@event4u/agent-config 16.4.0 → 17.0.0

package/dist/agent-src/skills/tailwind-engineer/scripts/tailwind_config_gen.mjs

@@ -0,0 +1,482 @@
+#!/usr/bin/env tsx
+
+// src/skills/tailwind-engineer/scripts/tailwind_config_gen.ts
+import * as fs from "node:fs";
+import * as path from "node:path";
+import process from "node:process";
+import { fileURLToPath, pathToFileURL } from "node:url";
+var PROG = "tailwind_config_gen";
+var USAGE = `usage: ${PROG} [-h] [--framework {react,vue,svelte,nextjs}]
+                              [--js] [--output OUTPUT]
+                              [--colors [NAME:VALUE ...]]
+                              [--fonts [TYPE:FAMILY ...]]
+                              [--spacing [NAME:VALUE ...]]
+                              [--breakpoints [NAME:WIDTH ...]] [--plugins]
+                              [--validate-only]
+`;
+function jsonDumpsIndent2(obj) {
+  const pad = "  ";
+  function enc(value, depth) {
+    if (value === null) return "null";
+    if (typeof value === "boolean") return value ? "true" : "false";
+    if (typeof value === "number") return String(value);
+    if (typeof value === "string") return encStr(value);
+    if (Array.isArray(value)) {
+      if (value.length === 0) return "[]";
+      const inner2 = value.map((v) => pad.repeat(depth + 1) + enc(v, depth + 1));
+      return "[\n" + inner2.join(",\n") + "\n" + pad.repeat(depth) + "]";
+    }
+    const o = value;
+    const keys = Object.keys(o);
+    if (keys.length === 0) return "{}";
+    const inner = keys.map(
+      (k) => pad.repeat(depth + 1) + encStr(k) + ": " + enc(o[k], depth + 1)
+    );
+    return "{\n" + inner.join(",\n") + "\n" + pad.repeat(depth) + "}";
+  }
+  function encStr(s) {
+    let out = '"';
+    for (const ch of s) {
+      const cp = ch.codePointAt(0);
+      if (ch === '"') out += '\\"';
+      else if (ch === "\\") out += "\\\\";
+      else if (ch === "\n") out += "\\n";
+      else if (ch === "\r") out += "\\r";
+      else if (ch === "	") out += "\\t";
+      else if (ch === "\b") out += "\\b";
+      else if (ch === "\f") out += "\\f";
+      else if (cp < 32) out += "\\u" + cp.toString(16).padStart(4, "0");
+      else if (cp < 127) out += ch;
+      else if (cp > 65535) {
+        const v = cp - 65536;
+        const hi = 55296 + (v >> 10);
+        const lo = 56320 + (v & 1023);
+        out += "\\u" + hi.toString(16).padStart(4, "0");
+        out += "\\u" + lo.toString(16).padStart(4, "0");
+      } else {
+        out += "\\u" + cp.toString(16).padStart(4, "0");
+      }
+    }
+    return out + '"';
+  }
+  return enc(obj, 0);
+}
+function _stripChars(s, chars) {
+  let start = 0;
+  let end = s.length;
+  while (start < end && chars.includes(s[start])) {
+    start += 1;
+  }
+  while (end > start && chars.includes(s[end - 1])) {
+    end -= 1;
+  }
+  return s.slice(start, end);
+}
+var TailwindConfigGenerator = class {
+  typescript;
+  framework;
+  outputPath;
+  config;
+  constructor(typescript = true, framework = "react", outputPath = null) {
+    this.typescript = typescript;
+    this.framework = framework;
+    this.outputPath = outputPath ?? this._defaultOutputPath();
+    this.config = this._baseConfig();
+  }
+  /** Determine default output path — Path.cwd() / `tailwind.config.{ext}`. */
+  _defaultOutputPath() {
+    const ext = this.typescript ? "ts" : "js";
+    return path.join(process.cwd(), `tailwind.config.${ext}`);
+  }
+  /** Create base configuration structure. */
+  _baseConfig() {
+    return {
+      darkMode: ["class"],
+      content: this._defaultContentPaths(),
+      theme: {
+        extend: {}
+      },
+      plugins: []
+    };
+  }
+  /** Get default content paths for framework. */
+  _defaultContentPaths() {
+    const paths = {
+      react: ["./src/**/*.{js,jsx,ts,tsx}", "./index.html"],
