@skyramp/mcp 0.1.4 → 0.1.6

package/build/utils/scenarioDrafting.test.js

@@ -1,306 +1,529 @@
-import { draftScenariosFromEndpoints, draftMinimalScenarios, } from "./scenarioDrafting.js";
-// ---------------------------------------------------------------------------
-// draftMinimalScenarios
-// ---------------------------------------------------------------------------
-describe("draftMinimalScenarios", () => {
+// @ts-ignore
+import { isRealResource, draftScenariosFromEndpoints, draftDiffDirectScenarios, inferResourceRelationships, } from "./scenarioDrafting.js";
+describe("isRealResource", () => {
+    it("accepts normal resource names", () => {
+        expect(isRealResource("users")).toBe(true);
+        expect(isRealResource("products")).toBe(true);
+        expect(isRealResource("orders")).toBe(true);
+    });
+    it("accepts hyphenated resource names (not action verbs)", () => {
+        expect(isRealResource("saved-searches")).toBe(true);
+        expect(isRealResource("order-items")).toBe(true);
+        expect(isRealResource("user-profiles")).toBe(true);
+        expect(isRealResource("api-keys")).toBe(true);
+    });
+    it("rejects action-like single words", () => {
+        expect(isRealResource("login")).toBe(false);
+        expect(isRealResource("logout")).toBe(false);
+        expect(isRealResource("verify")).toBe(false);
+        expect(isRealResource("health")).toBe(false);
+        expect(isRealResource("ping")).toBe(false);
+        expect(isRealResource("dashboard")).toBe(false);
+        expect(isRealResource("webhook")).toBe(false);
+    });
+    it("rejects action-verb-hyphenated patterns", () => {
+        expect(isRealResource("forgot-password")).toBe(false);
+        expect(isRealResource("reset-password")).toBe(false);
+        expect(isRealResource("verify-email")).toBe(false);
+        expect(isRealResource("confirm-order")).toBe(false);
+        expect(isRealResource("send-notification")).toBe(false);
+        expect(isRealResource("create-session")).toBe(false);
+        expect(isRealResource("delete-cache")).toBe(false);
+    });
+    it("is case-insensitive", () => {
+        expect(isRealResource("Login")).toBe(false);
+        expect(isRealResource("VERIFY")).toBe(false);
+        expect(isRealResource("Forgot-Password")).toBe(false);
+    });
+});
+describe("draftScenariosFromEndpoints — irregular plural singularization", () => {
+    it("uses 'category' (not 'categorie') in FK field names for -ies plurals", () => {
+        const endpoints = [
+            { path: "/api/categories", methods: [{ method: "GET" }, { method: "POST" }] },
+            { path: "/api/categories/{id}", methods: [{ method: "GET" }, { method: "PUT" }, { method: "DELETE" }] },
+            { path: "/api/items", methods: [{ method: "GET" }, { method: "POST" }] },
+            { path: "/api/items/{id}", methods: [{ method: "GET" }, { method: "DELETE" }] },
+        ];
+        const scenarios = draftScenariosFromEndpoints(endpoints, [{ method: "POST", path: "/api/categories" }]);
+        const allText = JSON.stringify(scenarios);
+        expect(allText).not.toContain("categorie_id");
+        expect(allText).not.toContain("\"categorie\"");
+        // The diff-direct integration scenario description should use "category" (singular)
+        const integrationScenario = scenarios.find((s) => s.scenarioName === "categories-post-lifecycle");
+        expect(integrationScenario).toBeDefined();
+        expect(integrationScenario.steps[0].description).toContain("category");
+    });
+    it("uses 'status' (not 'statu') in FK field names for -ses plurals", () => {
+        const endpoints = [
+            { path: "/api/statuses", methods: [{ method: "GET" }, { method: "POST" }] },
+            { path: "/api/statuses/{id}", methods: [{ method: "GET" }, { method: "DELETE" }] },
+        ];
+        const scenarios = draftScenariosFromEndpoints(endpoints, [{ method: "POST", path: "/api/statuses" }]);
+        const allText = JSON.stringify(scenarios);
+        expect(allText).not.toContain("statu_id");
+        // The diff-direct integration scenario description should use "status" (singular)
+        const integrationScenario = scenarios.find((s) => s.scenarioName === "statuses-post-lifecycle");
+        expect(integrationScenario).toBeDefined();
+        expect(integrationScenario.steps[0].description).toContain("status");
+    });
+});
+describe("draftScenariosFromEndpoints", () => {
+    it("returns empty array for no endpoints", () => {
+        expect(draftScenariosFromEndpoints([])).toEqual([]);
+    });
+});
+describe("inferResourceRelationships", () => {
+    it("returns empty map for endpoints with no nesting or FK fields", () => {
+        const endpoints = [
+            { path: "/api/users", methods: [{ method: "GET" }] },
+            { path: "/api/products", methods: [{ method: "GET" }] },
+        ];
+        expect(inferResourceRelationships(endpoints).size).toBe(0);
+    });
+    it("detects parent→child relationship from path nesting (/parent/{id}/child)", () => {
+        const endpoints = [
+            { path: "/api/collections/{id}/links", methods: [{ method: "GET" }] },
+        ];
+        const rel = inferResourceRelationships(endpoints);
+        expect(rel.has("links")).toBe(true);
+        expect(rel.get("links").has("collections")).toBe(true);
+    });
+    it("detects FK relationship from request body field ({resource}_id)", () => {
+        const endpoints = [
+            { path: "/api/orders", methods: [{ method: "POST", interactions: [{ request: { body: { product_id: "abc" } } }] }] },
+            { path: "/api/products", methods: [{ method: "GET" }] },
+        ];
+        const rel = inferResourceRelationships(endpoints);
+        expect(rel.has("orders")).toBe(true);
+        expect(rel.get("orders").has("products")).toBe(true);
+    });
+    it("does not create self-reference", () => {
+        const endpoints = [
+            { path: "/api/orders", methods: [{ method: "POST", interactions: [{ request: { body: { order_id: "abc" } } }] }] },
+        ];
+        const rel = inferResourceRelationships(endpoints);
+        // orders should not reference itself
+        expect(rel.get("orders")?.has("orders")).toBeFalsy();
+    });
+    it("ignores FK fields that point to unknown resources", () => {
+        const endpoints = [
+            { path: "/api/orders", methods: [{ method: "POST", interactions: [{ request: { body: { nonexistent_resource_id: "abc" } } }] }] },
+        ];
+        const rel = inferResourceRelationships(endpoints);
+        // nonexistent_resource is not a known endpoint resource, should be ignored
+        expect(rel.get("orders")?.size ?? 0).toBe(0);
+    });
+});
+describe("draftDiffDirectScenarios", () => {
