getseatbelt 0.0.1

package/dist/cli.js

@@ -0,0 +1,4735 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { Command } from "commander";
+
+// src/commands/init.ts
+import path13 from "path";
+
+// src/utils/paths.ts
+import path from "path";
+var CONFIG_FILENAME = "seatbelt.config.yaml";
+var SEATBELT_DIRNAME = ".seatbelt";
+var STATE_FILENAME = "state.json";
+var ARTIFACTS_DIRNAME = "artifacts";
+var GITIGNORE_FILENAME = ".gitignore";
+function resolvePaths(cwd = process.cwd()) {
+  const root = path.resolve(cwd);
+  const seatbeltDir = path.join(root, SEATBELT_DIRNAME);
+  return {
+    cwd: root,
+    configFile: path.join(root, CONFIG_FILENAME),
+    seatbeltDir,
+    stateFile: path.join(seatbeltDir, STATE_FILENAME),
+    artifactsDir: path.join(seatbeltDir, ARTIFACTS_DIRNAME),
+    gitignore: path.join(root, GITIGNORE_FILENAME)
+  };
+}
+function artifactDir(paths, runId) {
+  return path.join(paths.artifactsDir, runId);
+}
+function displayPath(from, to) {
+  const rel = path.relative(from, to);
+  return rel.split(path.sep).join("/");
+}
+
+// src/utils/fs.ts
+import fs from "fs";
+import fsp from "fs/promises";
+import path2 from "path";
+function exists(target) {
+  return fs.existsSync(target);
+}
+async function ensureDir(dir) {
+  await fsp.mkdir(dir, { recursive: true });
+}
+async function readText(target) {
+  return fsp.readFile(target, "utf8");
+}
+async function writeText(target, content) {
+  await ensureDir(path2.dirname(target));
+  await fsp.writeFile(target, content, "utf8");
+}
+async function readJson(target) {
+  return JSON.parse(await readText(target));
+}
+async function writeJson(target, data) {
+  await writeText(target, JSON.stringify(data, null, 2) + "\n");
+}
+async function readBase64(target) {
+  const buf = await fsp.readFile(target);
+  return buf.toString("base64");
+}
+
+// src/config/schema.ts
+import { z } from "zod";
+var viewportSchema = z.object({
+  width: z.number().int().positive().default(1280),
+  height: z.number().int().positive().default(800)
+}).default({});
+var appSchema = z.object({
+  name: z.string().default("My app"),
+  type: z.enum(["saas", "ecommerce", "web", "api"]).optional(),
+  framework: z.string().optional(),
+  // auto-detected later
+  packageManager: z.string().optional()
+  // auto-detected later
+}).default({});
+var serverSchema = z.object({
+  baseUrl: z.string().url().default("http://localhost:3000"),
+  port: z.number().int().positive().optional(),
+  devCommand: z.string().optional(),
+  startTimeoutMs: z.number().int().positive().default(6e4),
+  reuseExistingServer: z.boolean().default(true)
+}).default({});
+var servicesSchema = z.object({
+  startCommand: z.string().optional(),
+  waitFor: z.array(z.string()).default([]),
+  startTimeoutMs: z.number().int().positive().default(9e4),
+  reuseExisting: z.boolean().default(true),
+  stopOnFinish: z.boolean().default(false)
+  // NEVER tear services down by default
+}).default({});
+var checksSchema = z.object({
+  lint: z.string().optional(),
+  typecheck: z.string().optional(),
+  build: z.string().optional(),
+  test: z.string().optional()
+}).default({});
+var resetSchema = z.object({
+  command: z.string().optional(),
+  // Default false so a brand-new project (no reset yet) still runs its first flows.
+  // `seatbelt setup-reset` recommends setting this to true once a reset command exists.
+  required: z.boolean().default(false),
+  allowNonLocal: z.boolean().default(false),
+  // safety: refuse to reset a non-localhost baseUrl
+  timeoutMs: z.number().int().positive().default(12e4),
+  verify: z.object({
+    expectStdoutContains: z.string().optional(),
+    // After the reset command succeeds, hit this URL and require a 2xx. Absolute URL, or a
+    // path (e.g. /api/qa/health) resolved against server.baseUrl. Localhost-only by default.
+    httpOk: z.string().optional()
+  }).optional()
+}).default({});
+var browserSchema = z.object({
+  headed: z.boolean().default(true),
+  // DEFAULT: visible. This is the trust layer.
+  freshSession: z.boolean().default(true),
+  // DEFAULT: fresh context, cleared storage each run
+  slowMo: z.number().int().nonnegative().default(150),
+  viewport: viewportSchema,
+  video: z.boolean().default(true),
+  trace: z.boolean().default(false)
+}).default({});
+var aiSchema = z.object({
+  enabled: z.boolean().default(true),
+  // false behaves like --local-only
+  backend: z.string().url().default("https://api.getseatbelt.ai")
+}).default({});
+var flowsSchema = z.object({
+  dir: z.string().default("qa-flows"),
+  run: z.array(z.string()).default([]),
+  autoRefresh: z.enum(["prompt", "off", "always"]).default("prompt")
+}).default({});
+var reportSchema = z.object({
+  formats: z.array(z.enum(["html", "md"])).default(["html"]),
+  openOnFinish: z.boolean().default(true)
+  // auto-open report unless --no-open / CI / headless
+}).default({});
+var envSchema = z.object({
+  file: z.string().default(".env.local")
+}).default({});
+var configSchema = z.object({
+  version: z.number().default(1),
+  app: appSchema,
+  server: serverSchema,
+  services: servicesSchema,
+  checks: checksSchema,
+  reset: resetSchema,
+  browser: browserSchema,
+  ai: aiSchema,
+  flows: flowsSchema,
+  report: reportSchema,
+  env: envSchema
+}).default({});
+
+// src/config/defaults.ts
+var STARTER_CONFIG_YAML = `version: 1
+app:
+  name: My app
+
+server:
+  baseUrl: http://localhost:3000
+  reuseExistingServer: true
+
+browser:
+  headed: true
+  freshSession: true
+  video: true
+  trace: false
+
+report:
+  formats:
+    - html
+  openOnFinish: true
+
+flows:
+  dir: qa-flows
+  autoRefresh: prompt
+
+# Clean test user (optional but recommended). Run \`seatbelt setup-reset\` to generate
+# a prompt that adds a safe reset script to your app, then uncomment and set required: true.
+# reset:
+#   command: npm run qa:reset-user
+#   required: true
+#   timeoutMs: 30000
+#   allowNonLocal: false
+`;
+
+// src/flows/load.ts
+import path4 from "path";
+import fs3 from "fs";
+import YAML from "yaml";
+
+// src/flows/schema.ts
+import { z as z2 } from "zod";
+var gotoStep = z2.object({ goto: z2.string() }).strict();
+var clickStep = z2.object({ click: z2.string() }).strict();
+var fillStep = z2.object({
+  fill: z2.object({
+    selector: z2.string(),
+    value: z2.string().optional(),
+    // Pull the value from an env var (e.g. SEATBELT_TEST_PASSWORD) so secrets never live
+    // in the flow file. Exactly one of `value` / `valueFromEnv` must be set.
+    valueFromEnv: z2.string().optional()
+  }).strict().refine((v) => v.value !== void 0 !== (v.valueFromEnv !== void 0), {
+    message: "fill needs exactly one of `value` or `valueFromEnv`"
+  })
+}).strict();
+var pressStep = z2.object({
+  // `press: Enter` or `press: { key: Enter, selector: "input[name=q]" }`
+  press: z2.union([
+    z2.string(),
+    z2.object({ key: z2.string(), selector: z2.string().optional() }).strict()
+  ])
+}).strict();
+var selectOptionStep = z2.object({
+  selectOption: z2.object({ selector: z2.string(), value: z2.string() }).strict()
+}).strict();
+var uploadStep = z2.object({
+  // `path` is resolved relative to the project root; the file must exist when the step runs.
+  upload: z2.object({ selector: z2.string(), path: z2.string() }).strict()
+}).strict();
+var waitForUrlStep = z2.object({ waitForUrlContains: z2.string() }).strict();
+var waitForTextStep = z2.object({ waitForText: z2.string() }).strict();
+var waitTimeoutStep = z2.object({ waitForTimeoutMs: z2.number().int().nonnegative() }).strict();
+var expectUrlStep = z2.object({ expectUrlContains: z2.string() }).strict();
+var expectTextStep = z2.object({ expectText: z2.string() }).strict();
+var expectVisibleStep = z2.object({ expectVisible: z2.string() }).strict();
+var expectNotVisibleStep = z2.object({ expectNotVisible: z2.string() }).strict();
+var expectTitleStep = z2.object({ expectTitleContains: z2.string() }).strict();
+var screenshotStep = z2.object({ screenshot: z2.string() }).strict();
+var flowStepSchema = z2.union([
+  gotoStep,
+  clickStep,
+  fillStep,
+  pressStep,
+  selectOptionStep,
+  uploadStep,
+  waitForUrlStep,
+  waitForTextStep,
+  waitTimeoutStep,
+  expectUrlStep,
+  expectTextStep,
+  expectVisibleStep,
+  expectNotVisibleStep,
+  expectTitleStep,
+  screenshotStep
+]);
+var flowDependenciesSchema = z2.object({
+  files: z2.array(z2.string()).default([]),
+  routes: z2.array(z2.string()).default([]),
+  services: z2.array(z2.string()).default([])
+}).default({});
+var flowRequiresSchema = z2.object({
+  env: z2.array(z2.string()).default([])
+}).default({});
+var flowDeclaredStatusSchema = z2.enum(["grey", "green", "yellow", "red", "blocked"]);
+var flowSchema = z2.object({
+  id: z2.string().regex(/^[a-z0-9][a-z0-9-]*$/, "flow id must be lowercase letters, numbers and dashes"),
+  name: z2.string().min(1),
+  description: z2.string().default(""),
+  critical: z2.boolean().default(true),
+  /**
+   * Declared status. Optional. `yellow` means "template — needs setup" and is skipped in
+   * bulk `seatbelt run` / `seatbelt certify --run` (still shown in the map). Run it explicitly
+   * (`seatbelt run <id>`) or remove the line once it's configured to include it in bulk runs.
+   */
+  status: flowDeclaredStatusSchema.optional(),
+  tags: z2.array(z2.string()).default([]),
+  dependencies: flowDependenciesSchema,
+  requires: flowRequiresSchema,
+  /**
+   * Prerequisite flow ids that must pass first (e.g. a dashboard flow `needs: [login]`).
+   * Prereqs run before the dependent, once per run, and share its browser context so login
+   * carries into the dependent. A failed prereq blocks the dependent.
+   */
+  needs: z2.array(z2.string()).default([]),
+  startUrl: z2.string().optional(),
+  steps: z2.array(flowStepSchema).min(1, "a flow needs at least one step")
+}).strict();
+function isNeedsSetup(flow) {
+  return flow.status === "yellow";
+}
+
+// src/flows/templates.ts
+import fs2 from "fs";
+import path3 from "path";
+var HOMEPAGE = `id: homepage-smoke
+name: Homepage loads
+description: Open the home page and confirm it loads without crashing.
+critical: true
+tags:
+  - smoke
+dependencies:
+  routes:
+    - /
+steps:
+  - goto: /
+  - expectTitleContains: ""      # empty string = "any title" (just proves the page renders)
+  - screenshot: homepage
+`;
+var LOGIN = `id: login-smoke
+name: User logs in
+description: Log in as the QA test user from a fresh browser session.
+critical: true
+status: yellow                   # needs setup \u2014 skipped in bulk runs. Remove this line to enable.
+tags:
+  - auth
+  - critical
+dependencies:
+  routes:
+    - /login
+    - /dashboard
+requires:
+  env:
+    - SEATBELT_TEST_EMAIL
+    - SEATBELT_TEST_PASSWORD
+# TODO(setup): confirm the login route + selectors for YOUR app, then delete the "status: yellow"
+#   line above. Prefer stable selectors (type / placeholder / role) over brittle CSS.
+#   Example: Syllawise's Next.js app uses /signin with placeholder-based email/password inputs.
+steps:
+  - goto: /login
+  - fill:
+      selector: "input[type=email]"
+      valueFromEnv: SEATBELT_TEST_EMAIL
+  - fill:
+      selector: "input[type=password]"
+      valueFromEnv: SEATBELT_TEST_PASSWORD
+  - click: "button[type=submit]"
+  - expectUrlContains: "/dashboard"
+  - screenshot: after-login
+`;
+var DASHBOARD = `id: dashboard-smoke
+name: Dashboard loads after login
+description: After signing in, the dashboard/home area loads and shows the signed-in workspace.
+critical: true
+status: yellow                   # needs setup \u2014 skipped in bulk runs. Remove this line to enable.
+tags:
+  - dashboard
+dependencies:
+  routes:
+    - /login
+    - /dashboard
+requires:
+  env:
+    - SEATBELT_TEST_EMAIL
+    - SEATBELT_TEST_PASSWORD
+# TODO(setup): each flow runs in a FRESH session, so this logs in first. Update the route and the
+#   expected text below to match YOUR authenticated landing page.
+steps:
+  - goto: /login
+  - fill:
+      selector: "input[type=email]"
+      valueFromEnv: SEATBELT_TEST_EMAIL
+  - fill:
+      selector: "input[type=password]"
+      valueFromEnv: SEATBELT_TEST_PASSWORD
+  - click: "button[type=submit]"
+  - expectUrlContains: "/dashboard"
+  - expectVisible: "text=Dashboard"    # TODO: change to real text on your dashboard
+  - screenshot: dashboard
+`;
+var SIGNUP = `id: signup-smoke
+name: New user signs up
+description: Template only \u2014 a new user creates an account. Edit before enabling.
+critical: false
+status: yellow                   # template only \u2014 skipped until you configure it.
+tags:
+  - auth
+  - signup
+dependencies:
+  routes:
+    - /signup
+requires:
+  env:
+    - SEATBELT_TEST_EMAIL
+    - SEATBELT_TEST_PASSWORD
+# TODO(setup): signup usually needs a UNIQUE email per run (plus-addressing) and may send a
+#   verification email. Configure a QA bypass or a disposable inbox first, and confirm selectors.
+steps:
+  - goto: /signup
+  - fill:
+      selector: "input[type=email]"
+      valueFromEnv: SEATBELT_TEST_EMAIL
+  - fill:
+      selector: "input[type=password]"
+      valueFromEnv: SEATBELT_TEST_PASSWORD
+  - click: "button[type=submit]"
+  - screenshot: after-signup
+`;
+var UPLOAD = `id: upload-smoke
+name: User uploads a file
+description: Template only \u2014 upload a file and confirm it is accepted. Edit before enabling.
+critical: false
+status: yellow                   # template only \u2014 skipped until you configure it.
+tags:
+  - upload
+dependencies:
+  routes:
+    - /upload
+requires:
+  env:
+    - SEATBELT_TEST_EMAIL
+    - SEATBELT_TEST_PASSWORD
+# TODO(setup): add a fixture file at qa-fixtures/sample.pdf (or change the path), confirm the
+#   file-input selector, and set the success text your app shows after an upload.
+steps:
+  - goto: /upload
+  - upload:
+      selector: "input[type=file]"
+      path: "qa-fixtures/sample.pdf"
+  - click: "button[type=submit]"
+  - expectText: "Upload complete"      # TODO: change to your real success text
+  - screenshot: after-upload
+`;
+var CHECKOUT = `id: checkout-smoke
+name: Revenue / access flow (checkout example)
+description: Template only \u2014 an example revenue/access flow (checkout, billing, entitlements, or trial unlock). Edit before enabling.
+critical: false
+status: yellow                   # template only \u2014 this flow is app-specific. Keep disabled until wired.
+tags:
+  - checkout
+  - billing
+dependencies:
+  routes:
+    - /pricing
+    - /checkout
+    - /dashboard
+requires:
+  env:
+    - SEATBELT_TEST_EMAIL
+    - SEATBELT_TEST_PASSWORD
+# TODO(setup): this is an EXAMPLE of a critical flow \u2014 checkout, billing, entitlements, a trial
+#   unlock, or whatever revenue/access flow your app has. Not every app has one; delete this file
+#   if yours doesn't. Every app differs (Stripe or not, hosted vs embedded fields, local vs a
+#   preview/staging URL). Wire your real pricing/upgrade selectors and expected unlock state. If you
+#   use Stripe test mode, its test card is 4242 4242 4242 4242. Keep disabled until intentionally set.
+steps:
+  - goto: /pricing
+  - click: "text=Upgrade"              # TODO: your real upgrade button text/selector
+  - screenshot: checkout-page
+`;
+var STARTER_FLOW_TEMPLATES = [
+  { id: "homepage-smoke", yaml: HOMEPAGE },
+  { id: "login-smoke", yaml: LOGIN },
+  { id: "dashboard-smoke", yaml: DASHBOARD },
+  { id: "signup-smoke", yaml: SIGNUP },
+  { id: "upload-smoke", yaml: UPLOAD },
+  { id: "checkout-smoke", yaml: CHECKOUT }
+];
+function hasAnyFlowFiles(dir) {
+  try {
+    return fs2.readdirSync(dir).some((f) => f.endsWith(".yaml") || f.endsWith(".yml"));
+  } catch {
+    return false;
+  }
+}
+async function ensureStarterFlows(flowsDir) {
+  await ensureDir(flowsDir);
+  if (hasAnyFlowFiles(flowsDir)) return [];
+  const created = [];
+  for (const tpl of STARTER_FLOW_TEMPLATES) {
+    await writeText(path3.join(flowsDir, `${tpl.id}.yaml`), tpl.yaml);
+    created.push(tpl.id);
+  }
+  return created;
+}
+
+// src/flows/load.ts
+function listFlowFiles(dir) {
+  if (!exists(dir)) return [];
+  return fs3.readdirSync(dir).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml")).sort();
+}
+async function ensureFlowsDir(flowsDir) {
+  return ensureStarterFlows(flowsDir);
+}
+async function loadFlows(cwd, flowsDirName, options = {}) {
+  const flowsDir = path4.join(cwd, flowsDirName);
+  const createdFlowIds = options.create === false ? [] : await ensureFlowsDir(flowsDir);
+  const createdStarter = createdFlowIds.length > 0;
+  const files2 = listFlowFiles(flowsDir);
+  const flows = [];
+  const errors = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const fileName of files2) {
+    const full = path4.join(flowsDir, fileName);
+    let parsed;
+    try {
+      parsed = YAML.parse(await readText(full));
+    } catch (e) {
+      const first = e instanceof Error ? e.message.split("\n")[0] ?? e.message : String(e);
+      errors.push({ file: fileName, message: `not valid YAML (${first})` });
+      continue;
+    }
+    const result = flowSchema.safeParse(parsed);
+    if (!result.success) {
+      const issue = result.error.issues[0];
+      const where = issue && issue.path.length ? issue.path.join(".") : "(flow)";
+      errors.push({ file: fileName, message: `${where}: ${issue?.message ?? "invalid flow"}` });
+      continue;
+    }
+    const flow = result.data;
+    if (seen.has(flow.id)) {
+      errors.push({ file: fileName, message: `duplicate flow id "${flow.id}"` });
+      continue;
+    }
+    seen.add(flow.id);
+    flows.push(flow);
+  }
+  flows.sort((a, b) => a.id.localeCompare(b.id));
+  return { flowsDir, flows, createdStarter, createdFlowIds, errors };
+}
+
+// src/state/state.ts
+var HOMEPAGE_SMOKE_ID = "homepage-smoke";
+function normalizeFlow(f) {
+  return {
+    id: f.id,
+    name: f.name,
+    status: f.status ?? "grey",
+    description: f.description ?? "",
+    tags: f.tags ?? [],
+    lastRunId: f.lastRunId ?? null,
+    lastRunAt: f.lastRunAt ?? null,
+    lastReportPath: f.lastReportPath ?? null,
+    lastFailureSummary: f.lastFailureSummary ?? null,
+    dependencies: {
+      files: f.dependencies?.files ?? [],
+      routes: f.dependencies?.routes ?? [],
+      services: f.dependencies?.services ?? []
+    },
+    requires: { env: f.requires?.env ?? [] },
+    needs: f.needs ?? [],
+    certification: {
+      lastCertifiedAt: f.certification?.lastCertifiedAt ?? null,
+      lastCertifiedRunId: f.certification?.lastCertifiedRunId ?? null
+    }
+  };
+}
+function seedState(projectName) {
+  return {
+    version: 1,
+    project: { name: projectName },
+    flows: [
+      normalizeFlow({
+        id: HOMEPAGE_SMOKE_ID,
+        name: "Homepage loads",
+        status: "grey",
+        description: "Open the configured app URL and confirm the page loads.",
+        tags: ["smoke"]
+      })
+    ]
+  };
+}
+async function loadState(stateFile) {
+  if (!exists(stateFile)) return null;
+  const raw = await readJson(stateFile);
+  return {
+    version: raw.version ?? 1,
+    project: raw.project ?? { name: "My app" },
+    flows: (raw.flows ?? []).map((f) => normalizeFlow(f))
+  };
+}
+async function saveState(stateFile, state) {
+  await writeJson(stateFile, state);
+}
+async function loadOrSeedState(stateFile, projectName) {
+  return await loadState(stateFile) ?? seedState(projectName);
+}
+function upsertFlow(state, patch) {
+  const index = state.flows.findIndex((f) => f.id === patch.id);
+  if (index === -1) {
+    return { ...state, flows: [...state.flows, normalizeFlow(patch)] };
+  }
+  const flows = state.flows.map((f, i) => i === index ? { ...f, ...patch } : f);
+  return { ...state, flows };
+}
+function syncFlowsFromYaml(state, inputs) {
+  let next = state;
+  for (const f of inputs) {
+    const existing = next.flows.find((x) => x.id === f.id);
+    if (existing) {
+      next = upsertFlow(next, {
+        id: f.id,
+        name: f.name,
+        description: f.description,
+        tags: f.tags,
+        dependencies: f.dependencies,
+        requires: f.requires,
+        needs: f.needs
+      });
+    } else {
+      next = upsertFlow(next, {
+        id: f.id,
+        name: f.name,
+        status: f.declaredStatus ?? "grey",
+        description: f.description,
+        tags: f.tags,
+        dependencies: f.dependencies,
+        requires: f.requires,
+        needs: f.needs
+      });
+    }
+  }
+  return next;
+}
+function recordCertification(state, id, runId, at) {
+  return upsertFlow(state, {
+    id,
+    name: state.flows.find((f) => f.id === id)?.name ?? id,
+    certification: { lastCertifiedAt: at, lastCertifiedRunId: runId }
+  });
+}
+
+// src/utils/log.ts
+import pc from "picocolors";
+var log = {
+  plain(message = "") {
+    console.log(message);
+  },
+  step(message) {
+    console.log(pc.cyan("\u203A ") + message);
+  },
+  success(message) {
+    console.log(pc.green("\u2714 ") + message);
+  },
+  warn(message) {
+    console.log(pc.yellow("! ") + message);
+  },
+  info(message) {
+    console.log(pc.blue("i ") + message);
+  },
+  dim(message) {
+    console.log(pc.dim(message));
+  },
+  blank() {
+    console.log("");
+  }
+};
+
+// src/utils/prompt.ts
+import readline from "readline/promises";
+import { stdin as input, stdout as output } from "process";
+async function offer(question, opts = {}) {
+  const { autoYes = false, defaultYes = true } = opts;
+  if (autoYes) return true;
+  if (!process.stdin.isTTY) return false;
+  const hint = defaultYes ? "[Y/n]" : "[y/N]";
+  const rl = readline.createInterface({ input, output });
+  try {
+    const answer = (await rl.question(`${question} ${hint} `)).trim().toLowerCase();
+    if (answer === "") return defaultYes;
+    return /^y(es)?$/.test(answer);
+  } finally {
+    rl.close();
+  }
+}
+
+// src/utils/errors.ts
+import pc2 from "picocolors";
+var SeatbeltError = class extends Error {
+  hint;
+  constructor(message, hint) {
+    super(message);
+    this.name = "SeatbeltError";
+    this.hint = hint;
+  }
+};
+function isDebug() {
+  return process.env.SEATBELT_DEBUG === "1" || process.argv.includes("--debug");
+}
+function printError(err) {
+  console.error("");
+  if (err instanceof SeatbeltError) {
+    console.error(pc2.red("\u2716 ") + pc2.red(err.message));
+    if (err.hint) {
+      console.error("");
+      console.error(err.hint);
+    }
+  } else {
+    const msg = err instanceof Error ? err.message : String(err);
+    console.error(pc2.red("\u2716 Something went wrong.") + " " + msg);
+    console.error("");
+    console.error(pc2.dim("Run again with SEATBELT_DEBUG=1 for technical details."));
+  }
+  if (isDebug() && err instanceof Error && err.stack) {
+    console.error("");
+    console.error(pc2.dim(err.stack));
+  }
+}
+
+// src/commands/run.ts
+import path11 from "path";
+import open from "open";
+import { chromium } from "playwright";
+
+// src/config/load.ts
+import YAML2 from "yaml";
+
+// src/config/detect.ts
+import path5 from "path";
+import fs4 from "fs";
+
+// src/utils/net.ts
+import net from "net";
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function parseHostPort(url) {
+  const u = new URL(url);
+  const port = u.port ? Number(u.port) : u.protocol === "https:" ? 443 : 80;
+  return { host: u.hostname, port };
+}
+function isLocalhostUrl(url) {
+  try {
+    const host = new URL(url).hostname;
+    return host === "localhost" || host === "127.0.0.1" || host === "0.0.0.0" || host === "::1" || host.endsWith(".local");
+  } catch {
+    return false;
+  }
+}
+function probePort(host, port, timeoutMs = 400) {
+  return new Promise((resolve) => {
+    const socket = new net.Socket();
+    let settled = false;
+    const done = (ok) => {
+      if (settled) return;
+      settled = true;
+      socket.destroy();
+      resolve(ok);
+    };
+    socket.setTimeout(timeoutMs);
+    socket.once("connect", () => done(true));
+    socket.once("timeout", () => done(false));
+    socket.once("error", () => done(false));
+    socket.connect(port, host === "localhost" ? "127.0.0.1" : host);
+  });
+}
+async function isUrlReachable(url, timeoutMs = 1e3) {
+  try {
+    const { host, port } = parseHostPort(url);
+    return await probePort(host, port, timeoutMs);
+  } catch {
+    return false;
+  }
+}
+async function firstReachablePort(host, ports, timeoutMs = 400) {
+  const checks = await Promise.all(
+    ports.map(async (port) => ({ port, ok: await probePort(host, port, timeoutMs) }))
+  );
+  for (const port of ports) {
+    if (checks.find((c) => c.port === port)?.ok) return port;
+  }
+  return null;
+}
+async function waitForUrlReachable(url, timeoutMs, intervalMs = 500) {
+  const deadline = Date.now() + timeoutMs;
+  if (await isUrlReachable(url, 1e3)) return true;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    if (await isUrlReachable(url, 1e3)) return true;
+  }
+  return false;
+}
+
+// src/config/detect.ts
+var FRAMEWORK_DEFAULT_PORT = {
+  nextjs: 3e3,
+  nuxt: 3e3,
+  vite: 5173,
+  quasar: 9e3,
+  node: 3e3
+};
+var COMMON_PORTS = [3e3, 3001, 5173, 8080, 9e3];
+async function readPackageJson(cwd) {
+  const file = path5.join(cwd, "package.json");
+  if (!exists(file)) return null;
+  try {
+    return JSON.parse(await readText(file));
+  } catch {
+    return null;
+  }
+}
+function detectPackageManager(cwd) {
+  if (exists(path5.join(cwd, "pnpm-lock.yaml"))) return "pnpm";
+  if (exists(path5.join(cwd, "yarn.lock"))) return "yarn";
+  if (exists(path5.join(cwd, "package-lock.json"))) return "npm";
+  return "npm";
+}
+function hasDep(pkg, name) {
+  if (!pkg) return false;
+  return Boolean(pkg.dependencies?.[name] || pkg.devDependencies?.[name]);
+}
+function hasConfigFile(cwd, base) {
+  return [".js", ".ts", ".mjs", ".cjs"].some((ext) => exists(path5.join(cwd, base + ext)));
+}
+function detectFramework(cwd, pkg) {
+  if (hasDep(pkg, "next") || hasConfigFile(cwd, "next.config")) return "nextjs";
+  if (hasDep(pkg, "nuxt") || hasDep(pkg, "nuxt3") || hasConfigFile(cwd, "nuxt.config")) return "nuxt";
+  if (hasDep(pkg, "quasar") || hasDep(pkg, "@quasar/app-vite") || hasDep(pkg, "@quasar/app-webpack") || hasConfigFile(cwd, "quasar.config")) {
+    return "quasar";
+  }
+  if (hasDep(pkg, "vite") || hasConfigFile(cwd, "vite.config")) return "vite";
+  return "node";
+}
+function runScript(pm2, script) {
+  return `${pm2} run ${script}`;
+}
+function pickScript(pkg, names) {
+  if (!pkg?.scripts) return void 0;
+  return names.find((n) => Boolean(pkg.scripts?.[n]));
+}
+var COMPOSE_FILES = ["docker-compose.yml", "docker-compose.yaml", "compose.yaml", "compose.yml"];
+function detectComposeFile(cwd) {
+  return COMPOSE_FILES.find((f) => exists(path5.join(cwd, f))) ?? null;
+}
+function detectEnvFiles(cwd) {
+  try {
+    return fs4.readdirSync(cwd).filter((f) => f === ".env" || f.startsWith(".env.")).sort();
+  } catch {
+    return [];
+  }
+}
+function isPlaceholderTest(script) {
+  return /no test specified/i.test(script);
+}
+async function detect(paths) {
+  const cwd = paths.cwd;
+  const pkg = await readPackageJson(cwd);
+  const packageManager = detectPackageManager(cwd);
+  const framework = detectFramework(cwd, pkg);
+  const devScript = pickScript(pkg, ["dev", "start"]);
+  const devCommand = devScript ? runScript(packageManager, devScript) : void 0;
+  const buildScript = pickScript(pkg, ["build"]);
+  const lintScript = pickScript(pkg, ["lint"]);
+  const typecheckScript = pickScript(pkg, ["typecheck", "type-check"]);
+  const testScript = pickScript(pkg, ["test"]);
+  const defaultPort = FRAMEWORK_DEFAULT_PORT[framework];
+  const probeOrder = [defaultPort, ...COMMON_PORTS].filter((p, i, a) => a.indexOf(p) === i);
+  const livePort = await firstReachablePort("127.0.0.1", probeOrder, 350);
+  const port = livePort ?? defaultPort;
+  const checks = {};
+  if (buildScript) checks.build = runScript(packageManager, buildScript);
+  if (lintScript) checks.lint = runScript(packageManager, lintScript);
+  if (typecheckScript) checks.typecheck = runScript(packageManager, typecheckScript);
+  if (testScript && pkg?.scripts?.[testScript] && !isPlaceholderTest(pkg.scripts[testScript])) {
+    checks.test = runScript(packageManager, testScript);
+  }
+  return {
+    framework,
+    packageManager,
+    livePortFound: livePort !== null,
+    hasPackageJson: pkg !== null,
+    scripts: pkg?.scripts ? Object.keys(pkg.scripts).sort() : [],
+    composeFile: detectComposeFile(cwd),
+    envFiles: detectEnvFiles(cwd),
+    app: { framework, packageManager },
+    server: {
+      ...devCommand ? { devCommand } : {},
+      baseUrl: `http://localhost:${port}`,
+      port
+    },
+    ...Object.keys(checks).length ? { checks } : {}
+  };
+}
+async function detectConfig(paths) {
+  const summary = await detect(paths);
+  return {
+    app: summary.app,
+    server: summary.server,
+    ...summary.checks ? { checks: summary.checks } : {}
+  };
+}
+
+// src/config/load.ts
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function deepMerge(target, ...sources) {
+  for (const source of sources) {
+    if (!isPlainObject(source)) continue;
+    for (const [key, value] of Object.entries(source)) {
+      if (value === void 0) continue;
+      const existing = target[key];
+      if (isPlainObject(existing) && isPlainObject(value)) {
+        target[key] = deepMerge({ ...existing }, value);
+      } else {
+        target[key] = value;
+      }
+    }
+  }
+  return target;
+}
+function formatZodError(err) {
+  return err.issues.map((issue) => {
+    const where = issue.path.length ? issue.path.join(".") : "(root)";
+    return `  \u2022 ${where}: ${issue.message}`;
+  }).join("\n");
+}
+async function loadConfig(opts = {}) {
+  const paths = resolvePaths(opts.cwd);
+  const detected = await detectConfig(paths);
+  let fileConfig = {};
+  const configFileExists = exists(paths.configFile);
+  if (configFileExists) {
+    let parsed;
+    try {
+      parsed = YAML2.parse(await readText(paths.configFile));
+    } catch {
+      throw new SeatbeltError(
+        "Your seatbelt.config.yaml could not be read as YAML.",
+        `Check ${paths.configFile} for a syntax slip \u2014 usually a bad indent or a missing colon.`
+      );
+    }
+    if (parsed !== null && parsed !== void 0) {
+      if (!isPlainObject(parsed)) {
+        throw new SeatbeltError(
+          "Your seatbelt.config.yaml must be a set of settings (a YAML mapping), not a list or single value.",
+          "Start from the block that `seatbelt on` generates and add settings under it."
