jetic-cli 0.1.8 → 0.2.0

package/dist/index.js

@@ -268088,6 +268088,13 @@ var require_workflow_simulator = __commonJS({
             const colonIdx = expr.indexOf(":");
             const scope = expr.slice(0, colonIdx);
             const key = expr.slice(colonIdx + 1);
+            if (scope === "human") {
+              const envVal = process.env[`JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`];
+              if (envVal !== void 0 && envVal !== "") {
+                replacements.push({ placeholder: match[0], resolved: envVal });
+                continue;
+              }
+            }
             const mem = new memory_1.JeticMemory({ scope });
             const memVal = await mem.get(key);
             replacements.push({ placeholder: match[0], resolved: memVal != null ? String(memVal) : "" });
@@ -268509,7 +268516,7 @@ var require_endpoint_tools = __commonJS({
     "use strict";
     init_cjs_shims();
     Object.defineProperty(exports2, "__esModule", { value: true });
-    exports2.deleteEndpointSchema = exports2.updateEndpointSchema = exports2.addEndpointSchema = void 0;
+    exports2.deleteEndpointSchema = exports2.updateEndpointSchema = exports2.addEndpointSchema = exports2.constraintSchema = void 0;
     exports2.handleAddEndpoint = handleAddEndpoint;
     exports2.handleUpdateEndpoint = handleUpdateEndpoint;
     exports2.handleDeleteEndpoint = handleDeleteEndpoint;
@@ -268517,11 +268524,13 @@ var require_endpoint_tools = __commonJS({
     var crypto_1 = require("crypto");
     var types_1 = require_types();
     var parameterSchema = zod_1.z.object({
-      name: zod_1.z.string().describe("Parameter name"),
+      name: zod_1.z.string().min(1).describe("Parameter name"),
       in: zod_1.z.enum(["query", "path", "header", "cookie", "body"]).optional().describe("Parameter location in HTTP request"),
       type: zod_1.z.string().default("string").describe("Data type (string, number, boolean, array, object)"),
       format: zod_1.z.string().optional().describe("Format specifier (e.g. uuid, email, date-time, int64)"),
       required: zod_1.z.boolean().optional().describe("Whether parameter is required"),
+      min: zod_1.z.number().optional().describe("Minimum numeric value"),
+      max: zod_1.z.number().optional().describe("Maximum numeric value"),
       default: zod_1.z.any().optional().describe("Default value"),
       example: zod_1.z.any().optional().describe("Example value"),
       description: zod_1.z.string().optional().describe("Description")
@@ -268530,46 +268539,115 @@ var require_endpoint_tools = __commonJS({
       type: zod_1.z.string().describe("Data type (string, number, boolean, array, object)"),
       format: zod_1.z.string().optional().describe("Format specifier"),
       required: zod_1.z.boolean().optional().describe("Required flag"),
+      min: zod_1.z.number().optional().describe("Minimum numeric value"),
+      max: zod_1.z.number().optional().describe("Maximum numeric value"),
+      minLength: zod_1.z.number().optional().describe("Minimum string length"),
+      maxLength: zod_1.z.number().optional().describe("Maximum string length"),
       description: zod_1.z.string().optional().describe("Description"),
       example: zod_1.z.any().optional().describe("Example value"),
       default: zod_1.z.any().optional().describe("Default value"),
       enum: zod_1.z.array(zod_1.z.string()).optional().describe("Allowed enum values")
     });
+    exports2.constraintSchema = zod_1.z.object({
+      field: zod_1.z.string().optional().describe("Field this constraint applies to"),
+      rule: zod_1.z.string().optional().describe("Rule name (e.g. minLength, matches, requiredIf)"),
+      value: zod_1.z.any().optional().describe("Rule value / threshold"),
+      conflictStatus: zod_1.z.number().int().optional().describe("HTTP status on conflict"),
+      failureStatus: zod_1.z.number().int().optional().describe("HTTP status on validation failure"),
+      when: zod_1.z.object({
+        field: zod_1.z.string().describe("Condition field"),
+        present: zod_1.z.boolean().optional(),
+        equals: zod_1.z.any().optional()
+      }).optional().describe("Conditional constraint trigger"),
+      then: zod_1.z.object({
+        field: zod_1.z.string().describe("Field to constrain"),
+        type: zod_1.z.string().describe("Expected type when condition holds")
+      }).optional().describe("Conditional constraint effect")
+    });
     var requestBodySchema = zod_1.z.object({
       contentType: zod_1.z.string().nullable().default("application/json").describe("Content-Type header (e.g. application/json, multipart/form-data)"),
       required: zod_1.z.boolean().optional().describe("Whether request body is required"),
-      fields: zod_1.z.record(fieldDefinitionSchema).default({}).describe("Key-value record of payload fields")
+      fields: zod_1.z.record(fieldDefinitionSchema).default({}).describe("Key-value record of payload fields"),
+      constraints: zod_1.z.array(exports2.constraintSchema).optional().describe("Business-rule constraints extracted from handler logic (e.g. password minLength)")
     });
     var responseDefinitionSchema = zod_1.z.object({
       contentType: zod_1.z.string().optional().default("application/json"),
       description: zod_1.z.string().optional().describe("Human readable response description"),
-      schema: zod_1.z.record(zod_1.z.string()).optional().describe("Response body schema description (field -> type)"),
-      example: zod_1.z.any().optional().describe("Response payload example")
+      schema: zod_1.z.record(zod_1.z.string()).optional().describe("Response body schema description (field -> type, dot paths allowed)"),
+      example: zod_1.z.any().optional().describe("Response payload example"),
+      condition: zod_1.z.string().optional().describe("Condition under which this response occurs"),
+      ownershipCheck: zod_1.z.boolean().optional().describe("Whether this response enforces an ownership check")
     });
     var endpointSecuritySchema = zod_1.z.object({
-      scheme: zod_1.z.string().describe("Name of security scheme (e.g. bearerAuth, apiKey)"),
+      scheme: zod_1.z.string().describe("Name of security scheme declared in top-level securitySchemes (e.g. bearerAuth, apiKey)"),
       required: zod_1.z.boolean().optional().default(true),
-      scopes: zod_1.z.array(zod_1.z.string()).optional()
+      scopes: zod_1.z.array(zod_1.z.string()).optional().describe("OAuth2 scopes (only for oauth2 schemes)")
     });
     var sourceReferenceSchema = zod_1.z.object({
       file: zod_1.z.string().describe("Relative or absolute path to source file containing handler/route"),
       line: zod_1.z.number().describe("Line number in source file"),
       column: zod_1.z.number().optional()
     });
+    var middlewareSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe('Middleware name as in code (e.g. "auth", "cors", "express.json", "rateLimit")'),
+      type: zod_1.z.string().optional().describe('Middleware category (e.g. "auth", "parser", "cors", "rate-limit", "validation", "logging")'),
+      scheme: zod_1.z.string().optional().describe("Security scheme this middleware enforces (e.g. bearerAuth)"),
+      config: zod_1.z.record(zod_1.z.any()).optional().describe('Middleware options (e.g. { "max": 100, "windowMs": 60000 })'),
+      source: sourceReferenceSchema.optional().describe("Where the middleware is applied in source")
+    });
+    var paginationSchema = zod_1.z.object({
+      type: zod_1.z.enum(["offset", "cursor", "page"]).describe("Pagination strategy"),
+      pageParam: zod_1.z.string().optional().describe('Query param for page number/offset (e.g. "page")'),
+      limitParam: zod_1.z.string().optional().describe('Query param for page size (e.g. "limit")'),
+      cursorParam: zod_1.z.string().optional().describe("Query param for cursor (cursor strategy)"),
+      totalPath: zod_1.z.string().optional().describe('Response path to total count (e.g. "meta.total")')
+    });
+    var rateLimitSchema = zod_1.z.object({
+      windowMs: zod_1.z.number().int().positive().describe("Rate-limit window in milliseconds"),
+      max: zod_1.z.number().int().positive().describe("Max requests per window"),
+      scope: zod_1.z.string().optional().describe('Limit scope (e.g. "ip", "user", "global")')
+    });
+    var ownershipSchema = zod_1.z.object({
+      ownerField: zod_1.z.string().describe('Resource field holding the owner id (e.g. "userId")'),
+      mustMatchAuthClaim: zod_1.z.string().describe('Auth claim it must equal (e.g. "sub")')
+    });
+    var producesSchema = zod_1.z.object({
+      variable: zod_1.z.string().optional().describe('Memory variable name produced (e.g. "accessToken")'),
+      responseField: zod_1.z.string().optional().describe('Response path the value comes from (e.g. "data.accessToken")'),
+      resourceStateChange: zod_1.z.object({
+        resource: zod_1.z.string(),
+        field: zod_1.z.string(),
+        setFrom: zod_1.z.string()
+      }).optional().describe("Resource state mutation caused by this endpoint")
+    });
+    var consumesSchema = zod_1.z.object({
+      variable: zod_1.z.string().describe('Memory variable consumed (e.g. "accessToken")'),
+      usedAs: zod_1.z.string().describe('How it is used: "header:<Name>" (Bearer prefix auto-added for Authorization) or "body:<field>" / "query:<param>"'),
+      producedBy: zod_1.z.string().optional().describe('"METHOD /path" of the endpoint that produces it')
+    });
     exports2.addEndpointSchema = zod_1.z.object({
       projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
       path: zod_1.z.string().describe("Route path (e.g., /api/v1/users or /api/users/:id)"),
       name: zod_1.z.string().optional().describe('Human-readable endpoint name (e.g., "Create User")'),
+      summary: zod_1.z.string().optional().describe("Short one-line summary"),
       description: zod_1.z.string().optional().describe("Detailed description of endpoint functionality"),
       tags: zod_1.z.array(zod_1.z.string()).optional().describe('Category tags (e.g., ["users", "auth"])'),
+      deprecated: zod_1.z.boolean().optional().describe("Mark endpoint as deprecated"),
+      timeout: zod_1.z.number().int().positive().optional().describe("Request timeout in milliseconds"),
       handlerName: zod_1.z.string().optional().describe("Handler / controller function name (e.g. UserController.create)"),
       resource: zod_1.z.string().optional().describe("Associated domain resource (e.g. User, Order)"),
       source: sourceReferenceSchema.optional().describe("Source code provenance location"),
-      security: zod_1.z.array(endpointSecuritySchema).optional().describe("Security requirements"),
+      security: zod_1.z.array(endpointSecuritySchema).optional().describe("Security requirements (schemes must exist in top-level securitySchemes)"),
+      middleware: zod_1.z.array(middlewareSchema).optional().describe("Middleware chain IN EXECUTION ORDER (e.g. cors \u2192 json parser \u2192 auth \u2192 rateLimit \u2192 validator)"),
       parameters: zod_1.z.array(parameterSchema).optional().describe("Query, path, header, or cookie parameters"),
-      requestBody: requestBodySchema.optional().describe("Request body specification"),
+      requestBody: requestBodySchema.optional().describe("Request body specification incl. business-rule constraints"),
       responses: zod_1.z.record(responseDefinitionSchema).optional().describe('Response definitions keyed by status code (e.g. "200", "400")'),
+      pagination: paginationSchema.optional().describe("Pagination config for list endpoints"),
+      rateLimit: rateLimitSchema.optional().describe("Rate-limit config"),
+      ownership: ownershipSchema.optional().describe("Ownership / authorization rule"),
+      produces: zod_1.z.array(producesSchema).optional().describe("Memory variables produced from responses (feeds workflows)"),
+      consumes: zod_1.z.array(consumesSchema).optional().describe("Memory variables consumed as headers/body (chained auth)"),
       overwriteIfExists: zod_1.z.boolean().optional().default(true).describe("If endpoint with same method and path exists, update it instead of erroring")
     });
     function handleAddEndpoint(args) {
@@ -268581,6 +268659,11 @@ var require_endpoint_tools = __commonJS({
       if (existingIndex >= 0 && !overwriteIfExists) {
         throw new Error(`Endpoint ${methodUpper} ${normalizedPath} already exists in ${filePath}. Set overwriteIfExists: true to update it.`);
       }
+      for (const mw of args.middleware || []) {
+        if (!mw.name || !mw.name.trim()) {
+          throw new Error('Middleware entries must have a non-empty "name".');
+        }
+      }
       const source = args.source || {
         file: "manual-mcp",
         line: 1
@@ -268599,21 +268682,31 @@ var require_endpoint_tools = __commonJS({
           description: "Internal server error"
         }
       };
+      const previous = existingIndex >= 0 ? model.endpoints[existingIndex] : void 0;
       const newEndpoint = {
-        id: existingIndex >= 0 ? model.endpoints[existingIndex].id : (0, crypto_1.randomUUID)(),
+        id: previous?.id || (0, crypto_1.randomUUID)(),
         method: methodUpper,
         path: normalizedPath,
         name: args.name || `${methodUpper} ${normalizedPath}`,
+        summary: args.summary,
         description: args.description,
         tags: args.tags || [],
+        deprecated: args.deprecated,
+        timeout: args.timeout,
         handlerName: args.handlerName,
         resource: args.resource,
         source,
         security: args.security,
+        // Explicit middleware wins; otherwise preserve the previous chain (never silently drop it).
