@planu/cli 0.15.2

package/dist/tools/challenge-spec/platform-challenge-scenarios.js

@@ -0,0 +1,227 @@
+// tools/challenge-spec/platform-challenge-scenarios.ts
+// SPEC-015a: Challenge scenarios for Smart Contracts, Bots, and IoT projects
+import { getAdvancedPlatformChallenges } from './platform-challenge-scenarios-b.js';
+// === Smart Contract challenges (criterion 9) ===
+function buildSmartContractChallenges(spec, content) {
+    const lower = content.toLowerCase();
+    const hasMention = (keywords) => keywords.some((kw) => lower.includes(kw));
+    const scenarios = [];
+    // Reentrancy
+    scenarios.push({
+        scenario: 'Reentrancy attack: malicious contract calls back before state update',
+        probability: 'medium',
+        impact: 'critical',
+        currentHandling: hasMention(['nonreentrant', 'reentrancy', 'checks-effects-interactions'])
+            ? 'Guard mentioned in spec'
+            : 'Not addressed',
+        requiredHandling: 'Apply checks-effects-interactions pattern. Use OpenZeppelin `ReentrancyGuard`. ' +
+            'Update state BEFORE external calls.',
+        dataConsistency: 'All funds/balances must be updated atomically before any external call.',
+        userExperience: 'Transaction should revert with descriptive error on reentry attempt.',
+    });
+    // Integer overflow
+    scenarios.push({
+        scenario: 'Integer overflow/underflow causing unexpected balance or counter values',
+        probability: 'low',
+        impact: 'critical',
+        currentHandling: hasMention(['safematch', 'overflow', 'unchecked'])
+            ? 'Overflow protection noted'
+            : 'Relies on Solidity 0.8+ built-in checks',
+        requiredHandling: 'Solidity 0.8+ reverts on overflow by default. For gas optimization with `unchecked {}`, ' +
+            'document why overflow is safe. Audit all arithmetic paths.',
+        dataConsistency: 'Critical: token/ETH amounts must never overflow silently.',
+        userExperience: 'Transaction reverts with "Arithmetic overflow" if built-in check triggers.',
+    });
+    // Gas limits
+    scenarios.push({
+        scenario: 'Gas limit exceeded in loops over unbounded arrays/mappings',
+        probability: 'high',
+        impact: 'high',
+        currentHandling: hasMention(['pagination', 'batch', 'gas', 'limit'])
+            ? 'Some batching mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Limit loop iterations with a max cap. Prefer pagination over full enumeration. ' +
+            'Use events for off-chain indexing instead of on-chain arrays.',
+        dataConsistency: 'Partial loop execution must not leave state inconsistent.',
+        userExperience: 'Implement off-chain indexing (The Graph) for queries needing iteration.',
+    });
+    // Access control
+    scenarios.push({
+        scenario: 'Unauthorized function call: missing access control on sensitive functions',
+        probability: 'high',
+        impact: 'critical',
+        currentHandling: hasMention(['onlyowner', 'access', 'role', 'modifier'])
+            ? 'Access control mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Apply `onlyOwner`, `AccessControl`, or custom modifiers to admin functions. ' +
+            'Use role-based access (ADMIN_ROLE, MINTER_ROLE). Validate every external/public function.',
+        dataConsistency: 'All privileged operations require explicit authorization check.',
+        userExperience: 'Unauthorized calls revert with meaningful error ("Caller is not admin").',
+    });
+    // Front-running
+    scenarios.push({
+        scenario: 'Front-running: mempool observer submits higher-gas tx to steal value',
+        probability: 'medium',
+        impact: 'high',
+        currentHandling: hasMention(['commit-reveal', 'slippage', 'deadline', 'frontrun'])
+            ? 'Mitigation strategy noted'
+            : 'Not addressed',
+        requiredHandling: 'For swaps: add slippage tolerance + deadline. For auctions: use commit-reveal scheme. ' +
+            'For price-sensitive ops: use TWAP oracles instead of spot price.',
+        dataConsistency: 'Final price/amount must match user expectation within slippage bounds.',
+        userExperience: 'Transactions revert if slippage or deadline exceeded (user sees reason).',
+    });
+    void spec; // spec used for context
+    return scenarios;
+}
+// === Bot challenges (criterion 10) ===
+function buildBotChallenges(spec, content) {
+    const lower = content.toLowerCase();
+    const hasMention = (keywords) => keywords.some((kw) => lower.includes(kw));
+    const scenarios = [];
+    // Rate limiting
+    scenarios.push({
+        scenario: 'Bot exceeds platform API rate limits, causing commands to silently fail',
+        probability: 'high',
+        impact: 'high',
+        currentHandling: hasMention(['rate limit', 'throttle', 'queue'])
+            ? 'Rate limiting mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Implement request queue with rate limiter (token bucket). Retry with exponential backoff. ' +
+            'Cache frequently requested data. Respect per-route Discord/Slack limits.',
+        dataConsistency: 'Queued commands must be executed in order; no silent drops.',
+        userExperience: 'Inform user when request is queued: "Your request is processing, please wait."',
+    });
+    // Spam and abuse
+    scenarios.push({
+        scenario: 'User or bot sends flood of commands, causing DoS or cost spike',