+        );
+      }
+      fileConfig = parsed;
+    }
+  }
+  const merged = deepMerge({}, detected, fileConfig, opts.overrides);
+  const result = configSchema.safeParse(merged);
+  if (!result.success) {
+    throw new SeatbeltError(
+      "Your Seatbelt configuration has a problem:\n" + formatZodError(result.error),
+      "Fix the value(s) above in seatbelt.config.yaml, then run the command again."
+    );
+  }
+  return { config: result.data, configFileExists, paths };
+}
+
+// src/utils/runId.ts
+function createRunId(date = /* @__PURE__ */ new Date()) {
+  const pad = (n) => String(n).padStart(2, "0");
+  const y = date.getFullYear();
+  const mo = pad(date.getMonth() + 1);
+  const d = pad(date.getDate());
+  const h = pad(date.getHours());
+  const mi = pad(date.getMinutes());
+  const s = pad(date.getSeconds());
+  return `${y}-${mo}-${d}_${h}-${mi}-${s}`;
+}
+
+// src/version.ts
+var VERSION = "0.0.1";
+
+// src/server/lifecycle.ts
+import path6 from "path";
+import { spawn } from "child_process";
+import { execa } from "execa";
+var noopStop = async () => {
+};
+function portOf(config) {
+  try {
+    const u = new URL(config.server.baseUrl);
+    if (u.port) return Number(u.port);
+  } catch {
+  }
+  if (config.server.port) return config.server.port;
+  try {
+    return parseHostPort(config.server.baseUrl).port;
+  } catch {
+    return 3e3;
+  }
+}
+async function killTree(pid, sub) {
+  if (!pid) {
+    try {
+      sub.kill();
+    } catch {
+    }
+    return;
+  }
+  if (process.platform === "win32") {
+    await new Promise((resolve) => {
+      const t = spawn("taskkill", ["/pid", String(pid), "/T", "/F"], { stdio: "ignore" });
+      t.on("exit", () => resolve());
+      t.on("error", () => resolve());
+    });
+  } else {
+    try {
+      sub.kill("SIGTERM");
+    } catch {
+    }
+  }
+  await Promise.race([sub.catch(() => void 0), sleep(2e3)]);
+}
+async function ensureServer(config, cwd, runDir) {
+  const baseUrl = config.server.baseUrl;
+  if (await isUrlReachable(baseUrl, 1500)) {
+    log.info(`Reusing the app already running at ${pc.cyan(baseUrl)}.`);
+    return { startedBySeatbelt: false, ready: true, logPath: null, stop: noopStop };
+  }
+  const devCommand = config.server.devCommand;
+  if (!devCommand) {
+    return {
+      startedBySeatbelt: false,
+      ready: false,
+      logPath: null,
+      error: `Nothing is running at ${baseUrl}, and Seatbelt couldn't detect a dev command to start it.`,
+      stop: noopStop
+    };
+  }
+  if (!isLocalhostUrl(baseUrl)) {
+    return {
+      startedBySeatbelt: false,
+      ready: false,
+      logPath: null,
+      error: `Refusing to auto-start a dev server for a non-localhost URL (${baseUrl}). Start it yourself, then run Seatbelt.`,
+      stop: noopStop
+    };
+  }
+  const logPath = path6.join(runDir, "server.log");
+  const port = portOf(config);
+  log.step(`Starting your dev server: ${pc.cyan(devCommand)}`);
+  log.dim(`  (logs \u2192 ${displayPath(cwd, logPath)})`);
+  const sub = execa(devCommand, {
+    shell: true,
+    cwd,
+    reject: false,
+    stdout: { file: logPath },
+    stderr: { file: logPath },
+    env: { ...process.env, PORT: String(port), BROWSER: "none", SEATBELT_QA: "1" }
+  });
+  const pid = sub.pid;
+  const stop = async () => {
+    await killTree(pid, sub);
+  };
+  const ready = await waitForUrlReachable(baseUrl, config.server.startTimeoutMs, 500);
+  if (!ready) {
+    await stop();
+    return {
+      startedBySeatbelt: true,
+      ready: false,
+      logPath,
+      error: `Your dev server didn't become reachable at ${baseUrl} within ${Math.round(
+        config.server.startTimeoutMs / 1e3
+      )}s. Check the server log for the reason.`,
+      stop: noopStop
+    };
+  }
+  log.success(`Dev server is up at ${pc.cyan(baseUrl)}.`);
+  return { startedBySeatbelt: true, ready: true, logPath, stop };
+}
+
+// src/reset/run.ts
+import path7 from "path";
+import { execa as execa2 } from "execa";
+var RESET_BASE = {
+  verifyHttpUrl: null,
+  verifyHttpOk: null
+};
+function resetBlocksRun(r) {
+  return r.required && (r.status === "missing" || r.status === "failed" || r.status === "refused");
+}
+function resetIsCaution(r) {
+  return !r.required && (r.status === "failed" || r.status === "refused");
+}
+function dangerousReason(command) {
+  if (/\brm\s+-rf\b/i.test(command)) return "it contains `rm -rf`";
+  if (/\bdropdb\b/i.test(command)) return "it contains `dropdb`";
+  if (/\bdrop\s+database\b/i.test(command)) return "it drops a database";
+  if (/prisma\s+migrate\s+reset/i.test(command) && /--force\b/i.test(command)) {
+    return "it runs `prisma migrate reset --force`";
+  }
+  if (/\bseatbelt\s+run\b/i.test(command)) return "it would recursively invoke `seatbelt run`";
+  return null;
+}
+function resolveVerifyUrl(httpOk2, baseUrl) {
+  if (/^https?:\/\//i.test(httpOk2)) return httpOk2;
+  return baseUrl.replace(/\/+$/, "") + "/" + httpOk2.replace(/^\/+/, "");
+}
+async function httpOk(url, timeoutMs) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  let fetchUrl = url;
+  try {
+    const u = new URL(url);
+    if (u.hostname === "localhost") {
+      u.hostname = "127.0.0.1";
+      fetchUrl = u.toString();
+    }
+  } catch {
+  }
+  try {
+    const res = await fetch(fetchUrl, { signal: controller.signal, redirect: "follow" });
+    return { ok: res.status >= 200 && res.status < 300, detail: `HTTP ${res.status}` };
+  } catch (e) {
+    const msg = e instanceof Error ? e.message.split("\n")[0] ?? e.message : String(e);
+    return { ok: false, detail: msg };
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function resetNotRun(config, reason) {
+  return {
+    ...RESET_BASE,
+    configured: Boolean(config.reset.command),
+    required: config.reset.required,
+    command: config.reset.command ?? null,
+    status: "not-run",
+    exitCode: null,
+    durationMs: 0,
+    logFile: null,
+    summary: reason
+  };
+}
+async function runReset(config, cwd, runDir, baseUrl) {
+  const command = config.reset.command ?? null;
+  const required = config.reset.required;
+  if (!command) {
+    return {
+      ...RESET_BASE,
+      configured: false,
+      required,
+      command: null,
+      status: required ? "missing" : "skipped",
+      exitCode: null,
+      durationMs: 0,
+      logFile: null,
+      summary: required ? "Reset is required, but no reset command is configured. Run `seatbelt setup-reset`." : "No clean-test-user reset configured (skipped)."
+    };
+  }
+  if (!isLocalhostUrl(baseUrl) && !config.reset.allowNonLocal) {
+    return {
+      ...RESET_BASE,
+      configured: true,
+      required,
+      command,
+      status: "refused",
+      exitCode: null,
+      durationMs: 0,
+      logFile: null,
+      summary: `Refused to run reset against a non-localhost URL (${baseUrl}). Set reset.allowNonLocal: true to override.`
+    };
+  }
+  const danger = dangerousReason(command);
+  if (danger) {
+    return {
+      ...RESET_BASE,
+      configured: true,
+      required,
+      command,
+      status: "refused",
+      exitCode: null,
+      durationMs: 0,
+      logFile: null,
+      summary: `Refused to auto-run the reset command because ${danger}. Run it yourself if that's intentional.`
+    };
+  }
+  const logPath = path7.join(runDir, "reset.log");
+  const start = Date.now();
+  const result = await execa2(command, {
+    shell: true,
+    cwd,
+    reject: false,
+    timeout: config.reset.timeoutMs,
+    // SEATBELT_QA=1 lets the app enable QA-only reset behavior. We never override NODE_ENV.
+    env: { ...process.env, SEATBELT_QA: "1" }
+  });
+  const durationMs = Date.now() - start;
+  const stdout = typeof result.stdout === "string" ? result.stdout : "";
+  const stderr = typeof result.stderr === "string" ? result.stderr : "";
+  const timedOut = result.timedOut === true;
+  const exitCode = typeof result.exitCode === "number" ? result.exitCode : timedOut ? null : 1;
+  const expect = config.reset.verify?.expectStdoutContains;
+  const stdoutFailed = Boolean(expect) && !stdout.includes(expect);
+  let verifyHttpUrl = null;
+  let verifyHttpOk = null;
+  let httpDetail = "";
+  const commandOk = !timedOut && exitCode === 0 && !stdoutFailed;
+  const httpOkTarget = config.reset.verify?.httpOk;
+  if (commandOk && httpOkTarget) {
+    verifyHttpUrl = resolveVerifyUrl(httpOkTarget, baseUrl);
+    if (!isLocalhostUrl(verifyHttpUrl) && !config.reset.allowNonLocal) {
+      verifyHttpOk = false;
+      httpDetail = "refused to check a non-localhost health URL (set reset.allowNonLocal: true)";
+    } else {
+      const res = await httpOk(verifyHttpUrl, Math.min(config.reset.timeoutMs, 15e3));
+      verifyHttpOk = res.ok;
+      httpDetail = res.detail;
+    }
+  }
+  await writeText(
+    logPath,
+    `$ ${command}
+
+[stdout]
+${stdout}
+
+[stderr]
+${stderr}
+
+[exit] ${exitCode ?? "killed"}${timedOut ? " (timed out)" : ""}
+${verifyHttpUrl ? `
+[verify httpOk] ${verifyHttpUrl} -> ${verifyHttpOk ? "ok" : "FAILED"} (${httpDetail})
+` : ""}`
+  );
+  const logFile = displayPath(cwd, logPath);
+  const passed = commandOk && verifyHttpOk !== false;
+  if (passed) {
+    return {
+      configured: true,
+      required,
+      command,
+      status: "passed",
+      exitCode,
+      durationMs,
+      logFile,
+      verifyHttpUrl,
+      verifyHttpOk,
+      summary: `Clean test user ready (${command}, ${(durationMs / 1e3).toFixed(1)}s${verifyHttpUrl ? `, health ${httpDetail}` : ""}).`
+    };
+  }
+  const reason = timedOut ? `timed out after ${Math.round(config.reset.timeoutMs / 1e3)}s` : stdoutFailed ? `did not print the expected text "${expect}"` : verifyHttpOk === false ? `health check failed at ${verifyHttpUrl} (${httpDetail})` : `exited with code ${exitCode}`;
+  return {
+    configured: true,
+    required,
+    command,
+    status: "failed",
+    exitCode,
+    durationMs,
+    logFile,
+    verifyHttpUrl,
+    verifyHttpOk,
+    summary: `Reset command ${reason}. See ${logFile}.`
+  };
+}
+
+// src/flows/runner.ts
+import fs5 from "fs";
+import path8 from "path";
+var GOTO_TIMEOUT_MS = 3e4;
+var STEP_TIMEOUT_MS = 15e3;
+function firstLine(err) {
+  const msg = err instanceof Error ? err.message : String(err);
+  return msg.split("\n")[0] ?? msg;
+}
+function joinUrl(baseUrl, target) {
+  if (/^https?:\/\//i.test(target)) return target;
+  return baseUrl.replace(/\/+$/, "") + "/" + target.replace(/^\/+/, "");
+}
+function stepLabel(step) {
+  if ("goto" in step) return `goto ${step.goto}`;
+  if ("click" in step) return `click ${step.click}`;
+  if ("fill" in step)
+    return `fill ${step.fill.selector}${step.fill.valueFromEnv ? ` (env ${step.fill.valueFromEnv})` : ""}`;
+  if ("press" in step)
+    return typeof step.press === "string" ? `press ${step.press}` : `press ${step.press.key}`;
+  if ("selectOption" in step) return `selectOption ${step.selectOption.selector}`;
+  if ("upload" in step) return `upload ${step.upload.path}`;
+  if ("waitForUrlContains" in step) return `waitForUrlContains ${step.waitForUrlContains}`;
+  if ("waitForText" in step) return `waitForText ${step.waitForText}`;
+  if ("waitForTimeoutMs" in step) return `waitForTimeoutMs ${step.waitForTimeoutMs}`;
+  if ("expectUrlContains" in step) return `expectUrlContains ${step.expectUrlContains}`;
+  if ("expectText" in step) return `expectText ${step.expectText}`;
+  if ("expectVisible" in step) return `expectVisible ${step.expectVisible}`;
+  if ("expectNotVisible" in step) return `expectNotVisible ${step.expectNotVisible}`;
+  if ("expectTitleContains" in step)
+    return step.expectTitleContains === "" ? "expectTitleContains (any)" : `expectTitleContains ${step.expectTitleContains}`;
+  if ("screenshot" in step) return `screenshot ${step.screenshot}`;
+  return "step";
+}
+async function runStep(page, step, ctx) {
+  if ("goto" in step) {
+    await page.goto(joinUrl(ctx.baseUrl, step.goto), { waitUntil: "load", timeout: GOTO_TIMEOUT_MS });
+    return;
+  }
+  if ("click" in step) {
+    await page.click(step.click, { timeout: STEP_TIMEOUT_MS });
+    return;
+  }
+  if ("fill" in step) {
+    let value;
+    if (step.fill.valueFromEnv) {
+      const v = ctx.env[step.fill.valueFromEnv];
+      if (v === void 0 || v === "") {
+        throw new Error(`env var ${step.fill.valueFromEnv} is not set (needed to fill this field)`);
+      }
+      value = v;
+    } else {
+      value = step.fill.value ?? "";
+    }
+    await page.fill(step.fill.selector, value, { timeout: STEP_TIMEOUT_MS });
+    return;
+  }
+  if ("press" in step) {
+    if (typeof step.press === "string") {
+      await page.keyboard.press(step.press);
+    } else if (step.press.selector) {
+      await page.locator(step.press.selector).first().press(step.press.key, { timeout: STEP_TIMEOUT_MS });
+    } else {
+      await page.keyboard.press(step.press.key);
+    }
+    return;
+  }
+  if ("selectOption" in step) {
+    await page.selectOption(step.selectOption.selector, step.selectOption.value, {
+      timeout: STEP_TIMEOUT_MS
+    });
+    return;
+  }
+  if ("upload" in step) {
+    const abs = path8.isAbsolute(step.upload.path) ? step.upload.path : path8.join(ctx.cwd, step.upload.path);
+    if (!fs5.existsSync(abs)) {
+      throw new Error(`fixture file not found: ${step.upload.path} (add it, or fix the path)`);
+    }
+    await page.setInputFiles(step.upload.selector, abs, { timeout: STEP_TIMEOUT_MS });
+    return;
+  }
+  if ("waitForUrlContains" in step) {
+    const needle = step.waitForUrlContains;
+    await page.waitForURL((url) => String(url).includes(needle), { timeout: STEP_TIMEOUT_MS });
+    return;
+  }
+  if ("waitForText" in step) {
+    await page.getByText(step.waitForText).first().waitFor({ state: "visible", timeout: STEP_TIMEOUT_MS });
+    return;
+  }
+  if ("waitForTimeoutMs" in step) {
+    await page.waitForTimeout(step.waitForTimeoutMs);
+    return;
+  }
+  if ("expectUrlContains" in step) {
+    const needle = step.expectUrlContains;
+    try {
+      await page.waitForURL((url) => String(url).includes(needle), { timeout: STEP_TIMEOUT_MS });
+    } catch {
+      throw new Error(`expected the URL to contain "${needle}", but it is "${page.url()}"`);
+    }
+    return;
+  }
+  if ("expectText" in step) {
+    try {
+      await page.getByText(step.expectText).first().waitFor({ state: "visible", timeout: STEP_TIMEOUT_MS });
+    } catch {
+      throw new Error(`expected to see the text "${step.expectText}", but it wasn't visible`);
+    }
+    return;
+  }
+  if ("expectVisible" in step) {
+    try {
+      await page.locator(step.expectVisible).first().waitFor({ state: "visible", timeout: STEP_TIMEOUT_MS });
+    } catch {
+      throw new Error(`expected "${step.expectVisible}" to be visible, but it wasn't`);
+    }
+    return;
+  }
+  if ("expectNotVisible" in step) {
+    const loc = page.locator(step.expectNotVisible).first();
+    const visible = await loc.isVisible().catch(() => false);
+    if (visible) {
+      throw new Error(`expected "${step.expectNotVisible}" to be hidden, but it is visible`);
+    }
+    return;
+  }
+  if ("expectTitleContains" in step) {
+    const needle = step.expectTitleContains;
+    if (needle === "") return;
+    const title = await page.title();
+    if (!title.includes(needle)) {
+      throw new Error(`page title "${title}" does not contain "${needle}"`);
+    }
+    return;
+  }
+  if ("screenshot" in step) {
+    await ensureDir(ctx.shotDir);
+    const file = path8.join(ctx.shotDir, `${step.screenshot || "screenshot"}.png`);
+    await page.screenshot({ path: file, fullPage: true });
+    ctx.screenshots.push(file);
+    return;
+  }
+}
+async function runFlow(page, flow, baseUrl, runDir, env, cwd) {
+  const consoleErrors = [];
+  const networkFailures = [];
+  page.on("console", (m) => {
+    if (m.type() === "error") consoleErrors.push(m.text());
+  });
+  page.on("pageerror", (e) => consoleErrors.push(e.message));
+  page.on("requestfailed", (r) => {
+    const f = r.failure();
+    networkFailures.push(`${r.method()} ${r.url()} \u2014 ${f?.errorText ?? "failed"}`);
+  });
+  page.on("response", (res) => {
+    if (res.status() >= 400) {
+      networkFailures.push(`${res.request().method()} ${res.url()} \u2192 ${res.status()}`);
+    }
+  });
+  const shotDir = path8.join(runDir, "flows", flow.id);
+  const screenshots = [];
+  const ctx = { baseUrl, cwd, env, shotDir, screenshots };
+  const steps = [];
+  let failureSummary = null;
+  const start = Date.now();
+  const firstStep = flow.steps[0];
+  const beginsWithGoto = firstStep !== void 0 && "goto" in firstStep;
+  if (flow.startUrl && !beginsWithGoto) {
+    try {
+      await page.goto(joinUrl(baseUrl, flow.startUrl), {
+        waitUntil: "load",
+        timeout: GOTO_TIMEOUT_MS
+      });
+    } catch (e) {
+      const msg = firstLine(e);
+      steps.push({ index: 0, label: `goto ${flow.startUrl} (startUrl)`, ok: false, error: msg });
+      failureSummary = `startUrl ${flow.startUrl}: ${msg}`;
+    }
+  }
+  if (!failureSummary) {
+    for (let i = 0; i < flow.steps.length; i++) {
+      const step = flow.steps[i];
+      const label = stepLabel(step);
+      try {
+        await runStep(page, step, ctx);
+        steps.push({ index: i, label, ok: true, error: null });
+      } catch (e) {
+        const msg = firstLine(e);
+        steps.push({ index: i, label, ok: false, error: msg });
+        failureSummary = `step ${i + 1} (${label}): ${msg}`;
+        try {
+          await ensureDir(shotDir);
+          const file = path8.join(shotDir, "failure.png");
+          await page.screenshot({ path: file, fullPage: true });
+          screenshots.push(file);
+        } catch {
+        }
+        break;
+      }
+    }
+  }
+  let finalUrl = null;
+  let pageTitle = null;
+  try {
+    finalUrl = page.url();
+  } catch {
+  }
+  try {
+    pageTitle = await page.title();
+  } catch {
+  }
+  return {
+    id: flow.id,
+    name: flow.name,
+    description: flow.description,
+    critical: flow.critical,
+    status: failureSummary ? "red" : "green",
+    finalUrl,
+    pageTitle,
+    steps,
+    screenshots,
+    consoleErrors,
+    networkFailures,
+    failureSummary,
+    durationMs: Date.now() - start
+  };
+}
+
+// src/flows/graph.ts
+function validateNeeds(flows) {
+  const ids = new Set(flows.map((f) => f.id));
+  const errors = [];
+  for (const f of flows) {
+    for (const n of f.needs) {
+      if (!ids.has(n)) {
+        errors.push({ message: `flow "${f.id}" needs "${n}", which doesn't exist in your flows` });
+      }
+    }
+  }
+  return errors;
+}
+function findCycle(flows) {
+  const byId = new Map(flows.map((f) => [f.id, f]));
+  const state = /* @__PURE__ */ new Map();
+  const stack = [];
+  const visit = (id) => {
+    const s = state.get(id);
+    if (s === "done") return null;
+    if (s === "visiting") {
+      const start = stack.indexOf(id);
+      return [...stack.slice(start), id];
+    }
+    const flow = byId.get(id);
+    if (!flow) return null;
+    state.set(id, "visiting");
+    stack.push(id);
+    for (const n of flow.needs) {
+      const cyc = visit(n);
+      if (cyc) return cyc;
+    }
+    stack.pop();
+    state.set(id, "done");
+    return null;
+  };
+  for (const f of flows) {
+    const cyc = visit(f.id);
+    if (cyc) return cyc;
+  }
+  return null;
+}
+function expandWithPrereqs(rootIds, byId) {
+  const out = /* @__PURE__ */ new Set();
+  const walk2 = (id) => {
+    if (out.has(id)) return;
+    const flow = byId.get(id);
+    if (!flow) return;
+    out.add(id);
+    for (const n of flow.needs) walk2(n);
+  };
+  for (const id of rootIds) walk2(id);
+  return out;
+}
+function topoSort(ids, byId) {
+  const result = [];
+  const done = /* @__PURE__ */ new Set();
+  const visit = (id) => {
+    if (done.has(id) || !ids.has(id)) return;
+    done.add(id);
+    const flow = byId.get(id);
+    if (flow) for (const n of flow.needs) visit(n);
+    result.push(id);
+  };
+  for (const id of ids) visit(id);
+  return result;
+}
+function journeys(ids, byId) {
+  const parent = /* @__PURE__ */ new Map();
+  const find = (x) => {
+    let r = x;
+    while (parent.get(r) !== r) r = parent.get(r);
+    let c = x;
+    while (parent.get(c) !== r) {
+      const next = parent.get(c);
+      parent.set(c, r);
+      c = next;
+    }
+    return r;
+  };
+  const union = (a, b) => {
+    const ra = find(a);
+    const rb = find(b);
+    if (ra !== rb) parent.set(ra, rb);
+  };
+  for (const id of ids) parent.set(id, id);
+  for (const id of ids) {
+    const flow = byId.get(id);
+    if (!flow) continue;
+    for (const n of flow.needs) if (ids.has(n)) union(id, n);
+  }
+  const groups = /* @__PURE__ */ new Map();
+  for (const id of ids) {
+    const root = find(id);
+    if (!groups.has(root)) groups.set(root, /* @__PURE__ */ new Set());
+    groups.get(root).add(id);
+  }
+  return [...groups.values()].map((set) => topoSort(set, byId));
+}
+
+// src/flows/env.ts
+import fs6 from "fs";
+import path9 from "path";
+function parseEnvFile(contents) {
+  const out = {};
+  for (const rawLine of contents.split(/\r?\n/)) {
+    const line2 = rawLine.trim();
+    if (!line2 || line2.startsWith("#")) continue;
+    const eq = line2.indexOf("=");
+    if (eq === -1) continue;
+    const key = line2.slice(0, eq).trim().replace(/^export\s+/, "");
+    if (!key) continue;
+    let value = line2.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    out[key] = value;
+  }
+  return out;
+}
+function envFileExists(cwd, envFile) {
+  try {
+    return fs6.existsSync(path9.join(cwd, envFile));
+  } catch {
+    return false;
+  }
+}
+function loadEnvValues(cwd, envFile) {
+  const values = {};
+  try {
+    const file = path9.join(cwd, envFile);
+    if (fs6.existsSync(file)) {
+      Object.assign(values, parseEnvFile(fs6.readFileSync(file, "utf8")));
+    }
+  } catch {
+  }
+  for (const [k, v] of Object.entries(process.env)) {
+    if (typeof v === "string") values[k] = v;
+  }
+  return values;
+}
+function requiredEnvForFlow(flow) {
+  const names = new Set(flow.requires.env);
+  for (const step of flow.steps) {
+    if ("fill" in step && step.fill.valueFromEnv) names.add(step.fill.valueFromEnv);
+  }
+  return [...names];
+}
+function missingEnvForFlow(flow, values) {
+  return requiredEnvForFlow(flow).filter((name) => {
+    const v = values[name];
+    return v === void 0 || v.trim() === "";
+  });
+}
+
+// src/flows/freshness.ts
+import crypto from "crypto";
+import fs7 from "fs";
+import path10 from "path";
+var META_FILENAME = "flow-meta.json";
+var META_VERSION = 1;
+function metaPath(paths) {
+  return path10.join(paths.seatbeltDir, META_FILENAME);
+}