+        middleware: args.middleware || previous?.middleware || [],
         parameters: args.parameters,
         requestBody: args.requestBody,
         responses,
-        middleware: existingIndex >= 0 ? model.endpoints[existingIndex].middleware : []
+        pagination: args.pagination,
+        rateLimit: args.rateLimit || previous?.rateLimit,
+        ownership: args.ownership,
+        produces: args.produces,
+        consumes: args.consumes
       };
       if (existingIndex >= 0) {
         model.endpoints[existingIndex] = newEndpoint;
@@ -268621,31 +268714,45 @@ var require_endpoint_tools = __commonJS({
         model.endpoints.push(newEndpoint);
       }
       (0, types_1.saveModel)(filePath, model);
+      const unknownSchemes = (args.security || []).map((s) => s.scheme).filter((scheme) => model.securitySchemes && !(scheme in (model.securitySchemes || {})));
       return {
         success: true,
         action: existingIndex >= 0 ? "updated" : "added",
         filePath,
         endpointId: newEndpoint.id,
+        ...unknownSchemes.length > 0 ? {
+          warning: `Security scheme(s) not declared in top-level securitySchemes: ${unknownSchemes.join(", ")}. Declare them or run jetic_verify_model for details.`
+        } : {},
         endpoint: newEndpoint
       };
     }
+    var endpointUpdatesSchema = zod_1.z.object({
+      name: zod_1.z.string().optional(),
+      summary: zod_1.z.string().optional(),
+      description: zod_1.z.string().optional(),
+      tags: zod_1.z.array(zod_1.z.string()).optional(),
+      deprecated: zod_1.z.boolean().optional(),
+      timeout: zod_1.z.number().int().positive().optional(),
+      handlerName: zod_1.z.string().optional(),
+      resource: zod_1.z.string().optional(),
+      source: sourceReferenceSchema.optional(),
+      security: zod_1.z.array(endpointSecuritySchema).optional(),
+      middleware: zod_1.z.array(middlewareSchema).optional().describe("Replaces the whole middleware chain (order = execution order)"),
+      parameters: zod_1.z.array(parameterSchema).optional(),
+      requestBody: requestBodySchema.optional(),
+      responses: zod_1.z.record(responseDefinitionSchema).optional(),
+      pagination: paginationSchema.optional(),
+      rateLimit: rateLimitSchema.nullable().optional().describe("Set to null to remove rate limiting"),
+      ownership: ownershipSchema.optional(),
+      produces: zod_1.z.array(producesSchema).optional(),
+      consumes: zod_1.z.array(consumesSchema).optional()
+    });
     exports2.updateEndpointSchema = zod_1.z.object({
       projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
       id: zod_1.z.string().optional().describe("Target endpoint UUID"),
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).optional().describe("HTTP method"),
       path: zod_1.z.string().optional().describe("Route path"),
-      updates: zod_1.z.object({
-        name: zod_1.z.string().optional(),
-        description: zod_1.z.string().optional(),
-        tags: zod_1.z.array(zod_1.z.string()).optional(),
-        handlerName: zod_1.z.string().optional(),
-        resource: zod_1.z.string().optional(),
-        source: sourceReferenceSchema.optional(),
-        security: zod_1.z.array(endpointSecuritySchema).optional(),
-        parameters: zod_1.z.array(parameterSchema).optional(),
-        requestBody: requestBodySchema.optional(),
-        responses: zod_1.z.record(responseDefinitionSchema).optional()
-      }).describe("Partial endpoint properties to update")
+      updates: endpointUpdatesSchema.describe("Partial endpoint properties to update (middleware replaces the whole chain)")
     });
     function handleUpdateEndpoint(args) {
       const { model, filePath } = (0, types_1.loadModel)(args.projectPath);
@@ -268666,10 +268773,16 @@ var require_endpoint_tools = __commonJS({
       const { updates } = args;
       if (updates.name !== void 0)
         endpoint.name = updates.name;
+      if (updates.summary !== void 0)
+        endpoint.summary = updates.summary;
       if (updates.description !== void 0)
         endpoint.description = updates.description;
       if (updates.tags !== void 0)
         endpoint.tags = updates.tags;
+      if (updates.deprecated !== void 0)
+        endpoint.deprecated = updates.deprecated;
+      if (updates.timeout !== void 0)
+        endpoint.timeout = updates.timeout;
       if (updates.handlerName !== void 0)
         endpoint.handlerName = updates.handlerName;
       if (updates.resource !== void 0)
@@ -268678,12 +268791,29 @@ var require_endpoint_tools = __commonJS({
         endpoint.source = updates.source;
       if (updates.security !== void 0)
         endpoint.security = updates.security;
+      if (updates.middleware !== void 0) {
+        for (const mw of updates.middleware) {
+          if (!mw.name || !mw.name.trim())
+            throw new Error('Middleware entries must have a non-empty "name".');
+        }
+        endpoint.middleware = updates.middleware;
+      }
       if (updates.parameters !== void 0)
         endpoint.parameters = updates.parameters;
       if (updates.requestBody !== void 0)
         endpoint.requestBody = updates.requestBody;
       if (updates.responses !== void 0)
         endpoint.responses = updates.responses;
+      if (updates.pagination !== void 0)
+        endpoint.pagination = updates.pagination;
+      if (updates.rateLimit !== void 0)
+        endpoint.rateLimit = updates.rateLimit;
+      if (updates.ownership !== void 0)
+        endpoint.ownership = updates.ownership;
+      if (updates.produces !== void 0)
+        endpoint.produces = updates.produces;
+      if (updates.consumes !== void 0)
+        endpoint.consumes = updates.consumes;
       (0, types_1.saveModel)(filePath, model);
       return {
         success: true,
@@ -269294,6 +269424,806 @@ var require_workflow_tools = __commonJS({
   }
 });
 
+// ../../packages/mcp-server/dist/tools/workflow-authoring-tools.js
+var require_workflow_authoring_tools = __commonJS({
+  "../../packages/mcp-server/dist/tools/workflow-authoring-tools.js"(exports2) {
+    "use strict";
+    init_cjs_shims();
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.deleteWorkflowSchema = exports2.updateWorkflowSchema = exports2.createWorkflowSchema = exports2.validateWorkflowSchema = exports2.workflowStepSchema = void 0;
+    exports2.validateWorkflowDefinition = validateWorkflowDefinition;
+    exports2.slugifyWorkflowName = slugifyWorkflowName;
+    exports2.handleValidateWorkflow = handleValidateWorkflow;
+    exports2.handleCreateWorkflow = handleCreateWorkflow;
+    exports2.handleUpdateWorkflow = handleUpdateWorkflow;
+    exports2.handleDeleteWorkflow = handleDeleteWorkflow;
+    var zod_1 = require("zod");
+    var fs4 = __importStar(require("fs"));
+    var path7 = __importStar(require("path"));
+    var types_1 = require_types();
+    var workflow_tools_1 = require_workflow_tools();
+    exports2.workflowStepSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe("Step name (must be unique within the workflow)"),
+      method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
+      path: zod_1.z.string().min(1).describe("Route path; :params resolve from body/memory (NOT from {{templates}} \u2014 those only work in body/inject)"),
+      description: zod_1.z.string().optional().describe("What this step does"),
+      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}}, {{workflow:key}} and {{human:key}} templates (human pauses for interactive input at runtime)"),
+      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Memory/header injection: "header:Name" or "body:field" (or bare header name) -> "scope:key" or "{{template}}" ({{human:key}} supported)'),
+      capture: zod_1.z.record(zod_1.z.string()).optional().describe('Save RESPONSE fields to memory: "scope:key" -> "dot.path.in.response"'),
+      captureInput: zod_1.z.record(zod_1.z.string()).optional().describe('Save REQUEST body fields to memory BEFORE sending: "scope:key" -> "bodyField"'),
+      expectStatus: zod_1.z.number().int().positive().optional().describe("Expected HTTP status (default 200; any 2xx passes when expecting 2xx)")
+      // NOTE: .passthrough() is intentional — unknown keys must REACH the validator
+      // (MODEL_DIALECT_KEY / UNKNOWN_STEP_KEY diagnostics). Zod's default strip
+      // behavior would silently swallow the exact mistakes we need to report.
