@aisdlc/core 1.5.0 → 1.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (8) hide show
  1. package/README.md +4 -1
  2. package/dist/index.cjs +890 -83
  3. package/dist/index.cjs.map +1 -1
  4. package/dist/index.d.cts +99 -6
  5. package/dist/index.d.ts +99 -6
  6. package/dist/index.js +822 -84
  7. package/dist/index.js.map +1 -1
  8. package/package.json +1 -1
package/dist/index.js CHANGED
@@ -2707,6 +2707,175 @@ function syncPdacDigests(options = {}) {
2707
2707
  details
2708
2708
  };
2709
2709
  }
2710
+
2711
+ // src/init/starter-schemas.ts
2712
+ var SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/architecture/adr.schema.json",\r\n "title": "Architecture Decision Record Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "deciders", "decision-date"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^ADR-[0-9]{3,4}(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "architecture-decision-record"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Decision record semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["proposed", "accepted", "rejected", "deprecated", "superseded"]\r\n },\r\n "deciders": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": { "type": "string" }\r\n },\r\n "decision-date": {\r\n "type": "string",\r\n "format": "date"\r\n },\r\n "affects-components": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^ADR-[0-9]{3,4}(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^ADR-[0-9]{3,4}(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2713
+ var SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/architecture/component.schema.json",\r\n "title": "NAF v4 / arc42 Architecture Component Schema (Multilevel)",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "level",\r\n "implementation-type",\r\n "implements-use-cases"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "component"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Architecture component semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["proposed", "accepted", "deprecated", "retired"]\r\n },\r\n "level": {\r\n "type": "integer",\r\n "minimum": 1,\r\n "description": "Hierarchical architecture level (1: Bounded Context / Root System, 2: Subsystem / Container, 3: Executable Unit / DLL / Function)."\r\n },\r\n "bounded-context": {\r\n "type": "string",\r\n "description": "Domain-Driven Design (DDD) Bounded Context name this component belongs to."\r\n },\r\n "parent-component": {\r\n "type": ["string", "null"],\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Parent component identifier (null if Level 1)."\r\n },\r\n "implementation-type": {\r\n "type": "string",\r\n "enum": ["service", "dll", "function", "composite"],\r\n "description": "Technical implementation paradigm: distributed service (service), dynamic/native library (dll), in-process module/function (function), or logical aggregator/Bounded Context (composite)."\r\n },\r\n "implements-use-cases": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "satisfies-requirements": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^(FR|QR|CON|SEC-REQ)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "hosted-in-enclave": {\r\n "type": "string",\r\n "pattern": "^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Security enclave where the component resides (optional for DLLs or in-process functions)."\r\n },\r\n "interfaces": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["name", "protocol"],\r\n "properties": {\r\n "name": { "type": "string" },\r\n "protocol": {\r\n "type": "string",\r\n "enum": [\r\n "REST/HTTP",\r\n "gRPC",\r\n "WebSocket",\r\n "Kafka",\r\n "MQTT",\r\n "C-ABI",\r\n "Native-ABI",\r\n "FFI",\r\n "In-Process API",\r\n "Function-Call",\r\n "CLI",\r\n "GUI",\r\n "IPC"\r\n ]\r\n },\r\n "contract-spec": { "type": "string" }\r\n }\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2714
+ var SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/architecture/introduction-and-goals.schema.json",\r\n "title": "NAF v4 Enterprise & Capability / arc42 Introduction and System Goals Schema",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "naf-perspective",\r\n "cites-product-actors",\r\n "cites-quality-goals",\r\n "cites-use-cases"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "architecture-introduction"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Artifact semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "proposed", "accepted", "approved", "deprecated", "superseded"]\r\n },\r\n "owner": {\r\n "type": "string"\r\n },\r\n "arc42-section": {\r\n "type": "integer",\r\n "const": 1\r\n },\r\n "naf-perspective": {\r\n "type": "string",\r\n "const": "Enterprise & Capability"\r\n },\r\n "cites-product-actors": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "cites-quality-goals": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^(QR|SEC-REQ)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "cites-use-cases": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^ARCH-INTRO-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2715
+ var SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/compliance/license-manifest.schema.json",\r\n "title": "Static Dependencies License Manifest Schema",\r\n "type": "object",\r\n "required": ["evaluated_dependencies"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(MAN-LIC|LIC-MAN|LIC)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Optional canonical artifact identifier."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "license-manifest"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+(\\\\.[0-9]+)?(-[0-9A-Za-z.-]+)?$",\r\n "description": "Manifest format version."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "description": {\r\n "type": "string"\r\n },\r\n "generated_at": {\r\n "type": "string"\r\n },\r\n "evaluated_dependencies": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "object",\r\n "required": ["package", "version", "spdx_license", "status"],\r\n "properties": {\r\n "package": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "version": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "spdx_license": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": [\r\n "APPROVED",\r\n "REJECTED",\r\n "REVIEW_REQUIRED",\r\n "COMMERCIAL_APPROVAL_REQUIRED",\r\n "PENDING"\r\n ]\r\n },\r\n "reason": {\r\n "type": "string"\r\n },\r\n "approved_by": {\r\n "type": "string"\r\n }\r\n },\r\n "additionalProperties": false\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2716
+ var SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/compliance/license-policy.schema.json",\r\n "title": "Open Source License Policy Schema",\r\n "type": "object",\r\n "required": ["version", "project", "default_action", "categories", "agent_guardrails", "ci_gates"],\r\n "properties": {\r\n "version": {\r\n "type": "string"\r\n },\r\n "project": {\r\n "type": "string"\r\n },\r\n "default_action": {\r\n "type": "string",\r\n "enum": ["ALLOW", "DENY", "REVIEW_REQUIRED"]\r\n },\r\n "categories": {\r\n "type": "object"\r\n },\r\n "agent_guardrails": {\r\n "type": "object",\r\n "required": ["enforce_pre_check", "reject_unknown_licenses"],\r\n "properties": {\r\n "enforce_pre_check": { "type": "boolean" },\r\n "reject_unknown_licenses": { "type": "boolean" },\r\n "auto_reject_categories": { "type": "array", "items": { "type": "string" } },\r\n "on_commercial_detected": { "type": "object" }\r\n }\r\n },\r\n "ci_gates": {\r\n "type": "object",\r\n "required": ["fail_on_denied", "generate_sbom"],\r\n "properties": {\r\n "fail_on_denied": { "type": "boolean" },\r\n "fail_on_missing_license": { "type": "boolean" },\r\n "generate_sbom": { "type": "boolean" },\r\n "sbom_format": { "type": "string" },\r\n "output_notices_file": { "type": "string" },\r\n "allowed_depth": { "type": "string", "enum": ["DIRECT", "TRANSITIVE"] }\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2717
+ var SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/compliance/quality-policy.schema.json",\r\n "title": "Software Quality Policy Schema (Polyglot)",\r\n "type": "object",\r\n "required": ["version", "project", "enforcement_mode", "coding_rules", "release_thresholds", "agent_guardrails"],\r\n "properties": {\r\n "version": { "type": "string" },\r\n "project": { "type": "string" },\r\n "enforcement_mode": { "type": "string", "enum": ["STRICT", "PERMISSIVE"] },\r\n "scope": {\r\n "type": "object",\r\n "properties": {\r\n "target_directories": { "type": "array", "items": { "type": "string" } },\r\n "supported_extensions": { "type": "array", "items": { "type": "string" } },\r\n "exclude_patterns": { "type": "array", "items": { "type": "string" } }\r\n }\r\n },\r\n "language_toolchains": {\r\n "type": "object"\r\n },\r\n "coding_rules": {\r\n "type": "object",\r\n "required": ["standards", "enforce_formatting", "rules"],\r\n "properties": {\r\n "standards": { "type": "array", "items": { "type": "string" } },\r\n "enforce_formatting": { "type": "boolean" },\r\n "formatting_engine": { "type": "string" },\r\n "linter_engine": { "type": "string" },\r\n "rules": { "type": "object" }\r\n }\r\n },\r\n "release_thresholds": {\r\n "type": "object",\r\n "required": ["cyclomatic_complexity", "cognitive_complexity", "maintainability_index", "code_duplication", "test_coverage"],\r\n "properties": {\r\n "cyclomatic_complexity": {\r\n "type": "object",\r\n "required": ["max_per_function", "action_on_breach"],\r\n "properties": {\r\n "max_per_function": { "type": "integer" },\r\n "warning_at": { "type": "integer" },\r\n "action_on_breach": { "type": "string" }\r\n }\r\n },\r\n "cognitive_complexity": {\r\n "type": "object",\r\n "required": ["max_per_function", "action_on_breach"],\r\n "properties": {\r\n "max_per_function": { "type": "integer" },\r\n "warning_at": { "type": "integer" },\r\n "action_on_breach": { "type": "string" }\r\n }\r\n },\r\n "maintainability_index": {\r\n "type": "object",\r\n "required": ["min_acceptable_score", "action_on_breach"],\r\n "properties": {\r\n "min_acceptable_score": { "type": "number" },\r\n "target_score": { "type": "number" },\r\n "action_on_breach": { "type": "string" }\r\n }\r\n },\r\n "code_duplication": {\r\n "type": "object",\r\n "required": ["max_percentage", "action_on_breach"],\r\n "properties": {\r\n "max_percentage": { "type": "number" },\r\n "action_on_breach": { "type": "string" }\r\n }\r\n },\r\n "test_coverage": {\r\n "type": "object",\r\n "required": ["min_line_coverage_percent", "action_on_breach"],\r\n "properties": {\r\n "min_line_coverage_percent": { "type": "number" },\r\n "min_branch_coverage_percent": { "type": "number" },\r\n "min_function_coverage_percent": { "type": "number" },\r\n "action_on_breach": { "type": "string" }\r\n }\r\n },\r\n "technical_debt": {\r\n "type": "object"\r\n }\r\n }\r\n },\r\n "agent_guardrails": {\r\n "type": "object",\r\n "required": ["enforce_pre_commit_linter", "prevent_suppression_comments"],\r\n "properties": {\r\n "enforce_pre_commit_linter": { "type": "boolean" },\r\n "prevent_suppression_comments": { "type": "boolean" },\r\n "auto_refactor_on_high_complexity": { "type": "boolean" }\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2718
+ var SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/ide/mcp-config.schema.json",\r\n "title": "IDE MCP Configuration Schema (Cursor, Antigravity, VS Code)",\r\n "type": "object",\r\n "properties": {\r\n "$schema": {\r\n "type": "string"\r\n },\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(MCP-CFG|IDE-MCP|MCP)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Optional identifier for MCP configuration artifact."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "mcp-config"\r\n },\r\n "mcpServers": {\r\n "type": "object",\r\n "additionalProperties": {\r\n "type": "object",\r\n "required": ["command"],\r\n "properties": {\r\n "command": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "args": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "env": {\r\n "type": "object"\r\n },\r\n "disabled": {\r\n "type": "boolean"\r\n },\r\n "alwaysAllow": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n },\r\n "description": "MCP server registry format for Cursor and Antigravity."\r\n },\r\n "servers": {\r\n "type": "object",\r\n "additionalProperties": {\r\n "type": "object",\r\n "required": ["command"],\r\n "properties": {\r\n "command": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "args": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "env": {\r\n "type": "object"\r\n },\r\n "disabled": {\r\n "type": "boolean"\r\n },\r\n "alwaysAllow": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n },\r\n "description": "MCP server registry format for VS Code."\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2719
+ var SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/manuals/production-manual.schema.json",\r\n "title": "AI-SDLC Production & Operations Manual Schema",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "applies-to-version",\r\n "target-audience"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Immutable production manual identifier (e.g. MAN-PROD-SENTINELCORE)."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "production-manual"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Document semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string",\r\n "description": "Template schema version."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3,\r\n "description": "Descriptive title of the production manual."\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "applies-to-version": {\r\n "type": "string",\r\n "description": "Software version or release this production manual applies to (e.g. v1.0.0)."\r\n },\r\n "target-audience": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "minItems": 1,\r\n "description": "Target technical profiles (e.g. DevOps, SRE, Release Manager, SecOps)."\r\n },\r\n "components-covered": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Architecture components (CMP-*) deployed and covered by the manual."\r\n },\r\n "enclaves-involved": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Security enclaves (SEC-ENC-*) in which deployment executes."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^MAN-PROD-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2720
+ var SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/manuals/user-manual.schema.json",\r\n "title": "AI-SDLC User Manual Schema",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "target-audience",\r\n "allowed-roles",\r\n "applies-to-version"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Immutable user manual identifier (e.g. MAN-USER-SENTINELCORE)."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "user-manual"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Document semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string",\r\n "description": "Template schema version."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3,\r\n "description": "Descriptive title of the user manual."\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "applies-to-version": {\r\n "type": "string",\r\n "description": "Software version or release this manual applies to (e.g. v1.0.0)."\r\n },\r\n "target-audience": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "minItems": 1,\r\n "description": "Target user profiles or roles for the manual."\r\n },\r\n "allowed-roles": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "minItems": 1,\r\n "description": "Formal catalog of authorized roles to operate the application (linked to ACT-*)."\r\n },\r\n "journeys-covered": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^JRN-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Product journey identifiers (JRN-*) covered in the manual."\r\n },\r\n "use-cases-covered": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Use case identifiers (UC-*) implemented across journeys."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^MAN-USER-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2721
+ var SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/actor.schema.json",\r\n "title": "ProductShape Actor Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "role-type"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "actor"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Artifact semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string",\r\n "description": "Schema specification version used."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "role-type": {\r\n "type": "string",\r\n "enum": ["human-user", "ai-agent", "external-system", "sensor-iot"]\r\n },\r\n "description": {\r\n "type": "string"\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Identifier of the actor superseded by this version or artifact."\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Identifier of the new actor superseding this one upon deprecation/retirement."\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2722
+ var SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/business-rule.schema.json",\r\n "title": "ProductShape Business Rule Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "enforcement-level"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^BR-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "business-rule"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Business rule semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "enforcement-level": {\r\n "type": "string",\r\n "enum": ["strict-invariant", "override-with-approval", "guideline"]\r\n },\r\n "defined-in": {\r\n "type": "string",\r\n "pattern": "^BC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "uses-terms": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^BR-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^BR-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2723
+ var SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/journey.schema.json",\r\n "title": "Customer / Operator Journey Schema",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "persona",\r\n "stages",\r\n "touchpoints"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^JRN-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "journey"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Journey semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "persona": {\r\n "type": "string",\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Actor (persona) starring in this journey."\r\n },\r\n "stages": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Sequential journey stages (e.g. Awareness, Onboarding, Activation, Retention)."\r\n },\r\n "touchpoints": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Touchpoints between persona and system at each stage."\r\n },\r\n "related-use-cases": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "System use cases related to this journey."\r\n },\r\n "pain-points": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Frictions or issues detected along the user journey."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"]\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"]\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2724
+ var SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/requirement.schema.json",\r\n "title": "ProductShape Requirement Schema (Strict Test Validation Enforced)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "category", "derives-from", "verifiable-by"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "requirement"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Requirement semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "category": {\r\n "type": "string",\r\n "enum": ["functional", "quality", "constraint"]\r\n },\r\n "derives-from": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^(UC|BR|CON|CAP|GOAL)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Product Traceability: Origin Use Cases, Rules, Constraints, or Capabilities."\r\n },\r\n "verifiable-by": {\r\n "type": "string",\r\n "enum": ["cucumber-bdd", "automated-unit-test", "integration-test", "performance-benchmark", "security-audit", "inspection"],\r\n "description": "Mandatory formal verification method."\r\n },\r\n "acceptance-format": {\r\n "type": "string",\r\n "enum": ["gherkin", "declarative-prose"],\r\n "description": "Acceptance criteria format."\r\n },\r\n "cucumber-tags": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^@[a-zA-Z0-9_-]+$"\r\n },\r\n "description": "Cucumber tags for filtering and executing BDD tests."\r\n },\r\n "enforce-bdd-variants": {\r\n "type": "boolean",\r\n "description": "When true, enforces all 3 BDD scenario categories (@nominal, @boundary, @invalid)."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^(FR|QR|CON)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2725
+ var SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/term.schema.json",\r\n "title": "Domain Glossary Term Schema (Ubiquitous Language)",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "definition",\r\n "bounded-context"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "term"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Term semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 2,\r\n "description": "Canonical name of the term in the domain ubiquitous language."\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "definition": {\r\n "type": "string",\r\n "minLength": 10,\r\n "description": "Precise and unambiguous definition of the term in the domain context."\r\n },\r\n "bounded-context": {\r\n "type": "string",\r\n "description": "DDD Bounded Context this term belongs to (e.g. FlightControl, Telemetry, Billing)."\r\n },\r\n "synonyms": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Synonyms or alternative terms used colloquially that map to this canonical term."\r\n },\r\n "anti-terms": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Incorrect or ambiguous terms that MUST NOT be used for this concept."\r\n },\r\n "related-terms": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Glossary terms semantically related."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"]\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"]\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2726
+ var SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/product/use-case.schema.json",\r\n "title": "ProductShape Use Case Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "primary-actor"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "use-case"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Use case semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string",\r\n "description": "Template schema version."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "primary-actor": {\r\n "type": "string",\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "supporting-actors": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^ACT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "governed-by": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^BR-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "uses-terms": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^TERM-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "in-context": {\r\n "type": "string",\r\n "pattern": "^BC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "alternative-flows": {\r\n "type": "array",\r\n "items": {\r\n "oneOf": [\r\n { "type": "string", "minLength": 1 },\r\n {\r\n "type": "object",\r\n "properties": {\r\n "id": { "type": "string" },\r\n "name": { "type": "string" },\r\n "description": { "type": "string" }\r\n },\r\n "additionalProperties": false\r\n }\r\n ]\r\n },\r\n "description": "Declared alternative flows that must be covered by tests."\r\n },\r\n "exception-flows": {\r\n "type": "array",\r\n "items": {\r\n "oneOf": [\r\n { "type": "string", "minLength": 1 },\r\n {\r\n "type": "object",\r\n "properties": {\r\n "id": { "type": "string" },\r\n "name": { "type": "string" },\r\n "description": { "type": "string" }\r\n },\r\n "additionalProperties": false\r\n }\r\n ]\r\n },\r\n "description": "Declared exception flows that must be covered by tests."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2727
+ var SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/safety/hazard.schema.json",\r\n "title": "Hazard Schema (Operational Hazard & Safety Risk Analysis)",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "severity",\r\n "probability",\r\n "fault-tolerance-time-ms",\r\n "mitigated-by"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^HAZ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "hazard"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Hazard semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "severity": {\r\n "type": "string",\r\n "enum": ["catastrophic", "critical", "major", "minor", "negligible"],\r\n "description": "Hazard severity per functional safety classification (DO-178C / ISO 26262)."\r\n },\r\n "probability": {\r\n "type": "string",\r\n "enum": ["frequent", "probable", "occasional", "remote", "improbable", "extremely-improbable"],\r\n "description": "Probability of operational hazard occurrence."\r\n },\r\n "fault-tolerance-time-ms": {\r\n "type": "number",\r\n "minimum": 0,\r\n "description": "Fault tolerance time interval (FTTI) limit in milliseconds before entering safe state."\r\n },\r\n "mitigated-by": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^SAF-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Safety requirements mitigating this hazard."\r\n },\r\n "hazardous-condition": {\r\n "type": "string",\r\n "description": "Description of the dangerous operational condition."\r\n },\r\n "potential-effect": {\r\n "type": "string",\r\n "description": "Potential effect on people, aircraft, or environment if hazard materializes."\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"]\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"]\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2728
+ var SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/safety/safety-req.schema.json",\r\n "title": "Safety Requirement Schema (Functional Safety & Hazard Mitigation)",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "title",\r\n "status",\r\n "version",\r\n "safety-domain",\r\n "safety-integrity-level",\r\n "mitigates-hazard",\r\n "fail-safe-action"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^SAF-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "safety-requirement"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Safety requirement semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "safety-domain": {\r\n "type": "string",\r\n "enum": [\r\n "flight-control",\r\n "collision-avoidance",\r\n "energy-management",\r\n "emergency-recovery",\r\n "sensor-integrity",\r\n "propulsion",\r\n "telemetry"\r\n ],\r\n "description": "Operational safety domain."\r\n },\r\n "safety-integrity-level": {\r\n "type": "string",\r\n "description": "Safety integrity level (e.g. DAL-A..D, ASIL-A..D, SIL-1..4)."\r\n },\r\n "mitigates-hazard": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^HAZ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Operational hazards mitigated by safety control."\r\n },\r\n "fail-safe-action": {\r\n "type": "string",\r\n "description": "Automatic action or contingency maneuver to enter safe state."\r\n },\r\n "fault-tolerance-time-ms": {\r\n "type": "number",\r\n "description": "Fault tolerance time interval limit in milliseconds (FTTI)."\r\n },\r\n "acceptance-format": {\r\n "type": "string",\r\n "enum": ["gherkin", "declarative-prose"]\r\n },\r\n "cucumber-tags": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"]\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"]\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2729
+ var SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/design.schema.json",\r\n "title": "Spec-Driven Development Technical Design Schema (DSG-*)",\r\n "type": "object",\r\n "required": ["id", "type", "title"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(DSG-[A-Z0-9]+(-[A-Z0-9]+)*|CHG-[A-Z0-9]+-DESIGN|[A-Z0-9]+(-[A-Z0-9]+)*)$",\r\n "description": "Unique identifier of the technical design specification."\r\n },\r\n "type": {\r\n "type": "string",\r\n "enum": ["spec-design", "spec-change-design", "design"]\r\n },\r\n "change-id": {\r\n "type": "string",\r\n "pattern": "^(CHG|FEAT|PATCH)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Parent change identifier associated with this design."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Semantic versioning (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "handoff": {\r\n "type": "string",\r\n "pattern": "^HOF-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Reference to the HOF-* sidecar."\r\n },\r\n "architecture-component": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Associated architecture component."\r\n },\r\n "architecture-components": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "List of architecture components covered by this technical design."\r\n },\r\n "enclave": {\r\n "type": "string",\r\n "pattern": "^(SEC-ENC-)?[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Zero trust security enclave."\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": [\r\n "draft",\r\n "proposed",\r\n "review",\r\n "approved",\r\n "active",\r\n "completed",\r\n "deprecated"\r\n ]\r\n },\r\n "author": {\r\n "type": "string"\r\n },\r\n "date": {\r\n "type": "string"\r\n },\r\n "contracts": {\r\n "type": "array",\r\n "description": "Explicit contract interfaces and methods designed for implementation and unit testing.",\r\n "items": {\r\n "oneOf": [\r\n { "type": "string", "minLength": 1 },\r\n {\r\n "type": "object",\r\n "required": ["methods"],\r\n "properties": {\r\n "component": { "type": "string" },\r\n "interface": { "type": "string" },\r\n "methods": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": { "type": "string", "minLength": 1 }\r\n }\r\n },\r\n "additionalProperties": false\r\n }\r\n ]\r\n }\r\n },\r\n "citations": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["id"],\r\n "properties": {\r\n "id": { "type": "string" },\r\n "digest": { "type": "string" },\r\n "comment": { "type": "string" },\r\n "anchor": { "type": "string" }\r\n },\r\n "additionalProperties": false\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2730