+      vue: ["./src/**/*.{vue,js,ts,jsx,tsx}", "./index.html"],
+      svelte: ["./src/**/*.{svelte,js,ts}", "./src/app.html"],
+      nextjs: [
+        "./app/**/*.{js,ts,jsx,tsx}",
+        "./pages/**/*.{js,ts,jsx,tsx}",
+        "./components/**/*.{js,ts,jsx,tsx}"
+      ]
+    };
+    return paths[this.framework] ?? paths["react"];
+  }
+  _extend() {
+    return this.config["theme"]["extend"];
+  }
+  /** Add custom colors to theme (dict.update — insertion order preserved). */
+  addColors(colors) {
+    const extend = this._extend();
+    if (!("colors" in extend)) {
+      extend["colors"] = {};
+    }
+    const target = extend["colors"];
+    for (const [k, v] of Object.entries(colors)) {
+      target[k] = v;
+    }
+  }
+  /** Add full color palette (50-950 shades) for a base color. */
+  addColorPalette(name, _baseColor) {
+    const extend = this._extend();
+    if (!("colors" in extend)) {
+      extend["colors"] = {};
+    }
+    extend["colors"][name] = {
+      "50": `var(--color-${name}-50)`,
+      "100": `var(--color-${name}-100)`,
+      "200": `var(--color-${name}-200)`,
+      "300": `var(--color-${name}-300)`,
+      "400": `var(--color-${name}-400)`,
+      "500": `var(--color-${name}-500)`,
+      "600": `var(--color-${name}-600)`,
+      "700": `var(--color-${name}-700)`,
+      "800": `var(--color-${name}-800)`,
+      "900": `var(--color-${name}-900)`,
+      "950": `var(--color-${name}-950)`
+    };
+  }
+  /** Add custom font families. */
+  addFonts(fonts) {
+    const extend = this._extend();
+    if (!("fontFamily" in extend)) {
+      extend["fontFamily"] = {};
+    }
+    const target = extend["fontFamily"];
+    for (const [k, v] of Object.entries(fonts)) {
+      target[k] = v;
+    }
+  }
+  /** Add custom spacing values. */
+  addSpacing(spacing) {
+    const extend = this._extend();
+    if (!("spacing" in extend)) {
+      extend["spacing"] = {};
+    }
+    const target = extend["spacing"];
+    for (const [k, v] of Object.entries(spacing)) {
+      target[k] = v;
+    }
+  }
+  /** Add custom breakpoints. */
+  addBreakpoints(breakpoints) {
+    const extend = this._extend();
+    if (!("screens" in extend)) {
+      extend["screens"] = {};
+    }
+    const target = extend["screens"];
+    for (const [k, v] of Object.entries(breakpoints)) {
+      target[k] = v;
+    }
+  }
+  /** Add plugin requirements (skip duplicates, preserve order). */
+  addPlugins(plugins) {
+    const arr = this.config["plugins"];
+    for (const plugin of plugins) {
+      if (!arr.includes(plugin)) {
+        arr.push(plugin);
+      }
+    }
+  }
+  /** Get plugin recommendations based on configuration. */
+  recommendPlugins() {
+    const recommendations = [];
+    recommendations.push("tailwindcss-animate");
+    if (this.framework === "nextjs") {
+      recommendations.push("@tailwindcss/typography");
+    }
+    return recommendations;
+  }
+  /** Generate configuration file content. */
+  generateConfigString() {
+    if (this.typescript) {
+      return this._generateTypescript();
+    }
+    return this._generateJavascript();
+  }
+  /** Generate TypeScript configuration. */
+  _generateTypescript() {
+    const pluginsStr = this._formatPlugins();
+    const configObj = { ...this.config };
+    delete configObj["plugins"];
+    const configJson = jsonDumpsIndent2(configObj);
+    return `import type { Config } from 'tailwindcss'
+
+const config: Config = {
+${this._indentJson(configJson, 1)}
+  plugins: [${pluginsStr}],
+}
+
+export default config
+`;
+  }
+  /** Generate JavaScript configuration. */
+  _generateJavascript() {
+    const pluginsStr = this._formatPlugins();
+    const configObj = { ...this.config };
+    delete configObj["plugins"];
+    const configJson = jsonDumpsIndent2(configObj);
