@taodigital/agents 0.0.0-stage → 1.2.0

package/dist/data-agent.js

@@ -0,0 +1,2284 @@
+"use strict";
+/**
+ * ZeTa-AI Test Data Generation Agent
+ *
+ * Field-schema grounded: loads typed AppField catalog before generating.
+ * If all grounded elements are non-data-bearing (buttons/links/toggles)
+ * → returns interaction variations, NOT fabricated field:value datasets.
+ *
+ * Four generation modes:
+ *   FORM   — ≥1 data-bearing field → typed, constraint-aware parameterized datasets
+ *   STATE  — all non-data-bearing → precondition-state datasets
+ *   VOLUME — PERFORMANCE / LOAD kinds → data-setup specs (row counts, concurrency, seed)
+ *   SKIP   — kinds not suited to any parameterized data (EXPLORATORY, MUTATION, AB_TEST, etc.)
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.scheduleSkillFileRefresh = scheduleSkillFileRefresh;
+exports.generateTestData = generateTestData;
+exports.generateTestDataBatch = generateTestDataBatch;
+exports.parseCsvToDatasets = parseCsvToDatasets;
+exports.mergeExternalDatasets = mergeExternalDatasets;
+const app_brain_1 = require("@taodigital/app-brain");
+const llm_js_1 = require("./llm.js");
+const llm_config_js_1 = require("./llm-config.js");
+const core_1 = require("@taodigital/core");
+const step_utils_js_1 = require("./step-utils.js");
+const skill_file_agent_js_1 = require("./skill-file-agent.js");
+// ─── PERF: Module-level TTL cache ────────────────────────────────────────────
+// Skill files and LLM config rarely change. Cache them for 5 minutes to avoid
+// a DB round-trip on every generateTestData call.
+const CACHE_TTL_MS = 5 * 60 * 1000;
+const _cache = new Map();
+function _cacheGet(key) {
+    const e = _cache.get(key);
+    if (!e || Date.now() > e.expiresAt) {
+        _cache.delete(key);
+        return undefined;
+    }
+    return e.value;
+}
+function _cacheSet(key, value) {
+    _cache.set(key, { value, expiresAt: Date.now() + CACHE_TTL_MS });
+}
+async function _cachedLLMConfig(tenantId) {
+    const k = `llmcfg:${tenantId}`;
+    const hit = _cacheGet(k);
+    if (hit !== undefined)
+        return hit;
+    const val = await (0, llm_config_js_1.getTaskAgentLLMConfig)(tenantId, 'testGeneration');
+    if (val !== undefined)
+        _cacheSet(k, val);
+    return val;
+}
+async function _cachedSkillFile(tenantId, projectId, type) {
+    const k = `skill:${tenantId}:${projectId}:${type}`;
+    const hit = _cacheGet(k);
+    if (hit !== undefined)
+        return hit;
+    const val = await app_brain_1.AppBrain.getSkillFile(tenantId, projectId, type).catch(() => null);
+    _cacheSet(k, val);
+    return val;
+}
+// ─── PERF: Seed-keyed LLM response cache ─────────────────────────────────────
+// L1: in-process LRU (1-hour TTL, 500-entry cap) — zero-latency hits on same pod.
+// L2: Redis (1-hour TTL) — shared across all pods so only ONE pod pays the LLM
+//     cost for a given (tenant, project, testCase, kind, fieldCount) tuple.
+//
+// Cache key: deterministicSeed output (int32) stringified — content-derived,
+// not time-based, so the same inputs always map to the same key.
+// Redis is optional: if REDIS_URL is unset or Redis is down, the code falls back
+// to L1 only. No correctness impact — LLM calls are temperature:0 + seeded so
+// every pod independently generates identical data. Redis reduces redundant cost.
+const _LLM_RESP_TTL = 60 * 60 * 1000;
+const _LLM_RESP_TTL_S = 60 * 60; // Redis EXPIRE takes seconds
+const _REDIS_KEY_PREFIX = 'zeta:data-agent:resp:';
+const _llmRespCache = new Map();
+function _respCacheGet(seed) {
+    const e = _llmRespCache.get(seed);
+    if (!e || Date.now() > e.at + _LLM_RESP_TTL) {
+        _llmRespCache.delete(seed);
+        return undefined;
+    }
+    return e.dataSets;
+}
+function _respCacheSet(seed, dataSets) {
+    if (_llmRespCache.size >= 500) {
+        const first = _llmRespCache.keys().next().value;
+        if (first !== undefined)
+            _llmRespCache.delete(first);
+    }
+    _llmRespCache.set(seed, { dataSets, at: Date.now() });
+}
+async function _respCacheGetL2(seed) {
+    const redis = (0, core_1.getRedisClient)();
+    if (!redis)
+        return undefined;
+    try {
+        const raw = await redis.get(`${_REDIS_KEY_PREFIX}${seed}`);
+        if (!raw)
+            return undefined;
+        return JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+}
+async function _respCacheSetL2(seed, dataSets) {
+    const redis = (0, core_1.getRedisClient)();
+    if (!redis)
+        return;
+    try {
+        await redis.set(`${_REDIS_KEY_PREFIX}${seed}`, JSON.stringify(dataSets), 'EX', _LLM_RESP_TTL_S);
+    }
+    catch {
+        // Redis write failure is non-fatal — L1 still serves the same pod
+    }
+}
+// ─── PERF: Debounced skill-file refresh (30s window per project) ──────────────
+// Prevents 25 concurrent refreshes when batch-generating 25 cases at once.
+const _refreshTimers = new Map();
+function scheduleSkillFileRefresh(tenantId, projectId, delayMs = 30_000) {
+    const k = `${tenantId}:${projectId}`;
+    const existing = _refreshTimers.get(k);
+    if (existing)
+        clearTimeout(existing);
+    const t = setTimeout(() => {
+        _refreshTimers.delete(k);
+        (0, skill_file_agent_js_1.refreshTestDataSkillFile)(tenantId, projectId).catch(console.error);
+    }, delayMs);
+    _refreshTimers.set(k, t);
+}
+// PERFORMANCE and LOAD now generate VOLUME mode datasets (data setup specs), not skipped.
+const SKIP_KINDS = new Set(['EXPLORATORY', 'MUTATION', 'AB_TEST', 'ALPHA_BETA', 'SYSTEM']);
+// Hard ceiling per test case — set high so the model generates as many as it finds meaningful.
+// Override with DATA_AGENT_ROW_LIMIT env var.
+const DATA_LIMIT = parseInt(process.env.DATA_AGENT_ROW_LIMIT ?? '50', 10);
+// Minimum datasets guaranteed per test case (never fewer than this).
+const DATA_MIN = 3;
+/**
+ * Contextual maximum — returns a generous ceiling so the model generates
+ * all meaningful scenarios without an artificial cap.
+ */
+function contextualMax(fields, kind, mode) {
+    if (mode === 'volume')
+        return 8; // baseline, peak, stress, spike, ramp, soak, burst, cold-start
+    if (mode === 'state')
+        return DATA_LIMIT; // generate all meaningful precondition states
+    // Form mode: complexity-driven
+    let complexity = 0;
+    for (const f of fields) {
+        if (f.dataType === 'enum')
+            complexity += Math.min(f.enumValues?.length ?? 1, 6) + 1;
+        else if (f.dataType === 'integer' || f.dataType === 'decimal' || f.dataType === 'currency')
+            complexity += 5;
+        else if (f.dataType === 'date' || f.dataType === 'datetime')
+            complexity += 4;
+        else if (f.dataType === 'boolean')
+            complexity += 2;
+        else if (f.dataType === 'phone')
+            complexity += 4;
+        else
+            complexity += 4; // string / email / url
+    }
+    const kindBonus = kind === 'SECURITY' ? 4
+        : kind === 'EDGE' ? 3
+            : kind === 'NEGATIVE' ? 3
+                : kind === 'ACCESSIBILITY' ? 2
+                    : 0;
+    return Math.max(DATA_MIN, Math.min(DATA_LIMIT, complexity + kindBonus));
+}
+// JSON schema for tool-call mode — forces OpenAI to return valid JSON directly
+const DATA_SETS_SCHEMA = {
+    type: 'object',
+    properties: {
+        dataSets: {
+            type: 'array',
+            items: {
+                type: 'object',
+                properties: {
+                    label: { type: 'string' },
+                    category: { type: 'string', enum: ['VALID', 'INVALID', 'EDGE', 'SECURITY'] },
+                    values: { type: 'object', additionalProperties: { type: 'string' } },
+                    expectedOutcome: { type: 'string' },
+                    gherkinExample: { type: 'string' },
+                },
+                required: ['label', 'category', 'values', 'expectedOutcome'],
+            },
+        },
+    },
+    required: ['dataSets'],
+};
+const VOLUME_KINDS = new Set(['PERFORMANCE', 'LOAD']);
+// Roles where XSS/SQLi/injection probes are meaningful (have a reflective text surface)
+const REFLECTIVE_ROLES = new Set(['INPUT_TEXT', 'INPUT_EMAIL', 'TEXTAREA', 'INPUT_PASSWORD']);
+const REFLECTIVE_TYPES = new Set(['string', 'email', 'url']);
+function allowsSecurityProbe(f) {
+    return f.dataBearing && REFLECTIVE_ROLES.has(f.elementRole) && REFLECTIVE_TYPES.has(f.dataType);
+}
+function fieldStrategy(f) {
+    switch (f.dataType) {
+        case 'string':
+            return `string: VALID-1=use the EXACT example value above (real value from app — do NOT substitute with "validUser" or any placeholder), VALID-2=alternate representative value. INVALID: empty${f.required ? ' (required field violation)' : ''}, ${f.maxLength ? f.maxLength + 1 : '256'}+ chars. EDGE: whitespace-only, leading/trailing spaces, unicode/emoji. BVA on minLength=${f.minLength ?? 0}/maxLength=${f.maxLength ?? 'n'}.`;
+        case 'email':
+            return `email: VALID-1=use the EXACT example value above (do NOT use "test@example.com" or invented emails), VALID-2=valid+subaddress (user+tag@domain). INVALID: missing @, missing domain, double @, space inside. EDGE: unicode local part, very long.`;
+        case 'integer':
+            return `integer: BVA → ${(f.minValue ?? 0) - 1}, ${f.minValue ?? 0}, ${(f.minValue ?? 0) + 1} ... ${(f.maxValue ?? 100) - 1}, ${f.maxValue ?? 100}, ${(f.maxValue ?? 100) + 1}; plus zero, negative, decimal-where-int-expected, non-numeric string.`;
+        case 'decimal':
+        case 'currency':
+            return `${f.dataType}: precision boundaries (${f.precision ?? 2} decimal places), zero, negative, very large, more-decimals-than-allowed, non-numeric.`;
+        case 'date':
+        case 'datetime':
+            return 'date: valid, min-date boundary, max-date boundary, invalid format, impossible date (Feb 30, Feb 29 in non-leap year), empty, out-of-allowed-range.';
+        case 'enum':
+            return `enum: one VALID dataset per allowed value [${(f.enumValues ?? []).join(', ')}]; one INVALID with a value NOT in the set.`;
+        case 'boolean':
+            return `boolean: true, false${!f.required ? ', missing/null' : ''}.`;
+        case 'phone':
+            return 'phone: valid with country code, valid without country code, too short, too long, letters mixed in, empty.';
+        case 'url':
+            return `url: VALID-1=the EXACT example URL shown above (do NOT invent "app.example.com" or any placeholder — use the real URL), VALID-2=same URL with http instead of https. INVALID: missing scheme (no ://), space inside URL, malformed hostname. EDGE: very long URL (500+ chars), empty string.`;
+        case 'file':
+            return 'file upload: VALID-1=supported file type (e.g. .pdf, .png, .csv) within size limit. VALID-2=another supported type at near-max size. INVALID: unsupported extension (.exe, .bat, .sh, .js); file size exceeding max limit; empty file (0 bytes). EDGE: file exactly at size limit; valid extension with corrupt/truncated content (MIME type mismatch); filename with special characters or very long name (200+ chars). SECURITY: valid extension masking malicious MIME type (e.g. image/jpeg file renamed to .pdf).';
+        default:
+            return '3 representative valid values + 2 specific invalid values with distinct failure reasons.';
+    }
+}
+/**
+ * Infer an appropriate dataType string from a camelCase field key name.
+ * Used when docs-based test cases have no crawled field schema — the step generator
+ * writes {{fieldKey}} placeholders whose types must be guessed from the key name.
+ */
+function inferDataTypeFromFieldKey(key) {
+    const k = key.toLowerCase();
+    // File types
+    if (/^(file(name)?|attachment|upload|import(file)?|exportfile)$/.test(k) || k.endsWith('file') || k.endsWith('filename'))
+        return 'file';
+    // URL types
+    if (k === 'url' || k === 'starturl' || k === 'dashboardurl' || k === 'loginurl' || k === 'redirecturl' || k === 'protectedurl' || k.endsWith('url') || k.endsWith('link') || k.endsWith('href') || k.endsWith('endpoint'))
+        return 'url';
+    // Email types
+    if (k === 'email' || k === 'username' || k.endsWith('email') || k === 'recipientemail')
+        return 'email';
+    // Phone types
+    if (k === 'phone' || k.endsWith('phone') || k.endsWith('mobile') || k.endsWith('tel'))
+        return 'phone';
+    // Integer / count types
+    if (k.endsWith('count') || k.endsWith('number') || k.endsWith('qty') || k.endsWith('quantity')
+        || k.endsWith('limit') || k.endsWith('total') || k.endsWith('size') || k.endsWith('index')
+        || k.endsWith('rowcount') || k.endsWith('pagecount') || k.endsWith('paircount') || k.endsWith('rowcount')
+        || /^(count|total|qty|quantity|size|index|limit|page)$/.test(k))
+        return 'integer';
+    // Currency / price types
+    if (k.endsWith('price') || k.endsWith('cost') || k.endsWith('fee') || k.endsWith('amount') || k.endsWith('balance'))
+        return 'currency';
+    // Date / time types
+    if (k.endsWith('date') || k.endsWith('time') || k.endsWith('at') || k.endsWith('on')
+        || k === 'startdate' || k === 'enddate' || k === 'duedate' || k === 'expiry' || k === 'expirydate')
+        return 'date';
+    // Boolean flags
+    if (k.endsWith('enabled') || k.endsWith('active') || k.endsWith('visible') || k.endsWith('published')
+        || k.endsWith('flag') || k.endsWith('toggle') || k.startsWith('is') || k.startsWith('has'))
+        return 'boolean';
+    // Default to string for everything else
+    return 'string';
+}
+/**
+ * Parse FZE multi-select encoded value into a human-readable comma-separated list.
+ * Format: OR|FUNCOPR|Option1|FUNCVAL|Option2|...
+ */
+function normalizeFzeMultiSelectValue(val) {
+    if (!val.includes('FUNCOPR') && !val.includes('FUNCVAL'))
+        return val;
+    const options = [];
+    const parts = val.split('|');
+    let inOption = false;
+    for (let i = 0; i < parts.length; i++) {
+        if (parts[i] === 'FUNCOPR' || parts[i] === 'FUNCVAL' || parts[i] === 'OR') {
+            inOption = true;
+        }
+        else if (inOption && parts[i].trim()) {
+            options.push(parts[i].trim());
+            inOption = false;
+        }
+    }
+    return options.length > 0 ? options.join(', ') : val;
+}
+function isValidExampleValue(v) {
+    if (v === null || v === undefined)
+        return false;
+    const s = String(v).trim();
+    return (s.length > 0 &&
+        s.length < 300 &&
+        s !== '[object Object]' &&
+        s !== 'undefined' &&
+        s !== 'null');
+}
+function buildFieldsBlock(fields) {
+    return fields.map((f) => {
+        const parts = [`  ${f.fieldKey} (${f.dataType}, ${f.elementRole}${f.required ? ', required' : ''})`];
+        if (f.minLength != null)
+            parts.push(`    minLength: ${f.minLength}`);
+        if (f.maxLength != null)
+            parts.push(`    maxLength: ${f.maxLength}`);
+        if (f.minValue != null)
+            parts.push(`    minValue: ${f.minValue}`);
+        if (f.maxValue != null)
+            parts.push(`    maxValue: ${f.maxValue}`);
+        if (f.enumValues?.length)
+            parts.push(`    allowedValues: [${f.enumValues.join(', ')}]`);
+        if (f.regex)
+            parts.push(`    pattern: ${f.regex}`);
+        if (f.exampleValue)
+            parts.push(`    example: ${f.exampleValue}`);
+        if (f.notes)
+            parts.push(`    businessRule: ${f.notes}`);
+        parts.push(`    STRATEGY: ${fieldStrategy(f)}`);
+        if (allowsSecurityProbe(f))
+            parts.push('    SECURITY: generate XSS, SQLi, path-traversal probe datasets for this field.');
+        return parts.join('\n');
+    }).join('\n\n');
+}
+/**
+ * Robustly extracts a JSON object from LLM output.