+        probability: 'high',
+        impact: 'medium',
+        currentHandling: hasMention(['cooldown', 'spam', 'abuse', 'permission'])
+            ? 'Spam prevention noted'
+            : 'Not addressed',
+        requiredHandling: 'Per-user cooldown (e.g. 5 req/10s). Block users who exceed limits. ' +
+            'Whitelist/allowlist for expensive commands.',
+        dataConsistency: 'Blocked operations must not partially execute.',
+        userExperience: 'Respond with cooldown remaining time: "Please wait 8s before reusing this command."',
+    });
+    // Command injection
+    scenarios.push({
+        scenario: 'Malicious user injects shell commands or SQL via bot command arguments',
+        probability: 'medium',
+        impact: 'critical',
+        currentHandling: hasMention(['sanitize', 'escape', 'validate', 'injection'])
+            ? 'Input validation noted'
+            : 'Not addressed',
+        requiredHandling: 'Sanitize all user inputs. Use parameterized queries. ' +
+            'Never pass user input to shell. Validate argument types strictly.',
+        dataConsistency: 'No user input reaches database or system calls unsanitized.',
+        userExperience: 'Reject invalid input with clear error message before processing.',
+    });
+    // API limits
+    scenarios.push({
+        scenario: 'Downstream API (OpenAI, external service) is unavailable or returns error',
+        probability: 'medium',
+        impact: 'high',
+        currentHandling: hasMention(['fallback', 'timeout', 'error handling'])
+            ? 'Error handling noted'
+            : 'Not addressed',
+        requiredHandling: 'Implement circuit breaker pattern. Define timeout for each API call (5-10s). ' +
+            'Provide fallback response when external service fails.',
+        dataConsistency: 'Bot state must not be corrupted when external API fails.',
+        userExperience: 'Communicate service degradation: "Feature temporarily unavailable, try again later."',
+    });
+    void spec;
+    return scenarios;
+}
+// === IoT challenges (criterion 11) ===
+function buildIoTChallenges(spec, content) {
+    const lower = content.toLowerCase();
+    const hasMention = (keywords) => keywords.some((kw) => lower.includes(kw));
+    const scenarios = [];
+    // Connectivity loss
+    scenarios.push({
+        scenario: 'Network connectivity lost while device is transmitting sensor data',
+        probability: 'high',
+        impact: 'high',
+        currentHandling: hasMention(['offline', 'queue', 'reconnect', 'local storage'])
+            ? 'Offline handling mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Buffer readings locally (flash/EEPROM). Queue messages for later delivery. ' +
+            'Implement exponential backoff reconnect. Define max local buffer size before dropping.',
+        dataConsistency: 'Timestamps must be device-local (RTC) to avoid clock skew on reconnect.',
+        userExperience: 'Dashboard shows "last seen X minutes ago" and data gap indicator.',
+    });
+    // Sensor failure
+    scenarios.push({
+        scenario: 'Sensor returns out-of-range values or stops responding',
+        probability: 'medium',
+        impact: 'high',
+        currentHandling: hasMention(['sensor', 'validate', 'range', 'watchdog'])
+            ? 'Sensor validation noted'
+            : 'Not addressed',
+        requiredHandling: 'Validate sensor readings against physical limits before processing. ' +
+            'Implement watchdog timer to detect sensor hang. Alert on consecutive failures.',
+        dataConsistency: 'Invalid readings must be marked (NaN/null), not silently discarded.',
+        userExperience: 'Alert: "Sensor [id] is offline or returning invalid data."',
+    });
+    // Battery management
+    scenarios.push({
+        scenario: 'Battery depletes unexpectedly due to aggressive polling or wake frequency',
+        probability: 'medium',
+        impact: 'medium',
+        currentHandling: hasMention(['sleep', 'deep sleep', 'power', 'battery'])
+            ? 'Power management mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Use deep sleep between readings. Adjust wake frequency based on battery level. ' +
+            'Send battery % in every telemetry packet. Alert when <20%.',
+        dataConsistency: 'Critical readings must be flushed before entering deep sleep.',
+        userExperience: 'Battery level visible in dashboard. Low battery alert at threshold.',
+    });
+    // OTA failure
+    scenarios.push({
+        scenario: 'OTA firmware update fails mid-flash, leaving device in unbootable state',
+        probability: 'low',
+        impact: 'critical',
+        currentHandling: hasMention(['ota', 'rollback', 'dual partition', 'backup'])
+            ? 'OTA strategy noted'
+            : 'Not addressed',
+        requiredHandling: 'Use dual-partition OTA (A/B). Validate checksum before applying. ' +
+            'Keep rollback partition intact. Require minimum battery level before OTA.',
+        dataConsistency: 'OTA is atomic: device boots new firmware or rolls back, never partial.',
+        userExperience: 'OTA progress reported to dashboard. Failure triggers automatic rollback and alert.',
+    });
+    void spec;
+    return scenarios;
+}
+// === Public API ===
+/**
+ * Returns platform-specific challenge scenarios based on project category.