+function readFlowMeta(paths) {
+  try {
+    const raw = JSON.parse(fs7.readFileSync(metaPath(paths), "utf8"));
+    return { version: raw.version ?? META_VERSION, flows: raw.flows ?? {} };
+  } catch {
+    return { version: META_VERSION, flows: {} };
+  }
+}
+async function writeFlowMeta(paths, meta) {
+  await fs7.promises.mkdir(paths.seatbeltDir, { recursive: true });
+  await fs7.promises.writeFile(metaPath(paths), JSON.stringify(meta, null, 2) + "\n", "utf8");
+}
+function fingerprintDependencies(cwd, deps) {
+  const out = {};
+  for (const rel of deps.files) {
+    if (rel.includes("*")) continue;
+    try {
+      const abs = path10.join(cwd, rel);
+      const stat = fs7.statSync(abs);
+      if (!stat.isFile()) continue;
+      out[rel] = crypto.createHash("sha1").update(fs7.readFileSync(abs)).digest("hex");
+    } catch {
+    }
+  }
+  return out;
+}
+function detectStale(current, baseline) {
+  if (!baseline || Object.keys(baseline).length === 0) return { stale: false, changedFiles: [] };
+  const changed = /* @__PURE__ */ new Set();
+  for (const [file, hash] of Object.entries(current)) {
+    if (baseline[file] !== void 0 && baseline[file] !== hash) changed.add(file);
+  }
+  for (const file of Object.keys(baseline)) {
+    if (!(file in current)) changed.add(file);
+  }
+  const changedFiles = [...changed];
+  return { stale: changedFiles.length > 0, changedFiles };
+}
+
+// src/report/verdict.ts
+function verdictLabel(v) {
+  if (v === "merge") return "MERGE";
+  if (v === "caution") return "MERGE WITH CAUTION";
+  return "DO NOT MERGE";
+}
+function verdictEmoji(v) {
+  if (v === "merge") return "\u2705";
+  if (v === "caution") return "\u26A0";
+  return "\u26D4";
+}
+function verdictExitCode(v) {
+  return v === "do_not_merge" ? 1 : 0;
+}
+function verdictClass(v) {
+  if (v === "merge") return "pass";
+  if (v === "caution") return "warn";
+  return "fail";
+}
+function computeVerdict(flows, reset, context = {}) {
+  const reasons = [];
+  let doNotMerge = false;
+  let caution = false;
+  if (context.serverUnavailable) {
+    doNotMerge = true;
+    reasons.push("The app/dev server could not be reached, so no flow could run.");
+  }
+  if (resetBlocksRun(reset)) {
+    doNotMerge = true;
+    reasons.push(`Required clean-test-user reset ${reset.status} \u2014 browser QA can't be trusted.`);
+  } else if (resetIsCaution(reset)) {
+    caution = true;
+    reasons.push("Clean-test-user reset did not succeed (not required) \u2014 results may be contaminated.");
+  }
+  for (const f of flows) {
+    if (f.status === "red") {
+      if (f.critical) {
+        doNotMerge = true;
+        reasons.push(`Critical flow "${f.id}" failed.`);
+      } else {
+        caution = true;
+        reasons.push(`Non-critical flow "${f.id}" failed.`);
+      }
+    } else if (f.status === "blocked") {
+      const why = f.blockedByPrereq ? `prerequisite "${f.blockedByPrereq}" did not pass` : f.missingEnv.length ? `missing env: ${f.missingEnv.join(", ")}` : "could not run";
+      if (f.critical) {
+        doNotMerge = true;
+        reasons.push(`Critical flow "${f.id}" blocked \u2014 ${why}.`);
+      } else {
+        caution = true;
+        reasons.push(`Flow "${f.id}" blocked \u2014 ${why}.`);
+      }
+    } else if (f.status === "yellow") {
+      caution = true;
+      reasons.push(`Flow "${f.id}" needs setup \u2014 not tested.`);
+    } else if (f.status === "grey") {
+      caution = true;
+      reasons.push(`Flow "${f.id}" has not been tested yet.`);
+    } else if (f.status === "green") {
+      if (f.stale) {
+        caution = true;
+        reasons.push(`Flow "${f.id}" passed but may be stale (dependency files changed).`);
+      }
+      if (f.consoleErrors.length || f.networkFailures.length) {
+        caution = true;
+        reasons.push(`Flow "${f.id}" passed but logged console/network errors.`);
+      }
+    }
+  }
+  const verdict = doNotMerge ? "do_not_merge" : caution ? "caution" : "merge";
+  return { verdict, reasons };
+}
+
+// src/report/html.ts
+function escapeHtml(input3) {
+  return input3.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;").replace(/'/g, "&#39;");
+}
+function countStatuses(flows) {
+  const counts = { green: 0, yellow: 0, red: 0, blocked: 0, grey: 0 };
+  for (const f of flows) counts[f.status] += 1;
+  return counts;
+}
+function buildFixPrompt(report) {
+  const reset = report.reset;
+  if (reset.status === "missing") {
+    return `Seatbelt needs a "clean test user" reset before it can trust browser QA, but no reset command is configured. Run \`seatbelt setup-reset\` to generate a prompt that adds a safe local reset script (\`qa:reset-user\`) to this app, then set reset.command in seatbelt.config.yaml and re-run \`seatbelt run\`.`;
+  }
+  if (reset.status === "failed") {
+    return `Seatbelt's clean-test-user reset failed before browser QA. The command \`${reset.command}\` ${reset.summary.replace(/^Reset command /, "")} Inspect the reset script (it should create/reset a fixed QA user and clear their state, gated on SEATBELT_QA=1 or NODE_ENV!=="production"), fix why it failed${reset.logFile ? ` (see ${reset.logFile})` : ""}, then re-run \`seatbelt run\`.`;
+  }
+  if (reset.status === "refused") {
+    return `Seatbelt refused to auto-run the configured reset command: ${reset.summary} Make the reset command safe (a scoped \`qa:reset-user\` that only touches the QA user), or run it yourself, then re-run \`seatbelt run\`.`;
+  }
+  const failed = report.flows.filter((f) => f.status === "red" || f.status === "blocked");
+  if (failed.length === 0) {
+    const needsSetup = report.flows.filter((f) => f.needsSetup);
+    const stale = report.flows.filter((f) => f.stale);
+    if (needsSetup.length || stale.length) {
+      const lines2 = [];
+      lines2.push(
+        `Seatbelt's tested flows passed against ${report.baseUrl} in a real browser, but some flows still need attention before this is fully certified:`
+      );
+      if (needsSetup.length) {
+        lines2.push("");
+        lines2.push(`Needs setup (skipped \u2014 configure, then remove "status: yellow"):`);
+        for (const f of needsSetup) lines2.push(`  - ${f.id}: ${f.note ?? "template not configured"}`);
+      }
+      if (stale.length) {
+        lines2.push("");
+        lines2.push(`Possibly stale (dependency files changed since last certified):`);
+        for (const f of stale) lines2.push(`  - ${f.id}: ${f.staleFiles.join(", ")}`);
+      }
+      lines2.push("");
+      lines2.push(
+        `Configure the needs-setup flows (test creds + real selectors) and re-run \`seatbelt certify --run\` to certify the full map.`
+      );
+      return lines2.join("\n");
+    }
+    return `All ${report.flows.length} Seatbelt flow(s) passed against ${report.baseUrl} in a real browser. Nothing to fix. Add more critical flows (login, checkout, dashboard) to widen coverage before your next merge.`;
+  }
+  const lines = [];
+  lines.push(
+    `Seatbelt ran browser flows against ${report.baseUrl} and ${failed.length} did not pass. Fix the app so these pass:`
+  );
+  for (const f of failed) {
+    lines.push("");
+    lines.push(`Flow "${f.name}" (${f.id}) \u2014 ${f.status.toUpperCase()}`);
+    if (f.missingEnv.length) {
+      lines.push(`  Missing env: ${f.missingEnv.join(", ")} (add to your env file, e.g. .env.local)`);
+    }
+    if (f.failureSummary) lines.push(`  Failed at: ${f.failureSummary}`);
+    if (f.finalUrl) lines.push(`  Final URL: ${f.finalUrl}`);
+    if (f.consoleErrors.length) {
+      lines.push(`  Console errors:`);
+      for (const e of f.consoleErrors.slice(0, 6)) lines.push(`    - ${e}`);
+    }
+    if (f.networkFailures.length) {
+      lines.push(`  Network failures:`);
+      for (const n of f.networkFailures.slice(0, 6)) lines.push(`    - ${n}`);
+    }
+  }
+  lines.push("");
+  lines.push(
+    `Inspect the routes/components/handlers behind each failing flow, use the console/network signals above to find the root cause, and fix it. Then I'll re-run \`seatbelt run\`.`
+  );
+  return lines.join("\n");
+}
+var STYLES = `
+:root { color-scheme: light dark; }
+* { box-sizing: border-box; }
+body { margin:0; padding:0 0 64px; font:15px/1.55 -apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,Helvetica,Arial,sans-serif; background:#0f1115; color:#e6e8eb; }
+@media (prefers-color-scheme: light){ body{ background:#f5f6f8; color:#1b1f24; } }
+.wrap { max-width:940px; margin:0 auto; padding:24px; }
+.brand { display:flex; align-items:center; gap:10px; font-weight:700; font-size:18px; margin-bottom:4px; }
+.brand .dot { width:12px; height:12px; border-radius:50%; background:#3b82f6; box-shadow:0 0 0 4px rgba(59,130,246,.2); }
+.sub { opacity:.7; font-size:13px; margin-bottom:20px; }
+.banner { border-radius:12px; padding:18px 20px; font-size:20px; font-weight:700; margin:18px 0 12px; }
+.banner.pass { background:linear-gradient(90deg,#0f2f1d,#14532d); color:#c9f7d8; border:1px solid #16a34a; }
+.banner.warn { background:linear-gradient(90deg,#3a2f0d,#5c4813); color:#ffe9a8; border:1px solid #d9a406; }
+.banner.fail { background:linear-gradient(90deg,#3a1113,#5b1418); color:#ffd7d9; border:1px solid #dc2626; }
+@media (prefers-color-scheme: light){ .banner.pass{background:#dcfce7;color:#14532d;} .banner.warn{background:#fef3c7;color:#7c5a05;} .banner.fail{background:#fee2e2;color:#7f1d1d;} }
+.reasons { margin:0 0 20px; padding:12px 16px; border-radius:10px; background:rgba(255,255,255,.04); border:1px solid rgba(255,255,255,.08); font-size:13px; }
+.reasons ul { margin:6px 0 0; padding-left:18px; } .reasons li { margin:3px 0; }
+.card { background:rgba(255,255,255,.03); border:1px solid rgba(255,255,255,.08); border-radius:12px; padding:16px 18px; margin:14px 0; }
+@media (prefers-color-scheme: light){ .card{ background:#fff; border-color:#e5e7eb; } }
+.card h2 { margin:0 0 12px; font-size:15px; }
+.card h3 { margin:16px 0 6px; font-size:12px; text-transform:uppercase; letter-spacing:.6px; opacity:.7; }
+.kv { display:grid; grid-template-columns:150px 1fr; gap:6px 16px; font-size:14px; }
+.kv div:nth-child(odd){ opacity:.6; }
+.mono { font-family:ui-monospace,SFMono-Regular,Menlo,Consolas,monospace; word-break:break-all; }
+.dim2 { opacity:.5; font-size:12px; }
+.err { color:#ff9ea2; }
+@media (prefers-color-scheme: light){ .err{ color:#b91c1c; } }
+.counts { display:flex; flex-wrap:wrap; gap:8px; margin-bottom:12px; }
+.count { padding:3px 10px; border-radius:999px; font-size:12px; font-weight:700; border:1px solid rgba(255,255,255,.14); }
+.pill { display:inline-block; padding:2px 10px; border-radius:999px; font-size:12px; font-weight:700; text-transform:uppercase; letter-spacing:.5px; }
+.pill.green{background:#14532d;color:#c9f7d8;} .pill.red{background:#5b1418;color:#ffd7d9;}
+.pill.grey{background:#3f4652;color:#dfe3e8;} .pill.yellow{background:#5c4813;color:#ffe9a8;} .pill.blocked{background:#4a3b12;color:#ffe9a8;}
+.tag { display:inline-block; padding:1px 8px; margin:0 4px 4px 0; border-radius:6px; font-size:11px; background:rgba(255,255,255,.08); }
+table { width:100%; border-collapse:collapse; font-size:14px; }
+th,td { text-align:left; padding:8px 10px; border-bottom:1px solid rgba(255,255,255,.08); vertical-align:top; }
+@media (prefers-color-scheme: light){ th,td{ border-color:#eceef1; } }
+th { font-size:12px; text-transform:uppercase; letter-spacing:.5px; opacity:.6; }
+ul.steps { list-style:none; margin:0; padding:0; } ul.steps li { padding:3px 0; font-size:13px; }
+ul.errs { margin:0; padding-left:18px; } ul.errs li { margin:4px 0; font-family:ui-monospace,monospace; font-size:13px; }
+.shots { display:flex; flex-wrap:wrap; gap:12px; } .shots figure { margin:0; max-width:280px; }
+img.shot { width:100%; border-radius:8px; border:1px solid rgba(255,255,255,.12); display:block; }
+figcaption { font-size:12px; opacity:.6; margin-top:4px; }
+.vid { width:100%; max-width:680px; border-radius:10px; border:1px solid rgba(255,255,255,.14); background:#000; display:block; margin:2px 0 8px; }
+.evhead { display:flex; align-items:center; gap:8px; }
+.tracecmd { display:block; margin-top:6px; }
+.empty { opacity:.55; font-style:italic; font-size:13px; }
+pre { background:#0b0d10; border:1px solid rgba(255,255,255,.1); border-radius:10px; padding:14px; overflow:auto; font-size:13px; color:#e6e8eb; }
+.copybtn { float:right; cursor:pointer; border:1px solid rgba(255,255,255,.18); background:transparent; color:inherit; border-radius:8px; padding:4px 10px; font-size:12px; }
+.copybtn:hover{ background:rgba(255,255,255,.08); }
+.note { font-size:13px; opacity:.72; margin-top:8px; }
+.warnnote { color:#ffce74; }
+.footer { opacity:.5; font-size:12px; margin-top:28px; text-align:center; }
+`;
+function resultPill(status) {
+  if (status === "green") return `<span class="pill green">PASS</span>`;
+  if (status === "blocked") return `<span class="pill blocked">BLOCKED</span>`;
+  if (status === "red") return `<span class="pill red">FAIL</span>`;
+  if (status === "yellow") return `<span class="pill yellow">NEEDS SETUP</span>`;
+  return `<span class="pill grey">${status.toUpperCase()}</span>`;
+}
+function resetPill(status) {
+  const cls = status === "passed" ? "green" : status === "failed" ? "red" : status === "missing" || status === "refused" ? "blocked" : "grey";
+  const label = status === "not-run" ? "NOT RUN" : status.toUpperCase();
+  return `<span class="pill ${cls}">${label}</span>`;
+}
+function renderResetSection(reset) {
+  return `<div class="card">
+    <h2>\u{1F527} Clean test user ${resetPill(reset.status)}</h2>
+    <div class="kv" style="margin-top:10px">
+      <div>Configured</div><div>${reset.configured ? "yes" : "no"}</div>
+      <div>Required</div><div>${reset.required ? "yes" : "no"}</div>
+      <div>Command</div><div class="mono">${reset.command ? escapeHtml(reset.command) : "\u2014"}</div>
+      ${reset.exitCode !== null ? `<div>Exit code</div><div class="mono">${reset.exitCode}</div>` : ""}
+      ${reset.durationMs ? `<div>Duration</div><div>${(reset.durationMs / 1e3).toFixed(1)}s</div>` : ""}
+      ${reset.verifyHttpUrl ? `<div>Health check</div><div class="mono">${reset.verifyHttpOk ? "\u2705" : "\u26D4"} ${escapeHtml(reset.verifyHttpUrl)}</div>` : ""}
+      ${reset.logFile ? `<div>Log</div><div class="mono">${escapeHtml(reset.logFile)}</div>` : ""}
+    </div>
+    <div class="note ${reset.status === "failed" || reset.status === "missing" || reset.status === "refused" ? "err" : ""}">${escapeHtml(reset.summary)}</div>
+    ${reset.status === "missing" ? `<div class="note">Run <span class="mono">seatbelt setup-reset</span> to generate a prompt that adds a safe reset script to your app.</div>` : ""}
+  </div>`;
+}
+function renderStep(s) {
+  const icon = s.ok ? "\u2705" : "\u26D4";
+  return `<li>${icon} <span class="mono">${escapeHtml(s.label)}</span>${s.error ? ` \u2014 <span class="err">${escapeHtml(s.error)}</span>` : ""}</li>`;
+}
+function depsLine(f) {
+  const parts = [];
+  if (f.dependencies.routes.length) parts.push(`routes: ${f.dependencies.routes.join(", ")}`);
+  if (f.dependencies.files.length) parts.push(`files: ${f.dependencies.files.join(", ")}`);
+  if (f.dependencies.services.length) parts.push(`services: ${f.dependencies.services.join(", ")}`);
+  if (f.requiresEnv.length) parts.push(`env: ${f.requiresEnv.join(", ")}`);
+  return parts.length ? escapeHtml(parts.join("  \xB7  ")) : "\u2014";
+}
+function renderFlowCard(f) {
+  const shots = f.screenshots.length ? f.screenshots.map(
+    (s) => `<figure><img class="shot" src="${s.dataUri}" alt="${escapeHtml(s.name)}"/><figcaption>${escapeHtml(s.name)}</figcaption></figure>`
+  ).join("") : `<div class="empty">No screenshots.</div>`;
+  const consoleBlock = f.consoleErrors.length ? `<ul class="errs">${f.consoleErrors.map((e) => `<li>${escapeHtml(e)}</li>`).join("")}</ul>` : `<div class="empty">None.</div>`;
+  const netBlock = f.networkFailures.length ? `<ul class="errs">${f.networkFailures.map((e) => `<li>${escapeHtml(e)}</li>`).join("")}</ul>` : `<div class="empty">None.</div>`;
+  const stepsBlock = f.steps.length ? `<ul class="steps">${f.steps.map(renderStep).join("")}</ul>` : `<div class="empty">Not run.</div>`;
+  const tagsHtml = f.tags.length ? f.tags.map((t) => `<span class="tag">${escapeHtml(t)}</span>`).join("") : "";
+  const videoBlock = f.videoFile ? `<video class="vid" controls preload="metadata" src="${escapeHtml(f.videoFile)}"></video>
+       <div class="dim2">\u{1F3A5} Video: <a href="${escapeHtml(f.videoFile)}">${escapeHtml(f.videoFile)}</a></div>` : `<div class="empty">No video recorded.</div>`;
+  const traceBlock = f.traceFile ? `<div class="note">\u{1F50D} Trace: <span class="mono">${escapeHtml(f.traceFile)}</span>
+         <span class="mono tracecmd">npx playwright show-trace ${escapeHtml(f.traceFile)}</span></div>` : "";
+  const evidence = `<h3>Evidence${f.status === "red" ? " \u2014 failure" : ""}</h3>
+    ${videoBlock}
+    <div class="shots">${shots}</div>
+    ${traceBlock}`;
+  return `<div class="card">
+    <h2>${escapeHtml(f.name)} ${resultPill(f.status)} ${f.critical ? "" : '<span class="dim2">non-critical</span>'}</h2>
+    ${tagsHtml ? `<div style="margin:2px 0 8px">${tagsHtml}</div>` : ""}
+    ${f.description ? `<div class="note">${escapeHtml(f.description)}</div>` : ""}
+    ${f.needs.length ? `<div class="note">Needs: ${escapeHtml(f.needs.join(", "))}</div>` : ""}
+    ${f.blockedByPrereq ? `<div class="note err">\u26D4 Blocked \u2014 prerequisite "${escapeHtml(f.blockedByPrereq)}" did not pass.</div>` : ""}
+    ${f.note ? `<div class="note warnnote">\u26A0 ${escapeHtml(f.note)}</div>` : ""}
+    ${f.stale ? `<div class="note warnnote">\u26A0 Possibly stale \u2014 these dependency files changed since last certified: ${escapeHtml(f.staleFiles.join(", "))}</div>` : ""}
+    ${f.missingEnv.length ? `<div class="note err">Missing env: ${escapeHtml(f.missingEnv.join(", "))} \u2014 add them to your env file (e.g. .env.local).</div>` : ""}
+    <div class="kv" style="margin-top:10px">
+      <div>Depends on</div><div>${depsLine(f)}</div>
+      <div>Final URL</div><div class="mono">${escapeHtml(f.finalUrl ?? "\u2014")}</div>
+      <div>Page title</div><div>${escapeHtml(f.pageTitle ?? "\u2014")}</div>
+      <div>Duration</div><div>${f.durationMs ? (f.durationMs / 1e3).toFixed(1) + "s" : "\u2014"}</div>
+    </div>
+    ${f.failureSummary ? `<div class="note err">\u26D4 ${escapeHtml(f.failureSummary)}</div>` : ""}
+    ${f.status === "red" ? `${evidence}<h3>Steps</h3>${stepsBlock}` : `<h3>Steps</h3>${stepsBlock}${evidence}`}
+    <h3>Console errors (${f.consoleErrors.length})</h3>${consoleBlock}
+    <h3>Network failures (${f.networkFailures.length})</h3>${netBlock}
+  </div>`;
+}
+function renderReportHtml(r) {
+  const cls = verdictClass(r.verdict);
+  const verdictText = `${verdictEmoji(r.verdict)} ${verdictLabel(r.verdict)}`;
+  const fix = buildFixPrompt(r);
+  const counts = countStatuses(r.flows);
+  const reasonsHtml = r.verdict !== "merge" && r.verdictReasons.length ? `<div class="reasons"><strong>Why:</strong><ul>${r.verdictReasons.map((x) => `<li>${escapeHtml(x)}</li>`).join("")}</ul></div>` : "";
+  const countsHtml = `<div class="counts">
+    <span class="count pill green">${counts.green} pass</span>
+    <span class="count pill yellow">${counts.yellow} needs setup</span>
+    <span class="count pill red">${counts.red} fail</span>
+    <span class="count pill blocked">${counts.blocked} blocked</span>
+    ${counts.grey ? `<span class="count pill grey">${counts.grey} untested</span>` : ""}
+  </div>`;
+  const rows = r.flows.map(
+    (f) => `<tr>
+      <td>${escapeHtml(f.name)}<div class="mono dim2">${escapeHtml(f.id)}</div></td>
+      <td style="text-align:center">${f.critical ? "\u2713" : "\u2014"}</td>
+      <td style="text-align:center">${resultPill(f.status)}</td>
+      <td>${f.tags.map((t) => `<span class="tag">${escapeHtml(t)}</span>`).join("") || "\u2014"}</td>
+      <td>${f.failureSummary ? escapeHtml(f.failureSummary) : f.note ? escapeHtml(f.note) : f.stale ? '<span class="warnnote">may be stale</span>' : "\u2014"}</td>
+      <td style="text-align:right">${f.durationMs ? (f.durationMs / 1e3).toFixed(1) + "s" : "\u2014"}</td>
+    </tr>`
+  ).join("");
+  return `<!DOCTYPE html>
+<html lang="en">
+<head>
+<meta charset="utf-8" />
+<meta name="viewport" content="width=device-width, initial-scale=1" />
+<title>SeatbeltAI Report \u2014 ${verdictLabel(r.verdict)}</title>
+<style>${STYLES}</style>
+</head>
+<body>
+<div class="wrap">
+  <div class="brand"><span class="dot"></span> SeatbeltAI</div>
+  <div class="sub">${r.mode === "certify" ? "Certification run" : "Run"} ${escapeHtml(r.runId)} \xB7 ${escapeHtml(r.generatedAt)} \xB7 session: ${r.sessionFresh ? "fresh" : "reused"} \xB7 seatbelt v${escapeHtml(r.seatbeltVersion)}</div>
+
+  <div class="banner ${cls}">${verdictText}</div>
+  ${reasonsHtml}
+
+  ${renderResetSection(r.reset)}
+
+  <div class="card">
+    <h2>Run</h2>
+    <div class="kv">
+      <div>Mode</div><div>${r.mode === "certify" ? "certify (QA-certified flow map)" : "run"}</div>
+      <div>Base URL</div><div class="mono">${escapeHtml(r.baseUrl)}</div>
+      <div>Framework</div><div>${escapeHtml(r.framework ?? "\u2014")}</div>
+      <div>Package manager</div><div>${escapeHtml(r.packageManager ?? "\u2014")}</div>
+      <div>Dev server</div><div>${r.serverStartedBySeatbelt ? "started by Seatbelt" : "reused (already running)"}</div>
+      ${r.serverLogFile ? `<div>Server log</div><div class="mono">${escapeHtml(r.serverLogFile)}</div>` : ""}
+      <div>Artifacts</div><div class="mono">${escapeHtml(r.artifactDir)}</div>
+    </div>
+  </div>
+
+  <div class="card">
+    <h2>Flow map (${r.flows.length})</h2>
+    ${countsHtml}
+    <table>
+      <thead><tr><th>Flow</th><th style="text-align:center">Critical</th><th style="text-align:center">Result</th><th>Tags</th><th>Failed step / note</th><th style="text-align:right">Duration</th></tr></thead>
+      <tbody>${rows}</tbody>
+    </table>
+  </div>
+
+  ${r.flows.map(renderFlowCard).join("")}
+
+  <div class="card">
+    <h2>Fix prompt \u2014 paste into Claude / Cursor / Codex
+      <button class="copybtn" onclick="copyFix()">Copy</button>
+    </h2>
+    <pre id="fix">${escapeHtml(fix)}</pre>
+  </div>
+
+  <div class="note">
+    Day 5 scope: <strong>deterministic local QA-certified flow map</strong> \u2014 clean-test-user reset
+    (with optional health check), real YAML flows with prerequisites replayed in a visible browser,
+    prominent video/screenshot/trace evidence, and a tri-state merge verdict. Still to come:
+    AI-generated/refreshed flows and full affected-flow reruns.