+ var SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/handoff.schema.json",\r\n "title": "PDaC Product Handoff Sidecar Schema (HOF-*)",\r\n "type": "object",\r\n "required": ["id", "type", "changeId", "subgraph"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^HOF-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Immutable identifier emitted by PDaC handoff."\r\n },\r\n "type": {\r\n "type": "string",\r\n "enum": ["handoff", "product-handoff"]\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "changeId": {\r\n "type": "string",\r\n "pattern": "^(CHG|FEAT)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$"\r\n },\r\n "createdAt": {\r\n "type": "string"\r\n },\r\n "subgraph": {\r\n "type": "object",\r\n "required": ["requirements"],\r\n "properties": {\r\n "requirements": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": { "type": "string" }\r\n },\r\n "useCases": {\r\n "type": "array",\r\n "items": { "type": "string" }\r\n },\r\n "businessRules": {\r\n "type": "array",\r\n "items": { "type": "string" }\r\n },\r\n "securityRequirements": {\r\n "type": "array",\r\n "items": { "type": "string" }\r\n },\r\n "abuseCases": {\r\n "type": "array",\r\n "items": { "type": "string" }\r\n },\r\n "actors": {\r\n "type": "array",\r\n "items": { "type": "string" }\r\n }\r\n },\r\n "additionalProperties": true\r\n },\r\n "citations": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["id"],\r\n "properties": {\r\n "id": { "type": "string" },\r\n "digest": { "type": "string" },\r\n "anchor": { "type": "string" },\r\n "comment": { "type": "string" }\r\n }\r\n }\r\n }\r\n },\r\n "additionalProperties": true\r\n}\r\n';
2731
+ var SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/proposal.schema.json",\r\n "title": "Spec-Driven Development Change Proposal Schema (CHG-*)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(CHG|FEAT|PATCH)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Unique identifier of the change proposal."\r\n },\r\n "type": {\r\n "type": "string",\r\n "enum": ["spec-change-proposal", "proposal"]\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": [\r\n "draft",\r\n "proposed",\r\n "review",\r\n "approved",\r\n "applied",\r\n "active",\r\n "completed",\r\n "rejected"\r\n ]\r\n },\r\n "author": {\r\n "type": "string"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Semantic versioning (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "date": {\r\n "type": "string"\r\n },\r\n "handoff": {\r\n "type": "string",\r\n "description": "Associated handoff sidecar reference."\r\n },\r\n "sdd-framework-compat": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Supported SDD framework adapters."\r\n },\r\n "citations": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["id"],\r\n "properties": {\r\n "id": { "type": "string" },\r\n "digest": { "type": "string" },\r\n "comment": { "type": "string" },\r\n "anchor": { "type": "string" }\r\n },\r\n "additionalProperties": false\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2732
+ var SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/release-kpis.schema.json",\r\n "title": "Release Consolidated KPIs & Attribution Telemetry Schema",\r\n "type": "object",\r\n "required": [\r\n "releaseBranch",\r\n "baseBranch",\r\n "generatedAt",\r\n "totalCommits",\r\n "totalLinesAdded",\r\n "totalLinesDeleted",\r\n "totalKloc",\r\n "totalBugs",\r\n "globalDefectDensity",\r\n "totalTimeSeconds",\r\n "totalTokens",\r\n "totalCostUsd",\r\n "authorStats",\r\n "bugList"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(KPI-REL|REL-KPI)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Optional artifact identifier."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "release-kpis"\r\n },\r\n "releaseBranch": {\r\n "type": "string"\r\n },\r\n "baseBranch": {\r\n "type": "string"\r\n },\r\n "generatedAt": {\r\n "type": "string"\r\n },\r\n "totalCommits": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "totalLinesAdded": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "totalLinesDeleted": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "totalKloc": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "totalBugs": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "globalDefectDensity": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "totalTimeSeconds": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "totalTokens": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "totalCostUsd": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "reworkTimeSeconds": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "reworkTokens": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "reworkCostUsd": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "reworkTimePercent": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "reworkTokensPercent": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "reworkCostPercent": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "authorStats": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": [\r\n "authorOrModel",\r\n "isAgent",\r\n "commits",\r\n "linesAdded",\r\n "linesDeleted",\r\n "klocProduced",\r\n "bugsInjected",\r\n "defectInjectionRate",\r\n "totalTimeSeconds",\r\n "totalTokens",\r\n "estimatedCostUsd"\r\n ],\r\n "properties": {\r\n "authorOrModel": {\r\n "type": "string"\r\n },\r\n "isAgent": {\r\n "type": "boolean"\r\n },\r\n "commits": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "linesAdded": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "linesDeleted": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "klocProduced": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "bugsInjected": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "defectInjectionRate": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "totalTimeSeconds": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "totalTokens": {\r\n "type": "integer",\r\n "minimum": 0\r\n },\r\n "estimatedCostUsd": {\r\n "type": "number",\r\n "minimum": 0\r\n }\r\n },\r\n "additionalProperties": false\r\n }\r\n },\r\n "bugList": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["sha", "subject", "author", "timeSeconds", "tokens"],\r\n "properties": {\r\n "sha": {\r\n "type": "string"\r\n },\r\n "subject": {\r\n "type": "string"\r\n },\r\n "author": {\r\n "type": "string"\r\n },\r\n "parentRef": {\r\n "type": "string"\r\n },\r\n "timeSeconds": {\r\n "type": "number",\r\n "minimum": 0\r\n },\r\n "tokens": {\r\n "type": "integer",\r\n "minimum": 0\r\n }\r\n },\r\n "additionalProperties": false\r\n }\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2733
+ var SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/session-telemetry.schema.json",\r\n "title": "Agent Session Telemetry Schema (.ai-sdlc/session-telemetry.json)",\r\n "type": "object",\r\n "required": [\r\n "model",\r\n "promptTokens",\r\n "completionTokens",\r\n "activeTimeSeconds"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(TEL-SES|SES-TEL|TEL)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Optional telemetry session identifier."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "session-telemetry"\r\n },\r\n "model": {\r\n "type": "string",\r\n "minLength": 1,\r\n "description": "AI model name or identifier."\r\n },\r\n "promptTokens": {\r\n "type": "integer",\r\n "minimum": 0,\r\n "description": "Total prompt tokens consumed."\r\n },\r\n "completionTokens": {\r\n "type": "integer",\r\n "minimum": 0,\r\n "description": "Total completion tokens generated."\r\n },\r\n "activeTimeSeconds": {\r\n "type": "number",\r\n "minimum": 0,\r\n "description": "Active session development duration in seconds."\r\n },\r\n "author": {\r\n "type": "string"\r\n },\r\n "authorType": {\r\n "type": "string",\r\n "enum": ["agent", "human"]\r\n },\r\n "sessionId": {\r\n "type": "string"\r\n },\r\n "timestamp": {\r\n "type": "string"\r\n },\r\n "provider": {\r\n "type": "string"\r\n },\r\n "confidence": {\r\n "type": "string",\r\n "enum": ["HIGH", "MEDIUM", "LOW"]\r\n },\r\n "source": {\r\n "type": "string"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2734
+ var SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/spec.schema.json",\r\n "title": "Spec-Driven Development Delivery Specification Schema (SPEC-*)",\r\n "type": "object",\r\n "required": ["id", "type", "change-id"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^SPEC-(CHG|FEAT|PATCH)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Unique identifier of the delivery specification."\r\n },\r\n "type": {\r\n "type": "string",\r\n "enum": ["delivery-spec", "spec"]\r\n },\r\n "change-id": {\r\n "type": "string",\r\n "pattern": "^(CHG|FEAT|PATCH)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Parent change identifier associated with this specification."\r\n },\r\n "profile": {\r\n "type": "string",\r\n "enum": ["patch", "standard", "critical"],\r\n "description": "Risk and governance profile of the change."\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Semantic versioning (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "handoff": {\r\n "type": "string",\r\n "description": "Associated handoff sidecar reference."\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": [\r\n "draft",\r\n "proposed",\r\n "review",\r\n "approved",\r\n "active",\r\n "completed",\r\n "deprecated"\r\n ]\r\n },\r\n "verification": {\r\n "type": "object",\r\n "properties": {\r\n "method": {\r\n "type": "string"\r\n },\r\n "command": {\r\n "type": "string"\r\n },\r\n "target": {\r\n "type": "string"\r\n }\r\n },\r\n "additionalProperties": true\r\n },\r\n "citations": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["id"],\r\n "properties": {\r\n "id": { "type": "string" },\r\n "digest": { "type": "string" },\r\n "comment": { "type": "string" },\r\n "anchor": { "type": "string" }\r\n },\r\n "additionalProperties": false\r\n }\r\n },\r\n "acceptance-format": {\r\n "type": "string",\r\n "enum": ["gherkin"],\r\n "description": "Formato de aceptaci\xF3n BDD obligatorio para especificaciones de entrega SDD."\r\n },\r\n "cucumber-tags": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^@[a-zA-Z0-9_-]+$"\r\n },\r\n "description": "Etiquetas de trazabilidad BDD para ejecuci\xF3n con Cucumber."\r\n },\r\n "cucumber-feature-file": {\r\n "type": "string",\r\n "description": "Ruta personalizada de extracci\xF3n del archivo .feature para Cucumber."\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2735
+ var SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/sdd/tasks.schema.json",\r\n "title": "Verifiable Tasks & Human Autonomy Governance Schema",\r\n "type": "object",\r\n "required": ["id", "type", "change-id", "version", "tasks"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^TSK-PLAN-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "task-plan"\r\n },\r\n "change-id": {\r\n "type": "string",\r\n "pattern": "^(CHG|FEAT)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$"\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 5\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "approved", "in-progress", "completed", "blocked"]\r\n },\r\n "governance-summary": {\r\n "type": "object",\r\n "properties": {\r\n "autonomous-tasks-count": { "type": "integer", "minimum": 0 },\r\n "human-review-plan-count": { "type": "integer", "minimum": 0 },\r\n "ambiguous-count": { "type": "integer", "minimum": 0 },\r\n "high-risk-manual-count": { "type": "integer", "minimum": 0 }\r\n }\r\n },\r\n "tasks": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "object",\r\n "required": ["id", "title", "complexity", "risk-level", "autonomy-mode", "verification", "assigned-to", "status"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^TSK-[0-9]{3,}$"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 5\r\n },\r\n "complexity": {\r\n "type": "string",\r\n "enum": ["LOW", "MEDIUM", "HIGH"]\r\n },\r\n "risk-level": {\r\n "type": "string",\r\n "enum": ["LOW", "MEDIUM", "HIGH", "CRITICAL"]\r\n },\r\n "autonomy-mode": {\r\n "type": "string",\r\n "enum": [\r\n "AUTONOMOUS",\r\n "HUMAN_REVIEW_PLAN",\r\n "AMBIGUOUS",\r\n "HIGH_RISK_MANUAL"\r\n ],\r\n "description": "AI agent human governance and supervision mode."\r\n },\r\n "verification": {\r\n "type": "object",\r\n "required": ["method", "command-or-criteria"],\r\n "properties": {\r\n "method": {\r\n "type": "string",\r\n "enum": ["automated-unit-test", "cucumber-bdd", "quality-gate", "license-audit", "sast-scan", "manual-inspection", "smoke-test"]\r\n },\r\n "command-or-criteria": {\r\n "type": "string",\r\n "minLength": 5\r\n }\r\n }\r\n },\r\n "assigned-to": {\r\n "type": "string",\r\n "enum": [\r\n "agent-developer",\r\n "agent-security-auditor",\r\n "agent-compliance-checker",\r\n "agent-qa",\r\n "human-engineer",\r\n "human-architect",\r\n "pair-human-agent"\r\n ]\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["PENDING", "IN_PROGRESS", "COMPLETED", "BLOCKED"]\r\n },\r\n "blocking-reason": {\r\n "type": "string"\r\n },\r\n "implements-components": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^CMP-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Architecture components (CMP-*) implemented by this atomic task."\r\n },\r\n "satisfies-requirements": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^(FR|QR|CON|SEC-REQ|SAF-REQ)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Requirements satisfied by this atomic task."\r\n },\r\n "implements-contracts": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "minLength": 1\r\n },\r\n "description": "Explicit interface or method contracts from design.md implemented by this task."\r\n }\r\n },\r\n "additionalProperties": false\r\n }\r\n },\r\n "supersedes": { "type": ["string", "null"] },\r\n "superseded-by": { "type": ["string", "null"] }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2736
+ var SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/security/abuse-case.schema.json",\r\n "title": "Abuse Case Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "primary-threat-actor", "targets-use-case", "stride-category", "mitigated-by"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^ABUSE-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "abuse-case"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Abuse case semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "primary-threat-actor": {\r\n "type": "string",\r\n "pattern": "^ACT-THREAT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "targets-use-case": {\r\n "type": "string",\r\n "pattern": "^UC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "stride-category": {\r\n "type": "string",\r\n "enum": ["spoofing", "tampering", "repudiation", "information-disclosure", "denial-of-service", "elevation-of-privilege"]\r\n },\r\n "mitigated-by": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^SEC-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "asvs-controls": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^ABUSE-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^ABUSE-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2737
+ var SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON = `{\r
2738
+ "$schema": "https://json-schema.org/draft/2020-12/schema",\r
2739
+ "$id": "https://ai-sdlc.org/schemas/security/enclave.schema.json",\r
2740
+ "title": "Security Enclave Schema (Zero Trust Architecture Boundary)",\r
2741
+ "type": "object",\r
2742
+ "required": [\r
2743
+ "id",\r
2744
+ "type",\r
2745
+ "title",\r
2746
+ "status",\r
2747
+ "version",\r
2748
+ "trust-zone",\r
2749
+ "perimeter-rules",\r
2750
+ "allowed-inbound",\r
2751
+ "allowed-outbound"\r
2752
+ ],\r
2753
+ "properties": {\r
2754
+ "id": {\r
2755
+ "type": "string",\r
2756
+ "pattern": "^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$"\r
2757
+ },\r
2758
+ "type": {\r
2759
+ "type": "string",\r
2760
+ "const": "security-enclave"\r
2761
+ },\r
2762
+ "version": {\r
2763
+ "type": "string",\r
2764
+ "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r
2765
+ "description": "Security enclave semantic version (SemVer)."\r
2766
+ },\r
2767
+ "schema-version": {\r
2768
+ "type": "string"\r
2769
+ },\r
2770
+ "title": {\r
2771
+ "type": "string",\r
2772
+ "minLength": 3\r
2773
+ },\r
2774
+ "status": {\r
2775
+ "type": "string",\r
2776
+ "enum": ["draft", "active", "deprecated", "retired"]\r
2777
+ },\r
2778
+ "trust-zone": {\r
2779
+ "type": "string",\r
2780
+ "enum": ["untrusted", "semi-trusted", "trusted", "highly-trusted", "dmz", "zero-trust-boundary"],\r
2781
+ "description": "Zero Trust confidence zone assigned to enclave."\r
2782
+ },\r
2783
+ "trust-level": {\r
2784
+ "type": "string",\r
2785
+ "description": "Descriptive Zero Trust confidence level."\r
2786
+ },\r
2787
+ "isolation": {\r
2788
+ "type": "string",\r
2789
+ "description": "Technical perimeter isolation mechanism."\r
2790
+ },\r
2791
+ "perimeter-rules": {\r
2792
+ "type": "array",\r
2793
+ "minItems": 1,\r
2794
+ "items": {\r
2795
+ "type": "string"\r
2796
+ },\r
2797
+ "description": "Perimeter rules defining enclave security boundary (e.g. mTLS, IP allowlist)."\r
2798
+ },\r
2799
+ "allowed-inbound": {\r
2800
+ "type": "array",\r
2801
+ "items": {\r
2802
+ "type": "string",\r
2803
+ "pattern": "^(CMP|SEC-ENC)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r
2804
+ },\r
2805
+ "description": "Components or enclaves authorized to initiate inbound connections."\r
2806
+ },\r
2807
+ "allowed-outbound": {\r
2808
+ "type": "array",\r
2809
+ "items": {\r
2810
+ "type": "string",\r
2811
+ "pattern": "^(CMP|SEC-ENC)-[A-Z0-9]+(-[A-Z0-9]+)*$"\r
2812
+ },\r
2813
+ "description": "Components or enclaves this enclave can connect to."\r
2814
+ },\r
2815
+ "enforced-by": {\r
2816
+ "type": "array",\r
2817
+ "items": {\r
2818
+ "type": "string",\r
2819
+ "pattern": "^SEC-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r
2820
+ },\r
2821
+ "description": "Security requirements enforcing this enclave's rules."\r
2822
+ },\r
2823
+ "authentication-mechanism": {\r
2824
+ "type": "string",\r
2825
+ "enum": ["mtls", "jwt", "api-key", "oauth2", "none"],\r
2826
+ "description": "Authentication mechanism required at enclave perimeter."\r
2827
+ },\r
2828
+ "supersedes": {\r
2829
+ "type": ["string", "null"]\r
2830
+ },\r
2831
+ "superseded-by": {\r
2832
+ "type": ["string", "null"]\r
2833
+ }\r
2834
+ },\r
2835
+ "additionalProperties": false\r
2836
+ }\r
2837
+ `;
2838
+ var SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/security/security-req.schema.json",\r\n "title": "Security Requirement Schema (Strict Test Validation Enforced)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "security-domain", "mitigates-abuse-case"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^SEC-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "security-requirement"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Security requirement semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "security-domain": {\r\n "type": "string",\r\n "enum": ["authentication", "authorization", "cryptography", "input-validation", "audit-logging", "communication-security", "data-protection"]\r\n },\r\n "mitigates-abuse-case": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string",\r\n "pattern": "^ABUSE-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "description": "Product/Security Traceability: Abuse case or threat this control neutralizes."\r\n },\r\n "enforced-in-enclave": {\r\n "type": "string",\r\n "pattern": "^SEC-ENC-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Architecture Traceability: Perimeter or internal security enclave."\r\n },\r\n "compliance-references": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "acceptance-format": {\r\n "type": "string",\r\n "enum": ["gherkin", "declarative-prose"],\r\n "description": "Mitigation criteria format."\r\n },\r\n "cucumber-tags": {\r\n "type": "array",\r\n "items": {\r\n "type": "string",\r\n "pattern": "^@[a-zA-Z0-9_-]+$"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^SEC-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^SEC-REQ-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2839
+ var SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/security/threat-actor.schema.json",\r\n "title": "Threat Actor Schema (Versionable)",\r\n "type": "object",\r\n "required": ["id", "type", "title", "status", "version", "threat-capability", "motivation"],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^ACT-THREAT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "threat-actor"\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Threat profile semantic version (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "deprecated", "retired"]\r\n },\r\n "threat-capability": {\r\n "type": "string",\r\n "enum": ["script-kiddie", "advanced-persistent-threat", "insider-threat", "automated-botnet", "supply-chain-attacker"]\r\n },\r\n "motivation": {\r\n "type": "string",\r\n "enum": ["financial-gain", "espionage", "sabotage", "data-theft", "reputational-damage"]\r\n },\r\n "attack-surfaces": {\r\n "type": "array",\r\n "items": {\r\n "type": "string"\r\n }\r\n },\r\n "supersedes": {\r\n "type": ["string", "null"],\r\n "pattern": "^ACT-THREAT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n },\r\n "superseded-by": {\r\n "type": ["string", "null"],\r\n "pattern": "^ACT-THREAT-[A-Z0-9]+(-[A-Z0-9]+)*$"\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2840
+ var SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON = '{\r\n "$schema": "https://json-schema.org/draft/2020-12/schema",\r\n "$id": "https://ai-sdlc.org/schemas/workflow/agent-handoff.schema.json",\r\n "title": "Agent Workflow Handoff Block Schema",\r\n "type": "object",\r\n "required": [\r\n "id",\r\n "type",\r\n "completed-phase",\r\n "acting-role",\r\n "autonomy-mode",\r\n "deliverables",\r\n "suggested-prompt"\r\n ],\r\n "properties": {\r\n "id": {\r\n "type": "string",\r\n "pattern": "^(AHOF|HOF-WORKFLOW|HOF)-[A-Z0-9]+(-[A-Z0-9]+)*$",\r\n "description": "Unique workflow handoff identifier."\r\n },\r\n "type": {\r\n "type": "string",\r\n "const": "agent-handoff"\r\n },\r\n "title": {\r\n "type": "string",\r\n "minLength": 3\r\n },\r\n "version": {\r\n "type": "string",\r\n "pattern": "^[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.-]+)?$",\r\n "description": "Semantic versioning (SemVer)."\r\n },\r\n "schema-version": {\r\n "type": "string"\r\n },\r\n "status": {\r\n "type": "string",\r\n "enum": ["draft", "active", "completed", "transferred"]\r\n },\r\n "completed-phase": {\r\n "type": "string",\r\n "minLength": 2,\r\n "description": "Name of the completed lifecycle phase or activity."\r\n },\r\n "acting-role": {\r\n "type": "string",\r\n "enum": [\r\n "agent-product-analyst",\r\n "agent-threat-modeler",\r\n "agent-system-architect",\r\n "agent-qa-engineer",\r\n "agent-developer",\r\n "agent-expert-user",\r\n "agent-security-auditor",\r\n "agent-compliance-checker",\r\n "agent-code-reviewer",\r\n "agent-devops",\r\n "human-dev",\r\n "tech-lead",\r\n "release-manager"\r\n ],\r\n "description": "Specialized role executing the handoff."\r\n },\r\n "autonomy-mode": {\r\n "type": "string",\r\n "enum": ["AUTONOMOUS", "HUMAN_REVIEW_PLAN", "AMBIGUOUS", "HIGH_RISK_MANUAL"],\r\n "description": "Autonomy level under which the task was executed."\r\n },\r\n "deliverables": {\r\n "type": "array",\r\n "minItems": 1,\r\n "items": {\r\n "type": "string"\r\n },\r\n "description": "Paths or IDs of artifacts produced during the phase."\r\n },\r\n "recommended-next-roles": {\r\n "type": "array",\r\n "items": {\r\n "type": "object",\r\n "required": ["role", "rationale"],\r\n "properties": {\r\n "role": {\r\n "type": "string"\r\n },\r\n "rationale": {\r\n "type": "string"\r\n }\r\n },\r\n "additionalProperties": false\r\n },\r\n "description": "Recommended downstream specialist roles and technical justifications."\r\n },\r\n "suggested-prompt": {\r\n "type": "string",\r\n "minLength": 5,\r\n "description": "Suggested invocation prompt to initiate the next agent."\r\n },\r\n "human-action-window": {\r\n "type": "object",\r\n "properties": {\r\n "review-and-validate": {\r\n "type": "boolean"\r\n },\r\n "edit-directly": {\r\n "type": "boolean"\r\n },\r\n "pause-or-divert": {\r\n "type": "boolean"\r\n },\r\n "delegate": {\r\n "type": "boolean"\r\n }\r\n },\r\n "additionalProperties": false,\r\n "description": "Actions available to the human engineer within the sovereign action window."\r\n }\r\n },\r\n "additionalProperties": false\r\n}\r\n';
2841
+ var STARTER_SCHEMAS_MAP = {
2842
+ "schemas/architecture/adr.schema.json": JSON.parse(SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON),
2843
+ "schemas/architecture/component.schema.json": JSON.parse(SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON),
2844
+ "schemas/architecture/introduction-and-goals.schema.json": JSON.parse(SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON),
2845
+ "schemas/compliance/license-manifest.schema.json": JSON.parse(SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON),
2846
+ "schemas/compliance/license-policy.schema.json": JSON.parse(SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON),
2847
+ "schemas/compliance/quality-policy.schema.json": JSON.parse(SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON),
2848
+ "schemas/ide/mcp-config.schema.json": JSON.parse(SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON),
2849
+ "schemas/manuals/production-manual.schema.json": JSON.parse(SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON),
2850
+ "schemas/manuals/user-manual.schema.json": JSON.parse(SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON),
2851
+ "schemas/product/actor.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON),
2852
+ "schemas/product/business-rule.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON),
2853
+ "schemas/product/journey.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON),
2854
+ "schemas/product/requirement.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON),
2855
+ "schemas/product/term.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON),
2856
+ "schemas/product/use-case.schema.json": JSON.parse(SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON),
2857
+ "schemas/safety/hazard.schema.json": JSON.parse(SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON),
2858
+ "schemas/safety/safety-req.schema.json": JSON.parse(SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON),
2859
+ "schemas/sdd/design.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON),
2860
+ "schemas/sdd/handoff.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON),
2861
+ "schemas/sdd/proposal.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON),
2862
+ "schemas/sdd/release-kpis.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON),
2863
+ "schemas/sdd/session-telemetry.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON),
2864
+ "schemas/sdd/spec.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON),
2865
+ "schemas/sdd/tasks.schema.json": JSON.parse(SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON),
2866
+ "schemas/security/abuse-case.schema.json": JSON.parse(SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON),
2867
+ "schemas/security/enclave.schema.json": JSON.parse(SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON),
2868
+ "schemas/security/security-req.schema.json": JSON.parse(SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON),
2869
+ "schemas/security/threat-actor.schema.json": JSON.parse(SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON),
2870
+ "schemas/workflow/agent-handoff.schema.json": JSON.parse(SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON)
2871
+ };
2872
+ var STARTER_SCHEMAS = Object.entries(STARTER_SCHEMAS_MAP).map(([relPath, schema]) => ({
2873
+ relPath,
2874
+ schema,
2875
+ content: JSON.stringify(schema, null, 2)
2876
+ }));
2877
+
2878
+ // src/verifiers/schemas.ts
2710
2879
  var TYPE_TO_SCHEMA_MAP = {
2711
2880
  // Product
2712
2881
  actor: "schemas/product/actor.schema.json",
@@ -3012,31 +3181,33 @@ function findSchemaFile(relSchemaPath, rootDir) {
3012
3181
  if (fs7.existsSync(fallbackPath)) return fallbackPath;
3013
3182
  return null;
3014
3183
  }
3184
+ function loadJsonSchema(fullPath, relSchemaPath) {
3185
+ if (fullPath && fs7.existsSync(fullPath)) {
3186
+ try {
3187
+ return JSON.parse(fs7.readFileSync(fullPath, "utf-8"));
3188
+ } catch {
3189
+ }
3190
+ }
3191
+ return STARTER_SCHEMAS_MAP[relSchemaPath] || null;
3192
+ }
3015
3193
  function resolveSchemaForArtifact(frontmatter, rootDir) {
3016
3194
  const type = frontmatter.type || (typeof frontmatter.id === "string" ? inferArtifactTypeFromId(frontmatter.id) : null);
3017
3195
  if (!type || !TYPE_TO_SCHEMA_MAP[type]) return null;
3018
3196
  const relSchemaPath = TYPE_TO_SCHEMA_MAP[type];
3019
- const fullPath = findSchemaFile(relSchemaPath, rootDir);
3020
- if (!fullPath) return null;
3021
- try {
3022
- const raw = fs7.readFileSync(fullPath, "utf-8");
3023
- return { schemaPath: relSchemaPath, schema: JSON.parse(raw) };
3024
- } catch {
3025
- return null;
3026
- }
3197
+ const schema = loadJsonSchema(findSchemaFile(relSchemaPath, rootDir), relSchemaPath);
3198
+ return schema ? { schemaPath: relSchemaPath, schema } : null;
3027
3199
  }
3028
3200
  function loadSchemaFromPathOrType(schemaOrType, rootDir) {
3029
3201
  if (schemaOrType.endsWith(".json")) {
3030
3202
  const fullPath = path4.isAbsolute(schemaOrType) ? schemaOrType : findSchemaFile(schemaOrType, rootDir);
3031
- if (fullPath && fs7.existsSync(fullPath)) {
3032
- return { schema: JSON.parse(fs7.readFileSync(fullPath, "utf-8")), schemaId: schemaOrType };
3033
- }
3034
- } else if (TYPE_TO_SCHEMA_MAP[schemaOrType]) {
3035
- const relPath = TYPE_TO_SCHEMA_MAP[schemaOrType];
3036
- const fullPath = findSchemaFile(relPath, rootDir);
3037
- if (fullPath && fs7.existsSync(fullPath)) {
3038
- return { schema: JSON.parse(fs7.readFileSync(fullPath, "utf-8")), schemaId: relPath };
3039
- }
3203
+ const relNormalized = schemaOrType.replace(/\\/g, "/");
3204
+ const schema = loadJsonSchema(fullPath, relNormalized);
3205
+ return { schema, schemaId: schemaOrType };
3206
+ }
3207
+ const relPath = TYPE_TO_SCHEMA_MAP[schemaOrType];
3208
+ if (relPath) {
3209
+ const schema = loadJsonSchema(findSchemaFile(relPath, rootDir), relPath);
3210
+ return { schema, schemaId: relPath };
3040
3211
  }
3041
3212
  return { schema: null };
3042
3213
  }
@@ -12686,6 +12857,419 @@ function getArchitectureTemplates(granularity = "minimal") {
12686
12857
  }));
12687
12858
  }
12688
12859
 
