@xera-ai/core 0.4.4 → 0.5.0

package/dist/bin/internal.js

@@ -19,15 +19,15 @@ var __esm = (fn, res) => () => (fn && (res = fn(fn = 0)), res);
 var __require = import.meta.require;
 
 // src/graph/paths.ts
-import { join } from "path";
+import { join as join3 } from "path";
 function graphPaths(repoRoot) {
-  const eventsDir = join(repoRoot, ".xera/graph/events");
+  const eventsDir = join3(repoRoot, ".xera/graph/events");
   return {
     eventsDir,
-    snapshotFile: join(repoRoot, ".xera/graph/snapshot.json"),
-    costLog: join(repoRoot, ".xera/cost-log.jsonl"),
-    eventsMonthDir: (yyyyMm) => join(eventsDir, yyyyMm),
-    eventFile: (ulid, skill, ticketId, yyyyMm) => join(eventsDir, yyyyMm, `${ulid}-${skill}-${ticketId}.jsonl`)
+    snapshotFile: join3(repoRoot, ".xera/graph/snapshot.json"),
+    costLog: join3(repoRoot, ".xera/cost-log.jsonl"),
+    eventsMonthDir: (yyyyMm) => join3(eventsDir, yyyyMm),
+    eventFile: (ulid, skill, ticketId, yyyyMm) => join3(eventsDir, yyyyMm, `${ulid}-${skill}-${ticketId}.jsonl`)
   };
 }
 function currentYyyyMm(now = new Date) {
@@ -41,7 +41,7 @@ var init_paths = () => {};
 var SCHEMA_VERSION = 1;
 
 // src/graph/schema.ts
-import { z } from "zod";
+import { z as z2 } from "zod";
 function safeParseEvent(value) {
   const r = EventSchema.safeParse(value);
   if (r.success)
@@ -50,110 +50,113 @@ function safeParseEvent(value) {
 }
 var schemaV, iso, ticketFetched, ticketEnriched, scenarioGenerated, pomGenerated, pomPromoted, runCompleted, classification, runClassified, classificationDisputed, edgeDiscovered, base, EventSchema;
 var init_schema = __esm(() => {
-  schemaV = z.literal(SCHEMA_VERSION);
-  iso = z.string().datetime({ offset: false });
-  ticketFetched = z.object({
-    ticketId: z.string().regex(/^[A-Z][A-Z0-9]*-\d+$/),
-    summary: z.string(),
-    ac: z.array(z.string()),
-    jiraLinks: z.array(z.object({
-      ticketId: z.string().regex(/^[A-Z][A-Z0-9]*-\d+$/),
-      relation: z.enum(["blocks", "duplicates", "relates", "supersedes"])
+  schemaV = z2.literal(SCHEMA_VERSION);
+  iso = z2.string().datetime({ offset: false });
+  ticketFetched = z2.object({
+    ticketId: z2.string().regex(/^[A-Z][A-Z0-9]*-\d+$/),
+    summary: z2.string(),
+    ac: z2.array(z2.string()),
+    jiraLinks: z2.array(z2.object({
+      ticketId: z2.string().regex(/^[A-Z][A-Z0-9]*-\d+$/),
+      relation: z2.enum(["blocks", "duplicates", "relates", "supersedes"])
     })),
-    storyHash: z.string(),
-    modifiesAreas: z.array(z.string().regex(/^[a-z0-9-]+$/))
+    storyHash: z2.string(),
+    modifiesAreas: z2.array(z2.string().regex(/^[a-z0-9-]+$/))
   }).passthrough();
-  ticketEnriched = z.object({
-    ticketId: z.string(),
+  ticketEnriched = z2.object({
+    ticketId: z2.string(),
     enrichedAt: iso,
-    similarCount: z.number().int().nonnegative()
+    similarCount: z2.number().int().nonnegative()
   }).passthrough();
-  scenarioGenerated = z.object({
-    scenarioId: z.string(),
-    ticketId: z.string(),
-    name: z.string(),
-    gherkin: z.string(),
-    priority: z.enum(["p0", "p1", "p2"]),
-    featureHash: z.string(),
+  scenarioGenerated = z2.object({
+    scenarioId: z2.string(),
+    ticketId: z2.string(),
+    name: z2.string(),
+    gherkin: z2.string(),
+    priority: z2.enum(["p0", "p1", "p2"]),
+    featureHash: z2.string(),
     generatedAt: iso
   }).passthrough();
-  pomGenerated = z.object({
-    pomId: z.string(),
-    ticketId: z.string(),
-    filePath: z.string(),
-    route: z.string(),
-    locators: z.array(z.string()),
-    scope: z.enum(["local", "shared"])
+  pomGenerated = z2.object({
+    pomId: z2.string(),
+    ticketId: z2.string(),
+    filePath: z2.string(),
+    route: z2.string(),
+    locators: z2.array(z2.string()),
+    scope: z2.enum(["local", "shared"])
   }).passthrough();
-  pomPromoted = z.object({
-    pomId: z.string(),
-    fromPath: z.string(),
-    toPath: z.string()
+  pomPromoted = z2.object({
+    pomId: z2.string(),
+    fromPath: z2.string(),
+    toPath: z2.string()
   }).passthrough();
-  runCompleted = z.object({
-    scenarioId: z.string(),
-    ticketId: z.string(),
-    runId: z.string(),
-    status: z.enum(["pass", "fail"]),
-    traceId: z.string().optional(),
-    runtime: z.number().nonnegative()
+  runCompleted = z2.object({
+    scenarioId: z2.string(),
+    ticketId: z2.string(),
+    runId: z2.string(),
+    status: z2.enum(["pass", "fail"]),
+    traceId: z2.string().optional(),
+    runtime: z2.number().nonnegative()
   }).passthrough();
-  classification = z.enum([
+  classification = z2.enum([
     "REAL_BUG",
     "TEST_BUG",
     "SELECTOR_DRIFT",
     "FLAKY",
     "PASS",
-    "TEST_OUTDATED"
+    "TEST_OUTDATED",
+    "CONTRACT_DRIFT",
+    "RATE_LIMITED",
+    "AUTH_EXPIRED"
   ]);
-  runClassified = z.object({
-    scenarioId: z.string(),
-    runId: z.string(),
+  runClassified = z2.object({
+    scenarioId: z2.string(),
+    runId: z2.string(),
     classification,
-    confidence: z.enum(["low", "medium", "high"])
+    confidence: z2.enum(["low", "medium", "high"])
   }).passthrough();
-  classificationDisputed = z.object({
-    runId: z.string(),
-    scenarioId: z.string(),
+  classificationDisputed = z2.object({
+    runId: z2.string(),
+    scenarioId: z2.string(),
     originalClassification: classification,
     disputedTo: classification,
-    qaActor: z.string(),
-    qaReason: z.string().optional()
+    qaActor: z2.string(),
+    qaReason: z2.string().optional()
   }).passthrough();
-  edgeDiscovered = z.object({
-    kind: z.enum(["tests", "uses", "covers", "modifies", "jira-linked", "similar", "ran"]),
-    from: z.string(),
-    to: z.string(),
-    confidence: z.number().min(0).max(1).optional(),
-    source: z.string()
+  edgeDiscovered = z2.object({
+    kind: z2.enum(["tests", "uses", "covers", "modifies", "jira-linked", "similar", "ran"]),
+    from: z2.string(),
+    to: z2.string(),
+    confidence: z2.number().min(0).max(1).optional(),
+    source: z2.string()
   }).passthrough();
   base = {
-    event_id: z.string().min(20),
+    event_id: z2.string().min(20),
     schema_version: schemaV,
     ts: iso,
-    actor: z.string()
+    actor: z2.string()
   };
-  EventSchema = z.discriminatedUnion("type", [
-    z.object({ ...base, type: z.literal("ticket.fetched"), payload: ticketFetched }),
-    z.object({ ...base, type: z.literal("ticket.enriched"), payload: ticketEnriched }),
-    z.object({ ...base, type: z.literal("scenario.generated"), payload: scenarioGenerated }),
-    z.object({ ...base, type: z.literal("pom.generated"), payload: pomGenerated }),
-    z.object({ ...base, type: z.literal("pom.promoted"), payload: pomPromoted }),
-    z.object({ ...base, type: z.literal("run.completed"), payload: runCompleted }),
-    z.object({ ...base, type: z.literal("run.classified"), payload: runClassified }),
-    z.object({
+  EventSchema = z2.discriminatedUnion("type", [
+    z2.object({ ...base, type: z2.literal("ticket.fetched"), payload: ticketFetched }),
+    z2.object({ ...base, type: z2.literal("ticket.enriched"), payload: ticketEnriched }),
+    z2.object({ ...base, type: z2.literal("scenario.generated"), payload: scenarioGenerated }),
+    z2.object({ ...base, type: z2.literal("pom.generated"), payload: pomGenerated }),
+    z2.object({ ...base, type: z2.literal("pom.promoted"), payload: pomPromoted }),
+    z2.object({ ...base, type: z2.literal("run.completed"), payload: runCompleted }),
+    z2.object({ ...base, type: z2.literal("run.classified"), payload: runClassified }),
+    z2.object({
       ...base,
-      type: z.literal("classification.disputed"),
+      type: z2.literal("classification.disputed"),
       payload: classificationDisputed
     }),
-    z.object({ ...base, type: z.literal("edge.discovered"), payload: edgeDiscovered })
+    z2.object({ ...base, type: z2.literal("edge.discovered"), payload: edgeDiscovered })
   ]);
 });
 
