specforge-mcp 0.1.0

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.js

@@ -0,0 +1,199 @@
+// tools/challenge-spec/resilience-challenge-scenarios-a.ts — SPEC-034
+// Signal detectors + validation boundary + cascade failure scenarios
+// Keywords indicating external service calls or shared state
+export const EXTERNAL_CALL_KEYWORDS = [
+    'api',
+    'http',
+    'fetch',
+    'request',
+    'endpoint',
+    'service',
+    'downstream',
+    'external',
+    'grpc',
+    'webhook',
+    'integration',
+    'client',
+    'sdk',
+];
+export const VALIDATION_KEYWORDS = [
+    'input',
+    'form',
+    'body',
+    'payload',
+    'request',
+    'submit',
+    'create',
+    'update',
+    'post',
+    'put',
+    'patch',
+    'validate',
+    'schema',
+    'endpoint',
+];
+export const RATE_LIMIT_KEYWORDS = [
+    'login',
+    'auth',
+    'register',
+    'public',
+    'api',
+    'bulk',
+    'export',
+    'import',
+];
+export const CONCURRENCY_KEYWORDS = [
+    'counter',
+    'cache',
+    'session',
+    'pool',
+    'shared',
+    'concurrent',
+    'parallel',
+    'queue',
+    'lock',
+    'mutex',
+    'atomic',
+    'thread',
+];
+export const SAGA_KEYWORDS = [
+    'distributed',
+    'saga',
+    'multi-step',
+    'compensat',
+    'rollback',
+    'orchestrat',
+    'choreograph',
+    'transaction',
+];
+/**
+ * Returns true when the spec describes an external service call.
+ */
+export function hasExternalCallSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return EXTERNAL_CALL_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec describes input validation.
+ */
+export function hasValidationSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return VALIDATION_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec is a rate-limit-sensitive endpoint.
+ */
+export function hasRateLimitSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return RATE_LIMIT_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec involves shared state.
+ */
+export function hasConcurrencySignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return CONCURRENCY_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Returns true when the spec describes a distributed saga.
+ */
+export function hasSagaSignal(spec, specContent) {
+    const lower = `${spec.title} ${spec.tags.join(' ')} ${specContent}`.toLowerCase();
+    return SAGA_KEYWORDS.some((kw) => lower.includes(kw));
+}
+/**
+ * Generate validation boundary challenge scenarios.
+ */
+export function generateValidationBoundaryScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Validation Boundary — String Fields: ` +
+                'What happens when a required string field receives: (a) empty string "", (b) null, (c) field absent from body entirely, ' +
+                '(d) string with only whitespace "   ", (e) Unicode multibyte string (emoji) that exceeds maxLength if the library counts bytes instead of codepoints? ' +
+                'Are all three cases (absent vs null vs empty) handled with distinct error codes?',
+            probability: 'high',
+            impact: 'high',
+            currentHandling: 'Validation may treat empty and null as equivalent, or silently pass absent fields as undefined without failing required checks.',
+            requiredHandling: 'Define explicit behavior for each case in the validation schema. ' +
+                'Empty string "" → 400 if field is required. ' +
+                'null → 400 if field is non-nullable. ' +
+                'Absent field → 400 if field is required. ' +
+                'Whitespace-only → trim and validate length after trimming. ' +
+                'Unicode: use character/codepoint counting, not byte length.',
+            dataConsistency: 'Accepting empty strings as valid inputs leads to records with meaningless values polluting the database.',
+            userExperience: 'Clear per-field error messages with the specific constraint violated improve form UX significantly.',
+        },
+        {
+            scenario: `[${spec.id}] Validation Boundary — Numeric Fields: ` +
+                'What happens when a numeric field receives: (a) value exactly at min boundary (e.g., min=0 → test with -1, 0, 1), ' +
+                '(b) value exactly at max boundary, (c) NaN, (d) Infinity or -Infinity, ' +
+                '(e) number sent as string "42" — does the library coerce or reject?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Boundary conditions (exactly at min/max) are often omitted from tests, leading to off-by-one bugs in production.',
+            requiredHandling: 'Test all boundary values explicitly: min-1 (fail), min (pass), max (pass), max+1 (fail). ' +
+                'NaN and Infinity must be rejected with 400, not passed through. ' +
+                'Coercion policy must be explicit: either always reject type mismatches or always coerce with documented behavior.',
+            dataConsistency: 'NaN or Infinity stored in numeric columns causes silent corruption or runtime exceptions.',
+            userExperience: 'Off-by-one errors in validation create confusing UX where users cannot submit valid data.',
+        },
+        {
+            scenario: `[${spec.id}] Validation Security — Injection Payloads: ` +
+                'Does the validation layer handle security-relevant strings without crashing or leaking internals? ' +
+                "Test with: SQL injection ('; DROP TABLE users; --), XSS (<script>alert(1)</script>), " +
+                'path traversal (../../etc/passwd), null bytes (\\0), template injection ({{7*7}}). ' +
+                'Validation is not the primary defense (that is parameterized queries / output encoding), ' +
+                'but it must not crash and must not expose stack traces.',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Injection payloads may cause unhandled exceptions in validation middleware, exposing internal error details.',
+            requiredHandling: 'All string inputs must be treated as untrusted. ' +
+                'Validation rejects malformed types; sanitization and parameterized queries handle injection prevention downstream. ' +
+                'Error responses must never include the rejected payload or stack trace — return sanitized field name + constraint only.',
+            dataConsistency: 'If injection payloads reach the database layer (even as errors), they can leak schema information via error messages.',