12860
+ // src/init/starter-templates.ts
12861
+ var STARTER_TEMPLATES_CI__GITLAB_CI_YML = `# ==============================================================================\r
12862
+ # AI-SDLC: GitLab CI/CD Pipeline Template\r
12863
+ # Continuous Quality Gates verification and canonical promotion of SDD changes\r
12864
+ # ==============================================================================\r
12865
+ \r
12866
+ stages:\r
12867
+ - validate\r
12868
+ - test\r
12869
+ - integrate\r
12870
+ \r
12871
+ default:\r
12872
+ image: node:20\r
12873
+ cache:\r
12874
+ key:\r
12875
+ files:\r
12876
+ - pnpm-lock.yaml\r
12877
+ paths:\r
12878
+ - .pnpm-store\r
12879
+ \r
12880
+ variables:\r
12881
+ PNPM_HOME: "$CI_PROJECT_DIR/.pnpm"\r
12882
+ \r
12883
+ before_script:\r
12884
+ - corepack enable\r
12885
+ - corepack prepare pnpm@10 --activate\r
12886
+ - pnpm config set store-dir .pnpm-store\r
12887
+ - pnpm install --frozen-lockfile\r
12888
+ - pnpm approve-builds --all\r
12889
+ - pnpm run build\r
12890
+ \r
12891
+ # ------------------------------------------------------------------------------\r
12892
+ # Stage 1: Pre-flight and Quality Gates Verification\r
12893
+ # ------------------------------------------------------------------------------\r
12894
+ quality-gates:\r
12895
+ stage: validate\r
12896
+ rules:\r
12897
+ - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'\r
12898
+ - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'\r
12899
+ - if: '$CI_COMMIT_BRANCH =~ /^release\\/.*/'\r
12900
+ script:\r
12901
+ - npx @aisdlc/cli check\r
12902
+ \r
12903
+ # ------------------------------------------------------------------------------\r
12904
+ # Stage 2: Unit Test Suite & Full Verification\r
12905
+ # ------------------------------------------------------------------------------\r
12906
+ test-and-verify:\r
12907
+ stage: test\r
12908
+ rules:\r
12909
+ - if: '$CI_PIPELINE_SOURCE == "merge_request_event"'\r
12910
+ - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'\r
12911
+ - if: '$CI_COMMIT_BRANCH =~ /^release\\/.*/'\r
12912
+ script:\r
12913
+ - pnpm test\r
12914
+ - npx @aisdlc/cli verify all\r
12915
+ \r
12916
+ # ------------------------------------------------------------------------------\r
12917
+ # Stage 3: Post-Merge SDD Canonical Integration\r
12918
+ # ------------------------------------------------------------------------------\r
12919
+ sdd-canonical-integration:\r
12920
+ stage: integrate\r
12921
+ rules:\r
12922
+ - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH && $CI_PIPELINE_SOURCE == "push"'\r
12923
+ - if: '$CI_COMMIT_BRANCH =~ /^release\\/.*/ && $CI_PIPELINE_SOURCE == "push"'\r
12924
+ - if: '$CI_PIPELINE_SOURCE == "web"'\r
12925
+ variables:\r
12926
+ GIT_STRATEGY: clone\r
12927
+ GIT_DEPTH: 0\r
12928
+ script:\r
12929
+ - npx @aisdlc/cli sdd integrate --auto || true\r
12930
+ - |\r
12931
+ git config user.name "gitlab-ci-bot"\r
12932
+ git config user.email "gitlab-ci-bot@noreply.gitlab.com"\r
12933
+ git add -A\r
12934
+ if ! git diff --cached --quiet; then\r
12935
+ git commit -m "chore(sdd): integrate changes into canonical baseline [skip ci]"\r
12936
+ git push "https://oauth2:\${CI_JOB_TOKEN}@\${CI_SERVER_HOST}/\${CI_PROJECT_PATH}.git" "HEAD:\${CI_COMMIT_BRANCH}"\r
12937
+ echo "\u2714 Canonical integration synchronized in GitLab."\r
12938
+ else\r
12939
+ echo "\u2139 No pending changes generated."\r
12940
+ fi\r
12941
+ `;
12942
+ var STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML = `# ==============================================================================\r
12943
+ # AI-SDLC: Azure DevOps Pipelines Template\r
12944
+ # Continuous Quality Gates verification and canonical promotion of SDD changes\r
12945
+ # ==============================================================================\r
12946
+ \r
12947
+ trigger:\r
12948
+ branches:\r
12949
+ include:\r
12950
+ - main\r
12951
+ - release/*\r
12952
+ \r
12953
+ pr:\r
12954
+ branches:\r
12955
+ include:\r
12956
+ - main\r
12957
+ - release/*\r
12958
+ \r
12959
+ pool:\r
12960
+ vmImage: 'ubuntu-latest'\r
12961
+ \r
12962
+ stages:\r
12963
+ - stage: ValidateAndTest\r
12964
+ displayName: 'Verification & Quality Gates'\r
12965
+ jobs:\r
12966
+ - job: QualityAndTests\r
12967
+ displayName: 'Quality Gates, Linting & Tests'\r
12968
+ steps:\r
12969
+ - task: NodeTool@0\r
12970
+ inputs:\r
12971
+ versionSpec: '20.x'\r
12972
+ displayName: 'Install Node.js 20'\r
12973
+ \r
12974
+ - script: |\r
12975
+ corepack enable\r
12976
+ corepack prepare pnpm@10 --activate\r
12977
+ pnpm install --frozen-lockfile\r
12978
+ pnpm approve-builds --all\r
12979
+ pnpm run build\r
12980
+ displayName: 'Install dependencies and build monorepo'\r
12981
+ \r
12982
+ - script: |\r
12983
+ npx @aisdlc/cli check\r
12984
+ displayName: 'Run AI-SDLC pre-flight (check)'\r
12985
+ \r
12986
+ - script: |\r
12987
+ pnpm test\r
12988
+ displayName: 'Run unit test suite'\r
12989
+ \r
12990
+ - script: |\r
12991
+ npx @aisdlc/cli verify all\r
12992
+ displayName: 'Run Full Release Gate (verify all)'\r
12993
+ \r
12994
+ - stage: CanonicalIntegration\r
12995
+ displayName: 'Post-Merge SDD Canonical Integration'\r
12996
+ dependsOn: ValidateAndTest\r
12997
+ condition: and(succeeded(), in(variables['Build.SourceBranch'], 'refs/heads/main', 'refs/heads/release/'))\r
12998
+ jobs:\r
12999
+ - job: SddPromote\r
13000
+ displayName: 'Consolidate canonical SDD specifications'\r
13001
+ steps:\r
13002
+ - checkout: self\r
13003
+ persistCredentials: true\r
13004
+ fetchDepth: 0\r
13005
+ \r
13006
+ - task: NodeTool@0\r
13007
+ inputs:\r
13008
+ versionSpec: '20.x'\r
13009
+ displayName: 'Install Node.js 20'\r
13010
+ \r
13011
+ - script: |\r
13012
+ corepack enable\r
13013
+ corepack prepare pnpm@10 --activate\r
13014
+ pnpm install --frozen-lockfile\r
13015
+ pnpm approve-builds --all\r
13016
+ pnpm run build\r
13017
+ displayName: 'Install dependencies'\r
13018
+ \r
13019
+ - script: |\r
13020
+ npx @aisdlc/cli sdd integrate --auto || true\r
13021
+ name: SddIntegrate\r
13022
+ displayName: 'Detect and integrate SDD increment'\r
13023
+ \r
13024
+ - script: |\r
13025
+ git config user.name "azure-pipelines[bot]"\r
13026
+ git config user.email "azure-pipelines[bot]@dev.azure.com"\r
13027
+ git add -A\r
13028
+ if ! git diff --cached --quiet; then\r
13029
+ git commit -m "chore(sdd): integrate changes into canonical baseline [skip ci]"\r
13030
+ git push origin HEAD:$(Build.SourceBranchName)\r
13031
+ echo "\u2714 Canonical integration synchronized in Azure DevOps."\r
13032
+ else\r
13033
+ echo "\u2139 No modifications generated in working tree."\r
13034
+ fi\r
13035
+ displayName: 'Synchronize canonical changes to repository'\r
13036
+ `;
13037
+ var STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML = `# ==============================================================================\r
13038
+ # AI-SDLC: Bitbucket Pipelines Template\r
13039
+ # Continuous Quality Gates verification and canonical promotion of SDD changes\r
13040
+ # ==============================================================================\r
13041
+ \r
13042
+ image: node:20\r
13043
+ \r
13044
+ definitions:\r
13045
+ caches:\r
13046
+ pnpm: $BITBUCKET_CLONE_DIR/.pnpm-store\r
13047
+ steps:\r
13048
+ - step: &build-and-verify\r
13049
+ name: Quality Gates & Verification\r
13050
+ caches:\r
13051
+ - pnpm\r
13052
+ script:\r
13053
+ - corepack enable\r
13054
+ - corepack prepare pnpm@10 --activate\r
13055
+ - pnpm config set store-dir $BITBUCKET_CLONE_DIR/.pnpm-store\r
13056
+ - pnpm install --frozen-lockfile\r
13057
+ - pnpm approve-builds --all\r
13058
+ - pnpm run build\r
13059
+ - npx @aisdlc/cli check\r
13060
+ - pnpm test\r
13061
+ - npx @aisdlc/cli verify all\r
13062
+ \r
13063
+ - step: &sdd-integrate\r
13064
+ name: SDD Canonical Integration\r
13065
+ caches:\r
13066
+ - pnpm\r
13067
+ script:\r
13068
+ - corepack enable\r
13069
+ - corepack prepare pnpm@10 --activate\r
13070
+ - pnpm config set store-dir $BITBUCKET_CLONE_DIR/.pnpm-store\r
13071
+ - pnpm install --frozen-lockfile\r
13072
+ - pnpm approve-builds --all\r
13073
+ - pnpm run build\r
13074
+ - npx @aisdlc/cli sdd integrate --auto || true\r
13075
+ - |\r
13076
+ git config user.name "bitbucket-pipelines[bot]"\r
13077
+ git config user.email "pipelines[bot]@bitbucket.org"\r
13078
+ git add -A\r
13079
+ if ! git diff --cached --quiet; then\r
13080
+ git commit -m "chore(sdd): integrate changes into canonical baseline [skip ci]"\r
13081
+ git push origin HEAD:$BITBUCKET_BRANCH\r
13082
+ echo "\u2714 Canonical integration synchronized in Bitbucket."\r
13083
+ fi\r
13084
+ \r
13085
+ pipelines:\r
13086
+ pull-requests:\r
13087
+ '**':\r
13088
+ - step: *build-and-verify\r
13089
+ \r
13090
+ branches:\r
13091
+ main:\r
13092
+ - step: *build-and-verify\r
13093
+ - step: *sdd-integrate\r
13094
+ 'release/*':\r
13095
+ - step: *build-and-verify\r
13096
+ - step: *sdd-integrate\r
13097
+ `;
13098
+ var STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML = "name: CI - AI-SDLC Quality Gates & Testing\n\non:\n push:\n branches: [ main ]\n pull_request:\n branches: [ main ]\n\njobs:\n verify-and-test:\n runs-on: ubuntu-latest\n strategy:\n matrix:\n node-version: [ 18.x, 20.x, 22.x ]\n\n steps:\n - name: Checkout Code\n uses: actions/checkout@v4\n\n - name: Install pnpm\n uses: pnpm/action-setup@v4\n with:\n version: 10\n\n - name: Setup Node.js ${{ matrix.node-version }}\n uses: actions/setup-node@v4\n with:\n node-version: ${{ matrix.node-version }}\n cache: 'pnpm'\n\n - name: Install Dependencies\n run: |\n pnpm install --frozen-lockfile\n pnpm approve-builds --all\n\n - name: Build Packages\n run: pnpm run build\n\n - name: Run Vitest Unit & Integration Suites\n run: pnpm test\n\n - name: AI-SDLC Quality Gate & Full Verification\n run: npx @aisdlc/cli verify all\n";
13099
+ var STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML = 'name: Deploy AI-SDLC Dashboard to GitHub Pages\n\non:\n push:\n branches:\n - main\n workflow_dispatch:\n\npermissions:\n contents: read\n pages: write\n id-token: write\n\nconcurrency:\n group: pages\n cancel-in-progress: false\n\njobs:\n deploy-dashboard:\n name: Build & Publish Interactive Dashboard\n runs-on: ubuntu-latest\n environment:\n name: github-pages\n url: ${{ steps.deployment.outputs.page_url }}\n\n steps:\n - name: Checkout Code\n uses: actions/checkout@v4\n with:\n fetch-depth: 0 # Full git history required for historical KPIs and telemetry\n\n - name: Setup Node.js\n uses: actions/setup-node@v4\n with:\n node-version: 20\n\n - name: Generate AI-SDLC Interactive Dashboard\n run: |\n mkdir -p reports\n npx --yes @aisdlc/cli report dashboard --output reports/index.html\n cp reports/index.html reports/dashboard.html\n touch reports/.nojekyll\n\n - name: Setup GitHub Pages\n uses: actions/configure-pages@v5\n\n - name: Upload Pages Artifact\n uses: actions/upload-pages-artifact@v3\n with:\n path: reports\n\n - name: Deploy to GitHub Pages\n id: deployment\n uses: actions/deploy-pages@v4\n\n - name: Emit Summary to GitHub Actions\n if: always() && steps.deployment.outcome == \'success\'\n run: |\n echo "### \u{1F310} AI-SDLC Interactive Dashboard Published" >> $GITHUB_STEP_SUMMARY\n echo "" >> $GITHUB_STEP_SUMMARY\n echo "The interactive PDaC / RTM graph, Quality Gate telemetry, and release metrics are live at:" >> $GITHUB_STEP_SUMMARY\n echo "" >> $GITHUB_STEP_SUMMARY\n echo "\u{1F449} **[Open Live Dashboard](${{ steps.deployment.outputs.page_url }})**" >> $GITHUB_STEP_SUMMARY\n';
13100
+ var STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML = "name: AI-SDLC PR KPI Aggregator\n\non:\n pull_request:\n types: [opened, synchronize, reopened]\n\npermissions:\n contents: read\n pull-requests: write\n\njobs:\n aggregate-kpis:\n name: Aggregate PR KPIs & Telemetry\n runs-on: ubuntu-latest\n\n steps:\n - name: Checkout Repository\n uses: actions/checkout@v4\n with:\n fetch-depth: 0\n\n - name: Install pnpm\n uses: pnpm/action-setup@v4\n with:\n version: 10\n\n - name: Setup Node.js\n uses: actions/setup-node@v4\n with:\n node-version: 20\n cache: 'pnpm'\n\n - name: Install Dependencies\n run: |\n pnpm install --frozen-lockfile\n\n - name: Calculate and Emit PR KPIs\n id: kpi\n run: |\n npx @aisdlc/cli kpi pr --base origin/${{ github.base_ref }} --head HEAD >> $GITHUB_STEP_SUMMARY\n";
13101
+ var STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML = `name: SDD Canonical Integration on Merge\r
13102
+ \r
13103
+ on:\r
13104
+ pull_request:\r
13105
+ types: [closed]\r
13106
+ branches:\r
13107
+ - main\r
13108
+ - 'release/**'\r
13109
+ workflow_dispatch:\r
13110
+ inputs:\r
13111
+ change_id:\r
13112
+ description: 'SDD change ID to integrate manually (e.g. chg-001-telemetry)'\r
13113
+ required: false\r
13114
+ type: string\r
13115
+ \r
13116
+ permissions:\r
13117
+ contents: write\r
13118
+ pull-requests: read\r
13119
+ \r
13120
+ concurrency:\r
13121
+ group: sdd-integrate-\${{ github.ref }}\r
13122
+ cancel-in-progress: false\r
13123
+ \r
13124
+ jobs:\r
13125
+ integrate-sdd:\r
13126
+ name: SDD Canonical Integration\r
13127
+ if: github.event.pull_request.merged == true || github.event_name == 'workflow_dispatch'\r
13128
+ runs-on: ubuntu-latest\r
13129
+ \r
13130
+ steps:\r
13131
+ - name: Checkout Repository\r
13132
+ uses: actions/checkout@v4\r
13133
+ with:\r
13134
+ ref: \${{ github.event.pull_request.base.ref || github.ref_name }}\r
13135
+ fetch-depth: 0\r
13136
+ token: \${{ secrets.GITHUB_TOKEN }}\r
13137
+ \r
13138
+ - name: Install pnpm\r
13139
+ uses: pnpm/action-setup@v4\r
13140
+ with:\r
13141
+ version: 10\r
13142
+ \r
13143
+ - name: Setup Node.js\r
13144
+ uses: actions/setup-node@v4\r
13145
+ with:\r
13146
+ node-version: 20\r
13147
+ cache: 'pnpm'\r
13148
+ \r
13149
+ - name: Install Dependencies\r
13150
+ run: |\r
13151
+ pnpm install --frozen-lockfile\r
13152
+ pnpm approve-builds --all\r
13153
+ \r
13154
+ - name: Build Packages\r
13155
+ run: pnpm run build\r
13156
+ \r
13157
+ - name: Detect and Integrate SDD Change\r
13158
+ id: integrate\r
13159
+ env:\r
13160
+ PR_HEAD_REF: \${{ github.event.pull_request.head.ref }}\r
13161
+ PR_TITLE: \${{ github.event.pull_request.title }}\r
13162
+ PR_BODY: \${{ github.event.pull_request.body }}\r
13163
+ MANUAL_CHANGE_ID: \${{ github.event.inputs.change_id }}\r
13164
+ run: |\r
13165
+ npx @aisdlc/cli sdd integrate --auto || true\r
13166
+ \r
13167
+ - name: Commit and Push Canonical Baseline Changes\r
13168
+ run: |\r
13169
+ git config user.name "github-actions[bot]"\r
13170
+ git config user.email "github-actions[bot]@users.noreply.github.com"\r
13171
+ git add -A\r
13172
+ if ! git diff --cached --quiet; then\r
13173
+ git commit -m "chore(sdd): integrate changes into canonical baseline [skip ci]"\r
13174
+ git push\r
13175
+ echo "\u2714 Canonical integration committed and synchronized to repository."\r
13176
+ else\r
13177
+ echo "\u2139 No pending changes generated in working tree."\r
13178
+ fi\r
13179
+ `;
13180
+ var STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD = '---\r\nid: REQ-LIC-ACQUISITION-001\r\ntype: license-acquisition-request\r\ntitle: Commercial License Acquisition Request for [Library]\r\nstatus: pending-approval # pending-approval, approved, rejected\r\nrequested-package: "@vendor/commercial-package"\r\nspdx-license: "BSL-1.1" # or Commercial, SSPL-1.0\r\nlicense-category: commercial_acquisition_required\r\nestimated-cost: "$1,200 / year"\r\nbusiness-justification: "Accelerates critical telemetry module development avoiding 4 months of in-house implementation."\r\n---\r\n\r\n# Commercial License Acquisition Request\r\n\r\n## 1. Package and Vendor\r\n- **Package**: `@vendor/commercial-package`\r\n- **Version**: `2.4.0`\r\n- **License Type**: BSL 1.1 / Commercial\r\n- **Official Website**: `https://vendor.example.com`\r\n\r\n## 2. Technical Justification and Evaluated Alternatives\r\n- **Why a permissive alternative (MIT/Apache 2.0) is not used**:\r\n - Open-source alternatives lack required hardware encryption protocol support.\r\n- **Impact of not acquiring the license**:\r\n - 4-month delay on product delivery milestone.\r\n\r\n## 3. Human Authorization Signatures\r\n- [ ] Tech Lead: Technical approval\r\n- [ ] Legal / IP Counsel: EULA clauses validation\r\n- [ ] Procurement / Budget Owner: Payment authorization\r\n';
13181
+ var STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD = '---\r\nid: MAN-PROD-001\r\ntype: production-manual\r\ntitle: "Production & Operations Manual: Application Name"\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\napplies-to-version: "v1.0.0"\r\ntarget-audience:\r\n - devops-engineer\r\n - sre-engineer\r\n - release-manager\r\n - secops\r\ncomponents-covered:\r\n - CMP-NAME-001\r\nenclaves-involved:\r\n - SEC-ENC-DMZ-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# MAN-PROD-001: Production & Operations Manual - Application Name\r\n\r\n## 1. Deterministic Release Regeneration (Reproducible Builds)\r\n\r\nThis section contains the specifications and directives required to deterministically reproduce identical bit-by-bit application artifacts or releases from their Git tag.\r\n\r\n### 1.1 Source Code Baseline\r\n\r\n- **Canonical Repository**: `https://github.com/organization/repo-name.git`\r\n- **Immutable Git Release Tag**: `v1.0.0`\r\n- **Commit SHA-256 / SHA-1**: `[VERIFIED_HEXADECIMAL_COMMIT_SHA]`\r\n- **Clean Checkout Command**:\r\n ```bash\r\n git clone --recurse-submodules https://github.com/organization/repo-name.git\r\n cd repo-name\r\n git checkout tags/v1.0.0\r\n git submodule update --init --recursive\r\n ```\r\n\r\n### 1.2 Frozen Toolchains and Build Tool Matrix\r\n\r\nTo prevent discrepancies in binary or package generation, strict usage of pinned versions of the following utilities is enforced:\r\n\r\n| Tool / Runtime | Exact Version | Toolchain Checksum / Digest | Purpose |\r\n| :--- | :--- | :--- | :--- |\r\n| **Node.js LTS** | `v22.12.0` | `sha256:node-v22.12.0-linux-x64.tar.xz` | Execution and transpilation runtime |\r\n| **pnpm** | `9.15.0` | `sha256:pnpm-v9.15.0` | Deterministic monorepo package manager |\r\n| **TypeScript (tsc)** | `5.7.2` | Pinned in `devDependencies` | Strict ECMAScript compiler |\r\n| **Docker BuildKit** | `v0.18.0` | `moby/buildkit:v0.18.0` | Hermetic OCI packaging engine |\r\n\r\n### 1.3 Libraries, Dependencies, and Vertex Graph\r\n\r\n- **Immutable Lockfile**: `pnpm-lock.yaml` (or `Cargo.lock`, `go.sum`, `requirements.lock`). Installations with open resolution are forbidden (`pnpm install --frozen-lockfile` mandatory).\r\n- **SBOM (Software Bill of Materials) Inventory**:\r\n - Format: CycloneDX JSON v1.5 / SPDX v2.3.\r\n - Compiled SBOM path: `reports/sbom-cyclonedx.json`.\r\n- **OSS License Governance**:\r\n - Binding policy: `license-policy.yaml`.\r\n - Library vertex pre-verification:\r\n ```bash\r\n pnpm verify:licenses\r\n ```\r\n\r\n### 1.4 Step-by-Step Deterministic Build Procedure\r\n\r\n1. **Step 1: Hermetic Dependency Installation**\r\n ```bash\r\n pnpm install --frozen-lockfile --ignore-scripts\r\n ```\r\n\r\n2. **Step 2: Integrity and Strict Type Checking**\r\n ```bash\r\n pnpm typecheck\r\n ```\r\n\r\n3. **Step 3: Artifact Compilation**\r\n ```bash\r\n export SOURCE_DATE_EPOCH=$(git log -1 --pretty=%ct)\r\n pnpm build\r\n ```\r\n\r\n4. **Step 4: Cryptographic Verification of Generated Artifact**\r\n ```bash\r\n sha256sum dist/app.bundle.js\r\n # Compare against the canonical checksum registered in official release:\r\n # Expected: [CANONICAL_SHA256_CHECKSUM]\r\n ```\r\n\r\n---\r\n\r\n## 2. Version, Infrastructure, and Migration Compatibility Matrix\r\n\r\nThis section defines technical interoperability boundaries between the release version and the deployment ecosystem, ensuring safe Zero-Downtime transitions.\r\n\r\n### 2.1 Platform and Execution Runtime Compatibility\r\n\r\n| Infrastructure Component | Approved Version Range | Recommended Version | Support Status |\r\n| :--- | :--- | :--- | :---: |\r\n| **Kubernetes Cluster (K8s)** | `>= 1.28` and `<= 1.31` | `1.30.2` | \u2705 Certified |\r\n| **Container Runtime (CRI)** | containerd `>= 1.7` / CRI-O `>= 1.28` | containerd `1.7.15` | \u2705 Certified |\r\n| **Base Operating System (Host)** | Ubuntu 22.04 LTS / RHEL 9.2+ | Ubuntu 22.04 LTS (Kernel 6.x) | \u2705 Homologated |\r\n| **Language Runtime (Production)** | Node.js `>= 20.x` and `<= 22.x` | `v22.12.0 LTS` | \u2705 Hermetic |\r\n\r\n### 2.2 Data Schema and Migration Compatibility (N-1 Support)\r\n\r\nTo enable Canary or Blue-Green continuous deployments without transaction loss:\r\n\r\n| Release Version | DB Schema Version | Compatible with $N-1$ Code | Schema Migration Status |\r\n| :---: | :---: | :---: | :--- |\r\n| **`v1.0.0`** (Current) | `SCHEMA-v1.0` | \u2705 Yes (supports `v0.9.x` code) | Non-destructive additive migration (no column renaming). |\r\n| **`v0.9.x`** | `SCHEMA-v0.9` | \u2705 Previous baseline | Fully compatible during Canary drain period. |\r\n\r\n### 2.3 Interoperability Between Architecture Components (`CMP-*`)\r\n\r\n| Dependent Component | Consumed Component | Minimum Compatible Versions | Binding Protocol / Contract |\r\n| :--- | :--- | :---: | :--- |\r\n| `CMP-NAME-001` (Gateway) | `CMP-NAME-002` (Backend) | `>= v1.0.0` | gRPC / Protobuf v3 (`contract_spec.proto`) |\r\n| `CMP-NAME-001` (Gateway) | Messaging Bus / Kafka | `>= 3.5.0` | Kafka v2 Protocol with TLS mTLS |\r\n\r\n### 2.4 Homologated Upgrade & Rollback Paths\r\n\r\n| Source Version | Direct Jump to `v1.0.0` | Intermediate Migration Required | Direct Rollback Procedure |\r\n| :---: | :---: | :---: | :---: |\r\n| **`v0.9.1`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`v0.9.0`** | \u2705 Allowed | \u274C Not required | `kubectl rollout undo` without data loss. |\r\n| **`< v0.9.0`** | \u274C Blocked | \u2705 Must upgrade to `v0.9.1` first | Requires restore from backup snapshot. |\r\n\r\n---\r\n\r\n## 3. CI/CD Architecture and Pipelines\r\n\r\n### 3.1 Hierarchical Branching Model and Integration Triggers\r\n\r\nFollowing the AI-SDLC 4-tier standard:\r\n\r\n```text\r\nTIER 1: main (Production)\r\n \u25B2\r\n \u2514\u2500\u2500 PR Release Gate (Manual Tech Lead / Release Manager Approval)\r\n \u2502\r\nTIER 2: release/v1.0.0 (Open Version Branch)\r\n \u25B2\r\n \u2514\u2500\u2500 PR Feature Gate (Lint + Tests + Quality Gate + SAST + SBOM)\r\n \u2502\r\nTIER 3: feat/CHG-001-* (Feature / Bug)\r\n```\r\n\r\n- **Pull Request Trigger**: Executes linters, full test battery, and governance verifications without deployment.\r\n- **Release Tag Trigger (`v*.*.*`)**: Executes the full hermetic build pipeline, image signing, and continuous deployment.\r\n\r\n### 3.2 CI/CD Pipeline Flowchart\r\n\r\n```mermaid\r\nflowchart LR\r\n A["Git Push / Tag v1.0.0"] --> B["Hermetic Checkout"]\r\n B --> C["Linters & Typecheck"]\r\n C --> D["Vitest: Unit & BDD"]\r\n D --> E["Quality Gate: CC & MI"]\r\n E --> F["SAST & Secret Scan"]\r\n F --> G["SBOM & License Gate"]\r\n G --> H["Deterministic Build"]\r\n H --> I["Cosign / SLSA Signing"]\r\n I --> J["Push to OCI Registry"]\r\n J --> K["Deploy to DMZ Enclave"]\r\n```\r\n\r\n### 3.3 Release Gate Contracts and Thresholds\r\n\r\n| Quality Gate | Tool / Command | Required Threshold | Action on Non-Compliance |\r\n| :--- | :--- | :--- | :--- |\r\n| **Lint & Typecheck** | `pnpm typecheck` | Zero errors, zero `any` | **Immediate failure** |\r\n| **Automated Tests** | `pnpm test:all` | 100% passed, Coverage >= 85% | **Immediate failure** |\r\n| **Cyclomatic Complexity** | `aisdlc verify quality` | CC <= 10 per function | **Release blocked** |\r\n| **Maintainability Index** | `aisdlc verify quality` | MI >= 50.0 / 100 | **Release blocked** |\r\n| **360\xB0 Traceability** | `aisdlc verify traceability` | 100% of requirements linked | **Release blocked** |\r\n| **OSS Licenses** | `aisdlc verify licenses` | Zero forbidden/viral licenses | **Release blocked** |\r\n| **Cryptographic Signature** | `cosign verify` | Valid signature from Corporate CA | **Deployment rejected** |\r\n\r\n---\r\n\r\n## 4. Production Deployment Strategy and Procedure\r\n\r\n### 4.1 Infrastructure Prerequisites and Network Enclaves\r\n\r\n- **Target Enclave**: `SEC-ENC-DMZ-001` (Strict segmentation without direct uncontrolled outbound internet access).\r\n- **Enabled Network Ports**:\r\n - Port `8443/TCP`: Secure WebSocket ingestion with mutual TLS (mTLS) authentication.\r\n - Port `9090/TCP`: Prometheus metrics (internal management network only).\r\n- **Secrets and Certificate Management**:\r\n - Server TLS and client root CA certificates mounted via immutable secret at `/etc/pki/tls/`.\r\n - Embedding cryptographic keys in environment variables or images is strictly forbidden.\r\n\r\n### 4.2 Rollout Strategy\r\n\r\nA **Canary strategy with progressive telemetry metrics analysis** is utilized:\r\n1. 10% of traffic is routed to the new version for 15 minutes.\r\n2. If the 5xx error rate is `<= 0.01%` and p99 latency is `<= 50ms`, traffic is promoted to 100%.\r\n\r\n### 4.3 Step-by-Step Deployment Procedure\r\n\r\n1. **Step 1: Pre-deployment and State Snapshot**\r\n ```bash\r\n # Check cluster health and record baseline\r\n kubectl get pods -n production -l app=system\r\n kubectl exec -it system-db-0 -- /backup/create-snapshot.sh\r\n ```\r\n\r\n2. **Step 2: Deployment Manifest Application**\r\n ```bash\r\n kubectl apply -f deploy/production/canary-deployment.yaml\r\n kubectl rollout status deployment/system-service -n production --timeout=180s\r\n ```\r\n\r\n3. **Step 3: Health Verification and Smoke Tests**\r\n ```bash\r\n curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/healthz\r\n curl -f --cacert /etc/pki/tls/ca.crt https://127.0.0.1:8443/readyz\r\n pnpm test:example\r\n ```\r\n\r\n### 4.4 Rollback Plan (Immediate Rollback)\r\n\r\n- **Objective Rollback Activation Criteria**:\r\n - mTLS handshake failure rate `> 1.0%`.\r\n - Ingestion p99 latency `> 100ms` for 2 continuous minutes.\r\n - Critical `CrashLoopBackOff` alert on more than 20% of instances.\r\n- **Rollback Execution Command**:\r\n ```bash\r\n kubectl rollout undo deployment/system-service -n production\r\n kubectl rollout status deployment/system-service -n production\r\n ```\r\n\r\n---\r\n\r\n## 5. Likely Errors Resolution and Troubleshooting (Runbooks)\r\n\r\nThis section documents the most frequent runtime and deployment failures along with diagnosis and immediate mitigation procedures.\r\n\r\n### 5.1 Frequent Incidents and Solutions Matrix\r\n\r\n#### Incident 1: Dependency Vertex Inconsistency or Drift (Build Failure)\r\n- **Symptom**: `pnpm install --frozen-lockfile` command fails in CI with error `ERR_PNPM_LOCKFILE_OUTDATED`.\r\n- **Root Cause**: `package.json` was modified without updating `pnpm-lock.yaml`.\r\n- **Diagnosis**:\r\n ```bash\r\n git diff HEAD^ package.json pnpm-lock.yaml\r\n ```\r\n- **Mitigation**:\r\n 1. On the feature branch, run `pnpm install` locally to regenerate the deterministic lockfile.\r\n 2. Verify no restricted-license dependencies were introduced via `pnpm verify:licenses`.\r\n 3. Commit both files together in an atomic commit.\r\n\r\n---\r\n\r\n#### Incident 2: mTLS Handshake Failure or Enclave Certificate Rejected\r\n- **Symptom**: Clients receive error `ERR_TLS_CERT_ALTNAME_INVALID` or connection closed with TLS alert `certificate_unknown (46)`.\r\n- **Root Cause**: Internal root CA mounted on server does not match the client certificate issuer CA, or certificate expired.\r\n- **Diagnosis**:\r\n ```bash\r\n openssl s_client -connect 127.0.0.1:8443 -CAfile /etc/pki/tls/ca.crt -cert /etc/pki/tls/client.crt -key /etc/pki/tls/client.key\r\n openssl x509 -in /etc/pki/tls/ca.crt -noout -dates -issuer -subject\r\n ```\r\n- **Mitigation**:\r\n 1. Verify expiration date of certificate mounted in cluster Secret.\r\n 2. If expired, rotate the certificate by injecting the new pair from HSM / Vault storage.\r\n 3. Orderly restart pods with `kubectl rollout restart deployment/system-service`.\r\n\r\n---\r\n\r\n#### Incident 3: Release Gate Rejection in CI/CD Due to Quality Metrics\r\n- **Symptom**: Pipeline aborts with verdict `Quality Gate REJECTED` (Cyclomatic Complexity > 10 or Maintainability < 50).\r\n- **Root Cause**: Introduction of complex nested logic (multiple `if/else`, extensive `switch`, or branching loops).\r\n- **Diagnosis**:\r\n ```bash\r\n pnpm verify:quality\r\n ```\r\n- **Mitigation**:\r\n 1. Inspect the violation report in `reports/QUALITY_GATE_REPORT.md` to identify the offending function.\r\n 2. Decompose function into cohesive private helper methods following the rule of maximum 40 lines per function.\r\n 3. Re-run `pnpm verify:quality` until green verdict is confirmed. Adding suppression comments (`// @ts-ignore`) is forbidden.\r\n\r\n---\r\n\r\n#### Incident 4: CrashLoopBackOff Due to Memory Leak or Connection Limit\r\n- **Symptom**: Pod is terminated with exit code `ExitCode: 137` (`OOMKilled`) after a load spike.\r\n- **Root Cause**: Undrained socket buffer accumulation during high-frequency bursts.\r\n- **Diagnosis**:\r\n ```bash\r\n kubectl describe pod system-service-xxx -n production | grep -i oom\r\n kubectl logs system-service-xxx -n production --previous\r\n ```\r\n- **Mitigation**:\r\n 1. Temporarily adjust memory limits in Kubernetes manifest (`resources.limits.memory`) if the load burst is legitimate.\r\n 2. Apply backpressure or discard expired packets in accordance with business rules (`BR-*`).\r\n 3. Run local benchmark with `pnpm test:all` to audit memory consumption.\r\n\r\n---\r\n\r\n### 5.2 Escalation Protocol and Critical Incident Management\r\n\r\n| Severity Level | Impact Criterion | Maximum Response Time | Roles Involved |\r\n| :--- | :--- | :---: | :--- |\r\n| **SEV-1 (Critical)** | Complete service outage or security breach in enclave. | 15 minutes | On-call SRE + Lead Architect + SecOps |\r\n| **SEV-2 (Major)** | Severe service degradation, massive retries without outage. | 1 hour | On-call SRE + Tech Lead |\r\n| **SEV-3 (Minor)** | Isolated node incident without global SLA impact. | 4 hours | Support Engineer / DevOps |\r\n\r\n---\r\n\r\n## 6. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Operations & DevOps Team | Initial Production Manual generation | CHG-009 |\r\n';
