@skyramp/mcp 0.3.4 → 0.3.6-rc.1

package/build/utils/scenarioDrafting.js

@@ -4,6 +4,8 @@ import { CATEGORY_PRIORITY, PriorityTier } from "../types/TestRecommendation.js"
 import { inferExpectedStatus } from "./httpDefaults.js";
 import { WorkspaceAuthType } from "./workspaceAuth.js";
 import { deriveResourceToken } from "./importerHop.js";
+import { isSegmentPrefix, pathSuffixMatches } from "./pathMatching.js";
+import { singularize } from "./pluralization.js";
 // Only tokens that are structurally non-testable (meta, infra, static assets).
 // Semantic tokens like login, search, webhook, payment are removed — the LLM
 // already knows how to handle them and the filter was suppressing valid surfaces.
@@ -19,35 +21,10 @@ function extractExecutionVerb(endpointPath) {
     const match = EXECUTION_SUFFIX.exec(endpointPath);
     return match ? match[1].toLowerCase() : "execute";
 }
-/**
- * Returns true when `a` starts with `b` at a path-segment boundary.
- * Plain `startsWith` is not sufficient — "/orders-archive".startsWith("/orders") is true
- * even though they are different resources. Requiring the next character to be "/" or
- * end-of-string ensures only genuine path prefixes are matched.
- */
-const isSegmentPrefix = (a, b) => a.startsWith(b) && (a[b.length] === "/" || a[b.length] === undefined);
 export function isRealResource(r) {
     return !ACTION_PATTERN.test(r) && !ACTION_VERB_HYPHEN.test(r);
 }
 const SKIP_SEGMENTS = new Set(["api", "v1", "v2", "v3", "public"]);
-/**
- * Convert a plural resource name to its singular form for use in field names
- * and step descriptions.
- *
- * Handles the most common irregular plurals found in REST API paths:
- *   -ies → -y  (categories → category, companies → company)
- *   -ses → -s  (statuses → status, classes → class)
- * Falls back to removing the trailing "s" for regular plurals.
- */
-function singularize(word) {
-    if (word.endsWith("ies") && word.length > 3) {
-        return word.slice(0, -3) + "y";
-    }
-    if (word.endsWith("ses") && word.length > 4) {
-        return word.slice(0, -2); // statuses → status
-    }
-    return word.endsWith("s") && word.length > 1 ? word.slice(0, -1) : word;
-}
 /**
  * Extract the primary resource name from an endpoint path.
  * E.g. "/api/v1/flow-costs/{cost_id}" → "flow-costs"
@@ -145,10 +122,38 @@ export function inferResourceRelationships(endpoints) {
 }
 export function draftScenariosFromEndpoints(endpoints, newEndpoints = [], wsAuthType, options = {}, removedEndpoints = []) {
     const scenarios = [];
+    // A drafted step path reaches the agent as the plan's `endpoint` and as the
+    // URL the generated test calls, so it has to be the spelling an HTTP client
+    // accepts. A route scanned from Express or NestJS source arrives as
+    // `/members/:uid`; the agent then spends one of its two repair attempts
+    // fixing the URL. Measured on eval run 32606742433, fixture
+    // cc15-org-reviewer-role: "2-attempt limit reached after URL fix", and the
+    // test failed on an unrelated assertion it had no attempt left to correct.
+    //
+    // Normalize here, at the one place the drafter reads an endpoint, rather than
+    // rewriting every stored route: `extractResourceFromPath` already treats both
+    // spellings as a parameter, so nothing else in the pipeline needs the change.
+    // Every path this function compares must be normalized together. Converting
+    // `endpoints` alone made the attack-surface sibling search compare a brace
+    // path against a colon `changedEndpoints` entry and find nothing.
+    endpoints = endpoints.map((ep) => ({ ...ep, path: toBraceParams(ep.path) }));
+    newEndpoints = newEndpoints.map((ep) => ({ ...ep, path: toBraceParams(ep.path) }));
+    removedEndpoints = removedEndpoints.map((ep) => ({ ...ep, path: toBraceParams(ep.path) }));
+    if (options.changedEndpoints) {
+        options = {
+            ...options,
+            changedEndpoints: options.changedEndpoints.map((ep) => ({ ...ep, path: toBraceParams(ep.path) })),
+        };
+    }
     const resourceGroups = new Map();
     for (const ep of endpoints) {
         const segments = ep.path.split("/").filter(Boolean);
-        const nonParamSegs = segments.filter(s => !s.startsWith("{") && !SKIP_SEGMENTS.has(s));
+        // Was `!s.startsWith("{")` — brace-only, so a colon-style segment became the
+        // resource and the drafted scenario was named ":uid-delete-auth-boundary".