+ * Handles: preamble text with stray { chars (e.g. "{login}"), markdown code fences,
+ * literal control characters in string values.
+ */
+function extractJson(raw) {
+    let slice = null;
+    // Strategy 1: anchor on the known "dataSets" key — most reliable for our output shape
+    const dsIdx = raw.indexOf('"dataSets"');
+    if (dsIdx !== -1) {
+        let start = dsIdx;
+        while (start > 0 && raw[start] !== '{')
+            start--;
+        const end = raw.lastIndexOf('}');
+        if (start >= 0 && end > start)
+            slice = raw.slice(start, end + 1);
+    }
+    // Strategy 2: strip markdown code fences then find outermost { }
+    if (!slice) {
+        const stripped = raw.replace(/```[a-zA-Z]*\n?/g, '').trim();
+        const j = stripped.indexOf('{');
+        const je = stripped.lastIndexOf('}');
+        if (j !== -1 && je !== -1)
+            slice = stripped.slice(j, je + 1);
+    }
+    if (!slice)
+        throw new Error('No JSON object found in LLM response');
+    // Try parse; on failure sanitize literal control characters ONLY inside string values
+    try {
+        return JSON.parse(slice);
+    }
+    catch {
+        let clean = '';
+        let inStr = false;
+        for (let i = 0; i < slice.length; i++) {
+            const c = slice[i];
+            if (c === '\\' && inStr) {
+                clean += c + slice[++i];
+                continue;
+            }
+            if (c === '"') {
+                inStr = !inStr;
+                clean += c;
+                continue;
+            }
+            if (inStr) {
+                if (c === '\n') {
+                    clean += '\\n';
+                    continue;
+                }
+                if (c === '\r') {
+                    clean += '\\r';
+                    continue;
+                }
+                if (c === '\t') {
+                    clean += '\\t';
+                    continue;
+                }
+            }
+            clean += c;
+        }
+        return JSON.parse(clean);
+    }
+}
+const HEDGING_RE = /\b(possibly|potentially|may |might |should probably|could )\b/i;
+function rejectHedgedOutcomes(dataSets) {
+    return dataSets.filter((ds) => {
+        if (HEDGING_RE.test(ds.expectedOutcome)) {
+            console.warn(`[data-agent] Dropped hedged outcome in "${ds.label}": "${ds.expectedOutcome}"`);
+            return false;
+        }
+        return true;
+    });
+}
+const DATA_INTENT_STOP_WORDS = new Set([
+    'test', 'case', 'scenario', 'user', 'page', 'input', 'button', 'field',
+    'click', 'enter', 'select', 'navigate', 'verify', 'validate', 'correctly',
+    'through', 'with', 'from', 'this', 'that', 'when', 'then', 'given', 'and',
+    'the', 'has', 'have', 'had', 'for', 'are', 'was', 'were', 'been', 'being',
+    'will', 'would', 'should', 'could', 'model', 'models', 'catalog',
+]);
+const GENERIC_OTHER_SCENARIO_RE = /\b(empty|blank|missing|required|invalid|malformed|non[-\s]?existent|no results?|first use|first-use|rapid|subsequent|simultaneous|different devices?|mobile|desktop|unicode|emoji|xss|sqli|sql injection|path traversal|permission|unauthenticated|expired session)\b/i;
+const NEGATIVE_INTENT_RE = /\b(invalid|reject|error|blocked|permission|unauthenticated|unauthorized|expired|no results?|not found|empty|required|missing|fail)\b/i;
+const OVERFLOW_INTENT_RE = /\b(overflow|excess|excessive|numerous|high number|many|large number|pagination|loading|performance|volume|load|results)\b/i;
+const SEARCH_INTENT_RE = /\b(search|find|query|lookup|filter|browse|locate)\b/i;
+const OVERFLOW_DATA_RE = /\b(overflow|excess|excessive|numerous|high|many|large|pagination|loading|performance|volume|load|results|maxResults|rowCount|pageSize|common term)\b/i;
+function intentText(testCase) {
+    return [
+        testCase?.title,
+        testCase?.expectedResult,
+        testCase?.preconditions,
+        Array.isArray(testCase?.tags) ? testCase.tags.join(' ') : '',
+        testCase?.techniqueOfRecord,
+        (0, step_utils_js_1.normalizeSteps)(testCase?.steps).join(' '),
+    ].filter(Boolean).join(' ');
+}
+function intentTokens(text) {
+    return new Set(text
+        .toLowerCase()
+        .replace(/[^a-z0-9\s-]/g, ' ')
+        .split(/\s+/)
+        .map((token) => token.trim())
+        .filter((token) => token.length >= 4 && !DATA_INTENT_STOP_WORDS.has(token)));
+}
+function datasetText(ds) {
+    return [
+        ds.label,
+        ds.category,
+        ds.expectedOutcome,
+        JSON.stringify(ds.values ?? {}),
+    ].join(' ');
+}
+function hasTokenOverlap(dsText, tokens) {
+    const lower = dsText.toLowerCase();
+    for (const token of tokens) {
+        if (lower.includes(token))
+            return true;
+    }
+    return false;
+}
+function enforceIntentScope(dataSets, testCase, kind, mode) {
+    if (mode === 'volume')
+        return dataSets;
+    const text = intentText(testCase);
+    const tokens = intentTokens(text);
+    const hasNegativeIntent = NEGATIVE_INTENT_RE.test(text);
+    const hasOverflowIntent = OVERFLOW_INTENT_RE.test(text);
+    const hasSearchIntent = SEARCH_INTENT_RE.test(text);
+    // E2E tests are multi-step positive flows (recorded journeys) — treat like positive
+    const positiveLike = kind === 'POSITIVE' || kind === 'SMOKE' || kind === 'REGRESSION' || kind === 'SANITY' || kind === 'UAT' || kind === 'E2E';
+    const filtered = dataSets.filter((ds) => {
+        const category = String(ds.category ?? '').toUpperCase();
+        const dsText = datasetText(ds);
+        // STATE mode: INVALID = "bad precondition state" (server 503, page unavailable) — valid even for SMOKE.
+        // FORM mode: INVALID = "invalid user input" — genuinely out-of-scope for positive/smoke tests.
+        if (positiveLike && !hasNegativeIntent && mode !== 'state' && (category === 'INVALID' || category === 'SECURITY')) {
+            console.warn(`[data-agent] Dropped ${category} dataset outside positive test intent: "${ds.label}"`);
+            return false;
+        }
+        // E2E tests are recorded multi-step journeys — EDGE (boundary/minimal inputs) are irrelevant.
+        if (kind === 'E2E' && mode === 'form' && category === 'EDGE') {
+            console.warn(`[data-agent] Dropped EDGE dataset for E2E recorded journey: "${ds.label}"`);
+            return false;
+        }
+        if (!positiveLike && hasNegativeIntent && category === 'VALID') {
+            console.warn(`[data-agent] Dropped VALID dataset from negative-intent test: "${ds.label}"`);
+            return false;
+        }
+        if (!hasNegativeIntent && GENERIC_OTHER_SCENARIO_RE.test(dsText)) {
+            if (!hasOverflowIntent || !OVERFLOW_DATA_RE.test(dsText)) {
+                console.warn(`[data-agent] Dropped generic/off-intent dataset: "${ds.label}"`);
+                return false;
+            }
+        }
+        if (hasOverflowIntent && !OVERFLOW_DATA_RE.test(dsText)) {
+            console.warn(`[data-agent] Dropped non-overflow dataset for overflow/pagination intent: "${ds.label}"`);
+            return false;
+        }
+        // In form mode, enforceFieldKeys already ensures only known field keys are present —
+        // token overlap check is redundant and incorrectly drops INVALID/EDGE datasets whose
+        // labels ("empty required field", "boundary value") don't mention test intent keywords.
+        // Token overlap check is only meaningful in state mode to filter off-topic preconditions.
+        if (mode !== 'form' && tokens.size > 0 && !hasTokenOverlap(dsText, tokens) && category !== 'VALID') {
+            console.warn(`[data-agent] Dropped dataset without test-intent overlap: "${ds.label}"`);
+            return false;
+        }
+        return true;
+    });
+    const scoped = filtered.length > 0
+        ? filtered
+        : hasNegativeIntent
+            ? dataSets.filter((ds) => {
+                const cat = String(ds.category ?? '').toUpperCase();
+                return cat === 'INVALID' || cat === 'EDGE' || cat === 'SECURITY';
+            })
+            : dataSets.filter((ds) => String(ds.category ?? '').toUpperCase() === 'VALID');
+    const maxRows = DATA_LIMIT;
+    let finalScoped = scoped;
+    if (hasSearchIntent && finalScoped.length > 0 && !finalScoped.some((ds) => {
+        const dsText = datasetText(ds);
+        return /no.results?|empty|zero|not.found/i.test(dsText);
+    })) {
+        const noResultsRow = dataSets.find((ds) => {
+            const dsText = datasetText(ds);
+            return /no.results?|empty|zero|not.found/i.test(dsText);
+        });
+        if (noResultsRow)
+            finalScoped = [...finalScoped, noResultsRow];
+    }
+    return finalScoped.slice(0, maxRows);
+}
+function normalizeTargetCount(dataSets, targetCount, fallbackRows) {
+    if (!targetCount || !Number.isFinite(targetCount))
+        return dataSets;
+    // Max capped by DATA_AGENT_MAX_ROWS (env), default 100 — allows full dataset generation
+    const hardMax = parseInt(process.env.DATA_AGENT_MAX_ROWS ?? '100', 10);
+    const count = Math.max(1, Math.min(hardMax, Math.floor(targetCount)));
+    const unique = [];
+    const seen = new Set();
+    for (const ds of dataSets) {
+        const key = `${String(ds.category).toUpperCase()}|${JSON.stringify(ds.values)}|${ds.expectedOutcome}`;
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        unique.push(ds);
+    }
+    if (unique.length >= count)
+        return unique.slice(0, count);
+    // Do not pad with clones — return whatever unique datasets were generated.
+    // Padding with copies of existing rows produces the illusion of more coverage without value.
+    return unique;
+}
+function relatedCaseExclusionBlock(testCase, cases, groundedOn) {
+    const currentId = testCase?.id;
+    const currentScreenId = testCase?.screenId;
+    const grounded = new Set((groundedOn ?? []).map(String));
+    const related = cases
+        .filter((tc) => tc?.id !== currentId)
+        .filter((tc) => {
+        if (currentScreenId && tc?.screenId === currentScreenId)
+            return true;
+        const otherGrounded = Array.isArray(tc?.groundedOn) ? tc.groundedOn.map(String) : [];
+        return otherGrounded.some((id) => grounded.has(id));
+    })
+        .slice(0, DATA_LIMIT);
+    if (related.length === 0)
+        return '';
+    return [
+        'RELATED TEST CASES ALREADY COVER SEPARATE SCENARIOS:',
+        ...related.map((tc) => {
+            const steps = (0, step_utils_js_1.normalizeSteps)(tc.steps).slice(0, 3).join(' | ');
+            return `  - ${tc.ref ?? tc.id}: ${tc.title}${steps ? ` — ${steps}` : ''}`;
+        }),
+        'Do NOT generate datasets for those related scenarios. Generate only data needed by the current TEST CASE.',
+    ].join('\n');
+}
+function enforceFieldKeys(dataSets, allowedKeys, dataBearingFields = []) {
+    return dataSets.map((ds) => {
+        const cleaned = {};
+        for (const [k, v] of Object.entries(ds.values)) {
+            if (allowedKeys.has(k)) {
+                // LLM-generated test values are fake (not real scraped PII) — use them as-is.
+                // piiClass=high only blocks real extracted values, not synthetic test data.
+                cleaned[k] = v;
+            }
+            else {
+                console.warn(`[data-agent] Dropped invented key "${k}" not in field catalog.`);
+            }
+        }
+        return { ...ds, values: cleaned };
+    }).filter((ds) => Object.keys(ds.values).length > 0);
+}
+/**
+ * Post-parse constraint enforcement for VALID datasets only.
+ * INVALID/EDGE/SECURITY datasets intentionally use out-of-range values to test
+ * validation — do not clamp those. VALID datasets must always satisfy field constraints.
+ *
+ * Rules applied:
+ *   - numeric (integer/decimal/currency) with min/maxValue: clamp to [min, max]
+ *   - enum fields: if generated value not in enumValues, use the first valid option
+ *   - string fields with maxLength: truncate to maxLength
+ */
+function clampConstrainedValues(dataSets, fields) {
+    if (fields.length === 0)
+        return dataSets;
+    const fieldMap = new Map(fields.map(f => [f.fieldKey, f]));
+    return dataSets.map((ds) => {
+        const category = String(ds.category ?? '').toUpperCase();
+        // Only clamp VALID datasets — INVALID/EDGE/SECURITY intentionally violate constraints
+        if (category !== 'VALID')
+            return ds;
+        const values = { ...ds.values };
+        for (const [key, rawVal] of Object.entries(values)) {
+            const field = fieldMap.get(key);
+            if (!field)
+                continue;
+            const val = String(rawVal ?? '');
+            // Numeric clamp for integer, decimal, currency
+            if (field.dataType === 'integer' || field.dataType === 'decimal' || field.dataType === 'currency') {
+                const num = parseFloat(val);
+                if (!isNaN(num)) {
+                    let clamped = num;
+                    if (field.minValue != null && clamped < field.minValue) {
+                        console.warn(`[data-agent] Clamped ${key}=${num} to minValue=${field.minValue} in VALID dataset "${ds.label}"`);
+                        clamped = field.minValue;
+                    }
+                    if (field.maxValue != null && clamped > field.maxValue) {
+                        console.warn(`[data-agent] Clamped ${key}=${num} to maxValue=${field.maxValue} in VALID dataset "${ds.label}"`);
+                        clamped = field.maxValue;
+                    }
+                    if (clamped !== num) {
+                        values[key] = field.dataType === 'integer' ? String(Math.round(clamped)) : String(clamped);
+                    }
+                }
+                continue;
+            }
+            // Enum fix: if value not in allowed options, use first valid option
+            if (field.dataType === 'enum' && field.enumValues && field.enumValues.length > 0) {
+                if (!field.enumValues.includes(val)) {
+                    console.warn(`[data-agent] Fixed enum ${key}="${val}" → "${field.enumValues[0]}" in VALID dataset "${ds.label}"`);
+                    values[key] = field.enumValues[0];
+                }
+                continue;
+            }
+            // String maxLength truncation
+            if (field.maxLength != null && val.length > field.maxLength) {
+                console.warn(`[data-agent] Truncated ${key} from ${val.length} to maxLength=${field.maxLength} in VALID dataset "${ds.label}"`);
+                values[key] = val.slice(0, field.maxLength);
+            }
+        }
+        return { ...ds, values };
+    });
+}
+async function generateTestData(opts) {
+    const testCase = await app_brain_1.AppBrain.getTestCaseWithContext(opts.tenantId, opts.testCaseId);
+    if (!testCase)
+        throw new Error('Test case not found.');
+    const kind = testCase.kind;
+    const groundedOn = testCase.groundedOn;
+    if (SKIP_KINDS.has(kind)) {
+        return { dataSets: [], saved: [], skipped: true, reason: `kind=${kind} does not benefit from parameterized test data` };
+    }
+    // Parallelize all independent DB lookups — saves ~250ms of sequential round-trips
+    const [fields, skillFile, errorCatalogueFile, projectCases, llmCfg] = await Promise.all([
+        app_brain_1.AppBrain.getFieldsForCase(opts.tenantId, opts.projectId, groundedOn),
+        _cachedSkillFile(opts.tenantId, opts.projectId, 'TEST_DATA'),
+        _cachedSkillFile(opts.tenantId, opts.projectId, 'ERROR_CATALOGUE'),
+        app_brain_1.AppBrain.listTestCaseSummaries(opts.tenantId, opts.projectId, 50).catch(() => []),
+        _cachedLLMConfig(opts.tenantId),
+    ]);
+    let dataBearingFields = fields.filter((f) => f.dataBearing);
+    // VOLUME mode: PERFORMANCE/LOAD get data-setup specs, not field:value datasets
+    if (VOLUME_KINDS.has(kind)) {
+        const { system: vsDefault, user: vu } = buildVolumePrompt({ testCase, kind });
+        const vs = await (0, core_1.getAgentPrompt)('data-gen-api', undefined, opts.tenantId).catch(() => null) ?? vsDefault;
+        let volumeDataSets = fallbackDataSets(kind, 'volume', fields);
+        try {
+            const t0v = Date.now();
+            const { text: raw, usage: vUsage } = await (0, llm_config_js_1.tryWithPlatformFallback)(llmCfg, (cfg) => (0, llm_js_1.askTracked)(vs, vu, cfg, 4096, DATA_SETS_SCHEMA, { temperature: 0, seed: (0, llm_js_1.deterministicSeed)(`${opts.tenantId}:${opts.projectId}:${opts.testCaseId}:volume:${kind}`) }));
+            try {
+                const vParsed = extractJson(raw);
+                if (Array.isArray(vParsed.dataSets))
+                    volumeDataSets = vParsed.dataSets;
+            }
+            catch { /* fallback already set */ }
+            (0, app_brain_1.recordLLMCall)({
+                tenantId: opts.tenantId, projectId: opts.projectId, jobId: opts.jobId,
+                agentType: 'data', label: `test_data_volume_${kind}`,
+                entityId: opts.testCaseId, entityType: 'test_data',
+                usage: vUsage, latencyMs: Date.now() - t0v,
+            }).catch(console.error);
+        }
+        catch { /* fallback already set */ }
+        volumeDataSets = normalizeTargetCount(volumeDataSets, opts.targetCount, fallbackDataSets(kind, 'volume', fields));
+        const saved = await app_brain_1.AppBrain.saveTestData(opts.tenantId, opts.projectId, opts.testCaseId, volumeDataSets.map(d => ({ ...d, source: 'generated' })));
+        return { dataSets: volumeDataSets, saved, mode: 'volume', source: 'generated' };
+    }
+    const baseCtx = skillFile?.content ?? '{"domain":"unknown"}';
+    const errorCtx = errorCatalogueFile?.content
+        ? `\n\n## Error Catalogue (use exact error text for INVALID dataset expectedOutcome):\n${errorCatalogueFile.content.slice(0, 800)}`
+        : '';
+    const domainCtx = baseCtx + errorCtx;
+    const inlineData = testCase.testDataInline;
+    const dataNote = testCase.dataNote;
+    const structuredSteps = testCase.structuredSteps;
+    // For imported test cases (groundedOn=[]) that have recorded form field values in testDataInline,
+    // synthesize ephemeral FieldSchema records so FORM mode generates real field:value datasets
+    // instead of falling through to STATE mode (which produces role/precondition data).