13182
+ var STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD = '---\r\nid: MAN-USER-001\r\ntype: user-manual\r\ntitle: "User Manual: Application Name"\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\napplies-to-version: "v1.0.0"\r\ntarget-audience:\r\n - ACT-ROLE-USER-001\r\n - ACT-OPERATOR-002\r\nallowed-roles:\r\n - ACT-ROLE-USER-001\r\n - ACT-OPERATOR-002\r\njourneys-covered:\r\n - JRN-JOURNEY-001\r\nuse-cases-covered:\r\n - UC-ACTION-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# MAN-USER-001: User Manual - Application Name\r\n\r\n## 1. System Purpose and Audience\r\n\r\nConcisely describes the software\'s purpose, the operational value it delivers to end users, and the general context in which it operates.\r\n\r\n- **Application / System**: `[System Name or Bounded Context]`\r\n- **Software Version**: `v1.0.0`\r\n- **Target Audience**: `[Functional roles and user profiles addressed]`\r\n\r\n---\r\n\r\n## 2. User Role Catalog and Permissions Matrix (RBAC)\r\n\r\nThis section formally defines the roles authorized to access and operate the application, as well as the privileges assigned to each.\r\n\r\n### 2.1 Authorized Role Catalog\r\n\r\n| Role Identifier | Role Name | Associated Actor | Description & Responsibility | Enclave / Access Level |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **`ROLE_USER`** | Standard User | `ACT-ROLE-USER-001` | Data queries and nominal business flow execution. | Corporate Network / Web UI |\r\n| **`ROLE_OPERATOR`** | System Operator | `ACT-OPERATOR-002` | Streaming supervision, alert management, and command control. | DMZ Enclave / Operational Console |\r\n\r\n### 2.2 Access and Capabilities Matrix by Role\r\n\r\n| Application Capability / Module | `ROLE_USER` | `ROLE_OPERATOR` | Authentication Mode |\r\n| :--- | :---: | :---: | :--- |\r\n| Status Query and Dashboard Visualizations | \u2705 Allowed | \u2705 Allowed | Bearer Token (OIDC/JWT) |\r\n| Business Journey Execution (`JRN-JOURNEY-001`) | \u2705 Allowed | \u2705 Allowed | Bearer Token (OIDC/JWT) |\r\n| Real-Time Streaming and Operational Control | \u274C Denied | \u2705 Allowed | mTLS + Device X.509 Certificate |\r\n| Global Parameters Configuration & Connectivity | \u274C Denied | \u2705 Allowed | Administrator Credential |\r\n\r\n---\r\n\r\n## 3. Version and User Platform Compatibility Matrix\r\n\r\nThis section specifies cross-compatibility between the current application version and user environments, clients, and formats.\r\n\r\n### 3.1 Client-Server Compatibility (APIs and SDKs)\r\n\r\n| Application Version (Backend) | Compatible CLI Version | Compatible SDK Version | Compatibility Status | Migration Notes |\r\n| :---: | :---: | :---: | :---: | :--- |\r\n| **`v1.0.0`** (Current) | `>= v1.0.0` | `>= v1.0.0` | \u2705 Fully Supported | Active canonical version. |\r\n| **`v1.0.0`** (Current) | `v0.9.x` | `v0.9.x` | \u26A0\uFE0F Degraded Mode | Requires upgrade before next minor. |\r\n| **`v1.0.0`** (Current) | `< v0.9.0` | `< v0.9.0` | \u274C Incompatible / Deprecated | Legacy endpoints decommissioned. |\r\n\r\n### 3.2 Homologated Browsers and Client Platforms\r\n\r\n| Platform / Environment | Minimum Supported Versions | Support Level | Known Constraints |\r\n| :--- | :--- | :---: | :--- |\r\n| **Google Chrome / Chromium** | Version `>= 120` | Tier 1 (Official) | Optimal WebSockets and WebGL performance. |\r\n| **Mozilla Firefox** | Version `>= 115 ESR` | Tier 1 (Official) | Full client certificate support. |\r\n| **Safari / WebKit** | Version `>= 17.0` | Tier 2 (Functional) | Requires explicit mTLS enablement in macOS Keychain. |\r\n| **Terminal / CLI (Linux / macOS / Windows)** | Node.js `>= 18` or Bash `>= 5.0` | Tier 1 (Official) | Full support on PowerShell 7+ and bash. |\r\n\r\n### 3.3 Configuration Files and Data Formats Compatibility\r\n\r\n| Format / Artifact | Source Version Supported | Automatic Conversion | User Action Required |\r\n| :--- | :---: | :---: | :--- |\r\n| **`config.yaml`** | `v0.9.x` | \u2705 Yes | None. Application migrates deprecated keys on startup. |\r\n| **Export Profiles (`.json`)** | `v0.9.x` | \u2705 Yes | 100% backward compatible. |\r\n\r\n---\r\n\r\n## 4. Application Installation, Access, and Configuration\r\n\r\n### 4.1 Access Channels and Prerequisites\r\n\r\n- **Web Portal / UI**: Access URL (e.g., `https://app.system.internal`).\r\n- **Command Line (CLI)**: Executable binary or package (e.g., `npx system-cli` or `./system-client`).\r\n- **Supported Browsers or Platforms**: Chrome >= 120, Firefox >= 120, Linux/macOS/Windows terminal.\r\n\r\n### 4.2 Client Configuration and Environment Variables\r\n\r\nThe application allows parameterizing its behavior via environment variables or local configuration files:\r\n\r\n| Parameter / Variable | Type | Default Value | Required | Description |\r\n| :--- | :--- | :--- | :---: | :--- |\r\n| `API_ENDPOINT` | URL | `https://api.system.internal/v1` | Yes | Base backend API endpoint. |\r\n| `WS_STREAM_URL` | WSS URL | `wss://stream.system.internal/telemetry` | No | Real-time telemetry or notifications socket. |\r\n| `CLIENT_TIMEOUT_MS` | Integer | `5000` | No | Network response timeout in milliseconds. |\r\n| `AUTH_PROFILE` | String | `production` | No | Active authentication profile (`development`, `staging`, `production`). |\r\n\r\n### 4.3 Local Configuration File (`config.yaml` / `.env`)\r\n\r\nExample recommended configuration for operator workstations:\r\n\r\n```yaml\r\n# Client configuration file: config.yaml\r\nprofile: production\r\nnetwork:\r\n api_endpoint: "https://api.system.internal/v1"\r\n stream_url: "wss://stream.system.internal/telemetry"\r\n timeout_ms: 5000\r\n retry_attempts: 3\r\n\r\nsecurity:\r\n tls_verify: true\r\n client_cert_path: "/etc/pki/client/operator.crt"\r\n client_key_path: "/etc/pki/client/operator.key"\r\n\r\nui:\r\n theme: "dark"\r\n refresh_interval_sec: 1\r\n```\r\n\r\n---\r\n\r\n## 5. Step-by-Step Journey Execution Guide (`JRN-*`)\r\n\r\nEach subsection documents an end-to-end Journey, specifying authorized execution roles, starting conditions, and the step-by-step operating procedure.\r\n\r\n### 5.1 `JRN-JOURNEY-001`: User Journey Name\r\n\r\n- **Linked Use Case**: `UC-ACTION-001`\r\n- **Primary Actor**: `ACT-ROLE-USER-001`\r\n- **Authorized Roles**: `ROLE_USER`, `ROLE_OPERATOR`\r\n- **Required Execution Enclave**: Corporate Intranet or VPN access\r\n\r\n#### A. Preconditions\r\n1. User must have an active and authenticated session with their authorized role.\r\n2. The base entity or resource must be in `ACTIVE` state.\r\n\r\n#### B. Step-by-Step Procedure\r\n\r\n1. **Step 1: Operation Initiation**\r\n - **Action**: User navigates to the execution section or invokes the corresponding command:\r\n ```bash\r\n system-cli execute --journey JRN-JOURNEY-001 --input payload.json\r\n ```\r\n - **Required Input**: Resource identifier and validated parameters.\r\n - **Expected On-Screen Response**: System displays confirmation dialog with operation summary.\r\n\r\n2. **Step 2: Validation and Submission**\r\n - **Action**: User reviews parameters and confirms execution.\r\n - **System Behavior**: Client locally validates data schema and transmits signed request.\r\n\r\n3. **Step 3: Observable Outcome Verification**\r\n - **Success Outcome**: Console / interface displays success message `MSG-SUCCESS-001` with generated unique transaction ID.\r\n - **Final State**: Resource transitions to `PROCESSED` state.\r\n\r\n#### C. Alternative Flows and Exception Handling\r\n- **Unauthorized Access**: If an unauthorized role attempts to invoke the journey, the system blocks the action, outputs code `MSG-ERR-AUTH-403`, and records the access attempt in the audit trail.\r\n- **Connection Loss in Transit**: If connection is lost during step 2, client retries with exponential backoff up to 3 times before notifying user.\r\n\r\n---\r\n\r\n## 6. System Messages Catalog and Response Codes\r\n\r\nStructured matrix of key informational, warning, and error messages emitted by the application during its operational lifecycle:\r\n\r\n| Code | Severity | Literal Screen Message | Trigger / Context | Meaning for User | Recommended Corrective Action |\r\n| :--- | :--- | :--- | :--- | :--- | :--- |\r\n| **`MSG-SYS-100`** | `INFO` | `"Connection established successfully with server"` | Successful network handshake upon initializing session. | Application is online and ready to process commands. | None. Normal operation. |\r\n| **`MSG-SYS-200`** | `INFO` | `"Operation completed successfully. Transaction ID: [TX-ID]"` | Successful completion of a Journey or Use Case. | Transaction was persisted and acknowledged by backend. | Save `TX-ID` for tracking if required. |\r\n| **`MSG-WARN-301`** | `WARN` | `"High link latency (>500ms). Degraded mode active"` | Response metric exceeds real-time threshold. | Screen data may experience slight refresh delays. | Check network connection quality or bandwidth. |\r\n| **`MSG-WARN-302`** | `WARN` | `"Session expiring in 5 minutes"` | Authentication token approaching TTL expiry. | User will be logged out unless credential is refreshed. | Renew session by clicking alert or re-authenticating. |\r\n| **`MSG-ERR-401`** | `ERR-USER` | `"Invalid credentials or expired token. Access denied"` | Login authentication failure or expired token. | User identity could not be validated. | Re-enter credentials or request a new token. |\r\n| **`MSG-ERR-403`** | `ERR-USER` | `"Unauthorized action for assigned role [ROLE]"` | Attempted execution of Journey or command outside RBAC. | User role lacks permissions for this resource. | Contact administrator to request permission expansion. |\r\n| **`MSG-ERR-422`** | `ERR-USER` | `"Invalid payload: field [FIELD] does not match schema"` | Syntactic validation or business rule (`BR-*`) failure. | User-supplied data is invalid. | Correct indicated fields according to business rule. |\r\n| **`MSG-ERR-503`** | `ERR-SYS` | `"Service temporarily unavailable. Retrying..."` | Backend gateway unreachable or under scheduled maintenance. | Central server is not responding to requests. | Await automatic retries or check system status page. |\r\n\r\n---\r\n\r\n## 7. Frequently Asked Questions (FAQ) and Support\r\n\r\n- **What should I do if I lose connectivity while executing a Journey?** \r\n The application implements idempotency mechanisms. Once network connectivity is restored, verify resource status before retrying to prevent duplicate transactions.\r\n- **How do I request a user role change?** \r\n Contact the Security Administrator (`SecOps`) referencing your user ID and operational justification for the role change.\r\n\r\n---\r\n\r\n## 8. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Documentation & Product Team | Initial User Manual generation | CHG-009 |\r\n';
13183
+ var STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD = '---\r\nid: ACT-NAME-001\r\ntype: actor\r\ntitle: Descriptive Actor Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nrole-type: human-user # human-user, ai-agent, external-system, sensor-iot\r\ndescription: One-sentence summary of the role this actor performs in the system.\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# ACT-NAME-001: Descriptive Actor Title\r\n\r\n## 1. Profile and Responsibility\r\nDescribes who this actor is, their operational context, and what goals they pursue when interacting with the product.\r\n\r\n## 2. System Touchpoints\r\n- Interaction channels (Web UI, REST API, WebSocket, Messaging).\r\n- Privilege level and latency/availability expectations.\r\n\r\n---\r\n\r\n## 3. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / Analyst | Initial actor profile creation | CHG-INIT-001 |\r\n';
13184
+ var STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD = '---\r\nid: BR-DOMAIN-001\r\ntype: business-rule\r\ntitle: Business Rule Name\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nenforcement-level: strict-invariant # strict-invariant, override-with-approval, guideline\r\ndefined-in: BC-CONTEXT-001\r\nuses-terms:\r\n - TERM-TERM-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# BR-DOMAIN-001: Business Rule Name\r\n\r\n## 1. Rule Definition\r\nFormally establishes the business invariant that must not be violated under any circumstance.\r\n\r\n## 2. Business Rationale and Consequences\r\n- **Why it exists**: Economic, regulatory, or technical justification for the constraint.\r\n- **Action upon violation**: Immediate transaction rejection with a formal error code.\r\n\r\n---\r\n\r\n## 3. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / Analyst | Initial business rule definition | CHG-INIT-001 |\r\n';
13185
+ var STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD = '---\r\nid: JRN-NAME-001\r\ntype: journey\r\ntitle: Descriptive User or Operator Journey Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\npersona: ACT-OPERATOR-001\r\nstages:\r\n - "Discovery and Planning"\r\n - "Configuration and Pre-flight"\r\n - "Mission Execution"\r\n - "Post-Analysis and Wrap-up"\r\ntouchpoints:\r\n - "Mission planning web portal"\r\n - "Ground control station (GCS)"\r\n - "Real-time telemetry dashboard"\r\n - "Flight report exporter"\r\nrelated-use-cases:\r\n - UC-PLAN-MISSION-001\r\n - UC-MONITOR-FLIGHT-001\r\npain-points:\r\n - "Latency when loading offline navigation maps"\r\n - "Complexity in manual flight plan reconciliation"\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# JRN-NAME-001: Descriptive User or Operator Journey Title\r\n\r\n## 1. Actor / Primary Persona Profile\r\n- **Protagonist Actor**: `ACT-OPERATOR-001`\r\n- **Main Goal**: Complete operational workflow with high efficiency, safety, and real-time visibility.\r\n\r\n---\r\n\r\n## 2. Journey Stages Map\r\n\r\n| Stage | User Goal | Touchpoints | Frictions / Pain Points |\r\n| :--- | :--- | :--- | :--- |\r\n| **1. Discovery and Planning** | Design route and validate operational constraints | Mission planning web portal | Complexity in manual flight plan reconciliation |\r\n| **2. Configuration and Pre-flight** | Verify subsystem health and link integrity | Ground control station (GCS) | Latency when loading offline navigation maps |\r\n| **3. Mission Execution** | Supervise telemetry and respond to alerts | Real-time telemetry dashboard | None detected in nominal flow |\r\n| **4. Post-Analysis and Wrap-up** | Export mission logs and performance metrics | Flight report exporter | Telemetry consolidation latency |\r\n\r\n---\r\n\r\n## 3. Traceability to Use Cases and Product\r\n\r\n- `UC-PLAN-MISSION-001`: Planning and validation of safe corridors.\r\n- `UC-MONITOR-FLIGHT-001`: Ingestion and visualization of real-time telemetry.\r\n\r\n---\r\n\r\n## 4. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-23 | Product Manager / UX Lead | Initial operator journey definition | CHG-INIT-001 |\r\n';
13186
+ var STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD = '---\r\n# Valid prefixes: FR- (Functional), QR- (Quality), CON- (Constraint)\r\nid: FR-FEATURE-001\r\ntype: requirement\r\ntitle: Concise Requirement Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\ncategory: functional # functional, quality, constraint\r\n\r\n# 1. PRODUCT TRACEABILITY (Upstream)\r\nderives-from:\r\n - UC-ACTION-001\r\n\r\n# 2. METHOD AND ACCEPTANCE CRITERIA\r\nverifiable-by: cucumber-bdd # cucumber-bdd, automated-unit-test, integration-test, performance-benchmark\r\nacceptance-format: gherkin # gherkin, declarative-prose\r\ncucumber-tags:\r\n - "@FR-FEATURE-001"\r\n - "@automated"\r\n - "@regression"\r\n\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# FR-FEATURE-001: Concise Requirement Title\r\n\r\n## 1. Normative Statement\r\nThe system MUST [unambiguous and atomic description of expected behavior under specific conditions].\r\n\r\n---\r\n\r\n## 2. Upstream Traceability\r\n\r\n| Dimension | Link / Artifact | Relationship Type | Status |\r\n| :--- | :--- | :--- | :--- |\r\n| **Product (Upstream)** | `UC-ACTION-001` | Derived from Use Case | Validated |\r\n\r\n> *Note: Traceability toward Architecture and Testing is maintained inversely; services declare `satisfies-requirements` and test suites tag or reference this requirement.*\r\n\r\n---\r\n\r\n## 3. Acceptance Criteria in Gherkin (Cucumber) Format\r\n\r\n```gherkin\r\n@FR-FEATURE-001 @automated @regression\r\nFeature: Concise Requirement Title\r\n As a [primary actor / user role]\r\n I want [functional system capability]\r\n So that [obtain expected business benefit or value]\r\n\r\n Background:\r\n Given the system is in operational state\r\n And the actor is authenticated with valid permissions\r\n\r\n Scenario: Successful nominal flow\r\n Given the system has initial precondition configured\r\n When the actor submits a request with valid parameters\r\n Then the system processes the operation successfully\r\n And the resource status updates to "ACTIVE"\r\n And the corresponding domain event is emitted\r\n\r\n Scenario Outline: Business rule validation and edge cases\r\n Given data input with value "<input>"\r\n When requirement validation is processed\r\n Then the response must return status code "<status_code>"\r\n And the descriptive message must be "<message>"\r\n\r\n Examples:\r\n | input | status_code | message |\r\n | correct_value | 200 | SUCCESSFUL_OPERATION |\r\n | invalid_value | 400 | ERROR_INVALID_PARAMETER |\r\n | limit_exceeded | 422 | ERROR_LIMIT_EXCEEDED |\r\n```\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / QA | Initial specification with complete 360\xB0 traceability | CHG-INIT-001 |\r\n';
13187
+ var STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD = '---\r\nid: TERM-NAME-001\r\ntype: term\r\ntitle: Canonical Term Name\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\ndefinition: "Canonical, formal, and unambiguous definition of the concept within the domain\'s ubiquitous language."\r\nbounded-context: "FlightControl"\r\nsynonyms:\r\n - "Alternative Term"\r\n - "Technical Alias"\r\nanti-terms:\r\n - "Confusing or Discouraged Term"\r\n - "Inaccurate Colloquial Concept"\r\nrelated-terms:\r\n - TERM-RELATED-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# TERM-NAME-001: Canonical Term Name\r\n\r\n## 1. Formal Definition (Ubiquitous Language)\r\n> **Definition**: Canonical, formal, and unambiguous definition of the concept within the domain\'s ubiquitous language.\r\n\r\nThis concept establishes a shared semantic truth across domain experts, developers, and security engineers, eliminating ambiguous interpretations in specifications and code.\r\n\r\n---\r\n\r\n## 2. Bounded Context and Semantic Boundaries\r\n- **Bounded Context**: `FlightControl`\r\n- **Application Scope**: Valid across domain models, database entities, public APIs, and telemetry events within this context.\r\n\r\n---\r\n\r\n## 3. Terminology Guide (Correct vs. Incorrect Usage)\r\n\r\n| Category | Term | Application Guideline |\r\n| :--- | :--- | :--- |\r\n| **Canonical** | `Canonical Term Name` | Mandatory usage in DTOs, interfaces, and formal documentation. |\r\n| **Permitted Synonym** | `Alternative Term` | Permitted exclusively in user manuals or informal communication. |\r\n| **Anti-Term (Forbidden)** | `Confusing or Discouraged Term` | **Forbidden**: Leads to domain confusion or semantic collision. |\r\n\r\n---\r\n\r\n## 4. Related Terms\r\n\r\n- `TERM-RELATED-001`: Complementary concept within the same bounded context.\r\n\r\n---\r\n\r\n## 5. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-23 | Domain Architect / PO | Initial addition to domain glossary | CHG-INIT-001 |\r\n';
13188
+ var STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD = '---\r\nid: UC-ACTION-001\r\ntype: use-case\r\ntitle: Clear Interaction Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nprimary-actor: ACT-NAME-001\r\nsupporting-actors: []\r\ngoverned-by:\r\n - BR-RULE-001\r\nuses-terms:\r\n - TERM-TERM-001\r\nin-context: BC-CONTEXT-001\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# UC-ACTION-001: Clear Interaction Title\r\n\r\n## 1. Intention and Outcome (User Story)\r\n\r\n- **As a**: [Primary actor defined in `primary-actor`, e.g. `ACT-NAME-001`]\r\n- **I want**: [Concrete action, interaction, or capability requested from the system]\r\n- **To**: [Observable result, business value, or expected outcome]\r\n\r\n## 2. Preconditions\r\n- The actor must be authenticated with valid credentials.\r\n- The resource or entity must be in active state.\r\n\r\n## 3. Main Success Scenario\r\n1. The actor initiates the action by submitting the required payload.\r\n2. The system validates the data in accordance with business rules declared in `governed-by`.\r\n3. The system processes the transaction and updates internal state.\r\n4. The system emits confirmation and associated domain events.\r\n\r\n## 4. Alternative Scenarios and Exceptions\r\n- **4.1 Validation Failure**: The system rejects the request reporting invalid fields without mutating state.\r\n- **4.2 Timeout / Unavailability**: The system applies retry with exponential backoff and emits an alert.\r\n\r\n---\r\n\r\n## 5. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Product Owner / Analyst | Initial use case definition | CHG-INIT-001 |\r\n';
13189
