@skyramp/mcp 0.0.65 → 0.1.0-rc.2

package/build/utils/scenarioDrafting.js

@@ -1,3 +1,6 @@
+import { ScenarioSource } from "../types/RepositoryAnalysis.js";
+import { TestType } from "../types/TestTypes.js";
+import { CATEGORY_PRIORITY } from "../types/TestRecommendation.js";
 /**
  * Cap on drafted scenarios per category to prevent prompt bloat on large APIs.
  * Value of 4 balances coverage breadth (enough to surface patterns across
@@ -148,318 +151,44 @@ export function draftScenariosFromEndpoints(endpoints, newEndpoints = []) {
             });
         }
     }
-    // ── Cross-resource integration scenarios ──
-    const relationships = inferResourceRelationships(endpoints);
-    const hasRelationships = relationships.size > 0;
-    const creatableResources = Array.from(resourceGroups.keys()).filter(r => isRealResource(r) && resourceGroups.get(r).methods.has("POST"));
-    const MAX_CROSS_RESOURCE = Math.min(Math.max(3, Math.floor(creatableResources.length / 2)), 8);
-    let crossCount = 0;
-    for (let i = 0; i < creatableResources.length && crossCount < MAX_CROSS_RESOURCE; i++) {
-        for (let j = i + 1; j < creatableResources.length && crossCount < MAX_CROSS_RESOURCE; j++) {
-            const r1 = creatableResources[i];
-            const r2 = creatableResources[j];
-            if (hasRelationships) {
-                // Only pair resources with a detected relationship; skip unrelated ones.
-                const r2DependsOnR1 = relationships.get(r2)?.has(r1) || relationships.get(r2)?.has(singularize(r1));
-                const r1DependsOnR2 = relationships.get(r1)?.has(r2) || relationships.get(r1)?.has(singularize(r2));
-                if (!r2DependsOnR1 && !r1DependsOnR2)
-                    continue;
-                // Use relationship direction: parent is the one that doesn't depend on the other.
-                const [parent, child] = r2DependsOnR1 ? [r1, r2] : [r2, r1];
-                const gParent = resourceGroups.get(parent);
-                const gChild = resourceGroups.get(child);
-                const singularParent = singularize(parent);
-                const singularChild = singularize(child);
-                scenarios.push(buildCrossResourceScenario(parent, child, gParent, gChild, singularParent, singularChild));
-            }
-            else {
-                // No relationship signals found — fall back to sequential pairing (existing behaviour).
-                const g1 = resourceGroups.get(r1);
-                const g2 = resourceGroups.get(r2);
-                scenarios.push(buildCrossResourceScenario(r1, r2, g1, g2, singularize(r1), singularize(r2)));
-            }
-            crossCount++;
-        }
-    }
-    // ── CRUD lifecycle scenarios ──
-    for (const [resource, group] of resourceGroups) {
-        const m = group.methods;
-        if (!m.has("POST") || !m.has("GET") || !isRealResource(resource))
-            continue;
-        const steps = [];
-        let order = 1;
-        const singular = singularize(resource);
-        steps.push({ order: order++, method: "POST", path: group.basePath, description: `Create a new ${singular}`, interactionType: "success", expectedStatusCode: 201 });
-        if (group.paramPath)
-            steps.push({ order: order++, method: "GET", path: group.paramPath, description: `Get the created ${singular} by ID`, interactionType: "success", expectedStatusCode: 200 });
-        if ((m.has("PUT") || m.has("PATCH")) && group.paramPath)
-            steps.push({ order: order++, method: m.has("PUT") ? "PUT" : "PATCH", path: group.paramPath, description: `Update the ${singular}`, interactionType: "success", expectedStatusCode: 200 });
-        if (m.has("DELETE") && group.paramPath)
-            steps.push({ order: order++, method: "DELETE", path: group.paramPath, description: `Delete the ${singular}`, interactionType: "success", expectedStatusCode: 204 });
-        scenarios.push({
-            scenarioName: `${resource}-crud-lifecycle`,
-            description: `CRUD lifecycle for ${resource}: create, read, update, delete`,
-            category: "crud",
-            priority: "medium",
-            steps,
-            chainingKeys: ["id", `${singular}_id`],
-            requiresAuth: true,
-            estimatedComplexity: "moderate",
-            source: "code-inferred",
-            testType: "integration",
-        });
-    }
-    scenarios.push(...draftUniqueConstraintScenarios(resourceGroups));
-    scenarios.push(...draftCascadeDeleteScenarios(resourceGroups, relationships));
-    scenarios.push(...draftPermissionBoundaryScenarios(resourceGroups));