+        // `isPathParam` is this file's own predicate and already accepts both forms;
+        // it deliberately does NOT reject a literal id (see its comment, SKYR-4229),
+        // so this changes the param spelling only.
+        const nonParamSegs = segments.filter(s => !isPathParam(s) && !SKIP_SEGMENTS.has(s));
         const resource = nonParamSegs[nonParamSegs.length - 1] || "unknown";
         const hasParam = /\{/.test(ep.path);
         const resourceSegIdx = segments.lastIndexOf(resource);
@@ -221,7 +226,7 @@ const TIER_ORDER = { CRITICAL: 4, HIGH: 3, MEDIUM: 2, LOW: 1 };
 /**
  * Enforce a global cap on drafted scenarios while preserving category diversity.
  *
- * 1. CRITICAL (new_endpoint / diff-direct) scenarios prioritized first.
+ * 1. CRITICAL (bug_caught) scenarios prioritized first.
  * 2. One scenario per non-empty category guaranteed (breadth).
  * 3. Remaining budget filled by priority tier (HIGH > MEDIUM > LOW).
  * 4. Hard cap at MAX_TOTAL_SCENARIOS — applied to the combined output.
@@ -254,9 +259,13 @@ export function capScenarios(scenarios) {
 }
 // ── Diff-direct scenario drafting ──
 // Generates targeted scenarios for each new endpoint in the branch diff.
-// These get category "new_endpoint" which maps to the CRITICAL priority tier
-// in the scorer, so they always fill the GENERATE slots before any structural
-// scenario — aligning the plan with what the LLM naturally wants to do anyway.
+// These get category "new_endpoint", which maps to the MEDIUM priority tier in
+// the scorer — BELOW business_rule, security_boundary and the other categories
+// that state what a test proves. They compete for GENERATE slots on merit
+// rather than auto-filling ahead of everything else; CRITICAL is reserved for
+// bug_caught, which targets an actually identified flaw. Level with the
+// structural categories was still too high: the last rank key is the
+// candidateId, so among same-tier candidates the alphabet decided.
 /**
  * Build the minimum steps for a diff-direct integration scenario.
  * Prerequisite resources (e.g. POST /products before POST /orders) are NOT
@@ -525,9 +534,27 @@ const SOURCE_RESOURCE_SKIP_SEGMENTS = new Set([
     ...SKIP_SEGMENTS,
     "app", "apps", "handler", "handlers", "index", "page", "pages", "route", "routes", "router", "server", "src",
 ]);
+/**
+ * `:name` to `{name}`, including an Express/Fastify constraint or modifier
+ * (`:id(\d+)`, `:id?`). The match starts at a segment boundary and needs a
+ * letter or underscore first, so a port or a mid-segment colon is left alone.
+ * Next.js `[id]` stays as written — those mirror file paths.
+ */
+function toBraceParams(path) {
+    return (path ?? "").replace(/(^|\/):([A-Za-z_]\w*)(\([^)]*\))?[?*+]?/g, "$1{$2}");
+}
 function pathSegments(path) {
     return path.split("/").filter(Boolean);
 }
+/**
+ * Recognises a declared parameter, NOT a literal id value. A UUID, digits or a
+ * long hex segment reads as a resource name here, unlike routeParsers.ts's
+ * isParamSegment + isOpaqueIdSegment. So `collectionPathForChangedEndpoint`
+ * does not reduce `/orders/<uuid>` to `/orders`, and no attack-surface
+ * auth-boundary scenario is drafted for that endpoint. Left as-is on purpose:
+ * fixing it drafts MORE scenarios, which needs measurement. SKYR-4229 tracks
+ * it; pathSegmentClassification.characterization.test.ts pins today's answer.
+ */
 function isPathParam(segment) {
     return /^\{[^}]+\}$/.test(segment) ||
         /^:[A-Za-z_][A-Za-z0-9_]*$/.test(segment) ||
@@ -733,21 +760,6 @@ export function draftDiffDirectScenarios(newEndpoints, resourceGroups, wsAuthTyp
         methods.add(ep.method.toUpperCase());
         grouped.set(ep.path, methods);
     }
-    // Segment-boundary suffix match: avoids "/orders" matching "/preorders".
-    const pathSuffixMatches = (fullPath, suffix) => {
-        if (fullPath === suffix)
-            return true;
-        const fullSegs = fullPath.split("/").filter(Boolean);
-        const suffixSegs = suffix.split("/").filter(Boolean);
-        if (suffixSegs.length === 0 || suffixSegs.length > fullSegs.length)
-            return false;
-        const offset = fullSegs.length - suffixSegs.length;
-        for (let i = 0; i < suffixSegs.length; i++) {
-            if (fullSegs[offset + i] !== suffixSegs[i])
-                return false;
-        }
-        return true;
-    };
     for (const [epPath, methods] of grouped) {
         let resource = extractResourceName(epPath);
         let resolvedPath = epPath;