+    }).passthrough();
+    var inlineWorkflowSchema = zod_1.z.object({
+      name: zod_1.z.string().min(1).describe("Workflow name (also used to derive the file slug)"),
+      description: zod_1.z.string().optional(),
+      environment: zod_1.z.string().optional().describe("Target environment name from the model (e.g. local)"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).describe("Ordered steps; later steps can use memory captured by earlier ones")
+    }).passthrough();
+    var TEMPLATE_RE = /\{\{\s*([^}]+?)\s*\}\}/g;
+    var KNOWN_WORKFLOW_KEYS = /* @__PURE__ */ new Set(["name", "description", "environment", "steps", "generatedAt"]);
+    var KNOWN_STEP_KEYS = /* @__PURE__ */ new Set([
+      "name",
+      "method",
+      "path",
+      "description",
+      "inject",
+      "capture",
+      "captureInput",
+      "expectStatus",
+      "body",
+      "condition"
+    ]);
+    var MODEL_DIALECT_KEYS = /* @__PURE__ */ new Set(["call", "auth", "bind"]);
+    function err(list, stepIndex, stepName, code, message, fix) {
+      list.push({ severity: "error", stepIndex, stepName, code, message, fix });
+    }
+    function warn(list, stepIndex, stepName, code, message, fix) {
+      list.push({ severity: "warning", stepIndex, stepName, code, message, fix });
+    }
+    function splitMemKey(raw) {
+      const idx = raw.indexOf(":");
+      if (idx <= 0)
+        return { scope: "workflow", key: raw };
+      return { scope: raw.slice(0, idx), key: raw.slice(idx + 1) };
+    }
+    function readMemoryKeys(projectRoot) {
+      const keys = /* @__PURE__ */ new Set();
+      try {
+        const memPath = path7.join(projectRoot, ".jetic", "memory.json");
+        if (!fs4.existsSync(memPath))
+          return keys;
+        const data = JSON.parse(fs4.readFileSync(memPath, "utf-8"));
+        for (const [scope, entries] of Object.entries(data || {})) {
+          if (!entries || typeof entries !== "object")
+            continue;
+          for (const key of Object.keys(entries))
+            keys.add(`${scope}:${key}`);
+        }
+      } catch {
+      }
+      return keys;
+    }
+    function collectTemplateRefs(value, out) {
+      if (typeof value === "string") {
+        TEMPLATE_RE.lastIndex = 0;
+        let m;
+        while ((m = TEMPLATE_RE.exec(value)) !== null)
+          out.push(m[1].trim());
+      } else if (Array.isArray(value)) {
+        for (const v of value)
+          collectTemplateRefs(v, out);
+      } else if (value && typeof value === "object") {
+        for (const v of Object.values(value))
+          collectTemplateRefs(v, out);
+      }
+    }
+    function suggestEndpoints(model, method, wfPath) {
+      const samePath = model.filter((e) => e.path === wfPath).map((e) => `${e.method} ${e.path}`);
+      if (samePath.length > 0)
+        return samePath.slice(0, 3);
+      const prefix = wfPath.split("/").slice(0, 3).join("/");
+      return model.filter((e) => e.path.startsWith(prefix)).map((e) => `${e.method} ${e.path}`).slice(0, 3);
+    }
+    function validateWorkflowDefinition(wf, opts) {
+      const errors = [];
+      const warnings = [];
+      const { model } = (0, types_1.loadModel)(opts?.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)((0, types_1.resolveModelPath)(opts?.projectPath));
+      const persistedMemory = readMemoryKeys(projectRoot);
+      if (!wf || typeof wf !== "object") {
+        err(errors, void 0, void 0, "NOT_AN_OBJECT", "Workflow must be an object with name + steps.", "Pass { name, steps: [...] }.");
+        return toReport(errors, warnings);
+      }
+      if (!wf.name || typeof wf.name !== "string" || !wf.name.trim()) {
+        err(errors, void 0, void 0, "MISSING_NAME", 'Workflow needs a non-empty "name".', 'Set a descriptive name like "User onboarding".');
+      }
+      if (!Array.isArray(wf.steps) || wf.steps.length === 0) {
+        err(errors, void 0, void 0, "NO_STEPS", "Workflow needs at least one step.", "Add steps with { name, method, path }.");
+        return toReport(errors, warnings);
+      }
+      if (wf.environment && !(model.environments || []).some((e) => e.name === wf.environment)) {
+        warn(warnings, void 0, void 0, "UNKNOWN_ENVIRONMENT", `Environment "${wf.environment}" is not declared in model.json.`, `Use one of: ${(model.environments || []).map((e) => e.name).join(", ") || "(none declared)"}, or add it with jetic_manage_environment.`);
+      }
+      for (const key of Object.keys(wf)) {
+        if (!KNOWN_WORKFLOW_KEYS.has(key)) {
+          warn(warnings, void 0, void 0, "UNKNOWN_WORKFLOW_KEY", `Top-level key "${key}" is not part of the file-workflow format and will be ignored.`, "Valid keys: name, description, environment, steps.");
+        }
+      }
+      const seenNames = /* @__PURE__ */ new Set();
+      const defined = /* @__PURE__ */ new Set();
+      const humanKeys = /* @__PURE__ */ new Set();
+      wf.steps.forEach((rawStep, i) => {
+        const stepNo = i + 1;
+        const sName = typeof rawStep?.name === "string" ? rawStep.name : void 0;
+        if (!rawStep || typeof rawStep !== "object" || Array.isArray(rawStep)) {
+          err(errors, stepNo, void 0, "STEP_NOT_AN_OBJECT", `Step ${stepNo} must be an object.`, "Use { name, method, path, ... }.");
+          return;
+        }
+        const step = rawStep;
+        for (const key of Object.keys(step)) {
+          if (MODEL_DIALECT_KEYS.has(key)) {
+            err(errors, stepNo, sName, "MODEL_DIALECT_KEY", `Step ${stepNo} uses "${key}" from the model-embedded workflow dialect, which file workflows ignore.`, 'File-workflow equivalent: split "call" into method+path; replace auth/bind with inject/capture.');
+          } else if (!KNOWN_STEP_KEYS.has(key)) {
+            warn(warnings, stepNo, sName, "UNKNOWN_STEP_KEY", `Step ${stepNo} has unknown key "${key}" which the simulator ignores.`, "Remove it or check the field name (valid: name, method, path, description, body, inject, capture, captureInput, expectStatus).");
+          }
+        }
+        if ("condition" in step) {
+          warn(warnings, stepNo, sName, "CONDITION_IGNORED", `"condition" is accepted but currently ignored by the simulator \u2014 the step always runs.`, "Encode branching as separate workflows, or gate with expectStatus per step.");
+        }
+        if (!sName || !sName.trim()) {
+          err(errors, stepNo, void 0, "STEP_MISSING_NAME", `Step ${stepNo} needs a non-empty "name".`, "Give every step a unique descriptive name.");
+        } else if (seenNames.has(sName)) {
+          warn(warnings, stepNo, sName, "DUPLICATE_STEP_NAME", `Duplicate step name "${sName}".`, "Rename steps so logs stay readable.");
+        } else {
+          seenNames.add(sName);
+        }
+        const method = typeof step.method === "string" ? step.method.toUpperCase() : void 0;
+        const validMethods = ["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"];
+        if (!method || !validMethods.includes(method)) {
+          err(errors, stepNo, sName, "BAD_METHOD", `Step ${stepNo} has invalid method ${JSON.stringify(step.method)}.`, `Use one of: ${validMethods.join(", ")}.`);
+          return;
+        }
+        if (typeof step.path !== "string" || !step.path.trim()) {
+          err(errors, stepNo, sName, "BAD_PATH", `Step ${stepNo} needs a "path" string.`, 'Use the route path, e.g. "/api/users/:id".');
+          return;
+        }
+        const wfPath = step.path.startsWith("/") ? step.path : `/${step.path}`;
+        const endpoint = (model.endpoints || []).find((e) => e.method.toUpperCase() === method && e.path === wfPath);
+        if (!endpoint) {
+          const suggestions = suggestEndpoints(model.endpoints || [], method, wfPath);
+          const msg = `Step ${stepNo} (${method} ${wfPath}) matches no endpoint in model.json.` + (suggestions.length > 0 ? ` Did you mean: ${suggestions.join(" | ")}?` : "");
+          if (opts?.allowUnknownEndpoints) {
+            warn(warnings, stepNo, sName, "UNKNOWN_ENDPOINT", msg, "Add the endpoint with jetic_add_endpoint so future runs stay verifiable.");
+          } else {
+            err(errors, stepNo, sName, "UNKNOWN_ENDPOINT", msg, "Add it with jetic_add_endpoint, fix the method/path, or re-run with allowUnknownEndpoints.");
+          }
+        } else if (step.expectStatus !== void 0) {
+          const codes = Object.keys(endpoint.responses || {});
+          const exp = Number(step.expectStatus);
+          const in2xx = exp >= 200 && exp < 300;
+          const modelHas2xx = codes.some((c3) => Number(c3) >= 200 && Number(c3) < 300);
+          if (!codes.includes(String(exp)) && !(in2xx && modelHas2xx)) {
+            warn(warnings, stepNo, sName, "UNEXPECTED_STATUS", `Step ${stepNo} expects ${exp} but the model declares [${codes.join(", ") || "none"}] for ${method} ${wfPath}.`, "Align expectStatus with the model, or update the endpoint responses.");
+          }
+        }
+        if (step.body !== void 0 && (typeof step.body !== "object" || step.body === null || Array.isArray(step.body))) {
+          err(errors, stepNo, sName, "BAD_BODY", `Step ${stepNo} "body" must be an object of field -> value.`, 'Use { "email": "{{faker.internet.email}}" }.');
+        }
+        if ((method === "GET" || method === "HEAD") && step.body && Object.keys(step.body).length > 0) {
+          warn(warnings, stepNo, sName, "GET_WITH_BODY", `Step ${stepNo} is ${method} with a body \u2014 it will be sent as URL query params, not a JSON body.`, "This is usually what you want for filters; otherwise switch to POST.");
+        }
+        if (endpoint?.requestBody?.fields && step.body && typeof step.body === "object") {
+          for (const field of Object.keys(step.body)) {
+            if (!(field in endpoint.requestBody.fields)) {
+              warn(warnings, stepNo, sName, "UNKNOWN_BODY_FIELD", `Step ${stepNo} sends body field "${field}" not declared on ${method} ${wfPath}.`, "Check the spelling, or extend the endpoint with jetic_update_endpoint.");
+            }
+          }
+        }
+        const pathParams = wfPath.match(/:([a-zA-Z_][a-zA-Z0-9_]*)/g) || [];
+        for (const p of pathParams) {
+          const pname = p.substring(1);
+          const inBody = step.body && typeof step.body === "object" && pname in step.body;
+          const inMemory = [...defined].some((d) => d.split(":")[1] === pname) || [...persistedMemory].some((d) => d.split(":")[1] === pname);
+          if (!inBody && !inMemory) {
+            err(errors, stepNo, sName, "UNRESOLVED_PATH_PARAM", `Path param ":${pname}" in step ${stepNo} has no body field or memory source \u2014 the URL will literally contain ":${pname}" and fail.`, `Add "${pname}" to this step's body, or capture it as memory in an earlier step (capture: { "workflow:${pname}": "data.${pname}" }).`);
+          }
+        }
+        if (/\{\{[^}]+\}\}/.test(wfPath)) {
+          warn(warnings, stepNo, sName, "PATH_TEMPLATE", `Step ${stepNo} path contains a {{template}} \u2014 paths only resolve :params, templates work in body/inject.`, 'Use "/api/users/:id" with an "id" body field or captured memory key.');
+        }
+        const refs = [];
+        collectTemplateRefs(step.body, refs);
+        if (step.inject && typeof step.inject === "object") {
+          for (const v of Object.values(step.inject))
+            collectTemplateRefs(v, refs);
+        }
+        for (const ref of refs) {
+          if (ref.startsWith("faker.")) {
+            if (ref.split(".").length < 3) {
+              warn(warnings, stepNo, sName, "SUSPICIOUS_FAKER", `"{{${ref}}}" looks like an incomplete faker path.`, "Use full paths like {{faker.internet.email}} or {{faker.string.uuid}}.");
+            }
+            continue;
+          }
+          if (!ref.includes(":")) {
+            err(errors, stepNo, sName, "BAD_TEMPLATE", `"{{${ref}}}" in step ${stepNo} needs a scope ("{{workflow:key}}", "{{scope:key}}") or faker ("{{faker.x.y}}").`, "Bare {{key}} is left literal \u2014 add the scope prefix.");
+            continue;
+          }
+          const { scope, key } = splitMemKey(ref);
+          if (!key) {
+            err(errors, stepNo, sName, "BAD_TEMPLATE", `"{{${ref}}}" has an empty key.`, "Use {{scope:key}} with a real key.");
+            continue;
+          }
+          if (scope === "human") {
+            if (key)
+              humanKeys.add(key);
+            continue;
+          }
+          const full = `${scope}:${key}`;
+          if (!defined.has(full) && !persistedMemory.has(full)) {
+            err(errors, stepNo, sName, "UNDEFINED_MEMORY_REF", `"{{${ref}}}" in step ${stepNo} is never captured by an earlier step and is not in memory.json \u2014 it resolves to "".`, `Capture "${full}" in an earlier step (capture/captureInput), or seed it first.`);
+          } else if (!defined.has(full)) {
+            warn(warnings, stepNo, sName, "MEMORY_FILE_DEPENDENT", `"{{${ref}}}" in step ${stepNo} only exists in the current memory.json, not from an earlier step \u2014 reruns after memory clear will break.`, `Capture "${full}" inside this workflow instead.`);
+          }
+        }
+        if (step.inject !== void 0) {
+          if (typeof step.inject !== "object" || step.inject === null || Array.isArray(step.inject)) {
+            err(errors, stepNo, sName, "BAD_INJECT", `Step ${stepNo} "inject" must be an object.`, 'Use { "header:Authorization": "Bearer {{workflow:accessToken}}" }.');
+          } else {
+            for (const [target, memRef] of Object.entries(step.inject)) {
+              if (!target.trim() || typeof memRef !== "string" || !memRef.trim()) {
+                err(errors, stepNo, sName, "BAD_INJECT", `Step ${stepNo} has an empty inject target or value.`, 'Use "header:Name"/"body:field" -> "scope:key".');
+              }
+            }
+          }
+        }
+        for (const field of ["capture", "captureInput"]) {
+          const cap = step[field];
+          if (cap === void 0)
+            continue;
+          if (typeof cap !== "object" || cap === null || Array.isArray(cap)) {
+            err(errors, stepNo, sName, "BAD_CAPTURE", `Step ${stepNo} "${field}" must be an object.`, `Use { "workflow:myVar": "${field === "capture" ? "data.id" : "bodyField"}" }.`);
+            continue;
+          }
+          for (const [memKey, srcPath] of Object.entries(cap)) {
+            if (!memKey.trim() || typeof srcPath !== "string" || !srcPath.trim()) {
+              err(errors, stepNo, sName, "BAD_CAPTURE", `Step ${stepNo} "${field}" has an empty key or path.`, 'Use { "workflow:myVar": "data.id" }.');
+              continue;
+            }
+            if (field === "captureInput" && (!step.body || typeof step.body !== "object" || !(srcPath in step.body))) {
+              warn(warnings, stepNo, sName, "CAPTURE_INPUT_MISSING_FIELD", `captureInput "${memKey}" reads body field "${srcPath}" which step ${stepNo} does not send.`, 'Add the field to body, or capture from the response with "capture" instead.');
+            }
+          }
+        }
+        for (const field of ["capture", "captureInput"]) {
+          const cap = step[field];
+          if (cap && typeof cap === "object" && !Array.isArray(cap)) {
+            for (const memKey of Object.keys(cap)) {
+              const { scope, key } = splitMemKey(memKey);
+              if (key)
+                defined.add(`${scope}:${key}`);
+            }
+          }
+        }
+      });
+      return toReport(errors, warnings, humanKeys);
+    }
+    function toReport(errors, warnings, humanKeys) {
+      return {
+        valid: errors.length === 0,
+        errorsCount: errors.length,
+        warningsCount: warnings.length,
+        errors,
+        warnings,
+        humanKeys: [...humanKeys || []].sort()
+      };
+    }
+    function slugifyWorkflowName(name) {
+      const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 80);
+      return slug || "workflow";
+    }
+    function workflowsDir(projectPath) {
+      return path7.join(path7.dirname((0, types_1.resolveModelPath)(projectPath)), "workflows");
+    }
+    function workflowFilePath(projectPath, slug) {
+      return path7.join(workflowsDir(projectPath), `${slug}.json`);
+    }
+    function resolveFileWorkflow(projectPath, ref) {
+      const listing = (0, workflow_tools_1.handleListWorkflows)({ projectPath });
+      const search = ref.toLowerCase();