     const makeGroups = (defs) => new Map(Object.entries(defs).map(([k, v]) => [k, { ...v, methods: new Set(v.methods) }]));
-    it("returns empty array when endpoints is empty", () => {
+    it("returns empty array when newEndpoints is empty", () => {
         const groups = makeGroups({ orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" } });
-        expect(draftMinimalScenarios([], groups, "new_endpoint")).toEqual([]);
-    });
-    it("GET endpoint → 1 contract scenario only (no integration)", () => {
-        const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
-        });
-        const result = draftMinimalScenarios([{ method: "GET", path: "/api/orders/{id}" }], groups, "new_endpoint");
-        expect(result).toHaveLength(1);
-        expect(result[0].testType).toBe("contract");
-        expect(result[0].scenarioName).toBe("orders-by-id-get-new-contract");
-        expect(result[0].steps).toHaveLength(1);
-        expect(result[0].steps[0].expectedStatusCode).toBe(200);
-    });
-    it("POST endpoint → 1 contract + 1 integration", () => {
-        const groups = makeGroups({
-            products: { basePath: "/api/products", methods: ["GET", "POST"], paramPath: "/api/products/{id}" },
-        });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/products" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        const contract = result.find(s => s.testType === "contract");
-        const integration = result.find(s => s.testType === "integration");
-        expect(contract).toBeDefined();
-        expect(integration).toBeDefined();
-        expect(contract.scenarioName).toBe("products-post-new-contract");
-        expect(integration.scenarioName).toBe("products-post-new-integration");
+        expect(draftDiffDirectScenarios([], groups)).toEqual([]);
     });
-    it("PUT endpoint → 1 contract + 1 integration", () => {
+    it("generates new_endpoint-category scenarios for a new PUT endpoint", () => {
         const groups = makeGroups({
             orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([{ method: "PUT", path: "/api/orders/{order_id}" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        expect(result.find(s => s.testType === "contract")).toBeDefined();
-        expect(result.find(s => s.testType === "integration")).toBeDefined();
-        // Both use the resolved path
-        expect(result[0].steps[0].path).toBe("/api/orders/{order_id}");
-    });
-    it("DELETE endpoint → 1 contract + 1 integration", () => {
-        const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST", "DELETE"], paramPath: "/api/orders/{id}" },
-        });
-        const result = draftMinimalScenarios([{ method: "DELETE", path: "/api/orders/{id}" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        const contract = result.find(s => s.testType === "contract");
-        const integration = result.find(s => s.testType === "integration");
+        const scenarios = draftDiffDirectScenarios([{ method: "PUT", path: "/api/orders/{order_id}" }], groups);
+        // PUT generates: mutation-recalc, contract, not-found (3 scenarios)
+        // Note: we intentionally skip the redundant "happy-path" integration for PUT/PATCH
+        // because mutation-recalc already provides comprehensive happy-path coverage
+        expect(scenarios.length).toBeGreaterThanOrEqual(3);
+        const newEndpointScenarios = scenarios.filter(s => s.category === "new_endpoint");
+        expect(newEndpointScenarios.length).toBeGreaterThanOrEqual(2);
+        // Mutation-recalculation scenario is drafted first for PUT/PATCH
+        const mutationRecalc = scenarios.find(s => s.testType === "integration" && s.scenarioName.includes("mutation-verify"));
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.steps.some(st => st.method === "PUT")).toBe(true);
+        expect(mutationRecalc.description).toContain("Mutation test");
+        // Note: happy-path integration removed for PUT/PATCH - mutation-recalc covers this
+        // Contract test
+        const contract = scenarios.find(s => s.testType === "contract" && s.steps[0].expectedStatusCode === 200);
         expect(contract).toBeDefined();
-        expect(integration).toBeDefined();
+        // Not-found edge case
+        const notFound = scenarios.find(s => s.steps.some(st => st.expectedStatusCode === 404));
+        expect(notFound).toBeDefined();
     });
-    it("each scenario has exactly 1 step", () => {
+    it("generates mutation-recalc scenario for a new PATCH endpoint", () => {
         const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT", "DELETE"], paramPath: "/api/orders/{id}" },
+            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PATCH"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([
-            { method: "GET", path: "/api/orders/{id}" },
-            { method: "POST", path: "/api/orders" },
-            { method: "PUT", path: "/api/orders/{id}" },
-            { method: "DELETE", path: "/api/orders/{id}" },
-        ], groups, "new_endpoint");
-        for (const s of result) {
-            expect(s.steps).toHaveLength(1);
-        }
+        const scenarios = draftDiffDirectScenarios([{ method: "PATCH", path: "/api/orders/{order_id}" }], groups);
+        // Mutation-recalculation scenario is drafted for PATCH
+        const mutationRecalc = scenarios.find(s => s.scenarioName === "orders-patch-mutation-verify");
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.testType).toBe("integration");
+        expect(mutationRecalc.category).toBe("new_endpoint");
+        expect(mutationRecalc.priority).toBe("high");
+        expect(mutationRecalc.description).toContain("Mutation test");
+        expect(mutationRecalc.description).toContain("derived calculations");
+        // Should have 3 steps: POST (create) → PATCH (add items) → GET (verify)
+        expect(mutationRecalc.steps).toHaveLength(3);
+        expect(mutationRecalc.steps[0].method).toBe("POST");
+        expect(mutationRecalc.steps[1].method).toBe("PATCH");
+        expect(mutationRecalc.steps[2].method).toBe("GET");
+        // Note: happy-path integration removed for PUT/PATCH - mutation-recalc covers this
     });
-    it("new_endpoint category → scenario names contain 'new'", () => {
+    it("integration scenario minimum steps: POST resource then PUT — LLM discovers prereqs from source code", () => {
         const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
+            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/orders" }], groups, "new_endpoint");
-        for (const s of result) {
-            expect(s.category).toBe("new_endpoint");
-            expect(s.scenarioName).toContain("-new-");
-        }