+    if (dataBearingFields.length === 0 && inlineData && Object.keys(inlineData).length > 0) {
+        // Metadata-only keys that are not form inputs — skip from field synthesis
+        const SKIP_KEYS = new Set(['customScripts', 'contextSwitches', 'recordedUrls', 'recordedSelections']);
+        // Keys that map to canonical form field names
+        const KEY_RENAME = {
+            recordedUser: 'username',
+            recordedPassword: 'password',
+        };
+        const _fzeDynamicRe = /^\{\{\s*fze\.(random|local)\./i;
+        const _fzeRandomEmailRe = /fze\.randomEmail\s*\(\s*['"]([^'"]+)['"]\s*\)/i;
+        const _fzeRandomTextRe = /fze\.randomText\s*\(\s*(\d+)\s*\)/i;
+        const _fzeRandomPhoneRe = /fze\.randomPhone/i;
+        const _fzeRandomNumberRe = /fze\.randomNumber/i;
+        const _sampleForDynamic = (raw, fieldKey) => {
+            const k = fieldKey.toLowerCase();
+            if (_fzeRandomEmailRe.test(raw)) {
+                const dom = raw.match(_fzeRandomEmailRe)?.[1] ?? 'example.com';
+                const _fn = ['james', 'sarah', 'michael', 'emily', 'david', 'jessica', 'robert', 'linda'][Math.floor(Math.random() * 8)];
+                const _ln = ['smith', 'jones', 'chen', 'wilson', 'taylor', 'brown', 'davis', 'martin'][Math.floor(Math.random() * 8)];
+                return `${_fn}.${_ln}@${dom}`;
+            }
+            if (_fzeRandomPhoneRe.test(raw))
+                return '555-123-4567';
+            if (_fzeRandomNumberRe.test(raw))
+                return '12345';
+            if (_fzeRandomTextRe.test(raw)) {
+                const n = Math.max(1, Number(raw.match(_fzeRandomTextRe)?.[1] ?? 8));
+                if (/first.?name|fname|szfirst/i.test(k))
+                    return 'John'.slice(0, n).padEnd(n > 4 ? n : 4, 'x').slice(0, n);
+                if (/last.?name|lname|surname|szlast/i.test(k))
+                    return 'Smith'.slice(0, n).padEnd(n > 5 ? n : 5, 'h').slice(0, n);
+                if (/name/i.test(k))
+                    return 'Sample'.slice(0, n) || 'Sample';
+                if (/comment|note|message|desc/i.test(k))
+                    return 'Test comment text'.slice(0, n) || 'TestText';
+                if (/city|town/i.test(k))
+                    return 'Springfield'.slice(0, n) || 'City';
+                if (/address|street/i.test(k))
+                    return '123 Main St'.slice(0, n) || 'Address';
+                return 'TestValue'.slice(0, n) || 'TestValue';
+            }
+            return 'SampleValue';
+        };
+        dataBearingFields = Object.entries(inlineData)
+            .filter(([key, v]) => !SKIP_KEYS.has(key) &&
+            !key.startsWith('artifact_') &&
+            !Array.isArray(v) &&
+            v !== null && v !== undefined &&
+            typeof v !== 'object' &&
+            String(v).trim().length > 0 &&
+            String(v).trim() !== '[object Object]' &&
+            String(v).length < 500
+        // fze.random* fields are now INCLUDED — sample values generated below
+        )
+            .map(([key, val]) => {
+            const rawVal = String(val).trim();
+            const fieldKey = KEY_RENAME[key] ?? key;
+            const lower = fieldKey.toLowerCase();
+            const isPassword = lower.includes('password') || lower.includes('pwd') || lower.includes('secret');
+            const isDynamic = _fzeDynamicRe.test(rawVal);
+            const isEmail = lower.includes('email') || /fze\.randomEmail/i.test(rawVal);
+            const exampleValue = isPassword ? 'Test@123!' : isDynamic ? _sampleForDynamic(rawVal, fieldKey) : rawVal;
+            return {
+                fieldKey,
+                label: fieldKey.replace(/([A-Z])/g, ' $1').trim(),
+                elementRole: (isPassword ? 'INPUT_PASSWORD' : isEmail ? 'INPUT_EMAIL' : 'INPUT_TEXT'),
+                dataBearing: true,
+                dataType: (isEmail ? 'email' : 'string'),
+                required: true,
+                piiClass: (isPassword ? 'high' : 'none'),
+                exampleValue,
+            };
+        });
+        // Add URL environment field — use ONLY first URL as the entry point.
+        // recordedUrls contains navigation history (18+ URLs); exposing all as enumValues
+        // causes the LLM to generate URL-scheme variations instead of meaningful data.
+        const recordedUrls = inlineData.recordedUrls;
+        if (Array.isArray(recordedUrls) && recordedUrls.length > 0) {
+            dataBearingFields.push({
+                fieldKey: 'startUrl',
+                label: 'Start URL',
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'url',
+                required: false,
+                piiClass: 'none',
+                exampleValue: recordedUrls[0],
+            });
+        }
+        // Add recorded filter/selection values from UI interactions.
+        // These include dropdown item clicks, date range selections, filter values, etc.
+        const recordedSelections = inlineData.recordedSelections;
+        if (Array.isArray(recordedSelections) && recordedSelections.length > 0) {
+            // Detect date ranges in selections to choose a more accurate label
+            const hasDate = recordedSelections.some(s => /\d{1,2}\/\d{1,2}\/\d{4}/.test(s));
+            const label = hasDate ? 'Date Range / Filter Values' : 'Recorded Filter Selections';
+            dataBearingFields.push({
+                fieldKey: 'selectedFilterValues',
+                label: label,
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'string',
+                required: false,
+                piiClass: 'none',
+                exampleValue: recordedSelections[0],
+                enumValues: recordedSelections.slice(0, 20),
+            });
+        }
+    }
+    // Extract fieldKey: value pairs from the data property of FZE/Functionize step objects.
+    // Steps from imported tests store raw form field bindings as data: "szZip: 10008".
+    // normalizeSteps/stepToText drops the data property when action is present, so we
+    // read raw step objects directly — the old → fieldKey: value regex never matched anything.
+    {
+        const rawSteps = Array.isArray(testCase.steps) ? testCase.steps : [];
+        const existingKeys = new Set(dataBearingFields.map((f) => f.fieldKey));
+        // Track all seen values — catches alias fields with same value (e.g. zipField≈szZip)
+        // even when groundedOn screen fields don't carry recorded exampleValues.
+        const seenValues = new Set(dataBearingFields.map(f => String(f.exampleValue ?? '').trim()).filter(v => v.length > 0 && !/^\{\{\s*fze\.(random|local)\./i.test(v)));
+        const SKIP_FZE_KEYS = new Set([
+            'script', 'customcode', 'customcode_1', 'customcode_2', 'customcode_3',
+            // Functionize recording metadata — not test input data
+            // Note: 'recordedpassword' is intentionally NOT skipped — it reaches the isPassword
+            // branch below which masks the actual value to '[protected]' and includes the field.
+            'recordedurls', 'recordeduser', 'recordedselections',
+            'contextswitches', 'recordedurl', 'recordedselection',
+            // Navigation fields — not form inputs
+            'starturl', 'startUrl', 'navigateurl', 'pageurl',
+        ]);
+        const STEP_DATA_RE = /^([a-zA-Z_][a-zA-Z0-9_]{1,50})\s*:\s*(.+)/;
+        for (const step of rawSteps) {
+            if (typeof step !== 'object' || !step)
+                continue;
+            const dataStr = typeof step.data === 'string' ? step.data.trim() : '';
+            if (!dataStr)
+                continue;
+            const m = dataStr.match(STEP_DATA_RE);
+            if (!m)
+                continue;
+            const rawKey = m[1].trim();
+            const rawVal = m[2].trim();
+            if (SKIP_FZE_KEYS.has(rawKey.toLowerCase()))
+                continue;
+            // Canonical key: strip Hungarian prefix (sz/txt/list...) AND common suffixes (Field/Input/etc.)
+            // so szUsername matches 'username' and firstNameField matches 'szFirstName' (via 'firstname').
+            const _canonKey = rawKey
+                .replace(/^(sz|txt|list|lbl|btn|chk|l|n)(?=[A-Z])/i, '')
+                .replace(/^(.)/, (c) => c.toLowerCase())
+                .replace(/(Field|Input|Select|Dropdown|Button|Text|Value)$/i, '')
+                .toLowerCase();
+            if (existingKeys.has(rawKey) || existingKeys.has(_canonKey))
+                continue;
+            if (rawVal.startsWith('script:'))
+                continue;
+            // FZE multi-select format: "OR|FUNCOPR|Option1|FUNCVAL|Option2|..." — normalize to readable list
+            const isFzeMultiSelect = rawVal.startsWith('OR|FUNCOPR') || rawVal.includes('|FUNCVAL|');
+            const normalizedVal = isFzeMultiSelect ? normalizeFzeMultiSelectValue(rawVal) : rawVal;
+            // FZE dynamic generator: {{fze.randomText(8)}} — extract generator info for LLM guidance
+            const fzeGeneratorMatch = rawVal.match(/^\{\{\s*fze\.(random\w+)\s*\(([^)]*)\)\s*\}\}$/i);
+            if (!isFzeMultiSelect && !fzeGeneratorMatch && /^\{\{\s*fze\.(random|local)\./i.test(rawVal.trim()))
+                continue; // skip other fze.random*/fze.local.* (dynamic); keep fze.env.* (static)
+            const lower = rawKey.toLowerCase();
+            const isPassword = /pass|pwd|secret/.test(lower);
+            const isEmail = /email|mail/.test(lower) || /^[^@]+@[^@]+\.[^@]+$/.test(normalizedVal);
+            const isDate = /date|birthday|dob|birth/.test(lower) || /\d{1,2}\/\d{1,2}\/\d{4}/.test(normalizedVal);
+            const isSsn = /ssn|sin|social/.test(lower);
+            const isZip = /zip|postal|post_?code/.test(lower);
+            const isDynamic = rawVal.startsWith('dynamic');
+            const label = rawKey
+                .replace(/^(sz|txt|list|lbl|btn|chk|l|n)/i, '')
+                .replace(/([A-Z])/g, ' $1')
+                .trim()
+                .replace(/^./, (c) => c.toUpperCase()) || rawKey;
+            // Skip alias fields that carry a value already covered by another field key.
+            if (seenValues.has(normalizedVal))
+                continue;
+            seenValues.add(normalizedVal);
+            // Determine exampleValue: password → [protected], fze generator → [dynamic:fn(args)],
+            // multi-select → normalized human-readable list, dynamic prefix → generic placeholder, else real value.
+            let exampleValue;
+            if (isPassword) {
+                exampleValue = '[protected]';
+            }
+            else if (fzeGeneratorMatch) {
+                const generatorFn = fzeGeneratorMatch[1];
+                const generatorArgs = fzeGeneratorMatch[2].trim();
+                exampleValue = `[dynamic:${generatorFn}(${generatorArgs})]`;
+            }
+            else if (isDynamic) {
+                exampleValue = isEmail ? 'test.user@example.com' : lower.includes('first') ? 'John' : lower.includes('last') ? 'Doe' : 'TestValue';
+            }
+            else {
+                exampleValue = normalizedVal.slice(0, 200);
+            }
+            const isCredentialUsername = /^(user|username|login|email|account)$/i.test(_canonKey);
+            const isCredentialPassword = isPassword;
+            existingKeys.add(rawKey);
+            dataBearingFields.push({
+                fieldKey: rawKey,
+                label,
+                elementRole: (isPassword ? 'INPUT_PASSWORD' : isEmail ? 'INPUT_EMAIL' : isDate ? 'INPUT_DATE' : 'INPUT_TEXT'),
+                dataBearing: true,
+                dataType: (isEmail ? 'email' : isDate ? 'date' : isZip ? 'zip' : 'string'),
+                required: !lower.includes('comment') && !lower.includes('note') && !lower.includes('type'),
+                piiClass: (isPassword || isSsn ? 'high' : isEmail ? 'medium' : 'none'),
+                exampleValue,
+                ...(isCredentialUsername || isCredentialPassword ? { credentialGroup: 'login' } : {}),
+            });
+        }
+    }
+    // Docs-based field inference: when there are no crawled fields AND no inline data recorded,
+    // the test came from a docs/requirements flow. Parse all {{fieldKey}} placeholders from step
+    // text and infer an appropriate data type from the field name — domain-agnostic.
+    if (dataBearingFields.length === 0 && (!inlineData || Object.keys(inlineData).length === 0)) {
+        const rawStepsInf = Array.isArray(testCase.steps) ? testCase.steps : [];
+        const allStepTextInf = rawStepsInf
+            .map((s) => typeof s === 'string' ? s : `${s.action ?? ''} ${s.data ?? ''} ${s.expected ?? ''}`.trim())
+            .join('\n');
+        const inferredKeys = new Set();
+        const placeholderRe = /\{\{([a-zA-Z][a-zA-Z0-9_]{1,39})\}\}/g;
+        let pm;
+        while ((pm = placeholderRe.exec(allStepTextInf)) !== null) {
+            const key = pm[1];
+            if (!inferredKeys.has(key) && !dataBearingFields.some(f => f.fieldKey === key)) {
+                inferredKeys.add(key);
+                const label = key.replace(/([A-Z])/g, ' $1').replace(/^./, c => c.toUpperCase()).trim();
+                dataBearingFields.push({
+                    fieldKey: key,
+                    label,
+                    elementRole: 'INPUT_TEXT',
+                    dataBearing: true,
+                    dataType: inferDataTypeFromFieldKey(key),
+                    required: false,
+                    piiClass: 'none',
+                    exampleValue: '',
+                });
+            }
+        }
+    }
+    // Always extract login user and start URL from preconditions, regardless of whether
+    // FZE fields were found — deduplicate via existingKeys to avoid double-adding.