+      const item = listing.workflows.find((w) => w.id.toLowerCase() === search || w.name.toLowerCase() === search || w.filePath && path7.resolve(w.filePath).toLowerCase() === path7.resolve(ref).toLowerCase());
+      if (!item) {
+        throw new Error(`Workflow "${ref}" not found. Available: ${listing.workflows.map((w) => w.id).join(", ") || "(none)"}.`);
+      }
+      if (item.source === "model_json" || !item.filePath) {
+        throw new Error(`Workflow "${ref}" lives inside model.json, which this tool cannot edit. Migrate it with jetic_create_workflow { fromModelWorkflow: "${item.name}" } first.`);
+      }
+      let def;
+      try {
+        def = JSON.parse(fs4.readFileSync(item.filePath, "utf-8"));
+      } catch (e) {
+        throw new Error(`Cannot read workflow file at ${item.filePath}: ${e?.message || e}`);
+      }
+      return { slug: item.id, filePath: item.filePath, def };
+    }
+    function migrateModelWorkflow(modelWorkflow) {
+      const notes = [];
+      const steps = (modelWorkflow.steps || []).map((s, i) => {
+        let method = "GET";
+        let reqPath = "/";
+        if (typeof s.call === "string" && s.call.includes(" ")) {
+          const parts = s.call.split(" ");
+          method = parts[0].toUpperCase();
+          reqPath = parts.slice(1).join(" ");
+        } else if (typeof s.call === "string") {
+          reqPath = s.call;
+        }
+        if (s.auth)
+          notes.push(`Step ${i + 1}: model "auth: ${s.auth}" has no file equivalent \u2014 express it with inject (header:Authorization).`);
+        if (s.bind)
+          notes.push(`Step ${i + 1}: model "bind" has no file equivalent \u2014 express it with capture/captureInput.`);
+        return {
+          name: s.description || `${method} ${reqPath}`,
+          method,
+          path: reqPath,
+          description: s.description,
+          body: s.body,
+          expectStatus: s.expectStatus
+        };
+      });
+      return { def: { name: modelWorkflow.name, description: modelWorkflow.description, steps }, notes };
+    }
+    function writeWorkflowFile(filePath, def) {
+      fs4.mkdirSync(path7.dirname(filePath), { recursive: true });
+      const payload = { ...def, generatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+      const tmp = `${filePath}.tmp`;
+      fs4.writeFileSync(tmp, JSON.stringify(payload, null, 2), "utf-8");
+      fs4.renameSync(tmp, filePath);
+    }
+    exports2.validateWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().optional().describe('Workflow slug, name, or file path to validate (omit when passing inline "definition")'),
+      definition: inlineWorkflowSchema.optional().describe("Inline workflow to dry-run validate WITHOUT saving (for pre-save checks)"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false).describe("Downgrade unknown-endpoint errors to warnings (endpoint exists on server but not in model yet)")
+    });
+    function handleValidateWorkflow(args) {
+      if (!args.workflow && !args.definition) {
+        throw new Error('Provide either "workflow" (slug/name/file) or an inline "definition" to validate.');
+      }
+      let def;
+      let filePath;
+      if (args.definition) {
+        def = args.definition;
+      } else {
+        const resolved = resolveFileWorkflow(args.projectPath, args.workflow);
+        def = resolved.def;
+        filePath = resolved.filePath;
+      }
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      return { ...filePath ? { filePath } : { saved: false }, ...report };
+    }
+    exports2.createWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      name: zod_1.z.string().min(1).optional().describe("Workflow name (required unless fromModelWorkflow is used)"),
+      slug: zod_1.z.string().optional().describe('File slug override (default: derived from name, e.g. "User Onboarding" -> "user-onboarding")'),
+      description: zod_1.z.string().optional(),
+      environment: zod_1.z.string().optional().describe("Target environment name from the model (e.g. local)"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).optional().describe("Ordered steps (required unless fromModelWorkflow is used)"),
+      fromModelWorkflow: zod_1.z.string().optional().describe("Migrate an embedded model.json workflow by name instead of authoring steps manually"),
+      overwrite: zod_1.z.boolean().optional().default(false).describe("Overwrite the file if the slug already exists (default false \u2014 safe creation)"),
+      validateOnly: zod_1.z.boolean().optional().default(false).describe("Only validate, do not write any file (dry run)"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false).describe("Save even when steps reference endpoints missing from model.json (recorded as warnings)")
+    });
+    function handleCreateWorkflow(args) {
+      let def;
+      const migrationNotes = [];
+      if (args.fromModelWorkflow) {
+        const { model } = (0, types_1.loadModel)(args.projectPath);
+        const raw = (model.workflows || []).find((w) => w.name === args.fromModelWorkflow);
+        if (!raw) {
+          throw new Error(`Embedded workflow "${args.fromModelWorkflow}" not found in model.json. Available: ${(model.workflows || []).map((w) => w.name).join(", ") || "(none)"}.`);
+        }
+        const migrated = migrateModelWorkflow(raw);
+        def = {
+          ...args.name ? { name: args.name } : {},
+          ...migrated.def,
+          ...args.description ? { description: args.description } : {},
+          ...args.environment ? { environment: args.environment } : {},
+          ...args.steps ? { steps: args.steps } : {}
+        };
+        migrationNotes.push(...migrated.notes);
+      } else {
+        if (!args.name)
+          throw new Error('"name" is required to create a workflow (or use fromModelWorkflow to migrate one).');
+        if (!args.steps || args.steps.length === 0) {
+          throw new Error('"steps" with at least one step is required (or use fromModelWorkflow to migrate one).');
+        }
+        def = {
+          name: args.name,
+          ...args.description ? { description: args.description } : {},
+          ...args.environment ? { environment: args.environment } : {},
+          steps: args.steps
+        };
+      }
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      const warnings = [...report.warnings];
+      for (const note of migrationNotes) {
+        warnings.push({ severity: "warning", code: "MIGRATION_NOTE", message: note, fix: "Adjust the saved file with jetic_update_workflow." });
+      }
+      if (!report.valid) {
+        throw new Error(`Workflow "${def.name}" has ${report.errorsCount} error(s) and was NOT saved:
+` + report.errors.map((e) => `- [step ${e.stepIndex ?? "-"}] ${e.message} Fix: ${e.fix}`).join("\n"));
+      }
+      const slug = args.slug?.trim() ? slugifyWorkflowName(args.slug) : slugifyWorkflowName(def.name);
+      const filePath = workflowFilePath(args.projectPath, slug);
+      const overwrite = args.overwrite === true;
+      const validateOnly = args.validateOnly === true;
+      if (validateOnly) {
+        return {
+          success: true,
+          action: "validated",
+          saved: false,
+          slug,
+          filePath,
+          stepsCount: def.steps.length,
+          needsHuman: report.humanKeys,
+          validation: { ...report, warnings }
+        };
+      }
+      if (fs4.existsSync(filePath) && !overwrite) {
+        throw new Error(`Workflow file already exists at ${filePath}. Pass overwrite: true to replace it, use jetic_update_workflow to edit it, or pick another slug.`);
+      }
+      const existedBefore = fs4.existsSync(filePath);
+      writeWorkflowFile(filePath, def);
+      return {
+        success: true,
+        action: existedBefore ? "overwritten" : "created",
+        slug,
+        filePath,
+        stepsCount: def.steps.length,
+        needsHuman: report.humanKeys,
+        ...report.humanKeys.length > 0 ? {
+          humanNote: `Steps need interactive human input for: ${report.humanKeys.map((k) => `{{human:${k}}}`).join(", ")}. Runners pause for it (CLI terminal prompt / dashboard dialog); pre-seed with ${report.humanKeys.map((k) => `JETIC_HUMAN_${k.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`).join(", ")} env or human: memory. Tell the user.`
+        } : {},
+        validation: { ...report, warnings },
+        next: `Run it with jetic_simulate_workflow { "workflow": "${slug}" }.`
+      };
+    }
+    exports2.updateWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().describe("Workflow slug, name, or file path to update"),
+      name: zod_1.z.string().min(1).optional().describe("Rename the workflow (file slug stays the same)"),
+      description: zod_1.z.string().optional().describe("Replace the description"),
+      environment: zod_1.z.string().optional().describe("Replace the target environment"),
+      steps: zod_1.z.array(exports2.workflowStepSchema).min(1).optional().describe("REPLACE all steps (use appendSteps to only add)"),
+      appendSteps: zod_1.z.array(exports2.workflowStepSchema).optional().describe("Append steps to the end (memory from existing steps stays usable)"),
+      validateOnly: zod_1.z.boolean().optional().default(false).describe("Only validate the result, do not write"),
+      allowUnknownEndpoints: zod_1.z.boolean().optional().default(false)
+    });
+    function handleUpdateWorkflow(args) {
+      const resolved = resolveFileWorkflow(args.projectPath, args.workflow);
+      const def = {
+        ...resolved.def,
+        ...args.name ? { name: args.name } : {},
+        ...args.description !== void 0 ? { description: args.description } : {},
+        ...args.environment !== void 0 ? { environment: args.environment } : {},
+        steps: [
+          ...args.steps ? [] : resolved.def.steps || [],
+          ...args.steps || [],
+          ...args.appendSteps || []
+        ]
+      };
+      const report = validateWorkflowDefinition(def, {
+        projectPath: args.projectPath,
+        allowUnknownEndpoints: args.allowUnknownEndpoints === true
+      });
+      if (!report.valid) {
+        throw new Error(`Updated workflow has ${report.errorsCount} error(s) and was NOT saved:
+` + report.errors.map((e) => `- [step ${e.stepIndex ?? "-"}] ${e.message} Fix: ${e.fix}`).join("\n"));
+      }
+      if (args.validateOnly === true) {
+        return { success: true, action: "validated", saved: false, slug: resolved.slug, filePath: resolved.filePath, stepsCount: def.steps.length, needsHuman: report.humanKeys, validation: report };
+      }
+      writeWorkflowFile(resolved.filePath, def);
+      return {
+        success: true,
+        action: "updated",
+        slug: resolved.slug,
+        filePath: resolved.filePath,
+        stepsCount: def.steps.length,
+        needsHuman: report.humanKeys,
+        validation: report,
+        next: `Run it with jetic_simulate_workflow { "workflow": "${resolved.slug}" }.`
+      };
+    }
+    exports2.deleteWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      workflow: zod_1.z.string().describe("Workflow slug, name, or file path to delete")
+    });
+    function handleDeleteWorkflow(args) {
+      const listing = (0, workflow_tools_1.handleListWorkflows)({ projectPath: args.projectPath });
+      const search = args.workflow.toLowerCase();
+      const item = listing.workflows.find((w) => w.id.toLowerCase() === search || w.name.toLowerCase() === search || w.filePath && path7.resolve(w.filePath).toLowerCase() === path7.resolve(args.workflow).toLowerCase());
+      if (!item) {
+        return { success: false, message: `Workflow "${args.workflow}" not found.` };
+      }
+      if (item.source === "model_json" || !item.filePath) {
+        throw new Error(`Workflow "${args.workflow}" is embedded in model.json and cannot be deleted by this tool. Remove it by editing .jetic/model.json directly.`);
+      }
+      fs4.rmSync(item.filePath, { force: true });
+      return { success: true, action: "deleted", slug: item.id, filePath: item.filePath };
+    }
+  }
+});
+
+// ../../packages/mcp-server/dist/tools/project-tools.js
+var require_project_tools = __commonJS({
+  "../../packages/mcp-server/dist/tools/project-tools.js"(exports2) {
+    "use strict";
+    init_cjs_shims();
+    var __createBinding = exports2 && exports2.__createBinding || (Object.create ? (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      var desc = Object.getOwnPropertyDescriptor(m, k);
+      if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+        desc = { enumerable: true, get: function() {
+          return m[k];
+        } };
+      }
+      Object.defineProperty(o, k2, desc);
+    }) : (function(o, m, k, k2) {
+      if (k2 === void 0) k2 = k;
+      o[k2] = m[k];
+    }));
+    var __setModuleDefault = exports2 && exports2.__setModuleDefault || (Object.create ? (function(o, v) {
+      Object.defineProperty(o, "default", { enumerable: true, value: v });
+    }) : function(o, v) {
+      o["default"] = v;
+    });
+    var __importStar = exports2 && exports2.__importStar || /* @__PURE__ */ (function() {
+      var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function(o2) {
+          var ar = [];
+          for (var k in o2) if (Object.prototype.hasOwnProperty.call(o2, k)) ar[ar.length] = k;
+          return ar;
+        };
+        return ownKeys(o);
+      };
+      return function(mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) {
+          for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        }
+        __setModuleDefault(result, mod);
+        return result;
+      };
+    })();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.scanProjectSchema = exports2.initProjectSchema = void 0;
+    exports2.handleInitProject = handleInitProject;
+    exports2.handleScanProject = handleScanProject;
+    var zod_1 = require("zod");
+    var fs4 = __importStar(require("fs"));
+    var path7 = __importStar(require("path"));
+    var types_1 = require_types();
+    var model_1 = require_dist2();
+    exports2.initProjectSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to the project root to initialize (defaults to JETIC_PROJECT_PATH / cwd)"),
+      projectName: zod_1.z.string().optional().describe("Project name (default: directory basename)"),
+      language: zod_1.z.string().optional().describe('Primary language (default: "typescript" when tsconfig.json exists, else omitted)'),
+      framework: zod_1.z.string().optional().describe('Framework (default: "express" when express is a dependency, else omitted)'),
+      environmentName: zod_1.z.string().optional().describe('First environment name (default "local")'),
+      baseUrl: zod_1.z.string().optional().describe('First environment base URL (default "http://localhost:3000")'),
+      overwrite: zod_1.z.boolean().optional().describe("Replace an existing .jetic/model.json (default false \u2014 never clobber silently)")
+    });
+    function detectStack(projectRoot) {
+      let hasExpress = false;
+      let hasPackageJson = false;
+      try {
+        const pkgPath = path7.join(projectRoot, "package.json");
+        if (fs4.existsSync(pkgPath)) {
+          hasPackageJson = true;
+          const pkg = JSON.parse(fs4.readFileSync(pkgPath, "utf-8"));
+          const deps = { ...pkg.dependencies || {}, ...pkg.devDependencies || {}, ...pkg.peerDependencies || {} };
+          hasExpress = "express" in deps;
+        }
+      } catch {
+      }
+      return { hasPackageJson, hasExpress, hasTsConfig: fs4.existsSync(path7.join(projectRoot, "tsconfig.json")) };
+    }
+    function handleInitProject(args) {
+      const filePath = (0, types_1.resolveModelPath)(args.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)(filePath);
+      const overwrite = args.overwrite === true;
+      if (fs4.existsSync(filePath) && !overwrite) {
+        const { model: model2 } = (0, types_1.loadModel)(args.projectPath);
+        return {
+          success: false,
+          action: "already-initialized",
+          filePath,
+          modelExists: true,
+          endpointsCount: model2.endpoints?.length || 0,
+          message: `Model already exists at ${filePath} \u2014 nothing was overwritten. Continue with step 2 (jetic_scan for Express, or jetic_add_endpoint per endpoint).`,
+          next: "If this is an Express+TypeScript project, run jetic_scan next. Otherwise read the code and add endpoints with jetic_add_endpoint, then jetic_verify_model."