+ var STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD = '---\r\nid: UFB-NAME-001\r\ntype: user-feedback\r\ntitle: "Design and User Experience Evaluation: [Feature / Use Case]"\r\nstatus: draft # draft | approved | archived\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nevaluator-actor: ACT-NAME # Evaluated actor (e.g. ACT-OPERATOR, ACT-USER)\r\ntarget-use-cases:\r\n - UC-NAME-001\r\ntarget-change: CHG-XXX # Analyzed SDD change identifier\r\ncreated-at: "YYYY-MM-DD"\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# UFB-NAME-001: Design and User Experience Evaluation: [Descriptive Title]\r\n\r\n> **Purpose:** Contrast product definition, specifications, or technical interfaces from an end-user or power-user perspective, establishing a strict immediate MVP cut and capturing structured suggestions for the future roadmap.\r\n\r\n---\r\n\r\n## 1. Operating Persona Context (Persona Environment)\r\n\r\nDescribes the profile and real-world operational circumstances under which the actor interacts with the system:\r\n- **Primary Actor**: `ACT-[NAME]`\r\n- **Operating Environment**: (e.g. Field work under direct sunlight, command console in operations center, noisy office, mobile touch device).\r\n- **Critical Conditions**: (e.g. Intermittent connectivity / low latency, high-stress rapid decision making, high event volume per minute).\r\n- **Key Expectation**: (e.g. Immediate confirmation of success, offline autonomy, reduction of repetitive steps).\r\n\r\n---\r\n\r\n## 2. Minimum Viable Product (MVP) Scope Proposal\r\n> *Inclusion Criterion: Strictly indispensable requirements for the actor to achieve their functional objective with certainty, without critical friction, without data loss, and with clear state visibility.*\r\n\r\n### A. Essential Flow (Core Journey)\r\nMinimum sequence of steps to complete the task:\r\n1. **Start / Input**: [User entry point and required initial data]\r\n2. **Main Action**: [Core interaction to process intent]\r\n3. **Confirmation and State**: [Visible system response confirming execution]\r\n\r\n### B. Indispensable User Requirements (Must-Have)\r\n- [ ] **[MVP-01] Irreversible Error Prevention**: [Safeguard or clear confirmation if the action modifies permanent data or executes destructive operations].\r\n- [ ] **[MVP-02] Real-Time State Visibility**: [Visual indicator of progress or process state (e.g. processing, synchronized, offline)].\r\n- [ ] **[MVP-03] Actionable Error Messages**: [Clear domain language messages indicating cause and remediation, without leaking internal technical traces].\r\n\r\n---\r\n\r\n## 3. Roadmap Suggestion Bank (Future Candidates)\r\n> *Criterion: Value-add suggestions, flow optimizations, and advanced needs that DO NOT block the MVP, preserved for Product Owner prioritization.*\r\n\r\n| Candidate ID | Category | Description and Pain Relieved | UX Impact | Estimated Complexity |\r\n| :--- | :--- | :--- | :---: | :---: |\r\n| **RDM-001** | *Productivity* | **Keyboard shortcuts / Quick flow:** Allows executing main action without a mouse for power users. | High | Low |\r\n| **RDM-002** | *Resilience* | **Local draft saving (Draft Mode):** Retains form inputs upon network drop to prevent rewrite. | High | Medium |\r\n| **RDM-003** | *Automation* | **Bulk actions:** Multi-selection to apply state to multiple elements simultaneously. | Medium | Medium |\r\n| **RDM-004** | *Visibility* | **Interface history and audit:** Quick view of recent change logs visible to the operator. | Medium | Low |\r\n\r\n---\r\n\r\n## 4. Strategic Questions for Product Owner (`open-questions`)\r\nOpen questions requiring business decisions to include in the active change or defer:\r\n1. *Does initial usage volume justify incorporating bulk actions (RDM-003) in this increment, or should the single flow be validated first?*\r\n2. *Is it acceptable for the MVP that history (RDM-004) be queried via server logs prior to exposing it in the UI?*\r\n\r\n---\r\n\r\n## 5. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Analysis Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | YYYY-MM-DD | agent-expert-user | Initial design analysis and MVP vs. Roadmap cut | CHG-XXX |\r\n';
13190
+ var STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD = '---\r\nid: HAZ-NAME-001\r\ntype: hazard\r\ntitle: Descriptive Operational Hazard Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nseverity: critical # catastrophic, critical, major, minor, negligible\r\nprobability: remote # frequent, probable, occasional, remote, improbable, extremely-improbable\r\nfault-tolerance-time-ms: 250 # FTTI: Fault tolerance time interval in milliseconds\r\n\r\n# Safety requirements mitigating this hazard (Downstream)\r\nmitigated-by:\r\n - SAF-REQ-NAME-001\r\n\r\nhazardous-condition: "Description of the anomalous operational condition or failure generating the hazard."\r\npotential-effect: "Loss of operational control, structural damage, or unintended collision."\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# HAZ-NAME-001: Descriptive Operational Hazard Title\r\n\r\n## 1. Operational Hazard Definition\r\nDetailed and concise description of the unintended operational condition representing a risk to the mission, the system, or the physical environment.\r\n\r\n## 2. Severity and Probability Classification\r\n\r\n| Parameter | Classification | Technical Justification |\r\n| :--- | :--- | :--- |\r\n| **Severity** | `critical` | Potential significant damage to aircraft or mission without direct human casualty. |\r\n| **Probability** | `remote` | Estimated failure rate $< 10^{-5}$ per nominal operating hour. |\r\n| **FTTI (Fault Tolerance)** | `250 ms` | Maximum time window to transition to safe state prior to adverse effects. |\r\n\r\n## 3. Triggering Conditions and Effects\r\n\r\n### Anomalous Condition\r\nDetail the initiating event (sensor failure, link loss, CAN bus freeze, or actuator degradation).\r\n\r\n### Potential Effect\r\nDirect consequence if the failure is not detected and mitigated within the FTTI interval.\r\n\r\n---\r\n\r\n## 4. Mitigation Traceability (Downstream Safety Requirements)\r\n\r\n| Safety Requirement | Fail-Safe Action | Mitigation Status |\r\n| :--- | :--- | :--- |\r\n| `SAF-REQ-NAME-001` | Contingency maneuver or transition to safe state | Designed |\r\n\r\n---\r\n\r\n## 5. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-23 | Safety Engineer | Initial hazard definition creation | CHG-INIT-001 |\r\n';
13191
+ var STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD = '---\r\n# Valid prefixes: SAF-REQ- (Safety Requirement / Operational Safety)\r\nid: SAF-REQ-NAME-001\r\ntype: safety-requirement\r\ntitle: Concise Safety Requirement Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nsafety-domain: flight-control # flight-control, collision-avoidance, energy-management, emergency-recovery, sensor-integrity\r\nsafety-integrity-level: "DAL-B" # DO-178C (DAL-A/B/C/D), ISO 26262 (ASIL-A/B/C/D), IEC 61508 (SIL-1/2/3/4)\r\n\r\n# 1. HAZARD AND RISK ANALYSIS TRACEABILITY (Upstream)\r\nmitigates-hazard:\r\n - HAZ-DESCRIPTION-001\r\n\r\nfail-safe-action: "SAFE_STATE_ACTION" # e.g. RETURN_TO_HOME, CONTROLLED_LANDING, MOTOR_CUTOFF\r\nfault-tolerance-time-ms: 100 # Maximum fault tolerance time interval (FTTI) before entering safe state\r\n\r\n# 2. VERIFICATION METHOD AND CRITERIA\r\nacceptance-format: gherkin\r\ncucumber-tags:\r\n - "@SAF-REQ-NAME-001"\r\n - "@safety"\r\n - "@failsafe"\r\n\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# SAF-REQ-NAME-001: Concise Safety Requirement Title\r\n\r\n## 1. Normative Operational Safety Statement\r\nThe system MUST [unambiguous description of defensive behavior preventing a hazard or mitigating unintended loss of control]. If [anomalous condition or hardware/sensor failure], the system MUST transition to safe state `SAFE_STATE_ACTION` within [X] milliseconds.\r\n\r\n---\r\n\r\n## 2. Hazard Mitigation and Fault Tolerance Matrix\r\n\r\n| Dimension | Link / Artifact | Relationship Type | Status |\r\n| :--- | :--- | :--- | :--- |\r\n| **Hazard Analysis (Upstream)** | `HAZ-DESCRIPTION-001` | Loss / Accident Mitigation | Validated |\r\n| **Integrity Level (SIL/DAL)** | `DAL-B` | Critical Software Level | Compliant |\r\n| **Fail-Safe Action** | `SAFE_STATE_ACTION` | Emergency Transition | Verified |\r\n\r\n---\r\n\r\n## 3. Mitigation Criteria in Gherkin Format (Safety & Fail-Safe Tests)\r\n\r\n```gherkin\r\n@SAF-REQ-NAME-001 @safety @failsafe\r\nFeature: Operational Failure Mitigation and Safe State Transition\r\n As an Autonomous Flight Control System\r\n I want to detect critical anomalies and execute contingency maneuvers\r\n So that I prevent accidents, collisions, and safeguard physical safety\r\n\r\n Scenario: Anomalous condition detection and safe state activation\r\n Given the system is in nominal operation\r\n When an unrecoverable failure condition occurs\r\n Then the system must detect the anomaly in less than 100 milliseconds\r\n And abort the current trajectory\r\n And execute contingency maneuver "SAFE_STATE_ACTION"\r\n And emit a critical alert to the ground control station\r\n```\r\n\r\n---\r\n\r\n## 4. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-15 | Safety Engineer | Initial safety requirement creation | CHG-INIT-001 |\r\n';
13192
+ var STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD = '---\r\nid: DSG-CHG-NAME-001\r\ntype: spec-design\r\nchange-id: CHG-NAME-001\r\ntitle: "Technical Design: Concise Delivery Increment Title"\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nhandoff: "HOF-CHG-NAME-001"\r\narchitecture-component: "CMP-NAME-001"\r\nenclave: "SEC-ENC-DMZ"\r\nstatus: draft\r\ncontracts:\r\n - component: "CMP-NAME-001"\r\n interface: "FeatureService"\r\n methods:\r\n - "executeAction"\r\n - "validateInput"\r\ncitations:\r\n - id: "UC-ACTION-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Use case driving this increment."\r\n - id: "FR-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Associated functional requirement."\r\n---\r\n\r\n# Technical Design: CHG-NAME-001\r\n\r\n## 1. Architectural Mapping and Zero Trust Enclave\r\nDefines the associated architectural component and corresponding security enclave.\r\n\r\n## 2. Data Contracts and Interfaces\r\nDetails interfaces, DTOs, TypeScript types, or data schemas.\r\n\r\n## 3. Error Handling and Mitigation Protocols\r\nSpecifies exception handling, error codes, and failure responses.\r\n\r\n## 4. License Policy Compliance (`license-policy.yaml`)\r\nLists external libraries or dependencies and confirms compatibility with the license policy.\r\n\r\n## 5. Revision History\r\n\r\n| Version | Date | Author | Change Description | Reference |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | YYYY-MM-DD | Author Name | Initial formal technical design | CHG-NAME-001 |\r\n';
13193
+ var STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML = '# ==============================================================================\r\n# AI-SDLC: PDaC Handoff Sidecar Template\r\n# Identifier emitted by PDaC for SDD workspace (OpenSpec / Spec Kit)\r\n# ==============================================================================\r\n\r\nid: HOF-CHG-001-FEATURE-NAME\r\ntype: handoff\r\ntitle: "Canonical Product Handoff for Delivery Increment"\r\nchangeId: CHG-001-FEATURE-NAME\r\nversion: "1.0.0"\r\ncreatedAt: "2026-09-14T00:00:00.000Z"\r\n\r\n# Product subgraph formally delivered to the SDD increment\r\nsubgraph:\r\n useCases:\r\n - UC-STREAM-TELEMETRY\r\n requirements:\r\n - FR-TELEMETRY-STREAM-001\r\n - QR-LATENCY-REALTIME\r\n securityRequirements:\r\n - SEC-REQ-MTLS-STREAM\r\n businessRules:\r\n - BR-TELEMETRY-VALIDITY\r\n abuseCases:\r\n - ABUSE-TELEMETRY-SPOOFING\r\n actors:\r\n - ACT-AUTONOMOUS-UAV\r\n - ACT-DRONE-OPERATOR\r\n - ACT-THREAT-SPOOFER\r\n\r\n# Cryptographic citations with immutable digests for drift detection\r\ncitations:\r\n - id: UC-STREAM-TELEMETRY\r\n digest: "sha256:5e5818cf2cc6d489f5d1b23cd4b61afac715cfc57a68fd44915b4adccd569cb8"\r\n comment: "Use case defining the continuous streaming flow"\r\n - id: FR-TELEMETRY-STREAM-001\r\n digest: "sha256:ad9e72840757ec009a610093476ea485c57dbb7cacb515ea27e8c8c153352e27"\r\n comment: "Functional requirement for telemetry ingestion"\r\n - id: SEC-REQ-MTLS-STREAM\r\n digest: "sha256:57f0c2ad1059aafdb6b3c140c074abbe8ee6f6c61e9733c69454f1551ed3397d"\r\n comment: "Mandatory mutual authentication via client certificates"\r\n';
13194
+ var STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD = '---\r\nid: CHG-NAME-001\r\ntype: spec-change-proposal\r\ntitle: Concise Delivery Increment Title\r\nstatus: draft # draft, review, approved, applied\r\nauthor: "agent-developer / human-dev"\r\ncitations:\r\n - id: "UC-ACTION-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Use case driving this increment."\r\n - id: "SEC-REQ-CONTROL-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Mandatory security requirement to implement."\r\n - id: "CMP-NAME-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Architectural component housing the change."\r\n---\r\n\r\n# Change Proposal: CHG-NAME-001\r\n\r\n## 1. Motivation and Scope\r\nExplains the problem solved by this increment and what parts of the codebase will be modified.\r\n\r\n## 2. Evaluated External Dependencies\r\n- List of new dependencies to be added and license verification per `license-policy.yaml`.\r\n';
13195
+ var STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD = '---\r\nid: PR-TEMPLATE-SDD-001\r\ntype: pull-request-template\r\ntitle: "Modular AI-SDLC Pull Request Template"\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nstatus: active\r\ndescription: "Institutional template for monitoring weak points and plan balance (X/O) in SDD deliveries"\r\n---\r\n\r\n# Pull Request: [TIER] - [CHANGE-ID] - Brief Title\r\n\r\n## 1. SDD Identification and Traceability\r\n\r\n- **SDD Change Specification**: `specs/changes/active/<change-id>/`\r\n- **PDaC Handoff Sidecar**: `specs/changes/active/<change-id>/handoff.yaml` (ID: `HOF-*`)\r\n- **Git Hierarchy Tier (4 Tiers)**:\r\n - [ ] Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` \u2794 `feat/<PARENT-ID>-<slug>`\r\n - [ ] Tier 3: `feat/<FEAT-ID>-<slug>` \u2794 `release/vX.Y.Z`\r\n - [ ] Tier 2: `release/vX.Y.Z` \u2794 `main`\r\n- **Linked Issues**: Closes #... / Refs #...\r\n\r\n---\r\n\r\n## 2. \u{1F4CB} Plan Execution Matrix and Testing Status (`X` vs `O`)\r\n\r\n> [!IMPORTANT]\r\n> **Non-Negotiable Total Exhaustiveness Rule**:\r\n> This table must include **each and every item identified for implementation** in the delivery plan (originating from `tasks.md`, the SDD specification, or issue criteria), without omitting any or creating abstract groupings.\r\n>\r\n> **Mandatory Marking Convention**:\r\n> - **`[X]` (Completed and Tested)**: Item is 100% implemented and has verifiable automated tests on disk (`tests/` or `.feature`) passing green.\r\n> - **`[O]` (Problem / Blocked)**: If there was any issue, technical limitation, failing test, or deferred scope, it must be marked with `[O]` and **full mandatory justification is required**:\r\n> 1. **Technical root cause** or encountered limitation.\r\n> 2. **Impact** on increment or system.\r\n> 3. **Mitigation** or rationale for deferral.\r\n> 4. **Formal reference** to tracking issue (GitHub Issue or `ADR-TECH-DEBT-*`).\r\n>\r\n> *Any PR with omitted planned items or unjustified `[O]` will be immediately blocked and rejected by the Tech Lead.*\r\n\r\n| Task / Item ID | Planned Description | Status (`[X]` / `[O]`) | Test Evidence on Disk or Mandatory Justification of `[O]` |\r\n| :--- | :--- | :---: | :--- |\r\n| `TSK-001` | <!-- e.g. Contract DTOs and Interfaces Definition --> | **[X]** | Covered in `tests/unit/dto.spec.ts` (100% pass) |\r\n| `TSK-002` | <!-- e.g. Network disconnection resilience --> | **[O]** | **Root cause:** TCP socket mock exhibits race conditions in CI.<br>**Impact:** Low in prod, flaky test.<br>**Mitigation:** Temporary extended timeout; tracked in issue #... |\r\n\r\n---\r\n\r\n## 3. \u{1F5FA}\uFE0F Weak Points Map and Risk Hotspots (Weak Points Hotspots)\r\n\r\n### A. Complexity Hotspots\r\n<!-- Record functions nearing quality-policy.yaml thresholds: CC > 7 (max 10), Cognitive > 10 (max 15), LOC > 30 (max 40), MI < 70 (min 50/65) -->\r\n| File | Function / Module | Metrics (CC / Cognitive / LOC / MI) | Technical Maintainability Justification |\r\n| :--- | :--- | :---: | :--- |\r\n| <!-- e.g. src/engine.ts --> | <!-- parsePayload() --> | CC: 8, Cog: 11, LOC: 32, MI: 72 | Deterministic parser without recursion; exhaustively tested. |\r\n\r\n### B. Edge Cases and Blind Spots\r\n<!-- Scenarios not covered by automated unit tests (concurrency, network timeouts, memory, jitter) -->\r\n- [ ] **Edge Case 1**: <!-- Scenario description, estimated risk, and operational mitigation -->\r\n- [ ] **Edge Case 2**: <!-- Scenario description, estimated risk, and operational mitigation -->\r\n\r\n### C. AI Assumptions\r\n<!-- Behaviors or heuristics assumed by the agent during implementation that require critical human review -->\r\n- [ ] **Assumption 1**: <!-- e.g. Assumed payload always arrives pre-parsed in UTF-8 -->\r\n- [ ] **Assumption 2**: <!-- e.g. Default timeout set to 5000ms as not stipulated in spec -->\r\n\r\n---\r\n\r\n## 4. \u{1F6E1}\uFE0F Attack Surface and Cybersecurity (STRIDE / Zero Trust)\r\n\r\n- [ ] **New External Channels**: Does it introduce HTTP endpoints, sockets, IPC channels, or brokers?\r\n- [ ] **Sanitization and Inputs**: Are all external inputs validated with strict typing schemas (Zod/JSON Schema)?\r\n- [ ] **Insecure Serialization**: Is polymorphic deserialization or dynamic code evaluation avoided?\r\n- [ ] **Secrets and Enclaves**: Are cryptographic keys, credentials, sensitive env vars, or enclaves (`SEC-ENC-*`) handled?\r\n- [ ] **Mitigated Security Requirements**: Implemented IDs (e.g. `SEC-REQ-*`) and associated tests (`SEC-TEST-*` or `.feature`).\r\n\r\n---\r\n\r\n## 5. \u{1F4E6} Dependencies and Licenses Inspection\r\n\r\n- **New Dependencies Added**:\r\n | Package | Version | License Type | `license-policy.yaml` Verification |\r\n | :--- | :---: | :---: | :---: |\r\n | <!-- e.g. zod --> | <!-- ^3.22.4 --> | <!-- MIT --> | <!-- \u2714 Compliant (Permissive) --> |\r\n- [ ] Zero dependencies with prohibited licenses (GPLv3/AGPL/unapproved commercial).\r\n- [ ] Verification executed successfully (`pnpm run verify:licenses`).\r\n\r\n---\r\n\r\n## 6. \u2705 Deterministic Pre-Flight Checklist (Release Gates)\r\n\r\n- [ ] **Strict Typing and Linter**: `pnpm run typecheck` (zero errors, zero unjustified suppressions).\r\n- [ ] **Quality Gate**: `pnpm run verify:quality` (CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$).\r\n- [ ] **BDD / Unit Tests**: `pnpm run verify:testing` (Gherkin scenarios synchronized and 100% passing).\r\n- [ ] **360\xB0 Traceability**: `pnpm run verify:traceability` (no orphan requirements).\r\n- [ ] **Open Source Licenses**: `pnpm run verify:licenses` (strict policy compliance).\r\n- [ ] **Schema Compliance**: `pnpm run verify:schemas` (100% of artifacts conform to JSON Schema).\r\n- [ ] **Full Test Suite**: `pnpm run test:all` / `pnpm run verify:all` (general green CI approval).\r\n\r\n---\r\n\r\n## 7. \u{1F6A8} Contingency Plan, Observability, and Rollback\r\n\r\n- **Observability Metrics and Alarms**: <!-- What metrics (p99 latency, 5xx error rate, memory) or logs should be monitored post-deployment? -->\r\n- **Rollback Procedure**: <!-- Exact command or procedure to revert change without collateral impact (e.g. git revert -m 1 <sha>) -->\r\n\r\n---\r\n\r\n## 8. \u{1F4CA} AI-SDLC: Aggregated KPIs Summary\r\n\r\n<!-- AI-SDLC-KPI-SUMMARY-START -->\r\n| Metric | Human | Total PR |\r\n| :--- | :---: | :---: |\r\n| **Commits Made** | - | **-** |\r\n| **Lines Added / Modif.** | - | **-** |\r\n| **Active Development Time** | - | **-** |\r\n| **Consumed Tokens (In+Out)** | - | **-** |\r\n| **Estimated Cost (\u20AC/$)** | \u2014 (Labor) | **-** |\r\n\r\n> *This block is updated automatically via `aisdlc kpi pr` or the CI workflow.*\r\n<!-- AI-SDLC-KPI-SUMMARY-END -->\r\n';
13196
+ var STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD = '---\r\nid: SPEC-CHG-NAME-001\r\ntype: delivery-spec\r\nchange-id: CHG-NAME-001\r\nprofile: standard # standard, patch, critical\r\nhandoff: HOF-CHG-NAME-001\r\nacceptance-format: gherkin\r\ncucumber-tags:\r\n - "@CHG-NAME-001"\r\n - "@automated"\r\ncitations:\r\n - id: "UC-ACTION-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Canonical use case driving or impacted by this increment."\r\n - id: "FR-NAME-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Formal functional requirement in canonical catalog."\r\n - id: "ACT-ACTOR-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Primary actor participating in the capability."\r\n - id: "CMP-NAME-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Architectural component implementing the specification."\r\n - id: "SEC-REQ-CONTROL-001"\r\n digest: "sha256:0000000000000000000000000000000000000000000000000000000000000000"\r\n comment: "Mandatory security requirement to implement."\r\n---\r\n\r\n# Delivery Specification: CHG-NAME-001\r\n\r\n## 1. Catalog Scope and Traceability (Canonical Alignment)\r\n\r\n> **MANDATORY SPECIFICATION RULE (ZERO AMBIGUITY / 360\xB0 TRACEABILITY):** \r\n> Every delivery increment (`spec.md`) MUST explicitly declare the exact boundaries of its impact across the canonical catalog (`product/`, `security/`, and `architecture/`). \r\n> An increment cannot author code or tests for unmapped behaviors. It must explicitly declare:\r\n> - **Affected Existing Catalog Items:** Existing functional requirements (`FR-*`), use cases (`UC-*`), actors (`ACT-*`), business rules (`BR-*`), security requirements (`SEC-REQ-*`), or architecture components/ADRs (`CMP-*`, `ADR-*`, `SRV-*`) whose behavior, contracts, or constraints are modified or deprecated.\r\n> - **New Catalog Items Introduced:** Any new functional requirements, use cases, actors, architecture decisions, or security rules created by this increment, identifying their proposed IDs and target catalog destination.\r\n\r\n### 1.1 Affected Existing Catalog Items (Modifications / Deprecations)\r\n\r\n| Catalog Category | Catalog ID | Action (`MODIFIED` / `DEPRECATED`) | Description of Delta & Behavioral Impact |\r\n| :--- | :--- | :--- | :--- |\r\n| Functional Requirement | `FR-EXISTING-001` | `MODIFIED` | Extends validation rules to support batch payload ingestion |\r\n| Use Case | `UC-EXISTING-001` | `MODIFIED` | Adds alternative execution path for handling throttling limits |\r\n| Actor / Persona | `ACT-EXISTING-001` | `MODIFIED` | Expands authorization scope to access batch processing endpoints |\r\n| Architecture / Component | `CMP-CORE-001` | `MODIFIED` | Ingestion pipeline updated to support non-blocking asynchronous dispatch |\r\n\r\n### 1.2 New Catalog Items Introduced (Additions)\r\n\r\n| Catalog Category | Proposed ID | Target Catalog Location | Formal Scope & Functional Contract |\r\n| :--- | :--- | :--- | :--- |\r\n| Functional Requirement | `FR-NEW-001` | `product/requirements/` | Automated cryptographic signature verification for incoming telemetry |\r\n| Use Case | `UC-NEW-001` | `product/use-cases/` | End-to-end telemetry subscription and streaming workflow |\r\n| Actor / Persona | `ACT-NEW-001` | `product/actors/` | External third-party auditor agent role |\r\n| Architecture Decision / Component | `ADR-005` / `CMP-NEW-001` | `architecture/` | Token bucket sliding-window rate limiting engine |\r\n| Security Requirement | `SEC-REQ-NEW-001` | `security/requirements/` | Enforce mutual TLS (mTLS) with client certificate validation |\r\n\r\n---\r\n\r\n## 2. Requirement Deltas and Formal Contracts\r\n\r\nFor each affected or new catalog item declared above, define the concrete functional delta:\r\n\r\n### [FR-NAME-001 / FR-NEW-001]: [Requirement Title]\r\n* **Operation:** `[ADDED | MODIFIED | DEPRECATED]`\r\n* **Primary Actor(s):** `ACT-ACTOR-001`\r\n* **Associated Use Case(s):** `UC-ACTION-001`\r\n* **Architectural Scope:** `CMP-NAME-001` (Security Enclave: `SEC-ENC-DMZ`)\r\n* **Behavioral Contract (Delta Specification):**\r\n * **Baseline (Before):** Describes previous behavior or states "None (New requirement)".\r\n * **Target Delta (After):** Explicit behavioral specification of the new or altered behavior.\r\n\r\n---\r\n\r\n## 3. Functional Behavior Scenarios (BDD Gherkin)\r\n\r\n```gherkin\r\n@CHG-NAME-001 @FR-NAME-001 @UC-ACTION-001 @functional @automated\r\nFeature: Delivery Specification CHG-NAME-001\r\n As a [primary actor / system role: ACT-ACTOR-001]\r\n I want [functional capability delivered by this change: FR-NAME-001]\r\n So that [expected business value or outcome]\r\n\r\n Background:\r\n Given the system is in a nominal operational state\r\n And dependent services are available\r\n\r\n Scenario: Nominal successful flow\r\n Given the client has established an authenticated session for "ACT-ACTOR-001"\r\n When valid payload is submitted according to specification\r\n Then the server responds with status 200 OK and persists state\r\n\r\n Scenario Outline: Parameter and edge case validation\r\n Given an input with parameter "<param>"\r\n When the request is processed\r\n Then the system returns status "<status>"\r\n\r\n Examples:\r\n | param | status |\r\n | nominal | 200 |\r\n | invalid | 400 |\r\n```\r\n\r\n---\r\n\r\n## 4. Cybersecurity and Mitigation Scenarios (Abuse Scenarios)\r\n\r\n```gherkin\r\n@CHG-NAME-001 @security @mitigation @SEC-REQ-CONTROL-001\r\nFeature: Threat Mitigation and Abuse Scenarios\r\n Scenario: Unauthorized access or unauthenticated payload attempt\r\n Given a malicious actor attempts to send data without valid credentials\r\n When connection attempts to reach protected enclaves "SEC-ENC-DMZ"\r\n Then handshake is aborted immediately and security alert SEC-TEST-001 is emitted\r\n```\r\n';
13197