+        const scenarios = draftDiffDirectScenarios([{ method: "PUT", path: "/api/orders/{order_id}" }], groups);
+        // Mutation-recalculation scenario comes first
+        const mutationRecalc = scenarios.find(s => s.testType === "integration" && s.scenarioName.includes("mutation-verify"));
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.steps.some(st => st.method === "POST" && st.path === "/api/orders")).toBe(true);
+        expect(mutationRecalc.steps.some(st => st.method === "PUT")).toBe(true);
+        // Note: happy-path integration removed for PUT/PATCH
+        // mutation-recalc already provides comprehensive happy-path coverage with POST → PUT → GET
+        // The minimum steps (POST + PUT) are already verified in the mutationRecalc check above
     });
-    it("business_rule category → scenario names contain 'changed'", () => {
+    it("generates 3 scenarios for a new POST endpoint", () => {
         const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
+            products: { basePath: "/api/products", methods: ["GET", "POST"], paramPath: "/api/products/{id}" },
         });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/orders" }], groups, "business_rule");
-        for (const s of result) {
-            expect(s.category).toBe("business_rule");
-            expect(s.scenarioName).toContain("-changed-");
-        }
+        const scenarios = draftDiffDirectScenarios([{ method: "POST", path: "/api/products" }], groups);
+        expect(scenarios.length).toBe(3); // integration, contract, validation
+        const types = scenarios.map(s => s.testType);
+        expect(types).toContain("integration");
+        expect(types).toContain("contract");
+        // validation error scenario (422)
+        expect(scenarios.some(s => s.steps.some(st => st.expectedStatusCode === 422))).toBe(true);
     });
-    it("passes through router-relative param paths as-is (LLM resolves from source)", () => {
+    it("ignores unknown paths and skips action-verb segments", () => {
         const groups = makeGroups({
-            orders: { basePath: "/api/v1/orders", methods: ["GET", "POST", "PATCH"], paramPath: "/api/v1/orders/{order_id}" },
+            orders: { basePath: "/api/orders", methods: ["POST", "DELETE"], paramPath: "/api/orders/{id}" },
         });
-        const result = draftMinimalScenarios([{ method: "PATCH", path: "/{order_id}" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        // Path is passed through as-is — the LLM resolves full path during source enrichment
-        expect(result[0].steps[0].path).toBe("/{order_id}");
+        const scenarios = draftDiffDirectScenarios([{ method: "POST", path: "/api/health" }], // 'health' is not a real resource
+        groups);
+        expect(scenarios).toEqual([]);
     });
-    it("resolves router-relative base paths (e.g. /orders) against known resourceGroups", () => {
-        const groups = makeGroups({
-            orders: { basePath: "/api/v1/orders", methods: ["GET", "POST"], paramPath: "/api/v1/orders/{order_id}" },
-        });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/orders" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        expect(result[0].scenarioName).toContain("orders");
+    it("draftScenariosFromEndpoints passes newEndpoints through to diff-direct scenarios", () => {
+        const endpoints = [
+            { path: "/api/orders", methods: ["GET", "POST", "PUT"] },
+            { path: "/api/orders/{order_id}", methods: ["GET", "PUT", "DELETE"] },
+        ];
+        const newEndpoints = [{ method: "PUT", path: "/api/orders/{order_id}" }];
+        const scenarios = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        const diffDirect = scenarios.filter(s => s.category === "new_endpoint");
+        expect(diffDirect.length).toBeGreaterThan(0);
+        expect(diffDirect.some(s => s.steps.some(st => st.method === "PUT"))).toBe(true);
     });
-    it("generates scenarios for any endpoint path (LLM validates relevance from source)", () => {
+    it("resolves router-relative param paths (e.g. /{order_id}) against known resourceGroups", () => {
         const groups = makeGroups({
+            orders: { basePath: "/api/v1/orders", methods: ["GET", "POST", "PATCH", "DELETE"], paramPath: "/api/v1/orders/{order_id}" },
             products: { basePath: "/api/v1/products", methods: ["GET", "POST"], paramPath: "/api/v1/products/{id}" },
         });
-        // Even unresolvable paths get seed scenarios — the LLM discards irrelevant ones
-        const result = draftMinimalScenarios([{ method: "PATCH", path: "/{nonexistent_id}" }], groups, "new_endpoint");
-        expect(result).toHaveLength(2); // contract + integration
+        // Diff scanner reports router-relative path, not the full API path
+        const scenarios = draftDiffDirectScenarios([{ method: "PATCH", path: "/{order_id}" }], groups);
+        expect(scenarios.length).toBeGreaterThanOrEqual(3);
+        // Mutation-recalculation scenario is drafted
+        const mutationRecalc = scenarios.find(s => s.scenarioName === "orders-patch-mutation-verify");
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.testType).toBe("integration");
+        expect(mutationRecalc.category).toBe("new_endpoint");
+        expect(mutationRecalc.steps[1].method).toBe("PATCH");
+        // Contract and not-found scenarios use the resolved full path
+        const contract = scenarios.find(s => s.scenarioName.includes("contract"));
+        expect(contract).toBeDefined();
+        expect(contract.steps[0].path).toBe("/api/v1/orders/{order_id}");
+        const notFound = scenarios.find(s => s.scenarioName.includes("not-found"));
+        expect(notFound).toBeDefined();
+        expect(notFound.steps[0].path).toBe("/api/v1/orders/{order_id}");
     });
-    it("deduplicates scenarios by method+path+testType key", () => {
+    it("resolves router-relative base paths (e.g. /orders) against known resourceGroups", () => {
         const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
+            orders: { basePath: "/api/v1/orders", methods: ["GET", "POST"], paramPath: "/api/v1/orders/{order_id}" },
         });
-        // Same endpoint twice
-        const result = draftMinimalScenarios([
-            { method: "POST", path: "/api/orders" },
-            { method: "POST", path: "/api/orders" },
-        ], groups, "new_endpoint");
-        expect(result).toHaveLength(2); // 1 contract + 1 integration, not doubled
-    });
-    it("action sub-path falls back to parent resource", () => {
+        const scenarios = draftDiffDirectScenarios([{ method: "POST", path: "/orders" }], groups);
+        expect(scenarios.length).toBeGreaterThanOrEqual(2);
+        const integration = scenarios.find(s => s.testType === "integration");
