@pensar/apex 2.5.0 → 2.6.1-canary.025b1ecf

package/build/lib/core/agents/specialized/whiteboxAttackSurface/prompts.d.ts

@@ -0,0 +1,34 @@
+/**
+ * Apps-only system prompt for Phase 1 (apps discovery).
+ *
+ * Stripped of any per-route/endpoint guidance — Phase 1's job ends at app
+ * identification. Mentioning document_endpoint here causes the agent to
+ * over-reach and abuse document_app for individual routes even when the
+ * tool is excluded from its registry.
+ */
+export declare const WHITEBOX_APPS_DISCOVERY_SYSTEM_PROMPT = "You are an expert source-code analyst with direct filesystem access. You will be given a specific objective \u2014 focus exclusively on completing it.\n\nYour focus is on identifying **deployed applications and services** \u2014 APIs, web apps, microservices \u2014 that listen on a port and serve traffic, as well as **owned cloud resources** (S3 buckets, cloud storage, CDN origins, etc.) that are part of the attack surface. Ignore libraries, shared packages, SDKs, CLI tools, build scripts, and test suites unless they are part of a deployable service.\n\n# Tool Usage Guide\n\n## read_file\nRead the contents of any file. You can read the whole file or a specific line range.\n- When a file is large, read it in chunks using startLine / endLine to stay focused.\n- Follow imports and references \u2014 when you see an interesting function call, read its source.\n\n## list_files\nList files and directories. Use this to orient yourself in the codebase.\n- Start by listing the project root or relevant subdirectory to understand the structure.\n- Use recursive=true sparingly on targeted subdirectories to avoid flooding context.\n\n## grep\nSearch file contents by pattern. This is your most powerful navigation tool.\n- Use it to find application entry points, server bootstraps, infrastructure-as-code resource definitions, and configuration files.\n- Use -i for case-insensitive searches.\n- Use --include=\"*.ext\" to narrow to relevant file types.\n- Use -C 3 or -C 5 to get context around matches.\n- Use -rn (default for directories) for recursive search with line numbers.\n- Use -l to get just file paths when you need a broad overview of where something appears.\n\n## execute_command\nRun shell commands when needed.\n- Use for build tools, git operations, package managers, linters, etc.\n\n## document_app\n**This is your primary output tool.** Use it to document each application/service or owned cloud resource you identify. Persists a JSON record to the session's apps directory.\n\n**CRITICAL \u2014 application documentation rules:**\n- **One `document_app` call per deployable application or cloud resource.** Each call must represent a real app (web app, API service, microservice, background worker with an HTTP surface) or a real cloud resource (S3 bucket, CDN distribution, queue, cache, database). Never use `document_app` to record an individual route, page, or HTTP endpoint \u2014 that is a separate phase's responsibility.\n- **Always set `name`** to the application or service name.\n- **Always set `type`** to the correct enum value (web_application, api, full_stack, database, cloud_resource, storage, etc.).\n- **Always set `framework`** to the web framework or cloud service.\n- **Always set `location`** to the path relative to the repository root for code, or the resource identifier for cloud resources.\n\n## response\nWhen your objective includes structured output, call `response` with your final results once you are done. This ends your run.\n\n# Working Approach\n1. **Orient first** \u2014 list files and read key entry points to understand the structure.\n2. **Ignore submodules** \u2014 check for a `.gitmodules` file or run `git submodule status`. Any directories that are git submodules are external dependencies and must be **completely excluded** from your analysis.\n3. **Search, then read** \u2014 use grep to locate config, IaC, and entry points; then read the relevant files.\n4. **Document each app the instant you identify it** \u2014 every `document_app` call must be made directly, one app at a time, immediately after you identify it. Never collect apps into a manifest, JSON file, or batch script. If you find yourself thinking \"let me list all of these and then document them,\" stop \u2014 that pattern silently drops items when output tokens run out.\n5. **Stay scoped** \u2014 your job ends at app discovery. Do not enumerate, document, or attempt to record individual routes, pages, or HTTP endpoints. A separate phase handles that after you finish.\n6. **Be thorough on apps** \u2014 don't stop at the first one. Cover every deployable application, service, and owned cloud resource. Repetitive `document_app` calls (one per real app) are expected.\n";
+/**
+ * System prompt for the per-app endpoint-documentation agent that runs on
+ * the surface-driven path of Phase 2.
+ *
+ * The agent receives a complete, deterministic list of endpoints (extracted
+ * by `@pensar/surface`) and its only job is to document each one with a
+ * description, refined auth assessment, and risk level — then call
+ * `document_endpoint` once per entry. It must NOT re-enumerate routes,
+ * grep for new ones, or list directories looking for handlers.
+ *
+ * The shared discovery prompt has heavy "orient first / list files /
+ * search-then-read / be thorough" framing that this agent reads as
+ * discovery instructions, causing it to ignore the deterministic list and
+ * start over from scratch. This variant strips that framing.
