tinybeeai 0.0.0-stage → 0.16.1

package/dist/review/backend-mock.js

@@ -0,0 +1,686 @@
+// Rule-based backend for the PR review (docs/PR-REVIEW-QA.md section 4.4). No model call.
+// It builds risks from signals of weight 3 or more (one per kind) and from length guards
+// on added lines, picks existing tests from the spec links, writes one new scenario per
+// risk, and takes the regression scope from the graph. It never verifies: every claim
+// stays unverified. The same answer serves as the fallback when a live pass fails.
+//
+// The demo pr_opened payload (search debounce) yields one risk ("One-letter search returns
+// no results"), one existing test and one new scenario, so the demo shows every section.
+import { converse } from './backend.js';
+import { fileOf, isCitable } from './scope.js';
+import { checklistItem, isSecurityCheck } from './security.js';
+import { dropScreenSteps, isBackendOnly } from './backend-only.js';
+const RISK_KIND = {
+    money: 'money',
+    auth: 'auth',
+    dates: 'dates',
+    concurrency: 'concurrency',
+    migration: 'migration',
+    feature_flag: 'feature_flag',
+    validation_changed: 'validation',
+    guard_removed: 'guard_removed',
+    response_shape: 'response_shape',
+    ui_state: 'ui_state',
+    selector_drift: 'selector_drift',
+    route_changed: 'route',
+    public_api: 'public_api',
+    config_env: 'config',
+    dependency_bump: 'dependency',
+    i18n_text: 'i18n',
+};
+const TEXT = {
+    money: {
+        title: 'Amount calculation changed',
+        why: 'The changed line computes or rounds an amount that users pay or receive.',
+        impact: 'Users see a wrong total, charge or refund.',
+        scenario: 'Check the amount on the changed path at a rounding boundary.',
+        steps: ['Build an order whose total rounds at half a cent', 'Complete the flow that uses the changed code'],
+        expected: 'The amount matches on every screen and receipt.',
+        severity: 'critical',
+    },
+    auth: {
+        title: 'Access check changed',
+        why: 'The changed line decides who can see or change data.',
+        impact: 'Users reach data they should not see, or lose access they need.',
+        scenario: 'Try the changed path as a user with each role.',
+        steps: ['Sign in as a user without the role', 'Open the changed page or call the changed endpoint'],
+        expected: 'Only users with the role get through.',
+        severity: 'critical',
+    },
+    dates: {
+        title: 'Date handling changed',
+        why: 'The changed line parses, formats or shifts a date.',
+        impact: 'Users see the wrong day or time near midnight or a time zone change.',
+        scenario: 'Check the changed date path in two time zones and on a month end.',
+        steps: ['Set the browser time zone to UTC minus 8', 'Use a date on the last day of a month'],
+        expected: 'The same date shows in every time zone.',
+        severity: 'high',
+    },
+    concurrency: {
+        title: 'Repeated actions overlap',
+        why: 'The changed line starts async work that a second action can start again.',
+        impact: 'Users see duplicate results or a stale answer after fast input.',
+        scenario: 'Repeat the changed action quickly on a slow network.',
+        steps: ['Throttle the network to slow 3G', 'Trigger the changed action twice in one second'],
+        expected: 'One request wins and the screen shows its result only.',
+        severity: 'high',
+    },
+    migration: {
+        title: 'Schema change on existing data',
+        why: 'The changed migration alters a table that already holds rows.',
+        impact: 'Deploys fail or existing records lose data.',
+        scenario: 'Apply the migration to a copy of a populated database.',
+        steps: ['Restore a database snapshot with rows', 'Run the migration'],
+        expected: 'The migration finishes and every row keeps its data.',
+        severity: 'critical',
+    },
+    feature_flag: {
+        title: 'Flag default changed',
+        why: 'The changed line sets or reads a feature flag.',
+        impact: 'Users get the new behaviour before anyone tested it.',
+        scenario: 'Run the changed flow with the flag on and with the flag off.',
+        steps: ['Turn the flag off and use the flow', 'Turn the flag on and use the flow'],
+        expected: 'Both states work as designed.',
+        severity: 'high',
+    },
+};
+const GENERIC = {
+    title: 'Changed behaviour on a core path',
+    why: 'The changed line alters behaviour that users reach directly.',
+    impact: 'Users see a different result than before.',
+    scenario: 'Use the changed flow with typical and boundary input.',