+    {
+        const precond = String(testCase.preconditions ?? '');
+        const stepTexts = (0, step_utils_js_1.normalizeSteps)(testCase.steps);
+        const allText = [precond, ...stepTexts].join('\n');
+        const existingKeysPrec = new Set(dataBearingFields.map((f) => f.fieldKey));
+        // Extract login user from "Login as: <username>" pattern in preconditions
+        const loginMatch = precond.match(/login as:\s*([^\s;,]+)/i);
+        if (loginMatch?.[1] && !existingKeysPrec.has('username')) {
+            const loginUser = loginMatch[1].trim();
+            const isEnvRef = /^\{\{\s*fze\.env\./i.test(loginUser);
+            existingKeysPrec.add('username');
+            dataBearingFields.push({
+                fieldKey: 'username',
+                label: 'Username',
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'string',
+                required: true,
+                piiClass: 'none',
+                exampleValue: loginUser,
+                isEnvVarReference: isEnvRef,
+            });
+        }
+        // Extract start URL from preconditions "Start URL: <url>" or first navigate step
+        const urlFromPrec = precond.match(/start url:\s*(https?:\/\/[^\s;,]+)/i);
+        const allNavMatches = [...allText.matchAll(/navigate to:\s*(https?:\/\/[^\s\n"']+|\{\{\s*fze\.env\.[^}]+\}\})/gi)];
+        const urlFromStep = allNavMatches[0];
+        const _rawExtractedUrl = urlFromPrec?.[1] ?? urlFromStep?.[1] ?? '';
+        const extractedUrl = /^\{\{\s*fze\.env\./i.test(_rawExtractedUrl) ? _rawExtractedUrl : _rawExtractedUrl.replace(/[.,;)'"\]]+$/, '');
+        if (extractedUrl && !existingKeysPrec.has('startUrl')) {
+            existingKeysPrec.add('startUrl');
+            dataBearingFields.push({
+                fieldKey: 'startUrl',
+                label: 'Start URL',
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'url',
+                required: false,
+                piiClass: 'none',
+                exampleValue: extractedUrl,
+            });
+        }
+        // Extract additional navigation URLs from steps (beyond startUrl).
+        // Captures "Navigate to: https://..." steps that represent distinct app pages visited.
+        function _normalizeNavUrl(url) {
+            if (/^\{\{/.test(url))
+                return url; // env var — don't normalize
+            try {
+                const u = new URL(url);
+                u.pathname = u.pathname.replace(/\/$/, '');
+                const params = [...u.searchParams.entries()].sort(([a], [b]) => a.localeCompare(b));
+                u.search = '';
+                params.forEach(([k, v]) => u.searchParams.append(k, v));
+                return u.toString();
+            }
+            catch {
+                return url;
+            }
+        }
+        function _urlToSemanticKey(url, idx) {
+            if (/^\{\{/.test(url))
+                return `envUrl_${idx}`; // env var ref
+            try {
+                const u = new URL(url);
+                const segments = u.pathname.split('/').filter(Boolean);
+                const lastSeg = segments[segments.length - 1] ?? '';
+                const pageName = lastSeg.replace(/\.(asp|aspx|html|htm|php|jsp|do)$/i, '');
+                if (pageName && pageName.length >= 3 && pageName.length <= 30 && /^[a-zA-Z]/.test(pageName)) {
+                    const camel = pageName.replace(/[-_](.)/g, (_, c) => c.toUpperCase());
+                    return `${camel}Url`;
+                }
+            }
+            catch { /* ignore */ }
+            return `navUrl_${idx}`;
+        }
+        const seenNavUrls = new Set([_normalizeNavUrl(extractedUrl)].filter(Boolean));
+        let navIdx = 2;
+        for (const navMatch of allNavMatches.slice(1)) {
+            const rawNavUrl = navMatch[1] ?? '';
+            const url = /^\{\{\s*fze\.env\./i.test(rawNavUrl) ? rawNavUrl : rawNavUrl.replace(/[.,;)'"\]]+$/, '').trim();
+            if (!url)
+                continue;
+            const normalizedUrl = _normalizeNavUrl(url);
+            if (seenNavUrls.has(normalizedUrl))
+                continue;
+            seenNavUrls.add(normalizedUrl);
+            let fieldKey = _urlToSemanticKey(url, navIdx);
+            // Ensure uniqueness
+            let _uniqueSuffix = 2;
+            while (existingKeysPrec.has(fieldKey)) {
+                fieldKey = `${_urlToSemanticKey(url, navIdx)}_${_uniqueSuffix++}`;
+            }
+            existingKeysPrec.add(fieldKey);
+            dataBearingFields.push({
+                fieldKey,
+                label: `Navigation URL ${navIdx}`,
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'url',
+                required: false,
+                piiClass: 'none',
+                exampleValue: url,
+            });
+            navIdx++;
+            if (navIdx > 6)
+                break; // cap at 5 additional nav URLs to avoid clutter
+        }
+    }
+    // Extract quoted field values from step action/expected text not already covered by testDataInline.
+    // Patterns: Enter "X" in/into Y, Select "X" from/in Y, Type "X" in Y.
+    {
+        const stepTexts = [];
+        const rawSteps = testCase.steps;
+        if (Array.isArray(rawSteps)) {
+            for (const s of rawSteps) {
+                if (s?.action)
+                    stepTexts.push(String(s.action));
+                if (s?.expected)
+                    stepTexts.push(String(s.expected));
+            }
+        }
+        const stepFieldKeys = new Set(dataBearingFields.map(f => f.fieldKey));
+        // Date range: "dd/mm/yyyy - dd/mm/yyyy" or "mm/dd/yyyy - mm/dd/yyyy"
+        const dateRangeRe = /(\d{1,2}\/\d{1,2}\/\d{2,4})\s*[-–to]+\s*(\d{1,2}\/\d{1,2}\/\d{2,4})/;
+        if (!stepFieldKeys.has('dateRange')) {
+            for (const txt of stepTexts) {
+                const m = txt.match(dateRangeRe);
+                if (m) {
+                    stepFieldKeys.add('dateRange');
+                    dataBearingFields.push({
+                        fieldKey: 'dateRange',
+                        label: 'Date Range',
+                        elementRole: 'INPUT_DATE',
+                        dataBearing: true,
+                        dataType: 'date',
+                        required: false,
+                        piiClass: 'none',
+                        exampleValue: `${m[1]} - ${m[2]}`,
+                    });
+                    break;
+                }
+            }
+        }
+        // Quoted field values: Enter/Type "VALUE" in/into/for FIELD_NAME (double and single quotes)
+        const enterRe = /(?:enter|type|input|fill)\s+"([^"]{1,120})"\s+(?:in(?:to)?|for)\s+([^.\n]{2,60})/gi;
+        const enterReSingle = /(?:enter|type|input|fill)\s+'([^']{1,120})'\s+(?:in(?:to)?|for)\s+([^.\n]{2,60})/gi;
+        // Select "VALUE" from/in/for FIELD_NAME (double and single quotes)
+        const selectRe = /(?:select|choose|pick)\s+"([^"]{1,120})"\s+(?:from|in|for)\s+([^.\n]{2,60})/gi;
+        const selectReSingle = /(?:select|choose|pick)\s+'([^']{1,120})'\s+(?:from|in|for)\s+([^.\n]{2,60})/gi;
+        // Random/dynamic placeholders from humanizeFzeToken: [random X-char text], [random email @dom], etc.
+        const HUMANIZED_DYNAMIC_RE = /^\[random\b|^\[dynamic\]|^\[env:/i;
+        // Values already captured from dataBearingFields (AppField catalog) AND from testDataInline directly.
+        // When AppField records exist the inline synthesis block (line ~596) is skipped, so inlineData values
+        // never enter dataBearingFields — include them here so step-text fields don't duplicate inline data.
+        const _inlineConcreteValues = Object.values(inlineData ?? {})
+            .filter((v) => typeof v === 'string' && v.trim().length > 0 && !/^\{\{fze\./i.test(v.trim()) && !HUMANIZED_DYNAMIC_RE.test(v.trim()))
+            .map(v => v.trim());
+        const seenValues = new Set([
+            ...dataBearingFields.map(f => String(f.exampleValue ?? '').trim()).filter(v => v.length > 0),
+            ..._inlineConcreteValues,
+        ]);
+        for (const txt of stepTexts) {
+            for (const re of [enterRe, enterReSingle, selectRe, selectReSingle]) {
+                re.lastIndex = 0;
+                let m;
+                while ((m = re.exec(txt)) !== null) {
+                    const value = m[1].trim();
+                    const rawField = m[2].trim().replace(/[^\w\s]/g, '').trim();
+                    const fieldKey = rawField.replace(/\s+(.)/g, (_, c) => c.toUpperCase()).replace(/^./, (c) => c.toLowerCase()).replace(/\W/g, '').slice(0, 40);
+                    if (!fieldKey || stepFieldKeys.has(fieldKey) || value.length === 0)
+                        continue;
+                    // Skip if the same concrete value already exists under a different field name.
+                    // Prevents szZip=10008 and zipField=10008 from both appearing when both
+                    // testDataInline key and step-text-derived key represent the same field.
+                    if (!HUMANIZED_DYNAMIC_RE.test(value) && seenValues.has(value))
+                        continue;
+                    // Dynamic placeholders become [dynamic] hints — don't use them as example values.
+                    const isDynPlaceholder = HUMANIZED_DYNAMIC_RE.test(value);
+                    stepFieldKeys.add(fieldKey);
+                    seenValues.add(value);
+                    const label = rawField.replace(/^./, (c) => c.toUpperCase());
+                    dataBearingFields.push({
+                        fieldKey,
+                        label,
+                        elementRole: 'INPUT_TEXT',
+                        dataBearing: true,
+                        dataType: 'string',
+                        required: false,
+                        piiClass: 'none',
+                        exampleValue: isDynPlaceholder ? '[dynamic]' : value.slice(0, 200),
+                    });
+                }
+            }
+        }
+        // Second pass: extract expected values from verification/assertion steps
+        const _seenVerifyValues = new Set(dataBearingFields.map(f => String(f.exampleValue ?? '').trim()).filter(v => v.length > 0));
+        const allRawStepsVerify = Array.isArray(testCase.steps) ? testCase.steps : [];
+        for (const step of allRawStepsVerify) {
+            const expected = step?.expected ?? step?.data?.expected ?? '';
+            const action = step?.action ?? step?.description ?? '';
+            if (!expected || typeof expected !== 'string')
+                continue;
+            const expectedTrimmed = expected.trim();
+            if (!expectedTrimmed || expectedTrimmed.length < 2 || expectedTrimmed.length > 300)
+                continue;
+            // Skip FZE expressions
+            if (/^\{\{\s*fze\./i.test(expectedTrimmed))
+                continue;
+            // Skip URLs (already captured as navUrl)
+            if (/^https?:\/\//i.test(expectedTrimmed))
+                continue;
+            // Normalize multi-select raw values instead of skipping — extract human-readable options
+            const _normalizedExpected = (expectedTrimmed.startsWith('OR|FUNCOPR') || expectedTrimmed.includes('|FUNCVAL|'))
+                ? normalizeFzeMultiSelectValue(expectedTrimmed)
+                : expectedTrimmed;
+            // Skip if normalization was a no-op (i.e., the string still looks like raw FZE encoding)
+            if (_normalizedExpected.startsWith('OR|FUNCOPR') || _normalizedExpected.includes('|FUNCVAL|'))
+                continue;
+            // Skip if already captured as a data value
+            if (_seenVerifyValues.has(_normalizedExpected))
+                continue;
+            // Derive a fieldKey from the action type
+            const actionLower = action.toLowerCase();
+            let fieldKey = '';
+            if (/verify.*url|url.*contain/i.test(actionLower)) {
+                fieldKey = 'expectedUrl';
+            }
+            else if (/verify.*text|check.*text/i.test(actionLower)) {
+                const words = action.replace(/[^a-zA-Z ]/g, '').trim().split(/\s+/).slice(2, 5);
+                fieldKey = words.map((w, i) => i === 0 ? w.toLowerCase() : w[0].toUpperCase() + w.slice(1)).join('') + 'Expected';
+            }
+            else {
+                fieldKey = 'verifyExpected';
+            }
+            if (!fieldKey)
+                fieldKey = 'verifyExpected';
+            // Ensure unique key
+            let uniqueKey = fieldKey;
+            let _vIdx = 2;
+            while (stepFieldKeys.has(uniqueKey)) {
+                uniqueKey = `${fieldKey}_${_vIdx++}`;
+            }
+            stepFieldKeys.add(uniqueKey);
+            _seenVerifyValues.add(_normalizedExpected);
+            dataBearingFields.push({
+                fieldKey: uniqueKey,
+                label: `Expected: ${_normalizedExpected.slice(0, 40)}`,
+                elementRole: 'INPUT_TEXT',
+                dataBearing: true,
+                dataType: 'string',
+                required: false,
+                piiClass: 'none',
+                exampleValue: _normalizedExpected,
+            });
+        }
+    }
+    // Extract click targets that may be dynamic (non-static labels like report names, entity names).
+    // Skips generic static labels ("Save", "Cancel", etc.) — only captures substantive click targets.
+    {
+        const stepTextsClick = [];
+        const rawStepsClick = testCase.steps;
+        if (Array.isArray(rawStepsClick)) {
+            for (const s of rawStepsClick) {
+                if (s?.action)
+                    stepTextsClick.push(String(s.action));
+            }
+        }
+        const allClickText = stepTextsClick.join('\n');
+        const clickFieldKeys = new Set(dataBearingFields.map(f => f.fieldKey));
+        const clickSeenValues = new Set(dataBearingFields.map(f => String(f.exampleValue ?? '').trim()).filter(v => v.length > 0));
+        const STATIC_CLICK_TARGETS = new Set([
+            'save', 'cancel', 'close', 'ok', 'yes', 'no', 'submit', 'back', 'next',
+            'continue', 'sign in', 'login', 'logout', 'select', 'add', 'delete',
+            'remove', 'edit', 'update', 'confirm', 'apply', 'reset', 'clear', 'done',
+        ]);
+        const clickPatterns = [
+            /(?:click|tap|press)\s+(?:the\s+)?["']([^"']{2,80})["']/gi,
+            /click\s+(?:button|link|tab|menu)[:\s]+["']([^"']{2,80})["']/gi,
+        ];
+        for (const pattern of clickPatterns) {
+            pattern.lastIndex = 0;
+            let cm;
+            while ((cm = pattern.exec(allClickText)) !== null) {
+                const target = cm[1]?.trim();
+                if (!target || target.length < 2)
+                    continue;
+                if (STATIC_CLICK_TARGETS.has(target.toLowerCase()))
+                    continue;
+                if (/^https?:\/\//.test(target))
+                    continue;
+                if (clickSeenValues.has(target))
+                    continue;
+                const fieldKey = 'clickTarget_' + target.replace(/[^a-zA-Z0-9]/g, '').slice(0, 20);
+                if (clickFieldKeys.has(fieldKey))
+                    continue;
+                clickFieldKeys.add(fieldKey);
+                clickSeenValues.add(target);
+                dataBearingFields.push({
+                    fieldKey,
+                    label: `Click target: ${target}`,
+                    elementRole: 'INPUT_TEXT',
+                    dataBearing: true,
+                    dataType: 'string',
+                    required: false,
+                    piiClass: 'none',
+                    exampleValue: target,
+                });
+            }
+        }
+    }
+    // Remove alias fields from dataBearingFields before they reach the LLM.
+    // Step-text regex loop (above) adds zipField/typeField/commentsField etc. without checking seenValues.
+    // Those alias fields carry the same value as the real DB-backed field (szZip/szType/szComments),
+    // so the LLM would generate both szZip AND zipField in output.
