blastproof 0.1.0

package/dist/cli.js

@@ -0,0 +1,2067 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command, InvalidArgumentError } from "commander";
+
+// src/commands/init.ts
+import { mkdir, writeFile } from "fs/promises";
+import path from "path";
+import { access } from "fs/promises";
+var DEFAULT_CONFIG = `# blastproof configuration
+# Docs: https://github.com/hamc/blastproof
+
+# Base URL of the app under test. Relative navigate paths resolve against it.
+base_url: http://localhost:4173
+
+llm:
+  # anthropic | openai | ollama
+  provider: anthropic
+  # Optional. Defaults: anthropic=claude-haiku-4-5, openai=gpt-4o-mini, ollama=qwen2.5
+  # model: claude-haiku-4-5
+  # Env var holding your API key (not needed for ollama).
+  api_key_env: ANTHROPIC_API_KEY
+  # OpenAI-compatible endpoint: required for ollama (http://localhost:11434/v1);
+  # with provider "openai" it enables compatible gateways, e.g. OpenRouter:
+  # base_url: https://openrouter.ai/api/v1   (model e.g. anthropic/claude-haiku-4.5)
+
+browser:
+  headless: true
+  timeout_ms: 30000
+
+# Budget of self-healing retries per step (element re-resolution via accessibility tree).
+# max_retries_per_step: 3
+
+# Impact hints mapping file globs to routes (used by \`blastproof run --impacted\`).
+routes:
+  "src/auth/**": ["/login"]
+  "src/cart/**": ["/cart", "/checkout"]
+
+# Files knowingly irrelevant to any route. Nothing is ignored by default: a file
+# nobody has classified is exactly the risk \`--fail-on-unmapped\` exists to surface,
+# so the list is yours to state rather than ours to guess.
+# ignore:
+#   - "**/*.md"
+#   - "docs/**"
+#   - ".github/**"
+#   - "LICENSE"
+
+# Optional: authenticate once per run so tests and \`plan\` reach pages behind a login.
+# Pick exactly ONE strategy. Credentials come from the environment via {{env.VAR}} \u2014
+# never write them here. A test can opt out with \`auth: false\` (a login test must).
+#
+# 1) A plain-English login journey, executed once (form login, any clickable flow):
+# auth:
+#   steps:
+#     - navigate to /login
+#     - fill the email field with {{env.TEST_EMAIL}}
+#     - fill the password field with {{env.TEST_PASSWORD}}
+#     - submit the login form
+#   verify: a signed-in indicator is visible   # optional, but turns N failures into 1
+#
+# 2) A session captured by hand \u2014 for SSO, MFA or magic links, which cannot be
+#    automated honestly. The file holds live session cookies: NEVER commit it.
+# auth:
+#   storage_state: .blastproof/auth.json
+#
+# 3) Static values, for token-based apps where driving a UI would be theatre:
+# auth:
+#   headers:
+#     Authorization: "Bearer {{env.API_TOKEN}}"
+
+# CI tip: these settings can be overridden from the environment, so you never have
+# to commit a provider choice just to configure a pipeline. Precedence is
+# CLI flag > environment > this file.
+#   BLASTPROOF_BASE_URL          the app under test
+#   BLASTPROOF_LLM_PROVIDER      anthropic | openai | ollama
+#   BLASTPROOF_LLM_MODEL
+#   BLASTPROOF_LLM_BASE_URL      the provider endpoint (not the app)
+#   BLASTPROOF_LLM_API_KEY_ENV   name of the variable holding your key, never the key
+`;
+var SAMPLE_TEST = `summary: App loads and shows the home page
+priority: P1
+tags: [smoke]
+# Routes this test covers; run --impacted selects tests by these routes.
+routes: ["/"]
+steps:
+  - verify the home page loads and shows a heading
+`;
+var GITIGNORE = `# blastproof runtime artifacts
+reports/
+sessions/
+
+# Captured sessions are live credentials \u2014 never commit them.
+.auth-state.json
+auth.json
+`;
+var SAMPLE_LOGIN_TEST = `summary: Login with valid credentials succeeds
+priority: P0
+tags: [smoke, auth]
+routes: ["/login"]
+# This test exercises the login itself, so it must start signed out even when an
+# auth recipe is configured.
+auth: false
+steps:
+  - navigate to /login
+  - fill the email field with demo@blastproof.dev
+  - fill the password field with demo123
+  - submit the login form
+  - verify a welcome message is shown
+# Secrets tip: use {{env.VAR_NAME}} placeholders in steps (e.g. {{env.TEST_PASSWORD}})
+# and export the variable before running. Values are masked as *** in all output.
+`;
+async function exists(file) {
+  try {
+    await access(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function writeIfAbsent(file, content, result) {
+  if (await exists(file)) {
+    result.kept.push(file);
+    return;
+  }
+  await mkdir(path.dirname(file), { recursive: true });
+  await writeFile(file, content);
+  result.created.push(file);
+}
+async function initProject(cwd = process.cwd()) {
+  const result = { created: [], kept: [] };
+  const root = path.join(cwd, ".blastproof");
+  await writeIfAbsent(path.join(root, ".gitignore"), GITIGNORE, result);
+  await writeIfAbsent(path.join(root, "config.yaml"), DEFAULT_CONFIG, result);
+  await writeIfAbsent(path.join(root, "tests", "app-load.yaml"), SAMPLE_TEST, result);
+  await writeIfAbsent(path.join(root, "tests", "login.yaml"), SAMPLE_LOGIN_TEST, result);
+  return result;
+}
+function formatInitGuidance(result) {
+  const lines = [];
+  if (result.created.length > 0) {
+    lines.push("Created:");
+    for (const file of result.created) lines.push(`  ${file}`);
+  }
+  if (result.kept.length > 0) {
+    lines.push("Kept existing (not overwritten):");
+    for (const file of result.kept) lines.push(`  ${file}`);
+  }
+  lines.push(
+    "",
+    "Next steps:",
+    "  1. Set your LLM API key:  export ANTHROPIC_API_KEY=...   (or OPENAI_API_KEY; ollama needs no key)",
+    "  2. Point base_url at your app in .blastproof/config.yaml",
+    "  3. Run your tests:        blastproof run",
+    "",
+    "First time with Playwright? Install the browser:  npx playwright install chromium"
+  );
+  return lines.join("\n");
+}
+
+// src/commands/plan.ts
+import path10 from "path";
+import { chromium as chromium2 } from "playwright";
+
+// src/auth.ts
+import { readFile, writeFile as writeFile2, mkdir as mkdir3 } from "fs/promises";
+import path3 from "path";
+
+// src/runner/env.ts
+var ENV_PLACEHOLDER = /\{\{\s*env\.([A-Za-z_][A-Za-z0-9_]*)\s*\}\}/g;
+var MissingEnvError = class extends Error {
+  constructor(variable) {
+    super(
+      `Environment variable ${variable} is referenced via {{env.${variable}}} but is not set. Export it before running, e.g. \`export ${variable}=...\`.`
+    );
+    this.name = "MissingEnvError";
+  }
+};
+function substituteEnv(text, env = process.env) {
+  return text.replace(ENV_PLACEHOLDER, (_match, name) => {
+    const value = env[name];
+    if (value === void 0) {
+      throw new MissingEnvError(name);
+    }
+    return value;
+  });
+}
+function referencedEnvVars(text) {
+  const names = /* @__PURE__ */ new Set();
+  for (const match of text.matchAll(ENV_PLACEHOLDER)) {
+    if (match[1]) names.add(match[1]);
+  }
+  return [...names];
+}
+function escapeRegExp(value) {
+  return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function maskSecrets(text, secrets) {
+  const ordered = [...secrets].filter(Boolean).sort((a, b) => b.length - a.length);
+  let masked = text;
+  for (const secret of ordered) {
+    masked = masked.replace(new RegExp(escapeRegExp(secret), "g"), "***");
+  }
+  return masked;
+}
+var SecretsMask = class {
+  secrets = /* @__PURE__ */ new Set();
+  /** Registers the current values of the env vars referenced in `text`. Throws MissingEnvError on unset vars. */
+  registerFrom(text, env = process.env) {
+    for (const name of referencedEnvVars(text)) {
+      const value = env[name];
+      if (value === void 0) {
+        throw new MissingEnvError(name);
+      }
+      this.secrets.add(value);
+    }
+  }
+  mask(text) {
+    return maskSecrets(text, this.secrets);
+  }
+};
+
+// src/runner/executor.ts
+import { mkdir as mkdir2 } from "fs/promises";
+import path2 from "path";
+
+// src/runner/actions.ts
+var ActionError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ActionError";
+  }
+};
+function describeTarget(target) {
+  const parts = [];
+  if (target.role) parts.push(`role=${target.role}`);
+  if (target.name) parts.push(`name="${target.name}"`);
+  if (target.text) parts.push(`text="${target.text}"`);
+  return parts.join(" ") || "(no target)";
+}
+async function resolveTarget(page, target, resolveTimeoutMs = 2e3) {
+  const candidates = [];
+  if (target.role) {
+    candidates.push(page.getByRole(target.role, target.name ? { name: target.name } : {}));
+  }
+  if (target.name) {
+    candidates.push(page.getByLabel(target.name));
+  }
+  const text = target.text ?? target.name;
+  if (text) {
+    candidates.push(page.getByText(text));
+  }
+  for (const candidate of candidates) {
+    const locator = candidate.first();
+    try {
+      await locator.waitFor({ state: "visible", timeout: resolveTimeoutMs });
+      return locator;
+    } catch {
+    }
+  }
+  throw new ActionError(`Element not found: ${describeTarget(target)}`);
+}
+function requireTarget(action) {
+  if (!action.target || !action.target.role && !action.target.name && !action.target.text) {
+    throw new ActionError(`Action "${action.action}" requires a target (role/name/text)`);
+  }
+  return action.target;
+}
+function requireValue(action) {
+  if (action.value === void 0 || action.value === "") {
+    throw new ActionError(`Action "${action.action}" requires a value`);
+  }
+  return action.value;
+}
+async function performAction(page, action, ctx) {
+  switch (action.action) {
+    case "navigate": {
+      const value = requireValue(action);
+      const url = new URL(value, ctx.baseUrl).toString();
+      await page.goto(url, { timeout: 3e4 });