+        expect(integration).toBeDefined();
+        expect(integration.category).toBe("new_endpoint");
+    });
+    it("skips unresolvable router-relative paths", () => {
         const groups = makeGroups({
             products: { basePath: "/api/v1/products", methods: ["GET", "POST"], paramPath: "/api/v1/products/{id}" },
         });
-        const result = draftMinimalScenarios([{ method: "GET", path: "/api/v1/products/search" }], groups, "new_endpoint");
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.some(s => s.scenarioName.includes("products"))).toBe(true);
+        // /{nonexistent_id} doesn't match any known resource
+        const scenarios = draftDiffDirectScenarios([{ method: "PATCH", path: "/{nonexistent_id}" }], groups);
+        expect(scenarios).toEqual([]);
     });
-    it("different paths resolving to same resource both produce scenarios (no silent dedup)", () => {
-        const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
-        });
-        // GET /api/orders and GET /api/orders/search both involve "orders" resource
-        const result = draftMinimalScenarios([
-            { method: "GET", path: "/api/orders" },
-            { method: "GET", path: "/api/orders/search" },
-        ], groups, "new_endpoint");
-        // Both should produce contract scenarios (not deduplicated)
-        expect(result).toHaveLength(2);
-        const paths = result.map(s => s.steps[0].path);
-        expect(paths).toContain("/api/orders");
-        expect(paths).toContain("/api/orders/search");
-        // Scenario names should be distinct
-        expect(result[0].scenarioName).not.toBe(result[1].scenarioName);
-    });
-    it("multiple methods on same path → correct scenario count", () => {
-        const groups = makeGroups({
-            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT", "DELETE"], paramPath: "/api/orders/{id}" },
-        });
-        const result = draftMinimalScenarios([
-            { method: "GET", path: "/api/orders/{id}" },
-            { method: "PUT", path: "/api/orders/{id}" },
-            { method: "DELETE", path: "/api/orders/{id}" },
-        ], groups, "new_endpoint");
-        // GET → 1 contract; PUT → 1 contract + 1 integration; DELETE → 1 contract + 1 integration = 5
-        expect(result).toHaveLength(5);
+    it("PR #195 regression: PATCH /{order_id} produces mutation-recalculate scenario in GENERATE slots", () => {
+        // Simulates the exact data from PR #195:
+        // - Full endpoint list with orders, products, reviews
+        // - newEndpoints has PATCH /{order_id} (router-relative)
+        const endpoints = [
+            { path: "/api/v1/orders", methods: ["GET", "POST"] },
+            { path: "/api/v1/orders/{order_id}", methods: ["GET", "PATCH", "DELETE"] },
+            { path: "/api/v1/products", methods: ["GET", "POST"] },
+            { path: "/api/v1/products/{product_id}", methods: ["GET", "PUT", "DELETE"] },
+            { path: "/api/v1/reviews", methods: ["GET", "POST"] },
+            { path: "/api/v1/reset", methods: ["POST"] },
+        ];
+        const newEndpoints = [{ method: "PATCH", path: "/{order_id}" }];
+        const allScenarios = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        // The diff-direct scenarios should include orders-patch-mutation-verify
+        const mutationRecalc = allScenarios.find(s => s.scenarioName === "orders-patch-mutation-verify");
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.category).toBe("new_endpoint"); // → CRITICAL priority tier
+        expect(mutationRecalc.steps).toHaveLength(3);
+        expect(mutationRecalc.steps[0].method).toBe("POST");
+        expect(mutationRecalc.steps[1].method).toBe("PATCH");
+        expect(mutationRecalc.steps[2].method).toBe("GET");
+        expect(mutationRecalc.description).toContain("derived calculations");
+        // Verify it outranks all non-new_endpoint scenarios (cascade-delete, unique-constraint, etc.)
+        const newEndpointScenarios = allScenarios.filter(s => s.category === "new_endpoint");
+        const otherScenarios = allScenarios.filter(s => s.category !== "new_endpoint");
+        expect(newEndpointScenarios.length).toBeGreaterThanOrEqual(3);
+        // All new_endpoint scenarios should include our mutation-recalculate
+        expect(newEndpointScenarios.some(s => s.scenarioName === "orders-patch-mutation-verify")).toBe(true);
+        // Non-new_endpoint scenarios should NOT include mutation-recalculate
+        expect(otherScenarios.every(s => s.scenarioName !== "orders-patch-mutation-verify")).toBe(true);
     });
 });
-// ---------------------------------------------------------------------------
-// extractResourceName — parent-segment fallback (tested indirectly)
-// ---------------------------------------------------------------------------
-describe("resolveEndpoint — prefix matching for sub-paths", () => {
+describe("diffDirectMutationRecalc — diverse app types (no hardcoded field names)", () => {
     const makeGroups = (defs) => new Map(Object.entries(defs).map(([k, v]) => [k, { ...v, methods: new Set(v.methods) }]));
-    it("/products/search → falls back to 'products' resource", () => {
+    const testCases = [
+        {
+            name: "E-commerce: PATCH /orders/{order_id}",
+            resource: "orders",
+            group: { basePath: "/api/v1/orders", methods: ["GET", "POST", "PATCH"], paramPath: "/api/v1/orders/{order_id}" },
+            method: "PATCH",
+            expectedParamName: "order_id",
+        },
+        {
+            name: "Project management: PUT /projects/{id}",
+            resource: "projects",
+            group: { basePath: "/api/projects", methods: ["GET", "POST", "PUT"], paramPath: "/api/projects/{id}" },
+            method: "PUT",
+            expectedParamName: "id",
+        },
+        {
+            name: "Invoicing: PATCH /invoices/{invoice_id}",
+            resource: "invoices",
+            group: { basePath: "/v2/invoices", methods: ["GET", "POST", "PATCH"], paramPath: "/v2/invoices/{invoice_id}" },
+            method: "PATCH",
+            expectedParamName: "invoice_id",
+        },
+        {
+            name: "Education LMS: PUT /courses/{course_id}",
+            resource: "courses",
+            group: { basePath: "/api/courses", methods: ["GET", "POST", "PUT"], paramPath: "/api/courses/{course_id}" },
+            method: "PUT",
+            expectedParamName: "course_id",
+        },
+        {
+            name: "Healthcare: PATCH /prescriptions/{prescription_id}",
+            resource: "prescriptions",
+            group: { basePath: "/api/prescriptions", methods: ["GET", "POST", "PATCH"], paramPath: "/api/prescriptions/{prescription_id}" },
+            method: "PATCH",