+ * Covers smart contracts (criterion 9), bots (criterion 10), and IoT (criterion 11).
+ */
+export function getPlatformChallenges(spec, content, knowledge) {
+    const scenarios = [];
+    const category = knowledge.projectCategory;
+    const framework = knowledge.framework?.toLowerCase() ?? '';
+    // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition
+    const stack = (knowledge.stack ?? []).map((s) => s.toLowerCase());
+    const isSmartContract = category === 'smart-contract' ||
+        ['hardhat', 'foundry', 'anchor', 'move'].includes(framework) ||
+        stack.some((s) => ['solidity', 'hardhat', 'foundry'].includes(s));
+    const isBot = category === 'bot' ||
+        stack.some((s) => ['discord.js', 'telegraf', 'grammy', '@slack/bolt'].includes(s));
+    const isIoT = category === 'iot' || stack.some((s) => ['platformio', 'arduino', 'zephyr'].includes(s));
+    if (isSmartContract) {
+        scenarios.push(...buildSmartContractChallenges(spec, content));
+    }
+    if (isBot) {
+        scenarios.push(...buildBotChallenges(spec, content));
+    }
+    if (isIoT) {
+        scenarios.push(...buildIoTChallenges(spec, content));
+    }
+    // SPEC-015b: Advanced platform challenges (OWASP, ML distribution shift, IaC state, IoT power loss)
+    scenarios.push(...getAdvancedPlatformChallenges(spec, content, knowledge));
+    return scenarios;
+}
+//# sourceMappingURL=platform-challenge-scenarios.js.map

package/dist/tools/challenge-spec/platform-challenge-scenarios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-challenge-scenarios.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/platform-challenge-scenarios.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,6EAA6E;AAG7E,OAAO,EAAE,6BAA6B,EAAE,MAAM,qCAAqC,CAAC;AAEpF,kDAAkD;AAElD,SAAS,4BAA4B,CAAC,IAAU,EAAE,OAAe;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,aAAa;IACb,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,sEAAsE;QAChF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,UAAU,CAAC,CAAC,cAAc,EAAE,YAAY,EAAE,6BAA6B,CAAC,CAAC;YACxF,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,iFAAiF;YACjF,qCAAqC;QACvC,eAAe,EAAE,yEAAyE;QAC1F,cAAc,EAAE,sEAAsE;KACvF,CAAC,CAAC;IAEH,mBAAmB;IACnB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,yEAAyE;QACnF,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YACjE,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,yCAAyC;QAC7C,gBAAgB,EACd,0FAA0F;YAC1F,4DAA4D;QAC9D,eAAe,EAAE,2DAA2D;QAC5E,cAAc,EAAE,4EAA4E;KAC7F,CAAC,CAAC;IAEH,aAAa;IACb,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,4DAA4D;QACtE,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,YAAY,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,iFAAiF;YACjF,+DAA+D;QACjE,eAAe,EAAE,2DAA2D;QAC5E,cAAc,EAAE,yEAAyE;KAC1F,CAAC,CAAC;IAEH,iBAAiB;IACjB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,2EAA2E;QACrF,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YACtE,CAAC,CAAC,0BAA0B;YAC5B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,8EAA8E;YAC9E,2FAA2F;QAC7F,eAAe,EAAE,iEAAiE;QAClF,cAAc,EAAE,0EAA0E;KAC3F,CAAC,CAAC;IAEH,gBAAgB;IAChB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,sEAAsE;QAChF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC;YAChF,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,wFAAwF;YACxF,kEAAkE;QACpE,eAAe,EAAE,wEAAwE;QACzF,cAAc,EAAE,0EAA0E;KAC3F,CAAC,CAAC;IAEH,KAAK,IAAI,CAAC,CAAC,wBAAwB;IACnC,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AAExC,SAAS,kBAAkB,CAAC,IAAU,EAAE,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,gBAAgB;IAChB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,yEAAyE;QACnF,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;YAC9D,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,4FAA4F;YAC5F,0EAA0E;QAC5E,eAAe,EAAE,6DAA6D;QAC9E,cAAc,EACZ,gFAAgF;KACnF,CAAC,CAAC;IAEH,iBAAiB;IACjB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,gEAAgE;QAC1E,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,QAAQ;QAChB,eAAe,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,YAAY,CAAC,CAAC;YACtE,CAAC,CAAC,uBAAuB;YACzB,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,qEAAqE;YACrE,6CAA6C;QAC/C,eAAe,EAAE,gDAAgD;QACjE,cAAc,EACZ,qFAAqF;KACxF,CAAC,CAAC;IAEH,oBAAoB;IACpB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,wEAAwE;QAClF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,CAAC,CAAC;YAC1E,CAAC,CAAC,wBAAwB;YAC1B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,uDAAuD;YACvD,mEAAmE;QACrE,eAAe,EAAE,6DAA6D;QAC9E,cAAc,EAAE,kEAAkE;KACnF,CAAC,CAAC;IAEH,aAAa;IACb,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,2EAA2E;QACrF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