+ var STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD = '---\r\nid: TSK-PLAN-CHG-001\r\ntype: task-plan\r\nchange-id: CHG-001-FEATURE-NAME\r\ntitle: Verifiable Tasks Breakdown and Autonomy Governance\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nstatus: draft\r\ngovernance-summary:\r\n autonomous-tasks-count: 2\r\n human-review-plan-count: 1\r\n ambiguous-count: 0\r\n high-risk-manual-count: 0\r\ntasks:\r\n - id: "TSK-001"\r\n title: "Contract DTOs and Interfaces Definition"\r\n complexity: "LOW"\r\n risk-level: "LOW"\r\n autonomy-mode: "AUTONOMOUS"\r\n implements-components:\r\n - "CMP-NAME-001"\r\n satisfies-requirements:\r\n - "FR-001"\r\n verification:\r\n method: "quality-gate"\r\n command-or-criteria: "npx tsc --noEmit && node packages/cli/bin/aisdlc.js verify quality"\r\n assigned-to: "agent-developer"\r\n status: "PENDING"\r\n\r\n - id: "TSK-002"\r\n title: "Core Business Logic and Algorithm Implementation"\r\n complexity: "MEDIUM"\r\n risk-level: "MEDIUM"\r\n autonomy-mode: "HUMAN_REVIEW_PLAN"\r\n implements-components:\r\n - "CMP-NAME-001"\r\n satisfies-requirements:\r\n - "FR-001"\r\n verification:\r\n method: "automated-unit-test"\r\n command-or-criteria: "npm test -- tests/unit/feature_core.spec.ts"\r\n assigned-to: "agent-developer"\r\n status: "PENDING"\r\n\r\n - id: "TSK-003"\r\n title: "Database Schema Migration / Critical Credentials"\r\n complexity: "HIGH"\r\n risk-level: "CRITICAL"\r\n autonomy-mode: "HIGH_RISK_MANUAL"\r\n verification:\r\n method: "manual-inspection"\r\n command-or-criteria: "DBA review + manual execution with verified idempotent script"\r\n assigned-to: "human-engineer"\r\n status: "PENDING"\r\n\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# Verifiable Tasks Breakdown: CHG-001-FEATURE-NAME\r\n\r\n## 1. Autonomy Classification and Human Supervision Matrix\r\n\r\nEach task is rigorously classified according to its complexity and risk level to determine the level of delegation to AI agents:\r\n\r\n| Autonomy Mode | Traffic Light | Activation Criterion | Agent and Human Behavior |\r\n| :--- | :---: | :--- | :--- |\r\n| **`AUTONOMOUS`** | \u{1F7E2} | Low risk, isolated and well-specified task with immediate tests. | **Autonomous Plan + Execution**. Agent creates plan and writes code without interruption. Human validates final PR. |\r\n| **`HUMAN_REVIEW_PLAN`** | \u{1F7E1} | Medium risk, architectural changes, API contracts, or critical business rules. | **Mandatory Plan Review**. Agent designs detailed plan, but halts. **Human must approve plan before coding.** |\r\n| **`AMBIGUOUS`** | \u{1F7E0} | Vague requirements, incomplete criteria, or conflicting business logic. | **Blocked for Implementation**. Agent is forbidden to guess. Requires prior interview and refinement with user. |\r\n| **`HIGH_RISK_MANUAL`** | \u{1F534} | Critical risk (destructive DB migrations, cryptographic keys, production infra). | **Autonomous Execution Forbidden**. Direct human execution or assisted mode with command-by-command confirmation. |\r\n\r\n---\r\n\r\n## 2. Detailed Task Plan and Verification Criteria\r\n\r\n### Phase 1: Types and Contracts (TSK-001)\r\n- **ID**: `TSK-001`\r\n- **Description**: Create interfaces and data structures stipulated in `design.md`.\r\n- **Mode**: `AUTONOMOUS` \u{1F7E2}\r\n- **Verification**: `npx tsc --noEmit && node packages/cli/bin/aisdlc.js verify quality`\r\n\r\n### Phase 2: Implementation and BDD Tests (TSK-002)\r\n- **ID**: `TSK-002`\r\n- **Description**: Implement business logic and pass Cucumber scenarios.\r\n- **Mode**: `HUMAN_REVIEW_PLAN` \u{1F7E1}\r\n- **Verification**: `npx cucumber-js tests/features/feature.feature`\r\n\r\n### Phase 3: Critical Operations / Deployment (TSK-003)\r\n- **ID**: `TSK-003`\r\n- **Description**: Apply migrations or perimeter enclave configurations.\r\n- **Mode**: `HIGH_RISK_MANUAL` \u{1F534}\r\n- **Verification**: Manual approval checklists and smoke tests (`smoke-test`).\r\n\r\n---\r\n\r\n## 3. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Lead Engineer | Plan creation with risk classification and 360\xB0 verification | CHG-INIT-001 |\r\n';
13198
+ var STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD = '---\r\nid: ABUSE-NAME-001\r\ntype: abuse-case\r\ntitle: Attack or Abuse Scenario Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nprimary-threat-actor: ACT-THREAT-NAME-001\r\ntargets-use-case: UC-ACTION-001\r\nstride-category: spoofing # spoofing, tampering, repudiation, information-disclosure, denial-of-service, elevation-of-privilege\r\nmitigated-by:\r\n - SEC-REQ-CONTROL-001\r\nasvs-controls:\r\n - "V2.1.1" # Reference to OWASP Application Security Verification Standard\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# ABUSE-NAME-001: Attack or Abuse Scenario Title\r\n\r\n## 1. Attack Vector and Exploitation Mechanics\r\nDescribes step-by-step how the malicious actor attempts to force, bypass, or abuse the legitimate use case.\r\n\r\n## 2. Attack Preconditions\r\n- What access or prior knowledge the attacker requires (expired tokens, intercepted network, payload injection).\r\n\r\n## 3. Potential Impact\r\n- Personal data exposure, telemetry corruption, denial of service, or identity spoofing.\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Security Officer / Threat Modeler | Initial abuse case threat modeling | CHG-SEC-001 |\r\n';
13199
+ var STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD = '---\r\nid: SEC-ENC-NAME-001\r\ntype: security-enclave\r\ntitle: Zero Trust Security Enclave Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\ntrust-zone: trusted # untrusted, semi-trusted, trusted, highly-trusted, dmz, zero-trust-boundary\r\nperimeter-rules:\r\n - "Mandatory mutual authentication via TLS 1.3 (mTLS)"\r\n - "Cryptographic token validation with maximum 5-minute expiry"\r\n - "Network isolation via firewall rules and restricted namespaces"\r\nallowed-inbound:\r\n - CMP-GATEWAY-001\r\nallowed-outbound:\r\n - CMP-DATABASE-001\r\nenforced-by:\r\n - SEC-REQ-AUTH-001\r\nauthentication-mechanism: mtls # mtls, jwt, api-key, oauth2, none\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# SEC-ENC-NAME-001: Zero Trust Security Enclave Title\r\n\r\n## 1. Enclave Definition and Purpose\r\nDescription of trust boundary, assets protected inside the enclave, and applied least-privilege principle.\r\n\r\n## 2. Trust Zone and Perimeter Rules\r\n\r\n| Parameter | Value | Security Justification |\r\n| :--- | :--- | :--- |\r\n| **Trust Zone** | `trusted` | Segment with access to sensitive data and critical logic services. |\r\n| **Authentication** | `mtls` | Mandatory asymmetric cryptography at all ingress points. |\r\n\r\n### Perimeter Rules\r\n1. **Inbound Flow Control**: Only explicitly authorized components may initiate connections.\r\n2. **Outbound Flow Control**: Outbound traffic restricted exclusively to dependencies required for operation.\r\n3. **Continuous Validation**: Every incoming request is cryptographically verified regardless of network origin.\r\n\r\n---\r\n\r\n## 3. Authorized Connectivity Matrix\r\n\r\n| Direction | Entity Identifier | Type | Protocol / Channel |\r\n| :--- | :--- | :--- | :--- |\r\n| **Inbound** | `CMP-GATEWAY-001` | Component | gRPC over mTLS (secure port) |\r\n| **Outbound** | `CMP-DATABASE-001` | Component | TCP encrypted with enclave credentials |\r\n\r\n---\r\n\r\n## 4. Linked Security Requirements\r\n\r\n- `SEC-REQ-AUTH-001`: Access control and perimeter encryption.\r\n\r\n---\r\n\r\n## 5. Revision History\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-23 | Security Architect | Initial Zero Trust security enclave creation | CHG-INIT-001 |\r\n';
13200
+ var STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD = '---\r\nid: SEC-REQ-CONTROL-001\r\ntype: security-requirement\r\ntitle: Security Mitigation Control Title\r\nstatus: draft\r\nversion: "1.0.0"\r\nschema-version: "1.0"\r\nsecurity-domain: authentication # authentication, authorization, cryptography, input-validation, audit-logging, communication-security, data-protection\r\n\r\n# 1. TRACEABILITY TO PRODUCT / SECURITY (Upstream)\r\nmitigates-abuse-case:\r\n - ABUSE-NAME-001\r\n\r\nenforced-in-enclave: SEC-ENC-DMZ-001\r\ncompliance-references:\r\n - "OWASP-ASVS-V2.1"\r\n - "ISO-27001-A.9"\r\n\r\n# 2. MITIGATION METHOD AND CRITERIA\r\nacceptance-format: gherkin\r\ncucumber-tags:\r\n - "@SEC-REQ-CONTROL-001"\r\n - "@security"\r\n - "@mitigation"\r\n\r\nsupersedes: null\r\nsuperseded-by: null\r\n---\r\n\r\n# SEC-REQ-CONTROL-001: Security Mitigation Control Title\r\n\r\n## 1. Technical Control Statement\r\nThe system MUST [precise description of the cryptographic, network, or authentication defense mechanism implemented].\r\n\r\n---\r\n\r\n## 2. Upstream Traceability\r\n\r\n| Dimension | Link / Artifact | Relationship Type | Status |\r\n| :--- | :--- | :--- | :--- |\r\n| **Product / Threat (Upstream)** | `ABUSE-NAME-001` | Mitigates Abuse Case | Validated |\r\n\r\n> *Note: Traceability toward Architecture and Testing is maintained inversely; services declare `satisfies-requirements` and security test suites tag or reference this requirement.*\r\n\r\n---\r\n\r\n## 3. Mitigation Criteria in Gherkin Format (Cucumber Security Tests)\r\n\r\n```gherkin\r\n@SEC-REQ-CONTROL-001 @security @mitigation\r\nFeature: Vulnerability Mitigation and Access Control\r\n As a Security Officer\r\n I want the system to reject any attack attempt or unauthenticated access\r\n So that I protect the integrity of the secure enclave\r\n\r\n Scenario: Access attempt without valid credentials (Negative Test)\r\n Given an adversary without a client certificate or signed token\r\n When they attempt to open a connection to the protected endpoint\r\n Then the handshake must be aborted immediately with a TLS error\r\n And no internal system traces must be exposed\r\n And an audit event must be logged in the SIEM with the source IP\r\n\r\n Scenario Outline: Manipulated payloads blocked\r\n Given a packet with malicious header "<payload>"\r\n When it is transmitted to the ingestion service\r\n Then the connection must be terminated immediately with code "<close_code>"\r\n\r\n Examples:\r\n | payload | close_code |\r\n | EXPIRED_CERT | 1008 |\r\n | REVOKED_CERT | 1008 |\r\n | UNTRUSTED_CA | 1008 |\r\n```\r\n\r\n---\r\n\r\n## 4. Revision History and Version Control\r\n\r\n| Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r\n| :--- | :--- | :--- | :--- | :--- |\r\n| **1.0.0** | 2026-09-03 | Security Officer / SecOps | Initial control specification with complete traceability | CHG-SEC-001 |\r\n';
13201
+ var STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD = `---\r
13202
+ id: ACT-THREAT-NAME-001\r
13203
+ type: threat-actor\r
13204
+ title: Adversary or Threat Profile\r
13205
+ status: draft\r
13206
+ version: "1.0.0"\r
13207
+ schema-version: "1.0"\r
13208
+ threat-capability: advanced-persistent-threat # script-kiddie, advanced-persistent-threat, insider-threat, automated-botnet, supply-chain-attacker\r
13209
+ motivation: financial-gain # financial-gain, espionage, sabotage, data-theft, reputational-damage\r
13210
+ attack-surfaces:\r
13211
+ - "Public REST API endpoints"\r
13212
+ - "WebSocket connections without mTLS"\r
13213
+ supersedes: null\r
13214
+ superseded-by: null\r
13215
+ ---\r
13216
+ \r
13217
+ # ACT-THREAT-NAME-001: Adversary Profile\r
13218
+ \r
13219
+ ## 1. Attacker Characterization\r
13220
+ Describes the adversary's profile, technical skill level, available resources, and typical modus operandi.\r
13221
+ \r
13222
+ ## 2. Attack Objectives\r
13223
+ - Which information assets or services the adversary seeks to compromise.\r
13224
+ - Estimated impact on confidentiality, integrity, and availability.\r
13225
+ \r
13226
+ ---\r
13227
+ \r
13228
+ ## 3. Revision History and Version Control\r
13229
+ \r
13230
+ | Version | Date | Author / Agent | Change Description | Change Reference (Change/PR) |\r
13231
+ | :--- | :--- | :--- | :--- | :--- |\r
13232
+ | **1.0.0** | 2026-09-03 | Security Officer / Threat Modeler | Initial threat profile characterization | CHG-SEC-001 |\r
13233
+ `;
13234
+ var STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD = '# Workflow Handoff Template\r\n\r\n> **Canonical reference:** [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md) and [`process/01_governance_and_roles.md`](../../process/01_governance_and_roles.md).\r\n>\r\n> **Activation Criterion by Autonomy Mode:**\r\n> - \u{1F7E2} **`AUTONOMOUS` (or exclusive supervision at the end in PR/CI):** OMITTED. The agent executes and delivers without interrupting the user with this handoff block.\r\n> - \u{1F7E1} **`HUMAN_REVIEW_PLAN` | \u{1F7E0} `AMBIGUOUS` | \u{1F534} `HIGH_RISK_MANUAL`:** MANDATORY. Upon completing the phase or proposal, the agent emits this block and **halts**, granting visibility to the user and relinquishing control.\r\n\r\n---\r\n\r\n### \u{1F504} Workflow Handoff\r\n\r\n- **Completed Phase / Activity**: `[Current phase, e.g. Product Definition / Threat Modeling / Architecture / SDD Implementation]`\r\n- **Acting Role**: `[agent-product-analyst | agent-threat-modeler | agent-system-architect | agent-developer | agent-expert-user | agent-security-auditor | agent-compliance-checker]`\r\n- **Task Autonomy Mode**: `[HUMAN_REVIEW_PLAN | AMBIGUOUS | HIGH_RISK_MANUAL]`\r\n- **Produced Deliverables**:\r\n - [x] `[Path or ID of generated artifact, e.g. specs/product/uc-mission.md]`\r\n - [x] `[Path or ID of generated artifact, e.g. quality-report.md]`\r\n\r\n- **Recommended Next Role(s) in Workflow**:\r\n - `[Suggested role name, e.g. agent-threat-modeler]`: `[Technical rationale, e.g. Model STRIDE adversaries and mitigate abuse cases]`\r\n - *(Optional)* `[Alternative role, e.g. agent-expert-user]`: `[Technical rationale, e.g. Evaluate UX and MVP boundary]`\r\n\r\n- **Suggested Invocation Prompt**:\r\n > "Act as `[next-role]` and proceed with the `[next phase]` phase on the generated deliverables: `[key artifacts]`."\r\n\r\n- **Human Action Window (User Sovereignty and Priority)**:\r\n - \u270B **Review and Validate**: Inspect generated artifacts and validate alignment with project vision before proceeding.\r\n - \u270F\uFE0F **Edit Directly**: Modify requirements, code, or acceptance criteria directly at any time.\r\n - \u{1F6D1} **Pause, Divert, or Discard**: Freeze workflow, redirect toward another goal, or discard proposal.\r\n - \u25B6\uFE0F **Delegate to Next Agent**: If satisfied with output, execute suggested prompt to continue the chain.\r\n\r\n---\r\n';
13235
+ var STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD = "## 1. SDD Identification and Traceability\r\n\r\n- **SDD Change Specification**: `specs/changes/active/<change-id>/` <!-- Link to active change directory -->\r\n- **PDaC Handoff Sidecar**: `specs/changes/active/<change-id>/handoff.yaml` <!-- ID: HOF-* -->\r\n- **Git Hierarchy Tier (4 Tiers)**:\r\n - [ ] Tier 4: `task/<PARENT-ID>/<TSK-ID>-<slug>` \u2794 `feat/<PARENT-ID>-<slug>`\r\n - [ ] Tier 3: `feat/<FEAT-ID>-<slug>` \u2794 `release/vX.Y.Z`\r\n - [ ] Tier 2: `release/vX.Y.Z` \u2794 `main`\r\n- **Linked Issues**: Closes #... / Refs #...\r\n\r\n---\r\n\r\n## 2. \u{1F4CB} Plan Execution Matrix and Testing Status (`X` vs `O`)\r\n\r\n> [!IMPORTANT]\r\n> **Non-Negotiable Total Exhaustiveness Rule**:\r\n> This table must include **each and every item identified for implementation** in the delivery plan (originating from `tasks.md`, the SDD specification, or issue criteria), without omitting any or creating abstract groupings.\r\n>\r\n> **Mandatory Marking Convention**:\r\n> - **`[X]` (Completed and Tested)**: Item is 100% implemented and has verifiable automated tests on disk (`tests/` or `.feature`) passing green.\r\n> - **`[O]` (Problem / Blocked)**: If there was any issue, technical limitation, failing test, or deferred scope, it must be marked with `[O]` and **full mandatory justification is required**:\r\n> 1. **Technical root cause** or encountered limitation.\r\n> 2. **Impact** on increment or system.\r\n> 3. **Mitigation** or rationale for deferral.\r\n> 4. **Formal reference** to tracking issue (GitHub Issue or `ADR-TECH-DEBT-*`).\r\n>\r\n> *Any PR with omitted planned items or unjustified `[O]` will be immediately blocked and rejected by the Tech Lead.*\r\n\r\n| Task / Item ID | Planned Description | Status (`[X]` / `[O]`) | Test Evidence on Disk or Mandatory Justification of `[O]` |\r\n| :--- | :--- | :---: | :--- |\r\n| `TSK-001` | <!-- e.g. Contract DTOs and Interfaces Definition --> | **[X]** | Covered in `tests/unit/dto.spec.ts` (100% pass) |\r\n| `TSK-002` | <!-- e.g. Network disconnection resilience --> | **[O]** | **Root cause:** TCP socket mock exhibits race conditions in CI.<br>**Impact:** Low in prod, flaky test.<br>**Mitigation:** Temporary extended timeout; tracked in issue #... |\r\n\r\n---\r\n\r\n## 3. \u{1F5FA}\uFE0F Weak Points Map and Risk Hotspots (Weak Points Hotspots)\r\n\r\n### A. Complexity Hotspots\r\n<!-- Record functions nearing quality-policy.yaml thresholds: CC > 7 (max 10), Cognitive > 10 (max 15), LOC > 30 (max 40), MI < 70 (min 50/65) -->\r\n| File | Function / Module | Metrics (CC / Cognitive / LOC / MI) | Technical Maintainability Justification |\r\n| :--- | :--- | :---: | :--- |\r\n| <!-- e.g. src/engine.ts --> | <!-- parsePayload() --> | CC: 8, Cog: 11, LOC: 32, MI: 72 | Deterministic parser without recursion; exhaustively tested. |\r\n\r\n### B. Edge Cases and Blind Spots\r\n<!-- Scenarios not covered by automated unit tests (concurrency, network timeouts, memory, jitter) -->\r\n- [ ] **Edge Case 1**: <!-- Scenario description, estimated risk, and operational mitigation -->\r\n- [ ] **Edge Case 2**: <!-- Scenario description, estimated risk, and operational mitigation -->\r\n\r\n### C. AI Assumptions\r\n<!-- Behaviors or heuristics assumed by the agent during implementation that require critical human review -->\r\n- [ ] **Assumption 1**: <!-- e.g. Assumed payload always arrives pre-parsed in UTF-8 -->\r\n- [ ] **Assumption 2**: <!-- e.g. Default timeout set to 5000ms as not stipulated in spec -->\r\n\r\n---\r\n\r\n## 4. \u{1F6E1}\uFE0F Attack Surface and Cybersecurity (STRIDE / Zero Trust)\r\n\r\n- [ ] **New External Channels**: Does it introduce HTTP endpoints, sockets, IPC channels, or brokers?\r\n- [ ] **Sanitization and Inputs**: Are all external inputs validated with strict typing schemas (Zod/JSON Schema)?\r\n- [ ] **Insecure Serialization**: Is polymorphic deserialization or dynamic code evaluation avoided?\r\n- [ ] **Secrets and Enclaves**: Are cryptographic keys, credentials, sensitive env vars, or enclaves (`SEC-ENC-*`) handled?\r\n- [ ] **Mitigated Security Requirements**: Implemented IDs (e.g. `SEC-REQ-*`) and associated tests (`SEC-TEST-*` or `.feature`).\r\n\r\n---\r\n\r\n## 5. \u{1F4E6} Dependencies and Licenses Inspection\r\n\r\n- **New Dependencies Added**:\r\n | Package | Version | License Type | `license-policy.yaml` Verification |\r\n | :--- | :---: | :---: | :---: |\r\n | <!-- e.g. zod --> | <!-- ^3.22.4 --> | <!-- MIT --> | <!-- \u2714 Compliant (Permissive) --> |\r\n- [ ] Zero dependencies with prohibited licenses (GPLv3/AGPL/unapproved commercial).\r\n- [ ] Verification executed successfully (`pnpm run verify:licenses`).\r\n\r\n---\r\n\r\n## 6. \u2705 Deterministic Pre-Flight Checklist (Release Gates)\r\n\r\n- [ ] **Strict Typing and Linter**: `pnpm run typecheck` (zero errors, zero unjustified suppressions).\r\n- [ ] **Quality Gate**: `pnpm run verify:quality` (CC $\\le 10$, Cognitive $\\le 15$, MI $\\ge 50$, LOC $\\le 40$).\r\n- [ ] **BDD / Unit Tests**: `pnpm run verify:testing` (Gherkin scenarios synchronized and 100% passing).\r\n- [ ] **360\xB0 Traceability**: `pnpm run verify:traceability` (no orphan requirements).\r\n- [ ] **Open Source Licenses**: `pnpm run verify:licenses` (strict policy compliance).\r\n- [ ] **Schema Compliance**: `pnpm run verify:schemas` (100% of artifacts conform to JSON Schema).\r\n- [ ] **Full Test Suite**: `pnpm run test:all` / `pnpm run verify:all` (general green CI approval).\r\n\r\n---\r\n\r\n## 7. \u{1F6A8} Contingency Plan, Observability, and Rollback\r\n\r\n- **Observability Metrics and Alarms**: <!-- What metrics (p99 latency, 5xx error rate, memory) or logs should be monitored post-deployment? -->\r\n- **Rollback Procedure**: <!-- Exact command or procedure to revert change without collateral impact (e.g. git revert -m 1 <sha>) -->\r\n\r\n---\r\n\r\n## 8. \u{1F4CA} AI-SDLC: Aggregated KPIs Summary\r\n\r\n<!-- AI-SDLC-KPI-SUMMARY-START -->\r\n| Metric | Human | Total PR |\r\n| :--- | :---: | :---: |\r\n| **Commits Made** | - | **-** |\r\n| **Lines Added / Modif.** | - | **-** |\r\n| **Active Development Time** | - | **-** |\r\n| **Consumed Tokens (In+Out)** | - | **-** |\r\n| **Estimated Cost (\u20AC/$)** | \u2014 (Labor) | **-** |\r\n\r\n> *This block is updated automatically via `aisdlc kpi pr` or the CI workflow.*\r\n<!-- AI-SDLC-KPI-SUMMARY-END -->\r\n";
13236
+ var STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML = '# ==============================================================================\r\n# AI-SDLC: Manifiesto de Cumplimiento de Licencias Evaluadas\r\n# ==============================================================================\r\n# Verificado contra: /license-policy.yaml\r\n# ==============================================================================\r\n\r\nevaluated_dependencies:\r\n - package: "@modelcontextprotocol/sdk"\r\n version: "1.0.4"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "SDK oficial para servidor Model Context Protocol."\r\n commercial_payment_required: false\r\n\r\n - package: "commander"\r\n version: "12.1.0"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "Parser de l\xEDnea de comandos para @ai-sdlc/cli."\r\n commercial_payment_required: false\r\n\r\n - package: "zod"\r\n version: "3.23.8"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "Validaci\xF3n de esquemas y tipos en runtime."\r\n commercial_payment_required: false\r\n\r\n - package: "js-yaml"\r\n version: "4.1.0"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "Parser y serializador YAML para especificaciones y frontmatter."\r\n commercial_payment_required: false\r\n\r\n - package: "chalk"\r\n version: "5.3.0"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "Estilizado de salida en terminal para comandos CLI."\r\n commercial_payment_required: false\r\n\r\n - package: "ajv"\r\n version: "8.17.1"\r\n spdx_license: "MIT"\r\n category: "permissive_free"\r\n status: "APPROVED"\r\n usage: "Validador JSON Schema para ProductShape, arc42 y SDD."\r\n commercial_payment_required: false\r\n';
13237
+ var STARTER_PROCESS_README = "# AI-SDLC: Process & Governance Framework\n\nThis directory hosts the deterministic governance, verification gates, and lifecycle protocols for AI-assisted software development.\n\n## Core Protocols & Lifecycle\n- **Phase 0 (Product Definition)**: `specs/product/` (Requirements `FR-*`, Use Cases `UC-*`, Actors `ACT-*`, Rules `BR-*`).\n- **Phase 1 (System Architecture)**: `templates/architecture/` (arc42 + NAF v4, `CMP-*`, Decisions `ADR-*`).\n- **Phase 2 (Cybersecurity Triad)**: `templates/security/` (Threat Actors `ACT-THREAT-*`, Abuse Cases `ABUSE-*`, Security Reqs `SEC-REQ-*`).\n- **Phase 3 (Spec-Driven Delivery - SDD)**: `specs/changes/active/<change-id>/` (`proposal.md`, `spec.md`, `design.md`, `tasks.md`, `handoff.yaml`).\n- **Phase 4 (Continuous Quality Gates & Verification)**:\n - Quality Gate: `npx aisdlc verify quality` (CC $\\le 10$, MI $\\ge 50$, LOC $\\le 40$)\n - BDD Testing: `npx aisdlc verify testing`\n - Traceability: `npx aisdlc verify traceability`\n - Licenses: `npx aisdlc verify licenses`\n - Schemas: `npx aisdlc verify schemas`\n - Release Gates: `npx aisdlc check` / `npx aisdlc verify all`\n";
13238
+ var STARTER_BASE_TEMPLATES = [
13239
+ { relPath: "templates/ci/.gitlab-ci.yml", content: STARTER_TEMPLATES_CI__GITLAB_CI_YML },
13240
+ { relPath: "templates/ci/azure-pipelines.yml", content: STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML },
13241
+ { relPath: "templates/ci/bitbucket-pipelines.yml", content: STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML },
13242
+ { relPath: "templates/ci/github-workflows/ci.yml", content: STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML },
13243
+ { relPath: "templates/ci/github-workflows/deploy-dashboard.yml", content: STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML },
13244
+ { relPath: "templates/ci/github-workflows/pr-kpi-summary.yml", content: STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML },
13245
+ { relPath: "templates/ci/github-workflows/sdd-integrate-on-merge.yml", content: STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML },
13246
+ { relPath: "templates/compliance/commercial-acquisition-request.template.md", content: STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD },
13247
+ { relPath: "templates/manuals/production-manual.template.md", content: STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD },
13248
+ { relPath: "templates/manuals/user-manual.template.md", content: STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD },
13249
+ { relPath: "templates/product/actor.template.md", content: STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD },
13250
+ { relPath: "templates/product/business-rule.template.md", content: STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD },
13251
+ { relPath: "templates/product/journey.template.md", content: STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD },
13252
+ { relPath: "templates/product/requirement.template.md", content: STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD },
13253
+ { relPath: "templates/product/term.template.md", content: STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD },
13254
+ { relPath: "templates/product/use-case.template.md", content: STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD },
13255
+ { relPath: "templates/product/user-design-feedback.template.md", content: STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD },
13256
+ { relPath: "templates/safety/hazard.template.md", content: STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD },
13257
+ { relPath: "templates/safety/safety-req.template.md", content: STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD },
13258
+ { relPath: "templates/sdd/design.template.md", content: STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD },
13259
+ { relPath: "templates/sdd/handoff.template.yaml", content: STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML },
13260
+ { relPath: "templates/sdd/proposal.template.md", content: STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD },
13261
+ { relPath: "templates/sdd/pull-request.template.md", content: STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD },
13262
+ { relPath: "templates/sdd/spec.template.md", content: STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD },
13263
+ { relPath: "templates/sdd/tasks.template.md", content: STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD },
13264
+ { relPath: "templates/security/abuse-case.template.md", content: STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD },
13265
+ { relPath: "templates/security/enclave.template.md", content: STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD },
13266
+ { relPath: "templates/security/security-req.template.md", content: STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD },
13267
+ { relPath: "templates/security/threat-actor.template.md", content: STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD },
13268
+ { relPath: "templates/workflow/agent-handoff.template.md", content: STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD },
13269
+ { relPath: "process/README.md", content: STARTER_PROCESS_README },
13270
+ { relPath: "compliance/license-manifest.yaml", content: STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML }
13271
+ ];
13272
+
12689
13273
  // src/init/index.ts
12690
13274
  var VALID_CI_PROVIDERS = ["github", "gitlab", "azure", "bitbucket"];
12691
13275
  var STARTER_QUALITY_POLICY = `# ==============================================================================
@@ -12890,7 +13474,7 @@ quality-gates:
12890
13474
  - if: '$CI_COMMIT_BRANCH == $CI_DEFAULT_BRANCH'
12891
13475
  - if: '$CI_COMMIT_BRANCH =~ /^release\\/.*/'
12892
13476
  script:
12893
- - node packages/cli/bin/aisdlc.js check
13477
+ - npx @aisdlc/cli check
12894
13478
 