+  </div>
+
+  <div class="footer">
+    Seatbelt ran against your current local working tree \u2014 pull or rebase first if you want the verdict to include the latest changes on main.<br>
+    Generated locally by SeatbeltAI \xB7 no data left your machine
+  </div>
+</div>
+<script>
+function copyFix(){
+  var el = document.getElementById('fix');
+  navigator.clipboard.writeText(el.innerText).then(function(){
+    var b = document.querySelector('.copybtn'); if(!b) return;
+    var t = b.textContent; b.textContent = 'Copied!'; setTimeout(function(){ b.textContent = t; }, 1400);
+  });
+}
+</script>
+</body>
+</html>
+`;
+}
+function renderReportMarkdown(r) {
+  const counts = countStatuses(r.flows);
+  const lines = [];
+  lines.push(`# SeatbeltAI Report \u2014 ${verdictEmoji(r.verdict)} ${verdictLabel(r.verdict)}`);
+  lines.push(
+    `_${r.mode === "certify" ? "certification run" : "run"} \xB7 ${r.generatedAt} \xB7 ${r.baseUrl} \xB7 ${r.framework ?? "\u2014"} \xB7 session: ${r.sessionFresh ? "fresh" : "reused"} \xB7 seatbelt v${r.seatbeltVersion}_`
+  );
+  lines.push("");
+  if (r.verdict !== "merge" && r.verdictReasons.length) {
+    lines.push(`**Why:**`);
+    for (const reason of r.verdictReasons) lines.push(`- ${reason}`);
+    lines.push("");
+  }
+  const resetIcon = r.reset.status === "passed" ? "\u2705" : r.reset.status === "skipped" || r.reset.status === "not-run" ? "\u2796" : "\u26D4";
+  lines.push(`## \u{1F527} Clean test user ${resetIcon} ${r.reset.status.toUpperCase()}`);
+  lines.push(`- Configured: ${r.reset.configured ? "yes" : "no"} \xB7 Required: ${r.reset.required ? "yes" : "no"}`);
+  if (r.reset.command) lines.push(`- Command: \`${r.reset.command}\``);
+  if (r.reset.verifyHttpUrl)
+    lines.push(`- Health check: ${r.reset.verifyHttpOk ? "\u2705" : "\u26D4"} \`${r.reset.verifyHttpUrl}\``);
+  if (r.reset.logFile) lines.push(`- Log: \`${r.reset.logFile}\``);
+  lines.push(`- ${r.reset.summary}`);
+  lines.push("");
+  lines.push(
+    `## Flow map \u2014 ${counts.green} pass \xB7 ${counts.yellow} needs setup \xB7 ${counts.red} fail \xB7 ${counts.blocked} blocked${counts.grey ? ` \xB7 ${counts.grey} untested` : ""}`
+  );
+  lines.push(`| Flow | Critical | Result | Tags | Failed step / note | Duration |`);
+  lines.push(`|------|:--:|:--:|------|------|--:|`);
+  for (const f of r.flows) {
+    const result = f.status === "green" ? "\u2705 PASS" : f.status === "blocked" ? "\u26A0 BLOCKED" : f.status === "yellow" ? "\u{1F7E1} NEEDS SETUP" : f.status === "red" ? "\u26D4 FAIL" : "\u25FB " + f.status.toUpperCase();
+    const detail = f.failureSummary ?? f.note ?? (f.stale ? "may be stale" : "\u2014");
+    lines.push(
+      `| ${f.name} (\`${f.id}\`) | ${f.critical ? "\u2713" : "\u2014"} | ${result} | ${f.tags.join(", ") || "\u2014"} | ${detail} | ${f.durationMs ? (f.durationMs / 1e3).toFixed(1) + "s" : "\u2014"} |`
+    );
+  }
+  lines.push("");
+  for (const f of r.flows) {
+    lines.push(`### ${f.name} (\`${f.id}\`) \u2014 ${f.status}`);
+    if (f.tags.length) lines.push(`- Tags: ${f.tags.join(", ")}`);
+    if (f.needs.length) lines.push(`- Needs: ${f.needs.join(", ")}`);
+    if (f.blockedByPrereq) lines.push(`- \u26D4 Blocked \u2014 prerequisite \`${f.blockedByPrereq}\` did not pass`);
+    if (f.dependencies.routes.length) lines.push(`- Routes: ${f.dependencies.routes.join(", ")}`);
+    if (f.dependencies.files.length) lines.push(`- Files: ${f.dependencies.files.join(", ")}`);
+    if (f.dependencies.services.length) lines.push(`- Services: ${f.dependencies.services.join(", ")}`);
+    if (f.requiresEnv.length) lines.push(`- Requires env: ${f.requiresEnv.join(", ")}`);
+    if (f.missingEnv.length) lines.push(`- \u26A0 Missing env: ${f.missingEnv.join(", ")}`);
+    if (f.stale) lines.push(`- \u26A0 Possibly stale \u2014 changed: ${f.staleFiles.join(", ")}`);
+    if (f.note) lines.push(`- ${f.note}`);
+    if (f.finalUrl) lines.push(`- Final URL: ${f.finalUrl}`);
+    if (f.failureSummary) lines.push(`- \u26D4 ${f.failureSummary}`);
+    if (f.videoFile) lines.push(`- \u{1F3A5} Video: \`${f.videoFile}\``);
+    if (f.traceFile) lines.push(`- \u{1F50D} Trace: \`npx playwright show-trace ${f.traceFile}\``);
+    if (f.consoleErrors.length) lines.push(`- Console errors: ${f.consoleErrors.length}`);
+    if (f.networkFailures.length) lines.push(`- Network failures: ${f.networkFailures.length}`);
+    lines.push("");
+  }
+  if (r.serverLogFile) {
+    lines.push(`Server log: \`${r.serverLogFile}\``);
+    lines.push("");
+  }
+  lines.push(`## Fix prompt (paste into Claude / Cursor / Codex)`);
+  lines.push("```");
+  lines.push(buildFixPrompt(r));
+  lines.push("```");
+  lines.push("");
+  lines.push(
+    `> Day 5 scope: deterministic local QA-certified flow map (reset + health check + flow prerequisites + video/trace evidence + tri-state verdict + freshness seed).`
+  );
+  return lines.join("\n") + "\n";
+}
+
+// src/commands/run.ts
+function chromiumLaunchError(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  const firstLine2 = (raw.split("\n")[0] ?? raw).trim();
+  if (/Executable doesn't exist|playwright install/i.test(raw)) {
+    return new SeatbeltError(
+      "Seatbelt couldn't start its browser (Chromium isn't installed yet).",
+      `Install it once with:
+  ${pc.green("npx playwright install chromium")}
+
+Then run ${pc.green("seatbelt run")} again.`
+    );
+  }
+  if (/spawn (UNKNOWN|EACCES|ENOENT|EPERM)/i.test(raw)) {
+    return new SeatbeltError(
+      "Seatbelt couldn't start its browser \u2014 the system blocked the browser from launching.",
+      [
+        "This usually means the browser can't open in the current environment (no desktop",
+        "session, a sandbox, or security software blocking chrome.exe). Run Seatbelt from a",
+        "normal terminal on your desktop. If it persists, reinstall the browser with:",
+        `  ${pc.green("npx playwright install chromium")}`,
+        "",
+        pc.dim(`Details: ${firstLine2}`)
+      ].join("\n")
+    );
+  }
+  return new SeatbeltError("Seatbelt couldn't start its browser.", firstLine2);
+}
+function baseFlowReport(flow, stale) {
+  return {
+    id: flow.id,
+    name: flow.name,
+    description: flow.description,
+    critical: flow.critical,
+    status: "grey",
+    tags: flow.tags,
+    dependencies: flow.dependencies,
+    requiresEnv: requiredEnvForFlow(flow),
+    missingEnv: [],
+    needsSetup: false,
+    needs: flow.needs,
+    blockedByPrereq: null,
+    stale: stale.stale,
+    staleFiles: stale.changedFiles,
+    finalUrl: null,
+    pageTitle: null,
+    failureSummary: null,
+    note: null,
+    durationMs: 0,
+    steps: [],
+    screenshots: [],
+    videoFile: null,
+    traceFile: null,
+    consoleErrors: [],
+    networkFailures: []
+  };
+}
+async function mergeRunResult(base, res, videoFile, traceFile) {
+  const screenshots = [];
+  for (const abs of res.screenshots) {
+    try {
+      const name = path11.basename(abs).replace(/\.png$/i, "");
+      screenshots.push({ name, dataUri: `data:image/png;base64,${await readBase64(abs)}` });
+    } catch {
+    }
+  }
+  return {
+    ...base,
+    status: res.status,
+    // green | red
+    finalUrl: res.finalUrl,
+    pageTitle: res.pageTitle,
+    failureSummary: res.failureSummary,
+    durationMs: res.durationMs,
+    steps: res.steps,
+    screenshots,
+    videoFile,
+    traceFile,
+    consoleErrors: res.consoleErrors,
+    networkFailures: res.networkFailures
+  };
+}
+async function runCommand(opts = {}) {
+  const { config, paths, configFileExists } = await loadConfig({ cwd: opts.cwd });
+  if (opts.headed !== void 0) config.browser.headed = opts.headed;
+  const mode = opts.mode ?? "run";
+  if (!configFileExists) {
+    log.info(
+      `No ${pc.cyan("seatbelt.config.yaml")} found \u2014 using detected + default settings. Run ${pc.green("seatbelt on")} to save a config.`
+    );
+  }
+  const runId = createRunId();
+  const dir = artifactDir(paths, runId);
+  await ensureDir(dir);
+  const baseUrl = config.server.baseUrl;
+  const framework = config.app.framework ?? null;
+  const packageManager = config.app.packageManager ?? null;
+  const relReportPath = displayPath(paths.cwd, path11.join(dir, "report.html"));
+  log.blank();
+  log.step(`Seatbelt ${mode === "certify" ? "certify" : "run"} ${pc.bold(runId)}`);
+  log.info(`Detected: ${pc.bold(framework ?? "node")} \xB7 ${packageManager ?? "npm"} \xB7 ${pc.cyan(baseUrl)}`);
+  const { flows: allFlows, flowsDir, createdFlowIds, errors: flowErrors } = await loadFlows(
+    paths.cwd,
+    config.flows.dir
+  );
+  if (createdFlowIds.length) {
+    log.info(
+      `No flows yet \u2014 created ${createdFlowIds.length} starter flow${createdFlowIds.length > 1 ? "s" : ""} in ${pc.cyan(displayPath(paths.cwd, flowsDir))} (${createdFlowIds.join(", ")}).`
+    );
+  }
+  for (const e of flowErrors) log.warn(`Skipping ${e.file}: ${e.message}`);
+  const byId = new Map(allFlows.map((f) => [f.id, f]));
+  for (const e of validateNeeds(allFlows)) log.warn(e.message);
+  const cycle = findCycle(allFlows);
+  if (cycle) {
+    throw new SeatbeltError(
+      `Flow dependencies contain a loop: ${cycle.join(" \u2192 ")}`,
+      "Remove one of the `needs:` links so the prerequisites form a chain, not a circle."
+    );
+  }
+  const target = (opts.target ?? "").trim();
+  const targeted = Boolean(target) && target !== "all";
+  let represent = allFlows;
+  if (targeted) {
+    if (!byId.has(target)) {
+      throw new SeatbeltError(
+        `No flow with id "${target}" was found in ${config.flows.dir}/.`,
+        allFlows.length ? `Available flows: ${allFlows.map((f) => f.id).join(", ")}` : `Run ${pc.green("seatbelt run")} to create starter flows.`
+      );
+    }
+    const ids = expandWithPrereqs([target], byId);
+    represent = allFlows.filter((f) => ids.has(f.id));
+  }
+  if (represent.length === 0) {
+    throw new SeatbeltError(
+      `No runnable flows were found in ${config.flows.dir}/.`,
+      `Add a flow YAML file, or run ${pc.green("seatbelt on")} again to scaffold the starter set.`
+    );
+  }
+  const meta = readFlowMeta(paths);
+  const staleByFlow = /* @__PURE__ */ new Map();
+  for (const f of represent) {
+    const current = fingerprintDependencies(paths.cwd, f.dependencies);
+    staleByFlow.set(f.id, detectStale(current, meta.flows[f.id]?.fingerprint));
+  }
+  const roots = targeted ? [target] : allFlows.filter((f) => !isNeedsSetup(f)).map((f) => f.id);
+  const execIds = expandWithPrereqs(roots, byId);
+  const envValues = loadEnvValues(paths.cwd, config.env.file);
+  const reports = /* @__PURE__ */ new Map();
+  let anyRunnable = false;
+  for (const f of represent) {
+    const base = baseFlowReport(f, staleByFlow.get(f.id) ?? { stale: false, changedFiles: [] });
+    if (!execIds.has(f.id)) {
+      base.status = "yellow";
+      base.needsSetup = true;
+      base.note = `Needs setup \u2014 configure this flow${base.requiresEnv.length ? ` (env: ${base.requiresEnv.join(", ")})` : ""}, then remove "status: yellow". Skipped in bulk runs; run it explicitly with "seatbelt run ${f.id}".`;
+      reports.set(f.id, base);
+      continue;
+    }
+    const missing = missingEnvForFlow(f, envValues);
+    if (missing.length) {
+      base.status = "blocked";
+      base.missingEnv = missing;
+      base.failureSummary = `missing env: ${missing.join(", ")}`;
+      base.note = `Add ${missing.join(", ")} to ${config.env.file} (or your shell), then re-run.`;
+      reports.set(f.id, base);
+      continue;
+    }
+    anyRunnable = true;
+    reports.set(f.id, base);
+  }
+  const needsAnyEnv = represent.some((f) => reports.get(f.id).requiresEnv.length > 0);
+  if (needsAnyEnv && !envFileExists(paths.cwd, config.env.file)) {
+    log.warn(
+      `No ${pc.cyan(config.env.file)} found \u2014 some flows need test credentials. Create it with e.g. ${pc.cyan("SEATBELT_TEST_EMAIL=\u2026")} / ${pc.cyan("SEATBELT_TEST_PASSWORD=\u2026")} (values are never printed or uploaded).`
+    );
+  }
+  const finalize = async (resetReport2, serverLogFile2, serverStartedBySeatbelt, serverUnavailable) => {
+    const flowReports = represent.map((f) => reports.get(f.id));
+    const { verdict, reasons } = computeVerdict(flowReports, resetReport2, { serverUnavailable });
+    const report = {
+      runId,
+      generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      mode,
+      verdict,
+      verdictReasons: reasons,
+      baseUrl,
+      framework,
+      packageManager,
+      serverStartedBySeatbelt,
+      serverLogFile: serverLogFile2,
+      artifactDir: displayPath(paths.cwd, dir),
+      sessionFresh: config.browser.freshSession,
+      seatbeltVersion: VERSION,
+      reset: resetReport2,
+      flows: flowReports
+    };
+    await writeText(path11.join(dir, "report.html"), renderReportHtml(report));
+    await writeJson(path11.join(dir, "run.json"), report);
+    if (config.report.formats.includes("md")) {
+      await writeText(path11.join(dir, "report.md"), renderReportMarkdown(report));
+    }
+    let state = await loadOrSeedState(paths.stateFile, config.app.name);
+    state = syncFlowsFromYaml(
+      state,
+      allFlows.map((f) => ({
+        id: f.id,
+        name: f.name,
+        description: f.description,
+        tags: f.tags,
+        dependencies: f.dependencies,
+        requires: f.requires,
+        needs: f.needs,
+        declaredStatus: f.status
+      }))
+    );
+    const at = report.generatedAt;
+    for (const f of flowReports) {
+      if (f.needsSetup) continue;
+      state = upsertFlow(state, {
+        id: f.id,
+        name: f.name,
+        status: f.status,
+        lastRunId: runId,
+        lastRunAt: at,
+        lastReportPath: relReportPath,
+        lastFailureSummary: f.failureSummary
+      });
+      if (mode === "certify" && (f.status === "green" || f.status === "red")) {
+        state = recordCertification(state, f.id, runId, at);
+        const flow = byId.get(f.id);
+        meta.flows[f.id] = {
+          dependencies: flow.dependencies,
+          fingerprint: fingerprintDependencies(paths.cwd, flow.dependencies),
+          lastCertifiedRunId: runId,
+          lastCertifiedAt: at
+        };
+      }
+    }
+    await saveState(paths.stateFile, state);
+    if (mode === "certify") await writeFlowMeta(paths, meta);
+    printSummary(report);
+    const shouldOpen = config.report.openOnFinish && opts.open !== false && !process.env.CI;
+    if (shouldOpen) {
+      try {
+        await open(path11.join(dir, "report.html"));
+      } catch {
+        log.dim("(Could not auto-open the report \u2014 open the path above in your browser.)");
+      }
+    }
+    return verdictExitCode(verdict);
+  };
+  const printSummary = (report) => {
+    const counts = countStatuses(report.flows);
+    log.blank();
+    const label = `${verdictEmoji(report.verdict)} Verdict: ${verdictLabel(report.verdict)}`;
+    if (report.verdict === "merge") log.success(pc.bold(label));
+    else log.warn(pc.bold(label));
+    if (report.verdict !== "merge" && report.verdictReasons.length) {
+      for (const r of report.verdictReasons.slice(0, 6)) log.plain(`  \u2022 ${r}`);
+    }
+    log.blank();
+    log.plain(
+      pc.dim(
+        `${counts.green} pass \xB7 ${counts.yellow} needs setup \xB7 ${counts.red} fail \xB7 ${counts.blocked} blocked${counts.grey ? ` \xB7 ${counts.grey} untested` : ""}`
+      )
+    );
+    for (const f of report.flows) {
+      const tag = f.status === "green" ? pc.green("PASS   ") : f.status === "yellow" ? pc.yellow("SETUP  ") : f.status === "blocked" ? pc.yellow("BLOCKED") : f.status === "red" ? pc.red("FAIL   ") : pc.dim("UNTESTD");
+      const detail = f.failureSummary && f.status !== "green" ? pc.dim("  \u2014 " + f.failureSummary) : f.stale ? pc.yellow("  \u2014 may be stale") : "";
+      log.plain(`  ${tag} ${f.id}${detail}`);
+    }
+    log.blank();
+    log.plain(`Report: ${pc.cyan(relReportPath)}`);
+    if (report.serverLogFile) log.plain(`Server log: ${pc.cyan(report.serverLogFile)}`);
+    log.blank();
+    if (report.verdict === "do_not_merge") {
+      log.plain(
+        pc.bold("Next:") + " copy the fix prompt from the report into Claude / Cursor / Codex, fix, then re-run."
+      );
+    } else {
+      log.plain(
+        pc.bold("Next:") + " configure any needs-setup flows and re-run " + pc.green(`seatbelt ${mode === "certify" ? "certify --run" : "run"}`) + "."