+    steps: ['Open the flow that uses the changed code', 'Use typical input, then boundary input'],
+    expected: 'The flow gives the same result as before for typical input.',
+    severity: 'high',
+};
+/** Rule-based text per security and robustness question; `why` and the scenario come from the lead. */
+const CHECK_TEXT = {
+    attacker_choice: {
+        impact: 'A forged event makes this machine check out and run code that the owner never approved.',
+        steps: ['Send a pull request event whose commit is not the head of that pull request', 'Watch the run steps and the working folder'],
+        expected: 'The run refuses the commit, and no code from it is checked out or run.',
+        severity: 'high',
+    },
+    path_safety: {
+        impact: 'A crafted checkout makes the server write outside the run folder, or a named pipe hangs the run.',
+        steps: [
+            'Make a folder on the copied path a symlink to a folder outside the checkout',
+            'Make one listed path a named pipe',
+            'Start a run that copies the listed files',
+        ],
+        expected: 'Both paths are skipped with a note, no file appears outside the run folder, and the run does not hang.',
+        severity: 'high',
+    },
+    delete_in_flight: {
+        impact: 'A deleted item can still post a comment, create an approval or save rows that point at nothing.',
+        steps: ['Start a run and hold it on a slow step, such as the model review', 'Delete the item that owns the run', 'Let the slow step finish'],
+        expected: 'The run stops quietly: no comment, approval or new row appears after the delete.',
+        severity: 'high',
+    },
+    caller_access: {
+        impact: 'A phone token or a caller without a token can read or change data that only the owner token may reach.',
+        steps: ['Call the changed route with no token', 'Call it with a phone token', 'Call it with the owner token'],
+        expected: 'Only the owner token gets through; the other calls get 401 or 403.',
+        severity: 'high',
+    },
+    changed_contract: {
+        impact: 'A caller that relies on the old result fails at once or takes the wrong branch.',
+        steps: [],
+        expected: 'Every caller gives the same result as before, or was changed on purpose.',
+        severity: 'high',
+    },
+    temp_cleanup: {
+        impact: 'Each run leaves folders in the temp folder until the disk is full.',
+        steps: ['Run the changed code ten times, one run failing', 'Count its folders in the temp folder'],
+        expected: 'The temp folder holds no folder from the runs.',
+        severity: 'medium',
+    },
+    time_dependent_test: {
+        impact: 'The suite fails just after midnight or in another time zone, and blocks unrelated changes.',
+        steps: ['Set the clock or a fake timer to 00:30 local time', 'Run the test file', 'Run it again with TZ set to a zone ten hours away'],
+        expected: 'The test passes at every time of day and in every time zone.',
+        severity: 'medium',
+    },
+    open_status: {
+        impact: 'A check or an approval stays pending forever, and the pull request looks blocked.',
+        steps: ['Open the item that sets the pending status', 'Reject it, let a second one expire, and make a third one fail'],
+        expected: 'The status closes each time with the reason.',
+        severity: 'high',
+    },
+};
+function securityText(f) {
+    const t = CHECK_TEXT[f.check];
+    const steps = f.check === 'changed_contract' && f.callers?.length
+        ? onePerFileFirst(f.callers)
+            .slice(0, 6)
+            .map((c) => `Run the caller at ${c.file}:${c.line} with the input the change treats differently`)
+        : t.steps;
+    return { ...t, title: f.title, why: f.scenario, scenario: scenarioFor(f), steps };
+}
+/** The first caller of each file, then the rest, so the steps reach every calling file. */
+function onePerFileFirst(callers) {
+    const seen = new Set();
+    const first = callers.filter((c) => !seen.has(c.file) && seen.add(c.file));
+    return [...first, ...callers.filter((c) => !first.includes(c))];
+}
+function scenarioFor(f) {
+    switch (f.check) {
+        case 'attacker_choice':
+            return 'Send an event that names a commit other than the pull request head. No checkout or test run starts.';
+        case 'path_safety':
+            return 'Put a symlinked folder and a named pipe on the copied paths, then start a run. Nothing is written outside.';
+        case 'delete_in_flight':
+            return 'Delete the item while one of its runs waits on a slow step. Nothing posts or saves after the delete.';