+      return `ok: navigated to ${url}`;
+    }
+    case "click": {
+      const target = requireTarget(action);
+      const locator = await resolveTarget(page, target, ctx.resolveTimeoutMs);
+      await locator.click();
+      return `ok: clicked ${describeTarget(target)}`;
+    }
+    case "fill": {
+      const target = requireTarget(action);
+      const value = requireValue(action);
+      const locator = await resolveTarget(page, target, ctx.resolveTimeoutMs);
+      await locator.fill(value);
+      return `ok: filled ${describeTarget(target)}`;
+    }
+    case "press": {
+      const key = action.value ?? "Enter";
+      if (action.target && (action.target.role || action.target.name || action.target.text)) {
+        const locator = await resolveTarget(page, action.target, ctx.resolveTimeoutMs);
+        await locator.press(key);
+        return `ok: pressed ${key} on ${describeTarget(action.target)}`;
+      }
+      await page.keyboard.press(key);
+      return `ok: pressed ${key}`;
+    }
+    case "select": {
+      const target = requireTarget(action);
+      const value = requireValue(action);
+      const locator = await resolveTarget(page, target, ctx.resolveTimeoutMs);
+      await locator.selectOption({ label: value });
+      return `ok: selected "${value}" in ${describeTarget(target)}`;
+    }
+    case "assert":
+    case "done":
+    case "fail":
+      throw new ActionError(`Action "${action.action}" is handled by the executor, not the page`);
+  }
+}
+
+// src/runner/executor.ts
+async function defaultSnapshot(page) {
+  const { captureSnapshot } = await import("./snapshot-CAIB2OHX.js");
+  return captureSnapshot(page);
+}
+function slugify(text) {
+  const slug = text.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  return slug || "test";
+}
+var StepFailure = class extends Error {
+};
+async function executeTest(page, test, options) {
+  const {
+    brain,
+    sessionDir,
+    baseUrl,
+    maxRetries = 3,
+    maxIterationsPerStep = 15,
+    mask = (s) => s,
+    snapshot = defaultSnapshot,
+    onEvent = () => {
+    }
+  } = options;
+  const startedAt = Date.now();
+  const stepResults = [];
+  const allSteps = [
+    ...(test.setup ?? []).map((step) => ({ step, setup: true })),
+    ...test.steps.map((step) => ({ step, setup: false }))
+  ];
+  const emitAction = (index, action, result) => {
+    const maskedAction = {
+      ...action,
+      value: action.value === void 0 ? void 0 : mask(action.value),
+      reasoning: mask(action.reasoning),
+      expectation: action.expectation === void 0 ? void 0 : mask(action.expectation)
+    };
+    onEvent({ type: "action", index, action: maskedAction, result: mask(result) });
+  };
+  let failure;
+  await page.goto(new URL(baseUrl).toString());
+  for (let index = 0; index < allSteps.length; index++) {
+    const { step, setup } = allSteps[index];
+    const stepStartedAt = Date.now();
+    onEvent({ type: "step-start", index, total: allSteps.length, step: mask(step), setup });
+    let iterations = 0;
+    let failedAttempts = 0;
+    let lastResult;
+    let stepFailedReason;
+    try {
+      while (true) {
+        if (iterations >= maxIterationsPerStep) {
+          throw new StepFailure(`step exceeded ${maxIterationsPerStep} actions without completing`);
+        }
+        const snap = await snapshot(page);
+        let action;
+        try {
+          action = await brain.nextAction({
+            step,
+            isSetup: setup,
+            snapshot: snap,
+            lastResult,
+            retriesLeft: maxRetries - failedAttempts,
+            iterationsLeft: maxIterationsPerStep - iterations
+          });
+        } catch (error) {
+          failedAttempts++;
+          lastResult = `error: ${error instanceof Error ? error.message : String(error)}`;
+          if (failedAttempts >= maxRetries) {
+            throw new StepFailure(`retry budget exhausted (${maxRetries}): ${lastResult}`);
+          }
+          continue;
+        }
+        iterations++;
+        if (action.action === "done") {
+          emitAction(index, action, action.reasoning);
+          break;
+        }
+        if (action.action === "fail") {
+          emitAction(index, action, action.reasoning);
+          throw new StepFailure(action.reasoning);
+        }
+        if (action.action === "assert") {
+          const expectation = action.expectation ?? action.reasoning;
+          const judgment = await brain.judge(expectation, snap);
+          const result = judgment.pass ? `ok: assertion passed: ${judgment.reason}` : `assertion failed: ${judgment.reason}`;
+          emitAction(index, action, result);
+          if (judgment.pass) {
+            lastResult = result;
+            continue;
+          }
+          failedAttempts++;
+          lastResult = result;
+          if (failedAttempts >= maxRetries) {
+            throw new StepFailure(judgment.reason);
+          }
+          continue;
+        }
+        try {
+          const result = await performAction(page, action, { baseUrl });
+          lastResult = result;
+          emitAction(index, action, result);
+        } catch (error) {
+          failedAttempts++;
+          lastResult = `error: ${error instanceof Error ? error.message : String(error)}`;
+          emitAction(index, action, lastResult);
+          if (failedAttempts >= maxRetries) {
+            throw new StepFailure(lastResult);
+          }
+        }
+      }
+    } catch (error) {
+      stepFailedReason = mask(error instanceof Error ? error.message : String(error));
+    }
+    const status = stepFailedReason ? "failed" : "passed";
+    stepResults.push({
+      step: mask(step),
+      // results are a report channel — never store substituted secrets
+      setup,
+      status,
+      iterations,
+      failedAttempts,
+      reason: stepFailedReason,
+      durationMs: Date.now() - stepStartedAt
+    });
+    onEvent({ type: "step-end", index, status, reason: stepFailedReason });
+    if (stepFailedReason) {
+      failure = { step: mask(step), reason: stepFailedReason };
+      break;
+    }
+  }
+  let screenshot;
+  if (failure) {
+    try {
+      await mkdir2(sessionDir, { recursive: true });
+      const file = path2.join(sessionDir, `${slugify(test.summary)}.png`);
+      await page.screenshot({ path: file, fullPage: true });
+      screenshot = file;
+    } catch {
+    }
+  }
+  return {
+    file: test.path,
+    summary: test.summary,
+    priority: test.priority,
+    tags: test.tags,
+    status: failure ? "failed" : "passed",
+    steps: stepResults,
+    failedStep: failure?.step,
+    reason: failure?.reason,
+    screenshot,
+    durationMs: Date.now() - startedAt
+  };
+}
+
+// src/auth.ts
+var AUTH_STATE_RELATIVE_PATH = path3.join(".blastproof", ".auth-state.json");
+var AuthError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AuthError";
+  }
+};
+function isStorageState(value) {
+  return typeof value === "object" && value !== null && Array.isArray(value.cookies) && Array.isArray(value.origins);
+}
+async function fromStorageState(file) {
+  let raw;
+  try {
+    raw = await readFile(file, "utf8");
+  } catch {
+    throw new AuthError(
+      `Cannot read auth.storage_state at ${file}. Capture a session first, or switch to an auth.steps recipe.`
+    );
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    throw new AuthError(`Invalid JSON in auth.storage_state at ${file}.`);
+  }
+  if (!isStorageState(parsed)) {
+    throw new AuthError(
+      `Invalid storage state at ${file}: expected an object with "cookies" and "origins" arrays.`
+    );
+  }
+  return { storageState: parsed };
+}
+function fromStatic(auth) {
+  const mask = new SecretsMask();
+  const session = {};
+  if (auth.headers) {
+    const headers = {};
+    for (const [name, value] of Object.entries(auth.headers)) {
+      mask.registerFrom(value);
+      headers[name] = substituteEnv(value);
+    }
+    session.extraHTTPHeaders = headers;
+  }
+  if (auth.cookies) {
+    const cookies = auth.cookies.map((cookie) => {
+      mask.registerFrom(cookie.value);
+      return { ...cookie, value: substituteEnv(cookie.value) };
+    });
+    session.storageState = { cookies, origins: [] };
+  }
+  return { session, mask };
+}
+async function runJourney(...args) {
+  try {
+    return await executeTest(...args);
+  } catch (error) {
+    throw new AuthError(
+      `Authentication could not run: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+async function fromSteps(options) {
+  const { auth, baseUrl, browser, brain, maxRetries, snapshot = defaultSnapshot, onEvent } = options;
+  const steps = auth.steps;
+  const mask = new SecretsMask();
+  for (const step of steps) mask.registerFrom(step);
+  const context = await browser.newContext();
+  try {
+    const page = await context.newPage();
+    const result = await runJourney(
+      page,
+      {
+        path: "<auth>",
+        summary: "authentication",
+        steps: steps.map((step) => substituteEnv(step)),
+        priority: "P0",
+        tags: [],
+        routes: [],
+        auth: false
+      },
+      {
+        brain,
+        sessionDir: path3.join(options.cwd, ".blastproof", "reports", "auth"),
+        baseUrl,
+        maxRetries,
+        mask: (text) => mask.mask(text),
+        snapshot,
+        onEvent
+      }
+    );
+    if (result.status === "failed") {
+      throw new AuthError(
+        `Authentication failed at step "${result.failedStep ?? "unknown"}": ${result.reason ?? "no reason given"}`
+      );
+    }
+    if (auth.verify) {