+      );
+    }
+    log.blank();
+  };
+  if (!anyRunnable) {
+    log.dim("No flows are eligible to run right now (all need setup or are missing env).");
+    return await finalize(
+      resetNotRun(config, "No flows were eligible to run, so reset was not needed."),
+      null,
+      false,
+      false
+    );
+  }
+  const server = await ensureServer(config, paths.cwd, dir);
+  const serverLogFile = server.logPath ? displayPath(paths.cwd, server.logPath) : null;
+  if (!server.ready) {
+    log.blank();
+    if (server.startedBySeatbelt) {
+      log.plain(server.error ?? `Seatbelt could not reach ${baseUrl}.`);
+      log.plain("");
+      log.dim("Check the server log for the underlying error, then run seatbelt run again.");
+    } else {
+      log.plain(`Seatbelt could not open ${pc.cyan(baseUrl)}.`);
+      log.plain("");
+      log.plain("Your app may not be running, and Seatbelt couldn't find a dev command to start it.");
+      log.plain(`Start your app (or set ${pc.cyan("server.devCommand")} in seatbelt.config.yaml), then run:`);
+      log.plain(`  ${pc.green("seatbelt run")}`);
+    }
+    for (const f of represent) {
+      const r = reports.get(f.id);
+      if (r.status === "blocked" || r.needsSetup) continue;
+      r.status = "blocked";
+      r.failureSummary = server.error ?? "app not reachable";
+      r.note = "The app wasn't reachable, so this flow could not run.";
+    }
+    return await finalize(
+      resetNotRun(config, "Skipped \u2014 the app was unreachable, so reset did not run."),
+      serverLogFile,
+      server.startedBySeatbelt,
+      true
+    );
+  }
+  const resetReport = await runReset(config, paths.cwd, dir, baseUrl);
+  if (resetReport.status === "passed") {
+    log.success(`Clean test user ready ${pc.dim("(" + resetReport.command + ")")}`);
+  } else if (resetReport.status === "skipped") {
+    log.dim("No clean-test-user reset configured \u2014 running without one.");
+  } else {
+    log.warn(resetReport.summary);
+  }
+  if (resetBlocksRun(resetReport)) {
+    log.blank();
+    if (resetReport.status === "missing") {
+      log.plain(`Run ${pc.green("seatbelt setup-reset")} to add a safe clean-test-user reset, then run again.`);
+    } else {
+      log.plain("Browser QA was stopped because a clean test user is required and reset did not succeed.");
+      if (resetReport.logFile) log.dim(`See ${resetReport.logFile} for details.`);
+    }
+    for (const f of represent) {
+      const r = reports.get(f.id);
+      if (r.status === "blocked" || r.needsSetup) continue;
+      r.status = "blocked";
+      r.failureSummary = `reset ${resetReport.status}`;
+      r.note = "Blocked: a required clean test user could not be prepared.";
+    }
+    if (server.startedBySeatbelt) await server.stop();
+    return await finalize(resetReport, serverLogFile, server.startedBySeatbelt, false);
+  }
+  const videoDir = path11.join(dir, "media");
+  const groups = journeys(execIds, byId);
+  let browser;
+  try {
+    try {
+      browser = await chromium.launch({
+        headless: !config.browser.headed,
+        slowMo: config.browser.slowMo
+      });
+    } catch (err) {
+      throw chromiumLaunchError(err);
+    }
+    for (const group of groups) {
+      if (group.every((id) => reports.get(id).status === "blocked")) continue;
+      const context = await browser.newContext({
+        viewport: config.browser.viewport,
+        storageState: void 0,
+        recordVideo: config.browser.video ? { dir: videoDir } : void 0
+      });
+      await context.clearCookies();
+      if (config.browser.trace) {
+        await context.tracing.start({ screenshots: true, snapshots: true, sources: false });
+      }
+      for (const id of group) {
+        const flow = byId.get(id);
+        const rep = reports.get(id);
+        if (rep.status === "blocked") continue;
+        const failedPrereq = flow.needs.find(
+          (n) => execIds.has(n) && reports.get(n).status !== "green"
+        );
+        if (failedPrereq) {
+          rep.status = "blocked";
+          rep.blockedByPrereq = failedPrereq;
+          rep.failureSummary = `prerequisite "${failedPrereq}" did not pass`;
+          rep.note = `Blocked: prerequisite "${failedPrereq}" did not pass, so this flow was not run.`;
+          log.warn(`BLOCKED \u2014 ${id} (needs ${failedPrereq})`);
+          continue;
+        }
+        log.step(`Flow: ${pc.bold(flow.name)} ${pc.dim("(" + flow.id + ")")}`);
+        if (config.browser.trace) await context.tracing.startChunk({ title: flow.id });
+        const page = await context.newPage();
+        const result = await runFlow(page, flow, baseUrl, dir, envValues, paths.cwd);
+        const video = page.video();
+        await page.close();
+        let traceFile = null;
+        if (config.browser.trace) {
+          const traceAbs = path11.join(dir, "flows", flow.id, "trace.zip");
+          try {
+            await context.tracing.stopChunk({ path: traceAbs });
+            traceFile = displayPath(dir, traceAbs);
+          } catch {
+            traceFile = null;
+          }
+        }
+        let videoFile = null;
+        if (video) {
+          try {
+            videoFile = path11.relative(dir, await video.path()).split(path11.sep).join("/");
+          } catch {
+            videoFile = null;
+          }
+        }
+        reports.set(flow.id, await mergeRunResult(rep, result, videoFile, traceFile));
+        if (result.status === "green") log.success(`PASS \u2014 ${flow.id}`);
+        else log.warn(`FAIL \u2014 ${flow.id}${result.failureSummary ? " \u2014 " + result.failureSummary : ""}`);
+      }
+      if (config.browser.trace) await context.tracing.stop().catch(() => {
+      });
+      await context.close();
+    }
+    await browser.close();
+    browser = void 0;
+  } finally {
+    if (browser) await browser.close().catch(() => {
+    });
+    if (server.startedBySeatbelt) await server.stop();
+  }
+  return await finalize(resetReport, serverLogFile, server.startedBySeatbelt, false);
+}
+
+// src/commands/setupReset.ts
+import path12 from "path";
+
+// src/reset/prompt.ts
+function pm(context) {
+  return context.packageManager || "npm";
+}
+function resetRunCommand(context) {
+  const p = pm(context);
+  return p === "npm" ? "npm run qa:reset-user" : `${p} qa:reset-user`;
+}
+function resetConfigSnippet(context) {
+  return [
+    "reset:",
+    `  command: ${resetRunCommand(context)}`,
+    "  required: true",
+    "  timeoutMs: 30000",
+    "  allowNonLocal: false"
+  ].join("\n");
+}
+function buildResetPrompt(context) {
+  const p = pm(context);
+  const frameworkNote = context.framework ? `This project looks like a ${context.framework} app using ${p}. ` : `This project uses ${p}. `;
+  return `You are working in this repository. Add a safe "clean test user" reset script so an
+external QA tool (SeatbeltAI) can start browser tests from a known-good state every run.
+
+${frameworkNote}Do the following:
+
+1. Inspect this app's auth model, database/ORM, and how it stores user, session, onboarding,
+   cart, uploads, progress, and entitlement/subscription state. Briefly report what you found
+   BEFORE writing code.
+
+2. Create a script runnable as \`${resetRunCommand(context)}\` that:
+   - Creates or resets a single FIXED QA test user, using env vars SEATBELT_TEST_EMAIL and
+     SEATBELT_TEST_PASSWORD (default them to safe local values if unset).
+   - Resets that user's per-user state: onboarding/"first run" flags back to the start, cart
+     emptied, uploads/progress cleared, entitlements/subscription set to free/none, any cached
+     unlocks relocked.
+   - Is IDEMPOTENT and fast \u2014 running it twice in a row gives the same clean state.
+   - Only ever touches the QA user's data. Never other users, never global/shared data.
+
+3. Safety (this is critical):
+   - Refuse to run when NODE_ENV === "production".
+   - Only perform resets when SEATBELT_QA === "1" OR NODE_ENV !== "production".
+   - Do NOT drop databases, run destructive migrations, or \`rm -rf\` anything.
+   - Use the app's existing database connection/ORM. Don't add heavy new dependencies.
+
+4. Wire it up:
+   - Add the "qa:reset-user" script to package.json.
+   - Document any required env vars (SEATBELT_TEST_EMAIL, SEATBELT_TEST_PASSWORD) in the README
+     or a comment.
+
+5. Print a clear success line at the end, e.g. "QA reset complete: user <email> reset", and a
+   clear error (non-zero exit) if it fails, so the outcome is obvious.
+
+Show me the diff before applying. Keep it minimal, idempotent, and local/dev only.`;
+}
+
+// src/commands/setupReset.ts
+async function setupResetCommand(opts = {}) {
+  const { config, paths } = await loadConfig({ cwd: opts.cwd });
+  const context = {
+    framework: config.app.framework ?? null,
+    packageManager: config.app.packageManager ?? null
+  };
+  const prompt = buildResetPrompt(context);
+  const snippet = resetConfigSnippet(context);
+  log.blank();
+  log.step("Set up a clean test user for Seatbelt");
+  log.blank();
+  log.plain("Before Seatbelt tests your app, it needs to start from the same place every time \u2014");
+  log.plain("a known QA user with a predictable, clean state (onboarding not done, cart empty,");
+  log.plain("no paid access, uploads/progress cleared). Seatbelt can't guess your database, so");
+  log.plain("it writes a prompt that tells Claude / Cursor / Codex to add this safely in your app.");
+  log.plain("");
+  log.dim("Seatbelt runs this command for you before each `seatbelt run` \u2014 you won't run it by hand.");
+  log.blank();
+  log.plain(pc.bold("1. Paste this prompt into Claude Code / Cursor / Codex:"));
+  log.blank();
+  log.plain(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log.plain(prompt);
+  log.plain(pc.dim("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500"));
+  log.blank();
+  log.plain(pc.bold("2. Then add this to ") + pc.cyan("seatbelt.config.yaml") + pc.bold(":"));
+  log.blank();
+  log.plain(snippet);
+  const promptFile = path12.join(paths.seatbeltDir, "reset-prompt.md");
+  await ensureDir(paths.seatbeltDir);
+  await writeText(
+    promptFile,
+    `# Seatbelt \u2014 clean test user prompt
+
+Paste the prompt below into your coding agent.
+
+\`\`\`
+${prompt}
+\`\`\`
+
+## Then add to seatbelt.config.yaml
+
+\`\`\`yaml
+${snippet}
+\`\`\`
+`
+  );
+  log.blank();
+  log.success(`Saved a copy to ${pc.cyan(displayPath(paths.cwd, promptFile))}`);
+  log.blank();
+  log.plain(pc.bold("Next:"));
+  log.plain(`  \u2022 Once your agent adds ${pc.cyan(resetRunCommand(context))}, run ${pc.green("seatbelt run")}.`);
+  log.plain(`  \u2022 Seatbelt will run your reset automatically before the browser flows.`);
+  log.blank();
+  log.dim("This command only generated a prompt \u2014 it did not run or change anything in your app.");
+  log.blank();
+  return 0;
+}
+
+// src/commands/init.ts
+var FLOWS_DIRNAME = "qa-flows";
+async function ensureGitignore(gitignorePath, entry) {
+  if (!exists(gitignorePath)) {
+    await writeText(gitignorePath, `${entry}
+`);
+    return "created";
+  }
+  const current = await readText(gitignorePath);
+  const lines = current.split(/\r?\n/).map((l) => l.trim());
+  if (lines.includes(entry) || lines.includes(entry.replace(/\/$/, ""))) {
+    return "present";
+  }
+  const needsNewline = current.length > 0 && !current.endsWith("\n");
+  await writeText(gitignorePath, current + (needsNewline ? "\n" : "") + `${entry}
+`);
+  return "appended";
+}
+async function initCommand(opts = {}) {
+  const paths = resolvePaths(opts.cwd);
+  const created = [];
+  const kept = [];
+  let configCreated = false;
+  log.blank();
+  log.step("Setting up Seatbelt in this project\u2026");
+  if (exists(paths.configFile)) {
+    kept.push(CONFIG_FILENAME);
+  } else {
+    await writeText(paths.configFile, STARTER_CONFIG_YAML);
+    created.push(CONFIG_FILENAME);
+    configCreated = true;
+  }
+  await ensureDir(paths.seatbeltDir);
+  const flowsDir = path13.join(paths.cwd, FLOWS_DIRNAME);
+  const createdFlowIds = await ensureFlowsDir(flowsDir);
+  if (createdFlowIds.length) {
+    created.push(`${FLOWS_DIRNAME}/ (${createdFlowIds.length} starter flows: ${createdFlowIds.join(", ")})`);
+  } else {
+    kept.push(`${FLOWS_DIRNAME}/ (already has flows)`);
+  }
+  if (exists(paths.stateFile)) {
+    kept.push(".seatbelt/state.json");
+  } else {
+    const { flows } = await loadFlows(paths.cwd, FLOWS_DIRNAME, { create: false });
+    let state = seedState("My app");
+    state = syncFlowsFromYaml(
+      state,
+      flows.map((f) => ({
+        id: f.id,
+        name: f.name,
+        description: f.description,
+        tags: f.tags,
+        dependencies: f.dependencies,
+        requires: f.requires,
+        needs: f.needs,
+        declaredStatus: f.status
+      }))
+    );
+    await saveState(paths.stateFile, state);
+    created.push(".seatbelt/state.json");
+  }
+  const gi = await ensureGitignore(paths.gitignore, ".seatbelt/");
+  log.blank();
+  if (created.length) {
+    for (const f of created) log.success(`Created ${pc.bold(f)}`);
+  }
+  if (kept.length) {
+    for (const f of kept) log.info(`Kept existing ${pc.bold(f)} (not overwritten)`);
+  }
+  if (gi === "created") log.success("Created .gitignore with .seatbelt/");
+  else if (gi === "appended") log.success("Added .seatbelt/ to .gitignore");
+  else log.info(".seatbelt/ already in .gitignore");
+  log.blank();
+  log.success("Seatbelt is set up in this repo.");
+  log.dim("By using Seatbelt you agree to the Terms and Privacy Policy at https://getseatbelt.ai/terms.");
+  log.blank();
+  const shouldRun = opts.run === true || opts.run !== false && await offer("Run Seatbelt now to watch your first browser check?", { autoYes: opts.yes });
+  if (shouldRun) {
+    try {
+      await runCommand({ cwd: opts.cwd, yes: opts.yes });
+    } catch (err) {
+      printError(err);
+      log.blank();
+      log.warn("Setup is done, but that first run didn't finish. Fix the issue above, then run `seatbelt run`.");
+    }
+    await maybeOfferReset(opts, configCreated);
+    log.blank();
+    log.plain(`Run ${pc.green("seatbelt run")} again after your next AI change.`);
+    log.blank();
+    log.dim("Seatbelt runs locally. Nothing leaves your machine.");
+    log.blank();
+    return 0;
+  }
+  await maybeOfferReset(opts, configCreated);
+  log.blank();
+  log.plain(pc.bold("You're set. Next steps:"));
+  log.plain("");
+  log.plain(`  \u2022 Run ${pc.green("npx seatbelt run")} to watch your first browser check and open a report.`);
+  log.plain(`  \u2022 Configure the "needs setup" flows in ${pc.cyan(FLOWS_DIRNAME + "/")} (confirm routes/selectors,`);
+  log.plain(`    add ${pc.cyan("SEATBELT_TEST_EMAIL")}/${pc.cyan("SEATBELT_TEST_PASSWORD")}); see the map with ${pc.green("seatbelt certify")}.`);
+  log.plain(`  \u2022 Set up a clean test user any time with ${pc.green("seatbelt setup-reset")}.`);
+  log.blank();
+  log.dim("Seatbelt runs locally. Nothing leaves your machine.");
+  log.blank();
+  return 0;
+}
+async function maybeOfferReset(opts, configCreated) {
+  if (!configCreated) return;
+  const want = await offer(
+    "Set up a clean test user, so every run starts from a known-clean account?",
+    { autoYes: opts.yes }
+  );
+  if (want) {
+    await setupResetCommand({ cwd: opts.cwd });
+  }
+}
+
+// src/commands/certify.ts
+function statusTag(status) {
+  switch (status) {
+    case "green":
+      return pc.green("green  ");
+    case "red":
+      return pc.red("red    ");
+    case "yellow":
+      return pc.yellow("yellow ");
+    case "blocked":
+      return pc.yellow("blocked");
+    default:
+      return pc.dim("grey   ");
+  }
+}
+function depsSummary(f, requiresEnv) {
+  const parts = [];
+  if (f.dependencies.routes.length) parts.push(`routes: ${f.dependencies.routes.join(", ")}`);
+  if (requiresEnv.length) parts.push(`env: ${requiresEnv.join(", ")}`);
+  if (f.dependencies.services.length) parts.push(`services: ${f.dependencies.services.join(", ")}`);
+  return parts.join("  \xB7  ") || pc.dim("\u2014");
+}
+function lastRunLabel(f) {
+  if (!f.lastRunAt) return pc.dim("never");
+  const when = f.lastRunAt.slice(0, 16).replace("T", " ");
+  const cert = f.certification.lastCertifiedAt ? " \u2713certified" : "";
+  return `${when}${pc.dim(cert)}`;
+}
+async function certifyCommand(opts = {}) {
+  const { config, paths } = await loadConfig({ cwd: opts.cwd });
+  const { flows, flowsDir, createdFlowIds, errors } = await loadFlows(paths.cwd, config.flows.dir);
+  log.blank();
+  log.step("Seatbelt certify \u2014 QA-certified flow map");
+  if (createdFlowIds.length) {
+    log.info(
+      `Created ${createdFlowIds.length} starter flow${createdFlowIds.length > 1 ? "s" : ""} in ${pc.cyan(displayPath(paths.cwd, flowsDir))} (${createdFlowIds.join(", ")}).`
+    );
+  }
+  for (const e of errors) log.warn(`Skipping ${e.file}: ${e.message}`);
+  let state = await loadOrSeedState(paths.stateFile, config.app.name);
+  state = syncFlowsFromYaml(
+    state,
+    flows.map((f) => ({
+      id: f.id,
+      name: f.name,
+      description: f.description,
+      tags: f.tags,
+      dependencies: f.dependencies,
+      requires: f.requires,
+      needs: f.needs,
+      declaredStatus: f.status
+    }))
+  );
+  await saveState(paths.stateFile, state);
+  const meta = readFlowMeta(paths);
+  const staleNotes = [];
+  for (const f of flows) {
+    const current = fingerprintDependencies(paths.cwd, f.dependencies);
+    const { stale, changedFiles } = detectStale(current, meta.flows[f.id]?.fingerprint);
+    if (stale) staleNotes.push(`${f.id}: ${changedFiles.join(", ")}`);
+    meta.flows[f.id] = {
+      dependencies: f.dependencies,
+      fingerprint: current,
+      // Preserve any prior certification stamps; --run will set fresh ones.
