jetic-cli 0.2.1 → 0.2.3

package/dist/index.js

@@ -267984,57 +267984,116 @@ var require_workflow_simulator = __commonJS({
         for (let i = 0; i < workflow.steps.length; i++) {
           const step = workflow.steps[i];
           const stepStartTime = Date.now();
+          if (step.condition) {
+            const condResult = await this.evaluateCondition(step.condition);
+            if (!condResult.matched) {
+              stepResults.push({
+                stepIndex: i + 1,
+                name: step.name || `${step.method} ${step.path}`,
+                method: step.method,
+                path: step.path,
+                targetUrl: "",
+                expectedStatus: step.expectStatus ?? 200,
+                actualStatus: 0,
+                durationMs: Date.now() - stepStartTime,
+                passed: true,
+                skipped: true,
+                retryCount: 0,
+                conditionResult: condResult,
+                requestHeaders: {},
+                requestBody: {},
+                responseBody: null,
+                capturedMemory: []
+              });
+              continue;
+            }
+          }
           const { headers: injectedHeaders, body: injectedBody } = await this.resolveInjections(step.inject);
           const resolvedBody = await this.resolveBodyTemplates(step.body || {});
           const finalBody = { ...injectedBody, ...resolvedBody };
           const inputCaptured = await this.captureInputToMemory(step.captureInput, finalBody);
           const resolvedPath = await this.resolvePathParams(step.path, finalBody);
           const fullUrl = `${baseUrl.replace(/\/$/, "")}${resolvedPath}`;
-          const expectedStatus = step.expectStatus || 200;
+          const expectedStatus = step.expectStatus ?? 200;
+          const maxAttempts = Math.max(1, step.retry?.times ?? workflow.retry?.times ?? 1);
+          const retryDelayMs = step.retry?.delayMs ?? workflow.retry?.delayMs ?? 0;
+          let attempts = 0;
           let responseStatus = 0;
           let responseBody = null;
           let stepPassed = false;
           let errorMsg;
-          try {
-            const fetchOptions = {
-              method: step.method.toUpperCase(),
-              headers: {
-                "Content-Type": "application/json",
-                ...injectedHeaders
-              }
-            };
-            if (!["GET", "HEAD"].includes(step.method.toUpperCase()) && Object.keys(finalBody).length > 0) {
-              fetchOptions.body = JSON.stringify(finalBody);
-            }
-            let finalUrl = fullUrl;
-            if (["GET", "HEAD"].includes(step.method.toUpperCase()) && Object.keys(finalBody).length > 0) {
-              const params = new URLSearchParams();
-              for (const [k, v] of Object.entries(finalBody)) {
-                if (v !== void 0 && v !== null)
-                  params.set(k, String(v));
-              }
-              finalUrl = `${fullUrl}?${params.toString()}`;
-            }
-            const resp = await fetch(finalUrl, fetchOptions);
-            responseStatus = resp.status;
-            const ct = resp.headers.get("content-type") || "";
-            if (ct.includes("application/json")) {
-              try {
-                responseBody = await resp.json();
-              } catch {
-                responseBody = null;
+          while (attempts < maxAttempts) {
+            attempts++;
+            if (attempts > 1 && retryDelayMs > 0) {
+              await new Promise((r) => setTimeout(r, retryDelayMs));
+            }
+            responseStatus = 0;
+            responseBody = null;
+            errorMsg = void 0;
+            try {
+              const fetchOptions = {
+                method: step.method.toUpperCase(),
+                headers: { "Content-Type": "application/json", ...injectedHeaders }
+              };
+              if (!["GET", "HEAD"].includes(step.method.toUpperCase()) && Object.keys(finalBody).length > 0) {
+                fetchOptions.body = JSON.stringify(finalBody);
+              }
+              let finalUrl = fullUrl;
+              if (["GET", "HEAD"].includes(step.method.toUpperCase()) && Object.keys(finalBody).length > 0) {
+                const params = new URLSearchParams();
+                for (const [k, v] of Object.entries(finalBody)) {
+                  if (v !== void 0 && v !== null)
+                    params.set(k, String(v));
+                }
+                finalUrl = `${fullUrl}?${params.toString()}`;
+              }
+              const resp = await fetch(finalUrl, fetchOptions);
+              responseStatus = resp.status;
+              const ct = resp.headers.get("content-type") || "";
+              if (ct.includes("application/json")) {
+                try {
+                  responseBody = await resp.json();
+                } catch {
+                  responseBody = null;
+                }
+              } else {
+                responseBody = await resp.text();
               }
-            } else {
-              responseBody = await resp.text();
+              const in2xx = (s) => s >= 200 && s < 300;
+              stepPassed = resp.status === expectedStatus || in2xx(resp.status) && in2xx(expectedStatus) || (step.continueOnStatus || []).includes(resp.status);
+              if (stepPassed)
+                break;
+            } catch (err) {
+              stepPassed = false;
+              errorMsg = err.message || String(err);
             }
-            stepPassed = resp.status === expectedStatus || resp.status >= 200 && resp.status < 300 && expectedStatus >= 200 && expectedStatus < 300;
-          } catch (err) {
-            stepPassed = false;
-            errorMsg = err.message || String(err);
           }
           const responseCaptured = stepPassed ? await this.captureToMemory(step.capture, responseBody) : [];
           if (!stepPassed) {
             allPassed = false;
+            const onFailure = step.onFailure ?? "abort";
+            stepResults.push({
+              stepIndex: i + 1,
+              name: step.name || `${step.method} ${step.path}`,
+              method: step.method,
+              path: step.path,
+              targetUrl: fullUrl,
+              expectedStatus,
+              actualStatus: responseStatus,
+              durationMs: Date.now() - stepStartTime,
+              passed: false,
+              skipped: false,
+              retryCount: attempts - 1,
+              failureHandling: onFailure === "continue" ? "continued" : "aborted",
+              requestHeaders: injectedHeaders,
+              requestBody: finalBody,
+              responseBody,
+              capturedMemory: [...inputCaptured],
+              error: errorMsg
+            });
+            if (onFailure === "abort")
+              break;
+            continue;
           }
           stepResults.push({
             stepIndex: i + 1,
@@ -268045,16 +268104,14 @@ var require_workflow_simulator = __commonJS({
             expectedStatus,
             actualStatus: responseStatus,
             durationMs: Date.now() - stepStartTime,
-            passed: stepPassed,
+            passed: true,
+            skipped: false,
+            retryCount: attempts - 1,
             requestHeaders: injectedHeaders,
             requestBody: finalBody,
             responseBody,
-            capturedMemory: [...inputCaptured, ...responseCaptured],
-            error: errorMsg
+            capturedMemory: [...inputCaptured, ...responseCaptured]
           });
-          if (!stepPassed) {
-            break;
-          }
         }
         const totalTimeMs = Date.now() - startTime;
         return {
@@ -268078,6 +268135,32 @@ var require_workflow_simulator = __commonJS({
           results: stepResults
         };
       }
+      // ── Condition evaluator ────────────────────────────────────────────────────
+      // Resolves the `if` template and applies the declared operator. Returns
+      // `matched: true` when the condition passes (step should execute).