+        case 'caller_access':
+            return 'Call the changed route with no token, a phone token and the owner token. Only the owner token gets through.';
+        case 'changed_contract':
+            return `Run every caller of ${f.fn ?? 'the changed function'} with the input the change treats differently. Each caller still works.`;
+        case 'temp_cleanup':
+            return 'Run the changed code ten times, one run failing, then check the temp folder. No folder is left.';
+        case 'time_dependent_test':
+            return 'Run the test at 00:30 local time and in another time zone. It passes both times.';
+        case 'open_status':
+            return 'Reject, expire and fail the item that opened the status. The status closes each time.';
+    }
+}
+const NUMBER_WORDS = ['zero', 'one', 'two', 'three', 'four', 'five', 'six', 'seven', 'eight', 'nine', 'ten'];
+function cap(s) {
+    return s ? s[0].toUpperCase() + s.slice(1) : s;
+}
+function clipWords(s, n) {
+    const w = s
+        .replace(/[\r\n]+/g, ' ')
+        .split(String.fromCharCode(0x2014))
+        .join(', ')
+        .trim()
+        .split(/\s+/)
+        .filter(Boolean);
+    return w.length > n ? `${w.slice(0, n).join(' ')} ...` : w.join(' ');
+}
+/** First citable line of a signal's range, or null. With `kind`, the first one whose text shows that kind's pattern wins. */
+function citableLine(f, s, kind) {
+    if (!f)
+        return null;
+    const end = Math.max(s.line, s.lineEnd ?? s.line);
+    let first = null;
+    for (let n = s.line; n <= end; n++) {
+        if (!isCitable(f, n))
+            continue;
+        first ??= n;
+        if (!kind)
+            return n;
+        const text = lineText(f, n);
+        if (text !== undefined && matchesKind(kind, text))
+            return n;
+    }
+    return first;
+}
+/** New-side line span of the patch hunk holding a line, for grouping signals with a risk. */
+function hunkSpan(f, line) {
+    for (const h of f.hunks) {
+        const nums = h.lines.map((l) => l.n).filter((n) => n !== undefined);
+        if (!nums.length)
+            continue;
+        const lo = Math.min(...nums);
+        const hi = Math.max(...nums);
+        if (line >= lo && line <= hi)
+            return [lo, hi];
+    }
+    return null;
+}
+// ---------- grounding (KAT-100) ----------
+/**
+ * What the changed line must show for a risk of this kind. A kind with no entry keeps the citation
+ * check only. Each entry is a list: the line matches when any pattern does.
+ */
+const KIND_PATTERNS = {
+    money: [/amount|price|total|round|currency|tax/i],
+    auth: [/auth|token|permission|role|session|acl|isAdmin|login/i, /\bcan[A-Z]/],
+    dates: [/\bnew Date\b|\bDate\./, /moment|dayjs|toISOString|timezone/i],
+    concurrency: [/await|Promise|setTimeout|debounce|async|queue/i, /\block|lock\b|Lock/],
+    migration: [/ALTER|CREATE|DROP|migrat/i],
+    feature_flag: [/flag|feature|toggle|enabled/i],
+    validation: [/valid|required|\bmin\b|\bmax\b|pattern|regex|length|trim|match/i],
+    config: [/env|config|setting|secret|url|port|timeout/i],
+    i18n: [/i18n|locale|translat|\bt\(|intl|lang/i],
+};
+export const GROUNDED_WHY_PREFIX = 'Rule-based guess, not verified:';
+export const UNGROUNDED_REASON = 'Rule-based review: the line does not show the pattern';
+/** Source code without comments and string contents; `inString` keeps strings (SQL lives in strings). */
+function codeOnly(text, keepStrings) {
+    let out = text.replace(/\/\*.*?\*\//g, ' ');
+    if (!keepStrings)
+        out = out.replace(/'(?:[^'\\]|\\.)*'|"(?:[^"\\]|\\.)*"|`(?:[^`\\]|\\.)*`/g, '""');
+    const slash = out.search(/(^|\s)\/\/|(^|\s)#(?!\w)|(^|\s)--(\s|$)/);
+    if (slash >= 0)
+        out = out.slice(0, slash);
+    return /^\s*(\*|\/\*)/.test(out) ? '' : out;
+}
+/** Text of the changed line a citation points at: an added line, or the removed text at a deletion anchor. */
+function lineText(f, line) {
+    const added = f.added.get(line);
+    if (added !== undefined)
+        return added;
+    if (f.status === 'removed')
+        return f.removedRuns.flatMap((r) => r.lines).join('\n') || undefined;
+    const runs = f.removedRuns.filter((r) => r.anchor === line);
+    return runs.length ? runs.flatMap((r) => r.lines).join('\n') : undefined;
+}
+function matchesKind(kind, text) {
+    const patterns = KIND_PATTERNS[kind];
+    return !patterns || patterns.some((re) => re.test(text));
+}
+/**
+ * The one place that holds the rule-based review to the diff. A risk stays only when every evidence
+ * line is a changed line of a changed file and the line itself shows the pattern of the risk kind.