+      const judgment = await brain.judge(auth.verify, await snapshot(page));
+      if (!judgment.pass) {
+        throw new AuthError(`Authentication could not be verified: ${mask.mask(judgment.reason)}`);
+      }
+    }
+    return { storageState: await context.storageState() };
+  } finally {
+    await context.close();
+  }
+}
+async function readCached(cwd) {
+  try {
+    return await fromStorageState(path3.join(cwd, AUTH_STATE_RELATIVE_PATH));
+  } catch {
+    return void 0;
+  }
+}
+async function writeCached(cwd, session) {
+  if (!session.storageState) return;
+  const file = path3.join(cwd, AUTH_STATE_RELATIVE_PATH);
+  await mkdir3(path3.dirname(file), { recursive: true });
+  await writeFile2(file, JSON.stringify(session.storageState), "utf8");
+}
+async function authenticate(options) {
+  const { auth, cwd } = options;
+  if (auth.cache) {
+    const cached = await readCached(cwd);
+    if (cached) return cached;
+  }
+  if (auth.storage_state) {
+    return fromStorageState(path3.resolve(cwd, auth.storage_state));
+  }
+  if (auth.headers || auth.cookies) {
+    return fromStatic(auth).session;
+  }
+  const session = await fromSteps(options);
+  if (auth.cache) await writeCached(cwd, session);
+  return session;
+}
+function contextOptions(session) {
+  if (!session) return {};
+  return {
+    ...session.storageState ? { storageState: session.storageState } : {},
+    ...session.extraHTTPHeaders ? { extraHTTPHeaders: session.extraHTTPHeaders } : {}
+  };
+}
+
+// src/config.ts
+import { readFile as readFile2 } from "fs/promises";
+import path4 from "path";
+import { parse as parseYaml } from "yaml";
+import { z } from "zod";
+var CONFIG_RELATIVE_PATH = path4.join(".blastproof", "config.yaml");
+var llmSchema = z.object({
+  provider: z.enum(["anthropic", "openai", "ollama"]).default("anthropic"),
+  model: z.string().min(1).optional(),
+  api_key_env: z.string().min(1).optional(),
+  base_url: z.string().url().optional()
+});
+var browserSchema = z.object({
+  headless: z.boolean().default(true),
+  timeout_ms: z.number().int().positive().default(3e4)
+});
+var cookieSchema = z.object({
+  name: z.string().min(1),
+  value: z.string(),
+  domain: z.string().optional(),
+  path: z.string().optional(),
+  url: z.string().optional()
+});
+var authSchema = z.object({
+  steps: z.array(z.string().min(1)).min(1).optional(),
+  storage_state: z.string().min(1).optional(),
+  headers: z.record(z.string()).optional(),
+  cookies: z.array(cookieSchema).min(1).optional(),
+  verify: z.string().min(1).optional(),
+  cache: z.boolean().default(false)
+}).superRefine((value, ctx) => {
+  const present = [];
+  if (value.steps) present.push("steps");
+  if (value.storage_state) present.push("storage_state");
+  if (value.headers || value.cookies) {
+    present.push([value.headers && "headers", value.cookies && "cookies"].filter(Boolean).join("+"));
+  }
+  if (present.length === 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "configure one auth strategy: steps (login journey), storage_state (captured session), or headers/cookies"
+    });
+    return;
+  }
+  if (present.length > 1) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `configure exactly one auth strategy, found ${present.join(" and ")}`
+    });
+  }
+});
+var configSchema = z.object({
+  base_url: z.string().url(),
+  llm: llmSchema.default({}),
+  browser: browserSchema.default({}),
+  routes: z.record(z.array(z.string())).optional(),
+  /** Globs for files knowingly irrelevant to any route (docs, CI config, licences). */
+  ignore: z.array(z.string()).optional(),
+  auth: authSchema.optional(),
+  max_retries_per_step: z.number().int().min(1).default(3)
+});
+var ENV_OVERRIDES = {
+  BLASTPROOF_BASE_URL: ["base_url"],
+  BLASTPROOF_LLM_PROVIDER: ["llm", "provider"],
+  BLASTPROOF_LLM_MODEL: ["llm", "model"],
+  BLASTPROOF_LLM_BASE_URL: ["llm", "base_url"],
+  BLASTPROOF_LLM_API_KEY_ENV: ["llm", "api_key_env"]
+};
+function applyEnvOverrides(data, env = process.env) {
+  const merged = data && typeof data === "object" ? { ...data } : {};
+  const applied = [];
+  for (const [variable, keyPath] of Object.entries(ENV_OVERRIDES)) {
+    const value = env[variable];
+    if (value === void 0 || value === "") continue;
+    if (keyPath.length === 1) {
+      merged[keyPath[0]] = value;
+    } else {
+      const [section2, field] = keyPath;
+      const current = merged[section2];
+      merged[section2] = {
+        ...current && typeof current === "object" ? current : {},
+        [field]: value
+      };
+    }
+    applied.push(variable);
+  }
+  return { data: merged, applied };
+}
+var ConfigError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "ConfigError";
+  }
+};
+function formatIssues(error) {
+  return error.issues.map((issue) => `  - ${issue.path.join(".") || "(root)"}: ${issue.message}`).join("\n");
+}
+async function loadConfig(cwd = process.cwd(), env = process.env) {
+  const configPath = path4.join(cwd, CONFIG_RELATIVE_PATH);
+  let raw;
+  try {
+    raw = await readFile2(configPath, "utf8");
+  } catch {
+    throw new ConfigError(
+      `No config found at ${CONFIG_RELATIVE_PATH}. Run \`blastproof init\` to scaffold one.`
+    );
+  }
+  let data;
+  try {
+    data = parseYaml(raw);
+  } catch (error) {
+    throw new ConfigError(
+      `Invalid YAML in ${CONFIG_RELATIVE_PATH}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const { data: merged, applied } = applyEnvOverrides(data ?? {}, env);
+  const result = configSchema.safeParse(merged);
+  if (!result.success) {
+    const source = applied.length > 0 ? `${CONFIG_RELATIVE_PATH} (with overrides from ${applied.join(", ")})` : CONFIG_RELATIVE_PATH;
+    throw new ConfigError(`Invalid ${source}:
+${formatIssues(result.error)}`);
+  }
+  return result.data;
+}
+
+// src/diff.ts
+import { simpleGit } from "simple-git";
+var DiffError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "DiffError";
+  }
+};
+function toDiffError(error, baseRef) {
+  const message = error instanceof Error ? error.message : String(error);
+  if (/not a git repository/i.test(message)) {
+    return new DiffError(
+      "Cannot compute diff: not inside a git repository. Run blastproof from within your project repository."
+    );
+  }
+  if (/no merge base/i.test(message)) {
+    return new DiffError(
+      `Cannot compute diff against '${baseRef}': no common merge-base with HEAD (shallow clone?). Fetch more history, e.g. \`git fetch --deepen\` or set fetch-depth: 0 in actions/checkout.`
+    );
+  }
+  if (/unknown revision|ambiguous argument|bad revision|invalid object name/i.test(message)) {
+    return new DiffError(
+      `Cannot compute diff: base ref '${baseRef}' does not exist in this repository. Fetch it first (e.g. \`git fetch origin ${baseRef}\`) or pass a valid --base ref.`
+    );
+  }
+  return new DiffError(`Cannot compute diff against '${baseRef}': ${message}`);
+}
+async function getChangedFiles(baseRef, cwd = process.cwd()) {
+  try {
+    const summary = await simpleGit(cwd).diffSummary(["--name-only", `${baseRef}...HEAD`]);
+    return summary.files.map((file) => file.file).sort();
+  } catch (error) {
+    throw toDiffError(error, baseRef);
+  }
+}
+
+// src/impact.ts
+import picomatch from "picomatch";
+function mapImpact(changedFiles, routes, ignore = []) {
+  const matchers = Object.entries(routes).map(([glob, urls]) => ({
+    isMatch: picomatch(glob, { dot: true }),
+    urls
+  }));
+  const isIgnored = ignore.map((glob) => picomatch(glob, { dot: true }));
+  const affected = /* @__PURE__ */ new Set();
+  const unmapped = [];
+  const ignored = [];
+  for (const file of changedFiles) {
+    const normalized = file.replace(/\\/g, "/");
+    if (isIgnored.some((matches) => matches(normalized))) {
+      ignored.push(normalized);
+      continue;
+    }
+    let matched = false;
+    for (const { isMatch, urls } of matchers) {
+      if (isMatch(normalized)) {
+        matched = true;
+        for (const url of urls) {
+          affected.add(url);
+        }
+      }
+    }
+    if (!matched) {
+      unmapped.push(normalized);
+    }
+  }
+  return {
+    affectedRoutes: [...affected].sort(),
+    unmappedFiles: unmapped.sort(),
+    ignoredFiles: ignored.sort()
+  };
+}
+
+// src/llm/brain.ts
+import { generateObject } from "ai";
+
+// src/llm/prompts.ts
+function agentSystemPrompt() {
+  return `You are a meticulous QA agent executing one plain-English test step at a time in a real browser.
+
+You receive the current page as a YAML accessibility snapshot (roles and accessible names, exactly what a user perceives) and decide the single next action to move the current step forward.
+
+Rules:
+- Return exactly ONE action per response. Never batch actions.
+- Pick target elements exclusively from the current snapshot, using their exact role and accessible name. Never invent CSS selectors or guess elements not in the snapshot.
+- Use "navigate" only with a URL or path as value. Use "fill" to type into textboxes/inputs. Use "press" for keyboard keys (value e.g. "Enter"). Use "select" for dropdowns (value = option label).
+- Use "assert" with an expectation to verify page state (visible text, counts, URLs). Assertions never modify the page.
+- Return "done" only when the current step is fully accomplished. Do not return "done" for work belonging to later steps.
+- Return "fail" with a clear reason when the step is impossible to accomplish (element missing after retries, unexpected page state, blocking error).
+- If your previous action errored, re-read the fresh snapshot and choose an alternative element or approach. Do not repeat the exact same failing action.