+      async evaluateCondition(condition) {
+        const evaluated = await this.resolveTemplateString(condition.if);
+        let matched;
+        if (condition.exists !== void 0) {
+          const hasValue = evaluated !== "" && evaluated !== "null" && evaluated !== "undefined";
+          matched = condition.exists ? hasValue : !hasValue;
+        } else if (condition.equals !== void 0) {
+          matched = evaluated === condition.equals;
+        } else if (condition.notEquals !== void 0) {
+          matched = evaluated !== condition.notEquals;
+        } else if (condition.contains !== void 0) {
+          matched = evaluated.includes(condition.contains);
+        } else if (condition.greaterThan !== void 0) {
+          matched = Number(evaluated) > condition.greaterThan;
+        } else if (condition.lessThan !== void 0) {
+          matched = Number(evaluated) < condition.lessThan;
+        } else if (condition.in !== void 0) {
+          matched = condition.in.includes(evaluated);
+        } else {
+          matched = evaluated !== "" && evaluated !== "false" && evaluated !== "0" && evaluated !== "null" && evaluated !== "undefined";
+        }
+        return { matched, evaluated };
+      }
       async resolveTemplateString(value) {
         const templateRe = /\{\{([^}]+)\}\}/g;
         let match;
@@ -269549,28 +269632,47 @@ var require_workflow_authoring_tools = __commonJS({
     var path7 = __importStar(require("path"));
     var types_1 = require_types();
     var workflow_tools_1 = require_workflow_tools();
+    var stepConditionSchema = zod_1.z.object({
+      if: zod_1.z.string().min(1).describe('Template expression to resolve, e.g. "{{workflow:role}}"'),
+      equals: zod_1.z.string().optional().describe("Resolved value must equal this string"),
+      notEquals: zod_1.z.string().optional().describe("Resolved value must NOT equal this string"),
+      contains: zod_1.z.string().optional().describe("Resolved value must contain this substring"),
+      exists: zod_1.z.boolean().optional().describe("true: value must be non-empty; false: value must be empty"),
+      greaterThan: zod_1.z.number().optional().describe("Numeric greater-than comparison"),
+      lessThan: zod_1.z.number().optional().describe("Numeric less-than comparison"),
+      in: zod_1.z.array(zod_1.z.string()).optional().describe("Resolved value must be one of these strings")
+    }).describe("Skip this step when the condition is not met");
+    var stepRetrySchema = zod_1.z.object({
+      times: zod_1.z.number().int().positive().max(10).describe("Max retry attempts (1\u201310)"),
+      delayMs: zod_1.z.number().int().nonnegative().optional().describe("Delay between retries in ms (default 0)")
+    });
     exports2.workflowStepSchema = zod_1.z.object({
       name: zod_1.z.string().min(1).describe("Step name (must be unique within the workflow)"),
       method: zod_1.z.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "OPTIONS", "HEAD"]).describe("HTTP method"),
       path: zod_1.z.string().min(1).describe("Route path; :params resolve from body/memory (NOT from {{templates}} \u2014 those only work in body/inject)"),
       description: zod_1.z.string().optional().describe("What this step does"),
-      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}}, {{workflow:key}} and {{human:key}} templates (human pauses for interactive input at runtime)"),
-      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Memory/header injection: "header:Name" or "body:field" (or bare header name) -> "scope:key" or "{{template}}" ({{human:key}} supported)'),
-      capture: zod_1.z.record(zod_1.z.string()).optional().describe('Save RESPONSE fields to memory: "scope:key" -> "dot.path.in.response"'),
-      captureInput: zod_1.z.record(zod_1.z.string()).optional().describe('Save REQUEST body fields to memory BEFORE sending: "scope:key" -> "bodyField"'),
-      expectStatus: zod_1.z.number().int().positive().optional().describe("Expected HTTP status (default 200; any 2xx passes when expecting 2xx)")
+      body: zod_1.z.record(zod_1.z.any()).optional().describe("Request payload. Values support {{faker.*}}, {{scope:key}}, {{workflow:key}} and {{human:key}} templates"),
+      inject: zod_1.z.record(zod_1.z.string()).optional().describe('Header/body injection: "header:Name" or "body:field" \u2192 "scope:key" or "{{template}}"'),
+      capture: zod_1.z.record(zod_1.z.string()).optional().describe('Save RESPONSE fields to memory: "scope:key" \u2192 "dot.path.in.response"'),
+      captureInput: zod_1.z.record(zod_1.z.string()).optional().describe('Save REQUEST body fields to memory BEFORE sending: "scope:key" \u2192 "bodyField"'),
+      expectStatus: zod_1.z.number().int().positive().optional().describe("Expected HTTP status (default 200; any 2xx passes when expecting 2xx)"),
+      condition: stepConditionSchema.optional().describe('Skip this step when condition is not met. Use {{workflow:key}} in the "if" field.'),
+      onFailure: zod_1.z.enum(["abort", "continue"]).optional().describe('"abort" (default): stop the workflow on failure. "continue": log failure and proceed (captures skipped).'),
+      continueOnStatus: zod_1.z.array(zod_1.z.number().int()).optional().describe("Additional HTTP status codes treated as pass for this step (e.g. [404])."),
+      retry: stepRetrySchema.optional().describe("Retry on failure \u2014 overrides the workflow-level global retry.")