 // src/graph/store.ts
 import { createHash } from "crypto";
 import {
-  existsSync,
+  existsSync as existsSync3,
   mkdirSync,
   readdirSync,
   readFileSync,
@@ -180,7 +183,7 @@ function appendEvents(repoRoot, events, opts) {
 }
 function loadAllEvents(repoRoot) {
   const paths = graphPaths(repoRoot);
-  if (!existsSync(paths.eventsDir))
+  if (!existsSync3(paths.eventsDir))
     return [];
   const files = [];
   for (const monthDir of readdirSync(paths.eventsDir, { withFileTypes: true })) {
@@ -359,7 +362,7 @@ function writeSnapshot(repoRoot, snap) {
 }
 function loadSnapshot(repoRoot) {
   const paths = graphPaths(repoRoot);
-  if (!existsSync(paths.snapshotFile))
+  if (!existsSync3(paths.snapshotFile))
     return null;
   try {
     return JSON.parse(readFileSync(paths.snapshotFile, "utf8"));
@@ -437,8 +440,8 @@ __export(exports_graph_record_script, {
   recordScriptImpl: () => recordScriptImpl
 });
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync4, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
-import { basename, join as join3 } from "path";
+import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync4 } from "fs";
+import { basename, join as join5 } from "path";
 function inferPriority(name, gherkin) {
   const haystack = `${name} ${gherkin}`.toLowerCase();
   for (const kw of P0_KEYWORDS) {
@@ -480,9 +483,9 @@ function parseFeature(text) {
   return scenarios;
 }
 function listPomFiles(dir) {
-  if (!existsSync4(dir))
+  if (!existsSync6(dir))
     return [];
-  return readdirSync2(dir).filter((f) => f.endsWith(".ts")).map((f) => join3(dir, f));
+  return readdirSync2(dir).filter((f) => f.endsWith(".ts")).map((f) => join5(dir, f));
 }
 function extractRoute(pomContent) {
   const m = pomContent.match(/goto\s*\(\s*['"]([^'"]+)['"]/);
@@ -509,11 +512,11 @@ function extractPomUsage(specContent) {
   return [...names];
 }
 async function recordScriptImpl(repoRoot, ticket) {
-  const ticketDir = join3(repoRoot, ".xera", ticket);
-  const featurePath = join3(ticketDir, "feature", `${ticket}.feature`);
-  const specPath = join3(ticketDir, "tests", `${ticket}.spec.ts`);
-  const pomDir = join3(ticketDir, "poms");
-  if (!existsSync4(featurePath)) {
+  const ticketDir = join5(repoRoot, ".xera", ticket);
+  const featurePath = join5(ticketDir, "feature", `${ticket}.feature`);
+  const specPath = join5(ticketDir, "tests", `${ticket}.spec.ts`);
+  const pomDir = join5(ticketDir, "poms");
+  if (!existsSync6(featurePath)) {
     console.error(`[graph-record script] feature missing`);
     return 1;
   }
@@ -551,7 +554,7 @@ async function recordScriptImpl(repoRoot, ticket) {
     };
     events.push(mk("xera-script", "pom.generated", pg));
   }
-  if (existsSync4(specPath)) {
+  if (existsSync6(specPath)) {
     const specContent = readFileSync4(specPath, "utf8");
     const usedPoms = extractPomUsage(specContent);
     for (const scenario of scenarios) {
@@ -7616,8 +7619,8 @@ __export(exports_graph_record, {
   graphRecordCmd: () => graphRecordCmd
 });
 import { createHash as createHash3 } from "crypto";
-import { existsSync as existsSync5, readFileSync as readFileSync5 } from "fs";
-import { basename as basename2, join as join4 } from "path";
+import { existsSync as existsSync7, readFileSync as readFileSync5 } from "fs";
+import { basename as basename2, join as join6 } from "path";
 function nowIso2() {
   return new Date().toISOString();
 }
@@ -7641,8 +7644,8 @@ function makeEvent(actor, type, payload) {
   };
 }
 function readStoryFrontmatter(repoRoot, ticket) {
-  const path = join4(repoRoot, ".xera", ticket, "story.md");
-  if (!existsSync5(path))
+  const path = join6(repoRoot, ".xera", ticket, "story.md");
+  if (!existsSync7(path))
     return null;
   const raw = readFileSync5(path, "utf8");
   const m = raw.match(/^---\n([\s\S]*?)\n---/);
@@ -7651,8 +7654,8 @@ function readStoryFrontmatter(repoRoot, ticket) {
   return $parse(m[1]);
 }
 function readGraphInput(repoRoot, ticket) {
-  const path = join4(repoRoot, ".xera", ticket, "graph-input.json");
-  if (!existsSync5(path))
+  const path = join6(repoRoot, ".xera", ticket, "graph-input.json");
+  if (!existsSync7(path))
     return { modifiesAreas: [] };
   try {
     return JSON.parse(readFileSync5(path, "utf8"));
@@ -7703,8 +7706,8 @@ async function recordScript(repoRoot, ticket) {
   return recordScriptImpl2(repoRoot, ticket);
 }
 async function recordExec(repoRoot, ticket, runId) {
-  const reporterPath = join4(repoRoot, ".xera", ticket, "runs", runId, "reporter.json");
-  if (!existsSync5(reporterPath)) {
+  const reporterPath = join6(repoRoot, ".xera", ticket, "runs", runId, "reporter.json");
+  if (!existsSync7(reporterPath)) {
     console.error(`[graph-record exec] reporter.json missing`);
     return 1;
   }
@@ -7726,8 +7729,8 @@ async function recordExec(repoRoot, ticket, runId) {
   return 0;
 }
 async function recordClassify(repoRoot, ticket, runId) {
-  const classifyPath = join4(repoRoot, ".xera", ticket, "runs", runId, "classifier-output.json");
-  if (!existsSync5(classifyPath)) {
+  const classifyPath = join6(repoRoot, ".xera", ticket, "runs", runId, "classifier-output.json");
+  if (!existsSync7(classifyPath)) {
     console.error(`[graph-record classify] classifier-output.json missing`);
     return 1;
   }
@@ -7834,7 +7837,10 @@ async function graphRecordCmd(argv) {
         "SELECTOR_DRIFT",
         "FLAKY",
         "PASS",
-        "TEST_OUTDATED"
+        "TEST_OUTDATED",
+        "CONTRACT_DRIFT",
+        "RATE_LIMITED",
+        "AUTH_EXPIRED"
       ];
       if (!validClass.includes(from) || !validClass.includes(to)) {
         console.error(`[graph-record dispute] --from and --to must be one of: ${validClass.join(", ")}`);
@@ -7869,11 +7875,11 @@ var exports_graph_backfill = {};
 __export(exports_graph_backfill, {
   graphBackfillCmd: () => graphBackfillCmd
 });
-import { existsSync as existsSync6, readdirSync as readdirSync3 } from "fs";
-import { join as join5 } from "path";
+import { existsSync as existsSync8, readdirSync as readdirSync3 } from "fs";
+import { join as join7 } from "path";
 async function backfillTicket(repoRoot, ticket, dryRun) {
-  const storyPath = join5(repoRoot, ".xera", ticket, "story.md");
-  if (!existsSync6(storyPath))
+  const storyPath = join7(repoRoot, ".xera", ticket, "story.md");
+  if (!existsSync8(storyPath))
     return 0;
   const { recordFetch: recordFetch2 } = await Promise.resolve().then(() => (init_graph_record(), exports_graph_record));
   if (dryRun) {
@@ -7887,8 +7893,8 @@ async function backfillTicket(repoRoot, ticket, dryRun) {
 async function graphBackfillCmd(argv) {
   const dryRun = argv.includes("--dry-run");
   const repoRoot = process.cwd();
-  const xeraDir = join5(repoRoot, ".xera");
-  if (!existsSync6(xeraDir)) {
+  const xeraDir = join7(repoRoot, ".xera");
+  if (!existsSync8(xeraDir)) {
     console.log("[backfill] no .xera/ directory");
     return 0;
   }
@@ -7914,6 +7920,212 @@ var init_graph_backfill = __esm(() => {
   init_graph_record_script();
 });
 
+// src/bin-internal/auth-setup.ts
+import { existsSync as existsSync2 } from "fs";
+import { join as join2 } from "path";
+import { pathToFileURL as pathToFileURL2 } from "url";
+
+// src/config/load.ts
+import { existsSync } from "fs";
+import { join } from "path";
+import { pathToFileURL } from "url";
+
+// src/config/schema.ts
+import { z } from "zod";
+var AuthRoleSchema = z.object({
+  envEmail: z.string().min(1),
+  envPassword: z.string().min(1)
+});
+var AuthSchema = z.object({
+  strategy: z.enum(["storageState", "apiToken", "none"]).default("none"),
+  ttl: z.string().default("8h"),
+  refreshBuffer: z.string().default("30m"),
+  setupScript: z.string().optional(),
+  roles: z.record(z.string(), AuthRoleSchema).default({})
+});
+var WebSchema = z.object({
+  baseUrl: z.record(z.string(), z.string().url()).refine((m) => Object.keys(m).length > 0, {
+    message: "baseUrl must have at least one environment"
+  }),
+  defaultEnv: z.string(),
+  auth: AuthSchema.prefault({}),
+  testData: z.object({
+    users: z.record(z.string(), z.object({ fromAuth: z.string() })).default({})
+  }).prefault({})
+}).refine((w) => w.baseUrl[w.defaultEnv] !== undefined, {
+  message: "defaultEnv must exist in baseUrl map",
+  path: ["defaultEnv"]
+});
+var HttpAuthRoleSchema = z.object({
+  tokenEnv: z.string().optional(),
+  userEnv: z.string().optional(),
+  passEnv: z.string().optional(),
+  tokenUrl: z.string().url().optional(),
+  clientIdEnv: z.string().optional(),
+  clientSecretEnv: z.string().optional(),
+  scope: z.string().optional()
+});
+var HttpAuthSchema = z.object({
+  strategy: z.enum(["bearer", "apiKey", "basic", "oauth-cc", "custom", "none"]).default("none"),
+  ttl: z.string().default("8h"),
+  refreshBuffer: z.string().default("30m"),
+  roles: z.record(z.string(), HttpAuthRoleSchema).default({})
+});
+var HttpSchema = z.object({
+  baseUrl: z.record(z.string(), z.string().url()).refine((m) => Object.keys(m).length > 0, {
+    message: "baseUrl must have at least one environment"
+  }),
+  defaultEnv: z.string(),
+  spec: z.string().optional(),
+  auth: HttpAuthSchema.prefault({})
+}).refine((h) => h.baseUrl[h.defaultEnv] !== undefined, {
+  message: "defaultEnv must exist in baseUrl map",
+  path: ["defaultEnv"]
+});
+var JiraSchema = z.object({
+  baseUrl: z.string().url(),
+  projectKeys: z.array(z.string().min(1)).min(1),
+  fields: z.object({
+    story: z.string().min(1),
+    acceptanceCriteria: z.string().optional(),
+    attachments: z.string().default("attachment")
+  })
+});
+var AISchema = z.object({
+  livePageSnapshot: z.boolean().default(true),
+  confidenceThreshold: z.enum(["low", "medium", "high"]).default("medium"),
+  maxRetries: z.object({
+    typecheck: z.number().int().min(0).max(5).default(2),
+    lint: z.number().int().min(0).max(5).default(2),
+    validateFeature: z.number().int().min(0).max(5).default(2)
+  }).prefault({})
+}).prefault({});
+var ReportingSchema = z.object({
+  language: z.enum(["en", "vi"]).default("en"),
+  postToJira: z.boolean().default(true),
+  transition: z.object({
+    onPass: z.string().nullable().default(null),
+    onFail: z.string().nullable().default(null)
+  }).prefault({}),
+  artifactLinks: z.enum(["git", "local"]).default("git")
+}).prefault({});
+var RunSchema = z.object({
+  autoImpact: z.object({
+    enabled: z.boolean().default(true),
+    threshold: z.number().nonnegative().default(8)
+  }).prefault({})
+}).prefault({});
+var XeraConfigSchema = z.object({
+  jira: JiraSchema,
+  web: WebSchema.optional(),
+  http: HttpSchema.optional(),
+  ai: AISchema,
+  reporting: ReportingSchema,
+  run: RunSchema.prefault({}),
+  adapters: z.array(z.enum(["web", "http"])).min(1).default(["web"])
+}).refine((c) => c.web !== undefined || c.http !== undefined, {
+  message: "At least one of `web` or `http` must be configured"
+}).refine((c) => c.adapters.every((a) => (a === "web" ? c.web : c.http) !== undefined), {
+  message: "Every adapter in `adapters` must have a corresponding config block",
+  path: ["adapters"]
+});
+
+// src/config/load.ts
+async function loadConfig(cwd) {
+  const path = join(cwd, "xera.config.ts");
+  if (!existsSync(path)) {
+    throw new Error(`xera.config.ts not found in ${cwd}`);
+  }
+  const mod = await import(pathToFileURL(path).href);
+  const raw = mod.default ?? mod;
+  return XeraConfigSchema.parse(raw);
+}
+
+// src/bin-internal/auth-setup.ts
+function parseOpts(argv) {
+  const opts = { shape: "all" };
+  for (let i = 0;i < argv.length; i++) {
+    const a = argv[i];
+    const next = argv[i + 1];
+    if (a === "--role" && next) {
+      opts.role = next;
+      i++;
+    } else if (a === "--shape" && next) {
+      if (next === "web" || next === "http" || next === "all")
+        opts.shape = next;
+      i++;
+    }
+  }
+  return opts;
+}
+async function authSetupCmd(argv) {
+  const opts = parseOpts(argv);
+  const cwd = process.cwd();
+  const config = await loadConfig(cwd);
+  const authSetupScript = join2(cwd, "shared", "auth-setup.ts");
+  if (!existsSync2(authSetupScript)) {
+    console.error(`[xera:auth-setup] auth-setup.ts not found at ${authSetupScript}. Run 'bunx @xera-ai/cli init' first.`);
+    return 1;
+  }
+  const mod = await import(pathToFileURL2(authSetupScript).href);
+  let exitCode = 0;
+  if ((opts.shape === "all" || opts.shape === "web") && config.web && typeof mod.web === "function") {
+    const { runAuthSetup } = await import("@xera-ai/web");
+    const { chromium } = await import("@playwright/test");
+    const browser = await chromium.launch();
+    try {
+      for (const [roleName, roleCreds] of Object.entries(config.web.auth.roles)) {
+        if (opts.role && roleName !== opts.role)
+          continue;
+        const email = process.env[roleCreds.envEmail];
+        const password = process.env[roleCreds.envPassword];
+        if (!email || !password) {
+          console.error(`[xera:auth-setup] missing env vars ${roleCreds.envEmail} / ${roleCreds.envPassword} for role '${roleName}'`);
+          exitCode = 1;
+          continue;
+        }
+        try {
+          await runAuthSetup({
+            role: roleName,
+            creds: { email, password },
+            setupScriptPath: authSetupScript,
+            authDir: join2(cwd, ".xera", ".auth"),
+            browser
+          });
+          console.log(`[xera:auth-setup] \u2713 ${roleName}.json (web)`);
+        } catch (e) {
+          console.error(`[xera:auth-setup] \u2717 web/${roleName}: ${e.message}`);
+          exitCode = 1;
+        }
+      }
+    } finally {
+      await browser.close();
+    }
+  }
+  if ((opts.shape === "all" || opts.shape === "http") && config.http && typeof mod.http === "function") {
+    globalThis.__XERA_HTTP_CONFIG__ = config.http;
+    const { runHttpAuthSetup } = await import("@xera-ai/http");
+    for (const roleName of Object.keys(config.http.auth.roles)) {
+      if (opts.role && roleName !== opts.role)
+        continue;
+      try {
+        await runHttpAuthSetup({
+          authDir: join2(cwd, ".xera", ".auth"),
+          role: roleName,
+          config: config.http,
+          setupFn: mod.http,
+          creds: { email: "", password: "" }
+        });
+        console.log(`[xera:auth-setup] \u2713 http/${roleName}.json`);
+      } catch (e) {
+        console.error(`[xera:auth-setup] \u2717 http/${roleName}: ${e.message}`);
+        exitCode = 1;
+      }
+    }
+  }
+  return exitCode;
+}
+
 // src/bin-internal/disputes.ts
 init_store();
 function parseDuration(s) {
@@ -7990,16 +8202,16 @@ async function disputesCmd(argv) {
 }
 