+    return `/** @type {import('tailwindcss').Config} */
+module.exports = {
+${this._indentJson(configJson, 1)}
+  plugins: [${pluginsStr}],
+}
+`;
+  }
+  /** Format plugins array for config. */
+  _formatPlugins() {
+    const arr = this.config["plugins"];
+    if (arr.length === 0) {
+      return "";
+    }
+    const pluginRequires = arr.map((plugin) => `require('${plugin}')`);
+    return pluginRequires.join(", ");
+  }
+  /** Add indentation to JSON string (skip first and last brace lines). */
+  _indentJson(jsonStr, level) {
+    const indent = "  ".repeat(level);
+    const lines = jsonStr.split("\n");
+    const indented = lines.slice(1, lines.length - 1).map((line) => indent + line);
+    return indented.join("\n");
+  }
+  /** Write configuration to file → [success, message]. */
+  writeConfig() {
+    try {
+      const configContent = this.generateConfigString();
+      fs.writeFileSync(this.outputPath, configContent);
+      return [true, `Configuration written to ${this.outputPath}`];
+    } catch (e) {
+      return [false, `Failed to write config: ${osErrorMessage(e)}`];
+    }
+  }
+  /** Validate configuration → [valid, message]. */
+  validateConfig() {
+    if (this.config["content"].length === 0) {
+      return [false, "No content paths specified"];
+    }
+    if (Object.keys(this._extend()).length === 0) {
+      return [true, "Warning: No theme extensions defined"];
+    }
+    return [true, "Configuration valid"];
+  }
+};
+function osErrorMessage(e) {
+  if (e && typeof e === "object" && "message" in e) {
+    return String(e.message);
+  }
+  return String(e);
+}
+var ArgExit = class extends Error {
+  constructor(code) {
+    super("argexit");
+    this.code = code;
+  }
+  code;
+};
+function argError(message) {
+  process.stderr.write(USAGE);
+  process.stderr.write(`${PROG}: error: ${message}
+`);
+  throw new ArgExit(2);
+}
+var FRAMEWORK_CHOICES = ["react", "vue", "svelte", "nextjs"];
+function parseArgs(argv) {
+  const args = {
+    framework: "react",
+    js: false,
+    output: null,
+    colors: null,
+    fonts: null,
+    spacing: null,
+    breakpoints: null,
+    plugins: false,
+    validate_only: false
+  };
+  const starFlags = /* @__PURE__ */ new Set(["--colors", "--fonts", "--spacing", "--breakpoints"]);
+  let i = 0;
+  while (i < argv.length) {
+    let a = argv[i];
+    let inlineValue = null;
+    const eq = a.indexOf("=");
+    if (a.startsWith("--") && eq !== -1) {
+      inlineValue = a.slice(eq + 1);
+      a = a.slice(0, eq);
+    }
+    if (a === "--js") {
+      args.js = true;
+    } else if (a === "--plugins") {
+      args.plugins = true;
+    } else if (a === "--validate-only") {
+      args.validate_only = true;
+    } else if (a === "--framework") {
+      const v = inlineValue ?? argv[++i];
+      if (v === void 0) {
+        argError("argument --framework: expected one argument");
+      }
+      if (!FRAMEWORK_CHOICES.includes(v)) {
+        argError(
+          `argument --framework: invalid choice: '${v}' (choose from 'react', 'vue', 'svelte', 'nextjs')`
+        );
+      }
+      args.framework = v;
+    } else if (a === "--output") {
+      const v = inlineValue ?? argv[++i];
+      if (v === void 0) {
+        argError("argument --output: expected one argument");
+      }
+      args.output = v;
+    } else if (starFlags.has(a)) {
+      const collected = [];
+      if (inlineValue !== null) {
+        collected.push(inlineValue);
+      } else {
+        while (i + 1 < argv.length && !argv[i + 1].startsWith("-")) {
+          collected.push(argv[++i]);
+        }
+      }
+      const key = a.slice(2);
+      args[key] = collected;
+    } else {
+      argError(`unrecognized arguments: ${a}`);
+    }
+    i += 1;
+  }
+  return args;
+}