       // NOTE: .passthrough() is intentional — unknown keys must REACH the validator
-      // (MODEL_DIALECT_KEY / UNKNOWN_STEP_KEY diagnostics). Zod's default strip
+      // (MODEL_DIALECT_KEY / UNKNOWN_STEP_KEY diagnostics). Zod’s default strip
       // behavior would silently swallow the exact mistakes we need to report.
     }).passthrough();
     var inlineWorkflowSchema = zod_1.z.object({
       name: zod_1.z.string().min(1).describe("Workflow name (also used to derive the file slug)"),
       description: zod_1.z.string().optional(),
       environment: zod_1.z.string().optional().describe("Target environment name from the model (e.g. local)"),
+      retry: stepRetrySchema.optional().describe("Global retry default applied to all steps (overridden per step)"),
       steps: zod_1.z.array(exports2.workflowStepSchema).min(1).describe("Ordered steps; later steps can use memory captured by earlier ones")
     }).passthrough();
     var TEMPLATE_RE = /\{\{\s*([^}]+?)\s*\}\}/g;
-    var KNOWN_WORKFLOW_KEYS = /* @__PURE__ */ new Set(["name", "description", "environment", "steps", "generatedAt"]);
+    var KNOWN_WORKFLOW_KEYS = /* @__PURE__ */ new Set(["name", "description", "environment", "steps", "generatedAt", "retry"]);
     var KNOWN_STEP_KEYS = /* @__PURE__ */ new Set([
       "name",
       "method",
@@ -269581,7 +269683,10 @@ var require_workflow_authoring_tools = __commonJS({
       "captureInput",
       "expectStatus",
       "body",
-      "condition"
+      "condition",
+      "onFailure",
+      "continueOnStatus",
+      "retry"
     ]);
     var MODEL_DIALECT_KEYS = /* @__PURE__ */ new Set(["call", "auth", "bind"]);
     function err(list, stepIndex, stepName, code, message, fix) {
@@ -269677,8 +269782,41 @@ var require_workflow_authoring_tools = __commonJS({
             warn(warnings, stepNo, sName, "UNKNOWN_STEP_KEY", `Step ${stepNo} has unknown key "${key}" which the simulator ignores.`, "Remove it or check the field name (valid: name, method, path, description, body, inject, capture, captureInput, expectStatus).");
           }
         }
-        if ("condition" in step) {
-          warn(warnings, stepNo, sName, "CONDITION_IGNORED", `"condition" is accepted but currently ignored by the simulator \u2014 the step always runs.`, "Encode branching as separate workflows, or gate with expectStatus per step.");
+        if ("condition" in step && step.condition !== void 0) {
+          const cond = step.condition;
+          if (!cond || typeof cond !== "object" || Array.isArray(cond)) {
+            err(errors, stepNo, sName, "BAD_CONDITION", `Step ${stepNo} "condition" must be an object.`, 'Use { "condition": { "if": "{{workflow:role}}", "equals": "admin" } }.');
+          } else if (!cond.if || typeof cond.if !== "string" || !cond.if.trim()) {
+            err(errors, stepNo, sName, "BAD_CONDITION", `Step ${stepNo} "condition" must have a non-empty "if" field.`, 'Set "if" to a template expression like "{{workflow:role}}".');
+          } else {
+            const operators = ["equals", "notEquals", "contains", "exists", "greaterThan", "lessThan", "in"];
+            const usedOps = operators.filter((op) => op in cond && cond[op] !== void 0);
+            if (usedOps.length === 0) {
+              warn(warnings, stepNo, sName, "CONDITION_NO_OPERATOR", `Step ${stepNo} "condition" has no comparison operator \u2014 uses bare truthy check.`, "Add one of: equals, notEquals, contains, exists, greaterThan, lessThan, in for explicit logic.");
+            }
+            if (!/\{\{[^}]+\}\}/.test(cond.if)) {
+              warn(warnings, stepNo, sName, "CONDITION_BARE_IF", `Step ${stepNo} "condition.if" ("${cond.if}") contains no {{template}} and will be compared literally.`, "Use {{workflow:key}} or {{scope:key}} to reference captured memory values.");
+            }
+            const condRefs = [];
+            collectTemplateRefs(cond.if, condRefs);
+            for (const ref of condRefs) {
+              if (ref.startsWith("faker."))