+- Keep reasoning to one short sentence.`;
+}
+function agentUserPrompt(input) {
+  const parts = [
+    `Current ${input.isSetup ? "setup " : ""}step: ${input.step}`,
+    "",
+    "Page accessibility snapshot:",
+    input.snapshot
+  ];
+  if (input.lastResult) {
+    parts.push("", `Previous action result: ${input.lastResult}`);
+  }
+  parts.push(
+    "",
+    `Budget: ${input.retriesLeft} failed attempts left, ${input.iterationsLeft} actions left for this step.`,
+    "What is the single next action?"
+  );
+  return parts.join("\n");
+}
+function assertSystemPrompt() {
+  return `You are a QA judge. You receive a page accessibility snapshot and an expectation. Decide whether the snapshot satisfies the expectation. Be strict: only pass when the expectation is clearly met by the snapshot content. Answer with pass=true/false and a one-sentence reason.`;
+}
+function assertUserPrompt(expectation, snapshot) {
+  return [
+    `Expectation: ${expectation}`,
+    "",
+    "Page accessibility snapshot:",
+    snapshot,
+    "",
+    "Does the snapshot satisfy the expectation?"
+  ].join("\n");
+}
+function plannerSystemPrompt() {
+  return `You are a QA engineer writing one end-to-end test for a web page, in plain English.
+
+You receive a YAML accessibility snapshot of the page (roles and accessible names, exactly what a user perceives) and the list of source files a pull request changed in the area this page covers.
+
+Rules:
+- Write steps a human tester could follow without looking at the code. One action or check per step.
+- Refer to controls by the accessible name shown in the snapshot, spelled exactly. Never invent buttons, fields or links that are not in the snapshot.
+- Never write CSS selectors, XPath, IDs or any code \u2014 the runner resolves elements live from the accessibility tree.
+- Prefer the journey the changed files touch over a generic tour of the page. The changed files tell you which part of the page matters.
+- End with at least one step that verifies an observable outcome (visible text, a count, a state change).
+- If a step needs a credential or any secret, write it as a placeholder like {{env.TEST_PASSWORD}}. Never write a real or invented password, token or key.
+- Keep the whole test to a handful of steps: one journey, not an exhaustive suite.`;
+}
+function plannerUserPrompt(input) {
+  const parts = [`Route under test: ${input.route}`, "", "Page accessibility snapshot:", input.snapshot];
+  if (input.changedFiles.length > 0) {
+    parts.push(
+      "",
+      "Files this pull request changed in the area covering this route:",
+      ...input.changedFiles.map((file) => `- ${file}`)
+    );
+  } else {
+    parts.push("", "No specific changed files for this route: cover its main user journey.");
+  }
+  parts.push("", "Write the test for this route.");
+  return parts.join("\n");
+}
+
+// src/llm/schemas.ts
+import { z as z2 } from "zod";
+var agentActionSchema = z2.object({
+  action: z2.enum(["navigate", "click", "fill", "press", "select", "assert", "done", "fail"]).describe("The next browser action to perform for the current step."),
+  target: z2.object({
+    role: z2.string().optional().describe('ARIA role of the target element, e.g. "button", "link", "textbox".'),
+    name: z2.string().optional().describe("Accessible name of the target element, exactly as shown in the snapshot."),
+    text: z2.string().optional().describe("Visible text of the target element, used as a fallback when no role matches.")
+  }).optional().describe("Element to act on, resolved from the accessibility snapshot. Omit for navigate/done/fail."),
+  value: z2.string().optional().describe(
+    'Action payload: URL/path for navigate, text for fill, key for press (e.g. "Enter"), option label for select.'
+  ),
+  reasoning: z2.string().describe("One sentence explaining why this action moves the step forward."),
+  expectation: z2.string().optional().describe("For assert: the condition the current page snapshot must satisfy.")
+});
+var assertJudgmentSchema = z2.object({
+  pass: z2.boolean().describe("Whether the snapshot satisfies the expectation."),
+  reason: z2.string().describe("One sentence explaining the judgment.")
+});
+var generatedTestSchema = z2.object({
+  summary: z2.string().min(1).describe('One line naming the user journey this test covers, e.g. "Applying a discount updates the cart total".'),
+  steps: z2.array(z2.string().min(1)).min(1).describe(
+    "Plain-English steps a QA engineer would follow, each naming controls exactly as they appear in the snapshot."
+  ),
+  priority: z2.enum(["P0", "P1", "P2"]).describe("P0 for revenue- or auth-critical journeys, P1 for main flows, P2 for edge cases."),
+  tags: z2.array(z2.string()).describe('Short lowercase tags grouping this test, e.g. ["cart", "checkout"].')
+});
+
+// src/llm/brain.ts
+var MalformedModelOutputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "MalformedModelOutputError";
+  }
+};
+function createBrain(model, generate = generateObject) {
+  return {
+    async nextAction(input) {
+      const result = await generate({
+        model,
+        schema: agentActionSchema,
+        system: agentSystemPrompt(),
+        prompt: agentUserPrompt(input)
+      });
+      const parsed = agentActionSchema.safeParse(result.object);
+      if (!parsed.success) {
+        throw new MalformedModelOutputError(
+          `Model returned an invalid action: ${parsed.error.issues[0]?.message ?? "unknown"}`
+        );
+      }
+      return parsed.data;
+    },
+    async judge(expectation, snapshot) {
+      const result = await generate({
+        model,
+        schema: assertJudgmentSchema,
+        system: assertSystemPrompt(),
+        prompt: assertUserPrompt(expectation, snapshot)
+      });
+      const parsed = assertJudgmentSchema.safeParse(result.object);
+      if (!parsed.success) {
+        throw new MalformedModelOutputError(
+          `Model returned an invalid assert judgment: ${parsed.error.issues[0]?.message ?? "unknown"}`
+        );
+      }
+      return parsed.data;
+    }
+  };
+}
+function createPlanner(model, generate = generateObject) {
+  return {
+    async planTest(input) {
+      const result = await generate({
+        model,
+        schema: generatedTestSchema,
+        system: plannerSystemPrompt(),
+        prompt: plannerUserPrompt(input)
+      });
+      const parsed = generatedTestSchema.safeParse(result.object);
+      if (!parsed.success) {
+        throw new MalformedModelOutputError(
+          `Model returned an invalid test draft: ${parsed.error.issues[0]?.message ?? "unknown"}`
+        );
+      }
+      return parsed.data;
+    }
+  };
+}
+
+// src/llm/provider.ts
+import { createAnthropic } from "@ai-sdk/anthropic";
+import { createOpenAI } from "@ai-sdk/openai";
+var DEFAULT_MODELS = {
+  anthropic: "claude-haiku-4-5",
+  openai: "gpt-4o-mini",
+  ollama: "qwen2.5"
+};
+var DEFAULT_API_KEY_ENVS = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY"
+};
+var DEFAULT_OLLAMA_BASE_URL = "http://localhost:11434/v1";
+var MissingApiKeyError = class extends Error {
+  constructor(variable, provider) {
+    super(
+      `Missing API key: environment variable ${variable} is not set (required for provider "${provider}"). Export it before running, e.g. \`export ${variable}=...\`, or change llm.provider / llm.api_key_env in .blastproof/config.yaml.`
+    );
+    this.name = "MissingApiKeyError";
+  }
+};
+function createModel(llm, env = process.env) {
+  const modelId = llm.model ?? DEFAULT_MODELS[llm.provider];
+  switch (llm.provider) {
+    case "anthropic":
+    case "openai": {
+      const keyEnv = llm.api_key_env ?? DEFAULT_API_KEY_ENVS[llm.provider];
+      const apiKey = env[keyEnv];
+      if (!apiKey) {
+        throw new MissingApiKeyError(keyEnv, llm.provider);
+      }
+      const model = llm.provider === "anthropic" ? createAnthropic({ apiKey })(modelId) : (
+        // `.chat` = Chat Completions: works with official OpenAI and any
+        // OpenAI-compatible endpoint (OpenRouter, LiteLLM, vLLM) via base_url.
+        createOpenAI({ apiKey, ...llm.base_url ? { baseURL: llm.base_url } : {} }).chat(modelId)
+      );
+      return { model, provider: llm.provider, modelId };
+    }
+    case "ollama": {
+      const baseURL = llm.base_url ?? DEFAULT_OLLAMA_BASE_URL;
+      const model = createOpenAI({ baseURL, apiKey: "ollama" }).chat(modelId);
+      return { model, provider: "ollama", modelId };
+    }
+  }
+}
+
+// src/planner.ts
+import { writeFile as writeFile3 } from "fs/promises";
+import path6 from "path";
+import { stringify } from "yaml";
+
+// src/runner/testfile.ts
+import { readFile as readFile3, readdir } from "fs/promises";
+import path5 from "path";
+import { parse as parseYaml2 } from "yaml";
+import { z as z3 } from "zod";
+var TESTS_RELATIVE_DIR = path5.join(".blastproof", "tests");
+var prioritySchema = z3.enum(["P0", "P1", "P2"]);
+var testFileSchema = z3.object({
+  summary: z3.string().min(1),
+  steps: z3.array(z3.string().min(1)).min(1),
+  priority: prioritySchema.default("P1"),
+  tags: z3.array(z3.string()).default([]),
+  setup: z3.array(z3.string().min(1)).optional(),
+  routes: z3.array(z3.string()).default([]),
+  auth: z3.boolean().default(true)
+});
+var TestFileError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "TestFileError";
+  }
+};
+function formatIssues2(file, error) {
+  return error.issues.map((issue) => `  - ${issue.path.join(".") || "(root)"}: ${issue.message}`).join("\n");
+}
+async function parseTestFile(filePath) {
+  let raw;
+  try {
+    raw = await readFile3(filePath, "utf8");
+  } catch {
+    throw new TestFileError(`Cannot read test file: ${filePath}`);
+  }
+  let data;
+  try {
+    data = parseYaml2(raw);
+  } catch (error) {
+    throw new TestFileError(
+      `Invalid YAML in ${filePath}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const result = testFileSchema.safeParse(data ?? {});
+  if (!result.success) {
+    throw new TestFileError(`Invalid test file ${filePath}:
+${formatIssues2(filePath, result.error)}`);
+  }
+  return { path: filePath, ...result.data };
+}
+async function discoverTestFiles(root) {
+  const found = [];
+  async function walk(dir) {
+    const entries = await readdir(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      const full = path5.join(dir, entry.name);
+      if (entry.isDirectory()) {
+        await walk(full);
+      } else if (/\.ya?ml$/i.test(entry.name)) {
+        found.push(full);
+      }
+    }
+  }
+  await walk(root);
+  return found.sort();
+}
+
+// src/planner.ts
+var PlannerError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "PlannerError";
+  }
+};
+var CREDENTIAL_WORD = /\b(password|passwd|api[ _-]?key|token|secret|credential)\b/i;
+var QUOTED_LITERAL = /["'][^"']+["']/;
+function findSecretLiterals(steps) {
+  return steps.filter(
+    (step) => CREDENTIAL_WORD.test(step) && QUOTED_LITERAL.test(step) && !step.includes("{{env.")