 // src/bin-internal/doctor.ts
-import { existsSync as existsSync7, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "fs";
-import { join as join6 } from "path";
+import { existsSync as existsSync9, readdirSync as readdirSync4, readFileSync as readFileSync6 } from "fs";
+import { join as join8 } from "path";
 
 // src/graph/cost.ts
-import { appendFileSync, existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
+import { appendFileSync, existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2 } from "fs";
 init_paths();
 function summarizeCost(repoRoot, daysBack) {
   const paths = graphPaths(repoRoot);
   const result = { totalCalls: 0, totalUsd: 0, bySkill: {}, windowDays: daysBack };
-  if (!existsSync2(paths.costLog))
+  if (!existsSync4(paths.costLog))
     return result;
   const cutoff = Date.now() - daysBack * 86400 * 1000;
   for (const line of readFileSync2(paths.costLog, "utf8").split(`
@@ -8029,11 +8241,12 @@ function summarizeCost(repoRoot, daysBack) {
 init_store();
 
 // src/bin-internal/verify-prompts.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "fs";
+import { join as join4 } from "path";
 var IN_SCOPE_PROMPTS = [
   "feature-from-story.md",
-  "script-from-feature.md",
+  "script-from-feature-web.md",
+  "script-from-feature-http.md",
   "heal-locator.md",
   "extract-areas.md",
   "similarity-match.md",
@@ -8042,11 +8255,11 @@ var IN_SCOPE_PROMPTS = [
 var REQUIRED_SECTION_HEADING = "## Handling untrusted input";
 var REQUIRED_KEYWORDS = ["UNTRUSTED", "injection-follow", "<XR_"];
 function verifyPrompts(repoRoot) {
-  const promptsDir = join2(repoRoot, "packages/prompts");
+  const promptsDir = join4(repoRoot, "packages/prompts");
   const results = [];
   for (const filename of IN_SCOPE_PROMPTS) {
-    const path = join2(promptsDir, filename);
-    if (!existsSync3(path)) {
+    const path = join4(promptsDir, filename);
+    if (!existsSync5(path)) {
       results.push({
         ok: false,
         message: `${filename}: file missing at packages/prompts/${filename}`
@@ -8101,8 +8314,8 @@ function frontmatterField(content, field) {
   return m?.[1] ?? null;
 }
 function checkGoldenEvalDir(repoRoot) {
-  const root = join6(repoRoot, "fixtures/golden-eval");
-  if (!existsSync7(root))
+  const root = join8(repoRoot, "fixtures/golden-eval");
+  if (!existsSync9(root))
     return [{ ok: false, message: "fixtures/golden-eval/ does not exist" }];
   const dirs = readdirSync4(root, { withFileTypes: true }).filter((e) => e.isDirectory() && !e.name.startsWith("."));
   const results = [];
@@ -8113,9 +8326,9 @@ function checkGoldenEvalDir(repoRoot) {
     });
   }
   for (const entry of dirs) {
-    const dir = join6(root, entry.name);
-    const metaPath = join6(dir, "meta.json");
-    if (!existsSync7(metaPath)) {
+    const dir = join8(root, entry.name);
+    const metaPath = join8(dir, "meta.json");
+    if (!existsSync9(metaPath)) {
       results.push({ ok: false, message: `${entry.name}: meta.json missing` });
       continue;
     }
@@ -8132,12 +8345,12 @@ function checkGoldenEvalDir(repoRoot) {
     const stages = Array.isArray(meta.stages) ? meta.stages : [];
     if (stages.length === 0)
       results.push({ ok: false, message: `${entry.name}: meta.stages is empty` });
-    if (!existsSync7(join6(dir, "story.md")))
+    if (!existsSync9(join8(dir, "story.md")))
       results.push({ ok: false, message: `${entry.name}: story.md missing` });
     for (const stage of stages) {
       const required = REQUIRED_FILES_PER_STAGE[stage] ?? [];
       for (const rel of required) {
-        if (!existsSync7(join6(dir, rel))) {
+        if (!existsSync9(join8(dir, rel))) {
           results.push({
             ok: false,
             message: `${meta.id ?? entry.name}: stage "${stage}" declared but ${rel} missing`
@@ -8149,8 +8362,8 @@ function checkGoldenEvalDir(repoRoot) {
   return results;
 }
 function checkRubricPrompt(repoRoot) {
-  const path = join6(repoRoot, "packages/prompts/eval-rubric.md");
-  if (!existsSync7(path))
+  const path = join8(repoRoot, "packages/prompts/eval-rubric.md");
+  if (!existsSync9(path))
     return [{ ok: false, message: "packages/prompts/eval-rubric.md missing" }];
   const text = readFileSync6(path, "utf8");
   const id = frontmatterField(text, "id");
@@ -8162,8 +8375,8 @@ function checkRubricPrompt(repoRoot) {
   return [];
 }
 function checkEvalSkill(repoRoot) {
-  const path = join6(repoRoot, "packages/skills/xera-eval.md");
-  if (!existsSync7(path))
+  const path = join8(repoRoot, "packages/skills/xera-eval.md");
+  if (!existsSync9(path))
     return [{ ok: false, message: "packages/skills/xera-eval.md missing" }];
   const text = readFileSync6(path, "utf8");
   if (!frontmatterField(text, "name"))
@@ -8174,8 +8387,8 @@ function checkPromptInjectionPreamble(repoRoot) {
   return verifyPrompts(repoRoot);
 }
 function checkRootScripts(repoRoot) {
-  const path = join6(repoRoot, "package.json");
-  if (!existsSync7(path))
+  const path = join8(repoRoot, "package.json");
+  if (!existsSync9(path))
     return [{ ok: false, message: "root package.json missing" }];
   const pkg = JSON.parse(readFileSync6(path, "utf8"));
   const scripts = pkg.scripts ?? {};
@@ -8202,8 +8415,8 @@ async function doctorCmd(argv, opts = {}) {
     if (top)
       console.log(`  Top skill:   ${top[0]} (${top[1].calls} calls, $${top[1].usd.toFixed(2)})`);
   }
-  const xeraDir = join6(repoRoot, ".xera");
-  if (existsSync7(xeraDir)) {
+  const xeraDir = join8(repoRoot, ".xera");
+  if (existsSync9(xeraDir)) {
     const ticketDirs = readdirSync4(xeraDir, { withFileTypes: true }).filter((e) => e.isDirectory() && /^[A-Z]+-\d+$/.test(e.name));
     if (ticketDirs.length > 0) {
       const events = loadAllEvents(repoRoot);
@@ -8238,111 +8451,111 @@ async function doctorCmd(argv, opts = {}) {
 }
 
 // src/bin-internal/eval-deterministic.ts
-import { existsSync as existsSync8, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
-import { join as join8 } from "path";
+import { existsSync as existsSync10, readFileSync as readFileSync7, writeFileSync as writeFileSync2 } from "fs";
+import { join as join10 } from "path";
 import { validateGherkin } from "@xera-ai/web";
 
 // src/eval/paths.ts
-import { join as join7 } from "path";
+import { join as join9 } from "path";
 function resolveEvalPaths(cwd, runId) {
-  const root = join7(cwd, ".xera", "eval", runId);
+  const root = join9(cwd, ".xera", "eval", runId);
   return {
     root,
-    manifest: join7(root, "manifest.json"),
-    lock: join7(root, ".lock"),
-    deterministicScores: join7(root, "deterministic-scores.json"),
-    judgeScores: join7(root, "judge-scores.json"),
-    report: join7(root, "report.md"),
-    summary: join7(root, "summary.json"),
-    inputsDir: join7(root, "inputs"),
-    actualDir: join7(root, "actual"),
-    ticketInputsDir: (ticket) => join7(root, "inputs", ticket),
-    ticketActualDir: (ticket) => join7(root, "actual", ticket)
+    manifest: join9(root, "manifest.json"),
+    lock: join9(root, ".lock"),
+    deterministicScores: join9(root, "deterministic-scores.json"),
+    judgeScores: join9(root, "judge-scores.json"),
+    report: join9(root, "report.md"),
+    summary: join9(root, "summary.json"),
+    inputsDir: join9(root, "inputs"),
+    actualDir: join9(root, "actual"),
+    ticketInputsDir: (ticket) => join9(root, "inputs", ticket),
+    ticketActualDir: (ticket) => join9(root, "actual", ticket)
   };
 }
 