+                continue;
+              if (!ref.includes(":"))
+                continue;
+              const { scope, key } = splitMemKey(ref);
+              if (!key)
+                continue;
+              if (scope === "human") {
+                humanKeys.add(key);
+                continue;
+              }
+              const full = `${scope}:${key}`;
+              if (!defined.has(full) && !persistedMemory.has(full)) {
+                err(errors, stepNo, sName, "UNDEFINED_MEMORY_REF", `"{{${ref}}}" in condition.if of step ${stepNo} is not captured by any earlier step and is not in memory.json.`, `Capture "${full}" in an earlier step before referencing it in a condition.`);
+              }
+            }
+          }
         }
         if (!sName || !sName.trim()) {
           err(errors, stepNo, void 0, "STEP_MISSING_NAME", `Step ${stepNo} needs a non-empty "name".`, "Give every step a unique descriptive name.");
@@ -269804,6 +269942,40 @@ var require_workflow_authoring_tools = __commonJS({
             }
           }
         }
+        if (step.onFailure !== void 0) {
+          if (!["abort", "continue"].includes(String(step.onFailure))) {
+            err(errors, stepNo, sName, "BAD_ON_FAILURE", `Step ${stepNo} "onFailure" must be "abort" or "continue" (got "${step.onFailure}").`, 'Use "abort" (default, stops the workflow) or "continue" (logs failure, proceeds).');
+          }
+          if (step.onFailure === "continue" && step.capture && Object.keys(step.capture).length > 0) {
+            warn(warnings, stepNo, sName, "CONTINUE_WITH_CAPTURE", `Step ${stepNo} uses onFailure:"continue" but has captures \u2014 captures are only saved when the step passes.`, "This is usually fine for optional captures; ensure later steps handle missing memory gracefully.");
+          }
+        }
+        if (step.continueOnStatus !== void 0) {
+          if (!Array.isArray(step.continueOnStatus)) {
+            err(errors, stepNo, sName, "BAD_CONTINUE_ON_STATUS", `Step ${stepNo} "continueOnStatus" must be an array of HTTP status codes.`, "Use [404] or [404, 409].");
+          } else {
+            for (const code of step.continueOnStatus) {
+              if (typeof code !== "number" || code < 100 || code > 599) {
+                err(errors, stepNo, sName, "BAD_CONTINUE_ON_STATUS", `Step ${stepNo} "continueOnStatus" contains invalid status code: ${code}.`, "HTTP status codes must be integers between 100 and 599.");
+              }
+            }
+            if (step.continueOnStatus.some((c3) => c3 >= 500)) {
+              warn(warnings, stepNo, sName, "CONTINUE_ON_5XX", `Step ${stepNo} "continueOnStatus" includes 5xx server error codes \u2014 accepting server errors as pass is unusual.`, "Verify this is intentional (e.g. for idempotency checks or async polling).");
+            }
+          }
+        }
+        if (step.retry !== void 0) {
+          const r = step.retry;
+          if (!r || typeof r !== "object" || Array.isArray(r)) {
+            err(errors, stepNo, sName, "BAD_RETRY", `Step ${stepNo} "retry" must be an object { times, delayMs? }.`, 'Use { "retry": { "times": 3, "delayMs": 1000 } }.');
+          } else {
+            if (typeof r.times !== "number" || r.times < 1) {
+              err(errors, stepNo, sName, "BAD_RETRY", `Step ${stepNo} "retry.times" must be a positive integer.`, "Set retry.times to 1 or more.");
+            } else if (r.times > 5) {
+              warn(warnings, stepNo, sName, "HIGH_RETRY_COUNT", `Step ${stepNo} "retry.times" is ${r.times} \u2014 this may slow down workflows significantly.`, "Keep retry.times \u2264 5 for most use cases.");
+            }
+          }
+        }
         for (const field of ["capture", "captureInput"]) {
           const cap = step[field];
           if (cap && typeof cap === "object" && !Array.isArray(cap)) {
@@ -284410,6 +284582,284 @@ var require_session_tools = __commonJS({
   }
 });
 
+// ../../packages/mcp-server/dist/tools/workflow-designer-tools.js
+var require_workflow_designer_tools = __commonJS({
+  "../../packages/mcp-server/dist/tools/workflow-designer-tools.js"(exports2) {
+    "use strict";
+    init_cjs_shims();
+    Object.defineProperty(exports2, "__esModule", { value: true });
+    exports2.scaffoldWorkflowSchema = void 0;
+    exports2.handleScaffoldWorkflow = handleScaffoldWorkflow;
+    var zod_1 = require("zod");
+    var types_1 = require_types();
+    function fieldToFakerValue(name, field) {
+      if (field.enum && field.enum.length > 0)
+        return field.enum[0];
+      if (field.format === "email")
+        return "{{faker.internet.email}}";
+      if (field.format === "uuid")
+        return "{{faker.string.uuid}}";
+      if (field.format === "date")
+        return "{{faker.date.past}}";
+      if (field.format === "date-time")
+        return "{{faker.date.recent}}";
+      if (field.format === "uri" || field.format === "url")
+        return "{{faker.internet.url}}";
+      if (field.format === "hostname")
+        return "{{faker.internet.domainName}}";
+      if (field.format === "ipv4")
+        return "{{faker.internet.ip}}";
+      const n = name.toLowerCase().replace(/[_-]/g, "");
+      if (n === "email" || n.endsWith("email"))
+        return "{{faker.internet.email}}";
+      if (n.includes("password") || n.includes("pwd"))
+        return "{{faker.internet.password}}";
+      if (n === "phone" || n.includes("phone") || n.includes("mobile"))
+        return "{{faker.phone.number}}";
