@skyramp/mcp 0.0.63 → 0.0.64-rc.2

package/build/utils/scenarioDrafting.js

@@ -4,18 +4,123 @@
  * resources) with token budget (each scenario adds ~15-20 lines to the prompt).
  */
 const MAX_DRAFTED_SCENARIOS_PER_CATEGORY = 4;
-const ACTION_PATTERN = /^(me|merge|archive|search|login|logout|verify|forgot|reset|config|dashboard|webhook|migration|favicon|payment|health|status|ping|metrics|callback|confirm|activate|deactivate|subscribe|unsubscribe)$/i;
+const ACTION_PATTERN = /^(me|merge|archive|search|login|logout|verify|forgot|reset|config|dashboard|webhook|migration|favicon|payment|health|status|ping|metrics|callback|confirm|activate|deactivate|subscribe|unsubscribe|unknown)$/i;
 const ACTION_VERB_HYPHEN = /^(forgot-|reset-|verify-|confirm-|send-|check-|get-|set-|update-|delete-|create-|trigger-|start-|stop-)/i;
 export function isRealResource(r) {
     return !ACTION_PATTERN.test(r) && !ACTION_VERB_HYPHEN.test(r);
 }
-export function draftScenariosFromEndpoints(endpoints) {
+const SKIP_SEGMENTS = new Set(["api", "v1", "v2", "v3", "public"]);
+/**
+ * Convert a plural resource name to its singular form for use in field names
+ * and step descriptions.
+ *
+ * Handles the most common irregular plurals found in REST API paths:
+ *   -ies → -y  (categories → category, companies → company)
+ *   -ses → -s  (statuses → status, classes → class)
+ * Falls back to removing the trailing "s" for regular plurals.
+ */
+function singularize(word) {
+    if (word.endsWith("ies") && word.length > 3) {
+        return word.slice(0, -3) + "y";
+    }
+    if (word.endsWith("ses") && word.length > 4) {
+        return word.slice(0, -2); // statuses → status
+    }
+    return word.endsWith("s") && word.length > 1 ? word.slice(0, -1) : word;
+}
+/**
+ * Extract the primary resource name from an endpoint path.
+ * E.g. "/api/v1/flow-costs/{cost_id}" → "flow-costs"
+ *      "/collections/{id}/links"      → "links"
+ */
+function extractResourceName(path) {
+    const segments = path.split("/").filter(Boolean);
+    const nonParam = segments.filter(s => !s.startsWith("{") && !SKIP_SEGMENTS.has(s));
+    const name = nonParam[nonParam.length - 1];
+    return name && isRealResource(name) ? name : null;
+}
+/**
+ * Infer parent→child resource relationships from two signals already present
+ * in the endpoint data — no source code scanning required.
+ *
+ * Signal 1 — path nesting (always available):
+ *   /collections/{id}/links  →  links depends on collections
+ *
+ * Signal 2 — request body FK fields (available when trace data is merged):
+ *   POST /orders body: { product_id: "..." }  →  orders depends on products
+ *
+ * Returns a map of `dependent → Set<parent>`. Only confirmed, real-resource
+ * pairs are included. When no signal is found the map is empty, which tells
+ * the caller to fall back to heuristic pairing.
+ */
+export function inferResourceRelationships(endpoints) {
+    const relationships = new Map();
+    const addRelationship = (dependent, parent) => {
+        if (dependent === parent)
+            return;
+        if (!isRealResource(dependent) || !isRealResource(parent))
+            return;
+        const deps = relationships.get(dependent) ?? new Set();
+        deps.add(parent);
+        relationships.set(dependent, deps);
+    };
+    // ── Signal 1: path nesting ──
+    // Pattern: /…/parentResource/{param}/childResource
+    for (const ep of endpoints) {
+        const segments = ep.path.split("/").filter(Boolean);
+        for (let i = 0; i + 2 < segments.length; i++) {
+            const seg = segments[i];
+            const paramSeg = segments[i + 1];
+            const childSeg = segments[i + 2];
+            if (!seg.startsWith("{") &&
+                paramSeg.startsWith("{") &&
+                !childSeg.startsWith("{") &&
+                !SKIP_SEGMENTS.has(seg) &&
+                !SKIP_SEGMENTS.has(childSeg)) {
+                addRelationship(childSeg, seg);
+            }
+        }
+    }
+    // ── Signal 2: FK fields in request body interactions ──
+    // Collect all known resource names first so we can validate FK targets.