+            expectedParamName: "prescription_id",
+        },
+        {
+            name: "Logistics: PUT /shipments/{shipment_id}",
+            resource: "shipments",
+            group: { basePath: "/api/shipments", methods: ["GET", "POST", "PUT"], paramPath: "/api/shipments/{shipment_id}" },
+            method: "PUT",
+            expectedParamName: "shipment_id",
+        },
+        {
+            name: "Restaurant: PATCH /menus/{menuId}",
+            resource: "menus",
+            group: { basePath: "/api/menus", methods: ["GET", "POST", "PATCH"], paramPath: "/api/menus/{menuId}" },
+            method: "PATCH",
+            expectedParamName: "menuId",
+        },
+        {
+            name: "Cloud billing: PUT /subscriptions/{subscription_id}",
+            resource: "subscriptions",
+            group: { basePath: "/billing/subscriptions", methods: ["GET", "POST", "PUT"], paramPath: "/billing/subscriptions/{subscription_id}" },
+            method: "PUT",
+            expectedParamName: "subscription_id",
+        },
+        {
+            name: "Warehouse: PATCH /inventories/{uuid}",
+            resource: "inventories",
+            group: { basePath: "/api/inventories", methods: ["GET", "POST", "PATCH"], paramPath: "/api/inventories/{uuid}" },
+            method: "PATCH",
+            expectedParamName: "uuid",
+        },
+        {
+            name: "Minimal: PATCH /items (no paramPath)",
+            resource: "items",
+            group: { basePath: "/items", methods: ["GET", "POST", "PATCH"] },
+            method: "PATCH",
+            expectedParamName: "item_id",
+        },
+    ];
+    it.each(testCases)("$name — produces valid mutation-recalc scenario", ({ resource, group, method, expectedParamName }) => {
+        const groups = makeGroups({ [resource]: group });
+        const scenarios = draftDiffDirectScenarios([{ method, path: group.paramPath ?? group.basePath }], groups);
+        const mutationRecalc = scenarios.find(s => s.scenarioName.endsWith("-mutation-verify"));
+        expect(mutationRecalc).toBeDefined();
+        expect(mutationRecalc.category).toBe("new_endpoint");
+        expect(mutationRecalc.testType).toBe("integration");
+        expect(mutationRecalc.priority).toBe("high");
+        // Step 1: POST to create resource (all test cases have POST)
+        expect(mutationRecalc.steps[0].method).toBe("POST");
+        expect(mutationRecalc.steps[0].path).toBe(group.basePath);
+        // Step 2: PUT/PATCH with mutation
+        const mutationStep = mutationRecalc.steps[1];
+        expect(mutationStep.method).toBe(method);
+        // Note: bodyMustInclude removed in intent-based refactor - LLM discovers fields from source
+        // Verify NO hardcoded domain-specific field names
+        // Verify hints are descriptive (contain "e.g." or similar guidance)
+        // Chaining uses the actual path param name (only when paramPath exists)
+        if (group.paramPath) {
+            expect(mutationStep.chainsFrom).toBeDefined();
+            const chaining = mutationStep.chainsFrom;
+            expect(chaining.targetParam).toBe(expectedParamName);
+            expect(chaining.sourceStep).toBe(1);
+            expect(chaining.sourceField).toBe("id");
+        }
+        else {
+            expect(mutationStep.chainsFrom).toBeUndefined();
+        }
+        // Step 3: GET verification (if paramPath exists)
+        if (group.paramPath) {
+            expect(mutationRecalc.steps).toHaveLength(3);
+            const getStep = mutationRecalc.steps[2];
+            expect(getStep.method).toBe("GET");
+            // Note: expectedResponseFields removed in intent-based refactor
+        }
+        // chainingKeys uses the actual path param name, not hardcoded singular_id
+        expect(mutationRecalc.chainingKeys).toContain("id");
+        expect(mutationRecalc.chainingKeys).toContain(expectedParamName);
+        // Description is domain-agnostic
+        expect(mutationRecalc.description).toContain("Mutation test");
+        expect(mutationRecalc.description).toContain("derived calculations");
+    });
+    it("no paramPath: PATCH step targets basePath, no GET verification, fallback param name", () => {
         const groups = makeGroups({
-            products: { basePath: "/api/v1/products", methods: ["GET", "POST"], paramPath: "/api/v1/products/{id}" },
+            items: { basePath: "/items", methods: ["GET", "POST", "PATCH"] },
         });
-        const result = draftMinimalScenarios([{ method: "GET", path: "/api/v1/products/search" }], groups, "new_endpoint");
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.some(s => s.scenarioName.includes("products"))).toBe(true);
+        const scenarios = draftDiffDirectScenarios([{ method: "PATCH", path: "/items" }], groups);
+        const mutationRecalc = scenarios.find(s => s.scenarioName.endsWith("-mutation-verify"));
+        expect(mutationRecalc).toBeDefined();
+        // No paramPath → PATCH targets basePath, no GET step
+        expect(mutationRecalc.steps).toHaveLength(2);
+        expect(mutationRecalc.steps[1].path).toBe("/items");
+        // Fallback param name: singular + _id
+        expect(mutationRecalc.chainingKeys).toContain("item_id");
     });
-    it("/links/archive → falls back to 'links' resource", () => {
+    it("resource without POST: no create step, no chaining", () => {
         const groups = makeGroups({
-            links: { basePath: "/api/v1/links", methods: ["GET", "POST", "PUT"], paramPath: "/api/v1/links/{id}" },
+            configs: { basePath: "/api/configs", methods: ["GET", "PATCH"], paramPath: "/api/configs/{config_id}" },
         });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/v1/links/archive" }], groups, "new_endpoint");
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.some(s => s.scenarioName.includes("links"))).toBe(true);
+        const scenarios = draftDiffDirectScenarios([{ method: "PATCH", path: "/api/configs/{config_id}" }], groups);
+        const mutationRecalc = scenarios.find(s => s.scenarioName.endsWith("-mutation-verify"));
+        expect(mutationRecalc).toBeDefined();
+        // No POST → starts with PATCH directly, no chaining
+        expect(mutationRecalc.steps[0].method).toBe("PATCH");
+        expect(mutationRecalc.steps[0].chainsFrom).toBeUndefined();
+        // Still has GET verification
+        expect(mutationRecalc.steps[1].method).toBe("GET");
+        expect(mutationRecalc.steps[1].chainsFrom).toBeUndefined();
     });
-    it("/health generates a scenario even without a matching group (LLM validates)", () => {
+    it("generates auth-boundary scenario for each new endpoint (security_boundary, not new_endpoint)", () => {
         const groups = makeGroups({