+    {
+        const _dedup = new Set();
+        dataBearingFields = dataBearingFields.filter(f => {
+            const v = String(f.exampleValue ?? '').trim();
+            // Only dedup by value when value is substantial and not fze/dynamic
+            if (!v || v.length >= 300 || /^\{\{\s*fze\./i.test(v) || v.startsWith('dynamic') || v.startsWith('http'))
+                return true;
+            if (_dedup.has(v))
+                return false;
+            _dedup.add(v);
+            return true;
+        });
+    }
+    // Final canonical key dedup pass: remove alias fields where a canonical equivalent already exists.
+    // Handles cases like szFirstName vs firstNameField (both canonicalize to 'firstname') that survive
+    // the value-dedup above because they may carry different exampleValues across extraction passes.
+    // Prefer FZE action keys (sz/txt/list prefix) over generated aliases (Field/Input suffix).
+    {
+        function _getCanonKey(key) {
+            return key
+                .replace(/^(sz|txt|list|lbl|btn|chk|l|n)(?=[A-Z])/i, '')
+                .replace(/^(.)/, (_, c) => c.toLowerCase())
+                .replace(/(Field|Input|Select|Dropdown|Button|Text|Value)$/i, '')
+                .toLowerCase();
+        }
+        const _canonToPreferred = new Map(); // canonical → preferred fieldKey
+        for (const field of dataBearingFields) {
+            const canon = _getCanonKey(field.fieldKey);
+            const existing = _canonToPreferred.get(canon);
+            if (!existing) {
+                _canonToPreferred.set(canon, field.fieldKey);
+            }
+            else {
+                // Prefer FZE action keys (sz/txt/list prefix) over generated aliases
+                const existingIsFze = /^(sz|txt|list|lbl|btn|chk|l|n)[A-Z]/.test(existing);
+                const currentIsFze = /^(sz|txt|list|lbl|btn|chk|l|n)[A-Z]/.test(field.fieldKey);
+                if (currentIsFze && !existingIsFze) {
+                    _canonToPreferred.set(canon, field.fieldKey);
+                }
+            }
+        }
+        dataBearingFields = dataBearingFields.filter(field => {
+            const canon = _getCanonKey(field.fieldKey);
+            return _canonToPreferred.get(canon) === field.fieldKey;
+        });
+    }
+    // Collect actual step-recorded values for deterministic VALID dataset injection.
+    // Like locator extraction — real recorded values, no LLM fabrication needed.
+    // Value-dedup: skip alias fields that carry the same value as a field already added
+    // (e.g. zipField≈szZip, typeField≈szType — same value, different key → drop the alias).
+    const directExtractedValues = {};
+    const _seenDirectValues = new Set();
+    for (const f of dataBearingFields) {
+        const v = String(f.exampleValue ?? '').trim();
+        // Password fields: always include with '[protected]' sentinel — value-dedup skipped since
+        // '[protected]' is not a real value but a masked placeholder that must appear in the row.
+        if (v === '[protected]') {
+            directExtractedValues[f.fieldKey] = '[protected]';
+            continue;
+        }
+        if (v && !v.startsWith('dynamic') && v !== 'Test@123!' && v.length < 300 && !/^\{\{\s*fze\.(random|local)\./i.test(v)) {
+            if (_seenDirectValues.has(v))
+                continue;
+            _seenDirectValues.add(v);
+            directExtractedValues[f.fieldKey] = v;
+        }
+    }
+    const mode = dataBearingFields.length > 0 ? 'form' : 'state';
+    const maxDatasets = contextualMax(dataBearingFields, kind, mode);
+    const screenMarkdown = mode === 'state' && testCase.screenId
+        ? await app_brain_1.AppBrain.getScreenMarkdown(opts.tenantId, testCase.screenId).then((r) => r?.markdownContent ?? undefined).catch(() => undefined)
+        : undefined;
+    const { system: systemDefault, user } = mode === 'form'
+        ? buildFormPrompt({ testCase, domainCtx, fields: dataBearingFields, groundedOn, inlineData, kind, relatedCases: projectCases, maxDatasets, dataNote, structuredSteps })
+        : buildStatePrompt({ testCase, domainCtx, groundedOn, inlineData, kind, relatedCases: projectCases, maxDatasets, dataNote, structuredSteps, screenMarkdown });
+    const dataPromptKey = mode === 'form' ? 'data-gen-values' : 'data-gen-schema';
+    const system = await (0, core_1.getAgentPrompt)(dataPromptKey, undefined, opts.tenantId).catch(() => null) ?? systemDefault;
+    // Include field count in seed — cache misses when extraction improves and more fields found.
+    const _respSeedNum = (0, llm_js_1.deterministicSeed)(`${opts.tenantId}:${opts.projectId}:${opts.testCaseId}:form:${kind}:f${dataBearingFields.length}`);
+    const _respSeedKey = String(_respSeedNum);
+    let dataSets;
+    let source = 'SYNTHETIC';
+    // Check seed-keyed cache — L1 (in-process) then L2 (Redis) — skip LLM call entirely on hit
+    const _cachedRespL1 = _respCacheGet(_respSeedKey);
+    const _cachedRespL2 = _cachedRespL1 ? undefined : await _respCacheGetL2(_respSeedKey);
+    const _cachedResp = _cachedRespL1 ?? _cachedRespL2;
+    if (_cachedResp) {
+        // Warm L1 from Redis hit so next request on this pod is zero-latency
+        if (_cachedRespL2)
+            _respCacheSet(_respSeedKey, _cachedResp);
+        dataSets = _cachedResp;
+    }
+    else {
+        let _rawLlmResponse;
+        try {
+            const t0 = Date.now();
+            const { text: raw, usage } = await (0, llm_config_js_1.tryWithPlatformFallback)(llmCfg, (cfg) => (0, llm_js_1.askTracked)(system, user, cfg, 4096, DATA_SETS_SCHEMA, { temperature: 0, seed: _respSeedNum }));
+            _rawLlmResponse = raw;
+            const latencyMs = Date.now() - t0;
+            const parsed = extractJson(raw);
+            // State mode may return interaction variations instead of datasets
+            if (parsed.interactionOnly && mode === 'form') {
+                throw new Error('LLM returned interactionOnly but mode is form — treating as fallback');
+            }
+            dataSets = (parsed.dataSets ?? []).map((ds) => ({
+                label: ds.label ?? 'Dataset',
+                category: ds.category ?? 'VALID',
+                values: ds.values ?? {},
+                expectedOutcome: ds.expectedOutcome ?? '',
+                ...(ds.gherkinExample ? { gherkinExample: ds.gherkinExample } : {}),
+            }));
+            // Enforce: only allowed fieldKeys in values{}; enforce PII=high synthetic
+            if (mode === 'form') {
+                const allowedKeys = new Set(dataBearingFields.map((f) => f.fieldKey));
+                dataSets = enforceFieldKeys(dataSets, allowedKeys, dataBearingFields);
+                // Post-parse constraint enforcement: clamp numerics, fix enums, truncate strings
+                dataSets = clampConstrainedValues(dataSets, dataBearingFields);
+            }
+            // Reject hedged expected outcomes
+            dataSets = rejectHedgedOutcomes(dataSets);
+            // Warn: static email/username/phone in non-VALID rows (should use DYNAMIC factory)
+            if (mode === 'form') {
+                const EMAIL_USERNAME_STATIC_RE = /["'][a-zA-Z0-9._%+]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}["']/;
+                dataSets = dataSets.map(ds => {
+                    if (ds.label !== 'valid' && ds.label !== 'recorded' && ds.category !== 'VALID') {
+                        const keys = Object.keys(ds.values ?? {}).filter(k => /email|username|phone/i.test(k));
+                        for (const k of keys) {
+                            if (typeof ds.values[k] === 'string' && EMAIL_USERNAME_STATIC_RE.test(JSON.stringify(ds.values[k]))) {
+                                console.warn(`[data-agent] static ${k} in non-valid row "${ds.label}" — should use DYNAMIC factory`);
+                                ds._warnings = [...(ds._warnings ?? []), `static ${k} in non-valid row — use DYNAMIC factory`];
+                            }
+                        }
+                    }
+                    return ds;
+                });
+            }
+            // Canonicalize STATE mode values to consistent formats before intent-scope filtering
+            if (mode === 'state')
+                dataSets = canonicalizeStateValues(dataSets);
+            dataSets = enforceIntentScope(dataSets, testCase, kind, mode);
+            // Guarantee minimum — supplement with fallback if LLM returned fewer than DATA_MIN datasets.
+            // Category-aware: fill MISSING categories first, then fill remaining slots.
+            // IMPORTANT: filter fallback pool through the same intent scope so E2E/positive tests
+            // don't get INVALID rows re-injected after enforceIntentScope already removed them.
+            if (dataSets.length < DATA_MIN) {
+                const rawFallbackPool = fallbackDataSets(kind, mode, dataBearingFields.length > 0 ? dataBearingFields : fields);
+                const fallbackPool = enforceIntentScope(rawFallbackPool, testCase, kind, mode);
+                const existingSigs = new Set(dataSets.map((d) => `${d.category}|${JSON.stringify(d.values)}`));
+                const existingCategories = new Set(dataSets.map((d) => d.category));
+                // Pass 1: fill categories not yet represented (e.g. INVALID missing → add INVALID fallback)
+                for (const fb of fallbackPool) {
+                    if (dataSets.length >= DATA_MIN)
+                        break;
+                    if (!existingCategories.has(fb.category)) {
+                        const sig = `${fb.category}|${JSON.stringify(fb.values)}`;
+                        if (!existingSigs.has(sig)) {
+                            dataSets.push(fb);
+                            existingSigs.add(sig);
+                            existingCategories.add(fb.category);
+                        }
+                    }
+                }
+                // Pass 2: fill remaining slots from any category (still deduped by signature)
+                for (const fb of fallbackPool) {
+                    if (dataSets.length >= DATA_MIN)
+                        break;
+                    const sig = `${fb.category}|${JSON.stringify(fb.values)}`;
+                    if (!existingSigs.has(sig)) {
+                        dataSets.push(fb);
+                        existingSigs.add(sig);
+                    }
+                }
+            }
+            dataSets = normalizeTargetCount(dataSets, opts.targetCount, enforceIntentScope(fallbackDataSets(kind, mode, dataBearingFields.length > 0 ? dataBearingFields : fields), testCase, kind, mode));
+            // Dedup by label AFTER guarantee-min and normalizeTargetCount (those can re-add same labels).
+            // Keep first occurrence of each label.
+            const seenLabels = new Set();
+            dataSets = dataSets.filter(ds => {
+                const l = String(ds.label ?? '').toLowerCase().trim();
+                if (seenLabels.has(l))
+                    return false;
+                seenLabels.add(l);
+                return true;
+            });
+            // Strip fze templates from values, expectedOutcome, and gherkinExample.
+            // Use non-global regex for .test() — global flag causes alternating true/false on repeated calls.
+            const FZE_RE = /\{\{\s*fze\.(random|local)\.[^}]+\}\}/i;
+            const FZE_RE_G = /\{\{\s*fze\.(random|local)\.[^}]+\}\}/gi;
+            dataSets = dataSets.map(ds => ({
+                ...ds,
+                values: ds.values
+                    ? Object.fromEntries(Object.entries(ds.values).filter(([, v]) => !FZE_RE.test(String(v ?? ''))))
+                    : ds.values,
+                expectedOutcome: typeof ds.expectedOutcome === 'string'
+                    ? ds.expectedOutcome.replace(FZE_RE_G, '[dynamic]')
+                    : ds.expectedOutcome,
+                gherkinExample: typeof ds.gherkinExample === 'string'
+                    ? ds.gherkinExample.replace(FZE_RE_G, '[dynamic]')
+                    : ds.gherkinExample,
+            }));
+            _respCacheSet(_respSeedKey, dataSets);
+            _respCacheSetL2(_respSeedKey, dataSets).catch(console.error);
+            (0, app_brain_1.recordLLMCall)({
+                tenantId: opts.tenantId,
+                projectId: opts.projectId,
+                jobId: opts.jobId,
+                agentType: 'data',
+                label: `test_data_${kind}_${mode}`,
+                entityId: opts.testCaseId,
+                entityType: 'test_data',
+                usage,
+                latencyMs,
+            }).catch(console.error);
+        }
+        catch (err) {
+            console.error('[data-agent] LLM call failed, using fallback:', err instanceof Error ? err.message : err);
+            if (_rawLlmResponse)
+                console.error('[data-agent] raw LLM response (first 600):', _rawLlmResponse.slice(0, 600));
+            dataSets = enforceIntentScope(fallbackDataSets(kind, mode, dataBearingFields.length > 0 ? dataBearingFields : fields), testCase, kind, mode);
+            dataSets = normalizeTargetCount(dataSets, opts.targetCount, dataSets);
+            source = 'FALLBACK';
+        }
+    } // end else (cache miss)
+    // Inject step-extracted VALID dataset as first row — ensures actual recorded values
+    // always appear in output, regardless of LLM generation or intent-scope filtering.
+    // This mirrors locator extraction: deterministic, from real test steps, no LLM.
+    if (Object.keys(directExtractedValues).length > 0 && mode === 'form') {
+        const directSig = JSON.stringify(directExtractedValues);
+        const alreadyPresent = dataSets.some(d => d.category === 'VALID' && JSON.stringify(d.values) === directSig);
+        if (!alreadyPresent) {
+            dataSets.unshift({
+                label: 'Recorded from test steps',
+                category: 'VALID',
+                values: directExtractedValues,
+                expectedOutcome: 'All recorded inputs accepted; test flow completes as specified.',
+            });
+        }
+    }
+    // Persist with source tag (fallback rows tagged separately)
+    const saved = await app_brain_1.AppBrain.saveTestData(opts.tenantId, opts.projectId, opts.testCaseId, dataSets.map((ds) => ({ ...ds, source })));
+    // Fix C: For synthetic FORM mode (imported cases — groundedOn empty), link test case to
+    // a shared TestDataSet keyed by field fingerprint so all cases sharing the same field set
+    // reuse one dataset instead of generating duplicate rows.
+    if (mode === 'form' && !groundedOn.length && dataBearingFields.length > 0) {
+        await app_brain_1.AppBrain.linkOrCreateSharedDataSet(opts.tenantId, opts.projectId, opts.testCaseId, dataBearingFields.map((f) => f.fieldKey), dataSets).catch((e) => console.warn('[data-agent] shared dataset link failed:', e?.message));
+    }
+    return { dataSets, saved, mode, source };
+}
+// ─── PERSONA LIBRARY ───────────────────────────────────────────────────────────
+// Real QA teams think in archetypes. Each persona represents a distinct user type
+// a tester would naturally cover. Including these in the prompt produces diverse,
+// realistic datasets instead of random variations of the same value.