+    const knownResources = new Set(endpoints.map(ep => extractResourceName(ep.path)).filter(Boolean));
+    for (const ep of endpoints) {
+        const resource = extractResourceName(ep.path);
+        if (!resource)
+            continue;
+        for (const m of ep.methods) {
+            if (typeof m === "string")
+                continue;
+            if (!["POST", "PUT", "PATCH"].includes(m.method))
+                continue;
+            for (const interaction of m.interactions ?? []) {
+                const body = interaction.request?.body;
+                if (!body || typeof body !== "object")
+                    continue;
+                for (const key of Object.keys(body)) {
+                    if (!key.endsWith("_id"))
+                        continue;
+                    const depSingular = key.slice(0, -3); // "product_id" → "product"
+                    const depPlural = depSingular + "s"; // → "products"
+                    // Only create relationship when the dependency actually exists as an endpoint
+                    if (knownResources.has(depPlural)) {
+                        addRelationship(resource, depPlural);
+                    }
+                    else if (knownResources.has(depSingular)) {
+                        addRelationship(resource, depSingular);
+                    }
+                }
+            }
+        }
+    }
+    return relationships;
+}
+export function draftScenariosFromEndpoints(endpoints, newEndpoints = []) {
     const scenarios = [];
     const resourceGroups = new Map();
     for (const ep of endpoints) {
         const segments = ep.path.split("/").filter(Boolean);
-        const skipSet = new Set(["api", "v1", "v2", "v3", "public"]);
-        const nonParamSegs = segments.filter(s => !s.startsWith("{") && !skipSet.has(s));
+        const nonParamSegs = segments.filter(s => !s.startsWith("{") && !SKIP_SEGMENTS.has(s));
         const resource = nonParamSegs[nonParamSegs.length - 1] || "unknown";
         const hasParam = /\{/.test(ep.path);
         const resourceSegIdx = segments.lastIndexOf(resource);
@@ -43,6 +148,9 @@ export function draftScenariosFromEndpoints(endpoints) {
             });
         }
     }
+    // ── Cross-resource integration scenarios ──
+    const relationships = inferResourceRelationships(endpoints);
+    const hasRelationships = relationships.size > 0;
     const creatableResources = Array.from(resourceGroups.keys()).filter(r => isRealResource(r) && resourceGroups.get(r).methods.has("POST"));
     const MAX_CROSS_RESOURCE = Math.min(Math.max(3, Math.floor(creatableResources.length / 2)), 8);
     let crossCount = 0;
@@ -50,58 +158,37 @@ export function draftScenariosFromEndpoints(endpoints) {
         for (let j = i + 1; j < creatableResources.length && crossCount < MAX_CROSS_RESOURCE; j++) {
             const r1 = creatableResources[i];
             const r2 = creatableResources[j];
-            const g1 = resourceGroups.get(r1);
-            const g2 = resourceGroups.get(r2);
-            const steps = [];
-            let order = 1;
-            const singular1 = r1.replace(/s$/, "");
-            const singular2 = r2.replace(/s$/, "");
-            steps.push({
-                order: order++, method: "POST", path: g1.basePath,
-                description: `Create a ${singular1}`,
-                interactionType: "success", expectedStatusCode: 201,
-            });
-            steps.push({
-                order: order++, method: "POST", path: g2.basePath,
-                description: `Create a ${singular2} referencing the ${singular1}`,
-                interactionType: "success", expectedStatusCode: 201,
-                chainsFrom: { sourceStep: 1, sourceField: `${singular1}_id`, sourceLocation: "body", targetParam: `${singular1}_id`, targetLocation: "body" },
-            });
-            if (g2.paramPath && g2.methods.has("GET")) {
-                steps.push({
-                    order: order++, method: "GET", path: g2.paramPath,
-                    description: `Verify the ${singular2} references the correct ${singular1}`,
-                    interactionType: "success", expectedStatusCode: 200,
-                });
+            if (hasRelationships) {
+                // Only pair resources with a detected relationship; skip unrelated ones.
