolveApiKey(apiUrl) {
   } catch {
     return null;
   }
-  const path28 = getCredentialsPath();
+  const path30 = getCredentialsPath();
   let raw;
   try {
-    raw = readFileSync(path28, "utf-8");
+    raw = readFileSync(path30, "utf-8");
   } catch (err) {
     if (!isNotFound(err)) warnUnreadableStoreOnce(err);
     return null;
   }
   try {
-    const entry = parseStore(raw, path28)[url];
+    const entry = parseStore(raw, path30)[url];
     if (typeof entry !== "object" || entry === null) return null;
     const token = entry.token;
     return typeof token === "string" && token ? token : null;
@@ -11948,12 +12215,12 @@ var init_credentials = __esm({
        * @param reason - What is wrong with it.
        * @param cause - Underlying parse error, if any.
        */
-      constructor(path28, reason, cause) {
+      constructor(path30, reason, cause) {
         super(
-          `Credentials file ${path28} is corrupt (${reason}). Fix it by hand, or delete it and run \`iamu auth login\` again.`,
+          `Credentials file ${path30} is corrupt (${reason}). Fix it by hand, or delete it and run \`iamu auth login\` again.`,
           {
             cause,
-            suggestedAction: `Delete ${path28} and run \`iamu auth login\`, or set IAMU_TOKEN.`
+            suggestedAction: `Delete ${path30} and run \`iamu auth login\`, or set IAMU_TOKEN.`
           }
         );
       }
@@ -12565,16 +12832,16 @@ async function needsWrite(filePath, content) {
     return true;
   }
 }
-function isCliWrittenSkill(path28) {
+function isCliWrittenSkill(path30) {
   try {
-    return /^generatedBy:/m.test(readFileSync3(path28, "utf-8"));
+    return /^generatedBy:/m.test(readFileSync3(path30, "utf-8"));
   } catch {
     return false;
   }
 }
-function isCliWrittenPrompt(path28) {
+function isCliWrittenPrompt(path30) {
   try {
-    const content = readFileSync3(path28, "utf-8");
+    const content = readFileSync3(path30, "utf-8");
     return content.includes("iamu") || /^generatedBy:/m.test(content);
   } catch {
     return false;
@@ -12586,8 +12853,8 @@ function planSkillFiles(hosts, projectRoot, version2) {
   for (const host of hosts) {
     if (pluginProvidesSkills(host, projectRoot)) {
       for (const name of skillTemplates.keys()) {
-        const path28 = join4(host.getSkillsDir(projectRoot), name, "SKILL.md");
-        if (isCliWrittenSkill(path28)) files.push({ host, path: path28, content: null });
+        const path30 = join4(host.getSkillsDir(projectRoot), name, "SKILL.md");
+        if (isCliWrittenSkill(path30)) files.push({ host, path: path30, content: null });
       }
     } else if (host.supportsSkills) {
       const skillsDir = host.getSkillsDir(projectRoot);
@@ -14107,7 +14374,7 @@ import {
   readlinkSync,
   realpathSync as realpathSync2
 } from "fs";
-import path17 from "path";
+import path18 from "path";
 function git(args, cwd) {
   return execFileSync("git", args, {
     cwd,
@@ -14160,8 +14427,8 @@ function detectWorktreeState(projectRoot, iamuDirName = IAMU_DIR) {
     const top = git(["rev-parse", "--show-toplevel"], projectRoot).toString("utf8").trim();
     if (!top) return void 0;
     const realTop = realpathSync2(top);
-    const realIamu = path17.join(realpathSync2(projectRoot), iamuDirName);
-    const iamuRel = path17.relative(realTop, realIamu).split(path17.sep).join("/");
+    const realIamu = path18.join(realpathSync2(projectRoot), iamuDirName);
+    const iamuRel = path18.relative(realTop, realIamu).split(path18.sep).join("/");
     const pathspec = iamuRel.startsWith("..") ? [":(top)"] : [":(top)", `:(top,exclude,literal)${iamuRel}`];
     const status2 = git(
       [
@@ -14191,7 +14458,7 @@ function detectWorktreeState(projectRoot, iamuDirName = IAMU_DIR) {
     );
     for (const file of sorted.slice(0, MAX_UNTRACKED_HASHED)) {
       const rel = file.replace(/\/$/, "");
-      hash.update(`${file}\0${hashFile(path17.join(realTop, rel))}
+      hash.update(`${file}\0${hashFile(path18.join(realTop, rel))}
 `);
     }
     if (sorted.length > MAX_UNTRACKED_HASHED) {
@@ -14364,7 +14631,7 @@ __export(start_run_exports, {
   resolveStartUrl: () => resolveStartUrl,
   startRun: () => startRun
 });
-import path18 from "path";
+import path19 from "path";
 import chalk11 from "chalk";
 function resolveStartUrl(target, scenario) {
   const base = target ?? scenario.target_url ?? null;
@@ -14540,7 +14807,7 @@ async function startRun(scenarioSlug, opts) {
     ...viewport ? { viewport } : {}
   };
   await atomicWriteFile(
-    path18.join(run.absPath, "walkthrough.json"),
+    path19.join(run.absPath, "walkthrough.json"),
     JSON.stringify(manifest, null, 2) + "\n"
   );
   if (opts.json) {
@@ -14548,7 +14815,7 @@ async function startRun(scenarioSlug, opts) {
       JSON.stringify(
         {
           run_id: run.runId,
-          path: path18.relative(projectRoot, run.absPath),
+          path: path19.relative(projectRoot, run.absPath),
           scenario_slug: scenarioSlug,
           target_url: start2.url,
           target_reachable: targetReachable,
@@ -14596,7 +14863,7 @@ async function startRun(scenarioSlug, opts) {
     );
   }
   console.log(
-    `  ${chalk11.dim("path:")}     ${path18.relative(projectRoot, run.absPath)}`
+    `  ${chalk11.dim("path:")}     ${path19.relative(projectRoot, run.absPath)}`
   );
   console.log();
   console.log(`  ${chalk11.bold("Next steps for blind execution:")}`);
@@ -14637,8 +14904,8 @@ var report_exports = {};
 __export(report_exports, {
   report: () => report
 });
-import { promises as fs23 } from "fs";
-import path19 from "path";
+import { promises as fs24 } from "fs";
+import path20 from "path";
 import chalk12 from "chalk";
 async function report(scenario, opts) {
   const ctx = await resolveProject(opts);
@@ -14657,8 +14924,8 @@ async function report(scenario, opts) {
   for (const rid of runs.reverse()) {
     try {
       const dir = runDir(projectRoot, rid);
-      const mRaw = await fs23.readFile(
-        path19.join(dir, "walkthrough.json"),
+      const mRaw = await fs24.readFile(
+        path20.join(dir, "walkthrough.json"),
         "utf8"
       );
       const manifest = JSON.parse(mRaw);
@@ -14666,8 +14933,8 @@ async function report(scenario, opts) {
       if (scenario && manifest.scenario_slug !== scenario) continue;
       let canonical = null;
       try {
-        const cRaw = await fs23.readFile(
-          path19.join(dir, "canonical.json"),
+        const cRaw = await fs24.readFile(
+          path20.join(dir, "canonical.json"),
           "utf8"
         );
         canonical = JSON.parse(cRaw);
@@ -15944,6 +16211,35 @@ async function init(opts) {
         ""
       )
     );
+    const testabilityPath = join5(iamuDir2, "testability.md");
+    if (!existsSync7(testabilityPath)) {
+      await writeFile3(
+        testabilityPath,
+        serializeFrontmatter(
+          {
+            status: "draft",
+            target_url: "http://localhost:3000"
+          },
+          `# Project Testability & Environment
+
+Target URL and execution harness for walkthroughs.
+Audited and populated during /iamu:init.
+
+## Target & Run Instructions
+- Default URL: http://localhost:3000
+
+## Reachable Surfaces
+(Run /iamu:init to discover testable routes)
+
+## Mocks & Data Fixtures
+(Run /iamu:init to inspect existing harnesses)
+
+## Untestable Boundaries
+(None documented yet)
+`
+        )
+      );
+    }
   }
   const promptTemplates = loadPromptTemplates();
   const promptsDir = join5(iamuDir2, ".prompts");
@@ -16553,7 +16849,7 @@ var init_browse_driver = __esm({
 
 // src/commands/step-numbering.ts
 import { open, readdir, unlink } from "fs/promises";
-import path20 from "path";
+import path21 from "path";
 function stepFileName(stepNumber2) {
   return `${String(stepNumber2).padStart(3, "0")}.json`;
 }
@@ -16575,7 +16871,7 @@ async function reserveStepFile(stepsDir, limit) {
     if (candidate > limit.maxSteps) {
       throw new Error(stepLimitMessage(limit.maxSteps, limit.runId));
     }
-    const stepPath = path20.join(stepsDir, stepFileName(candidate));
+    const stepPath = path21.join(stepsDir, stepFileName(candidate));
     try {
       const handle = await open(stepPath, "wx");
       await handle.close();
@@ -16607,7 +16903,7 @@ __export(step_exports, {
   stepCommand: () => stepCommand
 });
 import { copyFile, mkdir as mkdir5, stat } from "fs/promises";
-import path21 from "path";
+import path22 from "path";
 import chalk19 from "chalk";
 function parseMaxSteps(val) {
   if (typeof val === "number" && Number.isFinite(val) && val > 0) return val;
@@ -16626,8 +16922,8 @@ async function recordStep(input) {
   if (!runDirPath) {
     throw new Error(`Run directory not found for run "${input.runId}"`);
   }
-  const stepsDir = path21.join(runDirPath, "steps");
-  const screenshotsDir = path21.join(runDirPath, "screenshots");
+  const stepsDir = path22.join(runDirPath, "steps");
+  const screenshotsDir = path22.join(runDirPath, "screenshots");
   await mkdir5(stepsDir, { recursive: true });
   await mkdir5(screenshotsDir, { recursive: true });
   const shotSource = input.shot ? await existingShot(input.shot) : null;
@@ -16641,11 +16937,11 @@ async function recordStep(input) {
     let finalScreenshotPath = null;
     if (shotSource) {
       const destName = `step-${stepNumber2}.png`;
-      finalScreenshotPath = path21.join(screenshotsDir, destName);
-      if (path21.resolve(finalScreenshotPath) !== shotSource) {
+      finalScreenshotPath = path22.join(screenshotsDir, destName);
+      if (path22.resolve(finalScreenshotPath) !== shotSource) {
         await copyFile(shotSource, finalScreenshotPath);
       }
-      screenshotRef = path21.join("screenshots", destName);
+      screenshotRef = path22.join("screenshots", destName);
     }
     const parsedStep = runStepSchema.parse({
       step_number: stepNumber2,
@@ -16670,7 +16966,7 @@ async function recordStep(input) {
   }
 }
 async function existingShot(shot) {
-  const resolved = path21.resolve(shot);
+  const resolved = path22.resolve(shot);
   const isFile = await stat(resolved).then((s) => s.isFile()).catch(() => false);
   if (!isFile) {
     throw new Error(
@@ -16712,7 +17008,7 @@ async function stepCommand(runArg, opts) {
         JSON.stringify(
           {
             step_number: res.step.step_number,
-            path: path21.relative(projectRoot, res.stepPath),
+            path: path22.relative(projectRoot, res.stepPath),