package/build/utils/subjectEndpoints.d.ts

@@ -0,0 +1,19 @@
+import { DraftedScenario, SubjectEndpoint } from "../types/RepositoryAnalysis.js";
+import { ChangedRoute } from "./changedRoutes.js";
+export type { SubjectEndpoint };
+/**
+ * The endpoints a scenario tests, in step order.
+ *
+ * 1. Every step on a changed diff line that names a resource. A test written
+ *    for a pull request is about what the pull request changed, and a
+ *    scenario can exercise more than one changed endpoint.
+ * 2. If no step matches: the last mutating step that is not a teardown step.
+ *    Earlier mutations are usually setup (POST /products before PATCH /orders).
+ * 3. If no mutating step remains: the last step.
+ *
+ * Returns an empty list only for a scenario with no steps. Every caller must
+ * treat an empty list as "no information", never as "covered".
+ */
+export declare function resolveSubjectEndpoints(scenario: DraftedScenario, opts: {
+    changedRoutes?: ChangedRoute[];
+}): SubjectEndpoint[];

package/build/utils/subjectEndpoints.js

@@ -0,0 +1,98 @@
+import { findStepOnChangedRoute } from "./changedRoutes.js";
+import { extractResourceFromPath, isParamSegment } from "./routeParsers.js";
+const MUTATING_METHODS = new Set(["POST", "PUT", "PATCH", "DELETE"]);
+/**
+ * A final-position DELETE that removes a resource an earlier POST created is
+ * cleanup, not the subject. SKYR-4214 measured the cost of counting it: the
+ * same fixture keyed as POST::flows on one run and DELETE::flows on the next,
+ * decided only by whether the model appended a cleanup step.
+ *
+ * The step count matters. A two-step POST-then-DELETE has no room for a
+ * verification step, so the DELETE is what the test is about; the cleanup shape
+ * always has a step between the create and the delete. A scenario that asserts
+ * the delete worked (…DELETE, then GET 404) leaves the DELETE off the final
+ * position, so it is not excluded either.
+ */
+function isTeardownStep(steps, index) {
+    const step = steps[index];
+    if (index !== steps.length - 1)
+        return false;
+    if ((step.method ?? "").toUpperCase() !== "DELETE")
+        return false;
+    if (steps.length < 3)
+        return false;
+    const resource = extractResourceFromPath(step.path ?? "");
+    // "unknown" is the sentinel for a path that names no resource, so comparing
+    // it by equality makes any two unidentifiable paths look like the same
+    // resource: `POST /` … `DELETE /{id}` read as create-then-cleanup and the
+    // DELETE — the real subject — got skipped. Only a named resource can pair.
+    if (resource === "unknown")
+        return false;
+    return steps.slice(0, index).some((earlier) => (earlier.method ?? "").toUpperCase() === "POST" &&
+        extractResourceFromPath(earlier.path ?? "") === resource);
+}
+/**
+ * A route declaration made only of parameter segments (or none at all, e.g.
+ * "/" or "") names no resource, so it cannot tell one endpoint from another —
+ * every step's path ends in the same param segment. SKYR-4214: a changed
+ * `@router.delete("/{id}")` line matched a step's trailing DELETE cleanup
+ * step just as well as the step it was actually meant to catch, which
+ * reinstated the bug this file exists to fix. Rule 1 only accepts a route
+ * that contributes at least one non-parameter segment.
+ */
+function routeIdentifiesResource(routePath) {
+    return routePath.split("/").filter(Boolean).some((segment) => !isParamSegment(segment));
+}
+/**