+  );
+}
+function routeToSlug(route) {
+  const slug = route.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 60);
+  return slug || "home";
+}
+function renderTestYaml(draft, meta) {
+  const header = [
+    "# Generated by `blastproof plan` \u2014 review before committing.",
+    `# route: ${meta.route}`,
+    `# base: ${meta.base ?? "(explicit --route)"}`,
+    `# generated: ${meta.date ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10)}`,
+    ""
+  ].join("\n");
+  return header + stringify({
+    summary: draft.summary,
+    priority: draft.priority,
+    tags: draft.tags,
+    routes: draft.routes,
+    steps: draft.steps
+  });
+}
+async function generateForRoute(page, options) {
+  const { route, baseUrl, changedFiles, brain, snapshot = defaultSnapshot } = options;
+  const url = new URL(route, baseUrl).toString();
+  try {
+    await page.goto(url, { timeout: 3e4 });
+  } catch (error) {
+    throw new PlannerError(
+      `Cannot load ${url}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  const generated = await brain.planTest({ route, snapshot: await snapshot(page), changedFiles });
+  const leaked = findSecretLiterals(generated.steps);
+  if (leaked.length > 0) {
+    throw new PlannerError(
+      `Generated steps contain literal secrets instead of {{env.VAR}} placeholders: ${leaked.join(" | ")}`
+    );
+  }
+  return { ...generated, routes: [route] };
+}
+async function writeDraft(cwd, draft, meta) {
+  const file = path6.join(cwd, TESTS_RELATIVE_DIR, `${routeToSlug(meta.route)}.yaml`);
+  try {
+    await writeFile3(file, renderTestYaml(draft, meta), { flag: "wx" });
+  } catch (error) {
+    if (error.code === "EEXIST") {
+      throw new PlannerError(
+        `Refusing to overwrite ${path6.relative(cwd, file)} (route ${meta.route}). Delete or rename it to regenerate.`
+      );
+    }
+    throw error;
+  }
+  return file;
+}
+function coveredRoutes(tests) {
+  return new Set(tests.flatMap((test) => test.routes));
+}
+
+// src/commands/run.ts
+import path9 from "path";
+import { chromium } from "playwright";
+
+// src/report/html.ts
+import { mkdir as mkdir4, readFile as readFile4, writeFile as writeFile4 } from "fs/promises";
+import path7 from "path";
+var ESCAPES = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&#39;"
+};
+function escapeHtml(text) {
+  return text.replace(/[&<>"']/g, (char) => ESCAPES[char]);
+}
+async function embedScreenshot(file) {
+  try {
+    const bytes = await readFile4(file);
+    return `data:image/png;base64,${bytes.toString("base64")}`;
+  } catch {
+    return void 0;
+  }
+}
+var STYLES = `
+:root { color-scheme: light dark; --bg:#fff; --fg:#111; --muted:#666; --line:#e3e3e3;
+  --pass:#137333; --fail:#c5221f; --card:#fafafa; }
+@media (prefers-color-scheme: dark) {
+  :root { --bg:#15171a; --fg:#e8e8e8; --muted:#9aa0a6; --line:#2c2f34;
+    --pass:#5bb974; --fail:#f28b82; --card:#1c1f23; }
+}
+* { box-sizing: border-box; }
+body { margin:0; padding:2rem 1.25rem; background:var(--bg); color:var(--fg);
+  font:15px/1.55 ui-sans-serif, system-ui, -apple-system, "Segoe UI", sans-serif; }
+main { max-width: 62rem; margin: 0 auto; }
+h1 { font-size:1.35rem; margin:0 0 .25rem; }
+.sub { color:var(--muted); font-size:.85rem; margin-bottom:1.5rem; }
+.score { display:flex; align-items:baseline; gap:.75rem; flex-wrap:wrap;
+  padding:1.25rem; border:1px solid var(--line); border-radius:10px;
+  background:var(--card); margin-bottom:1.5rem; }
+.score b { font-size:2.5rem; line-height:1; font-variant-numeric:tabular-nums; }
+.verdict { font-weight:600; }
+.verdict.pass { color:var(--pass); } .verdict.fail { color:var(--fail); }
+.counts { color:var(--muted); font-size:.9rem; }
+table { width:100%; border-collapse:collapse; margin-bottom:1.5rem; }
+th, td { text-align:left; padding:.5rem .6rem; border-bottom:1px solid var(--line);
+  font-size:.9rem; vertical-align:top; }
+th { color:var(--muted); font-weight:600; }
+td.num { text-align:right; font-variant-numeric:tabular-nums; white-space:nowrap; }
+.tag { font-weight:700; font-size:.78rem; letter-spacing:.03em; }
+.tag.pass { color:var(--pass); } .tag.fail { color:var(--fail); }
+.tag.skip { color:var(--muted); }
+details { border:1px solid var(--line); border-radius:10px; padding:.75rem 1rem;
+  margin-bottom:.75rem; background:var(--card); }
+details > summary { cursor:pointer; font-weight:600; }
+.reason { border-left:3px solid var(--fail); padding:.5rem .75rem; margin:.75rem 0;
+  color:var(--fg); background:color-mix(in srgb, var(--fail) 8%, transparent);
+  border-radius:0 6px 6px 0; }
+ol.steps { margin:.5rem 0 0; padding-left:1.25rem; }
+ol.steps li { margin:.15rem 0; }
+ol.steps li.failed { color:var(--fail); font-weight:600; }
+img.shot { max-width:100%; border:1px solid var(--line); border-radius:8px; margin-top:.75rem; }
+.note { color:var(--muted); font-style:italic; font-size:.85rem; }
+footer { color:var(--muted); font-size:.8rem; border-top:1px solid var(--line);
+  padding-top:1rem; margin-top:2rem; }
+`;
+function seconds(ms) {
+  return `${(ms / 1e3).toFixed(1)}s`;
+}
+function renderSteps(steps) {
+  if (steps.length === 0) return "";
+  const items = steps.map(
+    (step) => `<li class="${step.status === "failed" ? "failed" : ""}">${escapeHtml(step.step)}${step.setup ? ' <span class="note">(setup)</span>' : ""}</li>`
+  ).join("\n        ");
+  return `<ol class="steps">
+        ${items}
+      </ol>`;
+}
+async function renderTest(result, cwd) {
+  const failed = result.status === "failed";
+  const file = cwd ? path7.relative(cwd, result.file) : result.file;
+  const parts = [
+    `    <details${failed ? " open" : ""}>`,
+    `      <summary><span class="tag ${failed ? "fail" : "pass"}">${failed ? "FAIL" : "PASS"}</span> ${escapeHtml(result.summary)} <span class="note">${escapeHtml(result.priority)} \xB7 ${escapeHtml(file)}</span></summary>`
+  ];
+  if (failed) {
+    if (result.failedStep) {
+      parts.push(`      <p><strong>Failing step:</strong> ${escapeHtml(result.failedStep)}</p>`);
+    }
+    if (result.reason) {
+      parts.push(`      <p class="reason">${escapeHtml(result.reason)}</p>`);
+    }
+  }
+  parts.push(`      ${renderSteps(result.steps)}`);
+  if (failed && result.screenshot) {
+    const embedded = await embedScreenshot(result.screenshot);
+    parts.push(
+      embedded ? `      <img class="shot" alt="Screenshot at failure" src="${embedded}">` : '      <p class="note">Screenshot unavailable.</p>'
+    );
+  }
+  parts.push("    </details>");
+  return parts.join("\n");
+}
+async function renderHtml(results, skipped, meta) {
+  const passed = results.filter((r) => r.status === "passed").length;
+  const failures = results.filter((r) => r.status === "failed");
+  const generatedAt = (meta.generatedAt ?? /* @__PURE__ */ new Date()).toISOString();
+  const ordered = [...failures, ...results.filter((r) => r.status === "passed")];
+  const detail = (await Promise.all(ordered.map((r) => renderTest(r, meta.cwd)))).join("\n");
+  const verdict = meta.minScore === void 0 ? "" : meta.score >= meta.minScore ? `<span class="verdict pass">min-score ${meta.minScore}: pass</span>` : `<span class="verdict fail">min-score ${meta.minScore}: FAIL</span>`;
+  const rows = results.map((r) => {
+    const file = meta.cwd ? path7.relative(meta.cwd, r.file) : r.file;
+    return `      <tr><td><span class="tag ${r.status === "failed" ? "fail" : "pass"}">${r.status === "failed" ? "FAIL" : "PASS"}</span></td><td>${escapeHtml(r.priority)}</td><td>${escapeHtml(r.summary)}</td><td>${escapeHtml(file)}</td><td class="num">${seconds(r.durationMs)}</td></tr>`;
+  }).join("\n");
+  const skippedRows = skipped.map((s) => {
+    const file = meta.cwd ? path7.relative(meta.cwd, s.path) : s.path;
+    return `      <tr><td><span class="tag skip">SKIP</span></td><td>\u2014</td><td>${escapeHtml(s.summary)}</td><td>${escapeHtml(file)}</td><td class="num">\u2014</td></tr>`;
+  }).join("\n");
+  return `<!doctype html>
+<html lang="en">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<title>blastproof report</title>
+<style>${STYLES}</style>
+</head>
+<body>
+<main>
+  <h1>blastproof report</h1>
+  <p class="sub">${escapeHtml(generatedAt)} \xB7 ${seconds(meta.durationMs)}</p>
+
+  <section class="score">
+    <b>${meta.score}</b>
+    ${verdict}
+    <span class="counts">${passed} passed \xB7 ${failures.length} failed${skipped.length > 0 ? ` \xB7 ${skipped.length} skipped` : ""}</span>
+  </section>
+
+  <table>
+    <thead><tr><th>Status</th><th>Priority</th><th>Test</th><th>File</th><th class="num">Time</th></tr></thead>
+    <tbody>
+${rows}${rows && skippedRows ? "\n" : ""}${skippedRows}
+    </tbody>
+  </table>
+
+${detail}
+
+  <footer>Generated by blastproof. Screenshots are embedded, so this file works offline.</footer>
+</main>
+</body>
+</html>
+`;
+}
+async function writeHtml(file, html) {
+  await mkdir4(path7.dirname(file), { recursive: true });
+  await writeFile4(file, html, "utf8");
+  return file;
+}
+
+// src/report/junit.ts
+import { mkdir as mkdir5, writeFile as writeFile5 } from "fs/promises";
+import path8 from "path";
+var ESCAPES2 = {
+  "&": "&amp;",
+  "<": "&lt;",
+  ">": "&gt;",
+  '"': "&quot;",
+  "'": "&apos;"
+};
+function escapeXml(text) {
+  return text.replace(/[&<>"']/g, (char) => ESCAPES2[char]);
+}
+function seconds2(ms) {
+  return (ms / 1e3).toFixed(3);
+}
+function renderJUnit(results, skipped, meta) {
+  const relative = (file) => meta.cwd ? path8.relative(meta.cwd, file) : file;
+  const failures = results.filter((result) => result.status === "failed").length;
+  const lines = [
+    '<?xml version="1.0" encoding="UTF-8"?>',
+    `<testsuite name="blastproof" tests="${results.length + skipped.length}" failures="${failures}" skipped="${skipped.length}" time="${seconds2(meta.durationMs)}">`,