             action: res.step.action,
             note: res.step.note,
             url: res.step.url,
@@ -16739,7 +17035,7 @@ async function stepCommand(runArg, opts) {
       console.log(`  ${chalk19.dim("shot:")}       ${res.step.screenshot}`);
     }
     console.log(
-      `  ${chalk19.dim("file:")}       ${path21.relative(projectRoot, res.stepPath)}`
+      `  ${chalk19.dim("file:")}       ${path22.relative(projectRoot, res.stepPath)}`
     );
     console.log();
   } catch (err) {
@@ -16782,21 +17078,21 @@ import {
 } from "fs";
 import { rm as rm2 } from "fs/promises";
 import { homedir as homedir3 } from "os";
-import path22 from "path";
+import path23 from "path";
 import chalk20 from "chalk";
 function stateDir() {
-  return path22.join(
-    process.env.IAMU_HOME ?? path22.join(homedir3(), ".iamu"),
+  return path23.join(
+    process.env.IAMU_HOME ?? path23.join(homedir3(), ".iamu"),
     "browse"
   );
 }
 function profileDir() {
-  return path22.join(stateDir(), "profile");
+  return path23.join(stateDir(), "profile");
 }
 function readBrowseState() {
   try {
     return JSON.parse(
-      readFileSync6(path22.join(stateDir(), "state.json"), "utf8")
+      readFileSync6(path23.join(stateDir(), "state.json"), "utf8")
     );
   } catch {
     return null;
@@ -16804,7 +17100,7 @@ function readBrowseState() {
 }
 function writeState(state) {
   mkdirSync(stateDir(), { recursive: true });
-  writeFileSync(path22.join(stateDir(), "state.json"), JSON.stringify(state));
+  writeFileSync(path23.join(stateDir(), "state.json"), JSON.stringify(state));
 }
 function fail(message, opts) {
   if (opts?.json) {
@@ -16867,7 +17163,7 @@ async function requestedViewport(opts) {
   let manifest;
   try {
     manifest = JSON.parse(
-      readFileSync6(path22.join(dir, "walkthrough.json"), "utf8")
+      readFileSync6(path23.join(dir, "walkthrough.json"), "utf8")
     );
   } catch {
     fail(
@@ -16973,7 +17269,7 @@ async function stop(opts, driver) {
   await driver.closeBrowser(state.port);
   if (state.pid) await reapBrowser(state.pid, profileDir(), driver);
   try {
-    unlinkSync(path22.join(stateDir(), "state.json"));
+    unlinkSync(path23.join(stateDir(), "state.json"));
   } catch {
   }
   report2(opts, { stopped: true }, [`  ${chalk20.green("\u2713")} Browser stopped`]);
@@ -17039,8 +17335,8 @@ async function withPage(opts, driver, fn, target) {
     let screenshot = null;
     if (opts.shot) {
       await waitForVisualStability(page);
-      screenshot = path22.resolve(opts.shot);
-      mkdirSync(path22.dirname(screenshot), { recursive: true });
+      screenshot = path23.resolve(opts.shot);
+      mkdirSync(path23.dirname(screenshot), { recursive: true });
       await page.screenshot({ path: screenshot, fullPage: Boolean(opts.full) });
     }
     return { url: page.url(), title: await page.title(), screenshot };
@@ -17119,7 +17415,7 @@ function printStep(opts, record, projectRoot) {
   if (opts.json) {
     const doc = {
       step_number: step.step_number,
-      path: path22.relative(projectRoot, record.stepPath),
+      path: path23.relative(projectRoot, record.stepPath),
       action: step.action,
       note: step.note,
       url: step.url,
@@ -17193,10 +17489,10 @@ async function browseStep(args, opts, driver) {
   const runDirPath = resolveRunDir(ctx.projectRoot, opts.run);
   if (!runDirPath) return;
   const maxSteps = parseMaxSteps(opts.maxSteps);
-  if (await peekNextStepNumber(path22.join(runDirPath, "steps")) > maxSteps) {
+  if (await peekNextStepNumber(path23.join(runDirPath, "steps")) > maxSteps) {
     return fail(stepLimitMessage(maxSteps, opts.run), opts);
   }
-  const pendingShot = path22.join(
+  const pendingShot = path23.join(
     runDirPath,
     "screenshots",
     `.pending-${randomUUID7()}.png`
@@ -17267,11 +17563,14 @@ var doctor_exports = {};
 __export(doctor_exports, {
   checkCdpResponsive: () => checkCdpResponsive,
   checkPortAvailable: () => checkPortAvailable,
+  checkProjectHarnesses: () => checkProjectHarnesses,
+  checkProjectTestabilityContract: () => checkProjectTestabilityContract,
+  checkTargetHealth: () => checkTargetHealth,
   doctor: () => doctor,
   runDoctorChecks: () => runDoctorChecks
 });
 import { createServer } from "net";
-import { existsSync as existsSync10 } from "fs";
+import { existsSync as existsSync10, promises as fs25 } from "fs";
 import { join as join7 } from "path";
 import chalk21 from "chalk";
 function checkPortAvailable(port) {
@@ -17549,11 +17848,186 @@ async function checkAgentIntegrations(projectRoot) {
   }
   return checks;
 }
-async function runDoctorChecks(projectRoot) {
+async function checkTargetHealth(targetUrl) {
+  const checks = [];
+  let parsedUrl;
+  try {
+    parsedUrl = new URL(targetUrl);
+  } catch {
+    checks.push({
+      category: "target",
+      name: "Target URL Format",
+      status: "error",
+      message: `Invalid target URL: "${targetUrl}"`,
+      remedy: "Provide a valid URL with protocol (e.g. http://localhost:3000)."
+    });
+    return checks;
+  }
+  try {
+    const res = await fetch(targetUrl, {
+      method: "GET",
+      redirect: "manual",
+      signal: AbortSignal.timeout(3e3)
+    });
+    if ([301, 302, 303, 307, 308].includes(res.status)) {
+      const location = res.headers.get("location") || "";
+      const isExternalAuth = /auth0\.com|okta\.com|clerk\.com|accounts\.google\.com|cognito|login\.microsoftonline\.com/i.test(
+        location
+      ) || location.includes("/oauth");
+      if (isExternalAuth) {
+        let redirectHost = location;
+        try {
+          redirectHost = new URL(location, targetUrl).host;
+        } catch {
+        }
+        checks.push({
+          category: "target",
+          name: "Authentication Boundary",
+          status: "warn",
+          message: `Target immediately redirects to external auth (${redirectHost})`,
+          remedy: "Configure a dev auth bypass or prepare for interactive login handshake before walking."
+        });
+        return checks;
+      }
+      checks.push({
+        category: "target",
+        name: "Target Reachability",
+        status: "ok",
+        message: `HTTP ${res.status} redirect -> ${location}`
+      });
+      return checks;
+    }
+    if (res.status >= 500) {
+      checks.push({
+        category: "target",
+        name: "Target Health",
+        status: "error",
+        message: `Target returned HTTP ${res.status} ${res.statusText || "Server Error"}`,
+        remedy: "Check dev server logs for unhandled exceptions or missing environment variables."
+      });
+      return checks;
+    }
+    checks.push({
+      category: "target",
+      name: "Target Reachability",
+      status: "ok",
+      message: `HTTP ${res.status} OK (${parsedUrl.origin})`
+    });
+  } catch (err) {
+    const message = err.message;
+    checks.push({
+      category: "target",
+      name: "Target Reachability",
+      status: "warn",
+      message: `Cannot connect to ${targetUrl} (${message})`,
+      remedy: "Ensure your dev server is running and listening on the specified port."
+    });
+  }
+  return checks;
+}
+async function checkProjectHarnesses(projectRoot) {
+  const checks = [];
+  const pkgPath = join7(projectRoot, "package.json");
+  if (!existsSync10(pkgPath)) return checks;
+  try {
+    const raw = await fs25.readFile(pkgPath, "utf8");
+    const pkg = JSON.parse(raw);
+    const scripts = pkg.scripts || {};
+    const allDeps = {
+      ...pkg.dependencies || {},
+      ...pkg.devDependencies || {}
+    };
+    const devScripts = ["dev", "start", "dev:mock", "serve"].filter(
+      (s) => s in scripts
+    );
+    if (devScripts.length > 0) {
+      checks.push({
+        category: "target",
+        name: "Dev Server Script",
+        status: "ok",
+        message: `Available scripts: ${devScripts.map((s) => `pnpm ${s}`).join(", ")}`
+      });
+    } else {
+      checks.push({
+        category: "target",
+        name: "Dev Server Script",
+        status: "warn",
+        message: "No standard dev script (dev, start, dev:mock) found in package.json",
+        remedy: "Add a `dev` or `start` script to package.json to boot your app locally."
+      });
+    }
+    if (allDeps.msw || existsSync10(join7(projectRoot, "src/mocks")) || existsSync10(join7(projectRoot, "mocks"))) {
+      checks.push({
+        category: "target",
+        name: "Mock Harness (MSW)",
+        status: "ok",
+        message: "Mock Service Worker detected. API mocks can decouple walks from live backends."
+      });
+    }
+    const seedScript = Object.keys(scripts).find(
+      (s) => /seed|db:seed|fixtures/i.test(s)
+    );
+    if (seedScript) {
+      checks.push({
+        category: "target",
+        name: "Database Seed",
+        status: "ok",
+        message: `Seed script detected (${seedScript}). Preconditions can be reset between runs.`
+      });
+    }
+  } catch {
+  }
+  return checks;
+}
+async function checkProjectTestabilityContract(projectRoot) {
+  const checks = [];
+  const testabilityPath = join7(projectRoot, "iamu", "testability.md");
+  if (!existsSync10(testabilityPath)) {
+    checks.push({
+      category: "target",
+      name: "Testability Contract (testability.md)",
+      status: "warn",
+      message: "iamu/testability.md not found",
+      remedy: "Run `/iamu:init` to audit your codebase and record testable routes, auth strategies, and mock harnesses."
+    });
+    return { checks };
+  }
+  try {
+    const raw = await fs25.readFile(testabilityPath, "utf8");
+    const { frontmatter } = parseFrontmatter(raw);
+    const targetUrl = typeof frontmatter.target_url === "string" ? frontmatter.target_url : void 0;
+    const details = [];
+    if (targetUrl) details.push(`Target: ${targetUrl}`);
+    if (frontmatter.dev_command) {
+      details.push(`Command: ${frontmatter.dev_command}`);
+    }
+    if (frontmatter.auth_strategy) {
+      details.push(`Auth: ${frontmatter.auth_strategy}`);
+    }
+    checks.push({
+      category: "target",
+      name: "Testability Contract (testability.md)",
+      status: "ok",
+      message: `Configured (${details.join(" \xB7 ") || "present"})`
+    });
+    return { checks, targetUrl };
+  } catch (err) {
+    checks.push({
+      category: "target",
+      name: "Testability Contract (testability.md)",
+      status: "warn",
+      message: `Unreadable testability contract: ${err.message}`,
+      remedy: "Repair iamu/testability.md frontmatter."