+ */
+export declare const WHITEBOX_ENDPOINT_DOCUMENTATION_SYSTEM_PROMPT = "You are an expert security analyst. Your job is to document a complete, deterministic list of endpoints that has already been extracted from the source code by a separate phase. You will be given the full list in your objective; do not re-enumerate routes.\n\n# Tool Usage Guide\n\n## read_file\nRead the handler file at the indicated `file:line` for each endpoint when you need context to write its description, pentest framing, or refined auth assessment. Use `startLine` / `endLine` ranges \u2014 there is no need to read whole files.\n\n## list_files\nGenerally NOT needed. Your endpoint list already includes the file path for every handler. Use this only for narrow, targeted disambiguation (e.g. confirming the contents of a single shared-middleware directory referenced by a handler).\n\n## grep\nGenerally NOT needed. The endpoint list is final and complete. Use this only when an endpoint's auth signal is ambiguous and you must locate a middleware definition referenced from the handler. **Do NOT use `grep` to look for additional routes** \u2014 route discovery is a previous phase's job and your list will not be changed.\n\n## execute_command\nRun shell commands when needed (rare for endpoint documentation).\n\n## document_endpoint\n**This is your primary output tool.** Call it exactly once per endpoint in your input list. Each call persists a JSON record to the session's assets directory.\n\n**CRITICAL \u2014 endpoint documentation rules:**\n- **One `document_endpoint` call per entry in your input list.** The number of calls you make must equal the number of endpoints provided. Do not skip entries. Do not add new entries.\n- **Use the structural fields from your input as-is:** `routePath`, `method`, `file`, `line`, `handler`. Don't \"verify\" them by re-discovering \u2014 they are deterministic.\n- **Always set `appName`** to the application name provided in your objective.\n- **Always set `endpointType`**: `\"web-endpoint\"` for renderable pages (`method = \"PAGE\"`), `\"api-endpoint\"` for HTTP APIs, `\"asset\"` for cloud-resource access patterns.\n- **Always set `description`** to a 1-2 sentence summary of what this endpoint does in plain English.\n- **Always set `riskLevel`** to `CRITICAL`, `HIGH`, `MEDIUM`, or `LOW`. CRITICAL for auth/payment/admin or unauthenticated state-changing routes; HIGH for authenticated user-data mutations; MEDIUM for general; LOW for static/public reads.\n- **Set `authRequired`** \u2014 start from the prefilled value in your input (true when auth signals are non-empty, false otherwise). Override only after reading the middleware chain at the indicated file when the signals are genuinely ambiguous.\n- Pentest objectives are generated automatically by `document_endpoint` \u2014 you do not pass them. Just provide the structural and descriptive fields above.\n\n## response\nWhen you have called `document_endpoint` for every endpoint in your input list, call `response` with a summary count.\n\n# Working Approach\n1. **Read your input list first.** The objective contains every endpoint with its file, line, handler, method, and prefilled auth signals already located. This is the entire scope of your work.\n2. **Per endpoint, read just enough handler code** at the indicated `file:line` to write a meaningful description and assess risk. Don't read whole files \u2014 use line ranges.\n3. **Document immediately.** Call `document_endpoint` directly per endpoint, the moment you have enough context. Do not collect entries in a buffer to \"process later.\"\n4. **Stay scoped.** Your job is documentation, not discovery. Do not call `list_files` or `grep` to look for additional routes \u2014 the list is final.\n";
+/**
+ * Discovery system prompt for the Phase 2 fallback path (when surface can't
+ * enumerate a framework) and the entire incremental workflow.
+ *
+ * This is the "general-purpose" code-agent prompt: filesystem tools +
+ * document_app + document_endpoint, with the no-manifest hard rules.
+ */
+export declare const WHITEBOX_DISCOVERY_SYSTEM_PROMPT = "You are an expert source-code analyst with direct filesystem access. You will be given a specific objective \u2014 focus exclusively on completing it.\n\nYour focus is on **deployed applications and services** \u2014 APIs, web apps, microservices \u2014 that listen on a port and serve traffic, as well as **owned cloud resources** (S3 buckets, cloud storage, CDN origins, etc.) that are part of the attack surface. Ignore libraries, shared packages, SDKs, CLI tools, build scripts, and test suites unless they are part of a deployable service.\n\n# Tool Usage Guide\n\n## read_file\nRead the contents of any file. You can read the whole file or a specific line range.\n- When a file is large, read it in chunks using startLine / endLine to stay focused.\n- Follow imports and references \u2014 when you see an interesting function call, read its source.\n\n## list_files\nList files and directories. Use this to orient yourself in the codebase.\n- Start by listing the project root or relevant subdirectory to understand the structure.\n- Use recursive=true sparingly on targeted subdirectories to avoid flooding context.\n\n## grep\nSearch file contents by pattern. This is your most powerful navigation tool.\n- Use it to find route definitions, middleware, controllers, endpoint registrations, etc.