+            userExperience: 'Stack traces exposed in 400 responses are a security vulnerability — use opaque error IDs instead.',
+        },
+    ];
+}
+/**
+ * Generate cascade failure challenge scenarios.
+ */
+export function generateCascadeFailureScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Cascade Failure — Connection Pool Exhaustion: ` +
+                'If the external service starts responding in 30 seconds (OS timeout) instead of the expected 200ms, ' +
+                'how many simultaneous requests accumulate in the connection pool before the circuit breaker activates? ' +
+                'If the pool has size N and each request holds a connection for T seconds, the pool fills in N * T seconds. ' +
+                'Calculate this with the actual pool size and timeout values. ' +
+                'Does the circuit breaker open before the pool is exhausted?',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Without a circuit breaker, slow external services cause connection pool exhaustion, ' +
+                'blocking all requests to this service (not just those calling the external service).',
+            requiredHandling: 'Set connect_timeout (2s) and read_timeout (10s) — never rely on OS timeout (30s+). ' +
+                'Circuit breaker must open before pool exhaustion: threshold 50% failures in 10 calls, open duration 60s. ' +
+                'When pool is at 80% capacity, emit a warning metric. ' +
+                'When circuit is open, return 503 immediately without touching the pool.',
+            dataConsistency: 'Pool exhaustion can cascade: if this service pool is exhausted, callers of this service also accumulate requests.',
+            userExperience: 'Without fast-fail (circuit open), users wait for OS timeout (30s) instead of receiving a 503 in under 1s.',
+        },
+        {
+            scenario: `[${spec.id}] Resilience — Retry Thundering Herd: ` +
+                'If the external service recovers after a 60-second outage and the circuit breaker transitions to HALF-OPEN, ' +
+                'all queued retries fire simultaneously. ' +
+                'Does the retry strategy use jitter (random delay offset) to spread the load, ' +
+                'or do all retries hit the recovering service at the same time (thundering herd)?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Retry without jitter causes thundering herd: all retries fire simultaneously after backoff, ' +
+                'potentially re-overloading the service as it recovers.',
+            requiredHandling: 'Exponential backoff with jitter: delay = random(0, base * 2^attempt). ' +
+                'In HALF-OPEN state: limit to 1-3 probe requests, not all queued requests simultaneously. ' +
+                'If probes succeed, circuit closes gradually.',
+            dataConsistency: 'Thundering herd can cause the recovering service to fail again immediately after recovery.',
+            userExperience: 'Jitter is invisible to the user but prevents the oscillation pattern where the service flaps between healthy and degraded.',
+        },
+    ];
+}
+//# sourceMappingURL=resilience-challenge-scenarios-a.js.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-a.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-a.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-a.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,qEAAqE;AAIrE,6DAA6D;AAC7D,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,KAAK;IACL,MAAM;IACN,OAAO;IACP,SAAS;IACT,UAAU;IACV,SAAS;IACT,YAAY;IACZ,UAAU;IACV,MAAM;IACN,SAAS;IACT,aAAa;IACb,QAAQ;IACR,KAAK;CACN,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,MAAM;IACN,MAAM;IACN,SAAS;IACT,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,MAAM;IACN,KAAK;IACL,OAAO;IACP,UAAU;IACV,QAAQ;IACR,UAAU;CACX,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,OAAO;IACP,MAAM;IACN,UAAU;IACV,QAAQ;IACR,KAAK;IACL,MAAM;IACN,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,SAAS;IACT,OAAO;IACP,SAAS;IACT,MAAM;IACN,QAAQ;IACR,YAAY;IACZ,UAAU;IACV,OAAO;IACP,MAAM;IACN,OAAO;IACP,QAAQ;IACR,QAAQ;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa;IACb,MAAM;IACN,YAAY;IACZ,WAAW;IACX,UAAU;IACV,YAAY;IACZ,aAAa;IACb,aAAa;CACd,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAU,EAAE,WAAmB;IACnE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAU,EAAE,WAAmB;IACjE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAU,EAAE,WAAmB;IAChE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAU,EAAE,WAAmB;IAClE,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,aAAa,CAAC,IAAU,EAAE,WAAmB;IAC3D,MAAM,KAAK,GAAG,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAClF,OAAO,aAAa,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mCAAmC,CAAC,IAAU;IAC5D,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,yCAAyC;gBACpD,0HAA0H;gBAC1H,wJAAwJ;gBACxJ,kFAAkF;YACpF,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,iIAAiI;YACnI,gBAAgB,EACd,mEAAmE;gBACnE,8CAA8C;gBAC9C,uCAAuC;gBACvC,2CAA2C;gBAC3C,6DAA6D;gBAC7D,6DAA6D;YAC/D,eAAe,EACb,0GAA0G;YAC5G,cAAc,EACZ,qGAAqG;SACxG;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,0CAA0C;gBACrD,oHAAoH;gBACpH,yEAAyE;gBACzE,qEAAqE;YACvE,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,kHAAkH;YACpH,gBAAgB,EACd,2FAA2F;gBAC3F,kEAAkE;gBAClE,mHAAmH;YACrH,eAAe,EACb,2FAA2F;YAC7F,cAAc,EACZ,2FAA2F;SAC9F;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,8CAA8C;gBACzD,oGAAoG;gBACpG,uFAAuF;gBACvF,qFAAqF;gBACrF,2FAA2F;gBAC3F,yDAAyD;YAC3D,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,8GAA8G;YAChH,gBAAgB,EACd,kDAAkD;gBAClD,qHAAqH;gBACrH,yHAAyH;YAC3H,eAAe,EACb,uHAAuH;YACzH,cAAc,EACZ,oGAAoG;SACvG;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAU;IACxD,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,kDAAkD;gBAC7D,sGAAsG;gBACtG,yGAAyG;gBACzG,6GAA6G;gBAC7G,+DAA+D;gBAC/D,6DAA6D;YAC/D,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,sFAAsF;gBACtF,sFAAsF;YACxF,gBAAgB,EACd,qFAAqF;gBACrF,2GAA2G;gBAC3G,uDAAuD;gBACvD,yEAAyE;YAC3E,eAAe,EACb,mHAAmH;YACrH,cAAc,EACZ,2GAA2G;SAC9G;QACD;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,wCAAwC;gBACnD,8GAA8G;gBAC9G,0CAA0C;gBAC1C,+EAA+E;gBAC/E,kFAAkF;YACpF,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,8FAA8F;gBAC9F,wDAAwD;YAC1D,gBAAgB,EACd,wEAAwE;gBACxE,2FAA2F;gBAC3F,8CAA8C;YAChD,eAAe,EACb,4FAA4F;YAC9F,cAAc,EACZ,4HAA4H;SAC/H;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.d.ts