+    });
+    return { checks };
+  }
+}
+async function runDoctorChecks(projectRoot, opts) {
   const checks = [
     ...checkRuntimeChecks(),
     ...await checkBrowserChecks()
   ];
+  let effectiveTarget = opts?.target;
   if (!projectRoot || !existsSync10(join7(projectRoot, "iamu"))) {
     checks.push({
       category: "project",
@@ -17573,6 +18047,15 @@ async function runDoctorChecks(projectRoot) {
     checks.push(...await checkProjectConfiguration(projectRoot));
     checks.push(...await checkProjectContextAndEntities(projectRoot));
     checks.push(...await checkAgentIntegrations(projectRoot));
+    checks.push(...await checkProjectHarnesses(projectRoot));
+    const testability = await checkProjectTestabilityContract(projectRoot);
+    checks.push(...testability.checks);
+    if (!effectiveTarget && testability.targetUrl) {
+      effectiveTarget = testability.targetUrl;
+    }
+  }
+  if (effectiveTarget) {
+    checks.push(...await checkTargetHealth(effectiveTarget));
   }
   const okCount = checks.filter((c) => c.status === "ok").length;
   const warnCount = checks.filter((c) => c.status === "warn").length;
@@ -17589,7 +18072,7 @@ async function runDoctorChecks(projectRoot) {
 }
 async function doctor(opts) {
   const projectRoot = findProjectRoot(process.cwd()) ?? void 0;
-  const result = await runDoctorChecks(projectRoot);
+  const result = await runDoctorChecks(projectRoot, { target: opts?.target });
   if (opts?.json) {
     console.log(JSON.stringify(result, null, 2));
     if (!result.ok) process.exitCode = 1;
@@ -17603,7 +18086,8 @@ async function doctor(opts) {
     { key: "browser", title: "Browser Automation" },
     { key: "project", title: "Project Configuration" },
     { key: "agent", title: "Agent Integrations" },
-    { key: "cloud", title: "Cloud & Authentication" }
+    { key: "cloud", title: "Cloud & Authentication" },
+    { key: "target", title: "Target & Testability" }
   ];
   for (const cat of categories) {
     const catChecks = result.checks.filter((c) => c.category === cat.key);
@@ -18081,13 +18565,13 @@ __export(validate_exports, {
   validate: () => validate
 });
 import { randomUUID as randomUUID8 } from "crypto";
-import { promises as fs24 } from "fs";
-import path23 from "path";
+import { promises as fs26 } from "fs";
+import path24 from "path";
 import chalk23 from "chalk";
 function inferTypeFromPath(filePath, projectRoot) {
-  const rel = path23.relative(path23.join(projectRoot, "iamu"), filePath);
-  if (rel.startsWith("..") || path23.isAbsolute(rel)) return null;
-  const segments = rel.split(path23.sep);
+  const rel = path24.relative(path24.join(projectRoot, "iamu"), filePath);
+  if (rel.startsWith("..") || path24.isAbsolute(rel)) return null;
+  const segments = rel.split(path24.sep);
   if (segments.length < 2) return null;
   return TYPE_BY_ALIAS.get(segments[0]) ?? null;
 }
@@ -18117,7 +18601,7 @@ function validateFile(filePath, raw, projectRoot) {
     );
     return result;
   }
-  if (path23.basename(filePath) === "context.yml") {
+  if (path24.basename(filePath) === "context.yml") {
     applyZodValidation(contextFrontmatterSchema, frontmatter, result);
     const warnings = [];
     const hasNotes = Boolean(
@@ -18177,17 +18661,17 @@ async function buildRepairLookups(projectRoot) {
     }
   }
   const runScenario = /* @__PURE__ */ new Map();
-  const runsDir2 = path23.join(projectRoot, "iamu", ".runs");
+  const runsDir2 = path24.join(projectRoot, "iamu", ".runs");
   let runIds = [];
   try {
-    runIds = await fs24.readdir(runsDir2);
+    runIds = await fs26.readdir(runsDir2);
   } catch {
   }
   for (const runId of runIds) {
     try {
       const manifest = JSON.parse(
-        await fs24.readFile(
-          path23.join(runsDir2, runId, "walkthrough.json"),
+        await fs26.readFile(
+          path24.join(runsDir2, runId, "walkthrough.json"),
           "utf8"
         )
       );
@@ -18209,7 +18693,7 @@ async function fixFindings(projectRoot, results, dryRun) {
     let raw;
     let parsed;
     try {
-      raw = await fs24.readFile(result.path, "utf8");
+      raw = await fs26.readFile(result.path, "utf8");
       parsed = parseFrontmatter(raw);
     } catch {
       continue;
@@ -18218,7 +18702,7 @@ async function fixFindings(projectRoot, results, dryRun) {
       parsed.frontmatter,
       {
         ...lookups,
-        fileSlug: path23.basename(result.path, ".md"),
+        fileSlug: path24.basename(result.path, ".md"),
         newId: randomUUID8,
         body: parsed.body
       }
@@ -18253,9 +18737,9 @@ async function validate(filePath, opts) {
   if (process.exitCode === 1) return;
   const results = [];
   if (filePath) {
-    const abs = path23.isAbsolute(filePath) ? filePath : path23.resolve(process.cwd(), filePath);
+    const abs = path24.isAbsolute(filePath) ? filePath : path24.resolve(process.cwd(), filePath);
     try {
-      const raw = await fs24.readFile(abs, "utf8");
+      const raw = await fs26.readFile(abs, "utf8");
       results.push(validateFile(abs, raw, projectRoot));
     } catch (err) {
       commandError(
@@ -18265,24 +18749,24 @@ async function validate(filePath, opts) {
       return;
     }
   } else if (opts.run) {
-    const findingsDir = path23.join(projectRoot, "iamu", ENTITY_DIRS.finding);
+    const findingsDir = path24.join(projectRoot, "iamu", ENTITY_DIRS.finding);
     let names = [];
     try {
-      names = await fs24.readdir(findingsDir);
+      names = await fs26.readdir(findingsDir);
     } catch {
     }
     for (const name of names) {
       if (!name.endsWith(".md")) continue;
-      const abs = path23.join(findingsDir, name);
+      const abs = path24.join(findingsDir, name);
       try {
-        const raw = await fs24.readFile(abs, "utf8");
+        const raw = await fs26.readFile(abs, "utf8");
         const { frontmatter } = parseFrontmatter(raw);
         if (frontmatter.run === opts.run) {
           results.push(validateFile(abs, raw, projectRoot));
         }
       } catch {
         results.push({
-          path: path23.relative(projectRoot, abs),
+          path: path24.relative(projectRoot, abs),
           valid: false,
           errors: ["Cannot read file or parse frontmatter"]
         });
@@ -18315,31 +18799,31 @@ async function validate(filePath, opts) {
   } else {
     const typesToCheck = typeFilter ? ENTITY_TYPES.filter((t) => typeFilter.has(t)) : ENTITY_TYPES;
     for (const type2 of typesToCheck) {
-      const iamuTypeDir = path23.join(projectRoot, "iamu", ENTITY_DIRS[type2]);
+      const iamuTypeDir = path24.join(projectRoot, "iamu", ENTITY_DIRS[type2]);
       let names;
       try {
-        names = await fs24.readdir(iamuTypeDir);
+        names = await fs26.readdir(iamuTypeDir);
       } catch {
         continue;
       }
       for (const name of names) {
         if (!name.endsWith(".md")) continue;
-        const abs = path23.join(iamuTypeDir, name);
+        const abs = path24.join(iamuTypeDir, name);
         try {
-          const raw = await fs24.readFile(abs, "utf8");
+          const raw = await fs26.readFile(abs, "utf8");
           results.push(validateFile(abs, raw, projectRoot));
         } catch {
           results.push({
-            path: path23.relative(projectRoot, abs),
+            path: path24.relative(projectRoot, abs),
             valid: false,
             errors: ["Cannot read file"]
           });
         }
       }
     }
-    const ctxPath = path23.join(projectRoot, "iamu", "context.yml");
+    const ctxPath = path24.join(projectRoot, "iamu", "context.yml");
     try {
-      const raw = await fs24.readFile(ctxPath, "utf8");
+      const raw = await fs26.readFile(ctxPath, "utf8");
       results.push(validateFile(ctxPath, raw, projectRoot));
     } catch {
     }
@@ -18358,19 +18842,19 @@ async function validate(filePath, opts) {
           valid,
           errors: results.filter((r) => !r.valid).flatMap(
             (r) => r.errors.map((e) => ({
-              path: path23.relative(projectRoot, r.path),
+              path: path24.relative(projectRoot, r.path),
               message: e
             }))
           ),
           warnings: results.filter((r) => r.warnings && r.warnings.length > 0).flatMap(
             (r) => (r.warnings ?? []).map((w) => ({
-              path: path23.relative(projectRoot, r.path),
+              path: path24.relative(projectRoot, r.path),
               message: w
             }))
           ),
           ...opts.fix ? {
             repaired: repaired.map((r) => ({
-              path: path23.relative(projectRoot, r.path),
+              path: path24.relative(projectRoot, r.path),
               changes: r.repairs,
               valid: r.valid
             }))
@@ -18392,7 +18876,7 @@ async function validate(filePath, opts) {
   }
   let hasErrors = false;
   for (const r of results) {
-    const relPath = path23.relative(projectRoot, r.path);
+    const relPath = path24.relative(projectRoot, r.path);
     if (r.valid) {
       if (r.warnings && r.warnings.length > 0) {
         console.log(`  ${symbols.warning} ` + chalk23.yellow(relPath));
@@ -18706,6 +19190,797 @@ var init_new_entity = __esm({
   }
 });
 
+// src/commands/explore-crawl.ts
+function candidateSig(c) {
+  return `${c.role}
+${c.name}
+${c.occurrence}`;
+}
+function originOf(url) {
+  try {
+    return new URL(url).origin;
+  } catch {
+    return null;
+  }
+}
+function skipReason(c, origin, deny) {
+  if (deny.some((re) => re.test(c.name) || c.href && re.test(c.href))) {
+    return "denied";
+  }
+  if (c.submit) return "submit";
+  if (UNSAFE_NAME.test(c.name)) return "unsafe_name";
+  if (c.href) {
+    let u = null;
+    try {
+      u = new URL(c.href);
+    } catch {
+    }
+    if (u && u.protocol !== "javascript:") {
+      if (u.protocol !== "http:" && u.protocol !== "https:") return "external";
+      if (u.origin !== origin) return "external";
+      if (UNSAFE_PATH.test(u.pathname)) return "unsafe_name";
+    }
+    if (c.download) return "download";
+  }
+  return null;
+}
+async function settle(page, settleMs) {
+  await page.waitForLoadState("domcontentloaded", { timeout: NAV_TIMEOUT_MS }).catch(() => {
+  });
+  await page.waitForLoadState("networkidle", { timeout: settleMs }).catch(() => {
+  });
+}
+async function readPage(page) {
+  return page.evaluate(READ_PAGE);
+}
+async function markDocument(page) {
+  await page.evaluate("window.__iamuDoc = true").catch(() => {
+  });
+}
+async function isSameDocument(page) {
+  return page.evaluate("window.__iamuDoc === true").catch(() => false);
+}
+async function clickCandidate(page, want) {
+  const state = await readPage(page);
+  const c = state.candidates.find(
+    (x) => candidateSig(x) === candidateSig(want)
+  );
+  if (!c) return false;
+  await page.locator(`[data-iamu-x="${c.index}"]`).click({ timeout: CLICK_TIMEOUT_MS });
+  return true;
+}
+async function crawl(page, opts) {
+  const origin = originOf(opts.startUrl);
+  if (!origin) throw new Error(`Not a URL: ${opts.startUrl}`);
+  let blocked = [];
+  await page.route("**/*", (route) => {
+    const req = route.request();
+    if (SAFE_METHODS.has(req.method())) return route.continue();
+    let where = req.url();
+    try {
+      const u = new URL(where);
+      where = u.origin === origin ? u.pathname : `${u.origin}${u.pathname}`;
+    } catch {
+    }
+    blocked.push(`${req.method()} ${where}`);
+    return route.abort("blockedbyclient");
+  });
+  const onDialog = (d) => {
+    d.dismiss().catch(() => {
+    });
+  };
+  const onPopup = (p) => {
+    if (p !== page) p.close().catch(() => {
+    });
+  };
+  page.on("dialog", onDialog);
+  page.context().on("page", onPopup);
+  try {
+    return await crawlFrom(page, opts, origin, () => {
+      const out = blocked;
+      blocked = [];
+      return out;
+    });
+  } finally {
+    page.off("dialog", onDialog);
+    page.context().off("page", onPopup);
+    await page.unroute("**/*").catch(() => {
+    });
+  }
+}
+async function crawlFrom(page, opts, origin, takeBlocked) {
+  const deny = opts.deny ?? [];
+  const settleMs = opts.settleMs ?? 1500;
+  const { budget } = opts;
+  const stats = {
+    surfaces: 0,
+    actions_tried: 0,
+    skipped: 0,
+    blocked_requests: 0,
+    errors: 0,
+    truncated: false
+  };
+  const surfaces = [];
+  const byKey = /* @__PURE__ */ new Map();
+  const byPlaceView = /* @__PURE__ */ new Map();
+  const signatureOf = (s) => exploreSignature(s.headings, s.title);
+  function addSurface(state, place, view, path30, depth) {
+    const key = exploreSurfaceKey(place, view);
+    const surface = {
+      key,
+      url: state.url,
+      place,
+      view,
+      signature: signatureOf(state),
+      label: state.headings[0] ?? (state.title || place),
+      headings: state.headings,
+      fields: state.fields,
+      depth,
+      path: path30,
+      actions: []
+    };
+    surfaces.push(surface);
+    byKey.set(key, surface);
+    byPlaceView.set(`${place}
+${surface.signature}`, key);
+    stats.surfaces++;
+    opts.log?.(`  ${"  ".repeat(depth)}${key}  ${surface.label}`);
+    return surface;
+  }
+  async function goto(url) {
+    await page.goto(url, {
+      waitUntil: "domcontentloaded",
+      timeout: NAV_TIMEOUT_MS
+    });
+    await settle(page, settleMs);
+  }
+  async function replay(path30) {
+    if (!("goto" in (path30[0] ?? {}))) await goto(opts.startUrl);
+    for (const step of path30) {
+      if ("goto" in step) {
+        await goto(step.goto);
+      } else {
+        if (!await clickCandidate(page, step.click)) return false;
+        await settle(page, settleMs);
+      }
+    }
+    return true;
+  }
+  await goto(opts.startUrl);
+  if (await page.evaluate("Boolean(navigator.serviceWorker?.controller)").catch(() => false)) {
+    throw new Error(
+      "A service worker controls this page, and the write guard cannot see its requests. Explore without --attach (service workers are blocked there)."