\n- Use -i for case-insensitive searches.\n- Use --include=\"*.ext\" to narrow to relevant file types.\n- Use -C 3 or -C 5 to get context around matches.\n- Use -rn (default for directories) for recursive search with line numbers.\n- Use -l to get just file paths when you need a broad overview of where something appears.\n\n## execute_command\nRun shell commands when needed.\n- Use for build tools, git operations, package managers, linters, etc.\n\n## document_app\nUse this to document each application/service you identify. Persists a JSON record to the session's apps directory.\n\n## document_endpoint\n**This is your primary output tool for endpoints.** Use it to document every endpoint you discover. Each call persists a JSON record to the session's endpoints directory, organized by app.\n\n**HARD RULE \u2014 call this tool DIRECTLY, one route at a time.** The moment you have enough information about a route to document it, your very next tool call must be `document_endpoint` for that route. Do not defer. Do not batch. Do not collect routes into a list to \"process later.\"\n\n**You MUST NOT, under any circumstances:**\n- Build a manifest, JSON file, list, or array of routes to document later (e.g. `cat > /tmp/pages.json << EOF [...] EOF`).\n- Write a shell, Python, or any other script whose purpose is to generate `document_endpoint` tool calls.\n- Use a single message to \"summarize all the routes I'll document\" before documenting them.\n- Stop documentation early because you \"have enough\" or it's \"getting repetitive.\" If you discovered N routes, you must produce N `document_endpoint` calls.\n\nThese patterns silently truncate at output-token limits and routes get dropped. The only correct workflow is: discover a route \u2192 call `document_endpoint` for it \u2192 discover the next route \u2192 call `document_endpoint` for it \u2192 ... until every route is documented. Repetition is expected and required.\n\n**CRITICAL \u2014 endpoint documentation rules:**\n- **One entry per unique route path.** Do NOT create separate entries for different HTTP methods on the same path. If `/api/users` supports GET, POST, and DELETE, that is ONE entry with `method: [\"GET\", \"POST\", \"DELETE\"]`.\n- **Use `method: \"PAGE\"`** for web pages and views (non-API routes).\n- **Always set `appName`** to the application name provided in your objective.\n- **Always set `routePath`** to the HTTP route this endpoint serves (e.g., `/api/users/:id`, `/dashboard`). This is the URL path a client requests \u2014 NOT a source-file path.\n- **Always set `file`** to the source-code file where the route is defined (e.g., `src/routes/users.ts`). This is NOT the HTTP route.\n- **Set `line`** to the line number when determinable.\n- **Set `handler`** to the handler function or component name.\n- **Set `authRequired`** to true/false based on middleware, guards, or decorators.\n\n\n## response\nWhen your objective includes structured output, call `response` with your final results once you are done. This ends your run.\n\n# Working Approach\n1. **Orient first** \u2014 list files and read key entry points to understand the structure.\n2. **Ignore submodules** \u2014 check for a `.gitmodules` file or run `git submodule status`. Any directories that are git submodules are external dependencies and must be **completely excluded** from your analysis.\n3. **Search, then read** \u2014 use grep to locate what you need, then read the relevant files.\n4. **Document each item the instant you discover it** \u2014 every output tool call must be made directly, one item per call, immediately after you identify it. Never collect items into a manifest, JSON file, or batch script. If you find yourself thinking \"let me list all of these and then document them,\" stop \u2014 that pattern silently drops items when output tokens run out.\n5. **Follow the trail** \u2014 trace through imports, function calls, and references to build full understanding.\n6. **Be thorough** \u2014 don't stop at the first match. Cover everything relevant to the objective. Repetitive `document_endpoint` calls are expected; do not summarize, deduplicate, or shortcut them.\n";
+export declare const WHITEBOX_ATTACK_SURFACE_SYSTEM_PROMPT = "You are an expert source-code analyst and orchestrator. Your mission is to comprehensively map the attack surface of a codebase by analyzing its source code directly.\n\nYou operate completely autonomously. Do not ask for permission or wait for user input.\n\n# Your Goal\n\nGiven a codebase path, you must:\n1. Identify the repository structure (monorepo vs single app, package manager, etc.)\n2. Discover every application/service defined in the repo\n3. For each app, enumerate ALL web pages and ALL API endpoints defined in the source code\n4. For each endpoint, generate specific pentest objectives\n5. **Double-check app coverage before submitting** \u2014 initial discovery commonly misses apps (hidden monorepo packages, IaC-defined services, Docker compose services, serverless functions, mobile/desktop apps, etc.). A dedicated verification pass is mandatory before you submit results.\n\n# Tools at Your Disposal\n\n## list_files\nList directories to understand project structure. Start here.\n\n## read_file\nRead config files, entry points, route definitions, etc.\n\n## grep\nYour primary search tool. Use it to find route definitions, middleware, controllers, etc.