+    "  <properties>",
+    `    <property name="score" value="${meta.score}"/>`,
+    "  </properties>"
+  ];
+  for (const result of results) {
+    const open = `  <testcase classname="${escapeXml(relative(result.file))}" name="${escapeXml(result.summary)}" time="${seconds2(result.durationMs)}"`;
+    if (result.status === "passed") {
+      lines.push(`${open}/>`);
+      continue;
+    }
+    const reason = result.reason ?? "test failed";
+    const body = result.failedStep ? `failing step: ${result.failedStep}
+${reason}` : reason;
+    lines.push(`${open}>`);
+    lines.push(`    <failure message="${escapeXml(reason)}">${escapeXml(body)}</failure>`);
+    lines.push("  </testcase>");
+  }
+  for (const test of skipped) {
+    lines.push(
+      `  <testcase classname="${escapeXml(relative(test.path))}" name="${escapeXml(test.summary)}" time="0.000">`,
+      '    <skipped message="no routes: declared, skipped by --impacted"/>',
+      "  </testcase>"
+    );
+  }
+  lines.push("</testsuite>", "");
+  return lines.join("\n");
+}
+async function writeJUnit(file, xml) {
+  await mkdir5(path8.dirname(file), { recursive: true });
+  await writeFile5(file, xml, "utf8");
+  return file;
+}
+
+// src/report/score.ts
+var WEIGHTS = { P0: 3, P1: 2, P2: 1 };
+var DEFAULT_WEIGHT = WEIGHTS.P1;
+function computeScore(results) {
+  let total = 0;
+  let passed = 0;
+  for (const result of results) {
+    const weight = WEIGHTS[result.priority] ?? DEFAULT_WEIGHT;
+    total += weight;
+    if (result.status === "passed") passed += weight;
+  }
+  if (total === 0) return 100;
+  return Math.round(100 * passed / total);
+}
+function formatScoreLine(score, results, threshold) {
+  if (results.length === 0) {
+    const base = "Score: 100 (no tests executed)";
+    return threshold === void 0 ? base : `${base} \u2014 min-score ${threshold}: pass`;
+  }
+  if (threshold === void 0) return `Score: ${score}`;
+  return score >= threshold ? `Score: ${score} \u2014 min-score ${threshold}: pass` : `Score: ${score} \u2014 min-score ${threshold}: FAIL (below threshold)`;
+}
+
+// src/runner/selection.ts
+function matchesFilters(test, filters) {
+  if (filters.tags.length > 0 && !filters.tags.some((tag) => test.tags.includes(tag))) {
+    return false;
+  }
+  if (filters.priority && test.priority !== filters.priority) {
+    return false;
+  }
+  if (filters.query && !test.summary.toLowerCase().includes(filters.query.toLowerCase())) {
+    return false;
+  }
+  return true;
+}
+function selectImpactedTests(tests, affectedRoutes, filters = { tags: [] }) {
+  const affected = new Set(affectedRoutes);
+  const selected = [];
+  const unroutedSkipped = [];
+  for (const test of tests) {
+    if (test.routes.length === 0) {
+      unroutedSkipped.push(test);
+      continue;
+    }
+    if (!test.routes.some((route) => affected.has(route))) continue;
+    if (!matchesFilters(test, filters)) continue;
+    selected.push(test);
+  }
+  const covered = new Set(selected.flatMap((test) => test.routes));
+  return {
+    selected,
+    unroutedSkipped,
+    uncoveredRoutes: affectedRoutes.filter((route) => !covered.has(route))
+  };
+}
+
+// src/commands/run.ts
+var EXIT_OK = 0;
+var EXIT_FAILED = 1;
+var EXIT_USAGE = 2;
+function sessionId() {
+  return (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+}
+function applyUrlOverride(config, url) {
+  if (url === void 0) return config;
+  try {
+    new URL(url);
+  } catch {
+    throw new ConfigError(
+      `Invalid --url '${url}': expected an absolute URL like http://localhost:4173.`
+    );
+  }
+  return { ...config, base_url: url };
+}
+function resolveSecretsAndSteps(test) {
+  const mask = new SecretsMask();
+  for (const step of [...test.setup ?? [], ...test.steps]) {
+    mask.registerFrom(step);
+  }
+  return {
+    test: {
+      ...test,
+      setup: test.setup?.map((step) => substituteEnv(step)),
+      steps: test.steps.map((step) => substituteEnv(step))
+    },
+    mask
+  };
+}
+function printEvent(event) {
+  switch (event.type) {
+    case "step-start":
+      console.log(`  ${event.setup ? "(setup) " : ""}step ${event.index + 1}/${event.total}: ${event.step}`);
+      break;
+    case "action": {
+      const { action, result } = event;
+      const target = action.target ? ` ${action.target.role ?? ""} "${action.target.name ?? action.target.text ?? ""}"` : "";
+      const value = action.value ? ` [${action.value}]` : "";
+      console.log(`    -> ${action.action}${target}${value} :: ${result}`);
+      break;
+    }
+    case "step-end":
+      if (event.status === "failed") {
+        console.log(`    X step failed: ${event.reason ?? "unknown reason"}`);
+      }
+      break;
+  }
+}
+function printSummary(results) {
+  const passed = results.filter((r) => r.status === "passed");
+  const failed = results.filter((r) => r.status === "failed");
+  console.log("\n--- Summary ---------------------------------------------------");
+  const rows = results.map((r) => ({
+    status: r.status === "passed" ? "PASS" : "FAIL",
+    priority: r.priority,
+    summary: r.summary,
+    duration: `${(r.durationMs / 1e3).toFixed(1)}s`
+  }));
+  const width = (key) => Math.max(key.length, ...rows.map((r) => String(r[key]).length));
+  const [ws, wp, wsum, wd] = [width("status"), width("priority"), width("summary"), width("duration")];
+  for (const row of rows) {
+    console.log(
+      `${row.status.padEnd(ws)}  ${row.priority.padEnd(wp)}  ${row.summary.padEnd(wsum)}  ${row.duration.padStart(wd)}`
+    );
+  }
+  console.log("---------------------------------------------------------------");
+  console.log(`${passed.length} passed, ${failed.length} failed, ${results.length} total`);
+  for (const r of failed) {
+    console.log(`
+X ${r.summary} (${r.file})`);
+    if (r.failedStep) console.log(`  failing step: ${r.failedStep}`);
+    if (r.reason) console.log(`  reason: ${r.reason}`);
+    if (r.screenshot) console.log(`  screenshot: ${r.screenshot}`);
+  }
+}
+async function runOne(browser, test, config, sessionDir, session) {
+  const brain = createBrain(createModel(config.llm).model);
+  let resolved;
+  let mask;
+  try {
+    ({ test: resolved, mask } = resolveSecretsAndSteps(test));
+  } catch (error) {
+    if (error instanceof MissingEnvError) {
+      return {
+        file: test.path,
+        summary: test.summary,
+        priority: test.priority,
+        tags: test.tags,
+        status: "failed",
+        steps: [],
+        reason: error.message,
+        durationMs: 0
+      };
+    }
+    throw error;
+  }
+  const context = await browser.newContext(test.auth ? contextOptions(session) : {});
+  try {
+    const page = await context.newPage();
+    page.setDefaultTimeout(config.browser.timeout_ms);
+    return await executeTest(page, resolved, {
+      brain,
+      sessionDir,
+      baseUrl: config.base_url,
+      maxRetries: config.max_retries_per_step,
+      mask: (text) => mask.mask(text),
+      onEvent: printEvent
+    });
+  } finally {
+    await context.close();
+  }
+}
+function printImpactReport(impact, selection, cwd) {
+  console.log("\n--- Impact -----------------------------------------------------");
+  console.log(
+    impact.affectedRoutes.length > 0 ? "Affected routes:" : "Affected routes: none"
+  );
+  for (const route of impact.affectedRoutes) console.log(`  ${route}`);
+  if (impact.unmappedFiles.length > 0) {
+    console.log("Unclassified files (matched by no routes: or ignore: glob):");
+    for (const file of impact.unmappedFiles) console.log(`  ${file}`);
+  }
+  if (impact.ignoredFiles.length > 0) {
+    console.log(`Ignored files: ${impact.ignoredFiles.length}`);
+  }
+  if (selection.unroutedSkipped.length > 0) {
+    console.log("Unrouted tests (skipped):");
+    for (const test of selection.unroutedSkipped) {
+      console.log(`  ${test.summary} (${path9.relative(cwd, test.path)})`);
+    }
+  }
+  if (selection.uncoveredRoutes.length > 0) {
+    console.log("Affected but uncovered routes:");
+    for (const route of selection.uncoveredRoutes) console.log(`  ${route}`);
+  }
+  console.log("---------------------------------------------------------------");
+}
+async function finalize(results, skipped, options, sessionDir, durationMs, impact) {
+  if (results.length > 0) printSummary(results);
+  const score = computeScore(results);
+  console.log(formatScoreLine(score, results, options.minScore));
+  if (options.junit) {
+    const target = typeof options.junit === "string" ? path9.resolve(options.cwd, options.junit) : path9.join(sessionDir, "junit.xml");
+    const xml = renderJUnit(results, skipped, { score, durationMs, cwd: options.cwd });
+    await writeJUnit(target, xml);
+    console.log(`JUnit report: ${path9.relative(options.cwd, target)}`);
+  }
+  if (options.html) {
+    const target = typeof options.html === "string" ? path9.resolve(options.cwd, options.html) : path9.join(sessionDir, "report.html");
+    const html = await renderHtml(results, skipped, {
+      score,
+      durationMs,
+      minScore: options.minScore,
+      cwd: options.cwd
+    });
+    await writeHtml(target, html);
+    console.log(`HTML report: ${path9.relative(options.cwd, target)}`);
+  }
+  const unclassified = options.failOnUnmapped ? impact?.unmappedFiles ?? [] : [];
+  if (unclassified.length > 0) {
+    console.error(
+      `error: ${unclassified.length} changed file(s) match no routes: or ignore: glob, so their blast radius is unknown:`
+    );
+    for (const file of unclassified) console.error(`  ${file}`);
+    console.error(
+      "Map them in routes: if they can affect a page, or list them in ignore: if they cannot."