     scenarios.push(...draftDiffDirectScenarios(newEndpoints, resourceGroups));
-    return scenarios;
+    return capScenarios(scenarios);
 }
-function buildCrossResourceScenario(parent, child, gParent, gChild, singularParent, singularChild) {
-    const steps = [];
-    let order = 1;
-    steps.push({
-        order: order++, method: "POST", path: gParent.basePath,
-        description: `Create a ${singularParent}`,
-        interactionType: "success", expectedStatusCode: 201,
-    });
-    steps.push({
-        order: order++, method: "POST", path: gChild.basePath,
-        description: `Create a ${singularChild} referencing the ${singularParent}`,
-        interactionType: "success", expectedStatusCode: 201,
-        chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
-    });
-    if (gChild.paramPath && gChild.methods.has("GET")) {
-        steps.push({
-            order: order++, method: "GET", path: gChild.paramPath,
-            description: `Verify the ${singularChild} references the correct ${singularParent}`,
-            interactionType: "success", expectedStatusCode: 200,
-        });
-    }
-    if (gChild.paramPath && gChild.methods.has("DELETE")) {
-        steps.push({
-            order: order++, method: "DELETE", path: gChild.paramPath,
-            description: `Clean up: delete the ${singularChild}`,
-            interactionType: "success", expectedStatusCode: 204,
-        });
-    }
-    return {
-        scenarioName: `${parent}-${child}-integration`,
-        description: `Multi-resource integration: create ${singularParent}, create ${singularChild} linked to it, verify, clean up`,
-        category: "workflow",
-        priority: "high",
-        steps,
-        chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
-        requiresAuth: true,
-        estimatedComplexity: "complex",
-        source: "code-inferred",
-        testType: "integration",
-    };
-}
-export function draftUniqueConstraintScenarios(resourceGroups) {
-    const scenarios = [];
-    for (const [resource, group] of resourceGroups) {
-        if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
-            break;
-        if (!group.methods.has("POST") || !isRealResource(resource))
-            continue;
-        const singular = singularize(resource);
-        scenarios.push({
-            scenarioName: `${resource}-unique-constraint`,
-            description: `Verify unique constraint: create ${singular}, attempt duplicate creation, expect 409 Conflict`,
-            category: "business_rule",
-            priority: "high",
-            steps: [
-                {
-                    order: 1, method: "POST", path: group.basePath,
-                    description: `Create a ${singular} with unique fields`,
-                    interactionType: "success", expectedStatusCode: 201,
-                },
-                {
-                    order: 2, method: "POST", path: group.basePath,
-                    description: `Attempt to create a duplicate ${singular} with the same unique fields — expect 409 Conflict`,
-                    interactionType: "error", expectedStatusCode: 409,
-                },
-                ...(group.paramPath && group.methods.has("GET") ? [{
-                        order: 3, method: "GET", path: group.paramPath,
-                        description: `Verify the original ${singular} is unchanged after duplicate attempt`,
-                        interactionType: "success", expectedStatusCode: 200,
-                    }] : []),
-            ],
-            chainingKeys: ["id", `${singular}_id`],
-            requiresAuth: true,
-            estimatedComplexity: "moderate",
-            source: "code-inferred",
-            testType: "integration",
-        });
-    }
-    return scenarios;
-}
-export function draftCascadeDeleteScenarios(resourceGroups, relationships = new Map()) {
-    const scenarios = [];
-    const hasRelationships = relationships.size > 0;
-    const deletableResources = Array.from(resourceGroups.keys()).filter(r => isRealResource(r) && resourceGroups.get(r).methods.has("POST") && resourceGroups.get(r).methods.has("DELETE"));
-    for (let i = 0; i < deletableResources.length; i++) {
-        for (let j = i + 1; j < deletableResources.length; j++) {
-            if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
-                break;
-            const r1 = deletableResources[i];
-            const r2 = deletableResources[j];
-            // Determine relationship direction: which is parent, which is child?