+function main(argv = process.argv.slice(2)) {
+  let args;
+  try {
+    args = parseArgs(argv);
+  } catch (e) {
+    if (e instanceof ArgExit) {
+      return e.code;
+    }
+    throw e;
+  }
+  const generator = new TailwindConfigGenerator(!args.js, args.framework, args.output);
+  if (args.colors) {
+    const colors = {};
+    for (const colorSpec of args.colors) {
+      const idx = colorSpec.indexOf(":");
+      if (idx === -1) {
+        process.stderr.write(`Invalid color spec: ${colorSpec}
+`);
+        return 1;
+      }
+      const name = colorSpec.slice(0, idx);
+      const value = colorSpec.slice(idx + 1);
+      colors[name] = value;
+    }
+    generator.addColors(colors);
+  }
+  if (args.fonts) {
+    const fonts = {};
+    for (const fontSpec of args.fonts) {
+      const idx = fontSpec.indexOf(":");
+      if (idx === -1) {
+        process.stderr.write(`Invalid font spec: ${fontSpec}
+`);
+        return 1;
+      }
+      const fontType = fontSpec.slice(0, idx);
+      const family = fontSpec.slice(idx + 1);
+      fonts[fontType] = family.split(",").map((f) => _stripChars(f.trim(), `'"`));
+    }
+    generator.addFonts(fonts);
+  }
+  if (args.spacing) {
+    const spacing = {};
+    for (const spacingSpec of args.spacing) {
+      const idx = spacingSpec.indexOf(":");
+      if (idx === -1) {
+        process.stderr.write(`Invalid spacing spec: ${spacingSpec}
+`);
+        return 1;
+      }
+      const name = spacingSpec.slice(0, idx);
+      const value = spacingSpec.slice(idx + 1);
+      spacing[name] = value;
+    }
+    generator.addSpacing(spacing);
+  }
+  if (args.breakpoints) {
+    const breakpoints = {};
+    for (const bpSpec of args.breakpoints) {
+      const idx = bpSpec.indexOf(":");
+      if (idx === -1) {
+        process.stderr.write(`Invalid breakpoint spec: ${bpSpec}
+`);
+        return 1;
+      }
+      const name = bpSpec.slice(0, idx);
+      const width = bpSpec.slice(idx + 1);
+      breakpoints[name] = width;
+    }
+    generator.addBreakpoints(breakpoints);
+  }
+  if (args.plugins) {
+    const recommended = generator.recommendPlugins();
+    generator.addPlugins(recommended);
+    process.stdout.write(`Added recommended plugins: ${recommended.join(", ")}
+`);
+    process.stdout.write("\nInstall with:\n");
+    process.stdout.write(`  npm install -D ${recommended.join(" ")}
+`);
+  }
+  const [valid, message] = generator.validateConfig();
+  if (!valid) {
+    process.stderr.write(`Validation failed: ${message}
+`);
+    return 1;
+  }
+  if (message.startsWith("Warning")) {
+    process.stdout.write(`${message}
+`);
+  }
+  if (args.validate_only) {
+    process.stdout.write("Configuration valid\n");
+    process.stdout.write("\nGenerated config:\n");
+    process.stdout.write(`${generator.generateConfigString()}
+`);
+    return 0;
+  }
+  const [success, writeMsg] = generator.writeConfig();
+  process.stdout.write(`${writeMsg}
+`);
+  return success ? 0 : 1;
+}
+function _isCliEntry() {
+  if (process.argv[1] === void 0) {
+    return false;
+  }
+  const argvUrl = pathToFileURL(path.resolve(process.argv[1])).href;
+  if (import.meta.url === argvUrl) {
+    return true;
+  }
+  try {
+    const here = fs.realpathSync(fileURLToPath(import.meta.url));
+    const argv = fs.realpathSync(path.resolve(process.argv[1]));
+    return here === argv;
+  } catch {
+    return false;
+  }
+}
+var _invokedDirectly = _isCliEntry();
+if (_invokedDirectly) {
+  process.exitCode = main();
+}
+export {
+  TailwindConfigGenerator,
+  main
+};

package/dist/agent-src/skills/test-case-discovery/SKILL.md

@@ -143,7 +143,7 @@ Walk the dimensions below; mark **3–5 as HIGH** (most likely to occur × highe
 - **State** — missing prerequisites, invalid state transitions, idempotency/double-submit, duplicates and ordering.