YACpE,CAAC,CAAC,sBAAsB;YACxB,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,+EAA+E;YAC/E,wDAAwD;QAC1D,eAAe,EAAE,0DAA0D;QAC3E,cAAc,EACZ,sFAAsF;KACzF,CAAC,CAAC;IAEH,KAAK,IAAI,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,wCAAwC;AAExC,SAAS,kBAAkB,CAAC,IAAU,EAAE,OAAe;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,MAAM,UAAU,GAAG,CAAC,QAAkB,EAAW,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;IAE9F,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,oBAAoB;IACpB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,oEAAoE;QAC9E,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;YAC7E,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,6EAA6E;YAC7E,wFAAwF;QAC1F,eAAe,EAAE,yEAAyE;QAC1F,cAAc,EAAE,mEAAmE;KACpF,CAAC,CAAC;IAEH,iBAAiB;IACjB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,wDAAwD;QAClE,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,UAAU,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;YACtE,CAAC,CAAC,yBAAyB;YAC3B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,sEAAsE;YACtE,gFAAgF;QAClF,eAAe,EAAE,qEAAqE;QACtF,cAAc,EAAE,4DAA4D;KAC7E,CAAC,CAAC;IAEH,qBAAqB;IACrB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,2EAA2E;QACrF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,QAAQ;QAChB,eAAe,EAAE,UAAU,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,iFAAiF;YACjF,4DAA4D;QAC9D,eAAe,EAAE,+DAA+D;QAChF,cAAc,EAAE,qEAAqE;KACtF,CAAC,CAAC;IAEH,cAAc;IACd,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,yEAAyE;QACnF,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,UAAU,CAAC,CAAC,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,QAAQ,CAAC,CAAC;YAC1E,CAAC,CAAC,oBAAoB;YACtB,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,mEAAmE;YACnE,2EAA2E;QAC7E,eAAe,EAAE,wEAAwE;QACzF,cAAc,EACZ,oFAAoF;KACvF,CAAC,CAAC;IAEH,KAAK,IAAI,CAAC;IACV,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,qBAAqB;AAErB;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAU,EACV,OAAe,EACf,SAA2B;IAE3B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,SAAS,CAAC,eAAe,CAAC;IAC3C,MAAM,SAAS,GAAG,SAAS,CAAC,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3D,uEAAuE;IACvE,MAAM,KAAK,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAElE,MAAM,eAAe,GACnB,QAAQ,KAAK,gBAAgB;QAC7B,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC5D,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpE,MAAM,KAAK,GACT,QAAQ,KAAK,KAAK;QAClB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAErF,MAAM,KAAK,GACT,QAAQ,KAAK,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IAE3F,IAAI,eAAe,EAAE,CAAC;QACpB,SAAS,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,SAAS,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,KAAK,EAAE,CAAC;QACV,SAAS,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,oGAAoG;IACpG,SAAS,CAAC,IAAI,CAAC,GAAG,6BAA6B,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAE3E,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/challenge-spec/privacy-challenge-scenarios.d.ts

@@ -0,0 +1,11 @@
+import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+/**
+ * Generates privacy challenge scenarios for specs that collect or process PII.
+ * These challenges are MANDATORY (cannot be skipped) per SPEC-030 business rules.
+ *
+ * Questions covered:
+ * - "What is the legal basis for processing this data?"
+ * - "What happens if the user withdraws consent while data is being processed?"
+ */
+export declare function generatePrivacyChallengeScenarios(spec: Spec, specContent: string, _knowledge: ProjectKnowledge): FailureScenario[];
+//# sourceMappingURL=privacy-challenge-scenarios.d.ts.map

package/dist/tools/challenge-spec/privacy-challenge-scenarios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-challenge-scenarios.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/privacy-challenge-scenarios.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF;;;;;;;GAOG;AACH,wBAAgB,iCAAiC,CAC/C,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,gBAAgB,GAC3B,eAAe,EAAE,CAoFnB"}

package/dist/tools/challenge-spec/privacy-challenge-scenarios.js

@@ -0,0 +1,75 @@
+// tools/challenge-spec/privacy-challenge-scenarios.ts — Privacy challenges (SPEC-030)
+// Generates privacy-specific failure scenarios when a spec involves PII.
+import { detectPIIInSpec } from '../../engine/pii-detector.js';
+/**
+ * Generates privacy challenge scenarios for specs that collect or process PII.
+ * These challenges are MANDATORY (cannot be skipped) per SPEC-030 business rules.
+ *
+ * Questions covered:
+ * - "What is the legal basis for processing this data?"
+ * - "What happens if the user withdraws consent while data is being processed?"