+    );
+  }
+  const first = await readPage(page);
+  const firstPlace = explorePlaceKey(first.url);
+  if (!firstPlace || originOf(first.url) !== origin) {
+    throw new Error(`The start URL led off the product, to ${first.url}`);
+  }
+  addSurface(first, firstPlace, null, [], 0);
+  for (let i = 0; i < surfaces.length; i++) {
+    const surface = surfaces[i];
+    if (!await replay(surface.path)) {
+      stats.errors++;
+      surface.actions.push({
+        role: "",
+        name: "",
+        occurrence: 0,
+        outcome: { kind: "error", message: LOST }
+      });
+      continue;
+    }
+    const home = await readPage(page);
+    const seen = new Set(home.candidates.map(candidateSig));
+    const work = home.candidates.map((c) => ({ c, via: [] }));
+    const homeList = home.candidates.map(candidateSig).join("\n");
+    let pristine = true;
+    for (let w = 0; w < work.length; w++) {
+      const { c, via } = work[w];
+      const action = {
+        role: c.role,
+        name: c.name,
+        occurrence: c.occurrence,
+        ...c.href ? { href: c.href } : {},
+        ...via.length > 0 ? { via } : {},
+        outcome: { kind: "same" }
+      };
+      surface.actions.push(action);
+      const reason = skipReason(c, origin, deny);
+      if (reason) {
+        action.outcome = { kind: "skipped", reason };
+        stats.skipped++;
+        continue;
+      }
+      if (surface.depth >= budget.max_depth || stats.actions_tried >= budget.max_actions) {
+        action.outcome = { kind: "skipped", reason: "budget" };
+        stats.skipped++;
+        stats.truncated = true;
+        continue;
+      }
+      stats.actions_tried++;
+      takeBlocked();
+      const click = {
+        click: { role: c.role, name: c.name, occurrence: c.occurrence }
+      };
+      let outcome;
+      let revealed = 0;
+      let left = false;
+      let lost = false;
+      try {
+        if (!pristine || via.length > 0) {
+          if (!await replay([...surface.path, ...via])) {
+            throw new Error(LOST);
+          }
+        }
+        pristine = false;
+        const before = await readPage(page);
+        await markDocument(page);
+        if (c.newTab && c.href) {
+          await goto(c.href);
+        } else {
+          if (!await clickCandidate(page, c)) {
+            throw new Error("control is gone");
+          }
+          await settle(page, settleMs);
+        }
+        const after = await readPage(page);
+        if (originOf(after.url) !== origin) {
+          outcome = { kind: "external", url: after.url };
+          left = true;
+        } else {
+          const place = explorePlaceKey(after.url) ?? before.url;
+          const sig = signatureOf(after);
+          const sameDoc = !(c.newTab && c.href) && await isSameDocument(page);
+          const beforePlace = explorePlaceKey(before.url);
+          let key = byPlaceView.get(`${place}
+${sig}`);
+          let view = null;
+          if (!key) {
+            const inPage = sameDoc && place === beforePlace;
+            view = inPage ? sig : null;
+            key = exploreSurfaceKey(place, view);
+            if (byKey.has(key)) byPlaceView.set(`${place}
+${sig}`, key);
+          }
+          if (key === surface.key) {
+            outcome = { kind: "same" };
+            const list2 = after.candidates.map(candidateSig).join("\n");
+            for (const n of after.candidates) {
+              const s = candidateSig(n);
+              if (seen.has(s)) continue;
+              seen.add(s);
+              work.push({ c: n, via: [...via, click] });
+              revealed++;
+            }
+            if (list2 === homeList) pristine = true;
+          } else {
+            outcome = { kind: "surface", surface: key };
+            if (!byKey.has(key)) {
+              if (stats.surfaces >= budget.max_surfaces) {
+                stats.truncated = true;
+              } else {
+                const path30 = !sameDoc && view === null ? [{ goto: after.url }] : [...surface.path, ...via, click];
+                addSurface(after, place, view, path30, surface.depth + 1);
+              }
+            }
+          }
+        }
+      } catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        outcome = { kind: "error", message: msg.split("\n")[0].slice(0, 200) };
+        stats.errors++;
+        lost = msg === LOST;
+      }
+      action.outcome = outcome;
+      if (revealed > 0) action.revealed = revealed;
+      const writes = takeBlocked();
+      if (writes.length > 0) {
+        action.blocked_requests = [...new Set(writes)];
+        stats.blocked_requests += writes.length;
+      }
+      if (left) pristine = false;
+      if (lost) break;
+    }
+  }
+  return { surfaces, stats };
+}
+var UNSAFE_NAME, UNSAFE_PATH, SAFE_METHODS, CLICK_TIMEOUT_MS, LOST, NAV_TIMEOUT_MS, READ_PAGE;
+var init_explore_crawl = __esm({
+  "src/commands/explore-crawl.ts"() {
+    "use strict";
+    init_dist2();
+    UNSAFE_NAME = new RegExp(
+      `(?<![\\p{L}\\p{N}])(${[
+        // English
+        "delete",
+        "remove",
+        "destroy",
+        "erase",
+        "pay",
+        "pay now",
+        "purchase",
+        "buy",
+        "checkout",
+        "place order",
+        "order now",
+        "send",
+        "submit",
+        "save",
+        "confirm",
+        "approve",
+        "reject",
+        "decline",
+        "publish",
+        "archive",
+        "unsubscribe",
+        "log ?out",
+        "sign ?out",
+        "reset",
+        "transfer",
+        "invite",
+        "upload",
+        "import",
+        "deactivate",
+        "close account",
+        // Swedish
+        "ta bort",
+        "radera",
+        "betala",
+        "k\xF6p",
+        "best\xE4ll",
+        "skicka",
+        "skicka in",
+        "spara",
+        "bekr\xE4fta",
+        "godk\xE4nn",
+        "avsl\xE5",
+        "publicera",
+        "arkivera",
+        "logga ut",
+        "\xE5terst\xE4ll",
+        "\xF6verf\xF6r",
+        "bjud in",
+        "ladda upp"
+      ].join("|")})(?![\\p{L}\\p{N}])`,
+      "iu"
+    );
+    UNSAFE_PATH = /(^|\/)(log-?out|sign-?out|logga-?ut|delete|remove|destroy|unsubscribe)(\/|$)/i;
+    SAFE_METHODS = /* @__PURE__ */ new Set(["GET", "HEAD", "OPTIONS"]);
+    CLICK_TIMEOUT_MS = 3e3;
+    LOST = "could not return to surface";
+    NAV_TIMEOUT_MS = 15e3;
+    READ_PAGE = String.raw`(() => {
+  const SELECTOR = [
+    "a[href]", "button", "summary",
+    'input[type="button"]', 'input[type="submit"]',
+    'input[type="reset"]', 'input[type="image"]',
+    '[role="button"]', '[role="link"]', '[role="tab"]',
+    '[role="menuitem"]', '[role="menuitemradio"]', '[role="menuitemcheckbox"]',
+  ].join(",");
+  const clean = (s) => (s ?? "").replace(/\s+/g, " ").trim();
+  const visible = (el) => {
+    if (typeof el.checkVisibility === "function" &&
+        !el.checkVisibility({ checkOpacity: true, checkVisibilityCSS: true })) {
+      return false;
+    }
+    const r = el.getBoundingClientRect();
+    return r.width > 0 && r.height > 0;
+  };
+  const textOf = (id) => clean(document.getElementById(id)?.innerText);
+  const nameOf = (el) => {
+    const label = clean(el.getAttribute("aria-label"));
+    if (label) return label;
+    const by = el.getAttribute("aria-labelledby");
+    if (by) {
+      const t = clean(by.split(/\s+/).map(textOf).join(" "));
+      if (t) return t;
+    }
+    if (el instanceof HTMLInputElement) {
+      return clean(el.value) || clean(el.alt) || clean(el.title);
+    }
+    const text = clean(el.innerText);
+    if (text) return text.slice(0, 80);
+    const img = el.querySelector("img[alt]");
+    return clean(img?.getAttribute("alt")) || clean(el.title);
+  };
+  const roleOf = (el) =>
+    el.getAttribute("role") || (el.tagName === "A" ? "link" : "button");
+
+  for (const el of document.querySelectorAll("[data-iamu-x]")) {
+    el.removeAttribute("data-iamu-x");
+  }
+  const seen = new Map();
+  const candidates = [];
+  let index = 0;
+  for (const el of document.querySelectorAll(SELECTOR)) {
+    if (!visible(el)) continue;
+    if (el.disabled || el.getAttribute("aria-disabled") === "true") continue;
+    const role = roleOf(el);
+    const name = nameOf(el);
+    const sig = role + "\n" + name;
+    const occurrence = seen.get(sig) ?? 0;
+    seen.set(sig, occurrence + 1);
+    let submit = false;
+    if (el instanceof HTMLButtonElement) {
+      // A button in a form submits unless it says type="button".
+      submit = el.form
+        ? el.type === "submit" || el.type === "reset"
+        : el.getAttribute("type") === "submit";
+    } else if (el instanceof HTMLInputElement) {
+      submit = ["submit", "reset", "image"].includes(el.type);
+    }
+    const anchor = el instanceof HTMLAnchorElement ? el : null;
+    el.setAttribute("data-iamu-x", String(index));
+    candidates.push({
+      index, role, name, occurrence,
+      href: anchor ? anchor.href : null,
+      download: anchor ? anchor.hasAttribute("download") : false,
+      newTab: anchor ? anchor.target === "_blank" : false,
+      submit,
+    });
+    index++;
+  }
+
+  const headings = [];
+  for (const el of document.querySelectorAll(
+    'h1, h2, [role="heading"][aria-level="1"], [role="heading"][aria-level="2"]',
+  )) {
+    if (!visible(el)) continue;
+    const t = clean(el.innerText);
+    if (t) headings.push(t.slice(0, 120));
+  }
+
+  const fields = [];
+  for (const f of document.querySelectorAll("input, select, textarea")) {
+    if (["hidden", "submit", "button", "reset", "image"].includes(f.type)) continue;
+    if (!visible(f)) continue;
+    const forLabel = f.id
+      ? document.querySelector('label[for="' + CSS.escape(f.id) + '"]')
+      : null;
+    const name =
+      clean(f.getAttribute("aria-label")) ||
+      clean(forLabel?.innerText) ||
+      clean(f.closest("label")?.innerText) ||
+      clean(f.placeholder) ||
+      clean(f.name);
+    if (name && !fields.includes(name)) fields.push(name.slice(0, 80));
+    if (fields.length >= 40) break;
+  }
+
+  return { url: location.href, title: clean(document.title), headings, fields, candidates };
+})()`;
+  }
+});
+
+// src/commands/explore.ts
+var explore_exports = {};
+__export(explore_exports, {
+  exploreCoverageCommand: () => exploreCoverageCommand,
+  exploreDiffCommand: () => exploreDiffCommand,
+  exploreList: () => exploreList,
+  exploreRun: () => exploreRun
+});
+import { promises as fs27 } from "fs";
+import path25 from "path";
+import chalk26 from "chalk";
+function fail2(message, json2) {
+  if (json2) console.error(JSON.stringify({ error: message }));
+  else console.error(chalk26.red(`  ${message}`));
+  process.exitCode = 1;
+}
+function positiveInt(raw, fallback, flag) {
+  if (raw === void 0) return fallback;
+  const n = Number(raw);
+  if (!Number.isInteger(n) || n < 1) {
+    throw new Error(`${flag} must be a positive whole number, got "${raw}"`);
+  }
+  return n;
+}
+async function testabilityTarget(projectRoot) {
+  try {
+    const raw = await fs27.readFile(
+      path25.join(projectRoot, "iamu", "testability.md"),
+      "utf8"
+    );
+    const { frontmatter } = parseFrontmatter(raw);
+    return typeof frontmatter.target_url === "string" ? frontmatter.target_url : null;
+  } catch {
+    return null;
+  }
+}
+async function openPage(opts) {
+  const { chromium } = await import("playwright-core");
+  const viewport = parseViewport(opts.viewport) ?? {
+    width: 1280,
+    height: 800
+  };
+  if (opts.attach) {
+    const state = readBrowseState();
+    if (!state) {
+      throw new Error(
+        "No browser to attach to \u2014 start one with `iamu browse start` and sign in first."
+      );
+    }
+    const browser2 = await chromium.connectOverCDP(
+      `http://127.0.0.1:${state.port}`
+    );
+    const context = browser2.contexts()[0] ?? await browser2.newContext();
+    const page2 = await context.newPage();
+    await page2.setViewportSize(viewport);
+    return {
+      page: page2,
+      close: async () => {
+        await page2.close().catch(() => {
+        });
+        await browser2.close().catch(() => {
+        });
+      }
+    };
+  }
+  const chrome = findChrome();
+  if (!chrome) {
+    throw new Error(
+      "No Chrome or Chromium found \u2014 install one or set IAMU_BROWSER."