+        };
+      }
+      const stack = detectStack(projectRoot);
+      const model = {
+        version: model_1.CURRENT_MODEL_VERSION,
+        generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        project: {
+          name: args.projectName || path7.basename(projectRoot) || "jetic-project",
+          ...args.language || (stack.hasTsConfig ? "typescript" : void 0) ? { language: args.language || "typescript" } : {},
+          ...args.framework || (stack.hasExpress ? "express" : void 0) ? { framework: args.framework || "express" } : {}
+        },
+        environments: [
+          { name: args.environmentName || "local", baseUrl: args.baseUrl || "http://localhost:3000" }
+        ],
+        securitySchemes: {},
+        resources: [],
+        endpoints: [],
+        dependencies: [],
+        workflows: [],
+        stateMachines: []
+      };
+      (0, types_1.saveModel)(filePath, model);
+      fs4.mkdirSync(path7.join(path7.dirname(filePath), "workflows"), { recursive: true });
+      const configPath = path7.join(path7.dirname(filePath), "config.json");
+      if (!fs4.existsSync(configPath)) {
+        fs4.writeFileSync(configPath, JSON.stringify({}, null, 2), "utf-8");
+      }
+      const scanRecommended = stack.hasExpress && stack.hasTsConfig;
+      return {
+        success: true,
+        action: overwrite ? "overwritten" : "created",
+        filePath,
+        project: model.project,
+        detected: stack,
+        scanRecommended,
+        next: scanRecommended ? "Step 2: this looks like an Express+TypeScript project \u2014 run jetic_scan next to auto-fill model.json (no AI key needed), then refine with jetic_add_endpoint and jetic_verify_model." : "Step 2: no auto-scan applies here \u2014 read the backend code and add each endpoint with jetic_add_endpoint (middleware, security, parameters, responses), then jetic_verify_model until clean. Step 3 (only on request): author workflows with jetic_validate_workflow \u2192 jetic_create_workflow \u2192 jetic_simulate_workflow."
+      };
+    }
+    exports2.scanProjectSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to the Express project root (must contain tsconfig.json). Defaults to JETIC_PROJECT_PATH / cwd."),
+      mode: zod_1.z.enum(["merge", "overwrite"]).optional().describe("merge (default): upsert scanned routes, keep hand-added endpoints. overwrite: replace the whole endpoints array.")
+    });
+    async function quietly(fn) {
+      const origStdoutWrite = process.stdout.write.bind(process.stdout);
+      const origLog = console.log;
+      const origInfo = console.info;
+      const origDebug = console.debug?.bind(console);
+      const noop = () => {
+      };
+      process.stdout.write = noop;
+      console.log = noop;
+      console.info = noop;
+      if (console.debug)
+        console.debug = noop;
+      try {
+        return await fn();
+      } finally {
+        process.stdout.write = origStdoutWrite;
+        console.log = origLog;
+        console.info = origInfo;
+        if (origDebug)
+          console.debug = origDebug;
+      }
+    }
+    async function handleScanProject(args) {
+      const filePath = (0, types_1.resolveModelPath)(args.projectPath);
+      const projectRoot = (0, types_1.projectRootOfModel)(filePath);
+      const mode = args.mode || "merge";
+      if (!fs4.existsSync(path7.join(projectRoot, "tsconfig.json"))) {
+        throw new Error(`Cannot scan ${projectRoot}: no tsconfig.json found. jetic_scan only supports Express+TypeScript projects. For any other stack, read the code and model each endpoint with jetic_add_endpoint instead.`);
+      }
+      const { ExpressScanner: ExpressScanner2 } = await Promise.resolve().then(() => __importStar(require_dist3()));
+      const config = {
+        projectRoot,
+        jeticDir: path7.dirname(filePath)
+        // No `ai` key on purpose: static discovery only, no provider, no keys.
+      };
+      let scanned;
+      try {
+        scanned = await quietly(() => new ExpressScanner2(config).scan());
+      } catch (err) {
+        throw new Error(`Scan failed for ${projectRoot}: ${err?.message || err}. If this is not an Express+TypeScript codebase, model endpoints manually with jetic_add_endpoint.`);
+      }
+      const { model: existing, exists } = (0, types_1.loadModel)(args.projectPath);
+      let added = 0;
+      let updated = 0;
+      let preserved = 0;
+      if (!exists || mode === "overwrite") {
+        if (mode === "overwrite" && exists)
+          preserved = 0;
+        existing.endpoints = scanned.endpoints;
+        added = scanned.endpoints.length;
+        if (!existing.environments || existing.environments.length === 0) {
+          existing.environments = scanned.environments;
+        }
+      } else {
+        const index = /* @__PURE__ */ new Map();
+        existing.endpoints.forEach((e, i) => index.set(`${e.method.toUpperCase()} ${e.path}`, i));
+        for (const s of scanned.endpoints) {
+          const key = `${s.method.toUpperCase()} ${s.path}`;
+          const at = index.get(key);
+          if (at === void 0) {
+            existing.endpoints.push(s);
+            added++;
+          } else {
+            existing.endpoints[at] = s;
+            updated++;
+          }
+        }
+        preserved = existing.endpoints.length - added - updated;
+        if (!existing.environments || existing.environments.length === 0) {
+          existing.environments = scanned.environments;
+        }
+      }
+      if (!existing.project?.framework && scanned.project?.framework) {
+        existing.project = { ...scanned.project, ...existing.project };
+      }
+      (0, types_1.saveModel)(filePath, existing);
+      const total = existing.endpoints.length;
+      return {
+        success: true,
+        action: "scanned",
+        filePath,
+        mode,
+        stats: { scanned: scanned.endpoints.length, added, updated, preserved, total },
+        ...scanned.endpoints.length === 0 ? {
+          warning: "Static scan found 0 endpoints. Check that Express routes live under this project root (custom entry points or routers may need manual modeling with jetic_add_endpoint)."
+        } : {},
+        next: total === 0 ? "No endpoints yet \u2014 model them manually with jetic_add_endpoint, then jetic_verify_model." : `Next: refine with jetic_add_endpoint / jetic_update_endpoint (AI enrichment is skipped in scans \u2014 add constraints, examples, ownership by hand), then jetic_verify_model until clean. Step 3 (only on request): workflows via jetic_validate_workflow \u2192 jetic_create_workflow \u2192 jetic_simulate_workflow.`
+      };
+    }
+  }
+});
+
 // ../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js
 var require_zod_compat = __commonJS({
   "../../node_modules/.pnpm/@modelcontextprotocol+sdk@1.30.0_zod@3.25.76/node_modules/@modelcontextprotocol/sdk/dist/cjs/server/zod-compat.js"(exports2) {
@@ -283362,6 +284292,8 @@ var require_server3 = __commonJS({
     var testing_tools_1 = require_testing_tools();
     var environment_tools_1 = require_environment_tools();
     var workflow_tools_1 = require_workflow_tools();
+    var workflow_authoring_tools_1 = require_workflow_authoring_tools();
+    var project_tools_1 = require_project_tools();
     exports2.JETIC_MCP_SERVER_NAME = "jetic-mcp-server";
     function getJeticMcpVersion() {
       try {
@@ -283374,13 +284306,12 @@ var require_server3 = __commonJS({
       return "0.1.0";
     }
     exports2.JETIC_MCP_INSTRUCTIONS = [
-      "Jetic MCP manages API behavioral models stored in `.jetic/model.json`.",
-      "Suggested workflow for AI agents:",
-      "1. Start with `jetic_read_model` (summaryOnly=true) to learn the project layout.",
-      "2. Use `jetic_list_endpoints` / `jetic_get_endpoint` before changing anything.",
-      "3. Mutating tools (`jetic_add_endpoint`, `jetic_update_endpoint`, `jetic_delete_endpoint`, `jetic_manage_environment`) write to disk \u2014 confirm intent with the user first when the change is destructive (delete/overwrite).",
-      "4. After edits, run `jetic_verify_model` and fix reported errors.",
-      "5. Use `jetic_test_endpoint` / `jetic_simulate_workflow` only against a running server (local/staging); pass `baseUrl` to override the stored environment URL.",
+      "Jetic MCP manages API behavioral models in `.jetic/`. Work in this structured order:",
+      "1. INITIALIZE: if there is no `.jetic/model.json` (read tools report modelExists:false), call `jetic_init` first. It scaffolds the folder + model and tells you whether auto-scan applies. Never invent a model file by hand.",
+      "2. MODEL: Express+TypeScript project with tsconfig.json \u2192 run `jetic_scan` (static, keyless) to fill model.json, then refine with `jetic_add_endpoint` / `jetic_update_endpoint`. Any other stack \u2014 or scan gaps \u2014 read the code and model each endpoint yourself with `jetic_add_endpoint` (full fidelity: middleware chains, security, constraints, pagination, produces/consumes). Run `jetic_verify_model` until clean.",
+      "3. SIMULATE (only when the user asks): author workflows with `jetic_validate_workflow` (dry run) \u2192 `jetic_create_workflow` \u2192 `jetic_simulate_workflow`. Chain steps with capture/captureInput (producer) + inject or {{workflow:key}} templates (consumer). Use {{human:key}} ONLY for values unknowable beforehand (OTP codes, real secrets) \u2014 runners pause for interactive input and the create response lists them under needsHuman so you can warn the user.",
+      "No AI-provider setup is needed for any of this: never ask for OpenRouter/OpenAI keys and never use `jetic config ai`.",
+      "Mutating tools (`jetic_add_endpoint`, `jetic_update_endpoint`, `jetic_delete_endpoint`, `jetic_manage_environment`, workflow create/update) write to disk \u2014 confirm intent with the user first when the change is destructive (delete/overwrite).",
       "Project resolution: every tool accepts an optional `projectPath`. If omitted, the server uses the `JETIC_PROJECT_PATH` environment variable, falling back to its own working directory. Set one of them to the project root so the server edits the right `.jetic/model.json`."