+ */
+export function generatePrivacyChallengeScenarios(spec, specContent, _knowledge) {
+    const result = detectPIIInSpec(spec.title, specContent, specContent);
+    if (!result.hasPII) {
+        return [];
+    }
+    const scenarios = [];
+    // Challenge 1: Legal basis for processing
+    scenarios.push({
+        scenario: `[${spec.id}] Privacy — Legal Basis: What is the legal basis for processing the personal data detected in this spec (${result.fields.map((f) => f.fieldName).join(', ')})? Has a balancing test been conducted if using "legitimate interest"?`,
+        probability: 'high',
+        impact: 'critical',
+        currentHandling: 'Legal basis may not be documented in the spec — processing data without a documented legal basis is a GDPR violation.',
+        requiredHandling: 'Document the legal basis for each personal data field: consent, contract, legal-obligation, vital-interest, public-task, or legitimate-interest. ' +
+            'For sensitive-special categories (GDPR Art. 9), only consent or legal-obligation are valid. ' +
+            'Add this to the spec privacy section before implementation.',
+        dataConsistency: 'If legal basis changes (e.g. user withdraws consent), the data may no longer be lawfully processed and must be deleted.',
+        userExperience: 'Users must be informed of the legal basis at point of collection. Provide a clear privacy notice.',
+    });
+    // Challenge 2: Consent withdrawal during active processing
+    if (result.requiresConsentFlow) {
+        scenarios.push({
+            scenario: `[${spec.id}] Privacy — Consent Withdrawal: What happens if the user withdraws consent while their data is actively being processed (e.g., mid-batch-job, mid-transaction, or stored in an async queue)?`,
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Async processing pipelines may not check consent status at each processing step — consent withdrawal may not halt in-flight operations.',
+            requiredHandling: 'Implement consent-check gates in async processing pipelines. ' +
+                'When consent is withdrawn: (1) stop all processing immediately, (2) delete or anonymize the data, ' +
+                '(3) propagate deletion to all systems (DB, cache, queues, third parties), ' +
+                '(4) confirm deletion to the user. Retention must be triggered even for in-flight operations.',
+            dataConsistency: 'Consent withdrawal must be propagated consistently across all data stores. Consider distributed transaction patterns or saga compensation.',
+            userExperience: 'User should receive confirmation that their data has been deleted within a reasonable timeframe (typically 30 days under GDPR).',
+        });
+    }
+    // Challenge 3: Right to erasure — propagation
+    if (result.requiresRightToErasure) {
+        scenarios.push({
+            scenario: `[${spec.id}] Privacy — Right to Erasure Propagation: When a user requests deletion of their personal data, are ALL systems updated? Does deletion propagate to backups, logs, caches, and third-party processors?`,
+            probability: 'high',
+            impact: 'high',
+            currentHandling: 'Deletion may only be implemented in the primary database — backups, logs, and third-party systems may retain copies.',
+            requiredHandling: 'Define a complete erasure plan: (1) primary DB soft/hard delete, (2) backup retention schedule respects erasure requests, ' +
+                '(3) logs are scrubbed or have a TTL policy, (4) third-party processors are notified via API or manual DPA process, ' +
+                '(5) a verification step confirms deletion is complete.',
+            dataConsistency: 'Audit trail of erasure requests must be retained (without the personal data itself) to prove compliance.',
+            userExperience: 'User should receive a deletion confirmation with a reference ID within 72 hours of request.',
+        });
+    }
+    // Challenge 4: Sensitive special categories
+    if (result.sensitiveSpecialCount > 0) {
+        scenarios.push({
+            scenario: `[${spec.id}] Privacy — Special Category Data (GDPR Art. 9): This spec processes ${result.sensitiveSpecialCount} special-category field(s). Special categories cannot use "legitimate interest" as legal basis. Has additional explicit consent been obtained?`,
+            probability: 'high',
+            impact: 'critical',
+            currentHandling: 'Special category data (health, race, religion, biometric, political opinion, sexual orientation) requires explicit consent — implied consent or generic privacy policies are insufficient.',
+            requiredHandling: 'For each special-category field: (1) obtain explicit, granular consent specifically for that data type, ' +
+                '(2) document the justification for necessity, (3) implement extra encryption and access controls, ' +
+                '(4) restrict access to only personnel who require it.',
+            dataConsistency: 'Special-category data must be segregated from other PII and have stricter access audit trails.',
+            userExperience: 'Consent UI must clearly describe what special-category data is collected and why — vague descriptions are not valid consent.',
+        });
+    }
+    return scenarios;
+}
+//# sourceMappingURL=privacy-challenge-scenarios.js.map