 - **Collaborator failure** — timeout, 4xx/5xx, partial or malformed response, thrown exceptions, empty result sets.
 - **Concurrency & time** — races, retries, timezone/DST, clock skew (only when the surface touches them).
-- **Security surface** (authz / tenant / data access) — missing/expired credentials, not-owner, cross-tenant, privilege escalation, injection payload. On data-returning endpoints the three negative tests from `broken-access-control` (unauthenticated → 401, not-owner → 403/404, cross-tenant → 403/404) are the floor, not optional extras.
+- **Security surface** (authz / tenant / data access) — missing/expired credentials, not-owner, cross-tenant, privilege escalation, injection payload. On data-returning endpoints the three negative tests from `broken-access-control` (unauthenticated → 401, not-owner → 403/404, cross-tenant → 403/404) are the floor, not optional extras. On an **identity path** — login, sign-up, password reset, verification, a credential or email change — add the **equivalence case**: two security-equivalent identities, one known and one unknown, or one verified and one unverified, produce the same public outcome. Same status, same body category, same redirect, same cookies — not merely the same sentence, since a status code or a set cookie enumerates accounts just as well as an error message does. Name it like a test: `it answers a known and an unknown address identically`.
 
 ### 3. Case synthesis
 

package/dist/agent-src/skills/threat-modeling/SKILL.md

@@ -20,7 +20,7 @@ triggers:
 
 > **Grounded corpus (Tier-1 consultation):** before enumerating from
 > memory, ground surface → threats → controls in the adopted corpus —
-> `./scripts-run <skills-root>/corpus-grounding/scripts/ground ground
+> `node <skills-root>/corpus-grounding/scripts/ground.mjs ground
 > --manifest <skills-root>/threat-modeling/data/manifest.json
 > "<surface description>"` returns the surface class, ATT&CK/CWE-cited
 > threats, required controls, and negative tests, with confidence +
@@ -223,6 +223,13 @@ run tests**.
   chapter into separate Encoding-and-Sanitization and Validation-and-Business-Logic
   chapters, and drops direct CWE/NIST cross-mappings from the requirements.
   [owasp.org/www-project-application-security-verification-standard/](https://owasp.org/www-project-application-security-verification-standard/)
+- **OWASP ASVS v5.0.0 V6 Authentication** and **NIST SP 800-63B** (Digital
+  Identity Guidelines, Authentication and Lifecycle Management — read the
+  CURRENT revision, the series is re-issued). The authority the account-flow
+  rows defer to for password storage, verifier behavior, rate limiting and
+  recovery. Named as chapters, never quoted as values: a number copied out of
+  a standard goes stale silently where a pointer does not.
+  [pages.nist.gov/800-63-3/sp800-63b.html](https://pages.nist.gov/800-63-3/sp800-63b.html)
 - **OWASP Top 10 2021** — A01 Broken Access Control, A04 Insecure Design,
   A05 Security Misconfiguration — cross-reference when naming abuse cases.