-            let parent, child;
-            if (hasRelationships) {
-                const r2DependsOnR1 = relationships.get(r2)?.has(r1) || relationships.get(r2)?.has(singularize(r1));
-                const r1DependsOnR2 = relationships.get(r1)?.has(r2) || relationships.get(r1)?.has(singularize(r2));
-                if (!r2DependsOnR1 && !r1DependsOnR2)
-                    continue; // no detected relationship — skip
-                [parent, child] = r2DependsOnR1 ? [r1, r2] : [r2, r1];
-            }
-            else {
-                // Fallback: treat first as parent (existing behaviour)
-                [parent, child] = [r1, r2];
-            }
-            const gParent = resourceGroups.get(parent);
-            const gChild = resourceGroups.get(child);
-            if (!gParent.paramPath || !gChild.paramPath)
-                continue;
-            const singularParent = singularize(parent);
-            const singularChild = singularize(child);
-            // Scenario A: cascade delete — parent delete removes child
-            scenarios.push({
-                scenarioName: `${parent}-${child}-cascade-delete`,
-                description: `Verify cascade delete: create ${singularParent}, create ${singularChild} referencing it, delete ${singularParent}, verify ${singularChild} is also deleted`,
-                category: "data_integrity",
-                priority: "high",
-                steps: [
-                    {
-                        order: 1, method: "POST", path: gParent.basePath,
-                        description: `Create a ${singularParent}`,
-                        interactionType: "success", expectedStatusCode: 201,
-                    },
-                    {
-                        order: 2, method: "POST", path: gChild.basePath,
-                        description: `Create a ${singularChild} referencing the ${singularParent}`,
-                        interactionType: "success", expectedStatusCode: 201,
-                        chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
-                    },
-                    {
-                        order: 3, method: "DELETE", path: gParent.paramPath,
-                        description: `Delete the ${singularParent} — expect 204 if cascade is configured`,
-                        interactionType: "success", expectedStatusCode: 204,
-                    },
-                    {
-                        order: 4, method: "GET", path: gChild.paramPath,
-                        description: `Verify ${singularChild} was cascade-deleted — expect 404`,
-                        interactionType: "error", expectedStatusCode: 404,
-                    },
-                ],
-                chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
-                requiresAuth: true,
-                estimatedComplexity: "complex",
-                source: "code-inferred",
-                testType: "integration",
-            });
-            // Scenario B: delete blocked by referential integrity — parent cannot be removed while children exist
-            if (scenarios.length < MAX_DRAFTED_SCENARIOS_PER_CATEGORY) {
-                scenarios.push({
-                    scenarioName: `${parent}-${child}-delete-blocked`,
-                    description: `Verify referential integrity: create ${singularParent} with ${singularChild}, attempt to delete ${singularParent}, expect rejection (409/422), verify ${singularChild} is intact`,
-                    category: "data_integrity",
-                    priority: "high",
-                    steps: [
-                        {
-                            order: 1, method: "POST", path: gParent.basePath,
-                            description: `Create a ${singularParent}`,
-                            interactionType: "success", expectedStatusCode: 201,
-                        },
-                        {
-                            order: 2, method: "POST", path: gChild.basePath,
-                            description: `Create a ${singularChild} referencing the ${singularParent}`,
-                            interactionType: "success", expectedStatusCode: 201,
-                            chainsFrom: { sourceStep: 1, sourceField: `${singularParent}_id`, sourceLocation: "body", targetParam: `${singularParent}_id`, targetLocation: "body" },
-                        },
-                        {
-                            order: 3, method: "DELETE", path: gParent.paramPath,
-                            description: `Attempt to delete the ${singularParent} — expect 409 Conflict or 422 if referential integrity blocks it`,
-                            interactionType: "error", expectedStatusCode: 409,
-                        },
-                        {
-                            order: 4, method: "GET", path: gChild.paramPath,
-                            description: `Verify ${singularChild} is still intact after blocked delete — expect 200`,
-                            interactionType: "success", expectedStatusCode: 200,
-                        },
-                    ],