+      if (n === "name" || n === "fullname" || n === "displayname")
+        return "{{faker.person.fullName}}";
+      if (n === "firstname")
+        return "{{faker.person.firstName}}";
+      if (n === "lastname")
+        return "{{faker.person.lastName}}";
+      if (n === "username")
+        return "{{faker.internet.username}}";
+      if (n === "title")
+        return "{{faker.lorem.sentence}}";
+      if (n === "description" || n === "bio" || n === "summary")
+        return "{{faker.lorem.paragraph}}";
+      if (n === "url" || n.endsWith("url") || n === "avatar")
+        return "{{faker.internet.url}}";
+      if (n === "company" || n.includes("company") || n.includes("organization") || n.includes("workspace"))
+        return "{{faker.company.name}}";
+      if (n === "city")
+        return "{{faker.location.city}}";
+      if (n === "country")
+        return "{{faker.location.country}}";
+      if (n.includes("address"))
+        return "{{faker.location.streetAddress}}";
+      if (n === "zip" || n === "zipcode" || n.includes("postal"))
+        return "{{faker.location.zipCode}}";
+      if (n === "state" || n === "province")
+        return "{{faker.location.state}}";
+      if (n === "latitude" || n === "lat")
+        return "{{faker.location.latitude}}";
+      if (n === "longitude" || n === "lon" || n === "lng")
+        return "{{faker.location.longitude}}";
+      if (n === "color" || n === "colour")
+        return "{{faker.color.human}}";
+      if (n === "amount" || n === "price")
+        return field.min ?? 1;
+      if (n === "quantity" || n === "count" || n === "limit")
+        return field.min ?? 10;
+      if (n === "slug")
+        return "{{faker.lorem.slug}}";
+      if (n === "token" || n === "secret" || n === "key" || n === "otp" || n === "code" || n === "pin")
+        return null;
+      if (field.type === "string")
+        return "{{faker.lorem.word}}";
+      if (field.type === "number" || field.type === "integer")
+        return field.min ?? 1;
+      if (field.type === "boolean")
+        return true;
+      return null;
+    }
+    function tokenMemoryKey(schemeName, fieldPath) {
+      const last = fieldPath.split(".").pop() || schemeName;
+      return last.charAt(0).toLowerCase() + last.slice(1);
+    }
+    function isReuseCandidate(name) {
+      const n = name.toLowerCase().replace(/[_-]/g, "");
+      return ["email", "password", "username", "phone", "name", "id", "slug"].some((k) => n === k || n.endsWith(k));
+    }
+    exports2.scaffoldWorkflowSchema = zod_1.z.object({
+      projectPath: zod_1.z.string().optional().describe("Path to project root or .jetic folder"),
+      endpoints: zod_1.z.array(zod_1.z.union([
+        zod_1.z.string().describe('Method + path string, e.g. "POST /api/auth/login"'),
+        zod_1.z.object({ method: zod_1.z.string(), path: zod_1.z.string() })
+      ])).min(1).describe("ORDERED list of endpoints to scaffold into steps. Order matters: token-producer endpoints (e.g. login) must come before consumers (e.g. protected routes)."),
+      workflowName: zod_1.z.string().optional().describe("Suggested workflow name"),
+      environment: zod_1.z.string().optional().describe("Target environment name from model")
+    });
+    function handleScaffoldWorkflow(args) {
+      const { model } = (0, types_1.loadModel)(args.projectPath);
+      const requested = args.endpoints.map((ep) => {
+        if (typeof ep === "string") {
+          const parts = ep.trim().split(/\s+/);
+          return { method: (parts[0] || "GET").toUpperCase(), path: parts.slice(1).join(" ") || "/" };
+        }
+        return { method: ep.method.toUpperCase(), path: ep.path };
+      });
+      const securityMemKeys = {};
+      for (const [schemeName, scheme] of Object.entries(model.securitySchemes || {})) {
+        if (scheme.obtainedFrom) {
+          securityMemKeys[schemeName] = {
+            memKey: tokenMemoryKey(schemeName, scheme.obtainedFrom.field),
+            producedByEndpoint: scheme.obtainedFrom.endpoint.toUpperCase().trim(),
+            fieldPath: scheme.obtainedFrom.field
+          };
+        }
+      }
+      const tokenProducers = {};
+      for (const si of Object.values(securityMemKeys)) {
+        if (!tokenProducers[si.producedByEndpoint])
+          tokenProducers[si.producedByEndpoint] = [];
+        tokenProducers[si.producedByEndpoint].push({ memKey: si.memKey, fieldPath: si.fieldPath });
+      }
+      const draftSteps = [];
+      const missingFields = {};
+      const allHumanKeys = /* @__PURE__ */ new Set();
+      const securityChain = [];
+      const producedKeys = /* @__PURE__ */ new Set();
+      for (let idx = 0; idx < requested.length; idx++) {
+        const req = requested[idx];
+        const routeKey = `${req.method} ${req.path}`;
+        const routeKeyNorm = routeKey.toUpperCase().trim();
+        const endpoint = (model.endpoints || []).find((e) => e.method.toUpperCase() === req.method && e.path === req.path);
+        if (!endpoint) {
+          draftSteps.push({
+            name: routeKey,
+            method: req.method,
+            path: req.path,
+            description: `WARNING: "${routeKey}" not found in model.json \u2014 add it with jetic_add_endpoint first.`,
+            expectStatus: 200
+          });
+          missingFields[routeKey] = [`Endpoint "${routeKey}" not found in model.json.`];
+          continue;
+        }
+        const step = {
+          name: endpoint.name || routeKey,