+      lastCertifiedRunId: meta.flows[f.id]?.lastCertifiedRunId ?? null,
+      lastCertifiedAt: meta.flows[f.id]?.lastCertifiedAt ?? null
+    };
+  }
+  await writeFlowMeta(paths, meta);
+  const byId = new Map(state.flows.map((s) => [s.id, s]));
+  const reqEnvById = new Map(flows.map((f) => [f.id, requiredEnvForFlow(f)]));
+  log.blank();
+  log.plain(pc.bold("  Status   Flow                     Last run           Depends on"));
+  for (const f of flows) {
+    const s = byId.get(f.id);
+    if (!s) continue;
+    const id = f.id.padEnd(24).slice(0, 24);
+    log.plain(
+      `  ${statusTag(s.status)}  ${id} ${lastRunLabel(s).padEnd(18)} ${depsSummary(s, reqEnvById.get(f.id) ?? [])}`
+    );
+  }
+  log.blank();
+  const needsSetup = flows.filter((f) => isNeedsSetup(f)).map((f) => f.id);
+  if (needsSetup.length) {
+    log.dim(`Needs setup (skipped in bulk runs): ${needsSetup.join(", ")} \u2014 configure, then remove "status: yellow".`);
+  }
+  if (staleNotes.length) {
+    log.warn(`Possibly stale since last certified: ${staleNotes.join(" \xB7 ")}`);
+  }
+  const shouldRun = opts.run === true || opts.run !== false && opts.yes === true;
+  if (!shouldRun) {
+    log.blank();
+    log.plain(
+      `${pc.bold("Map synced.")} To verify every eligible flow in a real browser and certify them, run ${pc.green("seatbelt certify --run")}.`
+    );
+    log.blank();
+    return 0;
+  }
+  log.blank();
+  log.step("Certifying \u2014 running all eligible flows\u2026");
+  return runCommand({
+    cwd: opts.cwd,
+    target: "all",
+    open: opts.open,
+    headed: opts.headed,
+    yes: opts.yes,
+    mode: "certify"
+  });
+}
+
+// src/commands/generateFlows.ts
+import fs12 from "fs";
+import path18 from "path";
+import readline2 from "readline/promises";
+import { stdin as input2, stdout as output2 } from "process";
+
+// src/inspect/app.ts
+import fs10 from "fs";
+import path16 from "path";
+import YAML3 from "yaml";
+
+// src/inspect/routes.ts
+import fs8 from "fs";
+import path14 from "path";
+var ROUTE_EXT_RE = /\.(tsx|ts|jsx|js|vue|svelte)$/i;
+var SOURCE_EXT_RE = /\.(tsx|ts|jsx|js|vue|svelte|html)$/i;
+var SKIP_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  ".next",
+  ".seatbelt",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  "playwright-report",
+  "test-results"
+]);
+function walk(dir, cwd, maxFiles = 500) {
+  const out = [];
+  const visit = (current) => {
+    if (out.length >= maxFiles) return;
+    let entries;
+    try {
+      entries = fs8.readdirSync(current, { withFileTypes: true });
+    } catch {
+      return;
+    }
+    for (const entry of entries) {
+      if (out.length >= maxFiles) return;
+      if (entry.isDirectory()) {
+        if (!SKIP_DIRS.has(entry.name)) visit(path14.join(current, entry.name));
+      } else if (entry.isFile()) {
+        out.push(path14.relative(cwd, path14.join(current, entry.name)).split(path14.sep).join("/"));
+      }
+    }
+  };
+  if (exists(dir)) visit(dir);
+  return out;
+}
+function normalizeRoute(route) {
+  let out = route.replace(/\\/g, "/").replace(/\/index$/i, "");
+  out = out.replace(/\(([^/]+)\)\//g, "").replace(/\/\(([^/]+)\)/g, "");
+  out = out.replace(/\/@[^/]+/g, "");
+  out = out.replace(/\[\.\.\.([^\]]+)\]/g, ":$1*").replace(/\[([^\]]+)\]/g, ":$1");
+  out = out.replace(/\/+/g, "/");
+  if (!out.startsWith("/")) out = "/" + out;
+  return out === "" ? "/" : out;
+}
+function addRoute(routes, cwd, file, route, source) {
+  const normalized = normalizeRoute(route);
+  if (!routes.has(normalized)) routes.set(normalized, { route: normalized, file, source });
+}
+function nextAppRoute(cwd, file) {
+  const parts = file.split("/");
+  const appIndex = parts.indexOf("app");
+  if (appIndex === -1 || !/^page\./i.test(parts[parts.length - 1] ?? "")) return null;
+  return parts.slice(appIndex + 1, -1).join("/") || "/";
+}
+function nextPagesRoute(cwd, file) {
+  const parts = file.split("/");
+  const pagesIndex = parts.indexOf("pages");
+  if (pagesIndex === -1) return null;
+  const last = parts[parts.length - 1] ?? "";
+  if (!ROUTE_EXT_RE.test(last) || last.startsWith("_") || last.startsWith("api.")) return null;
+  const stem = last.replace(ROUTE_EXT_RE, "");
+  return [...parts.slice(pagesIndex + 1, -1), stem].join("/") || "/";
+}
+function nuxtRoute(file) {
+  const parts = file.split("/");
+  const pagesIndex = parts.indexOf("pages");
+  if (pagesIndex === -1) return null;
+  const last = parts[parts.length - 1] ?? "";
+  if (!ROUTE_EXT_RE.test(last)) return null;
+  const stem = last.replace(ROUTE_EXT_RE, "");
+  return [...parts.slice(pagesIndex + 1, -1), stem].join("/") || "/";
+}
+function routeHintsFromSource(text) {
+  const routes = /* @__PURE__ */ new Set();
+  const patterns = [
+    /(?:href|to|path)\s*=\s*["'`]((?:\/[a-zA-Z0-9@:%_+~#?&=.,/-]+)+)["'`]/g,
+    /(?:router\.push|navigate|redirect)\(\s*["'`]((?:\/[a-zA-Z0-9@:%_+~#?&=.,/-]+)+)["'`]/g
+  ];
+  for (const re of patterns) {
+    for (const match of text.matchAll(re)) {
+      const route = match[1];
+      if (route && !route.startsWith("//")) routes.add(route.split("?")[0] ?? route);
+    }
+  }
+  return [...routes].filter((r) => r.length < 80);
+}
+function detectRoutes(cwd) {
+  const routes = /* @__PURE__ */ new Map();
+  for (const file of walk(path14.join(cwd, "app"), cwd)) {
+    const route = nextAppRoute(cwd, file);
+    if (route) addRoute(routes, cwd, file, route, "next-app");
+  }
+  for (const file of walk(path14.join(cwd, "pages"), cwd)) {
+    const nextRoute = nextPagesRoute(cwd, file);
+    if (nextRoute) addRoute(routes, cwd, file, nextRoute, "next-pages");
+    const nuxt = nuxtRoute(file);
+    if (nuxt) addRoute(routes, cwd, file, nuxt, "nuxt");
+  }
+  const sourceRoots = ["src", "components", "routes"].filter((d) => exists(path14.join(cwd, d)));
+  for (const root of sourceRoots) {
+    for (const file of walk(path14.join(cwd, root), cwd, 250).filter((f) => SOURCE_EXT_RE.test(f))) {
+      let text = "";
+      try {
+        const abs = path14.join(cwd, file);
+        const stat = fs8.statSync(abs);
+        if (stat.size > 8e4) continue;
+        text = fs8.readFileSync(abs, "utf8");
+      } catch {
+        continue;
+      }
+      for (const route of routeHintsFromSource(text)) {
+        const source = /createRouter|createWebHistory|<Router|react-router|useRoutes/.test(text) ? file.endsWith(".vue") ? "vue-router" : "vite-react" : "generic";
+        addRoute(routes, cwd, file, route, source);
+      }
+    }
+  }
+  return [...routes.values()].sort((a, b) => a.route.localeCompare(b.route));
+}
+
+// src/ai/privacy.ts
+import fs9 from "fs";
+import path15 from "path";
+var BLOCKED_DIRS = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  "build",
+  "coverage",
+  ".next",
+  ".nuxt",
+  ".output",
+  ".seatbelt/artifacts",
+  "playwright-report",
+  "test-results"
+]);
+var BLOCKED_EXTS = /* @__PURE__ */ new Set([
+  ".png",
+  ".jpg",
+  ".jpeg",
+  ".gif",
+  ".webp",
+  ".ico",
+  ".mp4",
+  ".mov",
+  ".webm",
+  ".zip",
+  ".gz",
+  ".pdf",
+  ".woff",
+  ".woff2",
+  ".ttf",
+  ".eot",
+  ".exe",
+  ".dll",
+  ".so",
+  ".dylib"
+]);
+var ALLOWED_EXTS = /* @__PURE__ */ new Set([
+  ".ts",
+  ".tsx",
+  ".js",
+  ".jsx",
+  ".mjs",
+  ".cjs",
+  ".vue",
+  ".svelte",
+  ".html",
+  ".css",
+  ".scss",
+  ".md",
+  ".json",
+  ".yaml",
+  ".yml"
+]);
+var LOCKFILES = /* @__PURE__ */ new Set(["package-lock.json", "pnpm-lock.yaml", "yarn.lock", "bun.lockb"]);
+var DEFAULT_MAX_FILE_BYTES = 4e4;
+function norm(relPath) {
+  return relPath.split(path15.sep).join("/");
+}
+function privacyDecision(relPath, sizeBytes = 0, maxBytes = DEFAULT_MAX_FILE_BYTES) {
+  const rel = norm(relPath);
+  const lower = rel.toLowerCase();
+  const base = path15.posix.basename(lower);
+  const ext = path15.posix.extname(lower);
+  if (base === ".env" || base.startsWith(".env.")) return { allowed: false, reason: "env values are never sent" };
+  if (base.endsWith(".pem") || base.endsWith(".key") || base.endsWith(".p12")) return { allowed: false, reason: "key material is never sent" };
+  if (LOCKFILES.has(base)) return { allowed: false, reason: "lockfile excluded" };
+  if (BLOCKED_EXTS.has(ext)) return { allowed: false, reason: "binary/media file excluded" };
+  for (const dir of BLOCKED_DIRS) {
+    if (lower === dir || lower.startsWith(dir + "/") || lower.includes("/" + dir + "/")) {
+      return { allowed: false, reason: `${dir} excluded` };
+    }
+  }
+  if (sizeBytes > maxBytes) return { allowed: false, reason: `larger than ${maxBytes} bytes` };
+  if (!ALLOWED_EXTS.has(ext)) return { allowed: false, reason: "file type excluded" };
+  return { allowed: true, reason: "allowed source file" };
+}
+function redactSecrets(input3) {
+  let out = input3;
+  const replacements = [
+    [/(sk_live_[A-Za-z0-9_]+)/g, "[REDACTED_STRIPE_SECRET]"],
+    [/(sk_test_[A-Za-z0-9_]+)/g, "[REDACTED_STRIPE_SECRET]"],
+    [/(pk_live_[A-Za-z0-9_]+)/g, "[REDACTED_STRIPE_PUBLISHABLE]"],
+    [/(OPENAI_API_KEY\s*[:=]\s*)["']?[^"'\s]+/gi, "$1[REDACTED]"],
+    [/(api[_-]?key\s*[:=]\s*)["']?[^"'\s]+/gi, "$1[REDACTED]"],
+    [/(token\s*[:=]\s*)["']?[^"'\s]+/gi, "$1[REDACTED]"],
+    [/(password\s*[:=]\s*)["']?[^"'\n]+/gi, "$1[REDACTED]"],
+    [/(jwt[_-]?secret\s*[:=]\s*)["']?[^"'\s]+/gi, "$1[REDACTED]"],
+    [/(mongodb(?:\+srv)?:\/\/)[^\s"']+/gi, "$1[REDACTED]"],
+    [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, "[REDACTED_PRIVATE_KEY]"]
+  ];
+  for (const [re, replacement] of replacements) out = out.replace(re, replacement);
+  return out;
+}
+function collectEnvVarNames(cwd) {
+  const names = /* @__PURE__ */ new Set();
+  let files2 = [];
+  try {
+    files2 = fs9.readdirSync(cwd).filter((f) => f === ".env" || f.startsWith(".env."));
+  } catch {
+    return [];
+  }
+  for (const file of files2) {
+    try {
+      const text = fs9.readFileSync(path15.join(cwd, file), "utf8");
+      for (const line2 of text.split(/\r?\n/)) {
+        const match = line2.match(/^\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=/);
+        if (match?.[1]) names.add(match[1]);
+      }
+    } catch {
+    }
+  }
+  return [...names].sort();
+}
+function collectSourceFiles(cwd, relPaths, maxFiles = 30) {
+  const included = [];
+  const excluded = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const relPath of relPaths) {
+    const rel = norm(relPath);
+    if (seen.has(rel)) continue;
+    seen.add(rel);
+    const abs = path15.join(cwd, rel);
+    let stat;
+    try {
+      stat = fs9.statSync(abs);
+    } catch {
+      excluded.push({ path: rel, reason: "file not found" });
+      continue;
+    }
+    const decision = privacyDecision(rel, stat.size);
+    if (!decision.allowed) {
+      excluded.push({ path: rel, reason: decision.reason });
+      continue;
+    }
+    if (included.length >= maxFiles) {
+      excluded.push({ path: rel, reason: "source file budget reached" });
+      continue;
+    }
+    try {
+      included.push({ path: rel, content: redactSecrets(fs9.readFileSync(abs, "utf8")) });
+    } catch {
+      excluded.push({ path: rel, reason: "could not read file" });
+    }
+  }
+  return { included, excluded };
+}
+
+// src/inspect/app.ts
+function readPackageSummary(cwd) {
+  const file = path16.join(cwd, "package.json");
+  if (!exists(file)) return null;
+  try {
+    const raw = JSON.parse(fs10.readFileSync(file, "utf8"));
+    return {
+      name: raw.name ?? null,
+      scripts: raw.scripts ?? {},
+      dependencies: Object.keys(raw.dependencies ?? {}).sort(),
+      devDependencies: Object.keys(raw.devDependencies ?? {}).sort()
+    };
+  } catch {
+    return null;
+  }
+}
+function listFlowFiles2(cwd, flowsDir) {
+  const dir = path16.join(cwd, flowsDir);
+  try {
+    return fs10.readdirSync(dir).filter((f) => f.endsWith(".yaml") || f.endsWith(".yml")).sort().map((f) => path16.join(flowsDir, f).split(path16.sep).join("/"));
+  } catch {
+    return [];
+  }
+}
+async function existingFlowSummaries(cwd, flowsDir) {
+  const out = [];
+  for (const rel of listFlowFiles2(cwd, flowsDir)) {
+    const yaml = await readText(path16.join(cwd, rel)).catch(() => "");
+    let parsed = {};
+    try {
+      parsed = YAML3.parse(yaml) ?? {};
+    } catch {
+      parsed = {};
+    }
+    out.push({
+      id: typeof parsed.id === "string" ? parsed.id : path16.basename(rel).replace(/\.(ya?ml)$/i, ""),
+      name: typeof parsed.name === "string" ? parsed.name : "",
+      file: rel,
+      status: typeof parsed.status === "string" ? parsed.status : null,
+      yaml
+    });
+  }
+  return out;
+}
+function routeSet(routes) {
+  return new Set(routes.map((r) => r.route.toLowerCase()));
+}
+function hasAnyRoute(routes, parts) {
+  return [...routes].some((r) => parts.some((p) => r.includes(p)));
+}
+function inferCandidateFlows(routes, pkg) {
+  const routeNames = routeSet(routes);
+  const deps = new Set([...pkg?.dependencies ?? [], ...pkg?.devDependencies ?? []].map((d) => d.toLowerCase()));
+  const out = /* @__PURE__ */ new Set(["homepage-smoke"]);
+  if (hasAnyRoute(routeNames, ["/login", "/signin", "/sign-in", "/auth"])) out.add("signin-smoke");
+  if (hasAnyRoute(routeNames, ["/signup", "/register", "/sign-up"])) out.add("signup-smoke");
+  if (hasAnyRoute(routeNames, ["/onboarding", "/corridor", "/welcome", "/setup"])) out.add("onboarding-smoke");
+  if (hasAnyRoute(routeNames, ["/dashboard", "/app", "/account", "/overview", "/courses"])) out.add("dashboard-smoke");
+  if (hasAnyRoute(routeNames, ["/upload", "/import", "/documents", "/files"])) out.add("upload-smoke");
+  if (hasAnyRoute(routeNames, ["/pricing", "/checkout", "/billing", "/upgrade"]) || deps.has("stripe")) out.add("checkout-smoke");
+  if (hasAnyRoute(routeNames, ["/pro", "/entitlement", "/unlock", "/billing"])) out.add("entitlement-smoke");
+  return [...out];
+}
+function likelySourceFiles(cwd, routes, flowsDir, existing) {
+  const files2 = /* @__PURE__ */ new Set();
+  files2.add("package.json");
+  files2.add("seatbelt.config.yaml");
+  for (const route of routes.slice(0, 40)) files2.add(route.file);
+  for (const flow of existing) files2.add(flow.file);
+  const likelyNames = [
+    "middleware.ts",
+    "middleware.js",
+    "src/router.ts",
+    "src/router.js",
+    "src/routes.tsx",
+    "src/App.tsx",
+    "src/App.jsx"
+  ];
+  for (const rel of likelyNames) files2.add(rel);
+  return [...files2].filter((rel) => rel.startsWith(flowsDir + "/") || exists(path16.join(cwd, rel)));
+}
+async function inspectApp(paths, config) {
+  const detection = await detect(paths);
+  const packageJson = readPackageSummary(paths.cwd);
+  const routes = detectRoutes(paths.cwd);
+  const existingFlows = await existingFlowSummaries(paths.cwd, config.flows.dir);
+  const flowLoad = await loadFlows(paths.cwd, config.flows.dir, { create: false });
+  const meta = readFlowMeta(paths);
+  const staleFlows = [];
+  for (const flow of flowLoad.flows) {
+    const current = fingerprintDependencies(paths.cwd, flow.dependencies);
+    const stale = detectStale(current, meta.flows[flow.id]?.fingerprint);
+    if (stale.stale) staleFlows.push({ id: flow.id, changedFiles: stale.changedFiles });
+  }
+  let stateFlowIds = [];
+  try {
+    const raw = JSON.parse(fs10.readFileSync(paths.stateFile, "utf8"));
+    stateFlowIds = (raw.flows ?? []).map((f) => f.id).filter((id) => Boolean(id));
+  } catch {
+    stateFlowIds = [];
+  }
+  const candidates = inferCandidateFlows(routes, packageJson);
+  const sourcePaths = [
+    ...likelySourceFiles(paths.cwd, routes, config.flows.dir, existingFlows),
+    ...staleFlows.flatMap((f) => f.changedFiles)
+  ];
+  const source = collectSourceFiles(paths.cwd, sourcePaths);
+  return {
+    cwd: paths.cwd,
+    packageManager: detection.packageManager,
+    framework: detection.framework,
+    packageJson,
+    routes,
+    existingFlows,
+    stateFlowIds,
+    staleFlows,
+    candidateFlows: candidates,
+    envVarNames: collectEnvVarNames(paths.cwd),
+    source
+  };
+}
+
+// src/ai/prompt.ts
+function formatInspectionForPrompt(inspection) {
+  return JSON.stringify(buildHostedProjectPayload(inspection), null, 2);
+}
+function buildHostedProjectPayload(inspection) {
+  return {
+    packageManager: inspection.packageManager,
+    framework: inspection.framework,
+    packageJson: inspection.packageJson ? {
+      name: inspection.packageJson.name,
+      scripts: inspection.packageJson.scripts,
+      dependencies: inspection.packageJson.dependencies,
+      devDependencies: inspection.packageJson.devDependencies
+    } : null,
+    scripts: inspection.packageJson?.scripts ?? {},
+    routes: inspection.routes.map((r) => ({ route: r.route, file: r.file, source: r.source })),
+    existingFlows: inspection.existingFlows.map((f) => ({
+      id: f.id,
+      name: f.name,
+      file: f.file,
+      status: f.status
+    })),
+    stateFlowIds: inspection.stateFlowIds,
+    staleFlows: inspection.staleFlows,
+    candidateFlows: inspection.candidateFlows,
+    envVarNames: inspection.envVarNames,
+    envVarNamesOnly: inspection.envVarNames,
+    includedFiles: inspection.source.included.map((f) => f.path),
+    excludedFiles: inspection.source.excluded,
+    sourceFiles: inspection.source.included.map((f) => ({ path: f.path, content: f.content })),
+    redactionSummary: {
+      envValuesSent: false,
+      secretsRedacted: true,
+      excludedCount: inspection.source.excluded.length
+    }
+  };
+}
+function buildFlowPrompt(inspection, mode, targetFlows = []) {
+  const scope = targetFlows.length > 0 ? `Only generate or refresh these flow ids: ${targetFlows.join(", ")}.` : "Generate only flows supported by the detected routes and source evidence.";
+  return `You are SeatbeltAI's flow authoring layer.
+
+SeatbeltAI is QA for AI-coded apps before merge. AI writes deterministic Seatbelt YAML. Playwright runs that YAML later. Do not generate code. Do not invent unsupported app journeys.
+
+Task: ${mode === "refresh" ? "refresh stale existing Seatbelt flow YAML" : "generate starter Seatbelt flow YAML"}.
+${scope}
+
+Return ONLY one or more YAML documents, fenced as yaml or separated by "---". No prose outside YAML.
+
+Current Seatbelt flow schema:
+- Required: id, name, steps.
+- Optional/expected: description, critical, status, tags, dependencies, requires, needs.
+- id must be lowercase letters/numbers/dashes and match the intended file stem.
+- status may be grey, green, yellow, red, blocked. Use "yellow" when human review/setup is needed.
+- dependencies shape:
+  dependencies:
+    files: ["relative/source/file.tsx"]
+    routes: ["/route"]
+    services: []
+- requires shape:
+  requires:
+    env: [SEATBELT_TEST_EMAIL, SEATBELT_TEST_PASSWORD]
+- Use needs for authenticated flows that depend on sign-in, for example:
+  needs:
+    - signin-smoke
+
+Supported step syntax in this CLI:
+- goto: /path
+- click: "text=Sign in" OR "button[type=submit]"
+- fill:
+    selector: "input[type=email]"
+    valueFromEnv: SEATBELT_TEST_EMAIL
+- press: Enter
+- selectOption: { selector: "select[name=plan]", value: "pro" }
+- upload: { selector: "input[type=file]", path: "qa-fixtures/sample.pdf" }
+- waitForUrlContains: "/dashboard"
+- waitForText: "Dashboard"
+- waitForTimeoutMs: 1000
+- expectUrlContains: "/dashboard"
+- expectText: "Dashboard"
+- expectVisible: "text=Dashboard"
+- expectNotVisible: "text=Upgrade"
+- expectTitleContains: ""
+- screenshot: after-login
+
+Rules:
+- Use selector strings compatible with Playwright locator(), such as text=..., input[type=email], button[type=submit], [data-testid=...].
+- Prefer visible text/data-testid/input type/placeholder-derived CSS over brittle deep CSS.
+- Use valueFromEnv for credentials. Never include secret values.
+- Avoid destructive actions. Checkout flows should be cautious and status: yellow unless app evidence is clear.
+- Include comments only inside the YAML if they help human review.
+- Include dependencies.files and dependencies.routes for freshness.
+- Only include flows supported by routes/source evidence. If uncertain, create a cautious status: yellow template.
+
+Sanitized app summary:
+${formatInspectionForPrompt(inspection)}
+`;
+}
+function buildCopyPasteFallbackPrompt(inspection, targetFlows = []) {
+  const target = targetFlows.length ? `Focus on these flow ids: ${targetFlows.join(", ")}.` : "";
+  return `You are working in this repository. Create or refresh SeatbeltAI flow YAML files.
+
+${target}
+Use the current Seatbelt schema:
+- id, name, description, critical, status, tags, dependencies, requires, needs, steps.
+- Steps: goto, click, fill{selector,valueFromEnv}, press, selectOption, upload, waitForUrlContains, waitForText, waitForTimeoutMs, expectUrlContains, expectText, expectVisible, expectNotVisible, expectTitleContains, screenshot.
+- Use SEATBELT_TEST_EMAIL / SEATBELT_TEST_PASSWORD as env names only. Never write secret values.
+- Use status: yellow for anything that needs human review.
+- Use dependencies.files/routes so Seatbelt can detect stale flows.
+
+Detected summary:
+${formatInspectionForPrompt(inspection)}
+
+Return only YAML flow documents.`;
+}
+
+// src/ai/provider.ts
+function defaultModel(provider) {
+  if (provider === "seatbelt") return "hosted";
+  if (provider === "openai") return "gpt-4.1-mini";
+  return "hosted";
+}
+
+// src/ai/openai.ts
+var OpenAIFlowProvider = class {
+  constructor(apiKey = process.env.OPENAI_API_KEY) {
+    this.apiKey = apiKey;
+  }
+  apiKey;
+  name = "openai";
+  available() {
+    return Boolean(this.apiKey);
+  }
+  async generate(request) {
+    if (!this.apiKey) throw new Error("OPENAI_API_KEY is not set");
+    const res = await fetch("https://api.openai.com/v1/responses", {
+      method: "POST",
+      headers: {
+        "content-type": "application/json",
+        authorization: `Bearer ${this.apiKey}`
+      },
+      body: JSON.stringify({
+        model: request.model,
+        input: request.prompt,
+        store: false
+      })
+    });
+    const text = await res.text();
+    let body;
+    try {
+      body = JSON.parse(text);
+    } catch {
+      throw new Error(`OpenAI returned a non-JSON response (${res.status})`);
+    }
+    if (!res.ok) throw new Error(body.error?.message ?? `OpenAI request failed (${res.status})`);
+    if (body.output_text) return body.output_text;
+    const chunks = [];
+    for (const item of body.output ?? []) {
+      for (const part of item.content ?? []) {
+        if (part.type === "output_text" && part.text) chunks.push(part.text);
+      }
+    }
+    const out = chunks.join("\n").trim();
+    if (!out) throw new Error("OpenAI returned no text output");
+    return out;
+  }
+};
+
+// src/auth/store.ts
+import fs11 from "fs";
+import os from "os";
+import path17 from "path";
+function configDir() {
+  if (process.env.SEATBELT_CONFIG_DIR) return process.env.SEATBELT_CONFIG_DIR;
+  if (process.env.XDG_CONFIG_HOME) return path17.join(process.env.XDG_CONFIG_HOME, "seatbelt");
+  if (process.platform === "win32" && process.env.APPDATA) {
+    return path17.join(process.env.APPDATA, "seatbelt");
+  }
+  return path17.join(os.homedir(), ".config", "seatbelt");
+}
+function authFilePath() {
+  return path17.join(configDir(), "auth.json");
+}
+function readAuth() {
+  try {
+    const raw = fs11.readFileSync(authFilePath(), "utf8");
+    const data = JSON.parse(raw);
+    if (typeof data.token === "string" && data.token.trim()) {
+      return {
+        token: data.token,
+        email: data.email,
+        plan: data.plan,
+        savedAt: data.savedAt ?? (/* @__PURE__ */ new Date()).toISOString(),
+        origin: data.origin
+      };
+    }
+  } catch {
+  }
+  return null;
+}
+function readStoredToken() {
+  return readAuth()?.token;
+}
+function writeAuth(auth) {
+  const dir = configDir();
+  fs11.mkdirSync(dir, { recursive: true });
+  const record = { ...auth, savedAt: auth.savedAt ?? (/* @__PURE__ */ new Date()).toISOString() };
+  const file = authFilePath();
+  fs11.writeFileSync(file, JSON.stringify(record, null, 2) + "\n", "utf8");
+  try {
+    fs11.chmodSync(file, 384);
+  } catch {
+  }
+  return record;
+}
+function clearAuth() {
+  const file = authFilePath();
+  try {
+    if (!fs11.existsSync(file)) return false;
+    fs11.rmSync(file);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/ai/seatbelt.ts
+function trimTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+function seatbeltWebUrl() {
+  return trimTrailingSlash(
+    process.env.SEATBELT_WEB_URL ?? process.env.SEATBELT_APP_URL ?? "https://getseatbelt.ai"
+  );
+}
+function seatbeltApiToken() {
+  return process.env.SEATBELT_API_TOKEN ?? process.env.SEATBELT_API_KEY ?? readStoredToken();
+}
+function hostedAiDisabled() {
+  return process.env.SEATBELT_DISABLE_HOSTED_AI === "1";
+}
+function hostedAiTimeoutMs() {
+  const raw = Number(process.env.SEATBELT_API_TIMEOUT_MS);
+  if (!Number.isFinite(raw) || raw <= 0) return 6e4;
+  return Math.min(Math.max(raw, 5e3), 3e5);
+}
+var SeatbeltFlowProvider = class {
+  name = "seatbelt";
+  apiUrl;
+  token;
+  constructor(apiUrl, token = seatbeltApiToken()) {
+    this.apiUrl = trimTrailingSlash(process.env.SEATBELT_API_URL ?? apiUrl ?? "https://api.getseatbelt.ai");
+    this.token = token;
+  }
+  available() {
+    return Boolean(this.token) && !hostedAiDisabled();
+  }
+  destination() {
+    return this.apiUrl;
+  }
+  async generate(request) {
+    if (hostedAiDisabled()) throw new Error("Hosted Seatbelt AI is disabled by SEATBELT_DISABLE_HOSTED_AI=1.");
+    if (!this.token) throw new Error("SEATBELT_API_TOKEN is not set.");
+    const controller = new AbortController();
+    const timeoutMs = hostedAiTimeoutMs();
+    let timedOut = false;
+    const timeout = setTimeout(() => {
+      timedOut = true;
+      controller.abort();
+    }, timeoutMs);
+    let res;
+    try {
+      res = await fetch(`${this.apiUrl}/api/ai/generate-flows`, {
+        method: "POST",
+        signal: controller.signal,
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${this.token}`
+        },
+        body: JSON.stringify({
+          mode: request.mode ?? "generate-flows",
+          cliVersion: request.cliVersion,
+          project: request.project,
+          prompt: request.prompt
+        })
+      });
+    } catch (err) {
+      if (timedOut) {
+        throw new Error(`Seatbelt backend did not respond within ${Math.round(timeoutMs / 1e3)}s (set SEATBELT_API_TIMEOUT_MS to wait longer).`);
+      }
+      const reason = err instanceof Error ? err.message : String(err);
+      throw new Error(`Could not reach the Seatbelt backend at ${this.apiUrl}: ${reason}`);
+    } finally {
+      clearTimeout(timeout);
+    }
+    const body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok) {
+      const code = body?.error?.code ? `${body.error.code}: ` : "";
+      throw new Error(code + (body?.error?.message ?? `Seatbelt backend request failed (${res.status}).`));
+    }
+    if (!body.yaml?.trim()) throw new Error("Seatbelt backend returned no YAML.");
+    return body.yaml;
+  }
+};
+
+// src/commands/login.ts
+import http from "http";
+import crypto2 from "crypto";
+import open2 from "open";
+async function verifyToken(webUrl, token) {
+  try {
+    const res = await fetch(`${webUrl}/api/access/me`, {
+      headers: { authorization: `Bearer ${token}` }
+    });
+    const body = await res.json().catch(() => null);
+    return {
+      status: res.status,
+      active: body?.access?.active,
+      plan: body?.access?.plan,
+      email: body?.access?.email
+    };
+  } catch {
+    return { status: 0, networkError: true };
+  }
+}
+function successPage() {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Seatbelt connected</title>
+<style>
+  body{margin:0;height:100vh;display:flex;align-items:center;justify-content:center;
+    font-family:ui-sans-serif,system-ui,-apple-system,"Segoe UI",sans-serif;background:#0b1220;color:#fff}
+  .card{text-align:center;max-width:420px;padding:40px}
+  .badge{width:56px;height:56px;border-radius:14px;background:#2563EB;display:inline-flex;
+    align-items:center;justify-content:center;font-size:28px;margin-bottom:20px}
+  h1{font-size:22px;margin:0 0 8px} p{color:#94a3b8;line-height:1.5;margin:0}
+</style></head><body><div class="card">
+  <div class="badge">\u{1F512}</div>
+  <h1>You're connected to Seatbelt</h1>
+  <p>You can close this tab and return to your terminal. Future <code>seatbelt run</code> commands will just work.</p>
+</div></body></html>`;
+}
+function errorPage(message) {
+  return `<!doctype html><html><head><meta charset="utf-8"><title>Seatbelt login</title></head>
+<body style="font-family:sans-serif;padding:40px;color:#b42318">${message} \u2014 return to your terminal and run <code>seatbelt login</code> again.</body></html>`;
+}
+function waitForBrowserToken(state, timeoutMs) {
+  return new Promise((resolve, reject) => {
+    const server = http.createServer((req, res) => {
+      const url = new URL(req.url ?? "/", `http://127.0.0.1`);
+      if (url.pathname !== "/callback") {
+        res.writeHead(404, { "content-type": "text/plain" });
+        res.end("Not found");
+        return;
+      }
+      const token = url.searchParams.get("token");
+      const gotState = url.searchParams.get("state");
+      if (!token || gotState !== state) {
+        res.writeHead(400, { "content-type": "text/html" });
+        res.end(errorPage("That login link didn't match this session"));
+        return;
+      }
+      res.writeHead(200, { "content-type": "text/html" });
+      res.end(successPage());