-                    chainingKeys: [`${singularParent}_id`, `${singularChild}_id`, "id"],
-                    requiresAuth: true,
-                    estimatedComplexity: "complex",
-                    source: "code-inferred",
-                    testType: "integration",
-                });
-            }
-        }
-        if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
-            break;
-    }
-    return scenarios;
-}
-export function draftPermissionBoundaryScenarios(resourceGroups) {
-    const scenarios = [];
-    for (const [resource, group] of resourceGroups) {
-        if (scenarios.length >= MAX_DRAFTED_SCENARIOS_PER_CATEGORY)
-            break;
-        if (!isRealResource(resource))
-            continue;
-        const singular = singularize(resource);
-        const protectedMethods = ["POST", "PUT", "PATCH", "DELETE"].filter(m => group.methods.has(m));
-        if (protectedMethods.length === 0)
-            continue;
-        const targetMethod = protectedMethods[0];
-        const targetPath = (targetMethod === "POST") ? group.basePath : (group.paramPath || group.basePath);
-        scenarios.push({
-            scenarioName: `${resource}-auth-boundary`,
-            description: `Verify auth boundary: call ${targetMethod} ${resource} without authentication, expect 401 Unauthorized`,
-            category: "security_boundary",
-            priority: "high",
-            steps: [
-                {
-                    order: 1, method: targetMethod, path: targetPath,
-                    description: `Call ${targetMethod} ${targetPath} without authentication — expect 401 Unauthorized`,
-                    interactionType: "error", expectedStatusCode: 401,
-                },
-            ],
-            chainingKeys: [],
-            requiresAuth: false,
-            estimatedComplexity: "simple",
-            source: "code-inferred",
-            testType: "contract",
-        });
-        if (group.paramPath && group.methods.has("GET") && group.methods.has("POST") && scenarios.length < MAX_DRAFTED_SCENARIOS_PER_CATEGORY) {
-            scenarios.push({
-                scenarioName: `${resource}-cross-user-isolation`,
-                description: `Verify cross-user isolation: user A creates ${singular}, user B tries to access it, expect 403 Forbidden`,
-                category: "security_boundary",
-                priority: "high",
-                steps: [
-                    {
-                        order: 1, method: "POST", path: group.basePath,
-                        description: `User A creates a ${singular}`,
-                        interactionType: "success", expectedStatusCode: 201,
-                    },
-                    {
-                        order: 2, method: "GET", path: group.paramPath,
-                        description: `User B attempts to access user A's ${singular} — expect 403 Forbidden`,
-                        interactionType: "error", expectedStatusCode: 403,
-                    },
-                ],
-                chainingKeys: ["id", `${singular}_id`],
-                requiresAuth: true,
-                estimatedComplexity: "moderate",
-                source: "code-inferred",
-                testType: "integration",
-            });
+const MAX_TOTAL_SCENARIOS = 30;
+const TIER_ORDER = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
+/**
+ * Enforce a global cap on drafted scenarios while preserving category diversity.
+ *
+ * 1. CRITICAL (new_endpoint / diff-direct) scenarios prioritized first.
+ * 2. One scenario per non-empty category guaranteed (breadth).
+ * 3. Remaining budget filled by priority tier (HIGH > MEDIUM > LOW).
+ * 4. Hard cap at MAX_TOTAL_SCENARIOS — applied to the combined output.
+ */
+function capScenarios(scenarios) {
+    if (scenarios.length <= MAX_TOTAL_SCENARIOS)
+        return scenarios;
+    const critical = scenarios.filter(s => CATEGORY_PRIORITY[s.category] === "CRITICAL");
+    const rest = scenarios.filter(s => CATEGORY_PRIORITY[s.category] !== "CRITICAL");
+    const breadthPicks = [];
+    const seenCategories = new Set();
+    for (const s of rest) {
+        if (!seenCategories.has(s.category)) {
+            seenCategories.add(s.category);
+            breadthPicks.push(s);
         }
     }
-    return scenarios;
+    const breadthSet = new Set(breadthPicks);
+    const remaining = rest.filter(s => !breadthSet.has(s));
+    remaining.sort((a, b) => {
+        const ta = TIER_ORDER[CATEGORY_PRIORITY[a.category] ?? "LOW"] ?? 1;
+        const tb = TIER_ORDER[CATEGORY_PRIORITY[b.category] ?? "LOW"] ?? 1;
+        return tb - ta;
+    });
+    const budget = MAX_TOTAL_SCENARIOS - critical.length - breadthPicks.length;
+    const filler = remaining.slice(0, Math.max(budget, 0));
+    const combined = [...critical, ...breadthPicks, ...filler];
+    // Enforce the hard cap even if critical set alone exceeds it
+    return combined.slice(0, MAX_TOTAL_SCENARIOS);
 }
 // ── Diff-direct scenario drafting ──
 // Generates targeted scenarios for each new endpoint in the branch diff.