+                const r2DependsOnR1 = relationships.get(r2)?.has(r1) || relationships.get(r2)?.has(singularize(r1));
+                const r1DependsOnR2 = relationships.get(r1)?.has(r2) || relationships.get(r1)?.has(singularize(r2));
+                if (!r2DependsOnR1 && !r1DependsOnR2)
+                    continue;
+                // Use relationship direction: parent is the one that doesn't depend on the other.
+                const [parent, child] = r2DependsOnR1 ? [r1, r2] : [r2, r1];
+                const gParent = resourceGroups.get(parent);
+                const gChild = resourceGroups.get(child);
+                const singularParent = singularize(parent);
+                const singularChild = singularize(child);
+                scenarios.push(buildCrossResourceScenario(parent, child, gParent, gChild, singularParent, singularChild));
             }
-            if (g2.paramPath && g2.methods.has("DELETE")) {
-                steps.push({
-                    order: order++, method: "DELETE", path: g2.paramPath,
-                    description: `Clean up: delete the ${singular2}`,
-                    interactionType: "success", expectedStatusCode: 204,
-                });
+            else {
+                // No relationship signals found — fall back to sequential pairing (existing behaviour).
+                const g1 = resourceGroups.get(r1);
+                const g2 = resourceGroups.get(r2);
+                scenarios.push(buildCrossResourceScenario(r1, r2, g1, g2, singularize(r1), singularize(r2)));
             }
-            scenarios.push({
-                scenarioName: `${r1}-${r2}-integration`,
-                description: `Multi-resource integration: create ${singular1}, create ${singular2} linked to it, verify, clean up`,
-                category: "workflow",
-                priority: "high",
-                steps,
-                chainingKeys: [`${singular1}_id`, `${singular2}_id`, "id"],
-                requiresAuth: true,
-                estimatedComplexity: "complex",
-                source: "code-inferred",
-            });
             crossCount++;
         }
     }
+    // ── CRUD lifecycle scenarios ──
     for (const [resource, group] of resourceGroups) {
         const m = group.methods;
         if (!m.has("POST") || !m.has("GET") || !isRealResource(resource))
             continue;
         const steps = [];
         let order = 1;
-        const singular = resource.replace(/s$/, "");
+        const singular = singularize(resource);
         steps.push({ order: order++, method: "POST", path: group.basePath, description: `Create a new ${singular}`, interactionType: "success", expectedStatusCode: 201 });
         if (group.paramPath)
             steps.push({ order: order++, method: "GET", path: group.paramPath, description: `Get the created ${singular} by ID`, interactionType: "success", expectedStatusCode: 200 });
@@ -119,13 +206,56 @@ export function draftScenariosFromEndpoints(endpoints) {
             requiresAuth: true,
             estimatedComplexity: "moderate",
             source: "code-inferred",
+            testType: "integration",
         });
     }
     scenarios.push(...draftUniqueConstraintScenarios(resourceGroups));
-    scenarios.push(...draftCascadeDeleteScenarios(resourceGroups));
+    scenarios.push(...draftCascadeDeleteScenarios(resourceGroups, relationships));
     scenarios.push(...draftPermissionBoundaryScenarios(resourceGroups));
+    scenarios.push(...draftDiffDirectScenarios(newEndpoints, resourceGroups));
     return scenarios;
 }
+function buildCrossResourceScenario(parent, child, gParent, gChild, singularParent, singularChild) {
+    const steps = [];
+    let order = 1;
+    steps.push({
+        order: order++, method: "POST", path: gParent.basePath,
+        description: `Create a ${singularParent}`,
+        interactionType: "success", expectedStatusCode: 201,
+    });
+    steps.push({
+        order: order++, method: "POST", path: gChild.basePath,
+        description: `Create a ${singularChild} referencing the ${singularParent}`,
+        interactionType: "success", expectedStatusCode: 201,
+        chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
+    });
+    if (gChild.paramPath && gChild.methods.has("GET")) {
+        steps.push({
+            order: order++, method: "GET", path: gChild.paramPath,
+            description: `Verify the ${singularChild} references the correct ${singularParent}`,
+            interactionType: "success", expectedStatusCode: 200,
+        });
+    }
+    if (gChild.paramPath && gChild.methods.has("DELETE")) {
+        steps.push({
+            order: order++, method: "DELETE", path: gChild.paramPath,
+            description: `Clean up: delete the ${singularChild}`,
+            interactionType: "success", expectedStatusCode: 204,
+        });
+    }
+    return {
+        scenarioName: `${parent}-${child}-integration`,
+        description: `Multi-resource integration: create ${singularParent}, create ${singularChild} linked to it, verify, clean up`,