-            users: { basePath: "/api/users", methods: ["GET", "POST"] },
+            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([{ method: "GET", path: "/health" }], groups, "new_endpoint");
-        expect(result).toHaveLength(1); // GET → contract only
-        expect(result[0].steps[0].path).toBe("/health");
+        const scenarios = draftDiffDirectScenarios([{ method: "PUT", path: "/api/orders/{order_id}" }], groups);
+        const authBoundary = scenarios.find(s => s.scenarioName === "orders-put-auth-boundary");
+        expect(authBoundary).toBeDefined();
+        expect(authBoundary.category).toBe("security_boundary");
+        expect(authBoundary.testType).toBe("contract");
+        expect(authBoundary.steps[0].method).toBe("PUT");
+        expect(authBoundary.steps[0].path).toBe("/api/orders/{order_id}");
+        expect(authBoundary.steps[0].expectedStatusCode).toBe(401);
+        expect(authBoundary.requiresAuth).toBe(false);
     });
-    it("same action sub-path under different resources → both resolve correctly", () => {
+    it("auth-boundary scenario is not duplicated for same method/path", () => {
         const groups = makeGroups({
-            products: { basePath: "/api/products", methods: ["GET", "POST"], paramPath: "/api/products/{id}" },
-            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{id}" },
+            orders: { basePath: "/api/orders", methods: ["GET", "POST", "PUT", "DELETE"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([
-            { method: "GET", path: "/api/products/search" },
-            { method: "GET", path: "/api/orders/search" },
-        ], groups, "new_endpoint");
-        expect(result).toHaveLength(2);
-        const names = result.map(s => s.scenarioName);
-        expect(names[0]).not.toBe(names[1]);
-        expect(names.some(n => n.includes("products"))).toBe(true);
-        expect(names.some(n => n.includes("orders"))).toBe(true);
+        const scenarios = draftDiffDirectScenarios([{ method: "PUT", path: "/api/orders/{order_id}" }, { method: "DELETE", path: "/api/orders/{order_id}" }], groups);
+        const authBoundaries = scenarios.filter(s => s.scenarioName.includes("auth-boundary"));
+        // One for PUT, one for DELETE (not GET, not POST)
+        expect(authBoundaries).toHaveLength(2);
+        expect(authBoundaries.map(s => s.scenarioName).sort()).toEqual([
+            "orders-delete-auth-boundary",
+            "orders-put-auth-boundary",
+        ]);
     });
-    it("/api/v1/payments → 'payments' is a real resource, generates scenarios", () => {
+    it("does NOT generate auth-boundary for GET endpoints (often public)", () => {
         const groups = makeGroups({
-            payments: { basePath: "/api/v1/payments", methods: ["GET", "POST"], paramPath: "/api/v1/payments/{id}" },
+            orders: { basePath: "/api/orders", methods: ["GET", "POST"], paramPath: "/api/orders/{order_id}" },
         });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/v1/payments" }], groups, "new_endpoint");
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.some(s => s.scenarioName.includes("payments"))).toBe(true);
+        const scenarios = draftDiffDirectScenarios([{ method: "GET", path: "/api/orders/{order_id}" }], groups);
+        const authBoundary = scenarios.find(s => s.scenarioName.includes("auth-boundary"));
+        expect(authBoundary).toBeUndefined();
     });
-    it("/api/v1/webhooks → 'webhooks' is a real resource, generates scenarios", () => {
+    it("does NOT generate auth-boundary for POST", () => {
         const groups = makeGroups({
-            webhooks: { basePath: "/api/v1/webhooks", methods: ["GET", "POST"], paramPath: "/api/v1/webhooks/{id}" },
+            products: { basePath: "/api/products", methods: ["GET", "POST"], paramPath: "/api/products/{id}" },
         });
-        const result = draftMinimalScenarios([{ method: "POST", path: "/api/v1/webhooks" }], groups, "new_endpoint");
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.some(s => s.scenarioName.includes("webhooks"))).toBe(true);
+        const scenarios = draftDiffDirectScenarios([{ method: "POST", path: "/api/products" }], groups);
+        const authBoundary = scenarios.find(s => s.scenarioName.includes("auth-boundary"));
+        expect(authBoundary).toBeUndefined();
     });
 });
-// ---------------------------------------------------------------------------
-// draftScenariosFromEndpoints — integration tests
-// ---------------------------------------------------------------------------
-describe("draftScenariosFromEndpoints", () => {
-    it("returns empty array for no endpoints", () => {
-        expect(draftScenariosFromEndpoints([])).toEqual([]);
+describe("draftDiffDirectScenarios — GET without path param", () => {
+    const resourceGroups = new Map([
+        ["products", {
+                basePath: "/api/v1/products",
+                methods: new Set(["GET", "POST"]),
+                paramPath: "/api/v1/products/{product_id}",
+            }],
+    ]);
+    it("GET no-param: produces contract + collection scenario (LLM determines if query params apply)", () => {
+        const result = draftDiffDirectScenarios([{ method: "GET", path: "/api/v1/products/search" }], resourceGroups);
+        const names = result.map(s => s.scenarioName);
+        expect(names).toContain("products-get-new-endpoint-contract");
+        expect(names).toContain("products-search-list-query");
+        const scenario = result.find(s => s.scenarioName === "products-search-list-query");
+        expect(scenario.category).toBe("new_endpoint");
+        // Description instructs LLM to read source for query param logic
+        expect(scenario.description).toMatch(/read diff source|query param/i);
     });
-    it("passes newEndpoints through as new_endpoint category", () => {
-        const endpoints = [
-            { path: "/api/orders", methods: ["GET", "POST", "PUT"] },
-            { path: "/api/orders/{order_id}", methods: ["GET", "PUT", "DELETE"] },
-        ];
-        const newEndpoints = [{ method: "PUT", path: "/api/orders/{order_id}" }];
-        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
-        const newScenarios = result.filter(s => s.category === "new_endpoint");
-        expect(newScenarios.length).toBeGreaterThan(0);
-        expect(newScenarios.some(s => s.steps.some(st => st.method === "PUT"))).toBe(true);
+    it("GET no-param: produces zero cascade-delete or unique-constraint scenarios", () => {
+        const result = draftDiffDirectScenarios([{ method: "GET", path: "/api/v1/products/search" }], resourceGroups);
+        const names = result.map(s => s.scenarioName);
+        expect(names.some(n => n.includes("cascade"))).toBe(false);