@@ -477,57 +206,53 @@ function diffDirectIntegration(method, resource, singular, group) {
     if (method === "POST") {
         steps.push({
             order: 1, method: "POST", path: group.basePath,
-            description: `Create a ${singular} — verify 201 and response fields`,
+            description: `Create ${singular} and verify response`,
             interactionType: "success", expectedStatusCode: 201,
         });
         if (group.paramPath && group.methods.has("GET")) {
             steps.push({
                 order: 2, method: "GET", path: group.paramPath,
-                description: `Get the created ${singular} — verify fields match`,
+                description: `Retrieve created ${singular} and verify fields`,
                 interactionType: "success", expectedStatusCode: 200,
                 chainsFrom: { sourceStep: 1, sourceField: "id", sourceLocation: "body", targetParam: `${singular}_id`, targetLocation: "path" },
             });
         }
     }
-    else {
-        // PUT/PATCH/DELETE: create the resource first so it exists
+    else if (method === "DELETE") {
         if (group.methods.has("POST")) {
             steps.push({
                 order: 1, method: "POST", path: group.basePath,
-                description: `Create a ${singular} to be ${method === "DELETE" ? "deleted" : "updated"}`,
+                description: `Create ${singular} to delete`,
                 interactionType: "success", expectedStatusCode: 201,
             });
         }
         const targetPath = group.paramPath ?? group.basePath;
-        const sourceStep = steps.length; // 1 if create step exists, 0 otherwise
         steps.push({
-            order: steps.length + 1, method, path: targetPath,
-            description: method === "DELETE"
-                ? `DELETE the ${singular} — expect 204 No Content`
-                : `${method} the ${singular} with valid data — verify updated response fields`,
-            interactionType: "success", expectedStatusCode: method === "DELETE" ? 204 : 200,
-            ...(sourceStep > 0 ? { chainsFrom: { sourceStep, sourceField: "id", sourceLocation: "body", targetParam: `${singular}_id`, targetLocation: "path" } } : {}),
+            order: steps.length + 1, method: "DELETE", path: targetPath,
+            description: `Delete ${singular}`,
+            interactionType: "success", expectedStatusCode: 204,
+            ...(steps.length > 0 ? { chainsFrom: { sourceStep: 1, sourceField: "id", sourceLocation: "body", targetParam: `${singular}_id`, targetLocation: "path" } } : {}),
         });
-        if (method === "DELETE" && group.paramPath && group.methods.has("GET")) {
+        if (group.paramPath && group.methods.has("GET")) {
             steps.push({
                 order: steps.length + 1, method: "GET", path: group.paramPath,
-                description: `Verify the ${singular} is gone — expect 404`,
+                description: `Verify ${singular} is deleted (404)`,
                 interactionType: "error", expectedStatusCode: 404,
             });
         }
     }
     const suffix = method === "DELETE" ? "delete" : method.toLowerCase();
     return {
-        scenarioName: `${resource}-${suffix}-new-endpoint-happy-path`,
-        description: `New endpoint happy path: discover prerequisites from source code, then ${steps.map(s => `${s.method} ${s.path}`).join(" → ")}`,
+        scenarioName: `${resource}-${suffix}-lifecycle`,
+        description: `Lifecycle test: ${method} ${group.basePath} — verify ${method === "DELETE" ? "delete and subsequent 404" : "create and read-back"} flow`,
         category: "new_endpoint",
         priority: "high",
         steps,
         chainingKeys: ["id", `${singular}_id`],
         requiresAuth: true,
-        estimatedComplexity: "complex",
-        source: "code-inferred",
-        testType: "integration",
+        estimatedComplexity: "moderate",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.INTEGRATION,
     };
 }
 function diffDirectContract(method, path, resource) {
@@ -541,8 +266,8 @@ function diffDirectContract(method, path, resource) {
         chainingKeys: [],
         requiresAuth: true,
         estimatedComplexity: "simple",
-        source: "code-inferred",
-        testType: "contract",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.CONTRACT,
     };
 }
 function diffDirectNotFound(method, path, resource, singular) {
@@ -555,8 +280,8 @@ function diffDirectNotFound(method, path, resource, singular) {
         chainingKeys: [],
         requiresAuth: true,
         estimatedComplexity: "simple",
-        source: "code-inferred",
-        testType: "contract",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.CONTRACT,
     };
 }
 function diffDirectValidation(method, path, resource) {
@@ -569,8 +294,8 @@ function diffDirectValidation(method, path, resource) {
         chainingKeys: [],
         requiresAuth: true,
         estimatedComplexity: "simple",
-        source: "code-inferred",
-        testType: "contract",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.CONTRACT,
     };
 }
 /**
@@ -579,6 +304,47 @@ function diffDirectValidation(method, path, resource) {
  * derived totals (total_amount, item_count, subtotal) are recalculated.