+        category: "workflow",
+        priority: "high",
+        steps,
+        chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
+        requiresAuth: true,
+        estimatedComplexity: "complex",
+        source: "code-inferred",
+        testType: "integration",
+    };
+}
 export function draftUniqueConstraintScenarios(resourceGroups) {
     const scenarios = [];
     for (const [resource, group] of resourceGroups) {
@@ -133,7 +263,7 @@ export function draftUniqueConstraintScenarios(resourceGroups) {
             break;
         if (!group.methods.has("POST") || !isRealResource(resource))
             continue;
-        const singular = resource.replace(/s$/, "");
+        const singular = singularize(resource);
         scenarios.push({
             scenarioName: `${resource}-unique-constraint`,
             description: `Verify unique constraint: create ${singular}, attempt duplicate creation, expect 409 Conflict`,
@@ -160,25 +290,41 @@ export function draftUniqueConstraintScenarios(resourceGroups) {
             requiresAuth: true,
             estimatedComplexity: "moderate",
             source: "code-inferred",
+            testType: "integration",
         });
     }
     return scenarios;
 }
-export function draftCascadeDeleteScenarios(resourceGroups) {
+export function draftCascadeDeleteScenarios(resourceGroups, relationships = new Map()) {
     const scenarios = [];
-    const creatableResources = Array.from(resourceGroups.keys())
-        .filter(r => isRealResource(r) && resourceGroups.get(r).methods.has("POST") && resourceGroups.get(r).methods.has("DELETE"));
-    for (let i = 0; i < creatableResources.length; i++) {
-        for (let j = i + 1; j < creatableResources.length; j++) {
-            const parent = creatableResources[i];
-            const child = creatableResources[j];
+    const hasRelationships = relationships.size > 0;
+    const deletableResources = Array.from(resourceGroups.keys()).filter(r => isRealResource(r) && resourceGroups.get(r).methods.has("POST") && resourceGroups.get(r).methods.has("DELETE"));
+    for (let i = 0; i < deletableResources.length; i++) {
+        for (let j = i + 1; j < deletableResources.length; j++) {
+            if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
+                break;
+            const r1 = deletableResources[i];
+            const r2 = deletableResources[j];
+            // Determine relationship direction: which is parent, which is child?
+            let parent, child;
+            if (hasRelationships) {
+                const r2DependsOnR1 = relationships.get(r2)?.has(r1) || relationships.get(r2)?.has(singularize(r1));
+                const r1DependsOnR2 = relationships.get(r1)?.has(r2) || relationships.get(r1)?.has(singularize(r2));
+                if (!r2DependsOnR1 && !r1DependsOnR2)
+                    continue; // no detected relationship — skip
+                [parent, child] = r2DependsOnR1 ? [r1, r2] : [r2, r1];
+            }
+            else {
+                // Fallback: treat first as parent (existing behaviour)
+                [parent, child] = [r1, r2];
+            }
             const gParent = resourceGroups.get(parent);
             const gChild = resourceGroups.get(child);
             if (!gParent.paramPath || !gChild.paramPath)
                 continue;
-            const singularParent = parent.replace(/s$/, "");
-            const singularChild = child.replace(/s$/, "");
-            // Scenario A: cascade delete succeeds — child is removed with parent
+            const singularParent = singularize(parent);
+            const singularChild = singularize(child);
+            // Scenario A: cascade delete — parent delete removes child
             scenarios.push({
                 scenarioName: `${parent}-${child}-cascade-delete`,
                 description: `Verify cascade delete: create ${singularParent}, create ${singularChild} referencing it, delete ${singularParent}, verify ${singularChild} is also deleted`,
@@ -211,43 +357,45 @@ export function draftCascadeDeleteScenarios(resourceGroups) {
                 requiresAuth: true,
                 estimatedComplexity: "complex",
                 source: "code-inferred",
+                testType: "integration",
             });
             // Scenario B: delete blocked by referential integrity — parent cannot be removed while children exist
-            scenarios.push({
-                scenarioName: `${parent}-${child}-delete-blocked`,
-                description: `Verify referential integrity: create ${singularParent} with ${singularChild}, attempt to delete ${singularParent}, expect rejection (409/422), verify ${singularChild} is intact`,
-                category: "data_integrity",
-                priority: "high",
-                steps: [
-                    {
-                        order: 1, method: "POST", path: gParent.basePath,
-                        description: `Create a ${singularParent}`,
-                        interactionType: "success", expectedStatusCode: 201,