package/dist/tools/challenge-spec/privacy-challenge-scenarios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-challenge-scenarios.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/privacy-challenge-scenarios.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,yEAAyE;AAGzE,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,iCAAiC,CAC/C,IAAU,EACV,WAAmB,EACnB,UAA4B;IAE5B,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;IACrE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,0CAA0C;IAC1C,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,4GAA4G,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,wEAAwE;QACzP,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,UAAU;QAClB,eAAe,EACb,uHAAuH;QACzH,gBAAgB,EACd,mJAAmJ;YACnJ,8FAA8F;YAC9F,6DAA6D;QAC/D,eAAe,EACb,yHAAyH;QAC3H,cAAc,EACZ,mGAAmG;KACtG,CAAC,CAAC;IAEH,2DAA2D;IAC3D,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;QAC/B,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,8LAA8L;YACnN,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,yIAAyI;YAC3I,gBAAgB,EACd,+DAA+D;gBAC/D,oGAAoG;gBACpG,4EAA4E;gBAC5E,8FAA8F;YAChG,eAAe,EACb,4IAA4I;YAC9I,cAAc,EACZ,iIAAiI;SACpI,CAAC,CAAC;IACL,CAAC;IAED,8CAA8C;IAC9C,IAAI,MAAM,CAAC,sBAAsB,EAAE,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,wMAAwM;YAC7N,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,sHAAsH;YACxH,gBAAgB,EACd,4HAA4H;gBAC5H,qHAAqH;gBACrH,wDAAwD;YAC1D,eAAe,EACb,0GAA0G;YAC5G,cAAc,EACZ,6FAA6F;SAChG,CAAC,CAAC;IACL,CAAC;IAED,4CAA4C;IAC5C,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,IAAI,IAAI,CAAC,EAAE,wEAAwE,MAAM,CAAC,qBAAqB,gJAAgJ;YACzQ,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,4LAA4L;YAC9L,gBAAgB,EACd,0GAA0G;gBAC1G,oGAAoG;gBACpG,uDAAuD;YACzD,eAAe,EACb,gGAAgG;YAClG,cAAc,EACZ,8HAA8H;SACjI,CAAC,CAAC;IACL,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.d.ts

@@ -0,0 +1,35 @@
+import type { FailureScenario, Spec } from '../../types/index.js';
+export declare const EXTERNAL_CALL_KEYWORDS: string[];
+export declare const VALIDATION_KEYWORDS: string[];
+export declare const RATE_LIMIT_KEYWORDS: string[];
+export declare const CONCURRENCY_KEYWORDS: string[];
+export declare const SAGA_KEYWORDS: string[];
+/**
+ * Returns true when the spec describes an external service call.
+ */
+export declare function hasExternalCallSignal(spec: Spec, specContent: string): boolean;
+/**
+ * Returns true when the spec describes input validation.
+ */
+export declare function hasValidationSignal(spec: Spec, specContent: string): boolean;
+/**
+ * Returns true when the spec is a rate-limit-sensitive endpoint.
+ */
+export declare function hasRateLimitSignal(spec: Spec, specContent: string): boolean;
+/**
+ * Returns true when the spec involves shared state.
+ */
+export declare function hasConcurrencySignal(spec: Spec, specContent: string): boolean;
+/**
+ * Returns true when the spec describes a distributed saga.
+ */
+export declare function hasSagaSignal(spec: Spec, specContent: string): boolean;
+/**
+ * Generate validation boundary challenge scenarios.
+ */
+export declare function generateValidationBoundaryScenarios(spec: Spec): FailureScenario[];
+/**
+ * Generate cascade failure challenge scenarios.
+ */
+export declare function generateCascadeFailureScenarios(spec: Spec): FailureScenario[];
+//# sourceMappingURL=resilience-challenge-scenarios-a.d.ts.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-a.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-a.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAGlE,eAAO,MAAM,sBAAsB,UAclC,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAe/B,CAAC;AAEF,eAAO,MAAM,mBAAmB,UAS/B,CAAC;AAEF,eAAO,MAAM,oBAAoB,UAahC,CAAC;AAEF,eAAO,MAAM,aAAa,UASzB,CAAC;AAEF;;GAEG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAG9E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAG5E;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAG3E;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAG7E;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAGtE;AAED;;GAEG;AACH,wBAAgB,mCAAmC,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CAiEjF;AAED;;GAEG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CA+C7E"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.js

@@ -0,0 +1,199 @@
+// tools/challenge-spec/resilience-challenge-scenarios-a.ts — SPEC-034
+// Signal detectors + validation boundary + cascade failure scenarios
+// Keywords indicating external service calls or shared state
+export const EXTERNAL_CALL_KEYWORDS = [
+    'api',
+    'http',
+    'fetch',
+    'request',
+    'endpoint',
+    'service',
+    'downstream',
+    'external',
+    'grpc',
+    'webhook',
+    'integration',
+    'client',
+    'sdk',
+];
+export const VALIDATION_KEYWORDS = [
+    'input',
+    'form',
+    'body',
+    'payload',
+    'request',
+    'submit',
+    'create',
+    'update',
+    'post',
+    'put',
+    'patch',
+    'validate',
+    'schema',
+    'endpoint',
+];
+export const RATE_LIMIT_KEYWORDS = [
+    'login',
+    'auth',
+    'register',
+    'public',
+    'api',
+    'bulk',
+    'export',
+    'import',
+];
+export const CONCURRENCY_KEYWORDS = [
+    'counter',
+    'cache',
+    'session',
+    'pool',
+    'shared',
+    'concurrent',
+    'parallel',
+    'queue',
+    'lock',
+    'mutex',
+    'atomic',
+    'thread',
+];
+export const SAGA_KEYWORDS = [
+    'distributed',
+    'saga',
+    'multi-step',
+    'compensat',
+    'rollback',
+    'orchestrat',
+    'choreograph',
+    'transaction',
+];
+/**
+ * Returns true when the spec describes an external service call.