     ].join("\n");
     var READ_ONLY = {
@@ -283441,6 +284372,12 @@ var require_server3 = __commonJS({
       register("jetic_list_workflows", "List workflows", "Lists multi-step integration test workflows from .jetic/workflows/*.json, .jetic/workflow.json, or embedded model.json workflows.", workflow_tools_1.listWorkflowsSchema.shape, READ_ONLY, workflow_tools_1.handleListWorkflows);
       register("jetic_simulate_workflow", "Simulate workflow", "Executes a full end-to-end multi-step workflow simulation with dynamic memory capture, header injection, and schema validation against the live server.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
       register("jetic_simulate", "Simulate workflow (alias)", "Alias of jetic_simulate_workflow: runs a multi-step user-journey workflow against the live server. Prefer jetic_simulate_workflow in new prompts.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
+      register("jetic_validate_workflow", "Validate workflow", "Deep-validates a workflow WITHOUT saving or running it: step structure, endpoint cross-checks against model.json, and memory data-flow analysis (every {{scope:key}} except {{human:key}} must be captured by an earlier step). Accepts a saved workflow reference or an inline definition for pre-save dry runs.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
+      register("jetic_create_workflow", "Create workflow", "Creates a .jetic/workflows/<slug>.json workflow from ordered steps with capture/inject memory chaining. Refuses to save when validation errors exist (error messages say exactly how to fix); use validateOnly for a dry run. Can also migrate an embedded model.json workflow via fromModelWorkflow.", workflow_authoring_tools_1.createWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleCreateWorkflow);
+      register("jetic_update_workflow", "Update workflow", "Updates a saved file workflow: rename, description/environment, full steps replacement, or appendSteps. Validates before writing and refuses to save on errors.", workflow_authoring_tools_1.updateWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleUpdateWorkflow);
+      register("jetic_delete_workflow", "Delete workflow", "Deletes a saved .jetic/workflows/*.json workflow file by slug, name, or path. Destructive: confirm with the user before calling. Cannot delete model.json-embedded workflows.", workflow_authoring_tools_1.deleteWorkflowSchema.shape, DESTRUCTIVE, workflow_authoring_tools_1.handleDeleteWorkflow);
+      register("jetic_init", "Initialize Jetic project", "Step 1 of the structured order: scaffolds .jetic/model.json (+ workflows/, config.json) for repos that have none. Refuses to clobber an existing model (pass overwrite:true to replace). Reports whether auto-scan applies (Express+TypeScript) and what to do next.", project_tools_1.initProjectSchema.shape, WRITES_MODEL, project_tools_1.handleInitProject);
+      register("jetic_scan", "Scan Express project", "Step 2a for Express+TypeScript projects (requires tsconfig.json): static AST scan that fills model.json with routes, middleware, and auth heuristics. Keyless \u2014 no AI provider involved. Default merge upserts scanned routes and keeps hand-added endpoints; overwrite replaces all endpoints. Fails with guidance for non-Express stacks (model those manually).", project_tools_1.scanProjectSchema.shape, WRITES_MODEL, project_tools_1.handleScanProject);
       return server;
     }
     async function runMcpServer2() {
@@ -283506,6 +284443,8 @@ var require_dist7 = __commonJS({
     __exportStar(require_testing_tools(), exports2);
     __exportStar(require_environment_tools(), exports2);
     __exportStar(require_workflow_tools(), exports2);
+    __exportStar(require_workflow_authoring_tools(), exports2);
+    __exportStar(require_project_tools(), exports2);
     __exportStar(require_server3(), exports2);
     __exportStar(require_serial_transport(), exports2);
     var fs4 = __importStar(require("fs"));
@@ -283969,9 +284908,15 @@ Use EXACTLY these placeholders in body/inject values:
   {{faker.commerce.productName}}   product name
   {{faker.phone.number}}           phone number
   {{workflow:KEY}}                 value captured from a previous step
+  {{human:KEY}}                    ask the human at runtime (interactive prompt, waits for input).
+                                   Use ONLY for values unknowable beforehand (OTP/2FA codes,
+                                   CAPTCHAs, real personal secrets). First entry is saved to
+                                   human:KEY memory; JETIC_HUMAN_KEY env var skips the prompt.
 
-\u2501\u2501\u2501 FIELD RULES \u2501\u2501\u2501
+ \u2501\u2501\u2501 FIELD RULES \u2501\u2501\u2501
 "body"         \u2014 request body. Use {{faker.*}} for generated fields, {{workflow:KEY}} for previously captured values.
+                 Use {{human:KEY}} SPARINGLY and only when no other source exists (OTP codes, real secrets) \u2014
+                 it pauses execution waiting for a person to type a value.
 
 "captureInput" \u2014 save RESOLVED body field values to memory BEFORE the HTTP call.
                Only for faker-generated fields you need to re-use in later steps.
@@ -284022,7 +284967,7 @@ all [requiresAuth] endpoints inject Authorization, captures wired correctly betw
     method: import_zod.z.string().describe("HTTP method in uppercase: GET, POST, PUT, PATCH, DELETE"),
     path: import_zod.z.string().describe("Exact endpoint path, e.g. /api/auth/login"),
     description: import_zod.z.string().optional().describe("One sentence describing what this step does"),
-    body: import_zod.z.record(import_zod.z.string(), import_zod.z.any()).optional().describe("Request body. Use {{faker.X}} for generated values, {{workflow:KEY}} for captured values"),
+    body: import_zod.z.record(import_zod.z.string(), import_zod.z.any()).optional().describe("Request body. Use {{faker.X}} for generated values, {{workflow:KEY}} for captured values, {{human:KEY}} only for OTP/secret values a person must type at runtime"),
     captureInput: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Save resolved request body fields to memory BEFORE the HTTP call. Format: { "workflow:KEY": "bodyFieldName" }'),
     capture: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Save response body fields to memory AFTER success. Format: { "workflow:KEY": "dot.path" }'),
     inject: import_zod.z.record(import_zod.z.string(), import_zod.z.string()).optional().describe('Inject memory values into headers/body. Use "header:Authorization" for Bearer auth'),
@@ -284054,12 +284999,12 @@ function deepGet(obj, dotPath) {
   }
   return current;
 }
-async function resolveConditionRef(ref) {
-  return ref.replace(/\{\{([^}]+)\}\}/g, () => "").trim() === ref.trim() ? ref : await resolveTemplateString(ref);
+async function resolveConditionRef(ref, context = "condition") {
+  return ref.replace(/\{\{([^}]+)\}\}/g, () => "").trim() === ref.trim() ? ref : await resolveTemplateString(ref, context);
 }
-async function evalConditionRule(rule) {
-  const left = await resolveConditionRef(rule.left);
-  const right = rule.right !== void 0 ? await resolveConditionRef(rule.right) : void 0;
+async function evalConditionRule(rule, context = "condition") {
+  const left = await resolveConditionRef(rule.left, context);
+  const right = rule.right !== void 0 ? await resolveConditionRef(rule.right, context) : void 0;
   const op = rule.operator;
   switch (op) {
     case "equals":
@@ -284094,14 +285039,14 @@ async function evalConditionRule(rule) {
       return false;
   }
 }
-async function evaluateStepCondition(condition) {
+async function evaluateStepCondition(condition, context = "condition") {
   const { rules } = condition;
   const ruleList = rules.all ?? rules.any ?? [];
   const isAnd = !!rules.all;
   if (ruleList.length === 0) return { passed: true, reason: "No rules defined" };
   const results = [];
   for (const rule of ruleList) {
-    results.push({ rule, ok: await evalConditionRule(rule) });
+    results.push({ rule, ok: await evalConditionRule(rule, context) });
   }
   const passed = isAnd ? results.every((r) => r.ok) : results.some((r) => r.ok);
   const failing = results.filter((r) => !r.ok);
@@ -284110,12 +285055,89 @@ async function evaluateStepCondition(condition) {
   ).join(", ")}`;
   return { passed, reason };
 }
-async function resolveTemplateString(value) {
+function envKeyForHuman(key) {
+  return `JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+}
+var HumanInputError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "HumanInputError";
+  }
+};
+function isSecretHumanKey(key) {
+  return /pass|secret|token|pwd|private|credential/i.test(key);
+}
+async function promptLine(question) {
+  const readline3 = await new Function("modulePath", "return import(modulePath)")("node:readline/promises");
+  const rl = readline3.createInterface({ input: process.stdin, output: process.stdout });
+  try {
+    return await rl.question(question);
+  } finally {
+    rl.close();
+  }
+}
+async function promptSecret(question) {
+  const readline3 = await new Function("modulePath", "return import(modulePath)")("node:readline");
+  return new Promise((resolve2) => {
+    const rl = readline3.createInterface({ input: process.stdin, output: process.stdout, terminal: true });
+    process.stdout.write(question);
+    const w = rl;
+    const orig = w._writeToOutput.bind(rl);
+    w._writeToOutput = (s) => {
+      if (s === "\n" || s === "\r\n" || s === "\r") orig(s);
+      else w.output.write("*".repeat(s.length));
+    };
+    rl.question("", (answer) => {
+      w._writeToOutput = orig;
+      process.stdout.write("\n");
+      rl.close();
+      resolve2(answer);
+    });
+  });
+}
+async function askHuman(key, context) {
+  const envName = envKeyForHuman(key);
+  const fromEnv = process.env[envName];
+  if (fromEnv !== void 0 && fromEnv !== "") return fromEnv;
+  const mem = new import_memory2.JeticMemory({ scope: "human" });
+  const cached = await mem.get(key);
+  if (cached !== null && cached !== void 0 && String(cached) !== "") {
+    console.log(`  ${c.dim}\u21B3 using saved human value for "${key}" (jetic memory set human:${key} \u2026 to change)${c.reset}`);
+    return String(cached);
+  }
+  if (!process.stdin.isTTY) {
+    throw new HumanInputError(
+      `Workflow needs human input for "{{human:${key}}}"${context ? ` (${context})` : ""} but the terminal is not interactive. Pre-seed it with: jetic memory set human:${key} <value>  \u2014 or export ${envName}=<value>`
+    );
+  }
+  console.log(`
+  ${c.yellow}${c.bold}\u25C9 Human input required${c.reset}${context ? `  ${c.dim}${context}${c.reset}` : ""}`);
+  const question = `  ${c.cyan}Enter value for "${key}":${c.reset} `;
+  const value = isSecretHumanKey(key) ? await promptSecret(question) : await promptLine(question);
+  if (value !== "") {
+    await mem.set(key, value);
+    console.log(`  ${c.dim}\u21B3 saved to human:${key} memory (reused automatically next time)${c.reset}
+`);
+  } else {
+    console.log(`  ${c.dim}\u21B3 empty value accepted for "${key}" (not saved)${c.reset}
+`);
+  }
+  return value;
+}
+async function resolveTemplateString(value, context) {
   const templateRe = /\{\{([^}]+)\}\}/g;
   let match;
   const replacements = [];
   while ((match = templateRe.exec(value)) !== null) {
     const expr = match[1].trim();
+    if (!expr.startsWith("faker.")) {