+    );
+    return EXIT_FAILED;
+  }
+  if (options.minScore !== void 0) {
+    return score >= options.minScore ? EXIT_OK : EXIT_FAILED;
+  }
+  return results.some((result) => result.status === "failed") ? EXIT_FAILED : EXIT_OK;
+}
+function printDryRun(selected, baseUrl, cwd) {
+  console.log(`
+Dry run: ${selected.length} test(s) selected, base_url=${baseUrl}`);
+  for (const test of selected) {
+    console.log(`  ${test.summary} [${test.priority}] (${path9.relative(cwd, test.path)})`);
+  }
+  console.log("Dry run: no browser launched, no LLM calls made.");
+}
+async function runCommand(options) {
+  let config;
+  try {
+    config = applyUrlOverride(await loadConfig(options.cwd), options.url);
+  } catch (error) {
+    if (error instanceof ConfigError) {
+      console.error(`error: ${error.message}`);
+      return EXIT_USAGE;
+    }
+    throw error;
+  }
+  const impacted = options.impacted ?? false;
+  const base = options.base ?? "main";
+  let impact;
+  if (impacted) {
+    let changedFiles;
+    try {
+      changedFiles = await getChangedFiles(base, options.cwd);
+    } catch (error) {
+      if (error instanceof DiffError) {
+        console.error(`error: ${error.message}`);
+        return EXIT_USAGE;
+      }
+      throw error;
+    }
+    impact = mapImpact(changedFiles, config.routes ?? {}, config.ignore ?? []);
+  }
+  const testsDir = path9.join(options.cwd, TESTS_RELATIVE_DIR);
+  let files;
+  try {
+    files = await discoverTestFiles(testsDir);
+  } catch {
+    console.error(`error: no tests directory at ${TESTS_RELATIVE_DIR}. Run \`blastproof init\` first.`);
+    return EXIT_USAGE;
+  }
+  const results = [];
+  const parsed = [];
+  for (const file of files) {
+    try {
+      parsed.push(await parseTestFile(file));
+    } catch (error) {
+      if (error instanceof TestFileError) {
+        results.push({
+          file: path9.relative(options.cwd, file),
+          summary: path9.basename(file),
+          priority: "P1",
+          tags: [],
+          status: "failed",
+          steps: [],
+          reason: error.message,
+          durationMs: 0
+        });
+        continue;
+      }
+      throw error;
+    }
+  }
+  const selection = impact ? selectImpactedTests(parsed, impact.affectedRoutes, options) : {
+    selected: parsed.filter((test) => matchesFilters(test, options)),
+    unroutedSkipped: [],
+    uncoveredRoutes: []
+  };
+  const selected = selection.selected;
+  if (impact) {
+    printImpactReport(impact, selection, options.cwd);
+  }
+  if (options.dryRun) {
+    printDryRun(selected, config.base_url, options.cwd);
+    return EXIT_OK;
+  }
+  const sessionDir = path9.join(options.cwd, ".blastproof", "reports", sessionId());
+  const startedAt = Date.now();
+  if (selected.length === 0) {
+    console.log(
+      impact ? "No impacted tests to run." : "No tests matched the given filters."
+    );
+    return finalize(results, selection.unroutedSkipped, options, sessionDir, Date.now() - startedAt, impact);
+  }
+  try {
+    createModel(config.llm);
+  } catch (error) {
+    if (error instanceof MissingApiKeyError) {
+      console.error(`error: ${error.message}`);
+      return EXIT_USAGE;
+    }
+    throw error;
+  }
+  const { provider, modelId } = createModel(config.llm);
+  console.log(
+    `blastproof run: ${selected.length} test(s), provider=${provider} model=${modelId}, base_url=${config.base_url}`
+  );
+  const browser = await chromium.launch({ headless: config.browser.headless });
+  try {
+    let session;
+    if (config.auth) {
+      try {
+        console.log("Authenticating...");
+        session = await authenticate({
+          auth: config.auth,
+          cwd: options.cwd,
+          baseUrl: config.base_url,
+          browser,
+          brain: createBrain(createModel(config.llm).model),
+          maxRetries: config.max_retries_per_step,
+          onEvent: printEvent
+        });
+      } catch (error) {
+        if (error instanceof AuthError) {
+          console.error(`error: ${error.message}`);
+          return EXIT_USAGE;
+        }
+        throw error;
+      }
+    }
+    for (const test of selected) {
+      console.log(`
+> ${test.summary} [${test.priority}] (${path9.relative(options.cwd, test.path)})`);
+      results.push(await runOne(browser, test, config, sessionDir, session));
+    }
+  } finally {
+    await browser.close();
+  }
+  return finalize(results, selection.unroutedSkipped, options, sessionDir, Date.now() - startedAt, impact);
+}
+
+// src/commands/plan.ts
+function printAuthEvent(event) {
+  if (event.type === "step-start") {
+    console.log(`  step ${event.index + 1}/${event.total}: ${event.step}`);
+  } else if (event.type === "action") {
+    console.log(`    -> ${event.action.action} :: ${event.result}`);
+  } else if (event.status === "failed") {
+    console.log(`    X step failed: ${event.reason ?? "unknown reason"}`);
+  }
+}
+async function loadSuite(cwd) {
+  const testsDir = path10.join(cwd, TESTS_RELATIVE_DIR);
+  let files;
+  try {
+    files = await discoverTestFiles(testsDir);
+  } catch {
+    return [];
+  }
+  const parsed = [];
+  for (const file of files) {
+    try {
+      parsed.push(await parseTestFile(file));
+    } catch (error) {
+      if (error instanceof TestFileError) continue;
+      throw error;
+    }
+  }
+  return parsed;
+}
+async function resolveTargets(options, config, suite) {
+  const covered = coveredRoutes(suite);
+  if (options.routes && options.routes.length > 0) {
+    return { work: options.routes.map((route) => ({ route, changedFiles: [] })), alreadyCovered: [] };
+  }
+  const base = options.base ?? "main";
+  const changedFiles = await getChangedFiles(base, options.cwd);
+  const impact = mapImpact(changedFiles, config.routes ?? {}, config.ignore ?? []);
+  const filesForRoute = (route) => changedFiles.filter(
+    (file) => mapImpact([file], config.routes ?? {}, config.ignore ?? []).affectedRoutes.includes(route)
+  );
+  const work = [];
+  const alreadyCovered = [];
+  for (const route of impact.affectedRoutes) {
+    if (covered.has(route)) {
+      alreadyCovered.push(route);
+      continue;
+    }
+    work.push({ route, changedFiles: filesForRoute(route) });
+  }
+  return { work, alreadyCovered };
+}
+async function planCommand(options) {
+  let config;
+  try {
+    config = applyUrlOverride(await loadConfig(options.cwd), options.url);
+  } catch (error) {
+    if (error instanceof ConfigError) {
+      console.error(`error: ${error.message}`);
+      return EXIT_USAGE;
+    }
+    throw error;
+  }
+  const suite = await loadSuite(options.cwd);
+  let work;
+  let alreadyCovered;
+  try {
+    ({ work, alreadyCovered } = await resolveTargets(options, config, suite));
+  } catch (error) {
+    if (error instanceof DiffError) {
+      console.error(`error: ${error.message}`);
+      return EXIT_USAGE;
+    }
+    throw error;
+  }
+  if (alreadyCovered.length > 0) {
+    console.log("Already covered (skipped):");
+    for (const route of alreadyCovered) console.log(`  ${route}`);
+  }
+  if (work.length === 0) {
+    console.log("Nothing to generate: no affected route is missing coverage.");
+    return EXIT_OK;
+  }
+  try {
+    createModel(config.llm);
+  } catch (error) {
+    if (error instanceof MissingApiKeyError) {
+      console.error(`error: ${error.message}`);
+      return EXIT_USAGE;
+    }
+    throw error;
+  }
+  const { model, provider, modelId } = createModel(config.llm);
+  const brain = createPlanner(model);
+  const base = options.routes && options.routes.length > 0 ? void 0 : options.base ?? "main";
+  console.log(
+    `blastproof plan: ${work.length} route(s), provider=${provider} model=${modelId}, base_url=${config.base_url}`
+  );
+  const generated = [];
+  const written = [];
+  const failed = [];
+  const browser = await chromium2.launch({ headless: config.browser.headless });
+  try {
+    let session;
+    if (config.auth) {
+      try {
+        console.log("Authenticating...");
+        session = await authenticate({
+          auth: config.auth,
+          cwd: options.cwd,
+          baseUrl: config.base_url,
+          browser,
+          brain: createBrain(createModel(config.llm).model),
+          maxRetries: config.max_retries_per_step,
+          onEvent: printAuthEvent
+        });
+      } catch (error) {
+        if (error instanceof AuthError) {
+          console.error(`error: ${error.message}`);
+          return EXIT_USAGE;
+        }
+        throw error;
+      }
+    }