+          method: req.method,
+          path: endpoint.path
+        };
+        if (endpoint.description)
+          step.description = endpoint.description;
+        const missing = [];
+        if (endpoint.requestBody?.fields && Object.keys(endpoint.requestBody.fields).length > 0) {
+          const body = {};
+          for (const [fname, fdef] of Object.entries(endpoint.requestBody.fields)) {
+            let fromMem = null;
+            if (endpoint.consumes) {
+              for (const c3 of endpoint.consumes) {
+                if (c3.usedAs === fname || c3.variable === fname) {
+                  const k = `workflow:${c3.variable}`;
+                  if (producedKeys.has(k)) {
+                    fromMem = k;
+                    break;
+                  }
+                }
+              }
+            }
+            if (!fromMem) {
+              for (const pk of producedKeys) {
+                const pkName = pk.split(":").pop() || "";
+                if (pkName.toLowerCase() === fname.toLowerCase()) {
+                  fromMem = pk;
+                  break;
+                }
+              }
+            }
+            if (fromMem) {
+              body[fname] = `{{${fromMem}}}`;
+              continue;
+            }
+            const val = fieldToFakerValue(fname, fdef);
+            if (val !== null) {
+              body[fname] = val;
+            } else {
+              body[fname] = `{{human:${fname}}}`;
+              allHumanKeys.add(fname);
+              missing.push(`"${fname}" (type: ${fdef.type || "unknown"}) \u2014 no auto-mapping. Using {{human:${fname}}} (will pause for interactive input at runtime).`);
+            }
+          }
+          step.body = body;
+          const ci = {};
+          for (const [fname, fdef] of Object.entries(endpoint.requestBody.fields)) {
+            if (fdef.required && isReuseCandidate(fname)) {
+              const k = `workflow:${fname}`;
+              if (!producedKeys.has(k)) {
+                ci[k] = fname;
+                producedKeys.add(k);
+              }
+            }
+          }
+          if (Object.keys(ci).length > 0)
+            step.captureInput = ci;
+        }
+        if (endpoint.security && endpoint.security.length > 0) {
+          const inject = {};
+          for (const sec of endpoint.security) {
+            if (sec.scheme === "none")
+              continue;
+            const si = securityMemKeys[sec.scheme];
+            if (!si) {
+              missing.push(`Security scheme "${sec.scheme}" has no obtainedFrom in model.securitySchemes \u2014 add inject manually.`);
+              continue;
+            }
+            const tokenKey = `workflow:${si.memKey}`;
+            const available = producedKeys.has(tokenKey) || requested.slice(0, idx).some((r) => `${r.method} ${r.path}`.toUpperCase().trim() === si.producedByEndpoint);
+            if (available) {
+              const rawScheme = model.securitySchemes?.[sec.scheme];
+              const prefix = rawScheme?.valuePrefix != null ? rawScheme.valuePrefix : rawScheme?.scheme?.toLowerCase() === "bearer" ? "Bearer " : "";
+              inject["header:Authorization"] = `${prefix}{{${tokenKey}}}`;
+              securityChain.push(`Step ${idx + 1} (${routeKey}) \u2190 inject ${tokenKey} (produced by ${si.producedByEndpoint})`);
+            } else {
+              missing.push(`Security scheme "${sec.scheme}" requires "${tokenKey}" from "${si.producedByEndpoint}" \u2014 place that endpoint earlier in the list.`);
+            }
+          }
+          if (Object.keys(inject).length > 0)
+            step.inject = inject;
+        }
+        const capture = {};
+        if (endpoint.produces) {
+          for (const p of endpoint.produces) {
+            if (p.variable && p.responseField) {
+              const k = `workflow:${p.variable}`;
+              capture[k] = p.responseField;
+              producedKeys.add(k);
+            }
+          }
+        }
+        if (tokenProducers[routeKeyNorm]) {
+          for (const { memKey, fieldPath } of tokenProducers[routeKeyNorm]) {
+            const k = `workflow:${memKey}`;
+            if (!capture[k]) {
+              capture[k] = fieldPath;
+              producedKeys.add(k);
+              securityChain.push(`Step ${idx + 1} (${routeKey}) \u2192 produces ${k} from response.${fieldPath}`);
+            }
+          }
+        }
+        if (Object.keys(capture).length > 0)
+          step.capture = capture;
+        const codes = Object.keys(endpoint.responses || {}).map(Number).filter(Boolean);
+        const successCode = codes.find((c3) => c3 >= 200 && c3 < 300);
+        step.expectStatus = successCode ?? 200;
+        if (missing.length > 0)
+          missingFields[routeKey] = missing;
+        draftSteps.push(step);
+      }
+      const defaultName = args.workflowName || requested.map((r) => r.path.split("/").filter(Boolean).pop() || r.path).join(" \u2192 ") + " workflow";
+      return {
+        workflowName: defaultName,
+        ...args.environment ? { environment: args.environment } : {},
+        draftSteps,
+        stepsCount: draftSteps.length,
+        missingFields: Object.keys(missingFields).length > 0 ? missingFields : void 0,
+        humanKeys: [...allHumanKeys].sort(),
+        securityChain: securityChain.length > 0 ? securityChain : void 0,
+        instructions: [
+          "1. Review draftSteps. Resolve any missingFields entries before proceeding.",