 // src/eval/types.ts
-import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 var STAGES = ["feature-from-story", "script-from-feature", "diagnose-failure"];
-var StageSchema = z2.enum(STAGES);
-var VerdictSchema = z2.enum(["PASS", "FAIL", "NA"]);
-var PromptVersionsSchema = z2.object({
-  "feature-from-story": z2.string(),
-  "script-from-feature": z2.string(),
-  "diagnose-failure": z2.string(),
-  "eval-rubric": z2.string()
+var StageSchema = z3.enum(STAGES);
+var VerdictSchema = z3.enum(["PASS", "FAIL", "NA"]);
+var PromptVersionsSchema = z3.object({
+  "feature-from-story": z3.string(),
+  "script-from-feature": z3.string(),
+  "diagnose-failure": z3.string(),
+  "eval-rubric": z3.string()
 });
-var ManifestSchema = z2.object({
-  run_id: z2.string(),
-  started_at: z2.string(),
-  git_sha: z2.string(),
-  tickets: z2.array(z2.string()).min(1),
-  stages: z2.array(StageSchema).min(1),
-  ticket_stages: z2.record(z2.string(), z2.array(StageSchema).min(1)),
+var ManifestSchema = z3.object({
+  run_id: z3.string(),
+  started_at: z3.string(),
+  git_sha: z3.string(),
+  tickets: z3.array(z3.string()).min(1),
+  stages: z3.array(StageSchema).min(1),
+  ticket_stages: z3.record(z3.string(), z3.array(StageSchema).min(1)),
   prompt_versions: PromptVersionsSchema,
-  flags: z2.object({
-    force: z2.boolean(),
+  flags: z3.object({
+    force: z3.boolean(),
     only_prompt: StageSchema.nullable(),
-    only_ticket: z2.string().nullable(),
-    judge_only: z2.boolean()
+    only_ticket: z3.string().nullable(),
+    judge_only: z3.boolean()
   })
 });
-var DimensionSchema = z2.object({
-  name: z2.string(),
+var DimensionSchema = z3.object({
+  name: z3.string(),
   verdict: VerdictSchema,
-  notes: z2.string()
+  notes: z3.string()
 });
-var JudgmentSchema = z2.object({
+var JudgmentSchema = z3.object({
   stage: StageSchema,
-  ticket: z2.string(),
-  dimensions: z2.array(DimensionSchema).min(1)
+  ticket: z3.string(),
+  dimensions: z3.array(DimensionSchema).min(1)
 });
-var JudgeScoresSchema = z2.object({
-  run_id: z2.string(),
-  judgments: z2.array(JudgmentSchema)
+var JudgeScoresSchema = z3.object({
+  run_id: z3.string(),
+  judgments: z3.array(JudgmentSchema)
 });
-var DeterministicEntrySchema = z2.object({
-  ticket: z2.string(),
+var DeterministicEntrySchema = z3.object({
+  ticket: z3.string(),
   stage: StageSchema,
-  passed: z2.boolean(),
-  checks: z2.array(z2.string()),
-  error: z2.string().optional()
+  passed: z3.boolean(),
+  checks: z3.array(z3.string()),
+  error: z3.string().optional()
 });
-var DeterministicScoresSchema = z2.object({
-  run_id: z2.string(),
-  entries: z2.array(DeterministicEntrySchema)
+var DeterministicScoresSchema = z3.object({
+  run_id: z3.string(),
+  entries: z3.array(DeterministicEntrySchema)
 });
-var ResultSchema = z2.object({
-  ticket: z2.string(),
+var ResultSchema = z3.object({
+  ticket: z3.string(),
   stage: StageSchema,
-  deterministic: z2.object({
-    passed: z2.boolean(),
-    checks: z2.array(z2.string()),
-    error: z2.string().optional()
+  deterministic: z3.object({
+    passed: z3.boolean(),
+    checks: z3.array(z3.string()),
+    error: z3.string().optional()
   }),
-  judge: z2.object({
-    passed: z2.boolean(),
-    dimensions: z2.array(DimensionSchema),
-    score: z2.number().min(0).max(1)
+  judge: z3.object({
+    passed: z3.boolean(),
+    dimensions: z3.array(DimensionSchema),
+    score: z3.number().min(0).max(1)
   }).nullable(),
-  skipped: z2.boolean().optional()
+  skipped: z3.boolean().optional()
 });
-var SummarySchema = z2.object({
-  run_id: z2.string(),
-  git_sha: z2.string(),
+var SummarySchema = z3.object({
+  run_id: z3.string(),
+  git_sha: z3.string(),
   prompt_versions: PromptVersionsSchema,
-  results: z2.array(ResultSchema),
-  overall: z2.object({
-    passed: z2.number().int().nonnegative(),
-    failed: z2.number().int().nonnegative(),
-    total: z2.number().int().nonnegative(),
-    score: z2.number().min(0).max(1)
+  results: z3.array(ResultSchema),
+  overall: z3.object({
+    passed: z3.number().int().nonnegative(),
+    failed: z3.number().int().nonnegative(),
+    total: z3.number().int().nonnegative(),
+    score: z3.number().min(0).max(1)
   })
 });
 
 // src/bin-internal/eval-deterministic.ts
 function checkFeatureFromStory(actualFeaturePath) {
-  if (!existsSync8(actualFeaturePath)) {
+  if (!existsSync10(actualFeaturePath)) {
     return { passed: false, checks: ["validate-feature"], error: "actual missing: test.feature" };
   }
   try {
@@ -8359,23 +8572,23 @@ function checkFeatureFromStory(actualFeaturePath) {
   }
 }
 function checkScriptFromFeature(actualTicketDir) {
-  const specPath = join8(actualTicketDir, "spec.ts");
-  if (!existsSync8(specPath)) {
+  const specPath = join10(actualTicketDir, "spec.ts");
+  if (!existsSync10(specPath)) {
     return { passed: false, checks: ["file-presence"], error: "actual missing: spec.ts" };
   }
   return { passed: true, checks: ["file-presence"] };
 }
 function checkDiagnoseFailure(inputsTicketDir, actualTicketDir) {
-  const inputPath = join8(inputsTicketDir, "classifier-input.json");
-  const actualPath = join8(actualTicketDir, "classification.json");
-  if (!existsSync8(actualPath)) {
+  const inputPath = join10(inputsTicketDir, "classifier-input.json");
+  const actualPath = join10(actualTicketDir, "classification.json");
+  if (!existsSync10(actualPath)) {
     return {
       passed: false,
       checks: ["bucket-match"],
       error: "actual missing: classification.json"
     };
   }
-  if (!existsSync8(inputPath)) {
+  if (!existsSync10(inputPath)) {
     return {
       passed: false,
       checks: ["bucket-match"],
@@ -8413,7 +8626,7 @@ async function evalDeterministicCmd(argv, opts = {}) {
     return 1;
   }
   const paths = resolveEvalPaths(cwd, runId);
-  if (!existsSync8(paths.manifest)) {
+  if (!existsSync10(paths.manifest)) {
     console.error(`[xera:eval-deterministic] missing manifest.json at ${paths.manifest}`);
     return 1;
   }
@@ -8425,7 +8638,7 @@ async function evalDeterministicCmd(argv, opts = {}) {
       const actualDir = paths.ticketActualDir(ticket);
       let result;
       if (stage === "feature-from-story") {
-        result = checkFeatureFromStory(join8(actualDir, "test.feature"));
+        result = checkFeatureFromStory(join10(actualDir, "test.feature"));
       } else if (stage === "script-from-feature") {
         result = checkScriptFromFeature(actualDir);
       } else {
@@ -8452,13 +8665,13 @@ async function evalDeterministicCmd(argv, opts = {}) {
 // src/bin-internal/eval-prepare.ts
 import {
   copyFileSync,
-  existsSync as existsSync10,
+  existsSync as existsSync12,
   mkdirSync as mkdirSync4,
   readdirSync as readdirSync5,
   readFileSync as readFileSync9,
   writeFileSync as writeFileSync4
 } from "fs";
-import { join as join9 } from "path";
+import { join as join11 } from "path";
 
 // src/eval/run-id.ts
 import { execSync } from "child_process";
@@ -8483,11 +8696,11 @@ function generateRunId(opts = {}) {
 }
 
 // src/lock/file-lock.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync3, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
+import { existsSync as existsSync11, mkdirSync as mkdirSync3, readFileSync as readFileSync8, unlinkSync, writeFileSync as writeFileSync3 } from "fs";
 import { hostname } from "os";
 import { dirname as dirname2 } from "path";
 function acquireLock(path, runId) {
-  if (existsSync9(path))
+  if (existsSync11(path))
     return false;
   mkdirSync3(dirname2(path), { recursive: true });
   const data = {
@@ -8504,11 +8717,11 @@ function acquireLock(path, runId) {
   }
 }
 function releaseLock(path) {
-  if (existsSync9(path))
+  if (existsSync11(path))
     unlinkSync(path);
 }
 function readLock(path) {
-  if (!existsSync9(path))
+  if (!existsSync11(path))
     return null;
   return JSON.parse(readFileSync8(path, "utf8"));
 }
@@ -8551,16 +8764,16 @@ function parseFlags2(argv) {
   return flags;
 }
 function readPromptVersion(repoRoot, name) {
-  const path = join9(repoRoot, "packages/prompts", `${name}.md`);
-  if (!existsSync10(path))
+  const path = join11(repoRoot, "packages/prompts", `${name}.md`);
+  if (!existsSync12(path))
     return "0.0.0";
   const text = readFileSync9(path, "utf8");
   const m = /^version:\s*(\S+)\s*$/m.exec(text);
   return m?.[1] ?? "0.0.0";
 }
 function discoverEvalTickets(repoRoot) {
-  const root = join9(repoRoot, "fixtures/golden-eval");
-  if (!existsSync10(root))
+  const root = join11(repoRoot, "fixtures/golden-eval");
+  if (!existsSync12(root))
     return [];
   const out = [];
   for (const entry of readdirSync5(root, { withFileTypes: true })) {
@@ -8568,9 +8781,9 @@ function discoverEvalTickets(repoRoot) {
       continue;
     if (entry.name === "README.md" || entry.name.startsWith("."))
       continue;
-    const dir = join9(root, entry.name);
-    const metaPath = join9(dir, "meta.json");
-    if (!existsSync10(metaPath))
+    const dir = join11(root, entry.name);
+    const metaPath = join11(dir, "meta.json");
+    if (!existsSync12(metaPath))
       continue;
     const meta = JSON.parse(readFileSync9(metaPath, "utf8"));
     out.push({ id: meta.id, dir, stages: meta.stages });
@@ -8578,14 +8791,14 @@ function discoverEvalTickets(repoRoot) {
   return out.sort((a, b) => a.id.localeCompare(b.id));
 }
 function discoverClassifierTickets(repoRoot) {
-  const root = join9(repoRoot, "fixtures/golden-tickets");
-  if (!existsSync10(root))
+  const root = join11(repoRoot, "fixtures/golden-tickets");
+  if (!existsSync12(root))
     return [];
   const out = [];
   for (const entry of readdirSync5(root, { withFileTypes: true })) {
     if (!entry.isFile() || !entry.name.endsWith(".json"))
       continue;
-    const path = join9(root, entry.name);
+    const path = join11(root, entry.name);
     const data = JSON.parse(readFileSync9(path, "utf8"));
     if (typeof data.ticket === "string")
       out.push({ id: data.ticket, path });
@@ -8645,7 +8858,7 @@ async function evalPrepareCmd(argv, opts = {}) {
     ...opts.getGitSha ? { getGitSha: opts.getGitSha } : {}
   });
   const paths = resolveEvalPaths(repoRoot, runId);
-  if (existsSync10(paths.root) && !flags.force) {
+  if (existsSync12(paths.root) && !flags.force) {
     console.error(`[xera:eval-prepare] run dir already exists: ${paths.root}. Pass --force to re-run.`);
     return 1;
   }
@@ -8657,13 +8870,13 @@ async function evalPrepareCmd(argv, opts = {}) {
     const evalT = evalTickets.find((t) => t.id === ticket);
     const classT = classifierTickets.find((t) => t.id === ticket);
     if (evalT) {
-      copyFileSync(join9(evalT.dir, "story.md"), join9(ticketInputs, "story.md"));
-      const featurePath = join9(evalT.dir, "golden/test.feature");
-      if (existsSync10(featurePath))
-        copyFileSync(featurePath, join9(ticketInputs, "test.feature"));
+      copyFileSync(join11(evalT.dir, "story.md"), join11(ticketInputs, "story.md"));
+      const featurePath = join11(evalT.dir, "golden/test.feature");
+      if (existsSync12(featurePath))
+        copyFileSync(featurePath, join11(ticketInputs, "test.feature"));
     }
     if (classT) {
-      copyFileSync(classT.path, join9(ticketInputs, "classifier-input.json"));
+      copyFileSync(classT.path, join11(ticketInputs, "classifier-input.json"));
     }
   }
   const now = (opts.now ?? (() => new Date))();
@@ -8699,7 +8912,7 @@ async function evalPrepareCmd(argv, opts = {}) {
 }
 