+      const colonIdx = expr.indexOf(":");
+      if (colonIdx > 0 && expr.slice(0, colonIdx) === "human") {
+        const key = expr.slice(colonIdx + 1);
+        replacements.push({ placeholder: match[0], resolved: await askHuman(key, context) });
+        continue;
+      }
+    }
     if (expr.includes(":") && !expr.startsWith("faker.")) {
       const colonIdx = expr.indexOf(":");
       const scope = expr.slice(0, colonIdx);
@@ -284145,21 +285167,21 @@ async function resolveTemplateString(value) {
   }
   return result;
 }
-async function resolveBodyTemplates(body) {
+async function resolveBodyTemplates(body, context) {
   const resolved = {};
   for (const [key, value] of Object.entries(body)) {
-    resolved[key] = typeof value === "string" ? await resolveTemplateString(value) : value;
+    resolved[key] = typeof value === "string" ? await resolveTemplateString(value, context) : value;
   }
   return resolved;
 }
-async function resolveInjections(inject, memory, allMemory) {
+async function resolveInjections(inject, memory, allMemory, context) {
   const headers = {};
   const body = {};
   if (!inject) return { headers, body };
   for (const [target, memKeyOrTemplate] of Object.entries(inject)) {
     let strValue;
     if (memKeyOrTemplate.includes("{{")) {
-      strValue = await resolveTemplateString(memKeyOrTemplate);
+      strValue = await resolveTemplateString(memKeyOrTemplate, context);
     } else {
       const [scope, key] = memKeyOrTemplate.includes(":") ? memKeyOrTemplate.split(":", 2) : ["workflow", memKeyOrTemplate];
       const scopedMemory = new import_memory2.JeticMemory({ scope });
@@ -284212,8 +285234,9 @@ async function resolvePathParams(urlPath, body) {
 async function executeStep(step, baseUrl, defaultBody) {
   const startTime = Date.now();
   const memory = new import_memory2.JeticMemory({ scope: "workflow" });
-  const { headers, body: injectedBody } = await resolveInjections(step.inject, memory, memory);
-  const resolvedStepBody = await resolveBodyTemplates(step.body || {});
+  const stepLabel = step.name || `${step.method} ${step.path}`;
+  const { headers, body: injectedBody } = await resolveInjections(step.inject, memory, memory, stepLabel);
+  const resolvedStepBody = await resolveBodyTemplates(step.body || {}, stepLabel);
   const requestBody = { ...defaultBody, ...injectedBody, ...resolvedStepBody };
   const inputCaptured = await captureInputToMemory(step.captureInput, requestBody);
   const resolvedPath = await resolvePathParams(step.path, requestBody);
@@ -284557,71 +285580,86 @@ var simulateWorkflowCommand = new import_commander6.Command("workflow").descript
     const stepLabel = `${c.dim}${i + 1}/${workflow.steps.length}${c.reset}  ${getMethodColor(step.method)}${step.method}${c.reset} ${step.path}`;
     const spinner = new Spinner();
     spinner.start(`${stepLabel}  ${c.dim}${step.name}${c.reset}...`);
-    const result = await executeStep(step, baseUrl, {});
-    if (step.condition) {
-      const condResult = await evaluateStepCondition(step.condition);
-      result.conditionResult = condResult;
-      if (!condResult.passed) {
-        const { onFail, switchToWorkflow } = step.condition;
-        results.push(result);
-        const icon2 = result.passed ? TICK : CROSS;
-        spinner.stop(`  ${icon2} ${stepLabel}  ${formatStatus(result.status)}  ${c.dim}${result.durationMs}ms${c.reset}`);
-        renderStepResult(result, i, workflow.steps.length);
-        if (onFail === "abort") {
-          console.log(`  ${c.red}${c.bold}\u26A0 Condition failed \u2014 aborting workflow.${c.reset}
+    let result;
+    try {
+      result = await executeStep(step, baseUrl, {});
+      if (step.condition) {
+        const condResult = await evaluateStepCondition(step.condition, `condition of step "${step.name || step.path}"`);
+        result.conditionResult = condResult;
+        if (!condResult.passed) {
+          const { onFail, switchToWorkflow } = step.condition;
+          results.push(result);
+          const icon2 = result.passed ? TICK : CROSS;
+          spinner.stop(`  ${icon2} ${stepLabel}  ${formatStatus(result.status)}  ${c.dim}${result.durationMs}ms${c.reset}`);
+          renderStepResult(result, i, workflow.steps.length);
+          if (onFail === "abort") {
+            console.log(`  ${c.red}${c.bold}\u26A0 Condition failed \u2014 aborting workflow.${c.reset}
 `);
-          stopOnFailure = true;
-          break;
-        } else if (onFail === "continue") {
-          console.log(`  ${c.yellow}\u2298 Condition failed \u2014 skipping remaining steps.${c.reset}
+            stopOnFailure = true;
+            break;
+          } else if (onFail === "continue") {
+            console.log(`  ${c.yellow}\u2298 Condition failed \u2014 skipping remaining steps.${c.reset}
 `);
-          stopOnFailure = true;
-          break;
-        } else if (onFail === "switch" && switchToWorkflow) {
-          console.log(`  ${ARROW} Condition failed \u2014 switching to workflow: ${c.bold}${switchToWorkflow}${c.reset}
+            stopOnFailure = true;
+            break;
+          } else if (onFail === "switch" && switchToWorkflow) {
+            console.log(`  ${ARROW} Condition failed \u2014 switching to workflow: ${c.bold}${switchToWorkflow}${c.reset}
 `);
-          const switchPath = path3.join(workflowsDir, `${switchToWorkflow}.json`);
-          if (fs.existsSync(switchPath)) {
-            try {
-              const switchedWorkflow = JSON.parse(fs.readFileSync(switchPath, "utf-8"));
-              console.log(`  ${TICK} Loaded switch workflow: ${c.bold}${switchedWorkflow.name}${c.reset}
+            const switchPath = path3.join(workflowsDir, `${switchToWorkflow}.json`);
+            if (fs.existsSync(switchPath)) {
+              try {
+                const switchedWorkflow = JSON.parse(fs.readFileSync(switchPath, "utf-8"));
+                console.log(`  ${TICK} Loaded switch workflow: ${c.bold}${switchedWorkflow.name}${c.reset}
 `);
-              renderWorkflowHeader(switchedWorkflow);
-              console.log(`  ${c.magenta}\u{1F680}${c.reset} Executing sub-workflow...
+                renderWorkflowHeader(switchedWorkflow);
+                console.log(`  ${c.magenta}\u{1F680}${c.reset} Executing sub-workflow...
+`);
+                for (let si = 0; si < switchedWorkflow.steps.length; si++) {
+                  const switchStep = switchedWorkflow.steps[si];
+                  const switchLabel = `${c.dim}${si + 1}/${switchedWorkflow.steps.length}${c.reset}  ${getMethodColor(switchStep.method)}${switchStep.method}${c.reset} ${switchStep.path}`;
+                  const switchSpinner = new Spinner();
+                  switchSpinner.start(`${switchLabel}  ${c.dim}${switchStep.name}${c.reset}...`);
+                  const switchResult = await executeStep(switchStep, baseUrl, {});
+                  if (switchStep.condition) {
+                    switchResult.conditionResult = await evaluateStepCondition(
+                      switchStep.condition,
+                      `condition of step "${switchStep.name || switchStep.path}"`
+                    );
+                  }
+                  results.push(switchResult);
+                  const switchIcon = switchResult.passed ? TICK : CROSS;
+                  switchSpinner.stop(`  ${switchIcon} ${switchLabel}  ${formatStatus(switchResult.status)}  ${c.dim}${switchResult.durationMs}ms${c.reset}`);
+                  renderStepResult(switchResult, si, switchedWorkflow.steps.length);
+                }
+              } catch (e) {
+                console.log(`  ${c.red}\u2717 Failed to load switch workflow: ${e.message}${c.reset}
 `);
-              for (let si = 0; si < switchedWorkflow.steps.length; si++) {
-                const switchStep = switchedWorkflow.steps[si];
-                const switchLabel = `${c.dim}${si + 1}/${switchedWorkflow.steps.length}${c.reset}  ${getMethodColor(switchStep.method)}${switchStep.method}${c.reset} ${switchStep.path}`;
-                const switchSpinner = new Spinner();
-                switchSpinner.start(`${switchLabel}  ${c.dim}${switchStep.name}${c.reset}...`);
-                const switchResult = await executeStep(switchStep, baseUrl, {});
-                if (switchStep.condition) {
-                  switchResult.conditionResult = await evaluateStepCondition(switchStep.condition);
-                }
-                results.push(switchResult);
-                const switchIcon = switchResult.passed ? TICK : CROSS;
-                switchSpinner.stop(`  ${switchIcon} ${switchLabel}  ${formatStatus(switchResult.status)}  ${c.dim}${switchResult.durationMs}ms${c.reset}`);
-                renderStepResult(switchResult, si, switchedWorkflow.steps.length);
               }
-            } catch (e) {
-              console.log(`  ${c.red}\u2717 Failed to load switch workflow: ${e.message}${c.reset}
+            } else {
+              console.log(`  ${c.yellow}\u26A0 Switch workflow not found: ${switchPath}${c.reset}
 `);
             }
-          } else {
-            console.log(`  ${c.yellow}\u26A0 Switch workflow not found: ${switchPath}${c.reset}
-`);
-          }
-          if (step.condition.returnOnComplete) {
-            console.log(`  ${c.green}\u21A9 Sub-workflow complete. Returning to main workflow...${c.reset}
+            if (step.condition.returnOnComplete) {
+              console.log(`  ${c.green}\u21A9 Sub-workflow complete. Returning to main workflow...${c.reset}
 `);
-            continue;
-          } else {
-            stopOnFailure = true;
-            break;
+              continue;
+            } else {
+              stopOnFailure = true;
+              break;
+            }
           }
+          continue;
         }
-        continue;
       }
+    } catch (err) {
+      if (err instanceof HumanInputError || err?.name === "HumanInputError") {
+        spinner.stop(`  ${c.red}\u2717${c.reset} ${stepLabel}  ${c.dim}needs human input${c.reset}`);
+        console.error(`
+  ${c.red}${err.message}${c.reset}
+`);
+        process.exit(1);
+      }
+      throw err;
     }
     results.push(result);
     const icon = result.passed ? TICK : CROSS;
@@ -285534,8 +286572,29 @@ Output valid JSON only.
       res.status(500).json({ error: err.message });
     }
   });
+  const humanInputWaiters = /* @__PURE__ */ new Map();
+  const HUMAN_INPUT_TIMEOUT_MS = 10 * 60 * 1e3;
+  class HumanInputAbort extends Error {
+    constructor(key, reason) {
+      super(`Human input for "{{human:${key}}}" ${reason}`);
+      this.name = "HumanInputAbort";
+    }
+  }
+  app.post("/api/workflows/human-input", (req, res) => {
+    const { runId, key, value } = req.body;
+    if (!runId || !key) {
+      return res.status(400).json({ error: "runId and key are required" });
+    }
+    const waiter = humanInputWaiters.get(runId);
+    if (!waiter || waiter.key !== key) {
+      return res.status(404).json({ error: "no pending human input for this run/key (answered, timed out, or run ended)" });
+    }
+    humanInputWaiters.delete(runId);
+    waiter.resolve(typeof value === "string" ? value : null);
+    res.json({ ok: true });
+  });
   app.post("/api/workflows/run", async (req, res) => {
-    const { file } = req.body;
+    const { file, humanInputs: preseededHuman } = req.body;
     if (!file) {
       return res.status(400).json({ error: "file is required" });
     }
@@ -285576,10 +286635,46 @@ Output valid JSON only.