  * This pattern catches the most common class of user-reported bugs.
  */
+function diffDirectBoundaryValues(method, resource, singular, group) {
+    const steps = [];
+    const targetPath = group.paramPath ?? group.basePath;
+    const pathParamName = group.paramPath?.match(/\{([^}]+)\}/)?.[1] ?? `${singular}_id`;
+    if (group.methods.has("POST")) {
+        steps.push({
+            order: 1,
+            method: "POST",
+            path: group.basePath,
+            description: `Create a ${singular} for boundary testing`,
+            interactionType: "success",
+            expectedStatusCode: 201,
+        });
+    }
+    steps.push({
+        order: steps.length + 1,
+        method,
+        path: targetPath,
+        description: `${method} with valid boundary values (e.g. 0, maximum allowed, empty collection) — expect 200`,
+        interactionType: "success",
+        expectedStatusCode: 200,
+        // Signal the execution plan that a body is required. The agent reads source
+        // to discover the actual numeric/percentage field names to test at boundaries.
+        bodyMustInclude: ["numeric_or_percentage_field"],
+        ...(steps.length > 0 && group.paramPath
+            ? { chainsFrom: { sourceStep: 1, sourceField: "id", sourceLocation: "body", targetParam: pathParamName, targetLocation: "path" } }
+            : {}),
+    });
+    return {
+        scenarioName: `${resource}-${method.toLowerCase()}-boundary-values`,
+        description: `Boundary test: ${method} ${targetPath} — test valid boundary values (0%, 100%, minimum, maximum allowed by schema). Read source to identify numeric/percentage fields and their constraints; assert the response reflects the boundary value correctly.`,
+        category: "new_endpoint",
+        priority: "high",
+        steps,
+        chainingKeys: ["id", pathParamName],
+        requiresAuth: true,
+        estimatedComplexity: "moderate",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.INTEGRATION,
+    };
+}
 function diffDirectMutationRecalc(method, resource, singular, group) {
     const steps = [];
     if (group.methods.has("POST")) {
@@ -586,7 +352,7 @@ function diffDirectMutationRecalc(method, resource, singular, group) {
             order: 1,
             method: "POST",
             path: group.basePath,
-            description: `Create a ${singular} with initial items`,
+            description: `Create a ${singular} for testing`,
             interactionType: "success",
             expectedStatusCode: 201,
         });
@@ -598,10 +364,9 @@ function diffDirectMutationRecalc(method, resource, singular, group) {
         order: steps.length + 1,
         method,
         path: targetPath,
-        description: `${method} the ${singular} — add/replace items in the child collection (e.g. items array with product references chained from prior steps) and verify total_amount is recalculated`,
+        description: `${method} the ${singular} with valid changes — read source to find mutable fields`,
         interactionType: "success",
         expectedStatusCode: 200,
-        bodyMustInclude: ["child collection array (e.g. items)", "FK reference to parent resource (e.g. product_id)", "quantity or amount"],
         ...(sourceStep > 0 && group.paramPath
             ? { chainsFrom: { sourceStep, sourceField: "id", sourceLocation: "body", targetParam: pathParamName, targetLocation: "path" } }
             : {}),
@@ -611,39 +376,111 @@ function diffDirectMutationRecalc(method, resource, singular, group) {
             order: steps.length + 1,
             method: "GET",
             path: group.paramPath,
-            description: `Verify the ${singular} reflects the updated child collection with correct FK references, quantities, and recalculated totals`,
+            description: `Verify the ${singular} reflects changes — check any derived/calculated fields`,
             interactionType: "success",
             expectedStatusCode: 200,
-            expectedResponseFields: ["child collection array", "each child's FK reference", "each child's quantity", "recalculated total"],
             ...(sourceStep > 0 && group.paramPath
                 ? { chainsFrom: { sourceStep, sourceField: "id", sourceLocation: "body", targetParam: pathParamName, targetLocation: "path" } }
                 : {}),
         });
     }
     return {
-        scenarioName: `${resource}-${method.toLowerCase()}-add-items-recalculate`,
-        description: `Mutation recalculation: ${method} ${targetPath} — modify child collection and verify derived totals are recomputed`,
+        scenarioName: `${resource}-${method.toLowerCase()}-mutation-verify`,