+      cleanup();
+      resolve({ token, port });
+    });
+    let port = 0;
+    const timer = setTimeout(() => {
+      cleanup();
+      reject(
+        new SeatbeltError(
+          "Login timed out waiting for the browser.",
+          `Run ${pc.green("seatbelt login")} again, or paste a token with ${pc.green("seatbelt login --token <token>")}.`
+        )
+      );
+    }, timeoutMs);
+    function cleanup() {
+      clearTimeout(timer);
+      server.close();
+    }
+    server.on("error", (err) => {
+      cleanup();
+      reject(err);
+    });
+    server.listen(0, "127.0.0.1", () => {
+      port = server.address().port;
+      const webUrl = seatbeltWebUrl();
+      const loginUrl = `${webUrl}/login/cli?port=${port}&state=${state}`;
+      log.blank();
+      log.step("Opening your browser to connect your Seatbelt account\u2026");
+      log.plain(`  ${pc.cyan(loginUrl)}`);
+      log.dim("  If it didn't open, copy the link above into your browser.");
+      open2(loginUrl).catch(() => {
+        log.warn("Could not open a browser automatically. Open the link above manually.");
+      });
+    });
+  });
+}
+async function storeAndReport(token, verify, origin) {
+  writeAuth({ token, email: verify.email, plan: verify.plan, origin });
+  log.blank();
+  log.success("Logged in to Seatbelt.");
+  if (verify.email || verify.plan) {
+    log.plain(`  Account: ${pc.bold(verify.email ?? "(unknown)")}${verify.plan ? pc.dim(` \xB7 ${verify.plan}`) : ""}`);
+  }
+  log.dim(`  Token stored in ${authFilePath()}`);
+  log.blank();
+  log.plain(`Next: ${pc.green("seatbelt run")}`);
+  log.blank();
+}
+async function loginCommand(opts = {}) {
+  const webUrl = seatbeltWebUrl();
+  if (opts.token) {
+    const verify2 = await verifyToken(webUrl, opts.token);
+    if (verify2.status === 401 || verify2.status === 403) {
+      throw new SeatbeltError("That token was not accepted.", "Check the token and try again, or run `seatbelt login` without --token.");
+    }
+    if (verify2.networkError) {
+      log.warn(`Couldn't reach ${webUrl} to verify the token \u2014 storing it anyway.`);
+    } else if (verify2.active === false) {
+      log.warn("That token's subscription is not active. Storing it, but paid features may be skipped.");
+    }
+    await storeAndReport(opts.token, verify2, webUrl);
+    return 0;
+  }
+  const state = crypto2.randomBytes(16).toString("hex");
+  const { token } = await waitForBrowserToken(state, 5 * 6e4);
+  const verify = await verifyToken(webUrl, token);
+  if (verify.status === 401 || verify.status === 403) {
+    throw new SeatbeltError("The website returned a token, but it was rejected on verification.", "Try `seatbelt login` again.");
+  }
+  await storeAndReport(token, verify, webUrl);
+  return 0;
+}
+async function ensureHostedToken(opts = {}) {
+  const existing = seatbeltApiToken();
+  if (existing) return existing;
+  if (opts.localOnly) return void 0;
+  if (hostedAiDisabled()) return void 0;
+  if (process.env.SEATBELT_NO_AUTO_LOGIN === "1") return void 0;
+  if (!process.stdin.isTTY) return void 0;
+  log.blank();
+  log.warn("You need to connect Seatbelt to continue.");
+  log.plain("Opening your browser to log in\u2026");
+  try {
+    const state = crypto2.randomBytes(16).toString("hex");
+    const { token } = await waitForBrowserToken(state, 5 * 6e4);
+    const verify = await verifyToken(seatbeltWebUrl(), token);
+    if (verify.status === 401 || verify.status === 403) {
+      log.warn("Login didn't grant access. Continuing without hosted AI.");
+      return void 0;
+    }
+    writeAuth({ token, email: verify.email, plan: verify.plan, origin: seatbeltWebUrl() });
+    log.success(`Connected${verify.email ? " as " + verify.email : ""}.`);
+    return token;
+  } catch (err) {
+    log.warn(`Couldn't complete login: ${err instanceof Error ? err.message : String(err)}`);
+    log.dim("Continuing with local fallback. You can run `seatbelt login` any time.");
+    return void 0;
+  }
+}
+async function logoutCommand() {
+  const had = clearAuth();
+  log.blank();
+  if (had) log.success("Logged out. Stored Seatbelt token removed.");
+  else log.plain("You weren't logged in. Nothing to remove.");
+  log.blank();
+  return 0;
+}
+async function whoamiCommand() {
+  log.blank();
+  if (process.env.SEATBELT_API_TOKEN || process.env.SEATBELT_API_KEY) {
+    log.plain(`${pc.bold("Auth source:")} environment variable (advanced/CI override).`);
+  }
+  const auth = readAuth();
+  if (!auth) {
+    log.plain("Not logged in.");
+    log.dim(`Run ${pc.green("seatbelt login")} to connect your account in the browser.`);
+    log.blank();
+    return 0;
+  }
+  log.plain(`${pc.bold("Logged in:")} ${auth.email ?? "(unknown email)"}${auth.plan ? pc.dim(` \xB7 ${auth.plan}`) : ""}`);
+  log.dim(`  Stored ${new Date(auth.savedAt).toLocaleString()} in ${authFilePath()}`);
+  log.blank();
+  return 0;
+}
+
+// src/ai/flowSuggest.ts
+import YAML5 from "yaml";
+
+// src/ai/yamlExtract.ts
+import YAML4 from "yaml";
+function fencedBlocks(text) {
+  const blocks = [];
+  const re = /```(?:yaml|yml)?\s*([\s\S]*?)```/gi;
+  for (const match of text.matchAll(re)) {
+    if (match[1]?.trim()) blocks.push(match[1].trim());
+  }
+  return blocks;
+}
+function splitDocuments(text) {
+  const doc = YAML4.parseAllDocuments(text);
+  if (doc.length > 1) {
+    return doc.map((d) => d.toString().trim()).filter(Boolean);
+  }
+  return [text.trim()].filter(Boolean);
+}
+function issueMessage(err) {
+  if (err instanceof Error) return err.message.split("\n")[0] ?? err.message;
+  return String(err);
+}
+function normalizeYaml(value) {
+  return YAML4.stringify(value).trim() + "\n";
+}
+function extractFlowYaml(text) {
+  const chunks = fencedBlocks(text);
+  const candidates = chunks.length ? chunks.flatMap(splitDocuments) : splitDocuments(text);
+  const valid = [];
+  const rejected = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const candidate of candidates) {
+    let parsed;
+    try {
+      parsed = YAML4.parse(candidate);
+    } catch (err) {
+      rejected.push({ yaml: candidate, error: `YAML parse failed: ${issueMessage(err)}` });
+      continue;
+    }
+    const maybeFlows = Array.isArray(parsed?.flows) ? parsed.flows : [parsed];
+    for (const item of maybeFlows) {
+      const result = flowSchema.safeParse(item);
+      const yaml = normalizeYaml(item);
+      if (!result.success) {
+        const issue = result.error.issues[0];
+        const where = issue?.path.length ? issue.path.join(".") : "(flow)";
+        rejected.push({ yaml, error: `${where}: ${issue?.message ?? "invalid flow"}` });
+        continue;
+      }
+      if (seen.has(result.data.id)) {
+        rejected.push({ yaml, error: `duplicate flow id ${result.data.id}` });
+        continue;
+      }
+      seen.add(result.data.id);
+      valid.push({ id: result.data.id, yaml, flow: result.data });
+    }
+  }
+  return { valid, rejected };
+}
+
+// src/ai/flowSuggest.ts
+function routeFor(inspection, parts, fallback) {
+  const found = inspection.routes.find((r) => parts.some((p) => r.route.toLowerCase().includes(p)));
+  return { route: found?.route ?? fallback, file: found?.file ?? null };
+}
+function files(...items) {
+  return [...new Set(items.filter((x) => Boolean(x)))];
+}
+function yamlFor(flow) {
+  return YAML5.stringify(flow).trim() + "\n";
+}
+function makeFlow(flow) {
+  const parsed = extractFlowYaml(yamlFor(flow));
+  if (!parsed.valid[0]) throw new Error("local flow template did not validate");
+  return {
+    id: parsed.valid[0].id,
+    yaml: parsed.valid[0].yaml,
+    flow: parsed.valid[0].flow,
+    source: "local",
+    assumptions: ["Generated locally from routes. Review selectors before certifying."]
+  };
+}
+function localFlowSuggestions(inspection, requestedIds = []) {
+  const requested = new Set(requestedIds);
+  const shouldInclude = (id) => requested.size === 0 || requested.has(id);
+  const suggestions = [];
+  if (shouldInclude("homepage-smoke")) {
+    const home = routeFor(inspection, ["/"], "/");
+    suggestions.push(
+      makeFlow({
+        id: "homepage-smoke",
+        name: "Homepage loads",
+        description: "Open the home page and confirm it renders.",
+        critical: true,
+        tags: ["smoke"],
+        dependencies: { files: files(home.file), routes: ["/"], services: [] },
+        requires: { env: [] },
+        steps: [{ goto: "/" }, { expectTitleContains: "" }, { screenshot: "homepage" }]
+      })
+    );
+  }
+  const login = routeFor(inspection, ["/signin", "/login", "/sign-in", "/auth"], "/login");
+  const loginId = login.route.includes("signin") || login.route.includes("sign-in") ? "signin-smoke" : "login-smoke";
+  if (shouldInclude(loginId) || shouldInclude("signin-smoke") || shouldInclude("login-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: loginId,
+        name: "User signs in",
+        description: "Sign in as the QA test user from a fresh browser session.",
+        critical: true,
+        status: "yellow",
+        tags: ["auth", "critical"],
+        dependencies: { files: files(login.file), routes: [login.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        steps: [
+          { goto: login.route },
+          { fill: { selector: "input[type=email]", valueFromEnv: "SEATBELT_TEST_EMAIL" } },
+          { fill: { selector: "input[type=password]", valueFromEnv: "SEATBELT_TEST_PASSWORD" } },
+          { click: "button[type=submit]" },
+          { screenshot: "after-signin" }
+        ]
+      })
+    );
+  }
+  const dashboard = routeFor(inspection, ["/dashboard", "/app", "/account", "/overview", "/courses"], "/dashboard");
+  if (inspection.candidateFlows.includes("dashboard-smoke") && shouldInclude("dashboard-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: "dashboard-smoke",
+        name: "Dashboard loads",
+        description: "Authenticated dashboard or workspace loads.",
+        critical: true,
+        status: "yellow",
+        tags: ["dashboard"],
+        dependencies: { files: files(login.file, dashboard.file), routes: [login.route, dashboard.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        needs: [loginId],
+        steps: [
+          { goto: dashboard.route },
+          { expectTitleContains: "" },
+          { screenshot: "dashboard" }
+        ]
+      })
+    );
+  }
+  const signup = routeFor(inspection, ["/signup", "/register", "/sign-up"], "/signup");
+  if (inspection.candidateFlows.includes("signup-smoke") && shouldInclude("signup-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: "signup-smoke",
+        name: "New user signs up",
+        description: "Template for creating a new QA user. Review before enabling.",
+        critical: false,
+        status: "yellow",
+        tags: ["auth", "signup"],
+        dependencies: { files: files(signup.file), routes: [signup.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        steps: [
+          { goto: signup.route },
+          { fill: { selector: "input[type=email]", valueFromEnv: "SEATBELT_TEST_EMAIL" } },
+          { fill: { selector: "input[type=password]", valueFromEnv: "SEATBELT_TEST_PASSWORD" } },
+          { click: "button[type=submit]" },
+          { screenshot: "after-signup" }
+        ]
+      })
+    );
+  }
+  const onboarding = routeFor(inspection, ["/onboarding", "/corridor", "/welcome", "/setup"], "/onboarding");
+  if (inspection.candidateFlows.includes("onboarding-smoke") && shouldInclude("onboarding-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: "onboarding-smoke",
+        name: "Onboarding starts",
+        description: "Template for the first-run onboarding path.",
+        critical: true,
+        status: "yellow",
+        tags: ["onboarding"],
+        dependencies: { files: files(onboarding.file), routes: [onboarding.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        needs: [loginId],
+        steps: [{ goto: onboarding.route }, { expectTitleContains: "" }, { screenshot: "onboarding" }]
+      })
+    );
+  }
+  const upload = routeFor(inspection, ["/upload", "/import", "/documents", "/files"], "/upload");
+  if (inspection.candidateFlows.includes("upload-smoke") && shouldInclude("upload-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: "upload-smoke",
+        name: "User uploads a file",
+        description: "Template for uploading a fixture file. Review before enabling.",
+        critical: false,
+        status: "yellow",
+        tags: ["upload"],
+        dependencies: { files: files(upload.file), routes: [upload.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        needs: [loginId],
+        steps: [
+          { goto: upload.route },
+          { upload: { selector: "input[type=file]", path: "qa-fixtures/sample.pdf" } },
+          { screenshot: "after-upload" }
+        ]
+      })
+    );
+  }
+  const checkout = routeFor(inspection, ["/pricing", "/checkout", "/billing", "/upgrade"], "/pricing");
+  if (inspection.candidateFlows.includes("checkout-smoke") && shouldInclude("checkout-smoke")) {
+    suggestions.push(
+      makeFlow({
+        id: "checkout-smoke",
+        name: "User upgrades",
+        description: "Template for a revenue/access flow (checkout, billing, or entitlements). Keep disabled until your app's details are confirmed.",
+        critical: false,
+        status: "yellow",
+        tags: ["checkout", "billing"],
+        dependencies: { files: files(checkout.file), routes: [checkout.route], services: [] },
+        requires: { env: ["SEATBELT_TEST_EMAIL", "SEATBELT_TEST_PASSWORD"] },
+        needs: [loginId],
+        steps: [{ goto: checkout.route }, { click: "text=Upgrade" }, { screenshot: "checkout" }]
+      })
+    );
+  }
+  return suggestions;
+}
+function aiFlowSuggestions(output3) {
+  const extracted = extractFlowYaml(output3);
+  return {
+    suggestions: extracted.valid.map((v) => ({
+      id: v.id,
+      yaml: v.yaml,
+      flow: v.flow,
+      source: "ai",
+      assumptions: ["Generated by AI from sanitized app summary. Review before certifying."]
+    })),
+    rejected: extracted.rejected
+  };
+}
+
+// src/commands/generateFlows.ts
+function providerFor(name, seatbeltBackend) {
+  if (name === "seatbelt") return new SeatbeltFlowProvider(seatbeltBackend);
+  if (name === "openai") return new OpenAIFlowProvider();
+  return new SeatbeltFlowProvider(seatbeltBackend);
+}
+function chooseProvider(explicit) {
+  if (explicit) return explicit;
+  if (!hostedAiDisabled() && seatbeltApiToken()) return "seatbelt";
+  if (process.env.OPENAI_API_KEY) return "openai";
+  return hostedAiDisabled() ? "openai" : "seatbelt";
+}
+function targetPathFor(flowsDir, id) {
+  return path18.join(flowsDir, `${id}.yaml`);
+}
+function suggestedPathFor(flowsDir, id) {
+  return path18.join(flowsDir, `${id}.suggested.yaml`);
+}
+function backupPathFor(target) {
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  return `${target}.${stamp}.bak`;
+}
+function printInspectionSummary(inspection) {
+  log.plain(pc.bold("Detected app"));
+  log.plain(`  Framework/package: ${pc.cyan(inspection.framework)} / ${pc.cyan(inspection.packageManager)}`);
+  if (inspection.packageJson) {
+    log.plain(`  Scripts: ${Object.keys(inspection.packageJson.scripts).join(", ") || "(none)"}`);
+    const deps = inspection.packageJson.dependencies.slice(0, 12).join(", ");
+    log.plain(`  Dependencies: ${deps || "(none)"}${inspection.packageJson.dependencies.length > 12 ? ", ..." : ""}`);
+  }
+  log.plain(`  Routes: ${inspection.routes.map((r) => r.route).slice(0, 20).join(", ") || "(none detected)"}`);
+  log.plain(`  Existing flows: ${inspection.existingFlows.map((f) => f.id).join(", ") || "(none)"}`);
+  log.plain(`  Stale flows: ${inspection.staleFlows.map((f) => f.id).join(", ") || "(none)"}`);
+  log.plain(`  Candidate flows: ${inspection.candidateFlows.join(", ") || "(none)"}`);
+  log.plain(`  Env var names only: ${inspection.envVarNames.join(", ") || "(none detected)"}`);
+}
+function printPrivacySummary(inspection) {
+  log.blank();
+  log.plain(pc.bold("What would be sent to AI"));
+  log.plain("  Framework/package summary, package scripts, dependency names, detected routes.");
+  log.plain(`  Existing flow ids: ${inspection.existingFlows.map((f) => f.id).join(", ") || "(none)"}`);
+  log.plain(`  Stale flow ids: ${inspection.staleFlows.map((f) => f.id).join(", ") || "(none)"}`);
+  log.plain(`  Source files included: ${inspection.source.included.map((f) => f.path).join(", ") || "(none)"}`);
+  log.plain(`  Source files excluded: ${inspection.source.excluded.map((f) => `${f.path} (${f.reason})`).slice(0, 12).join(", ") || "(none)"}`);
+  log.plain(`  Env vars: names only (${inspection.envVarNames.join(", ") || "none detected"}). Values are never sent.`);
+  log.plain("  Redaction: likely API keys, tokens, passwords, Stripe secrets, Mongo URLs, JWT secrets, and private keys are replaced before sending.");
+}
+function printHostedDestination(provider) {
+  if (provider.name !== "seatbelt") return;
+  const destination = provider instanceof SeatbeltFlowProvider ? provider.destination() : "Seatbelt backend";
+  log.plain(`  API destination: ${pc.cyan(destination)}`);
+}
+async function consent(opts, inspection) {
+  if (opts.yes) return true;
+  if (!process.stdin.isTTY) return false;
+  printPrivacySummary(inspection);
+  const rl = readline2.createInterface({ input: input2, output: output2 });
+  try {
+    const answer = await rl.question("Send this sanitized summary to AI? [y/N] ");
+    return /^y(es)?$/i.test(answer.trim());
+  } finally {
+    rl.close();
+  }
+}
+async function saveFallbackPrompt(cwd, inspection, targetFlows) {
+  const file = path18.join(cwd, ".seatbelt", "flow-authoring-prompt.md");
+  await writeText(file, buildCopyPasteFallbackPrompt(inspection, targetFlows));
+  return file;
+}
+function filterSuggestions(suggestions, targetFlows) {
+  if (!targetFlows.length) return suggestions;
+  const target = new Set(targetFlows);
+  return suggestions.filter((s) => target.has(s.id));
+}
+async function writeSuggestions(cwd, flowsDirRel, suggestions, opts) {
+  const flowsDir = path18.join(cwd, flowsDirRel);
+  await ensureDir(flowsDir);
+  const written = [];
+  for (const suggestion of suggestions) {
+    const target = targetPathFor(flowsDir, suggestion.id);
+    const targetExists = exists(target);
+    let outPath = target;
+    let action2 = "write";
+    if (targetExists && opts.mode === "refresh" && opts.apply) {
+      action2 = "backup-and-overwrite";
+    } else if (targetExists) {
+      outPath = suggestedPathFor(flowsDir, suggestion.id);
+      action2 = "suggested";
+    }
+    if (opts.dryRun) {
+      written.push({ id: suggestion.id, path: outPath, action: "skip-dry-run" });
+      continue;
+    }
+    if (action2 === "backup-and-overwrite") {
+      await fs12.promises.copyFile(target, backupPathFor(target));
+    }
+    await writeText(outPath, suggestion.yaml);
+    written.push({ id: suggestion.id, path: outPath, action: action2 });
+  }
+  return written;
+}
+async function syncWrittenFlows(cwd, paths, projectName, suggestions, writes) {
+  const actualWrites = new Set(writes.filter((w) => w.action === "write" || w.action === "backup-and-overwrite").map((w) => w.id));
+  if (!actualWrites.size) return;
+  let state = await loadOrSeedState(paths.stateFile, projectName);
+  state = syncFlowsFromYaml(
+    state,
+    suggestions.filter((s) => actualWrites.has(s.id)).map((s) => ({
+      id: s.flow.id,
+      name: s.flow.name,
+      description: s.flow.description,
+      tags: s.flow.tags,
+      dependencies: s.flow.dependencies,
+      requires: s.flow.requires,
+      needs: s.flow.needs,
+      declaredStatus: s.flow.status
+    }))
+  );
+  await saveState(paths.stateFile, state);
+  const meta = readFlowMeta(paths);
+  for (const s of suggestions.filter((x) => actualWrites.has(x.id))) {
+    meta.flows[s.id] = {
+      dependencies: s.flow.dependencies,
+      fingerprint: fingerprintDependencies(cwd, s.flow.dependencies),
+      lastCertifiedAt: null,
+      lastCertifiedRunId: null
+    };
+  }
+  await writeFlowMeta(paths, meta);
+}
+async function runFlowGeneration(opts) {
+  const { config, paths } = await loadConfig({ cwd: opts.cwd });
+  const inspection = await inspectApp(paths, config);
+  const targetFlows = opts.targetFlows ?? [];
+  log.blank();
+  log.step(`Seatbelt ${opts.mode === "refresh" ? "refresh-flows --ai" : "generate-flows"}`);
+  printInspectionSummary(inspection);
+  const localOnly = opts.localOnly || config.ai.enabled === false;
+  if (!localOnly && opts.provider !== "openai") {
+    await ensureHostedToken({ localOnly });
+  }
+  const providerName = chooseProvider(opts.provider);
+  const model = opts.model ?? defaultModel(providerName);
+  const provider = providerFor(providerName, config.ai.backend);
+  let suggestions = [];
+  let usedAi = false;
+  const canCallProvider = !localOnly && provider.available() && (provider.name === "seatbelt" || await consent(opts, inspection));
+  if (!localOnly && provider.name === "seatbelt") {
+    log.blank();
+    log.plain(pc.bold("Hosted AI transparency"));
+    printHostedDestination(provider);
+    printPrivacySummary(inspection);
+  }
+  if (canCallProvider) {
+    try {
+      const prompt = buildFlowPrompt(inspection, opts.mode, targetFlows);
+      log.blank();
+      log.step(`Calling ${providerName} (${model}) with sanitized app summary.`);
+      const outputText = await provider.generate({
+        prompt,
+        model,
+        mode: opts.mode === "refresh" ? "refresh-flows" : "generate-flows",
+        cliVersion: VERSION,
+        project: buildHostedProjectPayload(inspection)
+      });
+      const ai = aiFlowSuggestions(outputText);
+      suggestions = filterSuggestions(ai.suggestions, targetFlows);
+      usedAi = suggestions.length > 0;
+      for (const rejected of ai.rejected) log.warn(`Rejected AI YAML: ${rejected.error}`);
+      if (!suggestions.length) log.warn("AI did not return any valid Seatbelt flows. Falling back to local templates.");
+    } catch (err) {
+      const message = err instanceof Error ? err.message : String(err);
+      log.warn(`AI generation was unavailable: ${message}`);
+    }
+  } else if (!localOnly && !provider.available()) {
+    if (provider.name === "seatbelt") {
+      const reason = hostedAiDisabled() ? "Hosted Seatbelt AI is disabled by SEATBELT_DISABLE_HOSTED_AI=1." : "You're not logged in to Seatbelt.";
+      log.warn(`${reason} Using local-only fallback instead of failing.`);
+      log.plain(`  Run ${pc.green("seatbelt login")} to connect your account in the browser (no token to paste), or pass ${pc.green("--local-only")} to stay offline.`);
+      log.dim(`  Advanced/CI: set ${pc.cyan("SEATBELT_API_TOKEN")} instead of logging in.`);
+    } else {
+      log.warn(`Local OpenAI developer fallback is unavailable because ${pc.cyan("OPENAI_API_KEY")} is not set. Using local-only fallback.`);
+    }
+  } else if (!localOnly) {
+    log.warn("AI consent was not granted. Using local-only fallback.");
+  }
+  if (!suggestions.length) {
+    suggestions = filterSuggestions(localFlowSuggestions(inspection, targetFlows), targetFlows);
+    if (opts.dryRun) {
+      log.info("Dry run: would save a copy-paste flow authoring prompt in .seatbelt/flow-authoring-prompt.md.");
+    } else {
+      const promptFile = await saveFallbackPrompt(paths.cwd, inspection, targetFlows);
+      log.info(`Saved a copy-paste flow authoring prompt: ${pc.cyan(displayPath(paths.cwd, promptFile))}`);
+    }
+  }
+  if (!suggestions.length) {
+    log.warn("No flow suggestions were produced from the detected app evidence.");
+    return 0;
+  }
+  const writes = await writeSuggestions(paths.cwd, config.flows.dir, suggestions, opts);
+  await syncWrittenFlows(paths.cwd, paths, config.app.name, suggestions, writes);
+  log.blank();
+  log.success(`${opts.dryRun ? "Prepared" : usedAi ? "Generated" : "Generated local fallback"} ${writes.length} flow suggestion${writes.length > 1 ? "s" : ""}:`);
+  for (const w of writes) {
+    const action2 = w.action === "skip-dry-run" ? "would write" : w.action === "suggested" ? "suggested" : w.action === "backup-and-overwrite" ? "applied with backup" : "wrote";
+    log.plain(`  ${pc.cyan(displayPath(paths.cwd, w.path))} ${pc.dim("(" + action2 + ")")}`);
+  }
+  log.blank();
+  log.plain(pc.bold("Next:"));
+  for (const w of writes.slice(0, 3)) {
+    if (!w.path.endsWith(".suggested.yaml") && w.action !== "skip-dry-run") log.plain(`  ${pc.green(`seatbelt run ${w.id}`)}`);
+  }
+  log.plain(`  ${pc.green("seatbelt certify --run")}`);
+  log.blank();
+  return 0;
+}
+async function generateFlowsCommand(opts = {}) {
+  return runFlowGeneration({ ...opts, mode: "generate" });
+}
+
+// src/commands/refreshFlows.ts
+import path19 from "path";
+async function refreshFlowsCommand(opts = {}) {
+  if (opts.ai) {
+    return runFlowGeneration({
+      cwd: opts.cwd,
+      localOnly: opts.localOnly,
+      dryRun: opts.dryRun,
+      yes: opts.yes,
+      provider: opts.provider,
+      model: opts.model,
+      mode: "refresh",
+      apply: opts.apply,
+      targetFlows: opts.flow ? [opts.flow] : void 0
+    });
+  }
+  const { config, paths } = await loadConfig({ cwd: opts.cwd });
+  const flowsDir = path19.join(paths.cwd, config.flows.dir);
+  log.blank();
+  log.step("Seatbelt refresh-flows " + pc.dim("(local)"));
+  log.dim("Use --ai to ask for validated YAML suggestions. Without --ai, this stays local and only refreshes starter templates/stale warnings.");
+  log.blank();
+  const created = await ensureStarterFlows(flowsDir);
+  if (created.length) {
+    log.success(
+      `Created ${created.length} starter flow${created.length > 1 ? "s" : ""} in ${pc.cyan(displayPath(paths.cwd, flowsDir))}: ${created.join(", ")}.`
+    );
+  }
+  if (opts.localOnly && !created.length) {
+    const restored = [];
+    for (const tpl of STARTER_FLOW_TEMPLATES) {
+      const file = path19.join(flowsDir, `${tpl.id}.yaml`);
+      if (!exists(file)) {
+        await writeText(file, tpl.yaml);
+        restored.push(tpl.id);
+      }
+    }
+    if (restored.length) {
+      log.success(`Restored ${restored.length} missing starter template${restored.length > 1 ? "s" : ""}: ${restored.join(", ")}.`);
+    } else {
+      log.dim("All starter templates already present \u2014 nothing to restore.");
+    }
+  }
+  const { flows, errors } = await loadFlows(paths.cwd, config.flows.dir, { create: false });
+  for (const e of errors) log.warn(`Skipping ${e.file}: ${e.message}`);
+  const meta = readFlowMeta(paths);
+  const stale = [];
+  for (const f of flows) {
+    const current = fingerprintDependencies(paths.cwd, f.dependencies);
+    const { stale: isStale, changedFiles } = detectStale(current, meta.flows[f.id]?.fingerprint);
+    if (isStale) stale.push({ id: f.id, files: changedFiles });
+  }
+  log.blank();
+  if (stale.length === 0) {
+    log.success(pc.bold("No stale flows detected.") + " Your flows match the files last certified.");
+    log.plain(`  (Run ${pc.green("seatbelt certify --run")} after configuring flows to set the freshness baseline.)`);
+  } else {
+    log.warn(pc.bold(`${stale.length} flow${stale.length > 1 ? "s" : ""} may be stale (dependency files changed):`));
+    for (const s of stale) log.plain(`  \u2022 ${pc.cyan(s.id)} \u2014 changed: ${s.files.join(", ")}`);
+    log.blank();
+    log.plain(pc.bold("What to do (Seatbelt won't rewrite your flow files):"));
+    log.plain(`  1. Review the changed files and update the affected flow YAML in ${pc.cyan(config.flows.dir + "/")}.`);
+    log.plain(`  2. Re-certify to refresh the baseline: ${pc.green("seatbelt certify --run")}.`);
+    log.dim(`  (Or run ${pc.green("seatbelt refresh-flows --ai --dry-run")} to ask for validated YAML suggestions.)`);
+  }
+  log.blank();
+  return 0;
+}
+
+// src/commands/lint.ts
+import path20 from "path";
+import { execa as execa3 } from "execa";
+var CHECK_TIMEOUT_MS = 3e5;
+function renderLintMarkdown(model) {
+  const lines = [];
+  lines.push(`# SeatbeltAI Lint \u2014 ${model.passed ? "\u2705 PASS" : "\u26D4 FAIL"}`);
+  lines.push(`_${model.generatedAt} \xB7 run ${model.runId}_`);
+  lines.push("");
+  lines.push(`| Check | Command | Result | Duration |`);
+  lines.push(`|------|------|:--:|--:|`);
+  for (const c of model.checks) {
+    lines.push(
+      `| ${c.name} | \`${c.command}\` | ${c.status === "pass" ? "\u2705 PASS" : "\u26D4 FAIL"} | ${(c.durationMs / 1e3).toFixed(1)}s |`
+    );
+  }
+  lines.push("");
+  for (const c of model.checks) {
+    if (c.logFile) lines.push(`- ${c.name}: \`${c.logFile}\``);
+  }
+  lines.push("");
+  lines.push(`> \`seatbelt lint\` runs your detected checks with no browser. Free and local.`);
+  return lines.join("\n") + "\n";
+}
+async function lintCommand(opts = {}) {
+  const { config, paths } = await loadConfig({ cwd: opts.cwd });
+  const order = ["lint", "typecheck", "build", "test"];
+  const checks = [];
+  for (const key of order) {
+    const command = config.checks[key];
+    if (command) checks.push({ name: key, command });
+  }
+  if (checks.length === 0) {
+    log.blank();
+    log.warn("No checks were detected.");
+    log.plain(
+      `Seatbelt looks for ${pc.cyan("lint")}, ${pc.cyan("typecheck")}, ${pc.cyan("build")} and ${pc.cyan("test")} scripts in package.json.`
+    );
+    log.plain(
+      "Add one or more of those scripts (or set them under `checks:` in seatbelt.config.yaml), then run " + pc.green("seatbelt lint") + " again."