+ * A dropped risk takes its what-to-test items and test gaps with it, and its signals go to `dropped`.
+ * A risk that stays is a guess: medium at most, low when only a comment or a string shows the pattern.
+ */
+export function groundRisks(answer, scope, signals = []) {
+    const keep = [];
+    const goneIds = new Set();
+    const dropped = [...answer.dropped];
+    for (const r of answer.risks) {
+        let level = r.evidence.length ? 'ok' : 'bad';
+        for (const ev of r.evidence) {
+            const f = fileOf(scope, ev.file);
+            if (!f || !isCitable(f, ev.line)) {
+                level = 'bad';
+                break;
+            }
+            const text = lineText(f, ev.line);
+            if (text === undefined || !matchesKind(r.kind, text)) {
+                level = 'bad';
+                break;
+            }
+            // The pattern must show in code. A match only in a comment or a string makes a weak guess.
+            if (!matchesKind(r.kind, codeOnly(text, r.kind === 'migration')))
+                level = 'comment_or_string';
+        }
+        if (level === 'bad') {
+            goneIds.add(r.id);
+            for (const id of r.signals) {
+                const sig = signals.find((s) => s.id === id);
+                const f = sig ? fileOf(scope, sig.file) : undefined;
+                const at = sig && f ? (citableLine(f, sig) ?? sig.line) : undefined;
+                dropped.push({
+                    signal: id,
+                    reason: UNGROUNDED_REASON,
+                    evidence: sig && at !== undefined ? { file: sig.file, line: at } : (r.evidence[0] ?? { file: sig?.file ?? '', line: sig?.line ?? 0 }),
+                });
+            }
+            continue;
+        }
+        const severity = level === 'comment_or_string' ? 'low' : r.severity === 'critical' || r.severity === 'high' ? 'medium' : r.severity;
+        keep.push({ ...r, severity, why: r.why.startsWith(GROUNDED_WHY_PREFIX) ? r.why : `${GROUNDED_WHY_PREFIX} ${r.why}` });
+    }
+    const severityOf = new Map(keep.map((r) => [r.id, r.severity]));
+    const whatToTest = answer.whatToTest
+        .filter((t) => !(t.riskIds.length && t.riskIds.every((id) => goneIds.has(id)) && !t.existingTest))
+        .map((t) => {
+        const riskIds = t.riskIds.filter((id) => !goneIds.has(id));
+        // A new scenario is a must only while one of its risks is still high.