+        description: `Mutation test: ${method} ${targetPath} — update fields and verify derived calculations (totals, discounts, sums, quantities) are recomputed correctly. Test at least one calculation-affecting change (e.g. discount percentage, quantity update, item addition/removal).`,
         category: "new_endpoint",
         priority: "high",
         steps,
         chainingKeys: ["id", pathParamName],
         requiresAuth: true,
         estimatedComplexity: "complex",
-        source: "code-inferred",
-        testType: "integration",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.INTEGRATION,
+    };
+}
+function diffDirectAuthBoundary(method, path, resource) {
+    return {
+        scenarioName: `${resource}-${method.toLowerCase()}-auth-boundary`,
+        description: `Auth boundary: ${method} ${path} without authentication returns 401 Unauthorized`,
+        category: "security_boundary",
+        priority: "high",
+        steps: [{ order: 1, method, path, description: `${method} ${path} without Authorization header — expect 401 Unauthorized`, interactionType: "error", expectedStatusCode: 401 }],
+        chainingKeys: [],
+        requiresAuth: false,
+        estimatedComplexity: "simple",
+        source: ScenarioSource.CodeInferred,
+        testType: TestType.CONTRACT,
+    };
+}
+/**
+ * Draft a unified scenario for GET endpoints without path params (collection or search).
+ * Rather than hardcoding keyword detection, the description instructs the LLM to read
+ * the diff source and determine whether query params are involved, then draft variations
+ * accordingly.
+ */
+function diffDirectGetCollection(path, resource, singular, group) {
+    const steps = [];
+    if (group.methods.has("POST")) {
+        steps.push({
+            order: 1,
+            method: "POST",
+            path: group.basePath,
+            description: `Create a ${singular} for query verification`,
+            interactionType: "success",
+            expectedStatusCode: 201,
+        });
+        steps.push({
+            order: 2,
+            method: "GET",
+            path,
+            description: `Query ${resource} and verify results include the created item`,
+            interactionType: "success",
+            expectedStatusCode: 200,
+        });
+    }
+    else {
+        steps.push({
+            order: 1,
+            method: "GET",
+            path,
+            description: `Query ${resource} and verify response structure`,
+            interactionType: "success",
+            expectedStatusCode: 200,
+        });
+    }
+    // Include a path-specific suffix in scenarioName to avoid collision when multiple GET
+    // collection endpoints exist for the same resource (e.g. /products and /products/featured).
+    // Strip API prefix segments (api, v1, ...) and param segments, take the last 1-2 meaningful ones.
+    const meaningfulSegs = path.split("/").filter(s => s && !s.startsWith("{") && !SKIP_SEGMENTS.has(s));
+    const pathSlug = meaningfulSegs.slice(-2).join("-") || resource;
+    const uniqueName = pathSlug === resource ? `${resource}-list-query` : `${pathSlug}-list-query`;
+    return {
+        scenarioName: uniqueName,
+        description: `List/query test: GET ${path} — read source to find supported query params (filters, pagination, search), then test with and without them`,
+        category: "new_endpoint",
+        priority: "high",
+        steps,
+        chainingKeys: ["id", `${singular}_id`],
+        requiresAuth: true,
+        estimatedComplexity: group.methods.has("POST") ? "moderate" : "simple",
+        source: ScenarioSource.CodeInferred,
+        testType: group.methods.has("POST") ? TestType.INTEGRATION : TestType.CONTRACT,
     };
 }
 /**
  * Draft scenarios that directly test each new endpoint in the branch diff.
  *
- * For each new endpoint, up to 3 scenarios are produced:
- *   PUT/PATCH  → integration happy path (prereqs + create + PUT), contract, not-found
- *   POST       → integration happy path (prereqs + POST + verify GET), contract, validation error
- *   DELETE     → integration lifecycle (create → DELETE → verify 404), contract
+ * For each new endpoint, method-specific scenarios are produced:
+ *   PUT/PATCH  → mutation-recalc integration, boundary-values integration, contract, not-found
+ *   POST       → lifecycle integration (create + optional GET), contract, validation error
+ *   DELETE     → lifecycle integration (create + delete + 404), contract
  *   GET /{id}  → contract, not-found
+ *   GET /coll  → contract + collection-list integration (create-then-GET) or contract-only
  *
- * All carry category "new_endpoint" → CRITICAL priority tier so they always
- * rank above structural candidates and occupy the GENERATE slots.