+ * The endpoints a scenario tests, in step order.
+ *
+ * 1. Every step on a changed diff line that names a resource. A test written
+ *    for a pull request is about what the pull request changed, and a
+ *    scenario can exercise more than one changed endpoint.
+ * 2. If no step matches: the last mutating step that is not a teardown step.
+ *    Earlier mutations are usually setup (POST /products before PATCH /orders).
+ * 3. If no mutating step remains: the last step.
+ *
+ * Returns an empty list only for a scenario with no steps. Every caller must
+ * treat an empty list as "no information", never as "covered".
+ */
+export function resolveSubjectEndpoints(scenario, opts) {
+    const steps = scenario.steps ?? [];
+    if (steps.length === 0)
+        return [];
+    const changedRoutes = (opts.changedRoutes ?? []).filter((route) => routeIdentifiesResource(route.path));
+    if (changedRoutes.length > 0) {
+        // Attribute PER ROUTE, not per step. A diff-extracted route is local to its
+        // own router declaration — the mount prefix lives in another file, so a bare
+        // `POST /items` suffix-matches a step on `/orders/{id}/items` and one on
+        // `/products/{id}/items` equally. Recording both would invent a subject the
+        // diff does not name, and dedup then needs every unrelated key covered
+        // before the candidate can be removed.
+        //
+        // A route matching exactly one step names that step. A route matching
+        // several names none of them: there is no evidence for choosing, and a
+        // guess is worse than an omission. Other routes still contribute, so a
+        // scenario that genuinely tests two changed endpoints keeps both subjects.
+        const attributed = [];
+        for (const route of changedRoutes) {
+            const matches = steps.filter((step) => findStepOnChangedRoute([step], [route]));
+            const distinct = new Map(matches.map((step) => [`${step.method} ${step.path}`, step]));
+            if (distinct.size === 1)
+                attributed.push([...distinct.values()][0]);
+        }
+        // Keep step order and drop the duplicates two routes can both name.
+        const onChanged = steps.filter((step) => attributed.includes(step));
+        if (onChanged.length > 0) {
+            return onChanged.map((step) => ({ method: step.method, path: step.path }));
+        }
+    }
+    for (let i = steps.length - 1; i >= 0; i--) {
+        if (!MUTATING_METHODS.has((steps[i].method ?? "").toUpperCase()))
+            continue;
+        if (isTeardownStep(steps, i))
+            continue;
+        return [{ method: steps[i].method, path: steps[i].path }];
+    }
+    const last = steps[steps.length - 1];
+    return [{ method: last.method, path: last.path }];
+}

package/build/utils/testFileClassification.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The single definition of "discovery treats this path as a test file", shared by
+ * discovery itself and by callers that must agree with what discovery classified as
+ * external coverage. A narrower predicate silently disagrees: `tests/test_orders.py`
+ * is external coverage here but is not a test file to `isTestFile` in
+ * scopeAssessment.ts, which only knows the Skyramp and JS/TS spec spellings.
+ *
+ * Accepts absolute or repo-relative paths. The directory patterns need a leading
+ * separator, which a repo-relative path has not got, so one is prepended.
+ */
+export declare function isDiscoveredTestFile(filePath: string): boolean;