+    );
+  }
+  const browser = await chromium.launch({
+    executablePath: chrome,
+    headless: true,
+    chromiumSandbox: !shouldDisableSandbox()
+  });
+  const page = await browser.newPage({ viewport, serviceWorkers: "block" });
+  return { page, close: () => browser.close().catch(() => {
+  }) };
+}
+async function exploreRun(url, opts) {
+  const ctx = await resolveProject(opts);
+  if (!ctx) return;
+  const target = url ?? await testabilityTarget(ctx.projectRoot);
+  if (!target) {
+    fail2(
+      "No URL to explore \u2014 pass one (iamu explore http://localhost:3000) or set target_url in iamu/testability.md.",
+      opts.json
+    );
+    return;
+  }
+  let startUrl;
+  let budget;
+  let deny;
+  try {
+    startUrl = new URL(target).href;
+    budget = {
+      max_surfaces: positiveInt(
+        opts.maxSurfaces,
+        DEFAULTS.max_surfaces,
+        "--max-surfaces"
+      ),
+      max_actions: positiveInt(
+        opts.maxActions,
+        DEFAULTS.max_actions,
+        "--max-actions"
+      ),
+      max_depth: positiveInt(opts.maxDepth, DEFAULTS.max_depth, "--max-depth")
+    };
+    deny = (opts.deny ?? []).map((d) => new RegExp(d, "i"));
+  } catch (err) {
+    fail2(err.message, opts.json);
+    return;
+  }
+  const quiet = opts.json || process.env.IAMU_QUIET === "1";
+  if (!quiet) {
+    console.error(chalk26.dim(`  Exploring ${startUrl} (read-only)\u2026`));
+  }
+  const now = /* @__PURE__ */ new Date();
+  let opened = null;
+  let result;
+  try {
+    opened = await openPage(opts);
+    result = await crawl(opened.page, {
+      startUrl,
+      budget,
+      deny,
+      log: quiet ? void 0 : (line) => console.error(chalk26.dim(line))
+    });
+  } catch (err) {
+    fail2(err.message.split("\n")[0], opts.json);
+    return;
+  } finally {
+    await opened?.close();
+  }
+  const build = detectBuild({ cwd: ctx.projectRoot });
+  const map2 = {
+    schema: 1,
+    id: composeExploreId(now),
+    created_at: now.toISOString(),
+    target_url: startUrl,
+    ...build ? { build: { ...build } } : {},
+    budget,
+    stats: result.stats,
+    surfaces: result.surfaces
+  };
+  const file = await writeExploreMap(ctx.projectRoot, map2);
+  const rel = path25.relative(process.cwd(), file);
+  if (opts.json) {
+    console.log(JSON.stringify({ id: map2.id, path: rel, stats: map2.stats }));
+    return;
+  }
+  const s = map2.stats;
+  console.log(
+    `
+  ${chalk26.bold(`${s.surfaces} surfaces`)} \xB7 ${s.actions_tried} controls tried \xB7 ${s.skipped} skipped \xB7 ${s.blocked_requests} writes blocked${s.errors ? ` \xB7 ${s.errors} errors` : ""}`
+  );
+  if (s.truncated) {
+    console.log(
+      chalk26.yellow(
+        "  Stopped by the budget before the product ran out \u2014 raise --max-surfaces / --max-actions / --max-depth to go further."
+      )
+    );
+  }
+  console.log(`  Map: ${rel}`);
+  console.log(chalk26.dim("  Next: iamu explore coverage"));
+}
+async function resolveMapId(projectRoot, id, offsetFromEnd = 1) {
+  if (id && id !== "latest") return id;
+  const ids = await listExploreMaps(projectRoot);
+  return ids.at(-offsetFromEnd) ?? null;
+}
+async function exploreList(opts) {
+  const ctx = await resolveProject(opts);
+  if (!ctx) return;
+  const rows = [];
+  for (const id of await listExploreMaps(ctx.projectRoot)) {
+    try {
+      const m = await readExploreMap(ctx.projectRoot, id);
+      rows.push({ id, target_url: m.target_url, surfaces: m.surfaces.length });
+    } catch {
+    }
+  }
+  if (opts.json) {
+    console.log(JSON.stringify({ maps: rows }));
+    return;
+  }
+  if (rows.length === 0) {
+    console.log("  No maps yet. Run: iamu explore <url>");
+    return;
+  }
+  for (const r of rows) {
+    console.log(
+      `  ${r.id}  ${r.surfaces} surfaces  ${chalk26.dim(r.target_url)}`
+    );
+  }
+}
+async function exploreCoverageCommand(mapId, opts) {
+  const ctx = await resolveProject(opts);
+  if (!ctx) return;
+  const id = await resolveMapId(ctx.projectRoot, mapId);
+  if (!id) {
+    fail2("No map yet. Run: iamu explore <url>", opts.json);
+    return;
+  }
+  let map2;
+  try {
+    map2 = await readExploreMap(ctx.projectRoot, id);
+  } catch (err) {
+    fail2(err.message, opts.json);
+    return;
+  }
+  const cov = exploreCoverage(map2, await readAllRunSteps(ctx.projectRoot));
+  if (opts.json) {
+    console.log(JSON.stringify(cov));
+    return;
+  }
+  console.log(
+    `
+  Map ${id} (${map2.surfaces.length} surfaces) against ${cov.runs} runs, ${cov.steps} steps`
+  );
+  console.log(
+    `  ${chalk26.green(`${cov.reached} reached`)} \xB7 ${chalk26.yellow(`${cov.place_only} URL reached, view unclear`)} \xB7 ${chalk26.red(`${cov.unreached} never reached`)}`
+  );
+  const section = (title, rows, color) => {
+    if (rows.length === 0) return;
+    console.log(`
+  ${color(title)}`);
+    for (const r of rows) {
+      console.log(
+        `    ${r.key.padEnd(32)} ${r.label}${chalk26.dim(`  (depth ${r.depth})`)}`
+      );
+    }
+  };
+  section(
+    "Never reached by a run",
+    cov.surfaces.filter((s) => s.status === "unreached"),
+    chalk26.red
+  );
+  section(
+    "URL reached, but no step names this view",
+    cov.surfaces.filter((s) => s.status === "place_only"),
+    chalk26.yellow
+  );
+  if (cov.run_only_places.length > 0) {
+    console.log(`
+  ${chalk26.cyan("Walked by runs, not in the map")}`);
+    for (const p of cov.run_only_places) {
+      console.log(
+        `    ${p.place.padEnd(32)} ${p.steps} steps, ${p.runs.length} runs`
+      );
+    }
+  }
+  if (cov.runs === 0) {
+    console.log(
+      chalk26.dim(
+        "\n  No runs yet \u2014 every surface counts as never reached. Walk a scenario first (iamu-run)."
+      )
+    );
+  }
+}
+async function exploreDiffCommand(a, b, opts) {
+  const ctx = await resolveProject(opts);
+  if (!ctx) return;
+  const idA = a ?? await resolveMapId(ctx.projectRoot, void 0, 2);
+  const idB = b ?? await resolveMapId(ctx.projectRoot, void 0, 1);
+  if (!idA || !idB || idA === idB) {
+    fail2(
+      "Need two maps to compare \u2014 explore again (iamu explore <url>), or name both maps.",
+      opts.json
+    );
+    return;
+  }
+  let mapA;
+  let mapB;
+  try {
+    mapA = await readExploreMap(ctx.projectRoot, idA);
+    mapB = await readExploreMap(ctx.projectRoot, idB);
+  } catch (err) {
+    fail2(err.message, opts.json);
+    return;
+  }
+  const d = diffExploreMaps(mapA, mapB);
+  if (opts.json) {
+    console.log(JSON.stringify(d));
+    return;
+  }
+  const pct = Math.round(d.surface_overlap * 100);
+  console.log(`
+  ${idA} \u2192 ${idB}`);
+  console.log(
+    `  ${chalk26.bold(`${pct}% of surfaces match`)} (${d.common} shared, ${d.only_a.length} only in the first, ${d.only_b.length} only in the second)`
+  );
+  if (d.only_a.length > 0) {
+    console.log(`
+  ${chalk26.red("Only in the first")}`);
+    for (const s of d.only_a) console.log(`    ${s.key.padEnd(32)} ${s.label}`);
+  }
+  if (d.only_b.length > 0) {
+    console.log(`
+  ${chalk26.green("Only in the second")}`);
+    for (const s of d.only_b) console.log(`    ${s.key.padEnd(32)} ${s.label}`);
+  }
+  if (d.changed_actions.length > 0) {
+    console.log(
+      `
+  ${chalk26.yellow(`Controls differ on ${d.changed_actions.length} shared surfaces`)}`
+    );
+    for (const c of d.changed_actions) {
+      console.log(`    ${c.key}  ${c.label}`);
+      for (const x of c.only_a) console.log(chalk26.red(`      - ${x}`));
+      for (const x of c.only_b) console.log(chalk26.green(`      + ${x}`));
+    }
+  }
+}
+var DEFAULTS;
+var init_explore = __esm({
+  "src/commands/explore.ts"() {
+    "use strict";
+    init_dist2();
+    init_build_info();
+    init_browse();
+    init_context4();
+    init_explore_crawl();
+    DEFAULTS = { max_surfaces: 40, max_actions: 300, max_depth: 6 };
+  }
+});
+
 // src/commands/completion.ts
 var completion_exports = {};
 __export(completion_exports, {
@@ -18902,7 +20177,7 @@ __export(instructions_walk_exports, {
 });
 import { existsSync as existsSync12, readFileSync as readFileSync8 } from "fs";
 import { join as join9 } from "path";
-import chalk26 from "chalk";
+import chalk27 from "chalk";
 function selfCommand() {
   const q = (p) => /[\s"'$]/.test(p) ? JSON.stringify(p) : p;
   return `${q(process.execPath)} ${q(process.argv[1] ?? "iamu")}`;
@@ -19229,35 +20504,35 @@ async function instructionsWalk(opts) {
     return;
   }
   console.log();
-  console.log(chalk26.bold("  Walk instructions"));
-  console.log(`  ${chalk26.dim("scenario:")}  ${sfm.slug}`);
-  console.log(`  ${chalk26.dim("persona:")}   ${pfm.name} (${pfm.role})`);
-  console.log(`  ${chalk26.dim("outline:")}   ${ofm.title}`);
+  console.log(chalk27.bold("  Walk instructions"));
+  console.log(`  ${chalk27.dim("scenario:")}  ${sfm.slug}`);
+  console.log(`  ${chalk27.dim("persona:")}   ${pfm.name} (${pfm.role})`);
+  console.log(`  ${chalk27.dim("outline:")}   ${ofm.title}`);
   if (sfm.state?.description || sfm.state?.approximation) {
     console.log(
-      `  ${chalk26.dim("state:")}     ${sfm.state.description ? sfm.state.description : sfm.state.approximation ?? ""}`
+      `  ${chalk27.dim("state:")}     ${sfm.state.description ? sfm.state.description : sfm.state.approximation ?? ""}`
     );
   }
-  if (targetUrl) console.log(`  ${chalk26.dim("target:")}    ${targetUrl}`);
+  if (targetUrl) console.log(`  ${chalk27.dim("target:")}    ${targetUrl}`);
   console.log(
-    `  ${chalk26.dim("access:")}    ${projectAccess || personaAccess ? `${projectAccess ? "project" : ""}${projectAccess && personaAccess ? " + " : ""}${personaAccess ? "persona" : ""}` : "not recorded (walker would run as whoever is signed in)"}`
+    `  ${chalk27.dim("access:")}    ${projectAccess || personaAccess ? `${projectAccess ? "project" : ""}${projectAccess && personaAccess ? " + " : ""}${personaAccess ? "persona" : ""}` : "not recorded (walker would run as whoever is signed in)"}`
   );
   console.log(
-    `  ${chalk26.dim("dismissed:")} ${dismissedFacts.length} findings to skip`
+    `  ${chalk27.dim("dismissed:")} ${dismissedFacts.length} findings to skip`
   );
   console.log(
-    `  ${chalk26.dim("guidance:")}  ${guidance.length} tester guidance rule${guidance.length === 1 ? "" : "s"}`
+    `  ${chalk27.dim("guidance:")}  ${guidance.length} tester guidance rule${guidance.length === 1 ? "" : "s"}`
   );
   if (revisit.length > 0) {
     console.log(
-      `  ${chalk26.dim("re-check:")}  ${revisit.length} place${revisit.length === 1 ? "" : "s"} where fixes await a re-run`
+      `  ${chalk27.dim("re-check:")}  ${revisit.length} place${revisit.length === 1 ? "" : "s"} where fixes await a re-run`
     );
   }
   console.log(
-    `  ${chalk26.dim("methodology:")} ${methodology ? "loaded" : "missing (run iamu update)"}`
+    `  ${chalk27.dim("methodology:")} ${methodology ? "loaded" : "missing (run iamu update)"}`