+          "2. humanKeys will pause the workflow at runtime for interactive input \u2014 they are intentional when needed.",
+          '3. Validate: jetic_validate_workflow { definition: { name: "<workflowName>", steps: <draftSteps> } }',
+          '4. Save:     jetic_create_workflow { name: "<workflowName>", steps: <draftSteps> }',
+          '5. Run:      jetic_simulate_workflow { workflow: "<slug>" }'
+        ].join("\n")
+      };
+    }
+  }
+});
+
 // ../../packages/mcp-server/dist/server.js
 var require_server3 = __commonJS({
   "../../packages/mcp-server/dist/server.js"(exports2) {
@@ -284471,6 +284921,7 @@ var require_server3 = __commonJS({
     var workflow_authoring_tools_1 = require_workflow_authoring_tools();
     var project_tools_1 = require_project_tools();
     var session_tools_1 = require_session_tools();
+    var workflow_designer_tools_1 = require_workflow_designer_tools();
     exports2.JETIC_MCP_SERVER_NAME = "jetic-mcp-server";
     function getJeticMcpVersion() {
       try {
@@ -284492,7 +284943,7 @@ var require_server3 = __commonJS({
       "\u2501\u2501 PHASE 2 \u2014 SCAN \u2501\u2501",
       "Populate the model with endpoints:",
       "  \u2022 Express+TypeScript (tsconfig.json present): call `jetic_scan` (static, keyless, no AI provider needed).",
-      "  \u2022 Any other stack or scan gaps: read the source code and call `jetic_add_endpoint` for every route (include middleware chains, security, constraints, pagination, produces/consumes).",
+      "  \u2022 Any other stack or scan gaps: read source code and call `jetic_add_endpoint` for every route (middleware chains, security, constraints, pagination, produces/consumes).",
       "Gate: DO NOT advance to Phase 3 until endpointsCount > 0.",
       "",
       "\u2501\u2501 PHASE 3 \u2014 VERIFY \u2501\u2501",
@@ -284501,14 +284952,55 @@ var require_server3 = __commonJS({
       "  \u2022 Add at least one `tag` per endpoint.",
       "  \u2022 Add `description` to every parameter.",
       "  \u2022 Add `description` to every response status code.",
-      "Use `jetic_update_endpoint` to fill gaps. Call `jetic_verify_model` again after each batch of updates.",
+      "Use `jetic_update_endpoint` to fill gaps. Call `jetic_verify_model` again after each batch.",
       "Gate: DO NOT advance to Phase 4 until jetic_get_session_phase returns phase=4 (modelIsValid AND allFieldsFilled both true).",
       "",
       "\u2501\u2501 PHASE 4 \u2014 SIMULATE \u2501\u2501",
-      'STOP. Ask the user: "What simulation or workflow do you want to build?"',
-      "Wait for their explicit answer. Then and only then: author the workflow with `jetic_validate_workflow` (dry run) \u2192 `jetic_create_workflow` \u2192 `jetic_simulate_workflow`.",
-      "Chain steps using capture/captureInput (producer) + inject or {{workflow:key}} (consumer). Use {{human:key}} ONLY for values unknowable beforehand (OTP codes, real secrets).",
-      "Never start Phase 4 without an explicit user-specified goal.",
+      'STOP. Ask the user: "What simulation or workflow do you want to build or test?"',
+      "Wait for their explicit answer. Then follow these sub-steps IN ORDER:",
+      "",
+      "STEP 4a \u2014 SCAFFOLD",
+      "  Call `jetic_scaffold_workflow` with the ORDERED list of endpoints the user wants to exercise.",
+      "  It reads model.json and returns `draftSteps` with:",
+      "    \u2022 body derived from requestBody.fields (faker-mapped by type / format / field name)",
+      "    \u2022 inject derived from securitySchemes.obtainedFrom (token producer \u2192 consumer chain)",
+      "    \u2022 capture derived from endpoint.produces",
+      "    \u2022 captureInput for required fields that later steps will reuse",
+      "  Review draftSteps. Fix any `missingFields` entries before proceeding.",
+      "",
+      "STEP 4b \u2014 HUMAN INPUT PROTOCOL",
+      "  Use {{human:key}} ONLY when the value is truly unknowable before runtime:",
+      "    \u2022 One-time secrets: OTP codes, 2FA tokens, CAPTCHA answers",
+      "    \u2022 Real credentials that must be typed at execution time",
+      "  NEVER use {{human:key}} for things faker can generate (emails, names, UUIDs, passwords).",
+      "  The scaffold tool already handles faker mapping \u2014 only override to {{human:key}} when a",
+      "  field appears in missingFields AND genuinely requires interactive user input.",
+      "",
+      "STEP 4c \u2014 CONDITIONS (branching / skipping steps)",
+      "  Add `condition` to skip a step when a memory value does not match:",
+      '    { "condition": { "if": "{{workflow:userRole}}", "equals": "admin" } }',
+      "  Operators: equals, notEquals, contains, exists (bool), greaterThan, lessThan, in (string[]).",
+      "  Skipped steps count as passed \u2014 the workflow continues.",
+      '  Pair with onFailure:"continue" for negative/branching flows.',
+      "",
+      "STEP 4d \u2014 FAILURE MODES & RETRY",
+      "  onFailure (per step):",
+      '    \u2022 "abort" (default) \u2014 stop the workflow on first failure',
+      '    \u2022 "continue" \u2014 log the failure and proceed (captures are skipped for that step)',
+      "  continueOnStatus (per step): extra codes treated as pass, e.g. [404] or [409].",
+      "  retry (per step OR workflow-level global default):",
+      '    \u2022 { "times": 3, "delayMs": 1000 } \u2014 retries up to 3\xD7 with 1 s between each attempt',
+      "    \u2022 Per-step retry overrides the workflow-level default. Keep times \u2264 5.",