@@ -0,0 +1,14 @@
+import type { FailureScenario, Spec } from '../../types/index.js';
+/**
+ * Generate rate limit bypass challenge scenarios.
+ */
+export declare function generateRateLimitBypassScenarios(spec: Spec): FailureScenario[];
+/**
+ * Generate concurrency model-specific challenge scenarios.
+ */
+export declare function generateConcurrencyScenarios(spec: Spec, concurrencyModel: string): FailureScenario[];
+/**
+ * Generate distributed saga failure scenarios.
+ */
+export declare function generateSagaFailureScenarios(spec: Spec): FailureScenario[];
+//# sourceMappingURL=resilience-challenge-scenarios-b.d.ts.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-b.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-b.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAElE;;GAEG;AACH,wBAAgB,gCAAgC,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CAsB9E;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,IAAI,EACV,gBAAgB,EAAE,MAAM,GACvB,eAAe,EAAE,CA8HnB;AAED;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,IAAI,GAAG,eAAe,EAAE,CA0B1E"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.js

@@ -0,0 +1,149 @@
+// tools/challenge-spec/resilience-challenge-scenarios-b.ts — SPEC-034
+// Rate limit bypass + concurrency model-specific + distributed saga scenarios
+/**
+ * Generate rate limit bypass challenge scenarios.
+ */
+export function generateRateLimitBypassScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Rate Limit Bypass — Distributed Attack: ` +
+                'The rate limit is configured per-IP. An attacker uses 1000 different IPs (botnet or distributed scraper) ' +
+                'to bypass the per-IP limit. What is the effective global rate of requests the system receives? ' +
+                'Does the system have any IP-independent rate limiting (per-account, global circuit breaker) to handle this?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Per-IP rate limiting is ineffective against distributed attacks — an attacker with 1000 IPs gets 1000x the per-IP limit.',
+            requiredHandling: 'Layer rate limits: per-IP (coarse), per-account/API-key (fine-grained), and global per-endpoint. ' +
+                'For authentication endpoints: per-account lockout after N failed attempts (regardless of source IP). ' +
+                'Use Redis-backed distributed rate limiting for consistency across multiple instances.',
+            dataConsistency: 'In-memory rate limiting (local to one instance) allows the effective limit to be multiplied by the number of instances.',
+            userExperience: 'Rate limit responses must include Retry-After header so legitimate clients can back off gracefully.',
+        },
+    ];
+}
+/**
+ * Generate concurrency model-specific challenge scenarios.
+ */
+export function generateConcurrencyScenarios(spec, concurrencyModel) {
+    const modelScenarios = {
+        goroutines: {
+            scenario: `[${spec.id}] Concurrency — Go Race Condition: ` +
+                'If this feature reads and writes shared state (counter, map, cache) from multiple goroutines simultaneously, ' +
+                'is the access protected by sync.Mutex, sync.RWMutex, or sync/atomic? ' +
+                'Run with `go test -race` to verify. ' +
+                'A map accessed concurrently without a lock is undefined behavior in Go (runtime panic possible).',
+            probability: 'high',
+            impact: 'critical',
+            currentHandling: 'Without mutex protection, concurrent map writes in Go cause a runtime panic or silent data corruption.',
+            requiredHandling: 'Use sync.RWMutex for read-heavy maps (multiple concurrent reads, exclusive writes). ' +
+                'Use sync/atomic for simple counters. ' +
+                'Always run `go test -race ./...` in CI to detect race conditions before production.',
+            dataConsistency: 'Race conditions on shared state lead to inconsistent reads and corrupted writes that are hard to reproduce.',
+            userExperience: 'A runtime panic from a race condition kills the entire goroutine group, causing an unexpected 500.',
+        },
+        'async-await': {
+            scenario: `[${spec.id}] Concurrency — Event Loop Blocking: ` +
+                'Does this feature perform any synchronous CPU-intensive or I/O-blocking operation inside an async function? ' +
+                'Examples: JSON.parse on large payloads (> 1MB), crypto operations (bcrypt without async), ' +
+                'RegExp with catastrophic backtracking. ' +
+                'These block the single-threaded event loop and degrade ALL concurrent requests, not just this one.',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Synchronous operations inside async handlers block the Node.js event loop, causing latency spikes for all concurrent requests.',
+            requiredHandling: 'Move CPU-intensive operations to worker threads (worker_threads module). ' +
+                'Use async crypto APIs (bcrypt.hash not bcrypt.hashSync). ' +
+                'Test with clinic.js or --inspect + async_hooks to identify event loop blocking before production.',
+            dataConsistency: 'No data consistency impact — performance issue only.',