package/build/utils/testFileClassification.js

@@ -0,0 +1,47 @@
+import * as path from "path";
+// Test file naming patterns — match against basename.
+// Includes Skyramp-generated suffixes so that files like orders_smoke.py placed
+// outside a recognized test directory are still discovered.
+const TEST_FILE_PATTERNS = [
+    /^test_.*\.(py|js|ts|rb|go|php)$/, // test_*.py, test_*.rb, test_*.go
+    /.*_test\.(py|ts|js|go|rs)$/, // *_test.py, *_test.go, *_test.rs
+    /.*\.test\.(ts|js|tsx|jsx)$/, // *.test.ts, *.test.js, *.test.tsx
+    /.*\..*spec\.(ts|js|tsx|jsx|rb)$/, // *.spec.ts, *.e2e-spec.ts, *.unit-spec.ts
+    /.*Test\.(java|kt|kts|cs|scala|swift|m)$/, // *Test.java, *Test.kt, *Test.m (ObjC)
+    /.*Tests\.(cs|swift|m)$/, // *Tests.cs, *Tests.swift, *Tests.m (ObjC)
+    /.*_spec\.rb$/, // *_spec.rb (RSpec)
+    /.*\.test\.php$/, // *.test.php
+    /.*Test\.php$/, // *Test.php (PHPUnit)
+    // Skyramp-generated test suffixes — must be matched even outside test dirs
+    /.*_(?:smoke|contract|fuzz|integration|load|e2e|ui)\.(py|ts|js|java|rb|go|cs|kt|kts|scala|swift|php|rs)$/i,
+];
+// Directory patterns that signal test-owned files — works with both / and \ separators.
+// Includes standard test dirs, snapshot dirs, and common helper/fixture dirs used by
+// Playwright, Cypress, and other frameworks for page objects and support code.
+const TEST_DIR_PATTERNS = [
+    /[\\/]tests?[\\/]/,
+    /[\\/]__tests__[\\/]/,
+    /[\\/]__snapshots__[\\/]/, // Jest/Vitest snapshot directories
+    /[\\/]spec[\\/]/,
+    /[\\/]e2e[\\/]/,
+    /[\\/]cypress[\\/]/, // Cypress support, fixtures, plugins
+    /[\\/]playwright[\\/]/, // Playwright fixtures and helpers
+    /[\\/]page-?objects?[\\/]/, // page-objects/, page-object/, pageObjects/
+    /[\\/]fixtures[\\/](?!db[\\/]|seed[\\/]|migrations[\\/])/, // test fixture files (not db/seed/migration fixtures)
+    /[\\/]cypress[\\/]support[\\/]/, // Cypress support directory (scoped to avoid matching app support/ dirs)
+];
+/**
+ * The single definition of "discovery treats this path as a test file", shared by
+ * discovery itself and by callers that must agree with what discovery classified as
+ * external coverage. A narrower predicate silently disagrees: `tests/test_orders.py`
+ * is external coverage here but is not a test file to `isTestFile` in
+ * scopeAssessment.ts, which only knows the Skyramp and JS/TS spec spellings.
+ *
+ * Accepts absolute or repo-relative paths. The directory patterns need a leading
+ * separator, which a repo-relative path has not got, so one is prepended.
+ */
+export function isDiscoveredTestFile(filePath) {
+    if (TEST_FILE_PATTERNS.some((p) => p.test(path.basename(filePath))))
+        return true;
+    return TEST_DIR_PATTERNS.some((p) => p.test(`/${filePath}`));
+}