+ * Additionally, PUT/PATCH/DELETE methods get an auth-boundary scenario
+ * (category "security_boundary" → HIGH priority, not CRITICAL) so it
+ * lands in ADDITIONAL deterministically instead of depending on LLM
+ * supplement. GET is excluded (often public); POST is excluded because
+ * the security-boundary supplement tier covers it.
  */
 export function draftDiffDirectScenarios(newEndpoints, resourceGroups) {
     if (newEndpoints.length === 0)
@@ -688,27 +525,29 @@ export function draftDiffDirectScenarios(newEndpoints, resourceGroups) {
                 }
             }
         }
-        // When extractResourceName returns null (e.g. "/{order_id}"), fall back to
-        // matching the path suffix against known resourceGroup paths using segment
-        // boundaries. Prefer the longest (most specific) match.
-        if (!resource) {
+        // When extractResourceName returns null OR the resource isn't in resourceGroups,
+        // fall back to finding a matching group via prefix or suffix matching.
+        if (!resource || !resourceGroups.has(resource)) {
             let bestMatch = null;
             for (const [rName, rGroup] of resourceGroups) {
-                if (rGroup.paramPath && pathSuffixMatches(rGroup.paramPath, epPath)) {
-                    if (!bestMatch || rGroup.paramPath.length > bestMatch.length) {
-                        bestMatch = { name: rName, path: rGroup.paramPath, length: rGroup.paramPath.length };
+                // Prefix match: epPath starts with group's basePath (e.g. /products/search → /products)
+                if (epPath.startsWith(rGroup.basePath + "/") || epPath === rGroup.basePath) {
+                    if (!bestMatch || rGroup.basePath.length > bestMatch.length) {
+                        bestMatch = { name: rName, path: rGroup.basePath, length: rGroup.basePath.length, isPrefixMatch: true };
                     }
                 }
-                if (pathSuffixMatches(rGroup.basePath, epPath)) {
-                    if (!bestMatch || rGroup.basePath.length > bestMatch.length) {
-                        bestMatch = { name: rName, path: rGroup.basePath, length: rGroup.basePath.length };
+                // Suffix match for router-relative paths (e.g. /{order_id} → /api/v1/orders/{order_id})
+                if (rGroup.paramPath && pathSuffixMatches(rGroup.paramPath, epPath)) {
+                    if (!bestMatch || rGroup.paramPath.length > bestMatch.length) {
+                        bestMatch = { name: rName, path: rGroup.paramPath, length: rGroup.paramPath.length, isPrefixMatch: false };
                     }
                 }
             }
             if (!bestMatch)
                 continue;
             resource = bestMatch.name;
-            resolvedPath = bestMatch.path;
+            // For prefix matches (action sub-paths), keep original path; for suffix matches, use resolved path
+            resolvedPath = bestMatch.isPrefixMatch ? epPath : bestMatch.path;
         }
         const group = resourceGroups.get(resource);
         if (!group)
@@ -723,8 +562,10 @@ export function draftDiffDirectScenarios(newEndpoints, resourceGroups) {
         };
         for (const method of methods) {
             if (method === "PUT" || method === "PATCH") {
+                // mutation-recalc tests the primary calculation flow
                 add(diffDirectMutationRecalc(method, resource, singular, group));
-                add(diffDirectIntegration(method, resource, singular, group));
+                // boundary-values tests edge cases (0, max, empty)
+                add(diffDirectBoundaryValues(method, resource, singular, group));
                 add(diffDirectContract(method, resolvedPath, resource));
                 if (hasPathParam)
                     add(diffDirectNotFound(method, resolvedPath, resource, singular));
@@ -742,6 +583,12 @@ export function draftDiffDirectScenarios(newEndpoints, resourceGroups) {
                 add(diffDirectContract(method, resolvedPath, resource));
                 add(diffDirectNotFound(method, resolvedPath, resource, singular));
             }
+            else if (method === "GET" && !hasPathParam) {
+                add(diffDirectContract(method, resolvedPath, resource));
+                add(diffDirectGetCollection(resolvedPath, resource, singular, group));
+            }
+            if (method === "PUT" || method === "PATCH" || method === "DELETE")
+                add(diffDirectAuthBoundary(method, resolvedPath, resource));
         }
     }
     return scenarios;