-                    },
-                    {
-                        order: 2, method: "POST", path: gChild.basePath,
-                        description: `Create a ${singularChild} referencing the ${singularParent}`,
-                        interactionType: "success", expectedStatusCode: 201,
-                        chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
-                    },
-                    {
-                        order: 3, method: "DELETE", path: gParent.paramPath,
-                        description: `Attempt to delete the ${singularParent} — expect 409 Conflict or 422 if referential integrity blocks it`,
-                        interactionType: "error", expectedStatusCode: 409,
-                    },
-                    {
-                        order: 4, method: "GET", path: gChild.paramPath,
-                        description: `Verify ${singularChild} is still intact after blocked delete — expect 200`,
-                        interactionType: "success", expectedStatusCode: 200,
-                    },
-                ],
-                chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
-                requiresAuth: true,
-                estimatedComplexity: "complex",
-                source: "code-inferred",
-            });
-            if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
-                break;
+            if (scenarios.length < MAX_DRAFTED_SCENARIOS_PER_CATEGORY) {
+                scenarios.push({
+                    scenarioName: `${parent}-${child}-delete-blocked`,
+                    description: `Verify referential integrity: create ${singularParent} with ${singularChild}, attempt to delete ${singularParent}, expect rejection (409/422), verify ${singularChild} is intact`,
+                    category: "data_integrity",
+                    priority: "high",
+                    steps: [
+                        {
+                            order: 1, method: "POST", path: gParent.basePath,
+                            description: `Create a ${singularParent}`,
+                            interactionType: "success", expectedStatusCode: 201,
+                        },
+                        {
+                            order: 2, method: "POST", path: gChild.basePath,
+                            description: `Create a ${singularChild} referencing the ${singularParent}`,
+                            interactionType: "success", expectedStatusCode: 201,
+                            chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
+                        },
+                        {
+                            order: 3, method: "DELETE", path: gParent.paramPath,
+                            description: `Attempt to delete the ${singularParent} — expect 409 Conflict or 422 if referential integrity blocks it`,
+                            interactionType: "error", expectedStatusCode: 409,
+                        },
+                        {
+                            order: 4, method: "GET", path: gChild.paramPath,
+                            description: `Verify ${singularChild} is still intact after blocked delete — expect 200`,
+                            interactionType: "success", expectedStatusCode: 200,
+                        },
+                    ],
+                    chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
+                    requiresAuth: true,
+                    estimatedComplexity: "complex",
+                    source: "code-inferred",
+                    testType: "integration",
+                });
+            }
         }
         if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
             break;
@@ -261,7 +409,7 @@ export function draftPermissionBoundaryScenarios(resourceGroups) {
             break;
         if (!isRealResource(resource))
             continue;
-        const singular = resource.replace(/s$/, "");
+        const singular = singularize(resource);
         const protectedMethods = ["POST", "PUT", "PATCH", "DELETE"].filter(m => group.methods.has(m));
         if (protectedMethods.length === 0)
             continue;
@@ -283,6 +431,7 @@ export function draftPermissionBoundaryScenarios(resourceGroups) {
             requiresAuth: false,
             estimatedComplexity: "simple",
             source: "code-inferred",
+            testType: "contract",
         });
         if (group.paramPath && group.methods.has("GET") && group.methods.has("POST") && scenarios.length < MAX_DRAFTED_SCENARIOS_PER_CATEGORY) {
             scenarios.push({
@@ -306,8 +455,184 @@ export function draftPermissionBoundaryScenarios(resourceGroups) {
                 requiresAuth: true,
                 estimatedComplexity: "moderate",
                 source: "code-inferred",
+                testType: "integration",
+            });
+        }
+    }
+    return scenarios;
+}
+// ── Diff-direct scenario drafting ──
+// Generates targeted scenarios for each new endpoint in the branch diff.