package/build/utils/uiPageEnumerator.d.ts

@@ -14,6 +14,12 @@
  *     Next.js (app/ and pages/), Nuxt / Vue Router file-based, and SvelteKit.
  *     Gated on detection of a framework config file in the repo.
  *
+ *   Strategy 1b — Import graph
+ *     For a changed file that is not itself a route (a component, a constants
+ *     module), map the production files that import it through the same
+ *     filesystem-route mapper. Uses the importer list the production-importer integration
+ *     check already computed. Merged with strategy 1 rather than tried after it.
+ *
  *   Strategy 2 — Source-grounded routes
  *     Walks router/App files with the TS Compiler API for code-defined
  *     route declarations like `<Route path="/cart" element={<Cart/>}>`.
@@ -26,16 +32,38 @@
  *   Strategy 3 — Root fallback
  *     Read the workspace's frontend baseUrl and treat it as the single
  *     candidate page. Always available when a frontend service is configured.
+ *
+ * When no frontend baseUrl can be resolved, strategies 1/1b still run and their
+ * results are returned as bare URL paths (`baseUrlResolved: false`) so the agent
+ * can prefix the base URL it discovers; strategies 2–3 need a host and are skipped.
  */
-export type CandidateUiPageStrategy = "framework-route-grep" | "source-grounded-routes" | "dart-go-router" | "root-fallback";
+import type { FrontendFileIntegration } from "../types/FrontendIntegration.js";
+export type CandidateUiPageStrategy = "framework-route-grep" | "import-graph" | "source-grounded-routes" | "dart-go-router" | "root-fallback";
 export interface CandidateUiPage {
-    /** Fully qualified URL (workspace baseUrl + framework-derived path). */
+    /**
+     * Fully qualified URL (workspace baseUrl + framework-derived path), or a bare
+     * URL path when `baseUrlResolved` is false.
+     */
     url: string;
     /** Source files that suggested this page (for traceability). */
     sourcedFrom: string[];
     /** Which strategy enumerated it. */
     strategy: CandidateUiPageStrategy;
+    /**
+     * Present (false) only when no frontend baseUrl could be resolved and `url`
+     * is a bare path the agent must prefix. Absent means `url` is complete.
+     */
+    baseUrlResolved?: false;
+    /** import-graph only: the route files that import `sourcedFrom` and produced this path. */
+    via?: string[];
 }
+/**
+ * Upper bound on candidate pages. Strategy 1b is bounded by changed files ×
+ * importers, and every candidate costs the agent a navigate + a capture, so the
+ * list is cut here — direct route matches first, then import-graph pages that
+ * render the most changed files.
+ */
+export declare const MAX_CANDIDATE_PAGES = 10;
 /**
  * File-system → URL mapping for filesystem-routed frameworks.
  *
@@ -63,15 +91,7 @@ export declare function frameworkFileToUrlPath(filePath: string): string | null;
  * and the `frontendFiles[]`-derived candidate frontend roots.
  */
 export declare function detectsFilesystemRouting(repositoryPath: string): boolean;
-/**
- * Strategy 1 implementation. Filters frontend files through the framework
- * route mapper; collects the URL paths that mapped successfully.
- *
- * Suppressed when the repo doesn't have a recognized filesystem-routing
- * framework config — see `detectsFilesystemRouting`. Without that guard,
- * repos with conventional `pages/` directories but code-defined routes
- * (e.g. React with React Router) produce false-positive URLs.
- */
+/** Strategy 1 only (no import graph), joined to `baseUrl`. */
 export declare function findCandidatePagesByFrameworkRoute(frontendFiles: string[], baseUrl: string, repositoryPath?: string): CandidateUiPage[];
 /**
  * Strategy 2 implementation. Walks router/App files with the TS Compiler API
@@ -126,21 +146,27 @@ export declare function findRootFallbackPage(repositoryPath: string): Promise<Ca
  *      is the picked frontend service's serviceName, sanitized via
  *      `sanitizeServiceName`)
  *   2. Global override: `SKYRAMP_TEST_BASE_URL` (single service or all
- *      services share one URL)
+ *      services share one URL). Also honored when the workspace declares no
+ *      services at all — the action can know the URL without a workspace entry.
  *   3. Static workspace.yml value: `api.baseUrl` from the picked frontend
  *      service
  *
- * Returns null when no service has a usable URL.
+ * Returns null when neither the environment nor any service has a usable URL.
  *
  * Exported (vs private) so analyze_changes and future tools can reuse the
  * same selection without re-implementing it.
  */
 export declare function pickFrontendBaseUrl(repositoryPath: string): Promise<string | null>;
 /**
- * Run the strategy ladder in order: framework route grep (1) → source-grounded
- * routes (2) → root fallback (3). Each strategy is consulted only if the
- * previous one produced no candidates. Returns whatever the ladder produces
- * (possibly empty if the workspace has no frontend baseUrl AND none of the
- * earlier strategies matched).
+ * Run the strategy ladder: framework route grep + import graph (1/1b) →
+ * source-grounded routes (2) → Dart GoRouter (2.5) → root fallback (3). Each
+ * later strategy is consulted only if the earlier ones produced no candidates.
+ *
+ * `integration` is the production-importer check for the same files; when given,
+ * changed non-route files resolve to the pages that import them.
+ *
+ * Without a resolvable frontend baseUrl only strategies 1/1b can run; their
+ * paths are returned with `baseUrlResolved: false` for the agent to prefix.
+ * Returns empty only when nothing resolves at all.
  */
-export declare function enumerateCandidateUiPages(repositoryPath: string, frontendFiles: string[]): Promise<CandidateUiPage[]>;
+export declare function enumerateCandidateUiPages(repositoryPath: string, frontendFiles: string[], integration?: FrontendFileIntegration[]): Promise<CandidateUiPage[]>;