 // src/bin-internal/eval-report.ts
-import { existsSync as existsSync11, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
+import { existsSync as existsSync13, readFileSync as readFileSync10, writeFileSync as writeFileSync5 } from "fs";
 function scoreJudgment(j) {
   const nonNa = j.dimensions.filter((d) => d.verdict !== "NA");
   if (nonNa.length === 0)
@@ -8754,7 +8967,7 @@ async function evalReportCmd(argv, opts = {}) {
     return 1;
   }
   const paths = resolveEvalPaths(cwd, runId);
-  if (!existsSync11(paths.manifest)) {
+  if (!existsSync13(paths.manifest)) {
     console.error(`[xera:eval-report] missing manifest.json at ${paths.manifest}`);
     return 1;
   }
@@ -8841,40 +9054,77 @@ async function evalReportCmd(argv, opts = {}) {
 }
 
 // src/bin-internal/exec.ts
-import { existsSync as existsSync15, mkdirSync as mkdirSync7 } from "fs";
-import { join as join13 } from "path";
+import { existsSync as existsSync17, mkdirSync as mkdirSync8 } from "fs";
+import { join as join14 } from "path";
 import { chromium } from "@playwright/test";
 import { runAuthSetup, runPlaywright, stagePlaywrightState } from "@xera-ai/web";
 
+// src/artifact/meta.ts
+import { existsSync as existsSync14, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname3 } from "path";
+import { z as z4 } from "zod";
+var MetaJsonSchema = z4.object({
+  ticket: z4.string(),
+  adapter: z4.string(),
+  xera_version: z4.string(),
+  prompts_version: z4.string(),
+  fetched_at: z4.string().optional(),
+  story_hash: z4.string().optional(),
+  feature_generated_at: z4.string().optional(),
+  feature_generated_from_story_hash: z4.string().optional(),
+  feature_hash: z4.string().optional(),
+  script_generated_at: z4.string().optional(),
+  script_generated_from_feature_hash: z4.string().optional(),
+  script_warnings: z4.array(z4.string()).optional()
+});
+function readMeta(path) {
+  if (!existsSync14(path))
+    return null;
+  return MetaJsonSchema.parse(JSON.parse(readFileSync11(path, "utf8")));
+}
+function writeMeta(path, meta) {
+  mkdirSync5(dirname3(path), { recursive: true });
+  writeFileSync6(path, JSON.stringify(meta, null, 2));
+}
+function updateMeta(path, patch) {
+  const existing = readMeta(path);
+  if (!existing) {
+    throw new Error(`meta.json not found at ${path}; cannot update`);
+  }
+  const next = { ...existing, ...patch };
+  writeMeta(path, next);
+  return next;
+}
+
 // src/artifact/paths.ts
-import { join as join10 } from "path";
+import { join as join12 } from "path";
 var TICKET_RE = /^[A-Z][A-Z0-9_]*-\d+$|^SAMPLE-\d+$/;
 function resolveArtifactPaths(repoRoot, ticket) {
   if (!TICKET_RE.test(ticket)) {
     throw new Error(`Invalid ticket key: "${ticket}" (expected e.g. JIRA-123 or SAMPLE-001)`);
   }
-  const ticketDir = join10(repoRoot, ".xera", ticket);
+  const ticketDir = join12(repoRoot, ".xera", ticket);
   return {
     ticketDir,
-    storyPath: join10(ticketDir, "story.md"),
-    featurePath: join10(ticketDir, "test.feature"),
-    specPath: join10(ticketDir, "spec.ts"),
-    pageObjectsDir: join10(ticketDir, "page-objects"),
-    runsDir: join10(ticketDir, "runs"),
-    metaPath: join10(ticketDir, "meta.json"),
-    statusPath: join10(ticketDir, "status.json"),
-    logPath: join10(ticketDir, "xera.log"),
-    lockPath: join10(ticketDir, ".lock"),
-    authDir: join10(repoRoot, ".xera", ".auth"),
+    storyPath: join12(ticketDir, "story.md"),
+    featurePath: join12(ticketDir, "test.feature"),
+    specPath: join12(ticketDir, "spec.ts"),
+    pageObjectsDir: join12(ticketDir, "page-objects"),
+    runsDir: join12(ticketDir, "runs"),
+    metaPath: join12(ticketDir, "meta.json"),
+    statusPath: join12(ticketDir, "status.json"),
+    logPath: join12(ticketDir, "xera.log"),
+    lockPath: join12(ticketDir, ".lock"),
+    authDir: join12(repoRoot, ".xera", ".auth"),
     runPath: (runId) => {
-      const runDir = join10(ticketDir, "runs", runId);
+      const runDir = join12(ticketDir, "runs", runId);
       return {
         runDir,
-        reportJsonPath: join10(runDir, "report.json"),
-        tracePath: join10(runDir, "trace.zip"),
-        normalizedPath: join10(runDir, "normalized.json"),
-        screenshotsDir: join10(runDir, "screenshots"),
-        videoDir: join10(runDir, "videos")
+        reportJsonPath: join12(runDir, "report.json"),
+        tracePath: join12(runDir, "trace.zip"),
+        normalizedPath: join12(runDir, "normalized.json"),
+        screenshotsDir: join12(runDir, "screenshots"),
+        videoDir: join12(runDir, "videos")
       };
     }
   };
@@ -8912,9 +9162,9 @@ function needsRefresh(entry, policy, now = new Date) {
 }
 
 // src/auth/state.ts
-import { existsSync as existsSync12, mkdirSync as mkdirSync5, readFileSync as readFileSync11, writeFileSync as writeFileSync6 } from "fs";
-import { join as join11 } from "path";
-import { z as z3 } from "zod";
+import { existsSync as existsSync15, mkdirSync as mkdirSync6, readFileSync as readFileSync12, writeFileSync as writeFileSync7 } from "fs";
+import { join as join13 } from "path";
+import { z as z5 } from "zod";
 
 // src/auth/encrypt.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -8971,123 +9221,39 @@ function resolveAuthKey() {
 }
 
 // src/auth/state.ts
-var AuthStateEntrySchema = z3.object({
-  role: z3.string(),
-  strategy: z3.enum(["storageState", "apiToken"]),
-  created_at: z3.string(),
-  expires_at: z3.string(),
-  payload: z3.record(z3.string(), z3.unknown())
+var AuthStateEntrySchema = z5.object({
+  role: z5.string(),
+  strategy: z5.enum(["storageState", "apiToken"]),
+  created_at: z5.string(),
+  expires_at: z5.string(),
+  payload: z5.record(z5.string(), z5.unknown())
 });
 function pathFor(authDir, role) {
-  return join11(authDir, `${role}.json`);
+  return join13(authDir, `${role}.json`);
 }
 function writeAuthState(authDir, entry) {
-  mkdirSync5(authDir, { recursive: true });
+  mkdirSync6(authDir, { recursive: true });
   const ct = encrypt(JSON.stringify(entry), resolveAuthKey());
-  writeFileSync6(pathFor(authDir, entry.role), ct);
+  writeFileSync7(pathFor(authDir, entry.role), ct);
 }
 function readAuthState(authDir, role) {
   const p = pathFor(authDir, role);
-  if (!existsSync12(p))
+  if (!existsSync15(p))
     return null;
-  const txt = readFileSync11(p, "utf8");
+  const txt = readFileSync12(p, "utf8");
   const plain = decrypt(txt, resolveAuthKey());
   return AuthStateEntrySchema.parse(JSON.parse(plain));
 }
 