+        if (t.existingTest || !riskIds.length)
+            return { ...t, riskIds };
+        return {
+            ...t,
+            riskIds,
+            priority: riskIds.some((id) => severityOf.get(id) === 'high' || severityOf.get(id) === 'critical') ? 'must' : 'should',
+        };
+    });
+    const testGaps = answer.testGaps
+        .filter((g) => !(g.riskIds.length && g.riskIds.every((id) => goneIds.has(id))))
+        .map((g) => ({ ...g, riskIds: g.riskIds.filter((id) => !goneIds.has(id)) }));
+    return { ...answer, risks: keep, whatToTest, testGaps, dropped };
+}
+/** Identifiers that hold text a user types. A length guard on anything else is not a search or form bug. */
+const USER_TEXT_EXACT = /^(?:q|query|search|term|text|input|value|keyword|filter|name|title|str|s)$/i;
+const USER_TEXT_SUFFIX = /(?:[a-z0-9](?:Query|Search|Term|Text|Input|Keyword|Filter)|_(?:query|search|term|text|input|keyword|filter))$/;
+const userText = (id) => USER_TEXT_EXACT.test(id) || USER_TEXT_SUFFIX.test(id);
+/** `const trimmed = debounced.trim();` and `const d = useDebounce(query, 300);`: a value that is still the user's text. */
+const ALIAS_CALL = /^(?:use[A-Za-z]*(?:Debounce|Deferred)[A-Za-z]*|debounce|String)\(\s*([A-Za-z_$][\w$]*)\b/;
+const ALIAS_CHAIN = /^([A-Za-z_$][\w$]*)\s*(?:\??\.\s*(?:trim|trimStart|trimEnd|toLowerCase|toUpperCase|normalize|slice|replace)\([^)]*\)\s*)*(?:(?:\?\?|\|\|)\s*[^;]*)?;?\s*$/;
+/**
+ * True when `id` names user text, directly or because the file (changed and context lines) assigns it from
+ * a name that does, through trimming, case changes or a debounce hook. Three hops at most. A value filtered
+ * or computed from user text (`const items = search(query)`) is not user text.
+ */
+function holdsUserText(f, id, depth = 0, seen = new Set()) {
+    if (userText(id))
+        return true;
+    if (depth >= 3 || seen.has(id))
+        return false;
+    seen.add(id);
+    const assign = new RegExp(`(?:const|let|var)\\s+${id.replace(/[$]/g, '\\$')}\\s*=\\s*(.+)$`);
+    for (const text of [...f.added.values(), ...f.context.values()]) {
+        const rhs = assign.exec(text.trim())?.[1]?.trim();
+        if (!rhs)
+            continue;
+        const from = (ALIAS_CALL.exec(rhs) ?? ALIAS_CHAIN.exec(rhs))?.[1];
+        if (from && from !== id && holdsUserText(f, from, depth + 1, seen))
+            return true;
+    }
+    return false;
+}
+/** An area name that is a test file name or path, not a product area. */
+function testLike(name) {
+    return /\.(?:test|spec)\b|\/|(?:^|[_-])(?:test|spec)s?(?:[_.-]|$)/i.test(name);
+}
+/** Builds the rule-based answer. Deterministic for the same input and hints. */
+export function mockAnswer(x, ctl) {
+    const hints = ctl.hints ?? {};
+    const scope = x.scope;
+    const areas = x.impactDrafts.map((a) => ({
+        id: a.id,
+        area: a.area,
+        files: a.files.filter((p) => !!fileOf(scope, p)),
+        userFlows: a.userFlows.length ? a.userFlows : [`${a.area.toLowerCase()} from the main page`],
+        ...(a.routes?.length ? { routes: a.routes } : {}),
+        confidence: a.confidence,
+    }));
+    const areaOf = (path) => areas.find((a) => a.files.includes(path));
+    const mapped = new Set(areas.flatMap((a) => a.files));
+    const unmappedFiles = scope.files
+        .filter((f) => (f.class === 'source' || f.class === 'config' || f.class === 'migration') && !mapped.has(f.path))
+        .map((f) => f.path);
+    const lensNames = new Set(x.lenses.map((l) => l.name));
+    const floorOf = (name) => x.lenses.find((l) => l.name === name)?.floor ?? 0;
+    const drafts = [];
+    const used = new Set();
+    const nextId = () => `r${drafts.length + 1}`;
+    // Length guards on added lines: `q.length >= 2` hides results for shorter input. Only user text counts:
+    // `items.length >= 2` or `password.length > 7` says nothing about a search box.