+    );
+    log.blank();
+    return 0;
+  }
+  const runId = createRunId();
+  const dir = artifactDir(paths, runId);
+  const lintDir = path20.join(dir, "lint");
+  await ensureDir(lintDir);
+  log.blank();
+  log.step(`Seatbelt lint ${pc.bold(runId)}`);
+  log.dim(`Running ${checks.length} check${checks.length > 1 ? "s" : ""} (no browser)\u2026`);
+  const results = [];
+  for (const check of checks) {
+    log.blank();
+    log.step(`${check.name}: ${pc.cyan(check.command)}`);
+    const logPath = path20.join(lintDir, `${check.name}.log`);
+    const start = Date.now();
+    const r = await execa3(check.command, {
+      shell: true,
+      cwd: paths.cwd,
+      reject: false,
+      timeout: CHECK_TIMEOUT_MS,
+      // CI=1 makes most runners (vitest/jest/react-scripts) run once and exit, not watch.
+      env: { ...process.env, CI: "1" }
+    });
+    const durationMs = Date.now() - start;
+    const stdout = typeof r.stdout === "string" ? r.stdout : "";
+    const stderr = typeof r.stderr === "string" ? r.stderr : "";
+    const timedOut = r.timedOut === true;
+    const exitCode = typeof r.exitCode === "number" ? r.exitCode : timedOut ? null : 1;
+    await writeText(
+      logPath,
+      `$ ${check.command}
+
+[stdout]
+${stdout}
+
+[stderr]
+${stderr}
+
+[exit] ${exitCode ?? "killed"}${timedOut ? " (timed out)" : ""}
+`
+    );
+    const status = !timedOut && exitCode === 0 ? "pass" : "fail";
+    results.push({
+      name: check.name,
+      command: check.command,
+      status,
+      exitCode,
+      durationMs,
+      logFile: displayPath(paths.cwd, logPath)
+    });
+    if (status === "pass") log.success(`${check.name} passed ${pc.dim((durationMs / 1e3).toFixed(1) + "s")}`);
+    else log.warn(`${check.name} failed ${pc.dim("(exit " + (exitCode ?? "timeout") + ")")}`);
+  }
+  const passed = results.every((r) => r.status === "pass");
+  const model = { runId, generatedAt: (/* @__PURE__ */ new Date()).toISOString(), passed, checks: results };
+  await writeJson(path20.join(dir, "lint-run.json"), model);
+  await writeText(path20.join(dir, "lint-report.md"), renderLintMarkdown(model));
+  log.blank();
+  log.plain(pc.bold("Checks"));
+  for (const r of results) {
+    const tag = r.status === "pass" ? pc.green("PASS") : pc.red("FAIL");
+    log.plain(
+      `  ${tag}  ${r.name.padEnd(10)} ${pc.dim((r.durationMs / 1e3).toFixed(1) + "s").padEnd(6)}  ${pc.dim(r.command)}`
+    );
+  }
+  log.blank();
+  log.plain(`Report: ${pc.cyan(displayPath(paths.cwd, path20.join(dir, "lint-report.md")))}`);
+  log.blank();
+  if (passed) {
+    log.success(pc.bold("All checks passed."));
+  } else {
+    log.warn(pc.bold("Some checks failed.") + " Fix them, then re-run " + pc.green("seatbelt lint") + ".");
+  }
+  log.blank();
+  return passed ? 0 : 1;
+}
+
+// src/commands/doctor.ts
+import fs13 from "fs";
+import path21 from "path";
+import { chromium as chromium2 } from "playwright";
+function mark(status) {
+  if (status === "ok") return pc.green("\u2713");
+  if (status === "warn") return pc.yellow("\u26A0");
+  return pc.red("\u2717");
+}
+function line(status, label, detail) {
+  log.plain(`  ${mark(status)} ${pc.bold(label.padEnd(10))} ${detail}`);
+}
+function chromiumInstalled() {
+  try {
+    return fs13.existsSync(chromium2.executablePath());
+  } catch {
+    return false;
+  }
+}
+async function doctorCommand(opts = {}) {
+  const { config, paths, configFileExists } = await loadConfig({ cwd: opts.cwd });
+  const summary = await detect(paths);
+  const baseUrl = config.server.baseUrl;
+  const reachable = await isUrlReachable(baseUrl, 1200);
+  const { flows, errors: flowErrors } = await loadFlows(paths.cwd, config.flows.dir, {
+    create: false
+  });
+  const flowsDirExists = exists(path21.join(paths.cwd, config.flows.dir)) || flows.length > 0;
+  const stateExists = exists(paths.stateFile);
+  const hasChromium = chromiumInstalled();
+  const resetConfigured = Boolean(config.reset.command);
+  const blockers = [];
+  log.blank();
+  log.step("Seatbelt doctor");
+  log.dim(configFileExists ? "Using seatbelt.config.yaml + detection." : "No config file \u2014 using detection + defaults.");
+  log.blank();
+  line(
+    summary.hasPackageJson ? "ok" : "warn",
+    "project",
+    `${pc.cyan(summary.framework)} \xB7 ${summary.packageManager}${summary.hasPackageJson ? "" : pc.dim("  (no package.json found)")}`
+  );
+  const resolvedChecks = ["lint", "typecheck", "build", "test"].filter(
+    (k) => config.checks[k]
+  );
+  line(
+    summary.scripts.length ? "ok" : "warn",
+    "scripts",
+    summary.scripts.length ? `${summary.scripts.join(", ")}${resolvedChecks.length ? pc.dim(`   \u2192 checks: ${resolvedChecks.join(", ")}`) : ""}` : "none detected"
+  );
+  if (reachable) {
+    line("ok", "server", `${pc.cyan(baseUrl)} ${pc.green("(reachable now)")}`);
+  } else if (config.server.devCommand) {
+    line("warn", "server", `${pc.cyan(baseUrl)} not reachable \u2014 Seatbelt will start ${pc.cyan(config.server.devCommand)} on run`);
+  } else {
+    line("fail", "server", `${pc.cyan(baseUrl)} not reachable and no dev command detected`);
+    blockers.push("Start your app, or set server.devCommand in seatbelt.config.yaml.");
+  }
+  if (summary.composeFile) {
+    line("warn", "services", `${summary.composeFile} detected ${pc.dim("(Seatbelt does not start Docker yet)")}`);
+  } else {
+    line("ok", "services", "no Docker Compose file");
+  }
+  if (flows.length > 0) {
+    line("ok", "flows", `${flows.length} valid in ${config.flows.dir}/${flowErrors.length ? pc.red(`  \xB7 ${flowErrors.length} invalid`) : ""}`);
+  } else if (flowsDirExists) {
+    line("warn", "flows", `${config.flows.dir}/ has no valid flows`);
+  } else {
+    line("warn", "flows", `${config.flows.dir}/ not created yet \u2014 run ${pc.green("seatbelt on")} or ${pc.green("seatbelt run")}`);
+  }
+  for (const e of flowErrors) log.plain(`      ${pc.red("\xB7")} ${e.file}: ${pc.dim(e.message)}`);
+  line(stateExists ? "ok" : "warn", "state", stateExists ? ".seatbelt/state.json present" : "no state yet (run `seatbelt on`)");
+  if (resetConfigured) {
+    line("ok", "reset", `${pc.cyan(config.reset.command)} \xB7 required: ${config.reset.required ? "yes" : "no"}`);
+  } else if (config.reset.required) {
+    line("fail", "reset", "required but no command set \u2014 run `seatbelt setup-reset`");
+    blockers.push("Reset is required but not configured. Run `seatbelt setup-reset`.");
+  } else {
+    line("warn", "reset", `no clean-test-user reset \u2014 run ${pc.green("seatbelt setup-reset")} to add one`);
+  }
+  line(
+    summary.envFiles.length ? "ok" : "warn",
+    "env",
+    summary.envFiles.length ? summary.envFiles.join(", ") : `no .env files ${pc.dim("(add creds like SEATBELT_TEST_EMAIL)")}`
+  );
+  if (hasChromium) {
+    line("ok", "browser", `Chromium installed \xB7 headed: ${config.browser.headed} \xB7 fresh: ${config.browser.freshSession} \xB7 video: ${config.browser.video} \xB7 trace: ${config.browser.trace}`);
+  } else {
+    line("fail", "browser", `Chromium not installed \u2014 run ${pc.green("npx playwright install chromium")}`);
+    blockers.push("Install the browser: npx playwright install chromium");
+  }
+  line("ok", "report", `formats: ${config.report.formats.join(", ")} \xB7 opens automatically: ${config.report.openOnFinish}`);
+  const envToken = Boolean(process.env.SEATBELT_API_TOKEN || process.env.SEATBELT_API_KEY);
+  const storedAuth = readAuth();
+  if (envToken) {
+    line("ok", "account", `using ${pc.cyan("SEATBELT_API_TOKEN")} from the environment ${pc.dim("(advanced/CI override)")}`);
+  } else if (storedAuth) {
+    line("ok", "account", `logged in${storedAuth.email ? ` as ${storedAuth.email}` : ""}${storedAuth.plan ? pc.dim(` \xB7 ${storedAuth.plan}`) : ""}`);
+  } else {
+    line("warn", "account", `not logged in \u2014 run ${pc.green("seatbelt login")} to unlock hosted AI ${pc.dim("(local QA still works)")}`);
+  }
+  log.blank();
+  if (blockers.length) {
+    log.warn(pc.bold(`${blockers.length} thing${blockers.length > 1 ? "s" : ""} to fix before Seatbelt can run:`));
+    for (const b of blockers) log.plain(`  \u2022 ${b}`);
+  } else if (!resetConfigured) {
+    log.plain(pc.bold("Looks runnable.") + " For repeatable results, add a clean test user:");
+    log.plain(`  \u2022 ${pc.green("seatbelt setup-reset")}, then ${pc.green("seatbelt run")}`);
+  } else {
+    log.success(pc.bold("Everything looks ready. Run ") + pc.green("seatbelt run") + pc.bold("."));
+  }
+  log.blank();
+  return blockers.length ? 1 : 0;
+}
+
+// src/commands/report.ts
+import fs14 from "fs";
+import path22 from "path";
+import open3 from "open";
+function findLatestReport(artifactsDir) {
+  if (!exists(artifactsDir)) return null;
+  let subdirs;
+  try {
+    subdirs = fs14.readdirSync(artifactsDir).filter((d) => {
+      try {
+        return fs14.statSync(path22.join(artifactsDir, d)).isDirectory();
+      } catch {
+        return false;
+      }
+    }).sort().reverse();
+  } catch {
+    return null;
+  }
+  for (const d of subdirs) {
+    const candidate = path22.join(artifactsDir, d, "report.html");
+    if (exists(candidate)) return candidate;
+  }
+  return null;
+}
+async function reportCommand(opts = {}) {
+  const paths = resolvePaths(opts.cwd);
+  const latest = findLatestReport(paths.artifactsDir);
+  if (!latest) {
+    log.blank();
+    log.warn("No Seatbelt report found yet.");
+    log.plain(`Run ${pc.green("seatbelt run")} first \u2014 it captures evidence and writes a report.`);
+    log.blank();
+    return 0;
+  }
+  const rel = displayPath(paths.cwd, latest);
+  if (opts.path) {
+    log.plain(rel);
+    return 0;
+  }
+  log.blank();
+  log.step(`Opening ${pc.cyan(rel)}`);
+  try {
+    await open3(latest);
+  } catch {
+    log.dim("(Could not auto-open \u2014 open the path above in your browser.)");
+  }
+  log.blank();
+  return 0;
+}
+
+// src/commands/account.ts
+import open4 from "open";
+async function statusCommand() {
+  const webUrl = seatbeltWebUrl();
+  const token = seatbeltApiToken();
+  const auth = readAuth();
+  log.blank();
+  log.step("Seatbelt status");
+  if (process.env.SEATBELT_API_TOKEN || process.env.SEATBELT_API_KEY) {
+    log.plain(`  Auth:    environment token ${pc.dim("(advanced/CI override)")}`);
+  } else if (auth) {
+    log.plain(`  Auth:    logged in ${pc.dim(`(stored ${new Date(auth.savedAt).toLocaleDateString()})`)}`);
+  } else {
+    log.plain(`  Auth:    ${pc.yellow("not logged in")}`);
+  }
+  if (!token) {
+    log.blank();
+    log.plain("You're not connected \u2014 local browser QA still works with no account.");
+    log.plain(`  Connect for hosted AI: ${pc.green("seatbelt login")}`);
+    log.blank();
+    return 0;
+  }
+  try {
+    const res = await fetch(`${webUrl}/api/access/me`, {
+      headers: { authorization: `Bearer ${token}` }
+    });
+    const body = await res.json().catch(() => null);
+    if (res.status === 200 && body?.access) {
+      log.plain(`  Account: ${pc.bold(body.access.email ?? "(unknown)")}`);
+      log.plain(
+        `  Plan:    ${body.access.plan ?? "(unknown)"} ${body.access.active ? pc.green("\xB7 active") : pc.yellow("\xB7 inactive")}`
+      );
+      log.plain(`  Backend: ${pc.green("reachable")} ${pc.dim(webUrl)}`);
+    } else if (res.status === 401) {
+      log.plain(`  Account: ${pc.yellow("token not recognized")} \u2014 run ${pc.green("seatbelt login")} again.`);
+    } else if (res.status === 402) {
+      log.plain(`  Account: ${pc.yellow("subscription inactive")} \u2014 reactivate with ${pc.green("seatbelt billing")}.`);
+    } else {
+      log.plain(`  Account: could not verify (status ${res.status}).`);
+    }
+  } catch {
+    log.plain(`  Backend: ${pc.yellow("unreachable")} ${pc.dim(webUrl)} ${pc.dim("\u2014 local QA still works")}`);
+  }
+  log.blank();
+  log.dim("Manage billing: seatbelt billing   \xB7   run quotas are honor-system for now");
+  log.blank();
+  return 0;
+}
+async function billingCommand() {
+  const webUrl = seatbeltWebUrl();
+  const token = seatbeltApiToken();
+  log.blank();
+  if (!token) {
+    log.warn("You're not logged in.");
+    log.plain(`  Run ${pc.green("seatbelt login")} first, then ${pc.green("seatbelt billing")}.`);
+    log.blank();
+    return 0;
+  }
+  log.step("Opening your Stripe billing portal\u2026");
+  let body = null;
+  try {
+    const res = await fetch(`${webUrl}/api/billing/portal`, {
+      method: "POST",
+      headers: { authorization: `Bearer ${token}` }
+    });
+    body = await res.json().catch(() => null);
+    if (!res.ok || !body?.ok || !body?.url) {
+      log.warn(body?.error?.message ?? `Could not open the billing portal (status ${res.status}).`);
+      log.blank();
+      return 1;
+    }
+  } catch (err) {
+    log.warn(`Could not reach ${webUrl}: ${err instanceof Error ? err.message : String(err)}`);
+    log.blank();
+    return 1;
+  }
+  log.plain(`  ${pc.cyan(body.url)}`);
+  try {
+    await open4(body.url);
+  } catch {
+    log.dim("  (Could not auto-open \u2014 open the link above in your browser.)");
+  }
+  log.blank();
+  return 0;
+}
+
+// src/cli.ts
+function headedFrom(opts) {
+  if (opts.headless) return false;
+  if (opts.headed) return true;
+  return void 0;
+}
+function action(fn) {
+  return async (...args) => {
+    try {
+      const code = await fn(...args);
+      process.exitCode = code ?? 0;
+    } catch (err) {
+      printError(err);
+      process.exitCode = 1;
+    }
+  };
+}
+var program = new Command();
+program.name("seatbelt").description("QA for AI-coded apps, before you merge. Watch a real browser check your app.").version(VERSION, "-v, --version", "print the Seatbelt version");
+program.command("init").alias("on").description("set up Seatbelt in this repo (write seatbelt.config.yaml + local .seatbelt state)").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--run", "run Seatbelt immediately after setup, skipping the prompt").option("--no-run", "set up only; do not run or prompt to run").option("--yes", "accept the run + clean-test-user offers without prompting").action(action((opts) => initCommand(opts)));
+program.command("run").argument("[target]", "flow id to run, or 'all' (default: run all flows)").description("detect + start your app, replay your flows in a visible browser, write + open a report").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--headed", "force a visible browser (this is the default)").option("--headless", "run the browser headless (for CI / automated checks)").option("--no-open", "do not auto-open the report when finished").option("--yes", "accept prompts / defaults without asking").action(
+  action(
+    (target, opts) => runCommand({
+      cwd: opts.cwd,
+      target,
+      open: opts.open,
+      yes: opts.yes,
+      headed: headedFrom(opts)
+    })
+  )
+);
+program.command("certify").description("sync + show the QA-certified flow map; with --run, verify every eligible flow in a browser").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--run", "run all eligible flows and certify them").option("--no-run", "only sync + show the flow map (default)").option("--headed", "force a visible browser (this is the default)").option("--headless", "run the browser headless (for CI / automated checks)").option("--no-open", "do not auto-open the report when finished").option("--yes", "accept prompts / defaults without asking").action(
+  action(
+    (opts) => certifyCommand({
+      cwd: opts.cwd,
+      run: opts.run,
+      open: opts.open,
+      yes: opts.yes,
+      headed: headedFrom(opts)
+    })
+  )
+);
+program.command("setup-reset").alias("reset-prompt").description("generate a paste-ready prompt to add a safe clean-test-user reset to your app").option("--cwd <path>", "run as if Seatbelt was started in <path>").action(action((opts) => setupResetCommand(opts)));
+program.command("lint").description("run detected checks (lint / typecheck / build / test) \u2014 fast, local, no browser").option("--cwd <path>", "run as if Seatbelt was started in <path>").action(action((opts) => lintCommand(opts)));
+program.command("doctor").description("plain-language diagnosis of your setup (detection, server, flows, reset, browser)").option("--cwd <path>", "run as if Seatbelt was started in <path>").action(action((opts) => doctorCommand(opts)));
+program.command("report").description("open the latest report without re-running QA").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--path", "print the report path instead of opening it").action(action((opts) => reportCommand(opts)));
+program.command("refresh-flows").description("refresh stale flow YAML; local fallback by default, AI suggestions with --ai").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--local-only", "no backend/AI; only regenerate missing local starter templates").option("--ai", "use AI to propose refreshed YAML for stale flows").option("--flow <id>", "refresh one flow id").option("--apply", "overwrite existing flow YAML (creates a backup first)").option("--dry-run", "inspect and validate suggestions without writing files").option("--provider <provider>", "AI provider (seatbelt or openai)").option("--model <model>", "AI model to use").option("--yes", "accept safe actions without asking").action(
+  action(
+    (opts) => refreshFlowsCommand(opts)
+  )
+);
+program.command("generate-flows").description("inspect this app and generate deterministic Seatbelt flow YAML suggestions").option("--cwd <path>", "run as if Seatbelt was started in <path>").option("--local-only", "no backend/AI; generate cautious local templates and a copy-paste prompt").option("--dry-run", "inspect and validate suggestions without writing files").option("--provider <provider>", "AI provider (seatbelt or openai)").option("--model <model>", "AI model to use").option("--yes", "consent to send the sanitized summary without prompting").action(
+  action(
+    (opts) => generateFlowsCommand(opts)
+  )
+);
+program.command("login").description("connect your Seatbelt account in the browser (stores a token; no manual paste)").option("--token <token>", "advanced: store this token directly instead of the browser flow (CI/scripted)").action(action((opts) => loginCommand({ token: opts.token })));
+program.command("logout").description("remove the stored Seatbelt login token").action(action(() => logoutCommand()));
+program.command("whoami").description("show the currently connected Seatbelt account").action(action(() => whoamiCommand()));
+program.command("status").alias("account").description("show your connection, plan/access, backend reachability, and billing link").action(action(() => statusCommand()));
+program.command("billing").description("open your Stripe billing portal (cancel, update payment, view invoices)").action(action(() => billingCommand()));
+program.parseAsync(process.argv).catch((err) => {
+  printError(err);
+  process.exitCode = 1;
+});