+            userExperience: 'Event loop blocking causes P99 latency spikes that affect all users, not just those using the slow feature.',
+        },
+        'threads-locks': {
+            scenario: `[${spec.id}] Concurrency — Deadlock Risk: ` +
+                'If this feature acquires multiple locks (e.g., lock on resource A, then lock on resource B), ' +
+                'is there another code path that acquires the same locks in the opposite order (B first, then A)? ' +
+                'This is the classic deadlock condition. ' +
+                'Test by running the two paths simultaneously with a short sleep between lock acquisitions.',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Inconsistent lock ordering causes deadlocks that hang threads indefinitely, eventually exhausting the thread pool.',
+            requiredHandling: 'Establish a canonical lock ordering (always A before B, never B before A). Document this ordering. ' +
+                'Use tryLock(timeout) in tests to detect deadlocks: if the lock is not acquired in N seconds, the test fails. ' +
+                'Consider using ReentrantLock over synchronized blocks for more control.',
+            dataConsistency: 'Deadlocked threads hold locks, preventing other threads from accessing the protected resources.',
+            userExperience: 'A deadlock causes the request to hang until the timeout is reached, resulting in a 503 or 504 for the user.',
+        },
+        'rust-ownership': {
+            scenario: `[${spec.id}] Concurrency — Rust Logical Deadlock: ` +
+                'Rust prevents data races at compile time via the borrow checker. ' +
+                'However, logical deadlocks (two async tasks waiting for each other via Mutex or channel) are still possible at runtime. ' +
+                'If this feature acquires Arc<Mutex<T>> guards in multiple futures, is the acquisition order consistent? ' +
+                'The Rust compiler will not catch this — it must be tested with deadlock timeout tests.',
+            probability: 'low',
+            impact: 'high',
+            currentHandling: 'Rust eliminates data races at compile time, but logical deadlocks between async tasks holding Mutex guards are runtime errors.',
+            requiredHandling: 'Use tokio::time::timeout to wrap Mutex acquisitions in async code. ' +
+                'If the lock is not acquired within the timeout, return an error instead of hanging. ' +
+                'Document the lock acquisition order and enforce it via code review.',
+            dataConsistency: 'Deadlocked async tasks hold Mutex guards, blocking other tasks from accessing the protected data.',
+            userExperience: 'Logical deadlocks in Rust async code cause requests to timeout rather than return an error — prefer explicit timeout.',
+        },
+        'actor-model': {
+            scenario: `[${spec.id}] Concurrency — Mailbox Overflow: ` +
+                'If the producer sends messages to this actor faster than the actor processes them, ' +
+                'the mailbox grows unboundedly. ' +
+                'What is the configured mailbox size limit? What happens when the limit is reached: ' +
+                'back-pressure (producer blocks), message drop (with which strategy), or unbounded growth (memory risk)?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Unbounded mailboxes cause memory exhaustion under load. Message drops without metrics cause silent data loss.',
+            requiredHandling: 'Configure a bounded mailbox with a drop strategy (drop-oldest or drop-newest). ' +
+                'Emit a metric when mailbox exceeds 80% capacity. ' +
+                'Consider back-pressure: if the producer is too fast, slow it down at the source instead of dropping at the destination.',
+            dataConsistency: 'Dropped messages cause data loss that is not recoverable without event sourcing or DLQ.',
+            userExperience: 'Mailbox overflow is invisible to users until they notice missing data or failed operations.',
+        },
+        'reactive-streams': {
+            scenario: `[${spec.id}] Concurrency — Backpressure Strategy: ` +
+                'This spec uses a reactive stream. If the publisher emits faster than the subscriber processes, ' +
+                'what backpressure strategy is in use? ' +
+                'BUFFER (memory risk), DROP (data loss), ERROR (stream terminates), LATEST (only last value), or MISSING (unbounded)? ' +
+                'The strategy must match the business requirements: can messages be dropped or is each one required?',
+            probability: 'medium',
+            impact: 'high',
+            currentHandling: 'Without explicit backpressure strategy, fast publishers overflow the subscriber buffer, causing OutOfMemoryError or silent drops.',
+            requiredHandling: 'Choose the backpressure strategy explicitly based on business requirements. ' +
+                'For critical events: use ERROR or bounded BUFFER to prevent loss. ' +
+                'For metrics/logging: DROP or LATEST is acceptable. ' +
+                'Test with a producer that emits 10x faster than the subscriber to verify the strategy holds.',