+const PERSONAS = [
+    { role: 'Admin', name: 'Sarah Chen', email: 'sarah.chen@{domain}', note: 'Power user with full access' },
+    { role: 'Manager', name: 'James Okafor', email: 'james.okafor@{domain}', note: 'Department head, approver role' },
+    { role: 'Standard User', name: 'Maria Garcia', email: 'maria.garcia@{domain}', note: 'Regular employee, day-to-day tasks' },
+    { role: 'New User', name: 'Tyler Brooks', email: 'tyler.brooks@{domain}', note: 'Onboarded this week, incomplete profile' },
+    { role: 'Read-Only', name: 'Priya Nair', email: 'priya.nair@{domain}', note: 'Viewer only, no write permissions' },
+    { role: 'External Partner', name: 'Luca Ferrari', email: 'luca.ferrari@partner.com', note: 'Third-party contractor with limited scope' },
+];
+function buildPersonaBlock(fields, domainCtx) {
+    const hasEmail = fields.some((f) => f.dataType === 'email');
+    const hasUsername = fields.some((f) => f.fieldKey.toLowerCase().includes('user') || f.fieldKey.toLowerCase().includes('name'));
+    const hasRole = fields.some((f) => f.fieldKey.toLowerCase().includes('role') || f.dataType === 'enum');
+    if (!hasEmail && !hasUsername && !hasRole)
+        return '';
+    // Try to extract domain from domainCtx; fallback to startUrl field if skill file has no URL
+    const domainMatch = domainCtx.match(/https?:\/\/([^/\s"']+)/);
+    const startUrlField = fields.find((f) => f.fieldKey === 'startUrl' && f.exampleValue);
+    const urlFallbackMatch = startUrlField?.exampleValue?.match(/https?:\/\/([^/\s"']+)/);
+    const rawDomain = domainMatch?.[1] ?? urlFallbackMatch?.[1] ?? null;
+    const domain = rawDomain?.replace(/^(staging\.|dev\.|uat\.)/, '') ?? 'company.com';
+    const lines = [
+        'USER ARCHETYPES — derive diverse realistic values from these personas instead of inventing generic test data:',
+        ...PERSONAS.slice(0, 4).map((p) => `  ${p.role}: name="${p.name}", email="${p.email.replace('{domain}', domain)}" — ${p.note}`),
+        'Use these as inspiration — vary the values per dataset to represent different user contexts.',
+    ];
+    return lines.join('\n');
+}
+// ─── FORM MODE ─────────────────────────────────────────────────────────────────
+function buildFormPrompt(opts) {
+    const { testCase, domainCtx, fields, groundedOn, inlineData, kind, relatedCases, maxDatasets, dataNote, structuredSteps } = opts;
+    const fieldKeys = fields.map((f) => f.fieldKey);
+    const hasSecurityTargets = fields.some(allowsSecurityProbe);
+    const system = [
+        'You generate test DATA for a single test case in a QA platform.',
+        '',
+        'OUTPUT FORMAT:',
+        '{ "dataSets": [ { "label": string, "category": "VALID"|"INVALID"|"EDGE"|"SECURITY", "values": { fieldKey: value }, "expectedOutcome": string, "gherkinExample": string } ] }',
+        '',
+        'HARD RULES — follow exactly:',
+        `  1. Keys in "values" MUST be from this exact set: [${fieldKeys.join(', ')}]. Never invent new keys.`,
+        '  2. Every expectedOutcome must be DETERMINISTIC. No hedging: "possibly", "potentially", "may", "might", "should probably", "could" are forbidden.',
+        '  3. For every INVALID dataset, state the exact rule violated and the exact error text the UI shows.',
+        '  4. SECURITY probes (XSS, SQLi, path traversal, template injection) ONLY for fields marked SECURITY below.',
+        `     ${hasSecurityTargets ? 'Security-eligible fields exist — generate SECURITY datasets for them.' : 'NO security-eligible fields — do NOT generate any SECURITY datasets.'}`,
+        '  5. PII-class high fields: use obviously-synthetic values (e.g. "Test User", "0000 0000 0000") — never real-looking SSNs, card numbers, passwords, or healthcare IDs.',
+        '  6. gherkinExample: pipe-delimited Examples row matching the field keys as headers.',
+        '  7. Output valid JSON only. No preamble, no markdown.',
+        '  8. CRITICAL — example values ARE real: The "example:" value shown for each field below is the EXACT real value recorded from the application under test. Your first VALID dataset MUST use every available example value verbatim. NEVER substitute with generic placeholders like "validUser", "testUser", "user@example.com", "example.com", "app.example.com", "test@example.com", "http://example.com", or any invented domain/username. Real values only.',
+        '  9. CRITICAL — this is NOT a suite-level coverage exercise. Generate data ONLY for this one test case. Do not cover sibling scenarios, generic validation cases, empty input, no-results cases, first-use cases, rapid repeated actions, multi-device cases, or security probes unless the TEST CASE title/steps/expected result explicitly ask for that scenario.',
+        ' 10. Field STRATEGY lines are reference material only. Do NOT exhaustively apply every strategy class. Pick only the value classes needed for this test case intent.',
+        ' 11. CROSS-FIELD RULES: When multiple fields are present, ensure values are mutually consistent within each dataset. Examples: if an age field and a credit-card field both exist, all VALID datasets must have age ≥ 18; if a start-date and end-date field exist, end-date must be after start-date in VALID datasets; if a country field and phone field exist, phone format must match country. Violate exactly one cross-field rule per INVALID/EDGE dataset targeting that rule.',
+        ' 12. WIZARD/MULTI-STEP CONTEXT: If this test case is for a specific step in a multi-step wizard or flow, your VALID datasets must assume all prior steps were completed successfully (preconditions met). INVALID datasets must target only validation failures specific to THIS step — do not produce data that would have been rejected in a prior step.',
+        ' 13. BOUNDARY VALUES (BVA): For numeric, date, or length-constrained fields, generate at least one EDGE dataset at a boundary: minimum value, maximum value, one below minimum, or one above maximum. For date fields: earliest valid date, latest valid date. Label boundary datasets with category "EDGE".',
+        ' 14. EQUIVALENCE CLASSES: Group inputs into distinct equivalence classes (e.g. valid range, below-range, above-range, empty, special-chars). Each dataset should represent a different class — not minor variants of the same class.',
+        ' 15. REQUIRED: For any field with type email, username, phone, or password — you MUST include a DYNAMIC entry using a factory function (not a static string). A dataset with a static email/username/phone is only acceptable as the first VALID row (the recorded value). All other rows with email/username/phone MUST use DYNAMIC factory functions. Static emails like "test@example.com" or "user1@test.com" in INVALID/EDGE rows are FORBIDDEN — use dynamic generation.',
+        '',
+        `DOMAIN CONTEXT: ${domainCtx}`,
+        ...(dataNote ? ['', `TEST DESIGNER GUIDANCE (follow precisely — overrides general heuristics):`, dataNote] : []),
+    ].join('\n');
+    // Build pairwise block for ≥3 data-bearing fields
+    const pairwiseBlock = fields.length >= 3 ? buildPairwiseBlock(fields) : '';
+    // Build relation-group cross-field integrity block
+    const relationGroupBlock = buildRelationGroupBlock(fields);
+    const exclusionsBlock = relatedCaseExclusionBlock(testCase, relatedCases, groundedOn);
+    const personaBlock = buildPersonaBlock(fields, domainCtx);
+    const user = [
+        `TEST CASE: ${testCase.title}`,
+        `TEST KIND: ${kind}`,
+        '',
+        'TEST STEPS:',
+        (0, step_utils_js_1.normalizeSteps)(testCase.steps).map((s, i) => `${i + 1}. ${s}`).join('\n'),
+        '',
+        'EXPECTED RESULT:',
+        String(testCase.expectedResult ?? ''),
+        '',
+        ...(exclusionsBlock ? [exclusionsBlock, ''] : []),
+        ...(personaBlock ? [personaBlock, ''] : []),
+        'FIELDS — generate datasets using ONLY these keys with the strategies shown:',
+        buildFieldsBlock(fields),
+        '',
+        `COVERAGE REQUIREMENTS:`,
+        `  1. Be COMPREHENSIVE — generate every distinct scenario a senior QA engineer would test. Minimum ${DATA_MIN} datasets; no artificial upper limit. Cover all meaningful field-value combinations, boundary values, error conditions, and representative personas.`,
+        '  2. Think like a senior QA engineer: What distinct real-world conditions would a human tester try? Use the USER ARCHETYPES above to derive realistic names, emails, and roles — not generic placeholders.',
+        '  3. Each dataset MUST have different values — not minor variants (user1/user2) but genuinely different inputs that test different paths.',
+        '  4. For POSITIVE tests, generate VALID datasets only unless the title or expected result explicitly describes a boundary/edge; do not generate INVALID rows for unrelated negative tests.',
+        `  5. FIELD COVERAGE: Every data-bearing field listed above must appear with a concrete value in at least one dataset. Do not omit form fields that appear in the test steps — they are part of the flow and must be covered.`,
+        ...(hasSecurityTargets ? ['  6. SECURITY: XSS, SQLi, path-traversal for security-eligible fields'] : []),
+        ...(pairwiseBlock ? ['', pairwiseBlock] : []),
+        ...(relationGroupBlock ? ['', relationGroupBlock] : []),
+        '',
+        formKindInstructions(kind),
+        ...(inlineData && Object.keys(inlineData).length > 0 ? (() => {
+            // Strip metadata/artifact keys — not form field values
+            const INLINE_SKIP = new Set(['customScripts', 'contextSwitches', 'recordedUrls', 'recordedSelections', 'recordedUser', 'recordedPassword']);
+            const filtered = Object.fromEntries(Object.entries(inlineData).filter(([k]) => !INLINE_SKIP.has(k) && !k.startsWith('artifact_')));
+            return Object.keys(filtered).length > 0 ? [
+                '',
+                'REAL RECORDED VALUES (these are actual values from the application — use them verbatim in VALID datasets, not as inspiration for invented values):',
+                JSON.stringify(filtered, null, 2),
+            ] : [];
+        })() : []),
+        ...(structuredSteps && structuredSteps.length > 0 ? [
+            '',
+            'RECORDED ACTIONS (machine-readable step breakdown — use "data" values as the authoritative field:value pairs):',
+            structuredSteps.filter((s) => s.data).map((s) => `  ${s.target ?? s.action}: "${s.data}"`).join('\n'),
+        ] : []),
+    ].join('\n');
+    return { system, user };
+}
+function formKindInstructions(kind) {
+    switch (kind) {
+        case 'NEGATIVE':
+            return 'FOCUS: Every INVALID dataset must fail in a distinct way directly related to the test case intent. Include the exact error message shown by the UI in expectedOutcome.';
+        case 'EDGE':
+            return 'FOCUS: Boundary and edge values specific to this test case scenario.';
+        case 'SECURITY':
+            return 'FOCUS: Injection probe datasets only. All SECURITY category. Each expectedOutcome: "Input rejected; no sensitive detail in error response."';
+        case 'ACCESSIBILITY':
+            return 'FOCUS: Datasets that test screen reader / keyboard nav — label presence, empty required fields, aria state.';
+        case 'E2E':
+        case 'INTEGRATION':
+            return 'FOCUS: Cover the FULL recorded flow. Every data-bearing field listed above must appear with a concrete value in at least one dataset. Vary credentials, form inputs, and configuration fields across datasets — do not reduce to only URL/username variations. Each dataset must represent a distinct real-world execution path through the entire flow.';
+        default:
+            return 'FOCUS: Generate diverse datasets that explicitly exercise the behavioral intent described in the TEST CASE title. Avoid generic exhaustive edge cases if they do not match the specific intent.';
+    }
+}
+// ─── VALUE CANONICALIZATION ────────────────────────────────────────────────────
+// Normalizes STATE mode output to consistent formats regardless of how the LLM phrases them.
+// Prevents "ctaPresent: true" (fallback) vs "ctaPresent: present" (LLM) mismatches.
+const STATE_COERCE = {
+    ctaPresent: { 'true': 'present', 'yes': 'present', '1': 'present', 'false': 'absent', 'no': 'absent', '0': 'absent', 'missing': 'absent' },
+    imagesLoadStatus: { 'true': 'allLoaded', 'loaded': 'allLoaded', 'all': 'allLoaded', 'false': 'none', 'failed': 'none', 'broken': 'none', 'error': 'none' },
+    contentState: { 'true': 'published', 'complete': 'published', 'full': 'published', 'available': 'published', 'false': 'missing', 'unavailable': 'missing', 'down': 'missing', 'error': 'missing' },
+    sectionsReadable: { 'true': 'allReadable', 'all': 'allReadable', 'false': 'none', 'unreadable': 'none', 'broken': 'none' },
+};
+function canonicalizeStateValues(dataSets) {
+    return dataSets.map((ds) => {
+        const values = { ...ds.values };
+        for (const [key, coerceMap] of Object.entries(STATE_COERCE)) {
+            if (key in values) {
+                const raw = String(values[key]).toLowerCase().trim();
+                if (coerceMap[raw])
+                    values[key] = coerceMap[raw];
+            }
+        }
+        return { ...ds, values };
+    });
+}
+// ─── STATE MODE ────────────────────────────────────────────────────────────────
+/**
+ * Extracts concrete values from test steps + FZE inline data without an LLM call.
+ * Surfaces URLs, dates, quoted labels, and recorded selections so the STATE mode
+ * LLM can use actual values instead of abstract keys like `filtersApplied: true`.
+ */
+function extractConcreteContext(steps, inlineData) {
+    const lines = [];
+    const INLINE_SKIP = new Set(['customScripts', 'contextSwitches', 'recordedUrls', 'recordedSelections', 'recordedUser', 'recordedPassword']);
+    if (inlineData) {
+        const recordedUrls = inlineData.recordedUrls;
+        if (Array.isArray(recordedUrls) && recordedUrls.length > 0) {
+            lines.push(`  startUrl: "${recordedUrls[0]}"`);
+            if (recordedUrls.length > 1)
+                lines.push(`  additionalUrls: [${recordedUrls.slice(1, 4).map(u => `"${u}"`).join(', ')}]`);
+        }
+        const recordedUser = inlineData.recordedUser;
+        if (recordedUser)
+            lines.push(`  loginAs: "${recordedUser}"`);
+        const recordedSelections = inlineData.recordedSelections;
+        if (Array.isArray(recordedSelections) && recordedSelections.length > 0) {
+            lines.push(`  selectedValues: [${recordedSelections.slice(0, 8).map(s => `"${s}"`).join(', ')}]`);
+        }
+        for (const [k, v] of Object.entries(inlineData)) {
+            if (!INLINE_SKIP.has(k) && !Array.isArray(v) && v !== null && typeof v !== 'object' && String(v).trim().length > 0 && String(v).trim() !== '[object Object]' && String(v).length < 100) {
+                lines.push(`  ${k}: "${v}"`);
+            }
+        }
+    }
+    const stepText = steps.join('\n');
+    // URLs from step text (dedupe, cap at 3)
+    const urlMatches = [...new Set([...stepText.matchAll(/https?:\/\/[^\s"'<>)]+/g)].map(m => m[0].replace(/[.,;)]+$/, '')))].slice(0, 3);
+    if (urlMatches.length > 0 && !lines.some(l => l.startsWith('  startUrl'))) {
+        lines.push(`  startUrl: "${urlMatches[0]}"`);
+        if (urlMatches.length > 1)
+            lines.push(`  additionalUrls: [${urlMatches.slice(1).map(u => `"${u}"`).join(', ')}]`);
+    }
+    // Date ranges and standalone dates
+    const rangeMatch = stepText.match(/(\d{1,2}\/\d{1,2}\/\d{4})\s*[-–]\s*(\d{1,2}\/\d{1,2}\/\d{4})/);
+    if (rangeMatch)
+        lines.push(`  dateRange: "${rangeMatch[0]}"`);
+    const dateMatches = [...new Set([
+            ...[...stepText.matchAll(/\d{1,2}\/\d{1,2}\/\d{4}/g)].map(m => m[0]),
+            ...[...stepText.matchAll(/\d{4}-\d{2}-\d{2}/g)].map(m => m[0]),
+        ])].slice(0, 6);
+    if (dateMatches.length > 0)
+        lines.push(`  datesInTest: [${dateMatches.map(d => `"${d}"`).join(', ')}]`);
+    // Quoted label strings from assertions/steps — double-quoted AND single-quoted (skip URLs and scripts)
+    const quotedVals = [...new Set([
+            ...[...stepText.matchAll(/"([^"]{2,80})"/g)].map(m => m[1]),
+            ...[...stepText.matchAll(/'([^']{2,80})'/g)].map(m => m[1]),
+        ].filter(s => !/^https?:/.test(s) && !/^script:/.test(s) && !/^locator:/.test(s)))].slice(0, DATA_LIMIT);
+    if (quotedVals.length > 0)
+        lines.push(`  namedValues: [${quotedVals.map(v => `"${v}"`).join(', ')}]`);
+    // Verification targets — extract what each step ASSERTS must be present or correct.