12895
13479
  test-and-verify:
12896
13480
  stage: test
@@ -12900,7 +13484,7 @@ test-and-verify:
12900
13484
  - if: '$CI_COMMIT_BRANCH =~ /^release\\/.*/'
12901
13485
  script:
12902
13486
  - pnpm test
12903
- - node packages/cli/bin/aisdlc.js verify all
13487
+ - npx @aisdlc/cli verify all
12904
13488
 
12905
13489
  sdd-canonical-integration:
12906
13490
  stage: integrate
@@ -12912,7 +13496,7 @@ sdd-canonical-integration:
12912
13496
  GIT_STRATEGY: clone
12913
13497
  GIT_DEPTH: 0
12914
13498
  script:
12915
- - node packages/cli/bin/aisdlc.js sdd integrate --auto || true
13499
+ - npx @aisdlc/cli sdd integrate --auto || true
12916
13500
  - |
12917
13501
  git config user.name "gitlab-ci-bot"
12918
13502
  git config user.email "gitlab-ci-bot@noreply.gitlab.com"
@@ -12962,7 +13546,7 @@ stages:
12962
13546
  displayName: 'Instalar dependencias y compilar monorepo'
12963
13547
 
12964
13548
  - script: |
12965
- node packages/cli/bin/aisdlc.js check
13549
+ npx @aisdlc/cli check
12966
13550
  displayName: 'Ejecutar pre-vuelo AI-SDLC (check)'
12967
13551
 