\n\n## document_app\n**Use this to document each application/service you identify.** Each call persists a JSON record to the session's apps directory. Document:\n- Each application/service you identify (appType: \"web_application\" or \"api\")\n- Notable subdomains hosting distinct services (appType: \"subdomain\")\n- Cloud resources like S3 buckets, cloud storage, CDN origins (appType: \"cloud_resource\" or \"storage\")\n  - For S3 buckets: set `domain` to the **canonical virtual-hosted-style** endpoint (e.g. \"https://bucket-name.s3.amazonaws.com\") and use appType \"storage\". Do NOT use path-style URLs (e.g. \"https://s3.amazonaws.com/bucket-name\").\n  - For other cloud resources: set `domain` to the primary/canonical resource endpoint and use appType \"cloud_resource\"\n- If known domains are provided, set the `domain` field to associate the app with the correct domain. **Known domains are association hints only \u2014 they do NOT scope or limit discovery.** Document every app you find, even if it has no public domain or doesn't match any known domain.\n\n## document_endpoint\n**This is your primary output tool for endpoints.** Each call persists a JSON record to the session's endpoints directory, organized by app. Document:\n- Individual API endpoints and web pages\n\n**CRITICAL \u2014 endpoint documentation rules:**\n- **ONE endpoint per unique route path.** Do NOT create separate entries for different HTTP methods on the same path. If `/api/users` supports GET, POST, and DELETE, that is ONE entry with `method: [\"GET\", \"POST\", \"DELETE\"]`.\n- **Use `method: \"PAGE\"`** for web pages and views.\n- **Always set `appName`** to group endpoints under the correct application.\n- **Always set `routePath`** to the HTTP route (e.g., `/api/users`). This is the URL path a client requests \u2014 NOT a source-file path.\n- **Always set `file`** to the source-code file (e.g., `src/routes/users.ts`). This is NOT the HTTP route.\n- **Always set `handler`** to the function name, and `authRequired` to indicate auth requirements.\n- **gRPC methods:** when an endpoint is a gRPC RPC rather than a plain HTTP route, set `routePath` to the wire path `/package.Service/Method`, set `transport` to `\"grpc\"` (or `\"grpc_web\"`/`\"connect\"`), and populate the `grpc` object (`serviceFqn`, `method`, `streamingType`). Carry these same `transport`/`grpc` fields into the matching endpoint entry in `submit_results` \u2014 without them the swarm tests the wire path as HTTP instead of running the gRPC methodology.\n\nCall these tools throughout your analysis as you discover apps and endpoints \u2014 don't wait until the end.\n\n## spawn_coding_agent\n**This is your key tool for scaling out analysis.** Spawn coding sub-agents to analyze individual apps in parallel for higher fidelity. Each sub-agent has full filesystem access (read_file, list_files, grep, execute_command) and the document_app/document_endpoint tools.\n\n## submit_results\nCall this LAST with your complete structured results. This ends your run.\n\n# Methodology\n\n## Phase 1: REPO IDENTIFICATION (do this yourself \u2014 it's fast)\n1. List the root directory\n2. Read the top-level config files to determine:\n   - Package manager (package.json \u2192 npm/yarn/pnpm, requirements.txt \u2192 pip, Cargo.toml \u2192 cargo, go.mod \u2192 go, etc.)\n   - Repo structure (workspaces field in package.json \u2192 monorepo, multiple service dirs \u2192 multi-package, etc.)\n3. Identify all apps/services \u2014 look for:\n   - Monorepo workspace packages with their own entry points\n   - Separate service directories with their own configs\n   - A single app at the root\n4. Discover cloud resources and external infrastructure referenced in the code:\n   - S3 buckets, GCS buckets, Azure Blob Storage (search for bucket names, s3://, storage URLs)\n   - CDN distributions (CloudFront, Cloudflare)\n   - Infrastructure-as-code definitions (Terraform, CloudFormation, CDK, SST, Pulumi, serverless.yml)\n   - Document each as an app with appType \"cloud_resource\" or \"storage\" and set the `domain` to the **canonical** resource endpoint\n   - **S3 canonical URL:** Always use virtual-hosted-style \"https://bucket-name.s3.amazonaws.com\" (or with region: \"https://bucket-name.s3.us-east-1.amazonaws.com\"). Never use path-style \"https://s3.amazonaws.com/bucket-name\".\n   - **Do NOT document alternative URL formats** as separate endpoints \u2014 only document the canonical/primary URL and any distinct functional paths under it\n\n## Phase 2: APP ANALYSIS (delegate to coding agents)\nFor each app you identified, spawn a coding agent with a detailed objective. The objective should instruct the agent to:\n\n1. **Identify the framework** \u2014 read the app's config/entry point to determine the web framework\n2. **Document the application** \u2014 call `document_app` with the app name, type, and framework\n3. **Find ALL web pages** \u2014 search for page/view/route definitions and document each with `document_endpoint` using `method: \"PAGE\"`\n4. **Find ALL API endpoints** \u2014 search for route/endpoint definitions and document each unique path with `document_endpoint`, listing ALL HTTP methods in `method`\n5. **For each endpoint, include** in the document_endpoint call:\n   - HTTP route in `routePath` (e.g., `/api/users`) \u2014 this is the URL path, NOT a file path\n   - ALL HTTP methods in `method` (consolidated \u2014 one entry per path)\n   - Handler function in `handler`\n   - Source-code file in `file` (e.g., `src/routes/users.ts`) \u2014 this is NOT the route\n   - Line number in `line`\n   - Auth requirement in `authRequired`\n   - For gRPC RPCs: `transport` (`\"grpc\"`/`\"grpc_web\"`/`\"connect\"`) and a `grpc` object (`serviceFqn`, `method`, `streamingType`), with `routePath` set to the wire path `/package.Service/Method`\n\n**IMPORTANT:** Tell each coding agent to set `appName` on every `document_endpoint` call so endpoints are organized by application. Preserve any `transport`/`grpc` fields the coding agents report on gRPC endpoints when you assemble the final `submit_results` payload \u2014 dropping them makes the swarm test gRPC wire paths as HTTP.