-// src/config/load.ts
-import { existsSync as existsSync13 } from "fs";
-import { join as join12 } from "path";
-import { pathToFileURL } from "url";
-
-// src/config/schema.ts
-import { z as z4 } from "zod";
-var AuthRoleSchema = z4.object({
-  envEmail: z4.string().min(1),
-  envPassword: z4.string().min(1)
-});
-var AuthSchema = z4.object({
-  strategy: z4.enum(["storageState", "apiToken", "none"]).default("none"),
-  ttl: z4.string().default("8h"),
-  refreshBuffer: z4.string().default("30m"),
-  setupScript: z4.string().optional(),
-  roles: z4.record(z4.string(), AuthRoleSchema).default({})
-});
-var WebSchema = z4.object({
-  baseUrl: z4.record(z4.string(), z4.string().url()).refine((m) => Object.keys(m).length > 0, {
-    message: "baseUrl must have at least one environment"
-  }),
-  defaultEnv: z4.string(),
-  auth: AuthSchema.prefault({}),
-  testData: z4.object({
-    users: z4.record(z4.string(), z4.object({ fromAuth: z4.string() })).default({})
-  }).prefault({})
-}).refine((w) => w.baseUrl[w.defaultEnv] !== undefined, {
-  message: "defaultEnv must exist in baseUrl map",
-  path: ["defaultEnv"]
-});
-var JiraSchema = z4.object({
-  baseUrl: z4.string().url(),
-  projectKeys: z4.array(z4.string().min(1)).min(1),
-  fields: z4.object({
-    story: z4.string().min(1),
-    acceptanceCriteria: z4.string().optional(),
-    attachments: z4.string().default("attachment")
-  })
-});
-var AISchema = z4.object({
-  livePageSnapshot: z4.boolean().default(true),
-  confidenceThreshold: z4.enum(["low", "medium", "high"]).default("medium"),
-  maxRetries: z4.object({
-    typecheck: z4.number().int().min(0).max(5).default(2),
-    lint: z4.number().int().min(0).max(5).default(2),
-    validateFeature: z4.number().int().min(0).max(5).default(2)
-  }).prefault({})
-}).prefault({});
-var ReportingSchema = z4.object({
-  language: z4.enum(["en", "vi"]).default("en"),
-  postToJira: z4.boolean().default(true),
-  transition: z4.object({
-    onPass: z4.string().nullable().default(null),
-    onFail: z4.string().nullable().default(null)
-  }).prefault({}),
-  artifactLinks: z4.enum(["git", "local"]).default("git")
-}).prefault({});
-var RunSchema = z4.object({
-  autoImpact: z4.object({
-    enabled: z4.boolean().default(true),
-    threshold: z4.number().nonnegative().default(8)
-  }).prefault({})
-}).prefault({});
-var XeraConfigSchema = z4.object({
-  jira: JiraSchema,
-  web: WebSchema,
-  ai: AISchema,
-  reporting: ReportingSchema,
-  run: RunSchema.prefault({}),
-  adapters: z4.array(z4.string().min(1)).min(1).default(["web"])
-});
-
-// src/config/load.ts
-async function loadConfig(cwd) {
-  const path = join12(cwd, "xera.config.ts");
-  if (!existsSync13(path)) {
-    throw new Error(`xera.config.ts not found in ${cwd}`);
-  }
-  const mod = await import(pathToFileURL(path).href);
-  const raw = mod.default ?? mod;
-  return XeraConfigSchema.parse(raw);
-}
-
 // src/logging/ndjson-logger.ts
-import { appendFileSync as appendFileSync2, existsSync as existsSync14, mkdirSync as mkdirSync6, readFileSync as readFileSync12 } from "fs";
-import { dirname as dirname3 } from "path";
+import { appendFileSync as appendFileSync2, existsSync as existsSync16, mkdirSync as mkdirSync7, readFileSync as readFileSync13 } from "fs";
+import { dirname as dirname4 } from "path";
 
 class NdjsonLogger {
   path;
   constructor(path) {
     this.path = path;
-    mkdirSync6(dirname3(path), { recursive: true });
+    mkdirSync7(dirname4(path), { recursive: true });
   }
   log(payload) {
     const entry = { ts: new Date().toISOString(), ...payload };
@@ -9095,9 +9261,9 @@ class NdjsonLogger {
 `);
   }
   static readAll(path) {
-    if (!existsSync14(path))
+    if (!existsSync16(path))
       return [];
-    const txt = readFileSync12(path, "utf8").trim();
+    const txt = readFileSync13(path, "utf8").trim();
     if (!txt)
       return [];
     return txt.split(`
@@ -9132,14 +9298,41 @@ async function execCmd(argv) {
   }
   const t0 = Date.now();
   try {
-    if (config.web.auth.strategy === "storageState" && config.web.auth.setupScript) {
+    const meta = readMeta(paths.metaPath);
+    const adapter = meta?.adapter ?? "web";
+    if (adapter === "http") {
+      if (!config.http) {
+        throw new Error("http adapter requires http config block");
+      }
+      const env = process.env["XERA_ENV"] ?? config.http.defaultEnv;
+      const { HttpAdapter } = await import("@xera-ai/http");
+      const result = await HttpAdapter.execute({
+        ticketDir: paths.ticketDir,
+        config,
+        runId,
+        env
+      });
+      log.log({
+        step: "exec.complete",
+        runId,
+        outcome: result.outcome,
+        elapsedMs: Date.now() - t0
+      });
+      console.log(`[xera:exec] runId=${runId} outcome=${result.outcome}`);
+      return result.outcome === "PASS" ? 0 : 3;
+    }
+    if (!config.web) {
+      throw new Error("web adapter requires web config block");
+    }
+    const webConfig = config.web;
+    if (webConfig.auth.strategy === "storageState" && webConfig.auth.setupScript) {
       const browser = await chromium.launch();
       try {
-        for (const [roleName, roleCreds] of Object.entries(config.web.auth.roles)) {
+        for (const [roleName, roleCreds] of Object.entries(webConfig.auth.roles)) {
           const entry = readAuthState(paths.authDir, roleName);
           if (needsRefresh(entry, {
-            ttl: config.web.auth.ttl,
-            refreshBuffer: config.web.auth.refreshBuffer
+            ttl: webConfig.auth.ttl,
+            refreshBuffer: webConfig.auth.refreshBuffer
           })) {
             const email = process.env[roleCreds.envEmail];
             const password = process.env[roleCreds.envPassword];
@@ -9150,7 +9343,7 @@ async function execCmd(argv) {
             await runAuthSetup({
               role: roleName,
               creds: { email, password },
-              setupScriptPath: join13(cwd, config.web.auth.setupScript),
+              setupScriptPath: join14(cwd, webConfig.auth.setupScript),
               authDir: paths.authDir,
               browser
             });
@@ -9161,23 +9354,23 @@ async function execCmd(argv) {
         await browser.close();
       }
     }
-    if (config.web.auth.strategy === "storageState") {
-      for (const roleName of Object.keys(config.web.auth.roles)) {
+    if (webConfig.auth.strategy === "storageState") {
+      for (const roleName of Object.keys(webConfig.auth.roles)) {
         if (readAuthState(paths.authDir, roleName)) {
           stagePlaywrightState(paths.authDir, roleName);
         }
       }
     }
-    const cfgPath = join13(cwd, "playwright.config.ts");
-    if (!existsSync15(cfgPath)) {
+    const cfgPath = join14(cwd, "playwright.config.ts");
+    if (!existsSync17(cfgPath)) {
       console.error(`[xera:exec] missing ${cfgPath}. Run \`xera init\` to scaffold it, then re-run.`);
       return 1;
     }
     const runDir = paths.runPath(runId).runDir;
-    mkdirSync7(runDir, { recursive: true });
-    const envName = process.env.XERA_ENV ?? config.web.defaultEnv;
-    const baseURL = config.web.baseUrl[envName] ?? config.web.baseUrl[config.web.defaultEnv];
-    const reportJsonPath = join13(runDir, "report.json");
+    mkdirSync8(runDir, { recursive: true });
+    const envName = process.env.XERA_ENV ?? webConfig.defaultEnv;
+    const baseURL = webConfig.baseUrl[envName] ?? webConfig.baseUrl[webConfig.defaultEnv];
+    const reportJsonPath = join14(runDir, "report.json");
     log.log({ step: "exec.start", runId, env: envName, baseURL });
     const r = await runPlaywright({
       specPath: paths.specPath,
@@ -9204,83 +9397,46 @@ import { dirname as dirname5 } from "path";
 
 // src/artifact/hash.ts
 import { createHash as createHash4 } from "crypto";
-import { existsSync as existsSync16, readFileSync as readFileSync13 } from "fs";
+import { existsSync as existsSync18, readFileSync as readFileSync14 } from "fs";
 function hashString(s) {
   return `sha256:${createHash4("sha256").update(s).digest("hex")}`;
 }
 function hashFile(path) {
-  return hashString(readFileSync13(path, "utf8"));
+  return hashString(readFileSync14(path, "utf8"));
 }
 function hashFileIfExists(path) {
-  if (!existsSync16(path))
+  if (!existsSync18(path))
     return null;
   return hashFile(path);
 }
 
-// src/artifact/meta.ts
-import { existsSync as existsSync17, mkdirSync as mkdirSync8, readFileSync as readFileSync14, writeFileSync as writeFileSync7 } from "fs";
-import { dirname as dirname4 } from "path";
-import { z as z5 } from "zod";
-var MetaJsonSchema = z5.object({
-  ticket: z5.string(),
-  adapter: z5.string(),
-  xera_version: z5.string(),
-  prompts_version: z5.string(),
-  fetched_at: z5.string().optional(),
-  story_hash: z5.string().optional(),
-  feature_generated_at: z5.string().optional(),
-  feature_generated_from_story_hash: z5.string().optional(),
-  feature_hash: z5.string().optional(),
-  script_generated_at: z5.string().optional(),
-  script_generated_from_feature_hash: z5.string().optional(),
-  script_warnings: z5.array(z5.string()).optional()
-});
-function readMeta(path) {
-  if (!existsSync17(path))
-    return null;
-  return MetaJsonSchema.parse(JSON.parse(readFileSync14(path, "utf8")));
-}
-function writeMeta(path, meta) {
-  mkdirSync8(dirname4(path), { recursive: true });
-  writeFileSync7(path, JSON.stringify(meta, null, 2));
-}
-function updateMeta(path, patch) {
-  const existing = readMeta(path);
-  if (!existing) {
-    throw new Error(`meta.json not found at ${path}; cannot update`);
-  }
-  const next = { ...existing, ...patch };
-  writeMeta(path, next);
-  return next;
-}
-
 // src/jira/mcp-backend.ts
-import { existsSync as existsSync18, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
+import { existsSync as existsSync19, mkdirSync as mkdirSync9, readFileSync as readFileSync15, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir } from "os";
-import { join as join14 } from "path";
+import { join as join15 } from "path";
 var MCP_ENV = "XERA_MCP_JIRA";
 async function createMcpBackend(_baseUrl) {
   if (process.env[MCP_ENV] !== "1")
     return null;
-  const tmpDir = join14(tmpdir(), "xera-mcp");
+  const tmpDir = join15(tmpdir(), "xera-mcp");
   mkdirSync9(tmpDir, { recursive: true });
   return {
     backend: "mcp",
     async fetchTicket(key, _fields) {
-      const cachePath = join14(tmpDir, `${key}.json`);
-      if (!existsSync18(cachePath)) {
+      const cachePath = join15(tmpDir, `${key}.json`);
+      if (!existsSync19(cachePath)) {
         throw new Error(`MCP-mode fetch requires the skill to first call mcp__atlassian__getJiraIssue and write ${cachePath}. ` + `If you are running this directly, unset ${MCP_ENV} to use REST.`);
       }
       const parsed = JSON.parse(readFileSync15(cachePath, "utf8"));
       return parsed;
     },
     async postComment(key, body) {
-      const outPath = join14(tmpDir, `${key}.comment.json`);
+      const outPath = join15(tmpDir, `${key}.comment.json`);
       writeFileSync8(outPath, JSON.stringify({ key, body }));
       return { id: "mcp-pending" };
     },
     async transitionStatus(key, statusName) {
-      const outPath = join14(tmpDir, `${key}.transition.json`);
+      const outPath = join15(tmpDir, `${key}.transition.json`);
       writeFileSync8(outPath, JSON.stringify({ key, statusName }));
     },
     async listFields(_sampleKey) {
@@ -9455,8 +9611,8 @@ init_graph_backfill();
 // src/graph/enrich.ts
 init_store();
 init_ulid();
-import { existsSync as existsSync19, readFileSync as readFileSync16 } from "fs";
-import { join as join15 } from "path";
+import { existsSync as existsSync20, readFileSync as readFileSync16 } from "fs";
+import { join as join16 } from "path";
 import { z as z6 } from "zod";
 var MAX_SIMILAR_EDGES = 10;
 var MIN_CONFIDENCE = 0.7;
@@ -9478,8 +9634,8 @@ var mk2 = (actor, type, payload) => ({
   payload
 });
 async function enrichTicket(repoRoot, ticketId, opts) {
-  const inputPath = join15(repoRoot, ".xera", ticketId, "enrichment-input.json");
-  if (!existsSync19(inputPath)) {
+  const inputPath = join16(repoRoot, ".xera", ticketId, "enrichment-input.json");
+  if (!existsSync20(inputPath)) {
     throw new Error(`enrichment-input.json not found at ${inputPath}`);
   }
   const raw = JSON.parse(readFileSync16(inputPath, "utf8"));
@@ -9592,11 +9748,11 @@ init_graph_record();
 