   [owasp.org/Top10/](https://owasp.org/Top10/)

package/dist/agent-src/skills/threat-modeling/data/manifest.json

@@ -43,6 +43,9 @@
     "surfaces": [
       "surface",
       "login",
+      "register",
+      "signup",
+      "passkey",
       "upload",
       "webhook",
       "tenant",
@@ -77,7 +80,7 @@
   "refresh_cadence": "quarterly",
   "upstream": {
     "repo": "derived: MITRE ATT&CK + CWE + OWASP API Top 10 / ASVS 5.0",
-    "sha": "re-derived 2026-09-27 against ATT&CK v19.x and ASVS 5.0.0: every ATT&CK id cited in threats.csv's Source Refs column (T1110, T1563, T1105, T1090, T1499, T1552, T1552.001, T1190, T1078.004) resolves in the current Enterprise matrix and none is deprecated or revoked \u2014 threats.csv itself carries no ASVS identifiers, so there is nothing to remap there. SKILL.md's References section cited ASVS 4.0.3's V3/V4/V5 by the old numbering; updated to 5.0.0's V7 Session Management, V8 Authorization, and V1 Encoding and Sanitization + V2 Validation and Business Logic, per the standard's own 4.0\u21925.0 migration guide",
-    "last_checked": "2026-09-18"
+    "sha": "re-derived 2026-09-27 against ATT&CK v19.x and ASVS 5.0.0: every ATT&CK id cited in threats.csv's Source Refs column (T1110, T1563, T1105, T1090, T1499, T1552, T1552.001, T1190, T1078.004) resolves in the current Enterprise matrix and none is deprecated or revoked \u2014 threats.csv itself carries no ASVS identifiers, so there is nothing to remap there. SKILL.md's References section cited ASVS 4.0.3's V3/V4/V5 by the old numbering; updated to 5.0.0's V7 Session Management, V8 Authorization, and V1 Encoding and Sanitization + V2 Validation and Business Logic, per the standard's own 4.0\u21925.0 migration guide. EXTENDED 2026-10-13 with the account-lifecycle half of the authentication class: a second authentication surface row (account lifecycle, registration, credential change) and thirteen threat rows \u2014 account enumeration (CWE-204/203/208), unverified email ownership (CWE-287/640), password acceptance (CWE-521), password storage (CWE-916/759), unsafe secret comparison and home-made credential primitives (CWE-208/338), reset beyond the token (CWE-640/362), identity or credential change (CWE-620/778), MFA and its recovery path (CWE-308), persistent login and logout (CWE-613/539), federated sign-in takeover (CWE-287/352), self-contained token validation (CWE-347), login CSRF (CWE-352) and signup abuse as a policy row (CWE-799); the credential-stuffing row was amended in place for spraying and resend throttling rather than duplicated. These rows are the first in threats.csv to carry ASVS identifiers, and the chapters cited \u2014 V2 Validation and Business Logic, V6 Authentication, V7 Session Management, V9 Self-contained Tokens, V10 OAuth and OIDC, V11 Cryptography, V16 Security Logging and Error Handling \u2014 were read from the standard's own 5.0 chapter listing on 2026-10-13 rather than recalled. The last_checked date records this extension only; the ATT&CK ids above were last re-derived 2026-09-27. Per ADR-238 no row carries a length, attempt count, iteration count, work factor or algorithm preference order: every such value defers to ASVS 5.0 V6 and NIST SP 800-63B, named in SKILL.md's References",
+    "last_checked": "2026-10-13"
   }
 }

package/dist/agent-src/skills/threat-modeling/data/reasoning.csv

@@ -1,11 +1,11 @@
-Surface_Class,Priority_Controls,Decision_Rules,Anti_Patterns,Severity
-authentication,MFA + rate-limit + rotation baseline,"{""if_password_reset"": ""single-use-hashed-tokens"", ""if_sso"": ""validate-audience-and-issuer"", ""if_remember_me"": ""rotate-on-privilege-change""}",Custom crypto + roll-your-own session store,HIGH
-authorization,"Object-level policy checks, deny-by-default","{""if_admin_panel"": ""separate-admin-guard"", ""if_mass_assignment_possible"": ""explicit-allowlist-dto""}",Route-middleware-only authorization,CRITICAL