+// These get category "new_endpoint" which maps to the CRITICAL priority tier
+// in the scorer, so they always fill the GENERATE slots before any structural
+// scenario — aligning the plan with what the LLM naturally wants to do anyway.
+/**
+ * Build the minimum steps for a diff-direct integration scenario.
+ * Prerequisite resources (e.g. POST /products before POST /orders) are NOT
+ * computed here — the execution plan instructs the LLM to discover them from
+ * source code (FK fields in request bodies) and prepend the steps itself.
+ */
+function diffDirectIntegration(method, resource, singular, group) {
+    const steps = [];
+    if (method === "POST") {
+        steps.push({
+            order: 1, method: "POST", path: group.basePath,
+            description: `Create a ${singular} — verify 201 and response fields`,
+            interactionType: "success", expectedStatusCode: 201,
+        });
+        if (group.paramPath && group.methods.has("GET")) {
+            steps.push({
+                order: 2, method: "GET", path: group.paramPath,
+                description: `Get the created ${singular} — verify fields match`,
+                interactionType: "success", expectedStatusCode: 200,
+                chainsFrom: { sourceStep: 1, sourceField: "id", sourceLocation: "body", targetParam: `${singular}_id`, targetLocation: "path" },
+            });
+        }
+    }
+    else {
+        // PUT/PATCH/DELETE: create the resource first so it exists
+        if (group.methods.has("POST")) {
+            steps.push({
+                order: 1, method: "POST", path: group.basePath,
+                description: `Create a ${singular} to be ${method === "DELETE" ? "deleted" : "updated"}`,
+                interactionType: "success", expectedStatusCode: 201,
             });
         }
+        const targetPath = group.paramPath ?? group.basePath;
+        const sourceStep = steps.length; // 1 if create step exists, 0 otherwise
+        steps.push({
+            order: steps.length + 1, method, path: targetPath,
+            description: method === "DELETE"
+                ? `DELETE the ${singular} — expect 204 No Content`
+                : `${method} the ${singular} with valid data — verify updated response fields`,
+            interactionType: "success", expectedStatusCode: method === "DELETE" ? 204 : 200,
+            ...(sourceStep > 0 ? { chainsFrom: { sourceStep, sourceField: "id", sourceLocation: "body", targetParam: `${singular}_id`, targetLocation: "path" } } : {}),
+        });
+        if (method === "DELETE" && group.paramPath && group.methods.has("GET")) {
+            steps.push({
+                order: steps.length + 1, method: "GET", path: group.paramPath,
+                description: `Verify the ${singular} is gone — expect 404`,
+                interactionType: "error", expectedStatusCode: 404,
+            });
+        }
+    }
+    const suffix = method === "DELETE" ? "delete" : method.toLowerCase();
+    return {
+        scenarioName: `${resource}-${suffix}-new-endpoint-happy-path`,
+        description: `New endpoint happy path: discover prerequisites from source code, then ${steps.map(s => `${s.method} ${s.path}`).join(" → ")}`,
+        category: "new_endpoint",
+        priority: "high",
+        steps,
+        chainingKeys: ["id", `${singular}_id`],
+        requiresAuth: true,
+        estimatedComplexity: "complex",
+        source: "code-inferred",
+        testType: "integration",
+    };
+}
+function diffDirectContract(method, path, resource) {
+    const expectedStatus = method === "POST" ? 201 : method === "DELETE" ? 204 : 200;
+    return {
+        scenarioName: `${resource}-${method.toLowerCase()}-new-endpoint-contract`,
+        description: `Contract: ${method} ${path} returns a schema-conformant response`,
+        category: "new_endpoint",
+        priority: "high",
+        steps: [{ order: 1, method, path, description: `${method} ${path} with valid input — verify response schema`, interactionType: "success", expectedStatusCode: expectedStatus }],
+        chainingKeys: [],
+        requiresAuth: true,
+        estimatedComplexity: "simple",