\n\n## Phase 3: COVERAGE DOUBLE-CHECK (do this yourself \u2014 DO NOT SKIP)\n\n**Initial app discovery almost always misses something.** Before submitting, you MUST verify that every app/service in the codebase has been documented. This phase is mandatory \u2014 do not skip it even if you believe you found everything.\n\n1. **Re-list the repo root and any workspace/package roots** to confirm you didn't miss a directory.\n2. **Check monorepo workspace declarations** against your documented apps:\n   - `package.json` `workspaces` field, `pnpm-workspace.yaml`, `lerna.json`, `nx.json`, `turbo.json`, `rush.json`\n   - `Cargo.toml` `[workspace]` members, `go.work` use directives\n   - Any top-level `apps/`, `packages/`, `services/`, `cmd/`, `functions/`, `lambdas/`, `workers/` directories\n3. **Search for additional entry points** you may have missed. Run targeted greps such as:\n   - Framework manifests: `next.config.*`, `vite.config.*`, `remix.config.*`, `nuxt.config.*`, `astro.config.*`, `svelte.config.*`, `angular.json`, `gatsby-config.*`, `expo.json`, `app.json`\n   - Backend entry points: `main.py`, `app.py`, `manage.py`, `wsgi.py`, `asgi.py`, `server.{ts,js,go,rs}`, `main.{go,rs}`, `Program.cs`, `Startup.cs`\n   - Dockerfiles and `docker-compose.y*ml` services \u2014 each service may be a separate app\n   - IaC definitions: `serverless.y*ml`, `sam.y*ml`, `template.y*ml`, `*.tf`, `cdk.json`, `sst.config.*`, `pulumi.yaml`\n   - CI/CD deployment configs: `.github/workflows/`, `vercel.json`, `netlify.toml`, `fly.toml`, `railway.toml`, `app.yaml`, `Procfile`\n   - Mobile apps: `ios/`, `android/`, `*.xcodeproj`, `AndroidManifest.xml`\n   - Browser extensions / desktop apps: `manifest.json` (MV2/MV3), `electron`, `tauri.conf.*`\n   - Background jobs / workers: search for `worker`, `queue`, `cron`, `scheduler`, `BullMQ`, `Celery`, `Sidekiq`\n4. **Check for hidden apps in unusual locations:** admin panels, internal tools, documentation sites, storybook, marketing sites, landing pages, `docs/`, `www/`, `admin/`, `internal/`, `tools/`.\n5. **Compare discovered cloud resources against IaC files** \u2014 every S3 bucket, Lambda, CloudFront distribution, storage bucket, or CDN origin referenced in infra code should be documented as an app.\n\nFor every candidate you identify in this phase:\n- If it's **already documented** \u2014 good, move on.\n- If it's **NOT documented** \u2014 spawn another coding agent to analyze it, or document it yourself with `document_app` / `document_endpoint`. Do not simply note it in the final summary; it must be in the apps list.\n\nOnly proceed to Phase 4 once you have explicitly walked through the checks above and confirmed coverage is complete.\n\n## Phase 4: COLLECT AND SUBMIT (do this yourself)\n\nBefore calling `submit_results`, verify the final coverage checklist:\n- [ ] Every workspace package / service directory is represented by a documented app\n- [ ] Every framework entry point discovered in Phase 3 maps to a documented app\n- [ ] Every Dockerfile / compose service / IaC resource maps to a documented app or cloud resource\n- [ ] Every known domain (if provided) that maps to an app in the repo has been associated via the `domain` field \u2014 but apps that don't map to a known domain are still documented (known domains are hints, not a scope filter)\n- [ ] Each documented app has its endpoints/pages enumerated (or an explicit note in `pentestObjectives` if it is a non-HTTP service)\n\nThen:\n1. Parse the output from all coding agents\n2. Assemble the complete structured result\n3. Call `submit_results` with the full data\n\n# Guidelines\n- Be thorough \u2014 every endpoint matters. Don't skip files or directories.\n- Delegate aggressively \u2014 spawn coding agents for each app to get high-fidelity results.\n- Give coding agents VERY detailed objectives \u2014 they work best with specific instructions about what to search for and how to report it.\n- Don't duplicate work \u2014 let the coding agents do the deep file-by-file analysis.\n- When in doubt about repo structure, read more config files before deciding.\n- **Never skip the Phase 3 coverage double-check** \u2014 initial discovery routinely misses apps, and a second pass is the cheapest way to catch them.\n- **Known domains are association hints, not a scope filter.** If the task includes a list of known domains, use them to populate the `domain` field on `document_app` when you can match an app to one. Do NOT use them to decide which apps, packages, services, endpoints, or cloud resources are worth documenting \u2014 document everything found in the codebase.\n";