-tenancy,ORM-layer global scope + sealed job context,"{""if_background_jobs"": ""seal-tenant-at-dispatch"", ""if_reports_or_exports"": ""scope-exports-explicitly""}",tenant_id from request body,CRITICAL
-file-upload,Content-sniffed allowlist outside webroot,"{""if_url_fetch"": ""ssrf-denylist-post-dns"", ""if_image_processing"": ""reencode-dont-trust""}",Extension-only validation,HIGH
-external-integration,HMAC + replay window + idempotency,"{""if_outbound_calls"": ""timeout-and-circuit-break"", ""if_queue_consumer"": ""verify-before-enqueue""}",Trusting source IP alone,HIGH
-public-endpoint,Rate limit + cache + minimal payload,"{""if_search_endpoint"": ""cap-page-size"", ""if_health_check"": ""no-version-disclosure""}",Expensive unauthenticated queries,MEDIUM
-billing,Ledger + idempotency + server-side amounts,"{""if_refunds"": ""one-way-state-machine"", ""if_webhooks_from_psp"": ""verify-signature-and-amount""}",Mutable balance column updates,CRITICAL
-secrets,Manager + redaction + scan,"{""if_third_party_keys"": ""scope-and-rotate-quarterly"", ""if_ci_pipeline"": ""masked-vars-only""}",Secrets in env committed to VCS,HIGH
-data-exposure,Allowlist serializers + contract tests,"{""if_admin_fields"": ""separate-serializer"", ""if_logs_contain_payloads"": ""logger-redaction-keys""}",Spreading model attributes into responses,MEDIUM
+Surface_Class,Priority_Controls,Decision_Rules,Anti_Patterns,Severity
+authentication,MFA + rate-limit + rotation baseline,"{""if_password_reset"": ""single-use-hashed-tokens"", ""if_sso"": ""validate-audience-and-issuer"", ""if_remember_me"": ""rotate-on-privilege-change"", ""if_registration"": ""verify-before-privilege"", ""if_federated_signin"": ""identity-is-issuer-plus-subject"", ""if_sensitive_mutation"": ""fresh-reauth-at-required-assurance"", ""if_unknown_identity"": ""same-verifier-path-same-outcome"", ""if_pepper"": ""outside-the-credential-store-with-rotation-plan"", ""if_email_canonicalization"": ""one-project-function-no-provider-alias-stripping-by-default"", ""if_provider_managed"": ""verify-configuration-not-rebuild""}",Custom crypto + roll-your-own session store,HIGH
+authorization,"Object-level policy checks, deny-by-default","{""if_admin_panel"": ""separate-admin-guard"", ""if_mass_assignment_possible"": ""explicit-allowlist-dto""}",Route-middleware-only authorization,CRITICAL
+tenancy,ORM-layer global scope + sealed job context,"{""if_background_jobs"": ""seal-tenant-at-dispatch"", ""if_reports_or_exports"": ""scope-exports-explicitly""}",tenant_id from request body,CRITICAL
+file-upload,Content-sniffed allowlist outside webroot,"{""if_url_fetch"": ""ssrf-denylist-post-dns"", ""if_image_processing"": ""reencode-dont-trust""}",Extension-only validation,HIGH
+external-integration,HMAC + replay window + idempotency,"{""if_outbound_calls"": ""timeout-and-circuit-break"", ""if_queue_consumer"": ""verify-before-enqueue""}",Trusting source IP alone,HIGH
+public-endpoint,Rate limit + cache + minimal payload,"{""if_search_endpoint"": ""cap-page-size"", ""if_health_check"": ""no-version-disclosure""}",Expensive unauthenticated queries,MEDIUM
+billing,Ledger + idempotency + server-side amounts,"{""if_refunds"": ""one-way-state-machine"", ""if_webhooks_from_psp"": ""verify-signature-and-amount""}",Mutable balance column updates,CRITICAL
+secrets,Manager + redaction + scan,"{""if_third_party_keys"": ""scope-and-rotate-quarterly"", ""if_ci_pipeline"": ""masked-vars-only""}",Secrets in env committed to VCS,HIGH
+data-exposure,Allowlist serializers + contract tests,"{""if_admin_fields"": ""separate-serializer"", ""if_logs_contain_payloads"": ""logger-redaction-keys""}",Spreading model attributes into responses,MEDIUM
 infrastructure,Deny-by-default ingress + encryption on + scoped IAM,"{""if_management_or_db_port"": ""no-internet-cidr-use-bastion-or-private-link"", ""if_object_storage"": ""block-public-access-at-account-and-bucket"", ""if_iam_policy"": ""enumerate-actions-and-resource-arns""}",Permissive defaults left in place because the resource works either way,HIGH