+            dataConsistency: 'Backpressure strategy determines whether data loss is acceptable or whether the stream must be slowed down.',
+            userExperience: 'Backpressure overflow can cause request failures for the publisher, which surfaces as 503 or timeout.',
+        },
+    };
+    const scenario = modelScenarios[concurrencyModel];
+    return scenario ? [scenario] : [];
+}
+/**
+ * Generate distributed saga failure scenarios.
+ */
+export function generateSagaFailureScenarios(spec) {
+    return [
+        {
+            scenario: `[${spec.id}] Distributed Saga — Partial Failure at Step N: ` +
+                'If step 3 of 5 in the saga fails after steps 1 and 2 already executed in external services, ' +
+                'how long do the compensation events (rollback for steps 1 and 2) take to complete? ' +
+                'How is it verified that the system is in a consistent state after compensation, ' +
+                'rather than in a partially-reverted state (step 1 rolled back but step 2 not yet)?',
+            probability: 'medium',
+            impact: 'critical',
+            currentHandling: 'Partial saga failures without compensation leave the system in an inconsistent state ' +
+                '(some external services have committed while others have not).',
+            requiredHandling: 'Each saga step must have a defined compensation operation. ' +
+                'Compensation must be idempotent (can be retried safely). ' +
+                'Track saga state in a durable store: if the orchestrator crashes mid-saga, it must resume from the last known state. ' +
+                'Add a saga status endpoint: GET /sagas/{id} returns the current step, status, and any failed compensations.',
+            dataConsistency: 'Partial compensation leaves distributed state inconsistent. The saga log must be the source of truth for rollback status.',
+            userExperience: 'Users must receive a clear error explaining that the operation was rolled back and what state the system is in. ' +
+                'If rollback also failed, the user must be told that manual resolution is required.',
+        },
+    ];
+}
+//# sourceMappingURL=resilience-challenge-scenarios-b.js.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios-b.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios-b.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios-b.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,8EAA8E;AAI9E;;GAEG;AACH,MAAM,UAAU,gCAAgC,CAAC,IAAU;IACzD,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,4CAA4C;gBACvD,2GAA2G;gBAC3G,iGAAiG;gBACjG,6GAA6G;YAC/G,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,0HAA0H;YAC5H,gBAAgB,EACd,mGAAmG;gBACnG,uGAAuG;gBACvG,uFAAuF;YACzF,eAAe,EACb,yHAAyH;YAC3H,cAAc,EACZ,qGAAqG;SACxG;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,IAAU,EACV,gBAAwB;IAExB,MAAM,cAAc,GAAoC;QACtD,UAAU,EAAE;YACV,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,qCAAqC;gBAChD,+GAA+G;gBAC/G,uEAAuE;gBACvE,sCAAsC;gBACtC,kGAAkG;YACpG,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,wGAAwG;YAC1G,gBAAgB,EACd,sFAAsF;gBACtF,uCAAuC;gBACvC,qFAAqF;YACvF,eAAe,EACb,6GAA6G;YAC/G,cAAc,EACZ,oGAAoG;SACvG;QACD,aAAa,EAAE;YACb,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,uCAAuC;gBAClD,8GAA8G;gBAC9G,4FAA4F;gBAC5F,yCAAyC;gBACzC,oGAAoG;YACtG,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,gIAAgI;YAClI,gBAAgB,EACd,2EAA2E;gBAC3E,2DAA2D;gBAC3D,mGAAmG;YACrG,eAAe,EAAE,sDAAsD;YACvE,cAAc,EACZ,6GAA6G;SAChH;QACD,eAAe,EAAE;YACf,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,iCAAiC;gBAC5C,+FAA+F;gBAC/F,mGAAmG;gBACnG,0CAA0C;gBAC1C,4FAA4F;YAC9F,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,oHAAoH;YACtH,gBAAgB,EACd,qGAAqG;gBACrG,+GAA+G;gBAC/G,yEAAyE;YAC3E,eAAe,EACb,iGAAiG;YACnG,cAAc,EACZ,6GAA6G;SAChH;QACD,gBAAgB,EAAE;YAChB,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,yCAAyC;gBACpD,mEAAmE;gBACnE,0HAA0H;gBAC1H,0GAA0G;gBAC1G,wFAAwF;YAC1F,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,gIAAgI;YAClI,gBAAgB,EACd,qEAAqE;gBACrE,sFAAsF;gBACtF,qEAAqE;YACvE,eAAe,EACb,mGAAmG;YACrG,cAAc,EACZ,uHAAuH;SAC1H;QACD,aAAa,EAAE;YACb,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,oCAAoC;gBAC/C,qFAAqF;gBACrF,iCAAiC;gBACjC,qFAAqF;gBACrF,yGAAyG;YAC3G,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,+GAA+G;YACjH,gBAAgB,EACd,iFAAiF;gBACjF,mDAAmD;gBACnD,yHAAyH;YAC3H,eAAe,EACb,yFAAyF;YAC3F,cAAc,EACZ,6FAA6F;SAChG;QACD,kBAAkB,EAAE;YAClB,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,yCAAyC;gBACpD,iGAAiG;gBACjG,wCAAwC;gBACxC,uHAAuH;gBACvH,qGAAqG;YACvG,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,MAAM;YACd,eAAe,EACb,mIAAmI;YACrI,gBAAgB,EACd,8EAA8E;gBAC9E,oEAAoE;gBACpE,qDAAqD;gBACrD,8FAA8F;YAChG,eAAe,EACb,6GAA6G;YAC/G,cAAc,EACZ,uGAAuG;SAC1G;KACF,CAAC;IAEF,MAAM,QAAQ,GAAG,cAAc,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAU;IACrD,OAAO;QACL;YACE,QAAQ,EACN,IAAI,IAAI,CAAC,EAAE,kDAAkD;gBAC7D,8FAA8F;gBAC9F,qFAAqF;gBACrF,kFAAkF;gBAClF,oFAAoF;YACtF,WAAW,EAAE,QAAQ;YACrB,MAAM,EAAE,UAAU;YAClB,eAAe,EACb,uFAAuF;gBACvF,gEAAgE;YAClE,gBAAgB,EACd,6DAA6D;gBAC7D,2DAA2D;gBAC3D,uHAAuH;gBACvH,6GAA6G;YAC/G,eAAe,EACb,2HAA2H;YAC7H,cAAc,EACZ,kHAAkH;gBAClH,oFAAoF;SACvF;KACF,CAAC;AACJ,CAAC"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios.d.ts