+        expect(names.some(n => n.includes("unique"))).toBe(false);
+        expect(names.some(n => n.includes("delete-blocked"))).toBe(false);
     });
-    it("changed + new endpoints on same resource → new takes priority (no duplicates)", () => {
-        const endpoints = [
-            { path: "/api/orders", methods: [{ method: "GET" }, { method: "POST" }, { method: "PUT" }] },
-            { path: "/api/orders/{order_id}", methods: [{ method: "GET" }, { method: "PUT" }, { method: "DELETE" }] },
-        ];
-        const newEndpoints = [{ method: "PUT", path: "/api/orders/{order_id}" }];
-        const changedEndpoints = [{ method: "PUT", path: "/api/orders/{order_id}" }];
-        const result = draftScenariosFromEndpoints(endpoints, newEndpoints, changedEndpoints);
-        const putScenarios = result.filter(s => s.steps.some(st => st.method === "PUT"));
-        const newPut = putScenarios.filter(s => s.category === "new_endpoint");
-        const changedPut = putScenarios.filter(s => s.category === "business_rule");
-        expect(newPut.length).toBeGreaterThan(0);
-        expect(changedPut.length).toBe(0); // deduped — new takes priority
-    });
-    it("changed endpoints produce scenarios even when no new endpoints exist", () => {
-        const endpoints = [
-            { path: "/api/orders", methods: [{ method: "GET" }, { method: "POST" }] },
-            { path: "/api/orders/{order_id}", methods: [{ method: "GET" }, { method: "PATCH" }] },
-        ];
-        const result = draftScenariosFromEndpoints(endpoints, [], [
-            { method: "PATCH", path: "/api/orders/{order_id}" },
-        ]);
-        expect(result.length).toBeGreaterThan(0);
-        expect(result.every(s => s.category === "business_rule")).toBe(true);
+    it("collection GET with POST: produces integration scenario (POST then GET)", () => {
+        const result = draftDiffDirectScenarios([{ method: "GET", path: "/api/v1/products" }], resourceGroups);
+        const scenario = result.find(s => s.scenarioName === "products-list-query");
+        expect(scenario).toBeDefined();
+        expect(scenario.testType).toBe("integration");
+        expect(scenario.steps[0].method).toBe("POST");
+        expect(scenario.steps[1].method).toBe("GET");
     });
-    it("modified GET → contract only; modified PUT → contract + integration", () => {
-        const endpoints = [
-            { path: "/api/orders", methods: [{ method: "GET" }, { method: "POST" }, { method: "PUT" }] },
-            { path: "/api/orders/{order_id}", methods: [{ method: "GET" }, { method: "PUT" }] },
-        ];
-        const result = draftScenariosFromEndpoints(endpoints, [], [
-            { method: "GET", path: "/api/orders/{order_id}" },
-            { method: "PUT", path: "/api/orders/{order_id}" },
+    it("collection GET without POST: produces contract scenario (single GET step)", () => {
+        const readOnlyGroups = new Map([
+            ["reports", {
+                    basePath: "/api/v1/reports",
+                    methods: new Set(["GET"]),
+                    paramPath: undefined,
+                }],
         ]);
-        const getScenarios = result.filter(s => s.steps[0].method === "GET");
-        const putScenarios = result.filter(s => s.steps[0].method === "PUT");
-        expect(getScenarios).toHaveLength(1); // contract only
-        expect(putScenarios).toHaveLength(2); // contract + integration
-    });
-    it("unrelated endpoints sharing last segment both produce scenarios", () => {
-        // /products/search and /orders/search both extract "search" as resource name.
-        // Without disambiguated keys, the second endpoint is silently dropped.
-        const endpoints = [
-            { path: "/api/products/search", methods: ["GET"] },
-            { path: "/api/orders/search", methods: ["GET"] },
-        ];
-        const result = draftScenariosFromEndpoints(endpoints, [
-            { method: "GET", path: "/api/products/search" },
-            { method: "GET", path: "/api/orders/search" },
-        ]);
-        expect(result).toHaveLength(2);
-        const paths = result.map(s => s.steps[0].path);
-        expect(paths).toContain("/api/products/search");
-        expect(paths).toContain("/api/orders/search");
+        const result = draftDiffDirectScenarios([{ method: "GET", path: "/api/v1/reports" }], readOnlyGroups);
+        const scenario = result.find(s => s.scenarioName === "reports-list-query");
+        expect(scenario).toBeDefined();
+        expect(scenario.testType).toBe("contract");
+        expect(scenario.steps).toHaveLength(1);
     });
 });
 // ---------------------------------------------------------------------------
 // capScenarios — enforced via draftScenariosFromEndpoints
 // ---------------------------------------------------------------------------
 describe("draftScenariosFromEndpoints — capScenarios hard limit", () => {
+    // Each PUT/PATCH new endpoint produces ~5 scenarios (mutation-verify, boundary-values,
+    // contract, not-found, auth-boundary). Seven resources × 2 methods each = 70 new
+    // endpoints → well above the 30-scenario cap.
     function makeEndpointsAndNewEps(resourceNames) {
         const endpoints = resourceNames.flatMap(r => [
             { path: `/api/${r}`, methods: [{ method: "GET" }, { method: "POST" }] },
@@ -309,8 +532,6 @@ describe("draftScenariosFromEndpoints — capScenarios hard limit", () => {
         const newEndpoints = resourceNames.flatMap(r => [
             { method: "PUT", path: `/api/${r}/{id}` },
             { method: "PATCH", path: `/api/${r}/{id}` },
-            { method: "POST", path: `/api/${r}` },
-            { method: "DELETE", path: `/api/${r}/{id}` },
         ]);
         return { endpoints, newEndpoints };
     }
@@ -324,9 +545,24 @@ describe("draftScenariosFromEndpoints — capScenarios hard limit", () => {
         const resources = ["users", "products", "orders", "invoices", "shipments", "reviews", "payments", "discounts"];
         const { endpoints, newEndpoints } = makeEndpointsAndNewEps(resources);
         const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        // new_endpoint is CRITICAL — verify at least some survive
         const criticalOnes = result.filter((s) => s.category === "new_endpoint");
         expect(criticalOnes.length).toBeGreaterThan(0);
     });
+    it("CRITICAL items (new_endpoint) fill the cap first; security_boundary may be dropped", () => {
+        // With many new endpoints, diffDirectContract/NotFound/MutationVerify/BoundaryValues all
+        // produce category "new_endpoint" (CRITICAL). When CRITICAL items alone exceed 30, the hard
+        // cap slices them first — breadth picks for non-CRITICAL categories are not guaranteed.