   );
   console.log();
-  console.log(chalk26.dim("  Use --json to get the full instruction bundle."));
+  console.log(chalk27.dim("  Use --json to get the full instruction bundle."));
   console.log();
 }
 var SCREEN;
@@ -19283,8 +20558,8 @@ __export(new_finding_exports, {
 });
 import { randomUUID as randomUUID10 } from "crypto";
 import { access, readFile as readFile6 } from "fs/promises";
-import path24 from "path";
-import chalk27 from "chalk";
+import path26 from "path";
+import chalk28 from "chalk";
 async function newFinding(opts) {
   const ctx = await resolveProject(opts);
   if (!ctx) return;
@@ -19350,7 +20625,7 @@ async function newFinding(opts) {
     }
     try {
       await access(
-        path24.join(runDirPath, "steps", `${String(n).padStart(3, "0")}.json`)
+        path26.join(runDirPath, "steps", `${String(n).padStart(3, "0")}.json`)
       );
     } catch {
       commandError(
@@ -19365,7 +20640,7 @@ async function newFinding(opts) {
   if (!scenarioSlug) {
     try {
       const manifestRaw = await readFile6(
-        path24.join(runDirPath, "walkthrough.json"),
+        path26.join(runDirPath, "walkthrough.json"),
         "utf8"
       );
       const manifest = JSON.parse(manifestRaw);
@@ -19454,10 +20729,10 @@ async function newFinding(opts) {
       return;
     }
     console.log();
-    console.log(`  ${symbols.success} Created finding: ${chalk27.cyan(slug)}`);
-    console.log(`  ${chalk27.dim("path:")} ${record.path}`);
-    console.log(`  ${chalk27.dim("id:")}   ${id}`);
-    for (const w of warnings) console.log(`  ${chalk27.yellow("!")} ${w}`);
+    console.log(`  ${symbols.success} Created finding: ${chalk28.cyan(slug)}`);
+    console.log(`  ${chalk28.dim("path:")} ${record.path}`);
+    console.log(`  ${chalk28.dim("id:")}   ${id}`);
+    for (const w of warnings) console.log(`  ${chalk28.yellow("!")} ${w}`);
     console.log();
   } catch (err) {
     commandError(
@@ -19483,7 +20758,7 @@ __export(view_results_exports, {
   promptViewResults: () => promptViewResults
 });
 import { isCancel as isCancel4, select as select3 } from "@clack/prompts";
-import chalk28 from "chalk";
+import chalk29 from "chalk";
 function launchCloudDashboard(config, runId) {
   const cloudRunId = runId ? toCloudRunUuid(runId) : void 0;
   const url = getCloudDashboardUrl(
@@ -19492,7 +20767,7 @@ function launchCloudDashboard(config, runId) {
     cloudRunId
   );
   console.log();
-  console.log(`  ${symbols.success} Opening Iamu Cloud: ${chalk28.cyan(url)}
+  console.log(`  ${symbols.success} Opening Iamu Cloud: ${chalk29.cyan(url)}
 `);
   openBrowser(url);
 }
@@ -19560,9 +20835,9 @@ __export(evaluate_exports, {
   evaluate: () => evaluate,
   evaluateRecord: () => evaluateRecord
 });
-import { promises as fs25 } from "fs";
-import path25 from "path";
-import chalk29 from "chalk";
+import { promises as fs28 } from "fs";
+import path27 from "path";
+import chalk30 from "chalk";
 import { z as z25 } from "zod";
 function formatIssues(error) {
   return error.issues.map(
@@ -19592,10 +20867,10 @@ async function evaluate(runId, opts) {
   const resolved = await resolveProjectAndRunDir(runId, opts);
   if (!resolved) return;
   const { projectRoot, runDirPath } = resolved;
-  const canonicalPath = path25.join(runDirPath, "canonical.json");
+  const canonicalPath = path27.join(runDirPath, "canonical.json");
   let canonical;
   try {
-    const raw = await fs25.readFile(canonicalPath, "utf8");
+    const raw = await fs28.readFile(canonicalPath, "utf8");
     canonical = JSON.parse(raw);
   } catch {
     commandError(
@@ -19651,15 +20926,15 @@ async function evaluate(runId, opts) {
     )
   };
   const prompt = composeJudgePrompt(input);
-  const promptFilePath = opts?.promptFile ?? path25.join(runDirPath, "judge_prompt.md");
-  await fs25.writeFile(promptFilePath, prompt, "utf8");
+  const promptFilePath = opts?.promptFile ?? path27.join(runDirPath, "judge_prompt.md");
+  await fs28.writeFile(promptFilePath, prompt, "utf8");
   if (opts?.json) {
     console.log(
       JSON.stringify(
         {
           ...input,
-          prompt_file: path25.relative(projectRoot, promptFilePath),
-          prompt_file_abs: path25.resolve(promptFilePath),
+          prompt_file: path27.relative(projectRoot, promptFilePath),
+          prompt_file_abs: path27.resolve(promptFilePath),
           judge_prompt: prompt
         },
         null,
@@ -19674,10 +20949,10 @@ async function evaluateRecord(runId, opts) {
   const resolved = await resolveProjectAndRunDir(runId, opts);
   if (!resolved) return;
   const { projectRoot, runDirPath } = resolved;
-  const canonicalPath = path25.join(runDirPath, "canonical.json");
+  const canonicalPath = path27.join(runDirPath, "canonical.json");
   let canonical;
   try {
-    const raw = await fs25.readFile(canonicalPath, "utf8");
+    const raw = await fs28.readFile(canonicalPath, "utf8");
     canonical = JSON.parse(raw);
   } catch {
     commandError(`No canonical.json for run: ${runId}`, opts);
@@ -19685,7 +20960,7 @@ async function evaluateRecord(runId, opts) {
   }
   let parsedFile;
   try {
-    const raw = await fs25.readFile(opts.file, "utf8");
+    const raw = await fs28.readFile(opts.file, "utf8");
     parsedFile = JSON.parse(raw);
   } catch {
     commandError(`Cannot read verdicts file: ${opts.file}`, opts);
@@ -19742,8 +21017,8 @@ ${formatIssues(fileResult.error)}`,
     overall: inputVerdicts.overall
   });
   const reportContent = renderCanonicalMarkdown(canonicalForReport);
-  const verdictsPath = path25.join(runDirPath, "verdicts.json");
-  const reportPath = path25.join(runDirPath, "report.md");
+  const verdictsPath = path27.join(runDirPath, "verdicts.json");
+  const reportPath = path27.join(runDirPath, "report.md");
   await Promise.all([
     atomicWriteFile(
       verdictsPath,
@@ -19763,8 +21038,8 @@ ${formatIssues(fileResult.error)}`,
       JSON.stringify(
         {
           runId,
-          verdictsPath: path25.relative(projectRoot, verdictsPath),
-          reportPath: path25.relative(projectRoot, reportPath),
+          verdictsPath: path27.relative(projectRoot, verdictsPath),
+          reportPath: path27.relative(projectRoot, reportPath),
           verdictsCount: validatedVerdicts.length,
           linkedCount: linked.length,
           ...cloudInfo ? { cloud: cloudInfo } : {}
@@ -19777,18 +21052,18 @@ ${formatIssues(fileResult.error)}`,
   }
   console.log();
   console.log(
-    `  ${symbols.success} Recorded ${validatedVerdicts.length} verdicts for run ${chalk29.cyan(runId)}`
+    `  ${symbols.success} Recorded ${validatedVerdicts.length} verdicts for run ${chalk30.cyan(runId)}`
   );
   if (linked.length > 0) {
     console.log(
-      `  ${chalk29.dim("linked:")}  ${linked.length} finding${linked.length === 1 ? "" : "s"} to the human test${linked.length === 1 ? "" : "s"} citing ${linked.length === 1 ? "it" : "them"}`
+      `  ${chalk30.dim("linked:")}  ${linked.length} finding${linked.length === 1 ? "" : "s"} to the human test${linked.length === 1 ? "" : "s"} citing ${linked.length === 1 ? "it" : "them"}`
     );
   }
   console.log(
-    `  ${chalk29.dim("verdicts:")} ${path25.relative(projectRoot, verdictsPath)}`
+    `  ${chalk30.dim("verdicts:")} ${path27.relative(projectRoot, verdictsPath)}`
   );
   console.log(
-    `  ${chalk29.dim("report:")}  ${path25.relative(projectRoot, reportPath)}`
+    `  ${chalk30.dim("report:")}  ${path27.relative(projectRoot, reportPath)}`
   );
   printCloudRunInfo(cloudInfo);
   await promptViewResults(projectRoot, { ...opts, runId });
@@ -19852,9 +21127,9 @@ __export(complete_exports, {
   screenshotSizeWarning: () => screenshotSizeWarning,
   validateCanonicalWalkthrough: () => validateCanonicalWalkthrough
 });
-import { promises as fs26 } from "fs";
-import path26 from "path";
-import chalk30 from "chalk";
+import { promises as fs29 } from "fs";
+import path28 from "path";
+import chalk31 from "chalk";
 async function complete(runId, opts) {
   const run = await loadRun(runId, opts);
   if (!run) return;
@@ -19864,7 +21139,7 @@ async function complete(runId, opts) {
   }
   if (!opts?.json) {
     console.log();
-    console.log(chalk30.bold("  Assembling canonical JSON\u2026"));
+    console.log(chalk31.bold("  Assembling canonical JSON\u2026"));
   }
   const provenanceAudit = auditStepProvenance(
     await readStepsForRun(run.projectRoot, runId)
@@ -19877,8 +21152,8 @@ async function complete(runId, opts) {
   const walkerSummary = await readWalkerSummary(run.runDirPath);
   let judgeReported;
   try {
-    const verdictsRaw = await fs26.readFile(
-      path26.join(run.runDirPath, "verdicts.json"),
+    const verdictsRaw = await fs29.readFile(
+      path28.join(run.runDirPath, "verdicts.json"),
       "utf8"
     );
     const parsed = JSON.parse(verdictsRaw);
@@ -19930,16 +21205,16 @@ async function loadRun(runId, opts) {
   if (!resolved) return null;
   const { projectRoot, runDirPath } = resolved;
   try {
-    await fs26.access(runDirPath);
+    await fs29.access(runDirPath);
   } catch {
     commandError(`Run not found: ${runId}`, opts);
     return null;
   }
-  const manifestPath = path26.join(runDirPath, "walkthrough.json");
+  const manifestPath = path28.join(runDirPath, "walkthrough.json");
   let manifest;
   try {
     manifest = JSON.parse(
-      await fs26.readFile(manifestPath, "utf8")
+      await fs29.readFile(manifestPath, "utf8")
     );
   } catch {
     commandError(`No walkthrough.json found for run: ${runId}`, opts);
@@ -19951,8 +21226,8 @@ async function reportAlreadyCompleted(run, opts) {
   const { runId, manifest } = run;
   if (opts?.json) {
     try {
-      const raw = await fs26.readFile(
-        path26.join(run.runDirPath, "canonical.json"),
+      const raw = await fs29.readFile(
+        path28.join(run.runDirPath, "canonical.json"),
         "utf8"
       );
       console.log(raw.trim());
@@ -19972,18 +21247,18 @@ async function reportAlreadyCompleted(run, opts) {
     return;
   }
   console.log();
-  console.log(chalk30.bold("  Run: ") + chalk30.cyan(runId));
-  console.log(`  status     ${chalk30.green("completed")}`);
+  console.log(chalk31.bold("  Run: ") + chalk31.cyan(runId));
+  console.log(`  status     ${chalk31.green("completed")}`);
   if (manifest.completed_at) {
-    console.log(`  completed  ${chalk30.dim(manifest.completed_at)}`);
+    console.log(`  completed  ${chalk31.dim(manifest.completed_at)}`);
   }
   const viewUrl = await pushedRunUrl(run.projectRoot, runId);
   if (viewUrl) {
-    console.log(`  view       ${chalk30.underline(viewUrl)}`);
+    console.log(`  view       ${chalk31.underline(viewUrl)}`);
   }
   console.log();
   console.log(
-    chalk30.dim(
+    chalk31.dim(
       "  Already completed \u2014 nothing to do. Use --force to reassemble the report."