@@ -0,0 +1,8 @@
+import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+export { EXTERNAL_CALL_KEYWORDS, VALIDATION_KEYWORDS, RATE_LIMIT_KEYWORDS, CONCURRENCY_KEYWORDS, SAGA_KEYWORDS, hasExternalCallSignal, hasValidationSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
+export { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
+/**
+ * Main entry: generate all SPEC-034 resilience/concurrency challenges for a spec.
+ */
+export declare function generateResilienceChallengeScenarios(spec: Spec, specContent: string, knowledge: ProjectKnowledge): FailureScenario[];
+//# sourceMappingURL=resilience-challenge-scenarios.d.ts.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAgBpF,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C;;GAEG;AACH,wBAAgB,oCAAoC,CAClD,IAAI,EAAE,IAAI,EACV,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,gBAAgB,GAC1B,eAAe,EAAE,CA2BnB"}

package/dist/tools/challenge-spec/resilience-challenge-scenarios.js

@@ -0,0 +1,32 @@
+// tools/challenge-spec/resilience-challenge-scenarios.ts — SPEC-034
+// Barrel re-export for resilience/concurrency challenge scenarios.
+// Signal detectors + validation + cascade: resilience-challenge-scenarios-a.ts
+// Rate limit + concurrency + saga: resilience-challenge-scenarios-b.ts
+import { hasValidationSignal, hasExternalCallSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
+import { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
+export { EXTERNAL_CALL_KEYWORDS, VALIDATION_KEYWORDS, RATE_LIMIT_KEYWORDS, CONCURRENCY_KEYWORDS, SAGA_KEYWORDS, hasExternalCallSignal, hasValidationSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
+export { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
+/**
+ * Main entry: generate all SPEC-034 resilience/concurrency challenges for a spec.
+ */
+export function generateResilienceChallengeScenarios(spec, specContent, knowledge) {
+    const scenarios = [];
+    if (hasValidationSignal(spec, specContent)) {
+        scenarios.push(...generateValidationBoundaryScenarios(spec));
+    }
+    if (hasExternalCallSignal(spec, specContent)) {
+        scenarios.push(...generateCascadeFailureScenarios(spec));
+    }
+    if (hasRateLimitSignal(spec, specContent)) {
+        scenarios.push(...generateRateLimitBypassScenarios(spec));
+    }
+    if (hasConcurrencySignal(spec, specContent)) {
+        const concurrencyModel = knowledge.concurrencyModel;
+        scenarios.push(...generateConcurrencyScenarios(spec, concurrencyModel ?? 'unknown'));
+    }
+    if (hasSagaSignal(spec, specContent)) {
+        scenarios.push(...generateSagaFailureScenarios(spec));
+    }
+    return scenarios;
+}
+//# sourceMappingURL=resilience-challenge-scenarios.js.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resilience-challenge-scenarios.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/resilience-challenge-scenarios.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,mEAAmE;AACnE,+EAA+E;AAC/E,uEAAuE;AAGvE,OAAO,EACL,mBAAmB,EACnB,qBAAqB,EACrB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAC/C,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,sBAAsB,EACtB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,aAAa,EACb,qBAAqB,EACrB,mBAAmB,EACnB,kBAAkB,EAClB,oBAAoB,EACpB,aAAa,EACb,mCAAmC,EACnC,+BAA+B,GAChC,MAAM,uCAAuC,CAAC;AAE/C,OAAO,EACL,gCAAgC,EAChC,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,uCAAuC,CAAC;AAE/C;;GAEG;AACH,MAAM,UAAU,oCAAoC,CAClD,IAAU,EACV,WAAmB,EACnB,SAA2B;IAE3B,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,IAAI,mBAAmB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAC3C,SAAS,CAAC,IAAI,CAAC,GAAG,mCAAmC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC/D,CAAC;IAED,IAAI,qBAAqB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAC7C,SAAS,CAAC,IAAI,CAAC,GAAG,+BAA+B,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,IAAI,kBAAkB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAC1C,SAAS,CAAC,IAAI,CAAC,GAAG,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,IAAI,oBAAoB,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QAC5C,MAAM,gBAAgB,GAAI,SAAgD,CAAC,gBAE9D,CAAC;QACd,SAAS,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,IAAI,EAAE,gBAAgB,IAAI,SAAS,CAAC,CAAC,CAAC;IACvF,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,EAAE,WAAW,CAAC,EAAE,CAAC;QACrC,SAAS,CAAC,IAAI,CAAC,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/challenge-spec/scenarios-data.d.ts

@@ -0,0 +1,3 @@
+import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+export declare function generateDataConsistencyScenarios(_spec: Spec, content: string, _knowledge: ProjectKnowledge): FailureScenario[];
+//# sourceMappingURL=scenarios-data.d.ts.map

package/dist/tools/challenge-spec/scenarios-data.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios-data.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/scenarios-data.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,wBAAgB,gCAAgC,CAC9C,KAAK,EAAE,IAAI,EACX,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,gBAAgB,GAC3B,eAAe,EAAE,CA0DnB"}

package/dist/tools/challenge-spec/scenarios-data.js

@@ -0,0 +1,52 @@
+// tools/challenge-spec/scenarios-data.ts — Data consistency and partial write scenarios
+import { contentMentions } from './scenarios-utils.js';
+export function generateDataConsistencyScenarios(_spec, content, _knowledge) {
+    const scenarios = [];
+    const lower = content.toLowerCase();
+    // Partial writes
+    if (lower.includes('transaction') ||
+        lower.includes('update') ||
+        lower.includes('create') ||
+        lower.includes('modify') ||
+        lower.includes('save')) {
+        scenarios.push({
+            scenario: 'Partial write: server crashes mid-transaction',
+            probability: 'low',
+            impact: 'critical',
+            currentHandling: contentMentions(lower, ['transaction', 'atomic', 'rollback'])
+                ? 'Transactions mentioned'
+                : 'Not addressed',
+            requiredHandling: 'Wrap multi-step writes in database transactions. Implement saga pattern for distributed operations.',
+            dataConsistency: 'ACID properties must be maintained. No orphaned records.',
+            userExperience: 'Transparent: user sees either success or clean failure with clear error message.',
+        });
+    }
+    // Stale data
+    if (lower.includes('cache') || lower.includes('real-time') || lower.includes('concurrent')) {
+        scenarios.push({
+            scenario: 'Stale data served from cache after underlying data changes',
+            probability: 'high',
+            impact: 'medium',
+            currentHandling: contentMentions(lower, ['invalidat', 'ttl', 'websocket', 'real-time'])
+                ? 'Some cache strategy mentioned'
+                : 'Not addressed',
+            requiredHandling: 'Implement cache invalidation on writes. Use TTL for time-sensitive data. Consider event-driven invalidation.',
+            dataConsistency: 'Define acceptable staleness window per data type. Document cache strategy.',
+            userExperience: 'Show "last updated" timestamp. Offer manual refresh option.',
+        });
+    }
+    // Duplicate operations
+    scenarios.push({
+        scenario: 'User double-clicks submit, causing duplicate records',
+        probability: 'high',
+        impact: 'medium',
+        currentHandling: contentMentions(lower, ['idempoten', 'debounce', 'disable', 'lock'])
+            ? 'Some prevention mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Implement idempotency keys for mutations. Disable submit button on click. Use unique constraints in DB.',
+        dataConsistency: 'No duplicate records from repeated submissions.',
+        userExperience: 'Button disabled during submission. Clear success/error feedback.',
+    });
+    return scenarios;
+}
+//# sourceMappingURL=scenarios-data.js.map