+        source: "code-inferred",
+        testType: "contract",
+    };
+}
+function diffDirectNotFound(method, path, resource, singular) {
+    return {
+        scenarioName: `${resource}-${method.toLowerCase()}-new-endpoint-not-found`,
+        description: `Edge case: ${method} ${path} with a non-existent ${singular} ID returns 404`,
+        category: "new_endpoint",
+        priority: "high",
+        steps: [{ order: 1, method, path, description: `${method} ${path} with non-existent ${singular} ID — expect 404 Not Found`, interactionType: "error", expectedStatusCode: 404 }],
+        chainingKeys: [],
+        requiresAuth: true,
+        estimatedComplexity: "simple",
+        source: "code-inferred",
+        testType: "contract",
+    };
+}
+function diffDirectValidation(method, path, resource) {
+    return {
+        scenarioName: `${resource}-${method.toLowerCase()}-new-endpoint-validation`,
+        description: `Validation: ${method} ${path} with missing required fields returns 422`,
+        category: "new_endpoint",
+        priority: "high",
+        steps: [{ order: 1, method, path, description: `${method} ${path} with empty/missing required fields — expect 422`, interactionType: "error", expectedStatusCode: 422 }],
+        chainingKeys: [],
+        requiresAuth: true,
+        estimatedComplexity: "simple",
+        source: "code-inferred",
+        testType: "contract",
+    };
+}
+/**
+ * Draft scenarios that directly test each new endpoint in the branch diff.
+ *
+ * For each new endpoint, up to 3 scenarios are produced:
+ *   PUT/PATCH  → integration happy path (prereqs + create + PUT), contract, not-found
+ *   POST       → integration happy path (prereqs + POST + verify GET), contract, validation error
+ *   DELETE     → integration lifecycle (create → DELETE → verify 404), contract
+ *   GET /{id}  → contract, not-found
+ *
+ * All carry category "new_endpoint" → CRITICAL priority tier so they always
+ * rank above structural candidates and occupy the GENERATE slots.
+ */
+export function draftDiffDirectScenarios(newEndpoints, resourceGroups) {
+    if (newEndpoints.length === 0)
+        return [];
+    const scenarios = [];
+    const seen = new Set();
+    // Group flat list by path
+    const grouped = new Map();
+    for (const ep of newEndpoints) {
+        const methods = grouped.get(ep.path) ?? new Set();
+        methods.add(ep.method.toUpperCase());
+        grouped.set(ep.path, methods);
+    }
+    for (const [epPath, methods] of grouped) {
+        const resource = extractResourceName(epPath);
+        if (!resource)
+            continue;
+        const group = resourceGroups.get(resource);
+        if (!group)
+            continue;
+        const singular = singularize(resource);
+        const hasPathParam = epPath.includes("{");
+        const add = (s) => {
+            if (!seen.has(s.scenarioName)) {
+                seen.add(s.scenarioName);
+                scenarios.push(s);
+            }
+        };
+        for (const method of methods) {
+            if (method === "PUT" || method === "PATCH") {
+                add(diffDirectIntegration(method, resource, singular, group));
+                add(diffDirectContract(method, epPath, resource));
+                if (hasPathParam)
+                    add(diffDirectNotFound(method, epPath, resource, singular));
+            }
+            else if (method === "POST") {
+                add(diffDirectIntegration(method, resource, singular, group));
+                add(diffDirectContract(method, epPath, resource));
+                add(diffDirectValidation(method, epPath, resource));
+            }
+            else if (method === "DELETE") {
+                add(diffDirectIntegration(method, resource, singular, group));
+                add(diffDirectContract(method, epPath, resource));
+            }
+            else if (method === "GET" && hasPathParam) {
+                add(diffDirectContract(method, epPath, resource));
+                add(diffDirectNotFound(method, epPath, resource, singular));
+            }
+        }
     }
     return scenarios;
 }