+    for (const f of scope.files) {
+        if (f.class !== 'source')
+            continue;
+        for (const [n, text] of [...f.added.entries()].sort((a, b) => a[0] - b[0])) {
+            const code = codeOnly(text, false);
+            const m = [...code.matchAll(/\b(\w+)\.length\s*(>=|>)\s*(\d+)/g)].find((g) => holdsUserText(f, g[1]));
+            if (!m)
+                continue;
+            const min = m[2] === '>=' ? Number(m[3]) : Number(m[3]) + 1;
+            if (min < 2 || min > 9)
+                continue;
+            const area = areaOf(f.path);
+            const noun = (area && !testLike(area.area) ? area.area : 'input').toLowerCase();
+            const span = hunkSpan(f, n);
+            const near = x.signals.filter((s) => s.file === f.path && span !== null && s.line >= span[0] && s.line <= span[1] && s.kind !== 'tests_untouched' && !used.has(s.id));
+            near.forEach((s) => used.add(s.id));
+            const short = min === 2 ? 'a single character' : `fewer than ${min} characters`;
+            const fewer = NUMBER_WORDS[min - 1];
+            drafts.push({
+                risk: {
+                    id: nextId(),
+                    title: `${cap(fewer)}-letter ${noun} returns no results`,
+                    kind: 'ui_state',
+                    severity: 'high',
+                    likelihood: 'likely',
+                    why: `The new guard skips ${noun} when the text has fewer than ${min} characters.`,
+                    userImpact: `Users who type ${short} see no results and no message.`,
+                    evidence: [{ file: f.path, line: n }],
+                    ...(area ? { areaId: area.id } : {}),
+                    signals: near.map((s) => s.id),
+                    source: null,
+                    confidence: 0.7,
+                },
+                text: {
+                    ...GENERIC,
+                    scenario: `Type ${fewer} letter${min - 1 === 1 ? '' : 's'}, then ${NUMBER_WORDS[min]} letters, in ${noun} and check the result list.`,
+                    steps: [`Open the page with the ${noun} box`, `Type ${short} and wait one second`, 'Type one more character and wait one second'],
+                    expected: `Short input shows a hint or results, and ${min} characters show matching results.`,
+                },
+            });
+        }
+    }
+    // Security and robustness pass: one risk per question, from its first lead on a changed line.
+    const leads = x.security?.findings ?? [];
+    const byCheck = new Map();
+    for (const s of x.signals) {
+        if (used.has(s.id) || !isSecurityCheck(s.kind))
+            continue;
+        const f = leads.find((l) => l.check === s.kind && l.file === s.file && l.line === s.line);
+        if (!f || citableLine(fileOf(scope, s.file), s) === null)
+            continue;
+        if (!byCheck.has(f.check))
+            byCheck.set(f.check, []);
+        byCheck.get(f.check).push({ s, f });
+    }
+    for (const [check, list] of byCheck) {
+        const { s, f } = list[0];
+        const area = areaOf(s.file);
+        list.forEach((l) => used.add(l.s.id));
+        const text = securityText(f);
+        drafts.push({
+            risk: {
+                id: nextId(),
+                title: text.title,
+                kind: checklistItem(check).riskKind,
+                severity: text.severity,
+                likelihood: 'possible',
+                why: text.why,
+                userImpact: text.impact,
+                evidence: [{ file: s.file, line: s.line }],
+                ...(area ? { areaId: area.id } : {}),
+                signals: list.map((l) => l.s.id),
+                source: `security:${check}`,
+                confidence: 0.7,
+            },
+            text,
+        });
+    }
+    // One risk per signal kind with weight 3 or more.