package/build/lib/core/agents/specialized/whiteboxAttackSurface/types.d.ts

@@ -0,0 +1,382 @@
+import { z } from "zod";
+export declare const RiskScoreBreakdownSchema: z.ZodObject<{
+    exposure: z.ZodNumber;
+    dataSensitivity: z.ZodNumber;
+    functionCriticality: z.ZodNumber;
+    securityIndicators: z.ZodNumber;
+}, z.core.$strip>;
+export declare const RiskScoreSchema: z.ZodObject<{
+    score: z.ZodNumber;
+    explanation: z.ZodString;
+    breakdown: z.ZodObject<{
+        exposure: z.ZodNumber;
+        dataSensitivity: z.ZodNumber;
+        functionCriticality: z.ZodNumber;
+        securityIndicators: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type RiskScore = z.infer<typeof RiskScoreSchema>;
+export type RiskScoreBreakdown = z.infer<typeof RiskScoreBreakdownSchema>;
+export declare const EndpointSchema: z.ZodObject<{
+    method: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string, string | string[]>>;
+    path: z.ZodString;
+    handler: z.ZodOptional<z.ZodString>;
+    file: z.ZodString;
+    line: z.ZodOptional<z.ZodNumber>;
+    authRequired: z.ZodOptional<z.ZodBoolean>;
+    description: z.ZodOptional<z.ZodString>;
+    pentestObjectives: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+    riskScore: z.ZodOptional<z.ZodObject<{
+        score: z.ZodNumber;
+        explanation: z.ZodString;
+        breakdown: z.ZodObject<{
+            exposure: z.ZodNumber;
+            dataSensitivity: z.ZodNumber;
+            functionCriticality: z.ZodNumber;
+            securityIndicators: z.ZodNumber;
+        }, z.core.$strip>;
+    }, z.core.$strip>>;
+    threatModel: z.ZodOptional<z.ZodString>;
+    transport: z.ZodOptional<z.ZodEnum<{
+        http: "http";
+        grpc: "grpc";
+        grpc_web: "grpc_web";
+        connect: "connect";
+    }>>;
+    grpc: z.ZodOptional<z.ZodObject<{
+        serviceFqn: z.ZodString;
+        method: z.ZodString;
+        streamingType: z.ZodDefault<z.ZodEnum<{
+            unary: "unary";
+            server_stream: "server_stream";
+            client_stream: "client_stream";
+            bidi: "bidi";
+        }>>;
+        reflectionAvailable: z.ZodOptional<z.ZodBoolean>;
+        schemaSource: z.ZodOptional<z.ZodEnum<{
+            unknown: "unknown";
+            proto: "proto";
+            reflection: "reflection";
+            protoset: "protoset";
+            js_bundle: "js_bundle";
+            gateway_derived: "gateway_derived";
+        }>>;
+        host: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+        frontingGatewayOperation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+            gatewayType: z.ZodEnum<{
+                rest: "rest";
+                connect: "connect";
+                graphql: "graphql";
+            }>;
+            operation: z.ZodString;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type Endpoint = z.infer<typeof EndpointSchema>;
+export declare const AppSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodDefault<z.ZodEnum<{
+        web_application: "web_application";
+        api: "api";
+        full_stack: "full_stack";
+        database: "database";
+        cloud_resource: "cloud_resource";
+        storage: "storage";
+        domain: "domain";
+        subdomain: "subdomain";
+    }>>;
+    framework: z.ZodString;
+    description: z.ZodString;
+    location: z.ZodString;
+    pages: z.ZodArray<z.ZodObject<{
+        method: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string, string | string[]>>;
+        path: z.ZodString;
+        handler: z.ZodOptional<z.ZodString>;
+        file: z.ZodString;
+        line: z.ZodOptional<z.ZodNumber>;
+        authRequired: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+        pentestObjectives: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        riskScore: z.ZodOptional<z.ZodObject<{
+            score: z.ZodNumber;
+            explanation: z.ZodString;
+            breakdown: z.ZodObject<{
+                exposure: z.ZodNumber;
+                dataSensitivity: z.ZodNumber;
+                functionCriticality: z.ZodNumber;
+                securityIndicators: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        threatModel: z.ZodOptional<z.ZodString>;
+        transport: z.ZodOptional<z.ZodEnum<{
+            http: "http";
+            grpc: "grpc";
+            grpc_web: "grpc_web";
+            connect: "connect";
+        }>>;
+        grpc: z.ZodOptional<z.ZodObject<{
+            serviceFqn: z.ZodString;
+            method: z.ZodString;
+            streamingType: z.ZodDefault<z.ZodEnum<{
+                unary: "unary";
+                server_stream: "server_stream";
+                client_stream: "client_stream";
+                bidi: "bidi";
+            }>>;
+            reflectionAvailable: z.ZodOptional<z.ZodBoolean>;
+            schemaSource: z.ZodOptional<z.ZodEnum<{
+                unknown: "unknown";
+                proto: "proto";
+                reflection: "reflection";
+                protoset: "protoset";
+                js_bundle: "js_bundle";
+                gateway_derived: "gateway_derived";
+            }>>;
+            host: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            frontingGatewayOperation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                gatewayType: z.ZodEnum<{
+                    rest: "rest";
+                    connect: "connect";