       }
     }
     if (!baseUrl) baseUrl = "http://localhost:4000";
-    send("start", { name: workflow.name, totalSteps: workflow.steps.length, baseUrl });
+    const runId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;
+    const runHumanCache = new Map(Object.entries(preseededHuman ?? {}));
+    const HUMAN_KEY_RE = /\{\{\s*human:([^}]+?)\s*\}\}/g;
+    const collectHumanRefs = () => {
+      const keys = /* @__PURE__ */ new Set();
+      for (const step of workflow.steps || []) {
+        for (const hay of [step?.path, JSON.stringify(step?.body ?? {}), JSON.stringify(step?.inject ?? {}), JSON.stringify(step?.condition ?? {})]) {
+          if (!hay) continue;
+          HUMAN_KEY_RE.lastIndex = 0;
+          let m;
+          while ((m = HUMAN_KEY_RE.exec(hay)) !== null) {
+            const k = (m[1] || "").trim();
+            if (k) keys.add(k);
+          }
+        }
+      }
+      return [...keys];
+    };
+    const humanEnvName = (key) => `JETIC_HUMAN_${key.toUpperCase().replace(/[^A-Z0-9]/g, "_")}`;
+    const humanSource = async (key) => {
+      if (runHumanCache.has(key)) return "run";
+      if (process.env[humanEnvName(key)]) return "env";
+      try {
+        const v = await new Mem({ scope: "human" }).get(key);
+        if (v != null && String(v) !== "") return "memory";
+      } catch {
+      }
+      return "prompt";
+    };
+    const neededHuman = [];
+    for (const k of collectHumanRefs()) neededHuman.push({ key: k, source: await humanSource(k) });
+    send("start", { name: workflow.name, totalSteps: workflow.steps.length, baseUrl, runId, humanKeys: neededHuman });
     let aborted = false;
     req.on("close", () => {
       aborted = true;
+      const waiter = humanInputWaiters.get(runId);
+      if (waiter) {
+        humanInputWaiters.delete(runId);
+        waiter.resolve(null);
+      }
     });
     function deepGet2(obj, dotPath) {
       return dotPath.replace(/\[(\d+)\]/g, ".$1").split(".").reduce((o, k) => o?.[k], obj);
@@ -285599,42 +286694,101 @@ Output valid JSON only.
         return _;
       });
     }
-    async function resolveMemoryTemplates(value) {
+    async function resolveMemoryTemplates(value, stepIndex = -1, stepName = "") {
       const matches = [...value.matchAll(/\{\{([^}]+)\}\}/g)];
       let result = value;
       for (const [placeholder, expr] of matches.map((m) => [m[0], m[1].trim()])) {
         if (expr.includes(":") && !expr.startsWith("faker.")) {
           const [scope, key] = expr.split(":", 2);
-          const mem = new Mem({ scope });
-          const val = await mem.get(key);
-          result = result.replace(placeholder, val != null ? String(val) : "");
+          const val = await resolveMemValue(scope, key, stepIndex, stepName);
+          result = result.replace(placeholder, val);
         }
       }
       return result;
     }
-    async function resolveStr(v) {
+    async function resolveStr(v, stepIndex = -1, stepName = "") {
       let s = await resolveTemplate(v);
-      s = await resolveMemoryTemplates(s);
+      s = await resolveMemoryTemplates(s, stepIndex, stepName);
       return s;
     }
-    async function executeStep2(step) {
+    async function resolveValueRecursive(val, stepIndex = -1, stepName = "") {
+      if (typeof val === "string") {
+        return await resolveStr(val, stepIndex, stepName);
+      }
+      if (Array.isArray(val)) {
+        const res2 = [];
+        for (const item of val) {
+          res2.push(await resolveValueRecursive(item, stepIndex, stepName));
+        }
+        return res2;
+      }
+      if (val && typeof val === "object" && val.constructor === Object) {
+        const res2 = {};
+        for (const [k, v] of Object.entries(val)) {
+          res2[k] = await resolveValueRecursive(v, stepIndex, stepName);
+        }
+        return res2;
+      }
+      return val;
+    }
+    async function resolveMemValue(scope, key, stepIndex, stepName) {
+      if (scope !== "human") {
+        const mem2 = new Mem({ scope });
+        const val = await mem2.get(key);
+        return val != null ? String(val) : "";
+      }
+      if (runHumanCache.has(key)) {
+        send("human_resolved", { index: stepIndex, key, source: "run" });
+        return runHumanCache.get(key);
+      }
+      const envVal = process.env[humanEnvName(key)];
+      if (envVal !== void 0 && envVal !== "") {
+        send("human_resolved", { index: stepIndex, key, source: "env" });
+        return envVal;
+      }
+      const mem = new Mem({ scope: "human" });
+      const answer = await waitForHumanInput(runId, key, stepIndex, stepName, send);
+      if (answer === null) {
+        throw new HumanInputAbort(key, aborted ? "was cancelled" : "timed out after 10 minutes");
+      }
+      await mem.set(key, answer);
+      send("human_resolved", { index: stepIndex, key, source: "prompt" });
+      return answer;
+    }
+    function waitForHumanInput(forRunId, key, stepIndex, stepName, sendFn) {
+      return new Promise((resolve2) => {
+        const timer = setTimeout(() => {
+          if (humanInputWaiters.get(forRunId)?.key === key) {
+            humanInputWaiters.delete(forRunId);
+            resolve2(null);
+          }
+        }, HUMAN_INPUT_TIMEOUT_MS);
+        humanInputWaiters.set(forRunId, {
+          key,
+          stepIndex,
+          resolve: (value) => {
+            clearTimeout(timer);
+            resolve2(value);
+          }
+        });
+        sendFn("human_input_required", { runId: forRunId, key, stepIndex, stepName });
+      });
+    }
+    async function executeStep2(step, stepIndex) {
       const startTime = Date.now();
+      const stepName = step.name || `${step.method} ${step.path}`;
       const headers = { "Content-Type": "application/json" };
       const bodyExtra = {};
       for (const [target, memKeyOrTpl] of Object.entries(step.inject ?? {})) {
-        const strVal = memKeyOrTpl.includes("{{") ? await resolveStr(memKeyOrTpl) : await (async () => {
+        const strVal = memKeyOrTpl.includes("{{") ? await resolveStr(memKeyOrTpl, stepIndex, stepName) : await (async () => {
           const [scope, key] = memKeyOrTpl.includes(":") ? memKeyOrTpl.split(":", 2) : ["workflow", memKeyOrTpl];
-          const val = await new Mem({ scope }).get(key);
-          return val != null ? String(val) : "";
+          return resolveMemValue(scope, key, stepIndex, stepName);
         })();
         if (!strVal) continue;
         if (target.startsWith("body:")) bodyExtra[target.slice(5)] = strVal;
         else headers[target.startsWith("header:") ? target.slice(7) : target] = strVal;
       }
-      const resolvedBody = {};
-      for (const [k, v] of Object.entries(step.body ?? {})) {
-        resolvedBody[k] = typeof v === "string" ? await resolveStr(v) : v;
-      }
+      const resolvedBody = await resolveValueRecursive(step.body ?? {}, stepIndex, stepName);
       const requestBody = { ...bodyExtra, ...resolvedBody };
       for (const [memKey, bodyField] of Object.entries(step.captureInput ?? {})) {
         const val = requestBody[bodyField];
@@ -285647,7 +286801,7 @@ Output valid JSON only.
         /:([a-zA-Z_][a-zA-Z0-9_]*)/g,
         (_, p) => requestBody[p] !== void 0 ? String(requestBody[p]) : `:${p}`
       );
-      resolvedPath = await resolveStr(resolvedPath);
+      resolvedPath = await resolveStr(resolvedPath, stepIndex, stepName);
       const finalUrl = `${baseUrl.replace(/\/$/, "")}${resolvedPath}`;
       const expectedStatus = step.expectStatus ?? 200;
       try {
@@ -285690,22 +286844,20 @@ Output valid JSON only.
     }
     let passed = 0;
     let failed = 0;
-    async function resolveCondRef(ref) {
+    async function resolveCondRef(ref, stepIndex, stepName) {
       const matches = [...ref.matchAll(/\{\{([^}]+)\}\}/g)];
       let result = ref;
       for (const [placeholder, expr] of matches.map((m) => [m[0], m[1].trim()])) {
         if (expr.includes(":") && !expr.startsWith("faker.")) {
           const [scope, key] = expr.split(":", 2);
-          const mem = new Mem({ scope });
-          const val = await mem.get(key);
-          result = result.replace(placeholder, val != null ? String(val) : "");
+          result = result.replace(placeholder, await resolveMemValue(scope, key, stepIndex, stepName));
         }
       }
       return result;
     }
-    async function evalCondRule(rule) {
-      const left = await resolveCondRef(rule.left);
-      const right = rule.right !== void 0 ? await resolveCondRef(rule.right) : void 0;
+    async function evalCondRule(rule, stepIndex, stepName) {
+      const left = await resolveCondRef(rule.left, stepIndex, stepName);
+      const right = rule.right !== void 0 ? await resolveCondRef(rule.right, stepIndex, stepName) : void 0;
       switch (rule.operator) {
         case "equals":
           return left === right;
@@ -285739,12 +286891,12 @@ Output valid JSON only.
           return false;
       }
     }
-    async function evalCondition(condition) {
+    async function evalCondition(condition, stepIndex, stepName) {
       const rules = condition.rules?.all ?? condition.rules?.any ?? [];
       const isAnd = !!condition.rules?.all;
       if (rules.length === 0) return { passed: true, reason: "No rules" };
       const results = [];
-      for (const rule of rules) results.push({ rule, ok: await evalCondRule(rule) });
+      for (const rule of rules) results.push({ rule, ok: await evalCondRule(rule, stepIndex, stepName) });
       const passed2 = isAnd ? results.every((r) => r.ok) : results.some((r) => r.ok);
       const failing = results.filter((r) => !r.ok);
       const reason = passed2 ? `All conditions met (${isAnd ? "AND" : "OR"})` : `Failed: ${failing.map((r) => `${r.rule.left} ${r.rule.operator}${r.rule.right !== void 0 ? " " + r.rule.right : ""}`).join(", ")}`;
@@ -285754,7 +286906,17 @@ Output valid JSON only.
       if (aborted) break;
       const step = workflow.steps[i];
       send("step_start", { index: i, step: { name: step.name, method: step.method, path: step.path } });
-      const result = await executeStep2(step);
+      let result;
+      try {
+        result = await executeStep2(step, i);
+      } catch (err) {
+        if (err instanceof HumanInputAbort || err?.name === "HumanInputAbort") {
+          send("aborted", { index: i, reason: err.message });
+          res.end();
+          return;
+        }
+        throw err;
+      }
       if (result.passed) passed++;
       else failed++;
       send("step_result", {
@@ -285769,7 +286931,7 @@ Output valid JSON only.
         error: result.error
       });
       if (step.condition && !aborted) {
-        const condResult = await evalCondition(step.condition);
+        const condResult = await evalCondition(step.condition, i, step.name || `${step.method} ${step.path}`);
         send("condition_result", {
           index: i,
           passed: condResult.passed,
@@ -285914,29 +287076,34 @@ Output valid JSON only.
     }
   });
   try {
-    let dashboardDistPath = import_path.default.join(__dirname, "dashboard");
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      dashboardDistPath = import_path.default.join(__dirname, "..", "dashboard");
+    let dashboardDistPath = null;
+    try {
+      const dashboardPackagePath = require.resolve("@jetic/dashboard/package.json");
+      const workspaceDist = import_path.default.join(import_path.default.dirname(dashboardPackagePath), "dist");
+      if (import_fs.default.existsSync(workspaceDist)) dashboardDistPath = workspaceDist;
+    } catch {
     }
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      try {
-        const dashboardPackagePath = require.resolve("@jetic/dashboard/package.json");
-        dashboardDistPath = import_path.default.join(import_path.default.dirname(dashboardPackagePath), "dist");
-      } catch {
-      }
+    if (!dashboardDistPath) {
+      const bundled = import_path.default.join(__dirname, "dashboard");
+      if (import_fs.default.existsSync(bundled)) dashboardDistPath = bundled;
     }
-    if (!import_fs.default.existsSync(dashboardDistPath)) {
-      console.warn(`Dashboard build not found at ${dashboardDistPath}. Please build the dashboard first.`);
+    if (!dashboardDistPath) {
+      const sibling = import_path.default.join(__dirname, "..", "dashboard");
+      if (import_fs.default.existsSync(sibling)) dashboardDistPath = sibling;
+    }
+    if (!dashboardDistPath) {
+      console.warn("Dashboard build not found. Build it with: pnpm --filter @jetic/dashboard run build");
+    } else {
+      app.use(import_express.default.static(dashboardDistPath));
+      app.get("*", (_req, res) => {
+        const indexPath = import_path.default.join(dashboardDistPath, "index.html");
+        if (import_fs.default.existsSync(indexPath)) {
+          res.sendFile(indexPath);
+        } else {
+          res.status(404).send("Dashboard not built yet.");
+        }
+      });
     }
-    app.use(import_express.default.static(dashboardDistPath));
-    app.get("*", (_req, res) => {
-      const indexPath = import_path.default.join(dashboardDistPath, "index.html");
-      if (import_fs.default.existsSync(indexPath)) {
-        res.sendFile(indexPath);
-      } else {
-        res.status(404).send("Dashboard not built yet.");
-      }
-    });
   } catch (e) {
     console.error("Could not find dashboard static files. Ensure it is built.", e);
   }
@@ -286107,7 +287274,7 @@ var mcpCommand = new import_commander10.Command("mcp").description("Launch Model
 
 // src/index.ts
 var program = new import_commander11.Command();
-program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.6");
+program.name("jetic").description("AI-Native API Behavior Testing").version("0.1.9");
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(inspectCommand);