 // src/bin-internal/graph-render.ts
 import { mkdirSync as mkdirSync11, renameSync as renameSync2, writeFileSync as writeFileSync10 } from "fs";
-import { dirname as dirname7, join as join17 } from "path";
+import { dirname as dirname7, join as join18 } from "path";
 
 // src/graph/render.ts
 import { readFileSync as readFileSync17 } from "fs";
-import { dirname as dirname6, join as join16 } from "path";
+import { dirname as dirname6, join as join17 } from "path";
 import { fileURLToPath } from "url";
 var COLORS = {
   ticket: "#3B82F6",
@@ -9815,9 +9971,9 @@ function transformForVisNetwork(snap, opts) {
 }
 var __filename2 = fileURLToPath(import.meta.url);
 var __dirname2 = dirname6(__filename2);
-var TEMPLATES_DIR = join16(__dirname2, "templates");
+var TEMPLATES_DIR = join17(__dirname2, "templates");
 function loadTemplate(name) {
-  return readFileSync17(join16(TEMPLATES_DIR, name), "utf8");
+  return readFileSync17(join17(TEMPLATES_DIR, name), "utf8");
 }
 function statsToHuman(s) {
   return `${s.tickets} tickets \xB7 ${s.scenarios} scenarios \xB7 ${s.poms} POMs \xB7 ${s.edges} edges`;
@@ -9863,7 +10019,7 @@ async function graphRenderCmd(argv) {
       depth = parseDepth(argv[++i]);
   }
   const repoRoot = process.cwd();
-  const finalPath = outPath ?? join17(repoRoot, ".xera/graph.html");
+  const finalPath = outPath ?? join18(repoRoot, ".xera/graph.html");
   const snap = deriveSnapshot(loadAllEvents(repoRoot));
   const totalNodeCount = Object.keys(snap.tickets).length + Object.keys(snap.scenarios).length + Object.keys(snap.poms).length + Object.keys(snap.areas).length;
   const performanceMode = decidePerformanceMode(totalNodeCount);
@@ -9915,8 +10071,8 @@ async function graphSnapshotCmd(argv) {
 }
 
 // src/bin-internal/heal-prepare.ts
-import { existsSync as existsSync20, readdirSync as readdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
-import { join as join18 } from "path";
+import { existsSync as existsSync21, readdirSync as readdirSync6, readFileSync as readFileSync18, writeFileSync as writeFileSync11 } from "fs";
+import { join as join19 } from "path";
 import { scrubFreeText } from "@xera-ai/web";
 
 // ../../node_modules/.bun/fflate@0.8.3/node_modules/fflate/esm/index.mjs
@@ -10344,7 +10500,7 @@ function classifyKind(raw) {
   return "other";
 }
 function extractDomSnapshot(tracePath) {
-  if (!existsSync20(tracePath))
+  if (!existsSync21(tracePath))
     return "";
   const buf = readFileSync18(tracePath);
   const entries = unzipSync(buf);
@@ -10394,12 +10550,12 @@ function extractDomSnapshot(tracePath) {
   return scrubFreeText(html);
 }
 function findPomLine(ticketDir, rawLocator) {
-  const pomDir = join18(ticketDir, "page-objects");
+  const pomDir = join19(ticketDir, "page-objects");
   const candidates = [];
-  if (existsSync20(pomDir)) {
+  if (existsSync21(pomDir)) {
     for (const name of readdirSync6(pomDir)) {
       if (name.endsWith(".ts"))
-        candidates.push(join18(pomDir, name));
+        candidates.push(join19(pomDir, name));
     }
   }
   for (const file of candidates) {
@@ -10441,13 +10597,13 @@ function findGherkinStep(featureText, rawLocator) {
 }
 function healPrepare(repoRoot, ticket, runId, scenarioName) {
   const paths = resolveArtifactPaths(repoRoot, ticket);
-  const classifierPath = join18(paths.ticketDir, "classifier-input.json");
+  const classifierPath = join19(paths.ticketDir, "classifier-input.json");
   const classifier = JSON.parse(readFileSync18(classifierPath, "utf8"));
   const cls = classifier.scenarios.find((s) => s.name === scenarioName);
   if (!cls)
     throw new Error(`scenario not found in classifier-input: "${scenarioName}"`);
-  const runDir = join18(paths.runsDir, runId);
-  const normalized = JSON.parse(readFileSync18(join18(runDir, "normalized.json"), "utf8"));
+  const runDir = join19(paths.runsDir, runId);
+  const normalized = JSON.parse(readFileSync18(join19(runDir, "normalized.json"), "utf8"));
   const normSc = normalized.scenarios.find((s) => s.name === scenarioName);
   if (!normSc?.failure)
     throw new Error(`no failure recorded for scenario "${scenarioName}"`);
@@ -10460,7 +10616,7 @@ function healPrepare(repoRoot, ticket, runId, scenarioName) {
   const pomLoc = findPomLine(paths.ticketDir, raw);
   const featureText = readFileSync18(paths.featurePath, "utf8");
   const gherkinStep = findGherkinStep(featureText, raw);
-  const domSnapshotAtFailure = extractDomSnapshot(join18(runDir, "trace.zip"));
+  const domSnapshotAtFailure = extractDomSnapshot(join19(runDir, "trace.zip"));
   return {
     ticket,
     runId,
@@ -10480,7 +10636,7 @@ async function healPrepareCmd(argv) {
   try {
     const result = healPrepare(process.cwd(), ticket, runId, scenarioName);
     const paths = resolveArtifactPaths(process.cwd(), ticket);
-    const outPath = join18(paths.runsDir, runId, "heal-input.json");
+    const outPath = join19(paths.runsDir, runId, "heal-input.json");
     writeFileSync11(outPath, JSON.stringify(result, null, 2));
     console.log(`[xera:heal-prepare] wrote ${outPath}`);
     return 0;
@@ -10492,7 +10648,7 @@ async function healPrepareCmd(argv) {
 
 // src/bin-internal/impact-prepare.ts
 import { mkdirSync as mkdirSync12, writeFileSync as writeFileSync12 } from "fs";
-import { join as join19 } from "path";
+import { join as join20 } from "path";
 
 // src/graph/impact.ts
 var PRIORITY_WEIGHT = { p0: 3, p1: 2, p2: 1 };
@@ -10742,11 +10898,11 @@ async function impactPrepareCmd(argv) {
     scenarios,
     generatedAt: new Date().toISOString()
   };
-  const impactDir = join19(repoRoot, ".xera/impact");
+  const impactDir = join20(repoRoot, ".xera/impact");
   mkdirSync12(impactDir, { recursive: true });
-  writeFileSync12(join19(impactDir, `${ticket}.json`), JSON.stringify(report, null, 2));
+  writeFileSync12(join20(impactDir, `${ticket}.json`), JSON.stringify(report, null, 2));
   if (!quiet) {
-    writeFileSync12(join19(impactDir, `${ticket}.md`), renderImpactMarkdown(report));
+    writeFileSync12(join20(impactDir, `${ticket}.md`), renderImpactMarkdown(report));
   }
   return 0;
 }
@@ -10771,9 +10927,8 @@ async function lintCmd(argv) {
 }
 
 // src/bin-internal/normalize.ts
-import { existsSync as existsSync21, readdirSync as readdirSync7 } from "fs";
-import { join as join20 } from "path";
-import { normalizeRun } from "@xera-ai/web";
+import { existsSync as existsSync22, readdirSync as readdirSync7 } from "fs";
+import { join as join21 } from "path";
 async function normalizeCmd(argv) {
   const ticket = argv[0];
   if (!ticket) {
@@ -10787,22 +10942,31 @@ async function normalizeCmd(argv) {
     console.error("[xera:normalize] no run found");
     return 1;
   }
-  const runDir = join20(paths.runsDir, runId);
-  if (!existsSync21(runDir)) {
+  const runDir = join21(paths.runsDir, runId);
+  if (!existsSync22(runDir)) {
     console.error(`[xera:normalize] runs/${runId} missing`);
     return 1;
   }
+  const meta = readMeta(paths.metaPath);
+  const adapter = meta?.adapter ?? "web";
+  if (adapter === "http") {
+    const { normalizeHttpRun } = await import("@xera-ai/http");
+    await normalizeHttpRun({ runId, runDir });
+    console.log(`[xera:normalize] wrote normalized.json (http)`);
+    return 0;
+  }
+  const { normalizeRun } = await import("@xera-ai/web");
   const r = await normalizeRun({ runId, runDir });
   console.log(`[xera:normalize] wrote normalized.json (scrubbed_fields_count=${r.scrubbed_fields_count})`);
   return 0;
 }
 
 // src/bin-internal/post.ts
-import { existsSync as existsSync23, readFileSync as readFileSync20 } from "fs";
-import { join as join21 } from "path";
+import { existsSync as existsSync24, readFileSync as readFileSync20 } from "fs";
+import { join as join22 } from "path";
 
 // src/artifact/status.ts
-import { existsSync as existsSync22, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
+import { existsSync as existsSync23, mkdirSync as mkdirSync13, readFileSync as readFileSync19, writeFileSync as writeFileSync13 } from "fs";
 import { dirname as dirname8 } from "path";
 import { z as z7 } from "zod";
 var ClassificationEnum = z7.enum([
@@ -10811,7 +10975,10 @@ var ClassificationEnum = z7.enum([
   "SELECTOR_DRIFT",
   "FLAKY",
   "TEST_BUG",
-  "TEST_OUTDATED"
+  "TEST_OUTDATED",
+  "CONTRACT_DRIFT",
+  "RATE_LIMITED",
+  "AUTH_EXPIRED"
 ]);
 var ResultEnum = z7.enum(["PASS", "FAIL"]);
 var ConfidenceEnum = z7.enum(["low", "medium", "high"]);
@@ -10837,7 +11004,7 @@ var StatusJsonSchema = z7.object({
 });
 var HISTORY_CAP = 20;
 function readStatus(path) {
-  if (!existsSync22(path))
+  if (!existsSync23(path))
     return null;
   return StatusJsonSchema.parse(JSON.parse(readFileSync19(path, "utf8")));
 }
@@ -10869,8 +11036,8 @@ async function postCmd(argv) {
     return 0;
   }
   const paths = resolveArtifactPaths(cwd, ticket);
-  const draftPath = join21(paths.ticketDir, "jira-comment.draft.md");
-  if (!existsSync23(draftPath)) {
+  const draftPath = join22(paths.ticketDir, "jira-comment.draft.md");
+  if (!existsSync24(draftPath)) {
     console.error(`[xera:post] no draft at ${draftPath}; run \`xera-internal report\` first.`);
     return 1;
   }
@@ -10902,12 +11069,15 @@ async function promoteCmd(argv) {
 }
 