+ */
+export function hasExternalCallSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return EXTERNAL_CALL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec describes input validation.
+ */
+export function hasValidationSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return VALIDATION_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec is a rate-limit-sensitive endpoint.
+ */
+export function hasRateLimitSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return RATE_LIMIT_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec involves shared state.
+ */
+export function hasConcurrencySignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return CONCURRENCY_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec describes a distributed saga.
+ */
+export function hasSagaSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return SAGA_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Generate validation boundary challenge scenarios.
+ */
+export function generateValidationBoundaryScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Validation Boundary — String Fields: ` +
+                'What happens when a required string field receives: (a) empty string "", (b) null, (c) field absent from body entirely, ' +
+                '(d) string with only whitespace "   ", (e) Unicode multibyte string (emoji) that exceeds maxLength if the library counts bytes instead of codepoints? ' +
+                'Are all three cases (absent vs null vs empty) handled with distinct error codes?',
+            probability: 'high',
+            impact: 'high',
+            currentHandling: 'Validation may treat empty and null as equivalent, or silently pass absent fields as undefined without failing required checks.',
+            requiredHandling: 'Define explicit behavior for each case in the validation schema. ' +
+                'Empty string "" → 400 if field is required. ' +
+                'null → 400 if field is non-nullable. ' +
+                'Absent field → 400 if field is required. ' +
+                'Whitespace-only → trim and validate length after trimming. ' +
+                'Unicode: use character/codepoint counting, not byte length.',
+            dataConsistency: 'Accepting empty strings as valid inputs leads to records with meaningless values polluting the database.',
+            userExperience: 'Clear per-field error messages with the specific constraint violated improve form UX significantly.',
+        },
+        {
+            scenario: `[${spec.id}] Validation Boundary — Numeric Fields: ` +
+                'What happens when a numeric field receives: (a) value exactly at min boundary (e.g., min=0 → test with -1, 0, 1), ' +
+                '(b) value exactly at max boundary, (c) NaN, (d) Infinity or -Infinity, ' +
+                '(e) number sent as string "42" — does the library coerce or reject?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Boundary conditions (exactly at min/max) are often omitted from tests, leading to off-by-one bugs in production.',
+            requiredHandling: 'Test all boundary values explicitly: min-1 (fail), min (pass), max (pass), max+1 (fail). ' +
+                'NaN and Infinity must be rejected with 400, not passed through. ' +
+                'Coercion policy must be explicit: either always reject type mismatches or always coerce with documented behavior.',
+            dataConsistency: 'NaN or Infinity stored in numeric columns causes silent corruption or runtime exceptions.',
+            userExperience: 'Off-by-one errors in validation create confusing UX where users cannot submit valid data.',
+        },
+        {
+            scenario: `[${spec.id}] Validation Security — Injection Payloads: ` +
+                'Does the validation layer handle security-relevant strings without crashing or leaking internals? ' +
+                "Test with: SQL injection ('; DROP TABLE users; --), XSS (<script>alert(1)</script>), " +
+                'path traversal (../../etc/passwd), null bytes (\\0), template injection ({{7*7}}). ' +
+                'Validation is not the primary defense (that is parameterized queries / output encoding), ' +
+                'but it must not crash and must not expose stack traces.',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Injection payloads may cause unhandled exceptions in validation middleware, exposing internal error details.',
+            requiredHandling: 'All string inputs must be treated as untrusted. ' +
+                'Validation rejects malformed types; sanitization and parameterized queries handle injection prevention downstream. ' +
+                'Error responses must never include the rejected payload or stack trace — return sanitized field name + constraint only.',
+            dataConsistency: 'If injection payloads reach the database layer (even as errors), they can leak schema information via error messages.',
+            userExperience: 'Stack traces exposed in 400 responses are a security vulnerability — use opaque error IDs instead.',
+        },
+    ];
+}
+/**
+ * Generate cascade failure challenge scenarios.