+    // "Verify that the primary heading 'X' is displayed" → expectedHeading: "X"
+    // "Check that X is displayed" / "Ensure X is present" / "Confirm X" → verificationTarget
+    const verifyPatterns = [
+        [/(?:verify|check|confirm|validate|assert)\s+that\s+the\s+([\w\s]{3,50}?)\s+'([^']{2,80})'\s+is\s+(?:displayed|visible|present|shown)/gi, 'expectedContent'],
+        [/(?:verify|check|confirm|validate)\s+that\s+the\s+([\w\s-]{3,50}?)\s+(?:is\s+)?(?:displayed|visible|present|shown)/gi, 'verifiedElement'],
+        [/(?:ensure|check)\s+([\w\s-]{3,50}?)\s+(?:load|display|appear|contain|show)\s/gi, 'checkedElement'],
+    ];
+    const verifyHints = [];
+    for (const [pat, hint] of verifyPatterns) {
+        for (const m of stepText.matchAll(pat)) {
+            const val = m[2] ?? m[1];
+            if (val && val.length >= 3 && val.length <= 80) {
+                verifyHints.push(`  ${hint}: "${val.trim()}"`);
+                if (verifyHints.length >= 4)
+                    break;
+            }
+        }
+        if (verifyHints.length >= 4)
+            break;
+    }
+    if (verifyHints.length > 0) {
+        lines.push(...[...new Set(verifyHints)].slice(0, 4));
+    }
+    // CTA redirect destination — passive redirect only (avoid matching "Navigate to URL" action steps)
+    // Patterns require explicit passive form: "redirected to X", "taken to X", "lands on X"
+    // NOT: "Navigate to X" (that's an action step, not a destination description)
+    const redirectPatterns = [
+        /→\s*(?:user\s+is\s+)?(?:redirected|taken)\s+to\s+(?:the\s+)?([^.;\n]{3,60}?)(?:\s*[.;]|\s*$)/im,
+        /(?:user\s+(?:is|gets?|was))\s+(?:redirected|taken)\s+to\s+(?:the\s+)?([^.;\n]{3,60}?)(?:\s*[.;]|\s*$)/im,
+        /(?:lands?\s+on|arrives?\s+(?:at|on))\s+(?:the\s+)?([^.;\n]{3,60}?)(?:\s*[.;]|\s*$)/im,
+    ];
+    for (const pat of redirectPatterns) {
+        const m = stepText.match(pat);
+        if (m?.[1]) {
+            const dest = m[1].trim();
+            // Reject if captured value looks like a URL (those belong in startUrl, not ctaDestination)
+            if (dest.length >= 3 && dest.length <= 60 && !/^https?:\/\//.test(dest)) {
+                lines.push(`  ctaDestination: "${dest}"`);
+                break;
+            }
+        }
+    }
+    // Mobile / responsive check detection — signals LLM to note responsive outcome
+    const hasMobileStep = /(?:test|verify|check|ensure|validate)\s+(?:the\s+)?(?:mobile|responsive(?:ness)?|(?:mobile\s+)?layout)/i.test(stepText);
+    if (hasMobileStep)
+        lines.push(`  hasResponsiveCheck: "true"`);
+    if (lines.length === 0)
+        return '';
+    return [
+        'CONCRETE VALUES FROM TEST STEPS (use these in dataset values — prefer real values over abstract keys):',
+        ...lines,
+        '  → Include startUrl in ALL datasets (VALID, INVALID, EDGE) — the URL under test is constant; only the page STATE varies.',
+        '  → Use dateRange / datesInTest for date-parameterized datasets.',
+        '  → Use namedValues / selectedValues for filter/selection-parameterized datasets.',
+        '  → Use expectedContent / verifiedElement values as dataset field values (e.g. expectedHeading: "Process Line Automation").',
+        '  → If ctaDestination is present, include it as a field in VALID/EDGE datasets (absent in INVALID — page is down).',
+        '  → If hasResponsiveCheck is "true", mention mobile layout check result in expectedOutcome (pass/degraded/not reached).',
+    ].join('\n');
+}
+function buildStatePrompt(opts) {
+    const { testCase, domainCtx, groundedOn, inlineData, kind, relatedCases, maxDatasets, dataNote, structuredSteps, screenMarkdown } = opts;
+    const concreteBlock = extractConcreteContext((0, step_utils_js_1.normalizeSteps)(testCase.steps), inlineData);
+    const exclusionsBlock = relatedCaseExclusionBlock(testCase, relatedCases, groundedOn);
+    const system = [
+        'You generate test DATA for an INTERACTION-BASED test case (button clicks, toggles, links — no form inputs).',
+        '',
+        'Do NOT generate field:value input data. Generate PRECONDITION STATE datasets.',
+        'A precondition dataset describes conditions that MUST be true BEFORE the action.',
+        '',
+        'OUTPUT FORMAT:',
+        '{ "dataSets": [ { "label": string, "category": "VALID"|"INVALID"|"EDGE", "values": { conditionName: value }, "expectedOutcome": string } ] }',
+        '',
+        'HARD RULES:',
+        '  1. Keys in "values" describe preconditions derived from the test steps — NOT invented from thin air. Never invent fields like deviceType, networkSpeed, cacheState, browserType, viewport — those are Playwright config, not precondition data.',
+        '     GOOD keys: pageStatus (200/503/404), contentState (published/draft/missing), userRole (admin/viewer), sessionState (active/expired)',
+        '     BAD keys: deviceType, networkSpeed, cacheState, maintenanceMode (unless the test steps explicitly mention these)',
+        '  2. Prefer CONCRETE values over abstract booleans — use actual URLs, dates, filter names, usernames extracted from the CONCRETE VALUES block. Never use "app.example.com", "example.com", "validUser", or any invented placeholder — use only values that appear in the test steps or CONCRETE VALUES block.',
+        '     BAD: { filtersApplied: true }  GOOD: { dateRange: "02/01/2025 - 02/13/2025", department: "All" }',
+        '     BAD: { hasUrl: true }          GOOD: { startUrl: "https://stagingnext.acme.com/login" }  ← use the ACTUAL URL from test steps',
+        '  3. Every expectedOutcome must be DETERMINISTIC. No hedging words.',
+        '  4. Do NOT generate SECURITY datasets — there is no user input surface to inject into.',
+        '  5. category VALID = preconditions that allow the action to succeed.',
+        '     category INVALID = preconditions that block the action (wrong role, wrong state, etc.).',
+        '     category EDGE = boundary preconditions (first use, last allowed, concurrent session).',
+        '  6. Output valid JSON only. No preamble.',
+        '',
+        `DOMAIN CONTEXT: ${domainCtx}`,
+        ...(dataNote ? ['', `TEST DESIGNER GUIDANCE (follow precisely — overrides general heuristics):`, dataNote] : []),
+    ].join('\n');
+    const user = [
+        `TEST CASE: ${testCase.title}`,
+        `TEST KIND: ${kind}`,
+        '',
+        'TEST STEPS:',
+        (0, step_utils_js_1.normalizeSteps)(testCase.steps).map((s, i) => `${i + 1}. ${s}`).join('\n'),
+        '',
+        'EXPECTED RESULT:',
+        String(testCase.expectedResult ?? ''),
+        '',
+        ...(exclusionsBlock ? [exclusionsBlock, ''] : []),
+        ...(concreteBlock ? [concreteBlock, ''] : []),
+        ...(structuredSteps && structuredSteps.length > 0 ? [
+            '',
+            'RECORDED ACTIONS (machine-readable step breakdown — use "data" values as the authoritative field:value pairs):',
+            structuredSteps.filter((s) => s.data).map((s) => `  ${s.target ?? s.action}: "${s.data}"`).join('\n'),
+        ] : []),
+        ...(screenMarkdown ? ['', 'PAGE STRUCTURE (use section/landmark names to anchor precondition keys to real page context):', screenMarkdown.slice(0, 4000), ''] : []),
+        'INTERACTED ELEMENTS (derive precondition context from these):',
+        groundedOn.map((g) => `  - ${g}`).join('\n'),
+        '',
+        `DATASET SCOPE: Be COMPREHENSIVE — generate every distinct precondition state a senior QA engineer would test. Minimum ${DATA_MIN}; no artificial upper limit.\nMANDATORY COVERAGE: You MUST output at least ONE dataset for EACH category: VALID, INVALID, and EDGE. Do NOT output two VALID datasets without also including both INVALID and EDGE — incomplete category coverage is a generation failure.\nInclude: different application/content states, user roles, permission levels, entity states (active/inactive/draft/published). Each dataset must have genuinely different precondition values.\nCRITICAL — DO NOT include network speed, device type, browser type, cache warmth, or viewport size as dataset values — those are Playwright/browser LAUNCH CONFIG, not test data. Only include conditions that the application itself can be in (e.g. page returns 200 vs 503, content present vs missing, user role, session state).`,
+        '',
+        stateKindInstructions(kind),
+    ].join('\n');
+    return { system, user };
+}
+function stateKindInstructions(kind) {
+    switch (kind) {
+        case 'STATE_TRANSITION':
+            return 'FOCUS: Every valid state the entity can be in before the action. Include invalid transitions from terminal states.';
+        case 'NEGATIVE':
+            return 'FOCUS: Preconditions that BLOCK the action — wrong role, insufficient permissions, wrong entity state, locked/throttled.';
+        case 'ACCESSIBILITY':
+            return 'FOCUS: Assistive-technology state — keyboard focus position, screen reader mode, high-contrast, zoom level.';
+        case 'SECURITY':
+            return 'FOCUS: Auth/authorization preconditions — unauthenticated, wrong tenant, expired session, insufficient role.';
+        case 'SMOKE':
+        case 'SANITY':
+        case 'REGRESSION':
+            return `FOCUS: Page/feature availability states. Generate EXACTLY one dataset per category — all three are REQUIRED:\n  (1) VALID:   pageStatus="200", contentState="published", ctaPresent="present", imagesLoadStatus="allLoaded" — page loads fully, all steps pass.\n  (2) INVALID: pageStatus="503" or "404", contentState="missing", ctaPresent="absent", imagesLoadStatus="none" — page unavailable, test fails at step 1.\n  (3) EDGE:    pageStatus="200", contentState="partial", ctaPresent="absent", imagesLoadStatus="partial" — page accessible (200) but degraded: some images broken, CTA missing.\nADDITIONAL KEYS:\n  - startUrl (from CONCRETE VALUES block) in EVERY dataset — URL is constant, only state varies.\n  - sectionsReadable="allReadable" (VALID), "partial" (EDGE), "none" (INVALID) — only if steps verify sections.\n  - expectedHeading="<exact text>" — VALID/EDGE only (page is up, heading is rendered); OMIT from INVALID (page returns 503/404, heading is never rendered).\n  - ctaDestination="<destination name>" — VALID/EDGE only if CONCRETE VALUES has ctaDestination; OMIT from INVALID. Value must be the INTERFACE/PAGE NAME (e.g. "contact or enquiry interface"), NOT a URL.\n  - In expectedOutcome: if CONCRETE VALUES has hasResponsiveCheck="true", VALID outcome must include "mobile responsive layout passes"; EDGE outcome must include "mobile layout may be affected"; INVALID outcome must include "mobile check not reached — page unavailable".\nKEY NAMES: pageStatus, contentState, ctaPresent, imagesLoadStatus, startUrl — NOT deviceType/networkSpeed/browserType/viewport.\nVALUE FORMAT: pageStatus="200"|"503"|"404"; contentState="published"|"partial"|"missing"; ctaPresent="present"|"absent"; imagesLoadStatus="allLoaded"|"partial"|"none"; sectionsReadable="allReadable"|"partial"|"none".\nDo NOT invent values — use only values from CONCRETE VALUES block or the canonical formats listed above.`;
+        default:
+            return 'Precondition datasets: normal app state (VALID), blocked/error state (INVALID), boundary edge state — first use, recently-deleted entity, concurrent modification. Do NOT use network speed or device type.';
+    }
+}
+// ─── Fallbacks (returned ALONE, never concatenated with generated data) ─────────
+function fallbackDataSets(kind, mode, fields) {
+    if (mode === 'state') {
+        // Auth precondition states are only relevant for security/negative test kinds
+        if (kind === 'SECURITY' || kind === 'NEGATIVE') {
+            return [
+                { label: 'Authenticated admin — normal state', category: 'VALID', values: { userRole: 'admin', authStatus: 'authenticated', initialState: 'active' }, expectedOutcome: 'Action completes successfully.' },
+                { label: 'Unauthenticated — no session', category: 'INVALID', values: { userRole: 'none', authStatus: 'unauthenticated', initialState: 'none' }, expectedOutcome: 'Redirect to /login.' },
+                { label: 'Insufficient permissions', category: 'INVALID', values: { userRole: 'viewer', authStatus: 'authenticated', initialState: 'active' }, expectedOutcome: 'Action blocked; permission error displayed.' },
+                { label: 'Expired session', category: 'EDGE', values: { userRole: 'admin', authStatus: 'session-expired', initialState: 'active' }, expectedOutcome: 'Session refresh prompt shown.' },
+            ];
+        }
+        // Page/feature availability states for smoke, positive, accessibility, edge, etc.
+        // Values use the same format as the AI prompt instructs: present/absent, published/missing/partial
+        return [
+            { label: 'Page accessible — all content present', category: 'VALID', values: { pageStatus: '200', contentState: 'published', ctaPresent: 'present' }, expectedOutcome: 'Page loads with all expected sections, images, and CTA functional.' },
+            { label: 'Page unavailable — server error', category: 'INVALID', values: { pageStatus: '503', contentState: 'missing', ctaPresent: 'absent' }, expectedOutcome: 'Error page or maintenance notice displayed; no test steps complete.' },
+            { label: 'Page accessible — CTA missing', category: 'EDGE', values: { pageStatus: '200', contentState: 'partial', ctaPresent: 'absent' }, expectedOutcome: 'Steps 1–7 pass but step 8 (click CTA) fails — CTA element not found.' },
+        ];
+    }
+    if (mode === 'volume') {
+        return [
+            { label: 'Baseline Volume', category: 'VOLUME', values: { users: '10', rampUp: '1m', duration: '5m' }, expectedOutcome: 'System maintains <500ms p95 latency.' },
+            { label: 'Peak Load', category: 'VOLUME', values: { users: '100', rampUp: '2m', duration: '10m' }, expectedOutcome: 'System maintains <2s p95 latency; 0% errors.' },
+        ];
+    }
+    // Form mode fallback — use real field keys if available, else a safe placeholder
+    const firstField = fields.find((f) => f.dataBearing);
+    const key = firstField?.fieldKey ?? 'field';
+    const exampleValid = firstField?.exampleValue ?? 'valid-value';
+    if (kind === 'NEGATIVE') {
+        return [
+            { label: 'Empty required field', category: 'INVALID', values: { [key]: '' }, expectedOutcome: `Validation error: ${key} is required.` },
+            { label: 'Exceeds max length', category: 'INVALID', values: { [key]: 'a'.repeat((firstField?.maxLength ?? 255) + 1) }, expectedOutcome: `Validation error: ${key} exceeds maximum length.` },
+        ];
+    }
+    if (kind === 'SECURITY') {
+        return [
+            { label: 'SQL injection probe', category: 'SECURITY', values: { [key]: "' OR 1=1 --" }, expectedOutcome: 'Input sanitized; no SQL error detail in response.' },
+            { label: 'XSS probe', category: 'SECURITY', values: { [key]: '<script>alert(1)</script>' }, expectedOutcome: 'Script tag escaped or rejected; no script executed.' },
+        ];
+    }
+    // Build multi-field VALID + INVALID + EDGE using all data-bearing fields.