     )
   );
@@ -19999,13 +21274,13 @@ function reportStrictProvenanceFailure(audit, opts) {
   }
   console.error();
   console.error(
-    chalk30.red(`  ${symbols.error} Strict provenance audit failed:`)
+    chalk31.red(`  ${symbols.error} Strict provenance audit failed:`)
   );
   for (const w of audit.warnings) {
-    console.error(chalk30.red(`    \u2022 ${w}`));
+    console.error(chalk31.red(`    \u2022 ${w}`));
   }
   console.error(
-    chalk30.dim(
+    chalk31.dim(
       "  Run was flagged as synthetic / scripted. Remove --strict-provenance to complete anyway."
     )
   );
@@ -20046,41 +21321,41 @@ function completeJsonPayload(canonical, extras) {
 function printCompletionSummary(run, completedAt, assembled, extras, provenanceAudit) {
   const { runId, projectRoot, manifest } = run;
   const { canonical } = assembled;
-  const count = (n) => n === 0 ? chalk30.dim("0") : chalk30.cyan(String(n));
-  console.log(chalk30.bold("  Run: ") + chalk30.cyan(runId));
-  console.log(`  scenario   ${chalk30.dim(manifest.scenario_slug)}`);
-  console.log(`  url        ${chalk30.dim(manifest.target_url)}`);
+  const count = (n) => n === 0 ? chalk31.dim("0") : chalk31.cyan(String(n));
+  console.log(chalk31.bold("  Run: ") + chalk31.cyan(runId));
+  console.log(`  scenario   ${chalk31.dim(manifest.scenario_slug)}`);
+  console.log(`  url        ${chalk31.dim(manifest.target_url)}`);
   if (manifest.environment) {
-    console.log(`  env        ${chalk30.dim(manifest.environment)}`);
+    console.log(`  env        ${chalk31.dim(manifest.environment)}`);
   }
   if (manifest.build) {
-    console.log(`  build      ${chalk30.dim(formatBuild(manifest.build))}`);
+    console.log(`  build      ${chalk31.dim(formatBuild(manifest.build))}`);
   }
   if (manifest.viewport) {
-    console.log(`  device     ${chalk30.dim(formatViewport(manifest.viewport))}`);
+    console.log(`  device     ${chalk31.dim(formatViewport(manifest.viewport))}`);
   }
-  console.log(`  status     ${chalk30.green("completed")}`);
+  console.log(`  status     ${chalk31.green("completed")}`);
   console.log(`  findings   ${count(canonical.findings.length)}`);
   console.log(`  steps      ${count(canonical.steps.length)}`);
-  console.log(`  started    ${chalk30.dim(manifest.created_at)}`);
-  console.log(`  completed  ${chalk30.dim(completedAt)}`);
+  console.log(`  started    ${chalk31.dim(manifest.created_at)}`);
+  console.log(`  completed  ${chalk31.dim(completedAt)}`);
   const models = manifest.models;
   if (models?.velocity_sec_per_step != null) {
     console.log(
-      `  velocity   ${chalk30.cyan(`~${models.velocity_sec_per_step}s/step`)} ${chalk30.dim(`(${models.total_duration_sec}s total)`)}`
+      `  velocity   ${chalk31.cyan(`~${models.velocity_sec_per_step}s/step`)} ${chalk31.dim(`(${models.total_duration_sec}s total)`)}`
     );
   }
   if (models && (models.walker || models.judge || models.matcher)) {
     const w = models.walker_reported ? `${models.walker} (${models.walker_reported})` : models.walker ?? "fast";
     const j = models.judge_reported ? `${models.judge} (${models.judge_reported})` : models.judge ?? "thorough";
-    console.log(`  models     ${chalk30.dim(`walker: ${w} \xB7 judge: ${j}`)}`);
+    console.log(`  models     ${chalk31.dim(`walker: ${w} \xB7 judge: ${j}`)}`);
   }
   console.log();
   console.log(
-    `  ${chalk30.dim("canonical:")} ${chalk30.dim(path26.relative(projectRoot, assembled.canonicalPath))}`
+    `  ${chalk31.dim("canonical:")} ${chalk31.dim(path28.relative(projectRoot, assembled.canonicalPath))}`
   );
   console.log(
-    `  ${chalk30.dim("report:")}    ${chalk30.dim(path26.relative(projectRoot, assembled.reportPath))}`
+    `  ${chalk31.dim("report:")}    ${chalk31.dim(path28.relative(projectRoot, assembled.reportPath))}`
   );
   if (extras.viewportWarning) {
     console.log();
@@ -20088,7 +21363,7 @@ function printCompletionSummary(run, completedAt, assembled, extras, provenanceA
   }
   if (extras.codeWarning) {
     console.log();
-    console.log(`  ${chalk30.yellow("!")} ${extras.codeWarning}`);
+    console.log(`  ${chalk31.yellow("!")} ${extras.codeWarning}`);
   }
   if (extras.revisit) printRevisit(extras.revisit);
   if (assembled.verification) printVerification(assembled.verification);
@@ -20100,13 +21375,13 @@ function printProvenanceWarnings(audit) {
   if (audit.warnings.length === 0) return;
   console.log();
   console.log(
-    `  ${symbols.warning} ${chalk30.yellow("Step provenance audit flagged suspicious timing:")}`
+    `  ${symbols.warning} ${chalk31.yellow("Step provenance audit flagged suspicious timing:")}`
   );
   for (const w of audit.warnings) {
-    console.log(`    ${chalk30.dim("\u2022")} ${w}`);
+    console.log(`    ${chalk31.dim("\u2022")} ${w}`);
   }
   console.log(
-    chalk30.dim(
+    chalk31.dim(
       "    Run appears to be programmatically batch-generated rather than an interactive walkthrough."
     )
   );
@@ -20138,17 +21413,17 @@ function screenshotFitsViewport(width, expected) {
 }
 async function screenshotSizeWarning(runDirPath, viewport) {
   if (!viewport) return null;
-  const dir = path26.join(runDirPath, "screenshots");
+  const dir = path28.join(runDirPath, "screenshots");
   let first;
   try {
-    first = (await fs26.readdir(dir)).filter((f) => f.toLowerCase().endsWith(".png")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true }))[0];
+    first = (await fs29.readdir(dir)).filter((f) => f.toLowerCase().endsWith(".png")).sort((a, b) => a.localeCompare(b, void 0, { numeric: true }))[0];
   } catch {
     return null;
   }
   if (!first) return null;
   let size = null;
   try {
-    const handle = await fs26.open(path26.join(dir, first), "r");
+    const handle = await fs29.open(path28.join(dir, first), "r");
     try {
       const head = Buffer.alloc(24);
       const { bytesRead } = await handle.read(head, 0, 24, 0);
@@ -20165,7 +21440,7 @@ async function screenshotSizeWarning(runDirPath, viewport) {
 async function readWalkerSummary(runDirPath) {
   try {
     const data = JSON.parse(
-      await fs26.readFile(path26.join(runDirPath, "summary.json"), "utf8")
+      await fs29.readFile(path28.join(runDirPath, "summary.json"), "utf8")
     );
     const strings = (v) => Array.isArray(v) ? v.filter((x) => typeof x === "string" && x.trim() !== "") : void 0;
     const model = typeof data.model === "string" && data.model.trim() !== "" ? data.model.trim() : void 0;
@@ -20274,7 +21549,7 @@ function validateCanonicalWalkthrough(canonical) {
 async function applyRecordedVerdicts(canonical, runDirPath) {
   try {
     const recorded = JSON.parse(
-      await fs26.readFile(path26.join(runDirPath, "verdicts.json"), "utf8")
+      await fs29.readFile(path28.join(runDirPath, "verdicts.json"), "utf8")
     );
     if (Array.isArray(recorded.verdicts)) {
       return applyVerdicts(canonical, recorded);
@@ -20284,7 +21559,7 @@ async function applyRecordedVerdicts(canonical, runDirPath) {
   return canonical;
 }
 async function persistCanonical(runDirPath, canonical) {
-  const canonicalPath = path26.join(runDirPath, "canonical.json");
+  const canonicalPath = path28.join(runDirPath, "canonical.json");
   await atomicWriteFile(
     canonicalPath,
     `${JSON.stringify(canonical, null, 2)}
@@ -20293,7 +21568,7 @@ async function persistCanonical(runDirPath, canonical) {
   return canonicalPath;
 }
 async function persistReport(runDirPath, canonical) {
-  const reportPath = path26.join(runDirPath, "report.md");
+  const reportPath = path28.join(runDirPath, "report.md");
   await atomicWriteFile(reportPath, renderCanonicalMarkdown(canonical));
   return reportPath;
 }
@@ -20393,17 +21668,17 @@ function placeLabel(p) {
 function printRevisit(r) {
   const missed = r.places.filter((p) => !p.reached);
   console.log();
-  const head = `  ${chalk30.bold("Re-check places:")} reached ${r.reached} of ${r.requested}`;
+  const head = `  ${chalk31.bold("Re-check places:")} reached ${r.reached} of ${r.requested}`;
   if (missed.length === 0) {
-    console.log(`${head} ${chalk30.green("\u2713")}`);
+    console.log(`${head} ${chalk31.green("\u2713")}`);
     return;
   }
   console.log(`${head} \u2014 not reached:`);
   for (const p of missed) {
-    console.log(`    ${chalk30.yellow("\u25CB")} ${placeLabel(p)}`);
+    console.log(`    ${chalk31.yellow("\u25CB")} ${placeLabel(p)}`);
   }
   console.log(
-    chalk30.dim(
+    chalk31.dim(
       "    Fixes there stay awaiting a re-run until a walk gets there."
     )
   );
@@ -20411,7 +21686,7 @@ function printRevisit(r) {
 function printVerification(verification) {
   console.log();
   console.log(
-    chalk30.bold("  Since this scenario's last run") + chalk30.dim(` (${verification.baseline_run_id.slice(0, 30)}\u2026)`) + chalk30.bold(":")
+    chalk31.bold("  Since this scenario's last run") + chalk31.dim(` (${verification.baseline_run_id.slice(0, 30)}\u2026)`) + chalk31.bold(":")
   );
   if (verification.resolved.length > 0) {
     console.log(
@@ -20420,7 +21695,7 @@ function printVerification(verification) {
   }
   if (verification.not_observed.length > 0) {
     console.log(
-      `    ${symbols.pending} ${verification.not_observed.length} not seen this run ${chalk30.dim("(not evidence of a fix)")}`
+      `    ${symbols.pending} ${verification.not_observed.length} not seen this run ${chalk31.dim("(not evidence of a fix)")}`
     );
   }
   if (verification.persists.length > 0) {
@@ -20461,14 +21736,14 @@ __export(match_exports, {
   match: () => match,
   matchRecord: () => matchRecord
 });
-import { promises as fs27 } from "fs";
-import path27 from "path";
-import chalk31 from "chalk";
+import { promises as fs30 } from "fs";
+import path29 from "path";
+import chalk32 from "chalk";
 async function completedManifest2(runDirPath, runId, opts) {
   let manifest;
   try {
     manifest = JSON.parse(
-      await fs27.readFile(path27.join(runDirPath, "walkthrough.json"), "utf8")
+      await fs30.readFile(path29.join(runDirPath, "walkthrough.json"), "utf8")
     );
   } catch {
     commandError(`Run not found: ${runId}`, opts);
@@ -20497,12 +21772,12 @@ async function match(runId, opts) {
   );
   const needed = input.current.length > 0 && (input.prior.length > 0 || (input.guidance ?? []).length > 0);
   const prompt = needed ? composeMatchPrompt(input) : null;
-  const promptFilePath = opts?.promptFile ?? path27.join(runDirPath, "match_prompt.md");
+  const promptFilePath = opts?.promptFile ?? path29.join(runDirPath, "match_prompt.md");
   if (prompt) {
-    await fs27.writeFile(promptFilePath, prompt, "utf8");
+    await fs30.writeFile(promptFilePath, prompt, "utf8");
   } else {
     try {
-      await fs27.unlink(promptFilePath);
+      await fs30.unlink(promptFilePath);
     } catch {
     }
   }
@@ -20512,8 +21787,8 @@ async function match(runId, opts) {
         {
           ...input,
           needed,
-          prompt_file: prompt ? path27.relative(ctx.projectRoot, promptFilePath) : null,
-          prompt_file_abs: prompt ? path27.resolve(promptFilePath) : null,
+          prompt_file: prompt ? path29.relative(ctx.projectRoot, promptFilePath) : null,
+          prompt_file_abs: prompt ? path29.resolve(promptFilePath) : null,
           match_prompt: prompt
         },
         null,
@@ -20524,7 +21799,7 @@ async function match(runId, opts) {
   }
   if (!prompt) {
     console.log(
-      chalk31.dim(
+      chalk32.dim(
         "  No earlier findings or tester guidance for this scenario to match against \u2014 nothing to do."