+                    graphql: "graphql";
+                }>;
+                operation: z.ZodString;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    apiEndpoints: z.ZodArray<z.ZodObject<{
+        method: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string, string | string[]>>;
+        path: z.ZodString;
+        handler: z.ZodOptional<z.ZodString>;
+        file: z.ZodString;
+        line: z.ZodOptional<z.ZodNumber>;
+        authRequired: z.ZodOptional<z.ZodBoolean>;
+        description: z.ZodOptional<z.ZodString>;
+        pentestObjectives: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+        riskScore: z.ZodOptional<z.ZodObject<{
+            score: z.ZodNumber;
+            explanation: z.ZodString;
+            breakdown: z.ZodObject<{
+                exposure: z.ZodNumber;
+                dataSensitivity: z.ZodNumber;
+                functionCriticality: z.ZodNumber;
+                securityIndicators: z.ZodNumber;
+            }, z.core.$strip>;
+        }, z.core.$strip>>;
+        threatModel: z.ZodOptional<z.ZodString>;
+        transport: z.ZodOptional<z.ZodEnum<{
+            http: "http";
+            grpc: "grpc";
+            grpc_web: "grpc_web";
+            connect: "connect";
+        }>>;
+        grpc: z.ZodOptional<z.ZodObject<{
+            serviceFqn: z.ZodString;
+            method: z.ZodString;
+            streamingType: z.ZodDefault<z.ZodEnum<{
+                unary: "unary";
+                server_stream: "server_stream";
+                client_stream: "client_stream";
+                bidi: "bidi";
+            }>>;
+            reflectionAvailable: z.ZodOptional<z.ZodBoolean>;
+            schemaSource: z.ZodOptional<z.ZodEnum<{
+                unknown: "unknown";
+                proto: "proto";
+                reflection: "reflection";
+                protoset: "protoset";
+                js_bundle: "js_bundle";
+                gateway_derived: "gateway_derived";
+            }>>;
+            host: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+            frontingGatewayOperation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                gatewayType: z.ZodEnum<{
+                    rest: "rest";
+                    connect: "connect";
+                    graphql: "graphql";
+                }>;
+                operation: z.ZodString;
+            }, z.core.$strip>>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type App = z.infer<typeof AppSchema>;
+export declare const AppInfoSchema: z.ZodObject<{
+    name: z.ZodString;
+    framework: z.ZodString;
+    description: z.ZodString;
+    location: z.ZodString;
+    type: z.ZodDefault<z.ZodEnum<{
+        web_application: "web_application";
+        api: "api";
+        full_stack: "full_stack";
+        database: "database";
+        cloud_resource: "cloud_resource";
+        storage: "storage";
+        domain: "domain";
+        subdomain: "subdomain";
+    }>>;
+}, z.core.$strip>;
+export type AppInfo = z.infer<typeof AppInfoSchema>;
+export declare const AppsDiscoveryResultSchema: z.ZodObject<{
+    repoType: z.ZodString;
+    packageManager: z.ZodString;
+    apps: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        framework: z.ZodString;
+        description: z.ZodString;
+        location: z.ZodString;
+        type: z.ZodDefault<z.ZodEnum<{
+            web_application: "web_application";
+            api: "api";
+            full_stack: "full_stack";
+            database: "database";
+            cloud_resource: "cloud_resource";
+            storage: "storage";
+            domain: "domain";
+            subdomain: "subdomain";
+        }>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type AppsDiscoveryResult = z.infer<typeof AppsDiscoveryResultSchema>;
+export declare const DiscoverySummarySchema: z.ZodObject<{
+    endpointsDocumented: z.ZodNumber;
+    summary: z.ZodString;
+}, z.core.$strip>;
+export type DiscoverySummary = z.infer<typeof DiscoverySummarySchema>;
+export declare const WhiteboxAttackSurfaceResultSchema: z.ZodObject<{
+    repoType: z.ZodString;
+    packageManager: z.ZodString;
+    apps: z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        type: z.ZodDefault<z.ZodEnum<{
+            web_application: "web_application";
+            api: "api";
+            full_stack: "full_stack";
+            database: "database";
+            cloud_resource: "cloud_resource";
+            storage: "storage";
+            domain: "domain";
+            subdomain: "subdomain";
+        }>>;
+        framework: z.ZodString;
+        description: z.ZodString;
+        location: z.ZodString;
+        pages: z.ZodArray<z.ZodObject<{
+            method: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string, string | string[]>>;
+            path: z.ZodString;
+            handler: z.ZodOptional<z.ZodString>;
+            file: z.ZodString;
+            line: z.ZodOptional<z.ZodNumber>;
+            authRequired: z.ZodOptional<z.ZodBoolean>;
+            description: z.ZodOptional<z.ZodString>;
+            pentestObjectives: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+            riskScore: z.ZodOptional<z.ZodObject<{
+                score: z.ZodNumber;
+                explanation: z.ZodString;
+                breakdown: z.ZodObject<{
+                    exposure: z.ZodNumber;
+                    dataSensitivity: z.ZodNumber;