+    const allDataFields = fields.filter(f => f.dataBearing && f.exampleValue);
+    if (allDataFields.length > 0) {
+        const validVals = {};
+        const invalidVals = {};
+        const edgeVals = {};
+        for (const f of allDataFields) {
+            const v = String(f.exampleValue ?? '').trim();
+            validVals[f.fieldKey] = v;
+            const isEmail = f.dataType === 'email' || /email|address/.test(f.fieldKey.toLowerCase());
+            const isPassword = f.piiClass === 'high';
+            invalidVals[f.fieldKey] = isEmail ? 'not-an-email' : isPassword ? 'wrongpassword' : '';
+            edgeVals[f.fieldKey] = v.length > 2 ? v.slice(0, 1) : `${v}_e`;
+        }
+        return [
+            { label: 'Valid recorded inputs', category: 'VALID', values: validVals, expectedOutcome: 'All inputs accepted; user proceeds to next step.' },
+            { label: 'Invalid / empty required fields', category: 'INVALID', values: invalidVals, expectedOutcome: 'Validation errors displayed; form submission blocked.' },
+            { label: 'Boundary value inputs', category: 'EDGE', values: edgeVals, expectedOutcome: 'System handles minimal inputs; validation may be triggered.' },
+        ];
+    }
+    return [
+        { label: 'Valid standard input', category: 'VALID', values: { [key]: exampleValid }, expectedOutcome: 'Input accepted; user proceeds to next step.' },
+        { label: 'Invalid input', category: 'INVALID', values: { [key]: '' }, expectedOutcome: 'Validation error displayed; field is required.' },
+        { label: 'Boundary value', category: 'EDGE', values: { [key]: 'a' }, expectedOutcome: 'System handles minimal input without error.' },
+    ];
+}
+// ─── VOLUME MODE (PERFORMANCE / LOAD) ───────────────────────────────────────
+function buildVolumePrompt(opts) {
+    const { testCase, kind } = opts;
+    const system = [
+        'You generate DATA-VOLUME SPECIFICATIONS for a performance/load test case in a QA platform.',
+        '',
+        'Do NOT generate field:value input datasets. Generate data-setup profiles (row counts, distribution, concurrency).',
+        '',
+        'OUTPUT FORMAT:',
+        '{ "dataSets": [ { "label": string, "category": "VOLUME", "values": { param: value }, "expectedOutcome": string } ] }',
+        '',
+        'HARD RULES:',
+        '  1. Each dataset = one volume/concurrency profile.',
+        '  2. Include: rowCount, concurrentUsers, requestsPerSecond, dataSeedStrategy, warmupSeconds, durationSeconds.',
+        '  3. Generate at least 3 profiles: baseline (normal load), peak (expected max), stress (beyond expected max).',
+        '  4. expectedOutcome: measurable assertion (e.g. "p95 response time < 500ms; no 5xx errors").',
+        '  5. Output valid JSON only. No preamble.',
+    ].join('\n');
+    const user = [
+        `TEST CASE: ${testCase.title}`,
+        `TEST KIND: ${kind}`,
+        '',
+        'TEST STEPS:',
+        (0, step_utils_js_1.normalizeSteps)(testCase.steps).map((s, i) => `${i + 1}. ${s}`).join('\n'),
+        '',
+        'EXPECTED RESULT:',
+        String(testCase.expectedResult ?? ''),
+        '',
+        'Generate 3 volume profiles: baseline, peak, stress.',
+    ].join('\n');
+    return { system, user };
+}
+// ─── BATCH TEST DATA GENERATION ─────────────────────────────────────────────────
+// JSON schema for batch mode — top-level object keyed by case_0, case_1, etc.
+const BATCH_DATA_SCHEMA = {
+    type: 'object',
+    additionalProperties: {
+        type: 'object',
+        properties: {
+            dataSets: {
+                type: 'array',
+                items: {
+                    type: 'object',
+                    properties: {
+                        label: { type: 'string' },
+                        category: { type: 'string', enum: ['VALID', 'INVALID', 'EDGE', 'SECURITY'] },
+                        values: { type: 'object', additionalProperties: { type: 'string' } },
+                        expectedOutcome: { type: 'string' },
+                        gherkinExample: { type: 'string' },
+                    },
+                    required: ['label', 'category', 'values', 'expectedOutcome'],
+                },
+            },
+        },
+        required: ['dataSets'],
+    },
+};
+/**
+ * Robustly extracts a JSON object keyed by case_N from LLM batch output.
+ * Mirrors extractJson() but anchors on "case_0" instead of "dataSets".
+ */
+function extractBatchJson(raw) {
+    let slice = null;
+    // Strategy 1: anchor on "case_0" key — the first batch key we expect
+    const caseIdx = raw.indexOf('"case_0"');
+    if (caseIdx !== -1) {
+        let start = caseIdx;
+        while (start > 0 && raw[start] !== '{')
+            start--;
+        const end = raw.lastIndexOf('}');
+        if (start >= 0 && end > start)
+            slice = raw.slice(start, end + 1);
+    }
+    // Strategy 2: strip markdown fences, find outermost { }
+    if (!slice) {
+        const stripped = raw.replace(/```[a-zA-Z]*\n?/g, '').trim();
+        const j = stripped.indexOf('{');
+        const je = stripped.lastIndexOf('}');
+        if (j !== -1 && je !== -1)
+            slice = stripped.slice(j, je + 1);
+    }
+    if (!slice)
+        throw new Error('No JSON object found in batch LLM response');
+    try {
+        return JSON.parse(slice);
+    }
+    catch {
+        let clean = '';
+        let inStr = false;
+        for (let i = 0; i < slice.length; i++) {
+            const c = slice[i];
+            if (c === '\\' && inStr) {
+                clean += c + slice[++i];
+                continue;
+            }
+            if (c === '"') {
+                inStr = !inStr;
+                clean += c;
+                continue;
+            }
+            if (inStr) {
+                if (c === '\n') {
+                    clean += '\\n';
+                    continue;
+                }
+                if (c === '\r') {
+                    clean += '\\r';
+                    continue;
+                }
+                if (c === '\t') {
+                    clean += '\\t';
+                    continue;
+                }
+            }
+            clean += c;
+        }
+        return JSON.parse(clean);
+    }
+}
+/**
+ * Generates test data for up to 5 test cases in a single LLM call.
+ *
+ * Caller is responsible for chunking: pass batches of up to 5 cases.
+ * Returns a Map keyed by the original case id, value is the dataSets array
+ * using the same per-dataset shape as generateTestData().
+ *
+ * Cases that the LLM omits from its response are absent from the returned Map
+ * (caller should fall back to generateTestData() for those).
+ */
+async function generateTestDataBatch(cases, options = {}) {
+    if (cases.length === 0)
+        return new Map();
+    const llmCfg = options.llmCfg ?? (options.tenantId
+        ? await _cachedLLMConfig(options.tenantId)
+        : undefined);
+    let domainCtx = options.skillFile ?? '{"domain":"unknown"}';
+    if (options.tenantId && options.projectId) {
+        const errFile = await _cachedSkillFile(options.tenantId, options.projectId, 'ERROR_CATALOGUE');
+        if (errFile?.content) {
+            domainCtx += `\n\n## Error Catalogue:\n${errFile.content.slice(0, 600)}`;
+        }
+    }
+    const BATCH_SYSTEM_DEFAULT = [
+        'You generate test DATA for multiple test cases in a QA platform.',
+        '',
+        'OUTPUT FORMAT — a single JSON object with one key per test case:',
+        '{',
+        '  "case_0": { "dataSets": [ { "label": string, "category": "VALID"|"INVALID"|"EDGE"|"SECURITY", "values": { fieldKey: value }, "expectedOutcome": string } ] },',
+        '  "case_1": { "dataSets": [ ... ] },',
+        '  ...',
+        '}',
+        '',
+        'HARD RULES — follow exactly:',
+        '  1. Return EXACTLY one top-level key per input case (case_0, case_1, …). Never omit a case.',
+        '  2. Every expectedOutcome must be DETERMINISTIC. No hedging: "possibly", "potentially", "may", "might", "should probably", "could" are forbidden.',
+        '  3. For every INVALID dataset, state the exact rule violated and the exact error text the UI shows.',
+        '  4. Each case\'s "values" keys must reflect the field inputs described in that case\'s steps.',
+        '  5. Generate 2–8 datasets per case. Each must represent a meaningfully different scenario.',
+        '  6. Output valid JSON only. No preamble, no markdown, no trailing commas.',
+        '',
+        `DOMAIN CONTEXT: ${domainCtx}`,
+    ].join('\n');
+    const system = await (0, core_1.getAgentPrompt)('data-gen-sql', undefined, options.tenantId).catch(() => null)
+        ?? BATCH_SYSTEM_DEFAULT;
+    const caseBlocks = cases.map((tc, i) => {
+        const steps = (0, step_utils_js_1.normalizeSteps)(tc.steps).map((s, si) => `  ${si + 1}. ${s}`).join('\n');
+        const lines = [
+            `CASE case_${i}: ${tc.title}`,
+            `STEPS:`,
+            steps,
+            `EXPECTED RESULT: ${tc.expectedResult}`,
+        ];
+        if (tc.preconditions)
+            lines.push(`PRECONDITIONS: ${tc.preconditions}`);
+        if (tc.testDataInline && Object.keys(tc.testDataInline).length > 0) {
+            lines.push(`RECORDED VALUES: ${JSON.stringify(tc.testDataInline)}`);
+        }
+        return lines.join('\n');
+    });
+    const user = [
+        `Generate test data for the following ${cases.length} test case(s):`,
+        '',
+        caseBlocks.join('\n\n---\n\n'),
+        '',
+        'Return a JSON object with keys case_0 through case_' + (cases.length - 1) + ', each containing a "dataSets" array.',
+    ].join('\n');
+    const result = new Map();
+    let rawResponse;
+    try {
+        const t0 = Date.now();
+        const { text: raw, usage } = await (0, llm_js_1.askTracked)(system, user, llmCfg, 4096, BATCH_DATA_SCHEMA, { temperature: 0, seed: (0, llm_js_1.deterministicSeed)(`${options.tenantId ?? ''}:${options.projectId ?? ''}:batch:${[...cases.map(c => c.id)].sort().join('|')}`) });
+        rawResponse = raw;
+        const latencyMs = Date.now() - t0;
+        const parsed = extractBatchJson(raw);
+        for (let i = 0; i < cases.length; i++) {
+            const batchKey = `case_${i}`;
+            const caseResult = parsed[batchKey];
+            if (!caseResult || !Array.isArray(caseResult.dataSets)) {
+                console.warn(`[data-agent] batch: missing or invalid result for ${batchKey} (id=${cases[i].id})`);
+                continue;
+            }
+            const _fzeReBatch = /\{\{\s*fze\.(random|local)\.[^}]+\}\}/i;
+            const dataSets = caseResult.dataSets.map((ds) => ({
+                label: ds.label ?? 'Dataset',
+                category: ds.category ?? 'VALID',
+                values: ds.values
+                    ? Object.fromEntries(Object.entries(ds.values).filter(([, v]) => !_fzeReBatch.test(String(v ?? ''))))
+                    : {},
+                expectedOutcome: ds.expectedOutcome ?? '',
+                ...(ds.gherkinExample ? { gherkinExample: ds.gherkinExample } : {}),
+            }));
+            result.set(cases[i].id, dataSets);
+        }
+        if (options.tenantId && options.projectId) {
+            (0, app_brain_1.recordLLMCall)({
+                tenantId: options.tenantId,
+                projectId: options.projectId,
+                agentType: 'data',
+                label: `test_data_batch_${cases.length}`,
+                entityId: cases.map((c) => c.id).join(','),
+                entityType: 'test_data',
+                usage,
+                latencyMs,
+            }).catch(console.error);
+        }
+    }
+    catch (err) {
+        console.error('[data-agent] batch LLM call failed:', err instanceof Error ? err.message : err);
+        if (rawResponse)
+            console.error('[data-agent] batch raw response (first 600):', rawResponse.slice(0, 600));
+        // Return empty map — caller decides whether to fall back to single-case generateTestData()
+    }
+    return result;
+}
+// ─── PAIRWISE BLOCK (injected for ≥3 data-bearing fields) ───────────────────────────
+function buildPairwiseBlock(fields) {
+    return [
+        'MULTI-FIELD PAIRWISE RULE (this case has 3+ data-bearing fields):',
+        '1. For each field, use the value-classes from its STRATEGY as parameter values',
+        '   (e.g. email → [valid, missing_at, unicode_local]; enum → [each allowedValue]; integer → [min, mid, max]).',
+        '2. Generate a PAIRWISE-covering VALID+INVALID set: every pair of values across any two fields',
+        '   must appear together in at least one dataset. Do NOT emit the full cross-product.',
+        '3. This pairwise set is IN ADDITION to (never a replacement for):',
+        '   - the full single-field BVA boundary rows for each constrained field, and',
+        '   - one security probe per security-eligible field.',
+        '4. Cap total datasets at 24; if pairwise + BVA + security exceeds the cap,',
+        '   drop the lowest-value redundant VALID rows first, never the boundary or security rows.',
+    ].join('\n');
+}
+// ─── RELATION-GROUP CROSS-FIELD INTEGRITY ──────────────────────────────────────
+function buildRelationGroupBlock(fields) {
+    const byGroup = new Map();
+    for (const f of fields) {
+        if (f.relationGroup) {
+            const existing = byGroup.get(f.relationGroup) ?? [];
+            existing.push(f);
+            byGroup.set(f.relationGroup, existing);
+        }
+    }
+    if (byGroup.size === 0)
+        return '';
+    const lines = ['CROSS-FIELD RELATION RULES (fields sharing a group must be mutually consistent):'];
+    for (const [group, groupFields] of byGroup.entries()) {
+        const keys = groupFields.map(f => f.fieldKey).join(', ');
+        lines.push(`  GROUP "${group}": [${keys}]`);
+        lines.push(`    In VALID rows: values must be mutually consistent (e.g. state belongs to country; confirm_password equals password; end_date >= start_date).`);
+        lines.push(`    In INVALID rows: include at least one dataset that VIOLATES this relationship specifically, naming the exact expected error.`);
+    }
+    return lines.join('\n');
+}
+/**
+ * Parse a single CSV row, handling quoted fields with commas.
+ */
+function parseCSVRow(line) {
+    const result = [];
+    let current = '';
+    let inQuotes = false;
+    for (let i = 0; i < line.length; i++) {
+        const ch = line[i];
+        if (ch === '"') {
+            if (inQuotes && line[i + 1] === '"') {
+                current += '"';
+                i++;
+            }
+            else
+                inQuotes = !inQuotes;
+        }
+        else if (ch === ',' && !inQuotes) {
+            result.push(current.trim());
+            current = '';
+        }
+        else {
+            current += ch;
+        }
+    }
+    result.push(current.trim());
+    return result;
+}
+/**
+ * Parse a CSV string (with header row) into VALID/INVALID/EDGE test datasets.
+ * Column names map to dataset field names.
+ * Rows are assigned categories based on a 'category' column (if present) or
+ * positionally: first 40% VALID, next 40% INVALID, last 20% EDGE.
+ *
+ * @param csvContent - Raw CSV string content
+ * @param fieldMap - Optional alias map: { csvColumnName: normalizedFieldName }
+ * @returns Array of dataset objects ready for use in test data generation
+ */
+function parseCsvToDatasets(csvContent, fieldMap) {
+    const lines = csvContent
+        .split(/\r?\n/)
+        .map((l) => l.trim())
+        .filter(Boolean);
+    if (lines.length < 2)
+        return []; // Need at least header + 1 data row
+    // Parse header
+    const headers = parseCSVRow(lines[0]);
+    const hasCategoryCol = headers.some((h) => h.toLowerCase() === 'category');
+    const hasLabelCol = headers.some((h) => h.toLowerCase() === 'label');
+    const rows = [];
+    for (let i = 1; i < lines.length; i++) {
+        const values = parseCSVRow(lines[i]);
+        if (values.length === 0)
+            continue;
+        const row = {};
+        headers.forEach((h, idx) => {
+            const normalizedKey = fieldMap?.[h] ?? h;
+            row[normalizedKey] = values[idx] ?? '';
+        });
+        rows.push(row);
+    }
+    if (rows.length === 0)
+        return [];
+    // Assign categories
+    const datasets = rows.map((row, idx) => {
+        let category = 'VALID';
+        if (hasCategoryCol) {
+            const cat = (row['category'] ?? '').toUpperCase();
+            if (['VALID', 'INVALID', 'EDGE', 'SECURITY'].includes(cat)) {
+                category = cat;
+            }
+            delete row['category'];
+        }
+        else {
+            // Positional assignment: first 40% VALID, next 40% INVALID, last 20% EDGE
+            const ratio = idx / rows.length;
+            if (ratio < 0.4)
+                category = 'VALID';
+            else if (ratio < 0.8)
+                category = 'INVALID';
+            else
+                category = 'EDGE';
+        }
+        const label = hasLabelCol ? (row['label'] ?? `row-${idx + 1}`) : `row-${idx + 1}`;
+        if (hasLabelCol)
+            delete row['label'];
+        return {
+            label,
+            category,
+            values: row,
+            expectedOutcome: category === 'VALID' ? 'Action succeeds' : 'Validation error or rejection',
+        };
+    });
+    return datasets;
+}
+/**
+ * Merge externally-provided datasets (from CSV upload) with LLM-generated datasets.
+ * External datasets take priority for matching categories.
+ * Deduplicates by category label.
+ */
+function mergeExternalDatasets(generated, external) {
+    if (external.length === 0)
+        return generated;
+    // External datasets replace LLM-generated ones of the same category
+    const externalByCategory = new Map();
+    for (const ds of external) {
+        const existing = externalByCategory.get(ds.category) ?? [];
+        existing.push(ds);
+        externalByCategory.set(ds.category, existing);
+    }
+    // Keep generated datasets only for categories not covered by external
+    const keepGenerated = generated.filter((ds) => !externalByCategory.has(ds.category));
+    return [...external, ...keepGenerated];
+}