       )
     );
@@ -20540,7 +21815,7 @@ async function matchRecord(runId, opts) {
   if (!manifest) return;
   let answer;
   try {
-    answer = JSON.parse(await fs27.readFile(opts.file, "utf8"));
+    answer = JSON.parse(await fs30.readFile(opts.file, "utf8"));
   } catch {
     commandError(`Cannot read matches file: ${opts.file}`, opts);
     return;
@@ -20581,17 +21856,17 @@ async function matchRecord(runId, opts) {
   }
   console.log();
   console.log(
-    `  ${chalk31.green("\u2713")} Matched ${result.linked} finding${result.linked === 1 ? "" : "s"} to earlier ones, ${result.new} first seen, ${result.rechecked_fixed} earlier re-checked fixed`
+    `  ${chalk32.green("\u2713")} Matched ${result.linked} finding${result.linked === 1 ? "" : "s"} to earlier ones, ${result.new} first seen, ${result.rechecked_fixed} earlier re-checked fixed`
   );
   if (result.suppressed > 0) {
     console.log(
-      `  ${chalk31.yellow("!")} ${result.suppressed} finding${result.suppressed === 1 ? "" : "s"} match tester guidance (flagged with suppressed_by_guidance \u2014 dismiss them in triage if the rule holds)`
+      `  ${chalk32.yellow("!")} ${result.suppressed} finding${result.suppressed === 1 ? "" : "s"} match tester guidance (flagged with suppressed_by_guidance \u2014 dismiss them in triage if the rule holds)`
     );
   }
   if (verification) printVerification(verification);
   console.log();
   console.log(
-    chalk31.dim("  Run `iamu sync` to push the linked findings to the cloud.")
+    chalk32.dim("  Run `iamu sync` to push the linked findings to the cloud.")
   );
   console.log();
 }
@@ -20612,7 +21887,7 @@ __export(prune_exports, {
   prune: () => prune
 });
 import { confirm, isCancel as isCancel5 } from "@clack/prompts";
-import chalk32 from "chalk";
+import chalk33 from "chalk";
 function formatBytes(bytes) {
   if (bytes <= 0) return "0 B";
   if (bytes < 1024) return `${bytes} B`;
@@ -20658,7 +21933,7 @@ async function prune(opts = {}) {
     });
     if (preview.prunedRuns.length === 0) {
       console.log(
-        chalk32.dim("  No runs match the pruning criteria. Nothing to prune.")
+        chalk33.dim("  No runs match the pruning criteria. Nothing to prune.")
       );
       return preview;
     }
@@ -20667,7 +21942,7 @@ async function prune(opts = {}) {
       message: `Prune ${mode} ${preview.prunedRuns.length} run(s) and reclaim ${formatBytes(preview.totalBytesReclaimed)}?`
     });
     if (isCancel5(confirmed) || !confirmed) {
-      console.log(chalk32.yellow("  Pruning cancelled."));
+      console.log(chalk33.yellow("  Pruning cancelled."));
       return;
     }
   }
@@ -20678,14 +21953,14 @@ async function prune(opts = {}) {
   }
   if (result.dryRun) {
     console.log(
-      chalk32.cyan(
+      chalk33.cyan(
         `
   [DRY RUN] Would prune ${result.prunedRuns.length} of ${result.totalRunsScanned} run(s):`
       )
     );
   } else {
     console.log(
-      chalk32.bold(
+      chalk33.bold(
         `
   ${symbols.success} Pruned ${result.prunedRuns.length} of ${result.totalRunsScanned} run(s):`
       )
@@ -20693,18 +21968,18 @@ async function prune(opts = {}) {
   }
   if (result.prunedRuns.length === 0) {
     console.log(
-      chalk32.dim("    No runs matched the pruning criteria. Nothing pruned.")
+      chalk33.dim("    No runs matched the pruning criteria. Nothing pruned.")
     );
   } else {
     for (const run of result.prunedRuns) {
       const mode = run.fullyDeleted ? "removed" : "screenshots purged";
       const count = run.screenshotsDeleted > 0 ? `${run.screenshotsDeleted} screenshots, ` : "";
       console.log(
-        `    ${chalk32.dim("\u2022")} ${chalk32.bold(run.runId)} ${chalk32.dim(`(${run.scenarioSlug ?? "unknown scenario"})`)}: ${chalk32.yellow(formatBytes(run.bytesReclaimed))} (${count}${mode})`
+        `    ${chalk33.dim("\u2022")} ${chalk33.bold(run.runId)} ${chalk33.dim(`(${run.scenarioSlug ?? "unknown scenario"})`)}: ${chalk33.yellow(formatBytes(run.bytesReclaimed))} (${count}${mode})`
       );
     }
     console.log(
-      chalk32.dim(
+      chalk33.dim(
         `
   Total reclaimed: ${formatBytes(result.totalBytesReclaimed)} (${result.totalScreenshotsDeleted} screenshots deleted)
 `
@@ -20727,7 +22002,7 @@ init_context4();
 import { existsSync as existsSync13, readFileSync as readFileSync9 } from "fs";
 import { dirname as dirname5, resolve as resolve3 } from "path";
 import { fileURLToPath as fileURLToPath3 } from "url";
-import chalk35 from "chalk";
+import chalk36 from "chalk";
 import { Command } from "commander";
 
 // src/commands/register-cloud.ts
@@ -20863,10 +22138,13 @@ function registerProjectCommands(program2) {
     await status2(opts);
   });
   program2.command("doctor").helpGroup("Project:").description(
-    "Diagnose environment: runtime, browser automation, skills, cloud"
+    "Diagnose environment: runtime, browser automation, skills, cloud, and target testability"
+  ).option(
+    "-t, --target <url>",
+    "Probe target URL health, reachability, and auth redirects"
   ).option("--json", "Output diagnostics as JSON").addHelpText(
     "after",
-    "\nExamples:\n  $ iamu doctor\n  $ iamu doctor --json"
+    "\nExamples:\n  $ iamu doctor\n  $ iamu doctor --target http://localhost:3000\n  $ iamu doctor --json"
   ).action(async (opts) => {
     const { doctor: doctor2 } = await Promise.resolve().then(() => (init_doctor(), doctor_exports));
     await doctor2(opts);
@@ -20898,9 +22176,9 @@ function registerProjectCommands(program2) {
     "after",
     "\nExamples:\n  $ iamu validate --all\n  $ iamu validate --all --fix --dry-run\n  $ iamu validate iamu/personas/maria.md"
   ).action(
-    async (path28, opts) => {
+    async (path30, opts) => {
       const { validate: validate2 } = await Promise.resolve().then(() => (init_validate(), validate_exports));
-      await validate2(path28, opts);
+      await validate2(path30, opts);
     }
   );
   program2.command("update").helpGroup("Project:").description("Update and repair agent skills and prompts to latest version").option(
@@ -20939,6 +22217,54 @@ function registerProjectCommands(program2) {
       await newEntity2(type2, opts);
     }
   );
+  const explore = program2.command("explore").helpGroup("Project:").description(
+    "Map the running product with a read-only crawl; compare the map with runs (coverage) or with another map (diff)"
+  );
+  explore.command("run [url]", { isDefault: true }).description(
+    "Crawl from <url> (default: target_url in iamu/testability.md) and write iamu/.cache/explore/<id>/map.json"
+  ).option("--max-surfaces <n>", "Stop after this many surfaces (default 40)").option("--max-actions <n>", "Stop after this many clicks (default 300)").option(
+    "--max-depth <n>",
+    "Don't go more than this many clicks from the start (default 6)"
+  ).option(
+    "--deny <pattern...>",
+    "Never click a control whose name or link matches (regex, case-insensitive)"
+  ).option("--viewport <WxH>", "Page size, e.g. 390x844 (default 1280x800)").option(
+    "--attach",
+    "Crawl in a new tab of the `iamu browse` browser, keeping its sign-ins"
+  ).option("--json", "Output as JSON").addHelpText(
+    "after",
+    `
+Read-only: controls that read like writes (delete, pay, send, save, log out \u2026),
+form submits, downloads and other origins are never clicked, nothing is typed,
+and every request but GET/HEAD/OPTIONS is blocked before it leaves the browser.
+
+Examples:
+  $ iamu explore http://localhost:3000
+  $ iamu explore --attach --deny "^Admin"
+  $ iamu explore coverage
+  $ iamu explore diff`
+  ).action(
+    async (url, opts) => {
+      const { exploreRun: exploreRun2 } = await Promise.resolve().then(() => (init_explore(), explore_exports));
+      await exploreRun2(url, opts);
+    }
+  );
+  explore.command("coverage [map]").description(
+    "Surfaces of a map (default: latest) that no run reached, and places runs reached that the map lacks"
+  ).option("--json", "Output as JSON").action(async (map2, opts) => {
+    const { exploreCoverageCommand: exploreCoverageCommand2 } = await Promise.resolve().then(() => (init_explore(), explore_exports));
+    await exploreCoverageCommand2(map2, opts);
+  });
+  explore.command("diff [a] [b]").description("Compare two maps (default: the two latest)").option("--json", "Output as JSON").action(
+    async (a, b, opts) => {
+      const { exploreDiffCommand: exploreDiffCommand2 } = await Promise.resolve().then(() => (init_explore(), explore_exports));
+      await exploreDiffCommand2(a, b, opts);
+    }
+  );
+  explore.command("list").description("List maps").option("--json", "Output as JSON").action(async (opts) => {
+    const { exploreList: exploreList2 } = await Promise.resolve().then(() => (init_explore(), explore_exports));
+    await exploreList2(opts);
+  });
   program2.command("completion [shell]").helpGroup("Project:").description("Output shell completion script (bash, zsh, fish)").action(async (shell) => {
     const { completion: completion2 } = await Promise.resolve().then(() => (init_completion(), completion_exports));
     completion2(program2, shell);
@@ -21146,23 +22472,23 @@ function registerAllCommands(program2) {
 
 // src/ui/panic.ts
 init_logger();
-import chalk33 from "chalk";
+import chalk34 from "chalk";
 var handlersRegistered = false;
 var customSigintHandler = null;
 function logFatalAndExit(title, errOrReason) {
   process.stderr.write("\x1B[?25h");
   if (isVerbose()) {
-    console.error(chalk33.red(`
+    console.error(chalk34.red(`
   ${title}:`));
     console.error(
       errOrReason instanceof Error ? errOrReason.stack || errOrReason : errOrReason
     );
   } else {
     const msg = errOrReason instanceof Error ? errOrReason.message : String(errOrReason);
-    console.error(chalk33.red(`
+    console.error(chalk34.red(`
   Fatal Error: ${msg}`));
     console.error(
-      chalk33.dim(
+      chalk34.dim(
         "  Run with --verbose or DEBUG=1 to view the full stack trace.\n"
       )
     );
@@ -21181,7 +22507,7 @@ function setupProcessHandlers() {
       }
       process.exit(130);
     } else {
-      console.error(chalk33.dim("\n  Operation cancelled."));
+      console.error(chalk34.dim("\n  Operation cancelled."));
       process.exit(130);
     }
   });
@@ -21207,7 +22533,7 @@ function setupProcessHandlers() {
 import { mkdir as mkdir7, readFile as readFile7, writeFile as writeFile5 } from "fs/promises";
 import { homedir as homedir4 } from "os";
 import { join as join10 } from "path";
-import chalk34 from "chalk";
+import chalk35 from "chalk";
 var CACHE_FILE = join10(homedir4(), ".iamu", "update-check.json");
 var CHECK_INTERVAL_MS = 24 * 60 * 60 * 1e3;
 function isSemverGreater(latest, current) {
@@ -21260,7 +22586,7 @@ async function checkForUpdate(currentVersion) {
 function printUpdateNotice(currentVersion, latestVersion) {
   console.error();
   console.error(
-    `  ${chalk34.yellow("Update available:")} ${chalk34.dim(currentVersion)} \u2192 ${chalk34.green(latestVersion)}  ${chalk34.dim("(run: npm i -g @iamu-dev/iamu)")}`
+    `  ${chalk35.yellow("Update available:")} ${chalk35.dim(currentVersion)} \u2192 ${chalk35.green(latestVersion)}  ${chalk35.dim("(run: npm i -g @iamu-dev/iamu)")}`
   );
 }
 
@@ -21305,7 +22631,7 @@ var program = new Command().name("iamu").description(
     }
   }
   if (root.color === false || process.env.NO_COLOR) {
-    chalk35.level = 0;
+    chalk36.level = 0;
   }
   if (root.verbose) {
     process.env.IAMU_VERBOSE = "1";