+      "",
+      "STEP 4e \u2014 VALIDATE (dry run, no save)",
+      '  jetic_validate_workflow { "definition": { "name": "...", "steps": [...] } }',
+      "  Fix all errors. Warnings are informational.",
+      "",
+      "STEP 4f \u2014 SAVE",
+      '  jetic_create_workflow { "name": "...", "steps": [...] }',
+      "",
+      "STEP 4g \u2014 RUN",
+      '  jetic_simulate_workflow { "workflow": "<slug>" }',
       "",
       "\u2501\u2501 GENERAL RULES \u2501\u2501",
       "No AI-provider setup is needed: never ask for OpenRouter/OpenAI keys and never use `jetic config ai`.",
@@ -284576,8 +285068,9 @@ var require_server3 = __commonJS({
       register("jetic_list_workflows", "List workflows", "Lists multi-step integration test workflows from .jetic/workflows/*.json, .jetic/workflow.json, or embedded model.json workflows.", workflow_tools_1.listWorkflowsSchema.shape, READ_ONLY, workflow_tools_1.handleListWorkflows);
       register("jetic_simulate_workflow", "Simulate workflow", "Executes a full end-to-end multi-step workflow simulation with dynamic memory capture, header injection, and schema validation against the live server.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
       register("jetic_simulate", "Simulate workflow (alias)", "Alias of jetic_simulate_workflow: runs a multi-step user-journey workflow against the live server. Prefer jetic_simulate_workflow in new prompts.", workflow_tools_1.simulateWorkflowSchema.shape, READ_LIVE, workflow_tools_1.handleSimulateWorkflow);
-      register("jetic_validate_workflow", "Validate workflow", "Deep-validates a workflow WITHOUT saving or running it: step structure, endpoint cross-checks against model.json, and memory data-flow analysis (every {{scope:key}} except {{human:key}} must be captured by an earlier step). Accepts a saved workflow reference or an inline definition for pre-save dry runs.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
-      register("jetic_create_workflow", "Create workflow", "Creates a .jetic/workflows/<slug>.json workflow from ordered steps with capture/inject memory chaining. Refuses to save when validation errors exist (error messages say exactly how to fix); use validateOnly for a dry run. Can also migrate an embedded model.json workflow via fromModelWorkflow.", workflow_authoring_tools_1.createWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleCreateWorkflow);
+      register("jetic_scaffold_workflow", "Scaffold workflow steps from model", "PHASE 4a \u2014 FIRST STEP when building a workflow. Given an ordered endpoint list, reads model.json and returns ready-made `draftSteps`: body fields faker-mapped by type/format/name, inject derived from securitySchemes.obtainedFrom token-producer chains, capture from endpoint.produces, captureInput for reusable credentials. Returns missingFields (fields needing human input or manual fix) and securityChain analysis. Does NOT save. Review draftSteps, then call jetic_validate_workflow \u2192 jetic_create_workflow.", workflow_designer_tools_1.scaffoldWorkflowSchema.shape, READ_ONLY, workflow_designer_tools_1.handleScaffoldWorkflow);
+      register("jetic_validate_workflow", "Validate workflow (dry run)", "Deep-validates a workflow WITHOUT saving: step structure, endpoint cross-checks against model.json, full memory data-flow analysis. Now also validates condition (including condition.if template refs), onFailure, continueOnStatus, and retry fields. Accepts a saved workflow slug/name or an inline definition.", workflow_authoring_tools_1.validateWorkflowSchema.shape, READ_ONLY, workflow_authoring_tools_1.handleValidateWorkflow);
+      register("jetic_create_workflow", "Create workflow", "Creates a .jetic/workflows/<slug>.json workflow. Supports: condition (skip steps based on memory), onFailure (abort|continue), continueOnStatus (extra pass codes), retry (per-step or global default). Refuses to save on validation errors.", workflow_authoring_tools_1.createWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleCreateWorkflow);
       register("jetic_update_workflow", "Update workflow", "Updates a saved file workflow: rename, description/environment, full steps replacement, or appendSteps. Validates before writing and refuses to save on errors.", workflow_authoring_tools_1.updateWorkflowSchema.shape, WRITES_MODEL, workflow_authoring_tools_1.handleUpdateWorkflow);
       register("jetic_delete_workflow", "Delete workflow", "Deletes a saved .jetic/workflows/*.json workflow file by slug, name, or path. Destructive: confirm with the user before calling. Cannot delete model.json-embedded workflows.", workflow_authoring_tools_1.deleteWorkflowSchema.shape, DESTRUCTIVE, workflow_authoring_tools_1.handleDeleteWorkflow);
       return server;
@@ -287476,7 +287969,7 @@ var mcpCommand = new import_commander10.Command("mcp").description("Launch Model
 
 // src/index.ts
 var program = new import_commander11.Command();
-program.name("jetic").description("AI-Native API Behavior Testing").version("0.2.1");
+program.name("jetic").description("AI-Native API Behavior Testing").version("0.2.3");
 program.addCommand(initCommand);
 program.addCommand(scanCommand);
 program.addCommand(inspectCommand);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jetic-cli",
-  "version": "0.2.1",
+  "version": "0.2.3",
   "description": "AI-Native API Behavior Testing & Discovery Tool — CLI and Local Studio Dashboard",
   "main": "dist/index.js",
   "bin": {