package/dist/agent-src/skills/threat-modeling/data/surfaces.csv

@@ -1,11 +1,12 @@
-Surface,Keywords,Surface Class,Data Classes,Notes
-Login / session / token issuance,login password session jwt token oauth sso 2fa mfa reset,authentication,"credentials, session tokens",Covers password reset and remember-me flows
-Authorization / policy / role check,authorization policy gate voter role permission admin rbac acl,authorization,entitlements,Includes admin-only routes and ownership checks
-Tenant boundary / row-level scope,tenant multi-tenant tenant_id scope row-level isolation,tenancy,all tenant data,Any query touching tenant-scoped tables
-File upload / user-supplied URL,upload file image attachment url fetch import csv,file-upload,"user files, server filesystem",Includes URL-fetch (SSRF surface)
-Outbound integration / webhook consumer,webhook integration third-party callback queue consumer api client,external-integration,"partner payloads, secrets",Inbound webhooks AND outbound calls
-Public unauthenticated endpoint,public endpoint health status unauthenticated anonymous,public-endpoint,whatever it returns,Includes health/status and marketing forms
-Billing / payment / balance mutation,billing payment charge refund invoice subscription balance credit,billing,money movement,Anything that changes an amount owed/paid
-Secrets / key handling,secret api-key signing key env vault kms rotation,secrets,credentials,"Storage, rotation, and logging paths"
-Data export / serializer / log channel,export serializer api-resource log audit csv download report,data-exposure,"PII, internal fields",Response shaping and log sinks
+Surface,Keywords,Surface Class,Data Classes,Notes
+Login / session / token issuance,login password session jwt token oauth sso 2fa mfa reset,authentication,"credentials, session tokens",Covers password reset and remember-me flows
+Account lifecycle / registration / credential change,register registration signup sign-up email-verification email-change passkey webauthn otp totp recovery magic-link oidc logout remember,authentication,"credentials, identity claims, recovery codes",Covers sign-up email ownership MFA enrolment federated linking credential and email change and session termination
+Authorization / policy / role check,authorization policy gate voter role permission admin rbac acl,authorization,entitlements,Includes admin-only routes and ownership checks
+Tenant boundary / row-level scope,tenant multi-tenant tenant_id scope row-level isolation,tenancy,all tenant data,Any query touching tenant-scoped tables
+File upload / user-supplied URL,upload file image attachment url fetch import csv,file-upload,"user files, server filesystem",Includes URL-fetch (SSRF surface)
+Outbound integration / webhook consumer,webhook integration third-party callback queue consumer api client,external-integration,"partner payloads, secrets",Inbound webhooks AND outbound calls
+Public unauthenticated endpoint,public endpoint health status unauthenticated anonymous,public-endpoint,whatever it returns,Includes health/status and marketing forms
+Billing / payment / balance mutation,billing payment charge refund invoice subscription balance credit,billing,money movement,Anything that changes an amount owed/paid
+Secrets / key handling,secret api-key signing key env vault kms rotation,secrets,credentials,"Storage, rotation, and logging paths"
+Data export / serializer / log channel,export serializer api-resource log audit csv download report,data-exposure,"PII, internal fields",Response shaping and log sinks
 Infrastructure / IaC resource definition,terraform iac infrastructure provisioning security group ingress egress cidr bucket storage iam role subnet vpc encryption,infrastructure,"network reachability, data at rest, cloud credentials",Any IaC change to networking storage IAM or encryption defaults