+        const resources = ["users", "products", "orders", "invoices", "shipments", "reviews", "payments", "discounts"];
+        const { endpoints, newEndpoints } = makeEndpointsAndNewEps(resources);
+        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        // All 30 surviving scenarios should be CRITICAL (new_endpoint)
+        const nonCritical = result.filter((s) => s.category !== "new_endpoint");
+        // Non-critical (security_boundary) may be 0 — this is the documented cap behavior
+        expect(nonCritical.length).toBeLessThanOrEqual(result.length);
+        // And the cap is enforced
+        expect(result.length).toBeLessThanOrEqual(30);
+    });
     it("does not cap when total scenarios are within the limit", () => {
         const endpoints = [
             { path: "/api/users", methods: [{ method: "GET" }, { method: "POST" }] },
@@ -336,24 +572,74 @@ describe("draftScenariosFromEndpoints — capScenarios hard limit", () => {
             { method: "PUT", path: "/api/users/{id}" },
         ];
         const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        // A single PUT endpoint produces 5 scenarios — well within the 30-scenario cap
         expect(result.length).toBeLessThanOrEqual(30);
-        expect(result.length).toBe(2); // contract + integration
+        expect(result.length).toBeGreaterThanOrEqual(4);
     });
-    it("respects MAX_TOTAL_SCENARIOS with combined new+changed", () => {
-        const resources = ["users", "products", "orders", "invoices", "shipments", "reviews", "payments", "discounts"];
-        const endpoints = resources.flatMap(r => [
-            { path: `/api/${r}`, methods: [{ method: "GET" }, { method: "POST" }] },
-            { path: `/api/${r}/{id}`, methods: [{ method: "GET" }, { method: "PUT" }, { method: "PATCH" }, { method: "DELETE" }] },
-        ]);
-        const newEndpoints = resources.slice(0, 4).flatMap(r => [
-            { method: "PUT", path: `/api/${r}/{id}` },
-            { method: "POST", path: `/api/${r}` },
-        ]);
-        const changedEndpoints = resources.slice(4).flatMap(r => [
-            { method: "PATCH", path: `/api/${r}/{id}` },
-            { method: "GET", path: `/api/${r}/{id}` },
-        ]);
-        const result = draftScenariosFromEndpoints(endpoints, newEndpoints, changedEndpoints);
-        expect(result.length).toBeLessThanOrEqual(30);
+});
+describe("path collision fix — resourceGroups disambiguation", () => {
+    it("unrelated paths sharing a last segment do not overwrite each other", () => {
+        // /api/v1/orders/search and /api/v1/products/search share 'search' as last segment.
+        // Before the fix, the second overwrote the first in resourceGroups.
+        // The scenario must reference the orders/search path specifically, not products/search.
+        const endpoints = [
+            { path: "/api/v1/orders/search", methods: ["GET"] },
+            { path: "/api/v1/products/search", methods: ["GET"] },
+        ];
+        const newEndpoints = [{ method: "GET", path: "/api/v1/orders/search" }];
+        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        expect(result.length).toBeGreaterThanOrEqual(1);
+        const allPaths = result.flatMap((s) => (s.steps ?? []).map((step) => step.path ?? ""));
+        // Must contain orders/search
+        expect(allPaths.some((p) => p.includes("orders/search"))).toBe(true);
+        // Must NOT contain products/search — wrong path from a collision would appear here
+        expect(allPaths.some((p) => p.includes("products/search"))).toBe(false);
+    });
+    it("related paths (nested resources) still merge correctly", () => {
+        // /api/v1/users and /api/v1/users/{id} are related — should still merge
+        const endpoints = [
+            { path: "/api/v1/users", methods: ["GET", "POST"] },
+            { path: "/api/v1/users/{id}", methods: ["GET", "PUT", "DELETE"] },
+        ];
+        const newEndpoints = [{ method: "POST", path: "/api/v1/users" }];
+        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        expect(result.length).toBeGreaterThanOrEqual(1);
+    });
+    it("new endpoint under a disambiguated group is not silently dropped", () => {
+        // When two paths share a last segment, both are stored under disambiguated keys
+        // (e.g. "search::/api/v1/orders/search"). The fallback in draftDiffDirectScenarios
+        // must use the full key for resourceGroups.get(), not the stripped "search" name
+        // (which has no entry), otherwise the scenario is silently skipped.
+        const endpoints = [
+            { path: "/api/v1/orders/search", methods: ["GET"] },
+            { path: "/api/v1/products/search", methods: ["GET"] },
+            { path: "/api/v1/orders", methods: ["GET", "POST"] },
+            { path: "/api/v1/products", methods: ["GET", "POST"] },
+        ];
+        const newEndpoints = [
+            { method: "GET", path: "/api/v1/orders/search" },
+            { method: "GET", path: "/api/v1/products/search" },
+        ];
+        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        // Both new endpoints must produce at least one scenario each — neither should be dropped
+        const allPaths = result.flatMap((s) => (s.steps ?? []).map((step) => step.path ?? ""));
+        expect(allPaths.some((p) => p.includes("orders/search") || p.includes("orders"))).toBe(true);
+        expect(allPaths.some((p) => p.includes("products/search") || p.includes("products"))).toBe(true);
+    });
+    it("paths sharing a string prefix but different resource names are not merged", () => {
+        // /api/v1/orders and /api/v1/orders-archive start with the same string
+        // but are different resources. startsWith alone would incorrectly merge them.
+        const endpoints = [
+            { path: "/api/v1/orders", methods: ["GET", "POST"] },
+            { path: "/api/v1/orders-archive", methods: ["GET"] },
+        ];
+        const newEndpoints = [{ method: "POST", path: "/api/v1/orders" }];
+        const result = draftScenariosFromEndpoints(endpoints, newEndpoints);
+        expect(result.length).toBeGreaterThanOrEqual(1);
+        const allPaths = result.flatMap((s) => (s.steps ?? []).map((step) => step.path ?? ""));
+        // orders scenario must be present
+        expect(allPaths.some((p) => p.includes("/orders"))).toBe(true);
+        // orders-archive must not appear in scenarios targeting /orders
+        expect(allPaths.some((p) => p.includes("orders-archive"))).toBe(false);
     });
 });