package/dist/tools/challenge-spec/scenarios-data.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios-data.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/scenarios-data.ts"],"names":[],"mappings":"AAAA,wFAAwF;AAGxF,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,UAAU,gCAAgC,CAC9C,KAAW,EACX,OAAe,EACf,UAA4B;IAE5B,MAAM,SAAS,GAAsB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAEpC,iBAAiB;IACjB,IACE,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC;QAC7B,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxB,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,EACtB,CAAC;QACD,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,+CAA+C;YACzD,WAAW,EAAE,KAAK;YAClB,MAAM,EAAE,UAAU;YAClB,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,aAAa,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC5E,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,eAAe;YACnB,gBAAgB,EACd,qGAAqG;YACvG,eAAe,EAAE,0DAA0D;YAC3E,cAAc,EACZ,kFAAkF;SACrF,CAAC,CAAC;IACL,CAAC;IAED,aAAa;IACb,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;QAC3F,SAAS,CAAC,IAAI,CAAC;YACb,QAAQ,EAAE,4DAA4D;YACtE,WAAW,EAAE,MAAM;YACnB,MAAM,EAAE,QAAQ;YAChB,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;gBACrF,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,eAAe;YACnB,gBAAgB,EACd,8GAA8G;YAChH,eAAe,EAAE,4EAA4E;YAC7F,cAAc,EAAE,6DAA6D;SAC9E,CAAC,CAAC;IACL,CAAC;IAED,uBAAuB;IACvB,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,sDAAsD;QAChE,WAAW,EAAE,MAAM;QACnB,MAAM,EAAE,QAAQ;QAChB,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;YACnF,CAAC,CAAC,2BAA2B;YAC7B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,yGAAyG;QAC3G,eAAe,EAAE,iDAAiD;QAClE,cAAc,EAAE,kEAAkE;KACnF,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/challenge-spec/scenarios-desktop.d.ts

@@ -0,0 +1,7 @@
+import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+/**
+ * Generate desktop auto-update edge case scenarios.
+ * Covers interrupted download, permission issues, version regression, update during close.
+ */
+export declare function generateDesktopAutoUpdateChallenges(_spec: Spec, specContent: string, knowledge: ProjectKnowledge): FailureScenario[];
+//# sourceMappingURL=scenarios-desktop.d.ts.map

package/dist/tools/challenge-spec/scenarios-desktop.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios-desktop.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/scenarios-desktop.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF;;;GAGG;AACH,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,IAAI,EACX,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,gBAAgB,GAC1B,eAAe,EAAE,CAiGnB"}

package/dist/tools/challenge-spec/scenarios-desktop.js

@@ -0,0 +1,86 @@
+// tools/challenge-spec/scenarios-desktop.ts — Desktop auto-update edge case scenarios
+// SPEC-014b: interrupted download, permission issues, version regression, update during close.
+import { contentMentions } from './scenarios-utils.js';
+/**
+ * Generate desktop auto-update edge case scenarios.
+ * Covers interrupted download, permission issues, version regression, update during close.
+ */
+export function generateDesktopAutoUpdateChallenges(_spec, specContent, knowledge) {
+    const lower = specContent.toLowerCase();
+    const isDesktop = knowledge.projectCategory === 'desktop' ||
+        contentMentions(lower, ['electron', 'tauri', 'auto-update', 'autoupdate', 'electron-updater']);
+    if (!isDesktop) {
+        return [];
+    }
+    const hasUpdateMention = contentMentions(lower, [
+        'update',
+        'electron-updater',
+        'autoUpdater',
+        'tauri updater',
+    ]);
+    if (!hasUpdateMention) {
+        return [];
+    }
+    const scenarios = [];
+    scenarios.push({
+        scenario: 'User interrupts update download (kills app mid-download)',
+        probability: 'medium',
+        impact: 'medium',
+        currentHandling: contentMentions(lower, ['resume', 'partial', 'checksum'])
+            ? 'Partially addressed in spec'
+            : 'Not addressed in spec',
+        requiredHandling: 'Implement resumable downloads with byte-range HTTP requests. ' +
+            'Store partial download with progress marker. ' +
+            'Verify checksum before applying. ' +
+            'Clean up partial file if user cancels.',
+        dataConsistency: 'Trigger: User force-quits during 40% downloaded update. App must launch normally without applying partial update.',
+        userExperience: 'On next launch, offer to resume download or start fresh. Show clear progress.',
+    });
+    scenarios.push({
+        scenario: 'Installer lacks write permissions (e.g., system-wide install vs user install)',
+        probability: 'medium',
+        impact: 'high',
+        currentHandling: contentMentions(lower, ['permission', 'admin', 'elevation', 'uac'])
+            ? 'Permissions partially addressed'
+            : 'Not addressed',
+        requiredHandling: 'Detect permission level before installing. ' +
+            'Windows: request UAC elevation for system-wide, or use per-user installation path. ' +
+            'macOS: install to ~/Applications if /Applications is read-only. ' +
+            'Linux: use user-local AppImage fallback.',
+        dataConsistency: 'Trigger: App installed in Program Files (requires admin) but updater runs without elevation.',
+        userExperience: 'Show clear error: "Update requires administrator permission. Click here to retry with elevated rights."',
+    });
+    scenarios.push({
+        scenario: 'Server version is older than installed version (rollback scenario)',
+        probability: 'low',
+        impact: 'high',
+        currentHandling: contentMentions(lower, ['version check', 'semver', 'downgrade'])
+            ? 'Version comparison mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Compare semver strictly: server.version <= installed.version → skip update. ' +
+            'Log and report version mismatch to monitoring. ' +
+            'Never downgrade silently. ' +
+            'Add configurable allowDowngrade flag for emergency rollbacks.',
+        dataConsistency: 'Trigger: Rollback deployment pushes v1.0.0 while users have v1.1.0 installed. ' +
+            'Data format may be forward-compatible only.',
+        userExperience: 'Do not notify user about "update" when none is available. Silent version check.',
+    });
+    scenarios.push({
+        scenario: 'User closes app while update is being applied (installer running)',
+        probability: 'medium',
+        impact: 'critical',
+        currentHandling: contentMentions(lower, ['pending', 'restart', 'apply on quit'])
+            ? 'Restart handling mentioned'
+            : 'Not addressed',
+        requiredHandling: 'Defer update application to app quit event. ' +
+            'Use electron-updater `autoUpdater.on("update-downloaded")` → install on quit. ' +
+            'Prevent force-quit during NSIS/MSI installer phase. ' +
+            'On next launch, detect interrupted install and prompt clean reinstall.',
+        dataConsistency: 'Trigger: NSIS installer replaces DLLs while app is writing to local database. ' +
+            'Half-replaced binaries can corrupt user data.',
+        userExperience: 'Show progress overlay during critical install phase. ' +
+            'Offer "Update and Restart Now" vs "Update on Next Launch".',
+    });
+    return scenarios;
+}
+//# sourceMappingURL=scenarios-desktop.js.map