+    const byKind = new Map();
+    for (const s of x.signals) {
+        if (used.has(s.id) || s.weight < 3 || !RISK_KIND[s.kind])
+            continue;
+        if (!byKind.has(s.kind))
+            byKind.set(s.kind, []);
+        byKind.get(s.kind).push(s);
+    }
+    for (const [kind, list] of byKind) {
+        const rk = RISK_KIND[kind];
+        const first = list.find((s) => citableLine(fileOf(scope, s.file), s) !== null);
+        if (!first)
+            continue;
+        const line = citableLine(fileOf(scope, first.file), first, rk);
+        const text = TEXT[rk] ?? GENERIC;
+        const lens = (first.lens ?? '').split(',').find((l) => lensNames.has(l));
+        const area = areaOf(first.file);
+        list.forEach((s) => used.add(s.id));
+        drafts.push({
+            risk: {
+                id: nextId(),
+                title: text.title,
+                kind: rk,
+                severity: text.severity,
+                likelihood: 'possible',
+                why: text.why,
+                userImpact: text.impact,
+                evidence: [{ file: first.file, line }],
+                ...(area ? { areaId: area.id } : {}),
+                signals: list.map((s) => s.id),
+                source: lens ? `lens:${lens}` : null,
+                confidence: Math.max(0.7, lens ? floorOf(lens) : 0),
+            },
+            text,
+        });
+    }
+    const risks = drafts.map((d) => d.risk);
+    // Every other shown signal is dropped with its own line as evidence.
+    const dropped = [];
+    for (const s of x.signals) {
+        if (used.has(s.id))
+            continue;
+        const line = citableLine(fileOf(scope, s.file), s) ?? s.line;
+        dropped.push({
+            signal: s.id,
+            reason: s.kind === 'tests_untouched'
+                ? 'Rule-based review: a missing test is a gap to plan, not a risk by itself.'
+                : `Rule-based review: weight ${s.weight} is below the risk threshold of 3.`,
+            evidence: { file: s.file, line },
+        });
+    }
+    // What to test: linked specs (or a smoke spec), then one new scenario per risk.
+    const testPaths = new Set(x.tests.map((t) => t.path));
+    const whatToTest = [];
+    const tid = () => `t${whatToTest.length + 1}`;
+    const fallbackArea = areas[0]?.id;
+    for (const a of areas) {
+        const risksHere = risks.filter((r) => r.areaId === a.id).map((r) => r.id);
+        const linked = (hints.specsByArea?.[a.id] ?? []).filter((p) => testPaths.has(p)).slice(0, 2);
+        for (const p of linked)
+            whatToTest.push({
+                id: tid(),
+                scenario: `Run the linked spec for ${a.area}.`,
+                type: 'e2e',
+                priority: 'should',
+                areaId: a.id,
+                riskIds: risksHere,
+                existingTest: p,
+            });
+    }
+    if (!whatToTest.length && fallbackArea) {
+        const smoke = (hints.smokeSpecs ?? []).find((p) => testPaths.has(p)) ?? x.tests[0]?.path;
+        if (smoke)
+            whatToTest.push({
+                id: tid(),
+                scenario: 'Run the smoke spec to confirm the app still loads.',
+                type: 'e2e',
+                priority: 'should',
+                areaId: fallbackArea,
+                riskIds: [],
+                existingTest: smoke,
+            });
+    }
+    const backendOnly = isBackendOnly(x.scope, x.impactDrafts);
+    for (const d of drafts) {
+        const areaId = d.risk.areaId ?? fallbackArea;
+        if (!areaId)
+            continue;
+        let how = {
+            steps: d.text.steps,
+            expected: d.text.expected,
+            data: 'Seed data that the changed flow lists or computes.',
+        };
+        // A change with no screen has no screen steps (KAT-385). What is left of the template stays; a check with no step left has none.