+ */
+export function generateCascadeFailureScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Cascade Failure — Connection Pool Exhaustion: ` +
+                'If the external service starts responding in 30 seconds (OS timeout) instead of the expected 200ms, ' +
+                'how many simultaneous requests accumulate in the connection pool before the circuit breaker activates? ' +
+                'If the pool has size N and each request holds a connection for T seconds, the pool fills in N * T seconds. ' +
+                'Calculate this with the actual pool size and timeout values. ' +
+                'Does the circuit breaker open before the pool is exhausted?',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Without a circuit breaker, slow external services cause connection pool exhaustion, ' +
+                'blocking all requests to this service (not just those calling the external service).',
+            requiredHandling: 'Set connect_timeout (2s) and read_timeout (10s) — never rely on OS timeout (30s+). ' +
+                'Circuit breaker must open before pool exhaustion: threshold 50% failures in 10 calls, open duration 60s. ' +
+                'When pool is at 80% capacity, emit a warning metric. ' +
+                'When circuit is open, return 503 immediately without touching the pool.',
+            dataConsistency: 'Pool exhaustion can cascade: if this service pool is exhausted, callers of this service also accumulate requests.',
+            userExperience: 'Without fast-fail (circuit open), users wait for OS timeout (30s) instead of receiving a 503 in under 1s.',
+        },
+        {
+            scenario: `[${spec.id}] Resilience — Retry Thundering Herd: ` +
+                'If the external service recovers after a 60-second outage and the circuit breaker transitions to HALF-OPEN, ' +
+                'all queued retries fire simultaneously. ' +
+                'Does the retry strategy use jitter (random delay offset) to spread the load, ' +
+                'or do all retries hit the recovering service at the same time (thundering herd)?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Retry without jitter causes thundering herd: all retries fire simultaneously after backoff, ' +
+                'potentially re-overloading the service as it recovers.',
+            requiredHandling: 'Exponential backoff with jitter: delay = random(0, base * 2^attempt). ' +
+                'In HALF-OPEN state: limit to 1-3 probe requests, not all queued requests simultaneously. ' +
+                'If probes succeed, circuit closes gradually.',
+            dataConsistency: 'Thundering herd can cause the recovering service to fail again immediately after recovery.',
+            userExperience: 'Jitter is invisible to the user but prevents the oscillation pattern where the service flaps between healthy and degraded.',
+        },
+    ];
+}
+//# sourceMappingURL=resilience-challenge-scenarios-a.js.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-a.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-a.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qEAAqE;AAIrE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,SAAS;IACT,YAAY;IACZ,UAAU;IACV,MAAM;IACN,SAAS;IACT,aAAa;IACb,QAAQ;IACR,KAAK;CACN,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa;IACb,MAAM;IACN,YAAY;IACZ,WAAW;IACX,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE,WAAmB;IACnE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,WAAmB;IACjE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAU,EAAE,WAAmB;IAChE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAU,EAAE,WAAmB;IAClE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,WAAmB;IAC3D,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAAU;IAC5D,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,yCAAyC;gBACpD,0HAA0H;gBAC1H,wJAAwJ;gBACxJ,kFAAkF;YACpF,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,iIAAiI;YACnI,gBAAgB,EACd,mEAAmE;gBACnE,8CAA8C;gBAC9C,uCAAuC;gBACvC,2CAA2C;gBAC3C,6DAA6D;gBAC7D,6DAA6D;YAC/D,eAAe,EACb,0GAA0G;YAC5G,cAAc,EACZ,qGAAqG;SACxG;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,0CAA0C;gBACrD,oHAAoH;gBACpH,yEAAyE;gBACzE,qEAAqE;YACvE,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,kHAAkH;YACpH,gBAAgB,EACd,2FAA2F;gBAC3F,kEAAkE;gBAClE,mHAAmH;YACrH,eAAe,EACb,2FAA2F;YAC7F,cAAc,EACZ,2FAA2F;SAC9F;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,8CAA8C;gBACzD,oGAAoG;gBACpG,uFAAuF;gBACvF,qFAAqF;gBACrF,2FAA2F;gBAC3F,yDAAyD;YAC3D,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,8GAA8G;YAChH,gBAAgB,EACd,kDAAkD;gBAClD,qHAAqH;gBACrH,yHAAyH;YAC3H,eAAe,EACb,uHAAuH;YACzH,cAAc,EACZ,oGAAoG;SACvG;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAU;IACxD,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,kDAAkD;gBAC7D,sGAAsG;gBACtG,yGAAyG;gBACzG,6GAA6G;gBAC7G,+DAA+D;gBAC/D,6DAA6D;YAC/D,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,sFAAsF;gBACtF,sFAAsF;YACxF,gBAAgB,EACd,qFAAqF;gBACrF,2GAA2G;gBAC3G,uDAAuD;gBACvD,yEAAyE;YAC3E,eAAe,EACb,mHAAmH;YACrH,cAAc,EACZ,2GAA2G;SAC9G;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,wCAAwC;gBACnD,8GAA8G;gBAC9G,0CAA0C;gBAC1C,+EAA+E;gBAC/E,kFAAkF;YACpF,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,8FAA8F;gBAC9F,wDAAwD;YAC1D,gBAAgB,EACd,wEAAwE;gBACxE,2FAA2F;gBAC3F,8CAA8C;YAChD,eAAe,EACb,4FAA4F;YAC9F,cAAc,EACZ,4HAA4H;SAC/H;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.d.ts

@@ -0,0 +1,14 @@
+import type { FailureScenario, Spec } from '../../types/index.js';
+/**
+ * Generate rate limit bypass challenge scenarios.
+ */
+export declare function generateRateLimitBypassScenarios(spec: Spec): FailureScenario[];
+/**
+ * Generate concurrency model-specific challenge scenarios.
+ */
+export declare function generateConcurrencyScenarios(spec: Spec, concurrencyModel: string): FailureScenario[];
+/**
+ * Generate distributed saga failure scenarios.
+ */
+export declare function generateSagaFailureScenarios(spec: Spec): FailureScenario[];
+//# sourceMappingURL=resilience-challenge-scenarios-b.d.ts.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-b.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-b.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAElE;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CAsB9E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA8HnB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CA0B1E"}