package/dist/tools/challenge-spec/scenarios-desktop.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios-desktop.js","sourceRoot":"","sources":["../../../src/tools/challenge-spec/scenarios-desktop.ts"],"names":[],"mappings":"AAAA,sFAAsF;AACtF,+FAA+F;AAG/F,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD;;;GAGG;AACH,MAAM,UAAU,mCAAmC,CACjD,KAAW,EACX,WAAmB,EACnB,SAA2B;IAE3B,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,SAAS,GACb,SAAS,CAAC,eAAe,KAAK,SAAS;QACvC,eAAe,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,CAAC,CAAC,CAAC;IAEjG,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,gBAAgB,GAAG,eAAe,CAAC,KAAK,EAAE;QAC9C,QAAQ;QACR,kBAAkB;QAClB,aAAa;QACb,eAAe;KAChB,CAAC,CAAC;IACH,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACtB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,0DAA0D;QACpE,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,QAAQ;QAChB,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;YACxE,CAAC,CAAC,6BAA6B;YAC/B,CAAC,CAAC,uBAAuB;QAC3B,gBAAgB,EACd,+DAA+D;YAC/D,+CAA+C;YAC/C,mCAAmC;YACnC,wCAAwC;QAC1C,eAAe,EACb,mHAAmH;QACrH,cAAc,EAAE,+EAA+E;KAChG,CAAC,CAAC;IAEH,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,+EAA+E;QACzF,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,YAAY,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YAClF,CAAC,CAAC,iCAAiC;YACnC,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,6CAA6C;YAC7C,qFAAqF;YACrF,kEAAkE;YAClE,0CAA0C;QAC5C,eAAe,EACb,8FAA8F;QAChG,cAAc,EACZ,yGAAyG;KAC5G,CAAC,CAAC;IAEH,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,oEAAoE;QAC9E,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,MAAM;QACd,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,eAAe,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;YAC/E,CAAC,CAAC,8BAA8B;YAChC,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,8EAA8E;YAC9E,iDAAiD;YACjD,4BAA4B;YAC5B,+DAA+D;QACjE,eAAe,EACb,gFAAgF;YAChF,6CAA6C;QAC/C,cAAc,EACZ,iFAAiF;KACpF,CAAC,CAAC;IAEH,SAAS,CAAC,IAAI,CAAC;QACb,QAAQ,EAAE,mEAAmE;QAC7E,WAAW,EAAE,QAAQ;QACrB,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,eAAe,CAAC,KAAK,EAAE,CAAC,SAAS,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;YAC9E,CAAC,CAAC,4BAA4B;YAC9B,CAAC,CAAC,eAAe;QACnB,gBAAgB,EACd,8CAA8C;YAC9C,gFAAgF;YAChF,sDAAsD;YACtD,wEAAwE;QAC1E,eAAe,EACb,gFAAgF;YAChF,+CAA+C;QACjD,cAAc,EACZ,uDAAuD;YACvD,4DAA4D;KAC/D,CAAC,CAAC;IAEH,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/tools/challenge-spec/scenarios-failure.d.ts

@@ -0,0 +1,3 @@
+import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+export declare function generateFailureScenarios(spec: Spec, content: string, _knowledge: ProjectKnowledge): FailureScenario[];
+//# sourceMappingURL=scenarios-failure.d.ts.map

package/dist/tools/challenge-spec/scenarios-failure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scenarios-failure.d.ts","sourceRoot":"","sources":["../../../src/tools/challenge-spec/scenarios-failure.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGpF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,IAAI,EACV,OAAO,EAAE,MAAM,EACf,UAAU,EAAE,gBAAgB,GAC3B,eAAe,EAAE,CAyHnB"}