 // src/bin-internal/report.ts
-import { existsSync as existsSync25, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "fs";
-import { join as join22 } from "path";
+import { existsSync as existsSync26, readFileSync as readFileSync21, writeFileSync as writeFileSync14 } from "fs";
+import { join as join23 } from "path";
 
 // src/classifier/aggregate.ts
 var CLASS_PRIORITY = [
   "REAL_BUG",
+  "CONTRACT_DRIFT",
+  "AUTH_EXPIRED",
+  "RATE_LIMITED",
   "TEST_OUTDATED",
   "TEST_BUG",
   "SELECTOR_DRIFT",
@@ -10934,6 +11104,134 @@ function aggregateScenarios(scenarios) {
   return { overall: chosen, overallConfidence: minConf, scenarios };
 }
 
+// src/classifier/auth-expired.ts
+function jwtExpPast(jwt, now) {
+  const parts = jwt.split(".");
+  if (parts.length !== 3)
+    return false;
+  try {
+    const payloadB64 = parts[1];
+    if (!payloadB64)
+      return false;
+    const payload = JSON.parse(Buffer.from(payloadB64, "base64url").toString("utf8"));
+    return typeof payload.exp === "number" && payload.exp * 1000 < now;
+  } catch {
+    return false;
+  }
+}
+function classifyAuthExpired(input) {
+  const has401 = input.calls.some((c) => c.status === 401);
+  if (!has401)
+    return null;
+  const now = Date.now();
+  for (const [role, entry] of Object.entries(input.authFiles)) {
+    const fileExpired = new Date(entry.expires_at).getTime() < now;
+    const jwtExpired = entry.type === "bearer" && jwtExpPast(entry.token, now);
+    if (fileExpired || jwtExpired) {
+      return {
+        class: "AUTH_EXPIRED",
+        rationale: `HTTP 401 captured; auth file for role '${role}' is past expiry. Run: bun run xera:auth-setup --role ${role}`
+      };
+    }
+  }
+  return null;
+}
+
+// src/classifier/contract-drift.ts
+function matchPath(specPaths, actualUrl) {
+  const path = actualUrl.split("?")[0] ?? actualUrl;
+  for (const tmpl of specPaths) {
+    const re = new RegExp(`^${tmpl.replace(/\{[^}]+\}/g, "[^/]+")}$`);
+    if (re.test(path))
+      return tmpl;
+  }
+  return null;
+}
+function matchesSchema(body, schema) {
+  if (!schema)
+    return true;
+  if (schema.type === "object") {
+    if (typeof body !== "object" || body === null || Array.isArray(body))
+      return false;
+    const obj = body;
+    for (const req of schema.required ?? []) {
+      if (!(req in obj))
+        return false;
+    }
+    return true;
+  }
+  if (schema.type === "array")
+    return Array.isArray(body);
+  if (schema.type === "string")
+    return typeof body === "string";
+  if (schema.type === "integer" || schema.type === "number")
+    return typeof body === "number";
+  if (schema.type === "boolean")
+    return typeof body === "boolean";
+  if (schema.type === "null")
+    return body === null;
+  return true;
+}
+var VERBS = ["get", "post", "put", "patch", "delete"];
+function isVerb(s) {
+  return VERBS.includes(s);
+}
+function classifyContractDrift(input) {
+  if (input.openapi === null)
+    return null;
+  const specPaths = Object.keys(input.openapi.paths);
+  for (const call of input.calls) {
+    const tmpl = matchPath(specPaths, call.url);
+    if (!tmpl) {
+      return {
+        class: "CONTRACT_DRIFT",
+        rationale: `Endpoint ${call.method} ${call.url} not found in OpenAPI`
+      };
+    }
+    const methodLower = call.method.toLowerCase();
+    if (!isVerb(methodLower)) {
+      return {
+        class: "CONTRACT_DRIFT",
+        rationale: `Method ${call.method} not supported by classifier for ${tmpl}`
+      };
+    }
+    const pathItem = input.openapi.paths[tmpl];
+    const op = pathItem?.[methodLower];
+    if (!op) {
+      return {
+        class: "CONTRACT_DRIFT",
+        rationale: `${call.method} not defined for ${tmpl} in OpenAPI`
+      };
+    }
+    const respDef = op.responses?.[String(call.status)];
+    if (!respDef) {
+      return {
+        class: "CONTRACT_DRIFT",
+        rationale: `Status ${call.status} not enumerated for ${call.method} ${tmpl} in OpenAPI`
+      };
+    }
+    const schema = respDef.content?.["application/json"]?.schema;
+    if (!matchesSchema(call.respBody, schema)) {
+      return {
+        class: "CONTRACT_DRIFT",
+        rationale: `Response body for ${call.method} ${tmpl} (${call.status}) does not match OpenAPI schema`
+      };
+    }
+  }
+  return null;
+}
+
+// src/classifier/rate-limited.ts
+function classifyRateLimited(input) {
+  const hit = input.calls.find((c) => c.status === 429);
+  if (!hit)
+    return null;
+  return {
+    class: "RATE_LIMITED",
+    rationale: `Captured HTTP 429 on ${hit.method} ${hit.url}`
+  };
+}
+
 // src/graph/classify.ts
 var DEFAULT_THRESHOLD = 0.7;
 var SHORT_CIRCUIT = ["FLAKY", "PASS"];
@@ -11038,11 +11336,11 @@ xera v${input.xeraVersion} \u2022 prompts v${input.promptsVersion}`;
 }
 
 // src/reporter/status-writer.ts
-import { existsSync as existsSync24 } from "fs";
+import { existsSync as existsSync25 } from "fs";
 function writeStatusFromClassification(path, input) {
   const result = input.classification.overall === "PASS" ? "PASS" : "FAIL";
   const entry = { ts: input.runTs, result, class: input.classification.overall };
-  if (!existsSync24(path)) {
+  if (!existsSync25(path)) {
     writeStatus(path, {
       ticket: input.ticket,
       lastRun: input.runTs,
@@ -11074,11 +11372,70 @@ async function reportCmd(argv) {
     console.error("[xera:report] usage: report <TICKET> --input=<classifier-output.json>");
     return 1;
   }
-  const paths = resolveArtifactPaths(process.cwd(), ticket);
+  const cwd = process.cwd();
+  const paths = resolveArtifactPaths(cwd, ticket);
   const input = JSON.parse(readFileSync21(inputArg.slice("--input=".length), "utf8"));
-  const aggregated = aggregateScenarios(input.scenarios);
-  const decisionsPath = join22(paths.ticketDir, "runs", input.runId, "outdated-decisions.json");
-  const decisions = existsSync25(decisionsPath) ? JSON.parse(readFileSync21(decisionsPath, "utf8")) : {};
+  let httpRuleOverride = null;
+  const meta = readMeta(paths.metaPath);
+  if (meta?.adapter === "http") {
+    const config = await loadConfig(cwd);
+    if (config.http) {
+      const normalizedPath = join23(paths.ticketDir, "runs", input.runId, "normalized.json");
+      if (existsSync26(normalizedPath)) {
+        const norm = JSON.parse(readFileSync21(normalizedPath, "utf8"));
+        const calls = norm.http?.calls ?? [];
+        const rate = classifyRateLimited({ calls });
+        if (rate)
+          httpRuleOverride = rate;
+        if (!httpRuleOverride) {
+          const authFiles = {};
+          const httpAuthDir = join23(cwd, ".xera", ".auth", "http");
+          for (const role of Object.keys(config.http.auth.roles)) {
+            const entry = readAuthState(httpAuthDir, role);
+            if (entry) {
+              const p = entry.payload;
+              if (typeof p.token === "string" && typeof p.type === "string") {
+                authFiles[role] = {
+                  token: p.token,
+                  type: p.type,
+                  expires_at: entry.expires_at
+                };
+              }
+            }
+          }
+          const authExp = classifyAuthExpired({ calls, authFiles });
+          if (authExp)
+            httpRuleOverride = authExp;
+        }
+        if (!httpRuleOverride && config.http.spec) {
+          const { loadOpenApi } = await import("@xera-ai/http");
+          const openapi = await loadOpenApi(config.http.spec);
+          if (openapi) {
+            const drift = classifyContractDrift({
+              calls: calls.map((c) => ({
+                method: c.method,
+                url: c.url,
+                status: c.status,
+                respBody: c.respBody
+              })),
+              openapi
+            });
+            if (drift)
+              httpRuleOverride = drift;
+          }
+        }
+      }
+    }
+  }
+  const scenariosForAggregation = httpRuleOverride ? input.scenarios.map((s) => s.outcome === "FAIL" ? {
+    ...s,
+    class: httpRuleOverride.class,
+    rationale: httpRuleOverride.rationale,
+    confidence: "high"
+  } : s) : input.scenarios;
+  const aggregated = aggregateScenarios(scenariosForAggregation);
+  const decisionsPath = join23(paths.ticketDir, "runs", input.runId, "outdated-decisions.json");
+  const decisions = existsSync26(decisionsPath) ? JSON.parse(readFileSync21(decisionsPath, "utf8")) : {};
   const graph = deriveSnapshot(loadAllEvents(process.cwd()));
   const normalizeScenarioName = (name) => name.trim().toLowerCase().replace(/\s+/g, " ");
   const scenarioIdByName = {};
@@ -11126,7 +11483,7 @@ async function reportCmd(argv) {
     xeraVersion: "0.1.0",
     promptsVersion: "1.0.0"
   });
-  const draftPath = join22(paths.ticketDir, "jira-comment.draft.md");
+  const draftPath = join23(paths.ticketDir, "jira-comment.draft.md");
   writeFileSync14(draftPath, md);
   console.log(`[xera:report] wrote status.json and ${draftPath}`);
   return 0;
@@ -11194,7 +11551,7 @@ async function unlockCmd(argv) {
 }
 
 // src/bin-internal/validate-feature.ts
-import { existsSync as existsSync26, readFileSync as readFileSync22 } from "fs";
+import { existsSync as existsSync27, readFileSync as readFileSync22 } from "fs";
 import { validateGherkin as validateGherkin2 } from "@xera-ai/web";
 async function validateFeatureCmd(argv) {
   const ticket = argv[0];
@@ -11203,7 +11560,7 @@ async function validateFeatureCmd(argv) {
     return 1;
   }
   const paths = resolveArtifactPaths(process.cwd(), ticket);
-  if (!existsSync26(paths.featurePath)) {
+  if (!existsSync27(paths.featurePath)) {
     console.error(`[xera:validate-feature] missing ${paths.featurePath}`);
     return 1;
   }
@@ -11219,6 +11576,7 @@ async function validateFeatureCmd(argv) {
 
 // src/bin-internal/index.ts
 var COMMANDS = {
+  "auth-setup": authSetupCmd,
   disputes: disputesCmd,
   doctor: doctorCmd,
   "eval-deterministic": evalDeterministicCmd,