+        if (backendOnly) {
+            how = dropScreenSteps(how).item;
+            if (how.steps?.length && !how.expected)
+                how.expected = 'The call answers as the change intends, with no error.';
+        }
+        whatToTest.push({
+            id: tid(),
+            scenario: d.text.scenario,
+            type: 'e2e',
+            priority: d.risk.severity === 'critical' || d.risk.severity === 'high' ? 'must' : 'should',
+            areaId,
+            riskIds: [d.risk.id],
+            ...how,
+        });
+    }
+    const testsAtRisk = [];
+    for (const k of hints.testsAtRiskDrafts ?? []) {
+        const f = fileOf(scope, k.evidence.file);
+        if (!f || !isCitable(f, k.evidence.line) || testsAtRisk.length >= 10)
+            continue;
+        testsAtRisk.push({
+            id: `k${testsAtRisk.length + 1}`,
+            path: k.path,
+            reason: `The test uses "${clipWords(k.value, 6)}", which the change removed or renamed.`,
+            evidence: { file: k.evidence.file, line: k.evidence.line },
+            testLine: k.testLine,
+        });
+    }
+    const testGaps = [];
+    for (const a of areas) {
+        const risksHere = risks.filter((r) => r.areaId === a.id).map((r) => r.id);
+        if (!risksHere.length || (hints.specsByArea?.[a.id] ?? []).length)
+            continue;
+        testGaps.push({
+            id: `g${testGaps.length + 1}`,
+            areaId: a.id,
+            missing: `No listed test covers the ${a.area} flow that the change touches.`,
+            type: 'e2e',
+            riskIds: risksHere,
+        });
+    }
+    const areaIds = new Set(areas.map((a) => a.id));
+    const hint = hints.scopeHint ?? {
+        level: areas.length ? 'area' : 'narrow',
+        areaIds: areas.map((a) => a.id),
+        reason: 'the change stays in its impact areas.',
+    };
+    const regressionScope = { level: hint.level, areaIds: hint.areaIds.filter((id) => areaIds.has(id)), reason: cap(hint.reason.replace(/\.?$/, '.')) };
+    const answer = groundRisks({
+        summary: '',
+        impactAreas: areas,
+        unmappedFiles,
+        risks,
+        whatToTest,
+        testsAtRisk,
+        testGaps,
+        regressionScope,
+        releaseNotesImpact: placeholderNotes(),
+        dropped,
+    }, scope, x.signals);
+    return describe(answer, x, scope);
+}
+function placeholderNotes() {
+    return { userVisible: false, note: null, audience: 'none', breaking: false };
+}
+/** Product areas for the summary: not test files, at most three names, then a count of the rest. */
+function areaPhrase(areas, scope) {
+    const product = areas.filter((a) => {
+        if (testLike(a.area))
+            return false;
+        return a.files.some((p) => fileOf(scope, p)?.class !== 'test');
+    });
+    const names = [...new Set(product.map((a) => a.area))];
+    if (!names.length)
+        return 'no mapped area';
+    const shown = names.slice(0, 3);
+    const rest = names.length - shown.length;
+    if (rest > 0)
+        return `${shown.join(', ')} and ${rest} more area${rest === 1 ? '' : 's'}`;
+    return shown.length > 1 ? `${shown.slice(0, -1).join(', ')} and ${shown[shown.length - 1]}` : shown[0];
+}
+/** The summary and the release note, written after grounding so they describe only the risks that stayed. */
+function describe(a, x, scope) {
+    const uiFile = scope.files.some((f) => f.class === 'source' && /\.(tsx|jsx|vue|svelte|html|css)$/.test(f.path));
+    const title = clipWords(x.event?.title ?? '', 18).replace(/[.!?]*$/, '');
+    const userVisible = uiFile || a.risks.length > 0;
+    const releaseNotesImpact = {
+        userVisible,
+        note: userVisible && title ? `${title}.` : null,
+        audience: userVisible ? 'end_users' : 'none',
+        breaking: false,
+    };
+    const lead = title ? `${title}.` : 'This change has no title.';
+    const summary = a.risks.length
+        ? `${lead} It touches ${areaPhrase(a.impactAreas, scope)}; test ${a.risks[0].title.toLowerCase()} first.`
+        : `${lead} No rule-based risk fired; run the linked tests.`;
+    return { ...a, summary, releaseNotesImpact };
+}
+export class MockQaBackend {
+    name = 'mock';
+    qaReview(input, ctl) {
+        const answer = mockAnswer(input, ctl);
+        return converse({
+            role: 'reviewer',
+            backend: this.name,
+            model: 'rules',
+            check: ctl.check,
+            first: async () => {
+                // The rule-based answer reads every changed line from the scope.
+                ctl.delivery?.markFiles(input.scope.files.map((f) => f.path));
+                return { raw: answer };
+            },
+            correct: async () => ({ raw: answer }),
+            maxCorrections: 0,
+        });
+    }
+    async qaVerify(_input, _claims) {
+        return { role: 'verifier', backend: this.name, model: 'rules', answer: null, ok: false, rounds: 0, errors: [], durationMs: 0, skipped: true };
+    }
+}
+//# sourceMappingURL=backend-mock.js.map