+    for (const { route, changedFiles } of work) {
+      console.log(`
+> ${route}`);
+      let draft;
+      const context = await browser.newContext(contextOptions(session));
+      try {
+        const page = await context.newPage();
+        page.setDefaultTimeout(config.browser.timeout_ms);
+        draft = await generateForRoute(page, {
+          route,
+          baseUrl: config.base_url,
+          changedFiles,
+          brain
+        });
+      } catch (error) {
+        failed.push({ route, reason: error instanceof Error ? error.message : String(error) });
+        console.log(`  X failed: ${error instanceof Error ? error.message : String(error)}`);
+        continue;
+      } finally {
+        await context.close();
+      }
+      generated.push(route);
+      if (options.write) {
+        try {
+          const file = await writeDraft(options.cwd, draft, { route, base });
+          written.push(path10.relative(options.cwd, file));
+          console.log(`  wrote ${path10.relative(options.cwd, file)}`);
+        } catch (error) {
+          if (error instanceof PlannerError) {
+            generated.pop();
+            failed.push({ route, reason: error.message });
+            console.log(`  X failed: ${error.message}`);
+            continue;
+          }
+          throw error;
+        }
+      } else {
+        console.log(`
+${renderTestYaml(draft, { route, base })}`);
+      }
+    }
+  } finally {
+    await browser.close();
+  }
+  console.log("\n--- Plan -------------------------------------------------------");
+  console.log(`Generated: ${generated.length > 0 ? generated.join(", ") : "none"}`);
+  if (written.length > 0) {
+    console.log("Written:");
+    for (const file of written) console.log(`  ${file}`);
+  }
+  if (!options.write && generated.length > 0) {
+    console.log("Preview only: no files written. Re-run with --write to persist.");
+  }
+  if (failed.length > 0) {
+    console.log("Failed:");
+    for (const { route, reason } of failed) console.log(`  ${route}: ${reason}`);
+  }
+  console.log("---------------------------------------------------------------");
+  return failed.length > 0 ? EXIT_FAILED : EXIT_OK;
+}
+
+// src/commands/test.ts
+function section(title) {
+  console.log(`
+=== ${title} ${"=".repeat(Math.max(0, 58 - title.length))}`);
+}
+async function testCommand(options) {
+  section("Verify: tests covering the affected routes");
+  const runCode = await runCommand({
+    cwd: options.cwd,
+    tags: [],
+    impacted: true,
+    base: options.base,
+    url: options.url,
+    minScore: options.minScore,
+    junit: options.junit,
+    html: options.html,
+    failOnUnmapped: options.failOnUnmapped
+  });
+  if (runCode === EXIT_USAGE) return EXIT_USAGE;
+  section("Draft: affected routes no test covers");
+  const planCode = await planCommand({
+    cwd: options.cwd,
+    base: options.base,
+    url: options.url,
+    write: options.write
+  });
+  if (planCode === EXIT_USAGE) return EXIT_USAGE;
+  console.log(
+    "\nDrafts are not executed and do not affect the score \u2014 review them before they join the suite."
+  );
+  return runCode === EXIT_OK && planCode === EXIT_OK ? EXIT_OK : EXIT_FAILED;
+}
+
+// src/cli.ts
+function collect(value, previous) {
+  return [...previous, value];
+}
+function parsePriority(value) {
+  if (value !== "P0" && value !== "P1" && value !== "P2") {
+    throw new InvalidArgumentError("priority must be one of P0, P1, P2");
+  }
+  return value;
+}
+function parseMinScore(value) {
+  const score = Number(value);
+  if (!Number.isInteger(score) || score < 0 || score > 100) {
+    throw new InvalidArgumentError("min-score must be an integer between 0 and 100");
+  }
+  return score;
+}
+var program = new Command();
+program.name("blastproof").description("Open-source AI testing agent: plain-English YAML tests executed agentically on a real browser.").version("0.0.1");
+program.command("init").description("Scaffold .blastproof/ (config, tests, sample tests) in the current directory").action(async () => {
+  try {
+    const result = await initProject(process.cwd());
+    console.log(formatInitGuidance(result));
+    process.exitCode = EXIT_OK;
+  } catch (error) {
+    console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = EXIT_USAGE;
+  }
+});
+program.command("run").description("Discover and run all tests under .blastproof/tests/ agentically").option("--tag <tag>", "only run tests with this tag (repeatable)", collect, []).option("--priority <priority>", "only run tests with this priority (P0|P1|P2)", parsePriority).option("--query <text>", "only run tests whose summary contains <text> (case-insensitive)").option("--impacted", "run only tests impacted by the diff vs --base (uses routes: mappings)").option("--base <ref>", "base git ref for --impacted", "main").option("--url <url>", "override config base_url for this run only (config file untouched)").option("--dry-run", "print the selection plan and exit without launching a browser or calling the LLM").option(
+  "--min-score <n>",
+  "require a weighted score of at least n (0-100); replaces the all-must-pass rule",
+  parseMinScore
+).option("--junit [path]", "write a JUnit XML report (default: .blastproof/reports/<session>/junit.xml)").option("--html [path]", "write a self-contained HTML report (default: .blastproof/reports/<session>/report.html)").option("--fail-on-unmapped", "fail when a changed file matches no routes: or ignore: glob").action(
+  async (options) => {
+    try {
+      process.exitCode = await runCommand({
+        cwd: process.cwd(),
+        tags: options.tag,
+        priority: options.priority,
+        query: options.query,
+        impacted: options.impacted,
+        base: options.base,
+        url: options.url,
+        dryRun: options.dryRun,
+        minScore: options.minScore,
+        junit: options.junit,
+        html: options.html,
+        failOnUnmapped: options.failOnUnmapped
+      });
+    } catch (error) {
+      console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = EXIT_USAGE;
+    }
+  }
+);
+program.command("plan").description("Generate plain-English YAML tests for affected routes no test covers yet").option("--base <ref>", "base git ref for the diff", "main").option("--url <url>", "override config base_url for this run only (config file untouched)").option("--route <route>", "generate for this route, bypassing the diff (repeatable)", collect, []).option("--write", "persist drafts under .blastproof/tests/ instead of previewing them").action(async (options) => {
+  try {
+    process.exitCode = await planCommand({
+      cwd: process.cwd(),
+      base: options.base,
+      url: options.url,
+      routes: options.route,
+      write: options.write
+    });
+  } catch (error) {
+    console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+    process.exitCode = EXIT_USAGE;
+  }
+});
+program.command("test").description("Full PR pipeline: run the tests covering the diff, then draft tests for the gaps").option("--base <ref>", "base git ref for the diff", "main").option("--url <url>", "override config base_url for this run only (config file untouched)").option(
+  "--min-score <n>",
+  "require a weighted score of at least n (0-100); replaces the all-must-pass rule",
+  parseMinScore
+).option("--junit [path]", "write a JUnit XML report (default: .blastproof/reports/<session>/junit.xml)").option("--html [path]", "write a self-contained HTML report (default: .blastproof/reports/<session>/report.html)").option("--write", "persist generated drafts under .blastproof/tests/ instead of previewing them").option("--fail-on-unmapped", "fail when a changed file matches no routes: or ignore: glob").action(
+  async (options) => {
+    try {
+      process.exitCode = await testCommand({
+        cwd: process.cwd(),
+        base: options.base,
+        url: options.url,
+        minScore: options.minScore,
+        junit: options.junit,
+        html: options.html,
+        write: options.write,
+        failOnUnmapped: options.failOnUnmapped
+      });
+    } catch (error) {
+      console.error(`error: ${error instanceof Error ? error.message : String(error)}`);
+      process.exitCode = EXIT_USAGE;
+    }
+  }
+);
+program.exitOverride();
+for (const command of program.commands) command.exitOverride();
+try {
+  await program.parseAsync(process.argv);
+} catch (error) {
+  const exitCode = error.exitCode ?? EXIT_USAGE;
+  process.exitCode = exitCode === 0 ? EXIT_OK : EXIT_USAGE;
+}
+//# sourceMappingURL=cli.js.map