+                    functionCriticality: z.ZodNumber;
+                    securityIndicators: z.ZodNumber;
+                }, z.core.$strip>;
+            }, z.core.$strip>>;
+            threatModel: z.ZodOptional<z.ZodString>;
+            transport: z.ZodOptional<z.ZodEnum<{
+                http: "http";
+                grpc: "grpc";
+                grpc_web: "grpc_web";
+                connect: "connect";
+            }>>;
+            grpc: z.ZodOptional<z.ZodObject<{
+                serviceFqn: z.ZodString;
+                method: z.ZodString;
+                streamingType: z.ZodDefault<z.ZodEnum<{
+                    unary: "unary";
+                    server_stream: "server_stream";
+                    client_stream: "client_stream";
+                    bidi: "bidi";
+                }>>;
+                reflectionAvailable: z.ZodOptional<z.ZodBoolean>;
+                schemaSource: z.ZodOptional<z.ZodEnum<{
+                    unknown: "unknown";
+                    proto: "proto";
+                    reflection: "reflection";
+                    protoset: "protoset";
+                    js_bundle: "js_bundle";
+                    gateway_derived: "gateway_derived";
+                }>>;
+                host: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                frontingGatewayOperation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    gatewayType: z.ZodEnum<{
+                        rest: "rest";
+                        connect: "connect";
+                        graphql: "graphql";
+                    }>;
+                    operation: z.ZodString;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+        apiEndpoints: z.ZodArray<z.ZodObject<{
+            method: z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string, string | string[]>>;
+            path: z.ZodString;
+            handler: z.ZodOptional<z.ZodString>;
+            file: z.ZodString;
+            line: z.ZodOptional<z.ZodNumber>;
+            authRequired: z.ZodOptional<z.ZodBoolean>;
+            description: z.ZodOptional<z.ZodString>;
+            pentestObjectives: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodArray<z.ZodString>]>, z.ZodTransform<string[], string | string[]>>>;
+            riskScore: z.ZodOptional<z.ZodObject<{
+                score: z.ZodNumber;
+                explanation: z.ZodString;
+                breakdown: z.ZodObject<{
+                    exposure: z.ZodNumber;
+                    dataSensitivity: z.ZodNumber;
+                    functionCriticality: z.ZodNumber;
+                    securityIndicators: z.ZodNumber;
+                }, z.core.$strip>;
+            }, z.core.$strip>>;
+            threatModel: z.ZodOptional<z.ZodString>;
+            transport: z.ZodOptional<z.ZodEnum<{
+                http: "http";
+                grpc: "grpc";
+                grpc_web: "grpc_web";
+                connect: "connect";
+            }>>;
+            grpc: z.ZodOptional<z.ZodObject<{
+                serviceFqn: z.ZodString;
+                method: z.ZodString;
+                streamingType: z.ZodDefault<z.ZodEnum<{
+                    unary: "unary";
+                    server_stream: "server_stream";
+                    client_stream: "client_stream";
+                    bidi: "bidi";
+                }>>;
+                reflectionAvailable: z.ZodOptional<z.ZodBoolean>;
+                schemaSource: z.ZodOptional<z.ZodEnum<{
+                    unknown: "unknown";
+                    proto: "proto";
+                    reflection: "reflection";
+                    protoset: "protoset";
+                    js_bundle: "js_bundle";
+                    gateway_derived: "gateway_derived";
+                }>>;
+                host: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+                frontingGatewayOperation: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+                    gatewayType: z.ZodEnum<{
+                        rest: "rest";
+                        connect: "connect";
+                        graphql: "graphql";
+                    }>;
+                    operation: z.ZodString;
+                }, z.core.$strip>>>;
+            }, z.core.$strip>>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+    summary: z.ZodObject<{
+        totalApps: z.ZodNumber;
+        totalPages: z.ZodNumber;
+        totalApiEndpoints: z.ZodNumber;
+        totalPentestObjectives: z.ZodNumber;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type WhiteboxAttackSurfaceResult = z.infer<typeof WhiteboxAttackSurfaceResultSchema>;

package/build/lib/core/agents/specialized/whiteboxAttackSurface/types.js

@@ -0,0 +1,21 @@
+import {
+  RiskScoreBreakdownSchema2,
+  RiskScoreSchema2,
+  EndpointSchema2,
+  AppSchema2,
+  AppInfoSchema2,
+  AppsDiscoveryResultSchema2,
+  DiscoverySummarySchema2,
+  WhiteboxAttackSurfaceResultSchema2
+} from "../../../../chunk-xpfg2fbk.js";
+import"../../../../chunk-vx228eeq.js";
+export {
+  AppInfoSchema2 as AppInfoSchema,
+  AppSchema2 as AppSchema,
+  AppsDiscoveryResultSchema2 as AppsDiscoveryResultSchema,
+  DiscoverySummarySchema2 as DiscoverySummarySchema,
+  EndpointSchema2 as EndpointSchema,
+  RiskScoreBreakdownSchema2 as RiskScoreBreakdownSchema,
+  RiskScoreSchema2 as RiskScoreSchema,
+  WhiteboxAttackSurfaceResultSchema2 as WhiteboxAttackSurfaceResultSchema
+};