12968
13552
  - script: |
@@ -12970,7 +13554,7 @@ stages:
12970
13554
  displayName: 'Ejecutar suite de pruebas unitarias'
12971
13555
 
12972
13556
  - script: |
12973
- node packages/cli/bin/aisdlc.js verify all
13557
+ npx @aisdlc/cli verify all
12974
13558
  displayName: 'Ejecutar Release Gate Completo (verify all)'
12975
13559
 
12976
13560
  - stage: CanonicalIntegration
@@ -12999,7 +13583,7 @@ stages:
12999
13583
  displayName: 'Instalar dependencias'
13000
13584
 
13001
13585
  - script: |
13002
- node packages/cli/bin/aisdlc.js sdd integrate --auto || true
13586
+ npx @aisdlc/cli sdd integrate --auto || true
13003
13587
  name: SddIntegrate
13004
13588
  displayName: 'Detectar e integrar incremento SDD'
13005
13589
 
@@ -13034,9 +13618,9 @@ definitions:
13034
13618
  - pnpm install --frozen-lockfile
13035
13619
  - pnpm approve-builds --all
13036
13620
  - pnpm run build
13037
- - node packages/cli/bin/aisdlc.js check
13621
+ - npx @aisdlc/cli check
13038
13622
  - pnpm test
13039
- - node packages/cli/bin/aisdlc.js verify all
13623
+ - npx @aisdlc/cli verify all
13040
13624
 
13041
13625
  - step: &sdd-integrate
13042
13626
  name: SDD Canonical Integration
@@ -13049,7 +13633,7 @@ definitions:
13049
13633
  - pnpm install --frozen-lockfile
13050
13634
  - pnpm approve-builds --all
13051
13635
  - pnpm run build
13052
- - node packages/cli/bin/aisdlc.js sdd integrate --auto || true
13636
+ - npx @aisdlc/cli sdd integrate --auto || true
13053
13637
  - |
13054
13638
  git config user.name "bitbucket-pipelines[bot]"
13055
13639
  git config user.email "pipelines[bot]@bitbucket.org"
@@ -13107,14 +13691,119 @@ jobs:
13107
13691
  pnpm install --frozen-lockfile
13108
13692
  pnpm approve-builds --all
13109
13693
 
13110
- - name: Build Monorepo Packages (@aisdlc/core & @aisdlc/cli)
13694
+ - name: Build Packages
13111
13695
  run: pnpm run build
13112
13696
 
13113
13697
  - name: Run Vitest Unit & Integration Suites
13114
13698
  run: pnpm test
13115
13699
 
13116
- - name: Dogfooding - Run AI-SDLC Full Verification Suite
13117
- run: node packages/cli/bin/aisdlc.js verify all
13700
+ - name: AI-SDLC Quality Gate & Full Verification
13701
+ run: npx @aisdlc/cli verify all
13702
+ `;
13703
+ var STARTER_GITHUB_PR_KPI = `name: AI-SDLC PR KPI Aggregator
13704
+
13705
+ on:
13706
+ pull_request:
13707
+ types: [opened, synchronize, reopened]
13708
+
13709
+ permissions:
13710
+ contents: read
13711
+ pull-requests: write
13712
+
13713
+ jobs:
13714
+ aggregate-kpis:
13715
+ name: Aggregate PR KPIs & Telemetry
13716
+ runs-on: ubuntu-latest
13717
+
13718
+ steps:
13719
+ - name: Checkout Repository
13720
+ uses: actions/checkout@v4
13721
+ with:
13722
+ fetch-depth: 0
13723
+
13724
+ - name: Install pnpm
13725
+ uses: pnpm/action-setup@v4
13726
+ with:
13727
+ version: 10
13728
+
13729
+ - name: Setup Node.js
13730
+ uses: actions/setup-node@v4
13731
+ with:
13732
+ node-version: 20
13733
+ cache: 'pnpm'
13734
+
13735
+ - name: Install Dependencies
13736
+ run: |
13737
+ pnpm install --frozen-lockfile
13738
+
13739
+ - name: Calculate and Emit PR KPIs
13740
+ id: kpi
13741
+ run: |
13742
+ npx @aisdlc/cli kpi pr --base origin/\${{ github.base_ref }} --head HEAD >> $GITHUB_STEP_SUMMARY
13743
+ `;
13744
+ var STARTER_GITHUB_DEPLOY_DASHBOARD = `name: Deploy AI-SDLC Dashboard to GitHub Pages
13745
+
13746
+ on:
13747
+ push:
13748
+ branches:
13749
+ - main
13750
+ workflow_dispatch:
13751
+
13752
+ permissions:
13753
+ contents: read
13754
+ pages: write
13755
+ id-token: write
13756
+
13757
+ concurrency:
13758
+ group: pages
13759
+ cancel-in-progress: false
13760
+
13761
+ jobs:
13762
+ deploy-dashboard:
13763
+ name: Build & Publish Interactive Dashboard
13764
+ runs-on: ubuntu-latest
13765
+ environment:
13766
+ name: github-pages
13767
+ url: \${{ steps.deployment.outputs.page_url }}
13768
+
13769
+ steps:
13770
+ - name: Checkout Code
13771
+ uses: actions/checkout@v4
13772
+ with:
13773
+ fetch-depth: 0
13774
+
13775
+ - name: Setup Node.js
13776
+ uses: actions/setup-node@v4
13777
+ with:
13778
+ node-version: 20
13779
+
13780
+ - name: Generate AI-SDLC Interactive Dashboard
13781
+ run: |
13782
+ mkdir -p reports
13783
+ npx --yes @aisdlc/cli report dashboard --output reports/index.html
13784
+ cp reports/index.html reports/dashboard.html
13785
+ touch reports/.nojekyll
13786
+
13787
+ - name: Setup GitHub Pages
13788
+ uses: actions/configure-pages@v5
13789
+
13790
+ - name: Upload Pages Artifact
13791
+ uses: actions/upload-pages-artifact@v3
13792
+ with:
13793
+ path: reports
13794
+
13795
+ - name: Deploy to GitHub Pages
13796
+ id: deployment
13797
+ uses: actions/deploy-pages@v4
13798
+
13799
+ - name: Emit Summary to GitHub Actions
13800
+ if: always() && steps.deployment.outcome == 'success'
13801
+ run: |
13802
+ echo "### \u{1F310} AI-SDLC Interactive Dashboard Published" >> $GITHUB_STEP_SUMMARY
13803
+ echo "" >> $GITHUB_STEP_SUMMARY
13804
+ echo "The interactive PDaC / RTM graph, Quality Gate telemetry, and release metrics are live at:" >> $GITHUB_STEP_SUMMARY
13805
+ echo "" >> $GITHUB_STEP_SUMMARY
13806
+ echo "\u{1F449} **[Open Live Dashboard](\${{ steps.deployment.outputs.page_url }})**" >> $GITHUB_STEP_SUMMARY
13118
13807
  `;
13119
13808
  var STARTER_GITHUB_SDD_INTEGRATE = `name: SDD Canonical Integration on Merge
13120
13809
 
@@ -13180,7 +13869,7 @@ jobs:
13180
13869
  PR_BODY: \${{ github.event.pull_request.body }}
13181
13870
  MANUAL_CHANGE_ID: \${{ github.event.inputs.change_id }}
13182
13871
  run: |
13183
- node packages/cli/bin/aisdlc.js sdd integrate --auto || true
13872
+ npx @aisdlc/cli sdd integrate --auto || true
13184
13873
 
13185
13874
  - name: Commit and Push Canonical Baseline Changes
13186
13875
  run: |
@@ -13195,6 +13884,8 @@ jobs:
13195
13884
  echo "\u2139 No pending modifications generated in working tree."
13196
13885
  fi
13197
13886
  `;
13887
+ var STARTER_PULL_REQUEST_TEMPLATE = STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD;
13888
+ var STARTER_GITHUB_PULL_REQUEST_TEMPLATE = STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD;
13198
13889
  var VALID_AGENT_TARGETS = ["cursor", "claude", "antigravity", "copilot", "mcp", "all"];
13199
13890
  var DISABLED_AGENT_VALUES = /* @__PURE__ */ new Set([false, "none", "false", ""]);
13200
13891
  var ALL_AGENT_VALUES = /* @__PURE__ */ new Set([void 0, null, true, "all"]);
@@ -13258,19 +13949,13 @@ function appendCopilotFiles(dirs, files) {
13258
13949
  function isTargetIncluded(targets, name) {
13259
13950
  return targets.has("all") || targets.has(name);
13260
13951
  }
13261
- function appendMcpFiles(targets, dirs, files) {
13262
- const hasMcp = isTargetIncluded(targets, "mcp");
13263
- if (hasMcp || targets.has("cursor")) {
13264
- dirs.push(".cursor");
13265
- files.push({ relPath: ".cursor/mcp.json", content: STARTER_CURSOR_MCP });
13266
- }
13267
- if (hasMcp || targets.has("antigravity")) {
13268
- files.push({ relPath: "antigravity.mcp.json", content: STARTER_ANTIGRAVITY_MCP });
13269
- }
13270
- if (hasMcp) {
13271
- dirs.push(".vscode");
13272
- files.push({ relPath: ".vscode/mcp.json", content: STARTER_VSCODE_MCP });
13273
- }
13952
+ function appendMcpFiles(dirs, files) {
13953
+ dirs.push(".cursor", ".vscode");
13954
+ files.push(
13955
+ { relPath: ".cursor/mcp.json", content: STARTER_CURSOR_MCP },
13956
+ { relPath: "antigravity.mcp.json", content: STARTER_ANTIGRAVITY_MCP },
13957
+ { relPath: ".vscode/mcp.json", content: STARTER_VSCODE_MCP }
13958
+ );
13274
13959
  }
13275
13960
  function collectAgentFiles(targets) {
13276
13961
  const dirs = [];
@@ -13279,7 +13964,7 @@ function collectAgentFiles(targets) {
13279
13964
  if (isTargetIncluded(targets, "cursor")) appendCursorFiles(dirs, files);
13280
13965
  if (isTargetIncluded(targets, "claude")) appendClaudeFiles(dirs, files);
13281
13966
  if (isTargetIncluded(targets, "copilot")) appendCopilotFiles(dirs, files);
13282
- appendMcpFiles(targets, dirs, files);
13967
+ appendMcpFiles(dirs, files);
13283
13968
  return { dirs, files };
13284
13969
  }
13285
13970
  function writeProjectFiles(destDir, files, dryRun) {
@@ -13304,6 +13989,7 @@ function writeProjectFiles(destDir, files, dryRun) {
13304
13989
  function validateCiProvider(ci) {
13305
13990
  if (!ci) return { valid: true };
13306
13991
  const normalized = ci.trim().toLowerCase();
13992
+ if (normalized === "none") return { valid: true };
13307
13993
  if (!VALID_CI_PROVIDERS.includes(normalized)) {
13308
13994
  return {
13309
13995
  valid: false,
@@ -13324,30 +14010,36 @@ function validateArchitectureGranularity(arch) {
13324
14010
  }
13325
14011
  return { valid: true, granularity: rawArch };
13326
14012
  }
14013
+ var BASE_DIRECTORIES = [
14014
+ "process",
14015
+ "compliance",
14016
+ "schemas/product",
14017
+ "schemas/security",
14018
+ "schemas/compliance",
14019
+ "schemas/architecture",
14020
+ "schemas/safety",
14021
+ "schemas/sdd",
14022
+ "schemas/manuals",
14023
+ "schemas/workflow",
14024
+ "schemas/ide",
14025
+ "templates/product",
14026
+ "templates/security",
14027
+ "templates/compliance",
14028
+ "templates/architecture",
14029
+ "templates/safety",
14030
+ "templates/sdd",
14031
+ "templates/manuals",
14032
+ "templates/ci",
14033
+ "templates/workflow",
14034
+ "specs",
14035
+ "reports",
14036
+ "tests/features"
14037
+ ];
13327
14038
  function getBaseDirectories(ciProvider) {
13328
- const dirs = [
13329
- "process",
13330
- "schemas/product",
13331
- "schemas/security",
13332
- "schemas/compliance",
13333
- "schemas/architecture",
13334
- "schemas/safety",
13335
- "schemas/sdd",
13336
- "schemas/manuals",
13337
- "templates/product",
13338
- "templates/security",
13339
- "templates/compliance",
13340
- "templates/architecture",
13341
- "templates/safety",
13342
- "templates/sdd",
13343
- "templates/manuals",
13344
- "templates/ci",
13345
- "templates/workflow",
13346
- "specs",
13347
- "reports",
13348
- "tests/features"
13349
- ];
13350
- if (ciProvider === "github") dirs.push(".github/workflows");
14039
+ const dirs = [...BASE_DIRECTORIES, ".cursor", ".vscode"];
14040
+ if (ciProvider === "github" || !ciProvider) {
14041
+ dirs.push(".github", ".github/workflows");
14042
+ }
13351
14043
  return dirs;
13352
14044
  }
13353
14045
  function getCiWorkflowFiles(ciProvider) {
@@ -13357,7 +14049,9 @@ function getCiWorkflowFiles(ciProvider) {
13357
14049
  if (ciProvider === "github") {
13358
14050
  return [
13359
14051
  { relPath: ".github/workflows/ci.yml", content: STARTER_GITHUB_CI },
13360
- { relPath: ".github/workflows/sdd-integrate-on-merge.yml", content: STARTER_GITHUB_SDD_INTEGRATE }
14052
+ { relPath: ".github/workflows/sdd-integrate-on-merge.yml", content: STARTER_GITHUB_SDD_INTEGRATE },
14053
+ { relPath: ".github/workflows/pr-kpi-summary.yml", content: STARTER_GITHUB_PR_KPI },
14054
+ { relPath: ".github/workflows/deploy-dashboard.yml", content: STARTER_GITHUB_DEPLOY_DASHBOARD }
13361
14055
  ];
13362
14056
  }
13363
14057
  return [];
@@ -13371,15 +14065,11 @@ function createDirectoriesOnDisk(destDir, directories, dryRun) {
13371
14065
  return created;
13372
14066
  }
13373
14067
  function collectStarterFiles(ciProvider, agentFiles = [], archGranularity = "minimal") {
13374
- return [
14068
+ const files = [
13375
14069
  { relPath: "quality-policy.yaml", content: STARTER_QUALITY_POLICY },
13376
14070
  { relPath: "license-policy.yaml", content: STARTER_LICENSE_POLICY },
13377
- { relPath: "templates/sdd/tasks.template.md", content: STARTER_TASK_TEMPLATE },
13378
- { relPath: "templates/product/requirement.template.md", content: STARTER_REQUIREMENT_TEMPLATE },
13379
- { relPath: "templates/workflow/agent-handoff.template.md", content: STARTER_WORKFLOW_HANDOFF_TEMPLATE },
13380
- { relPath: "templates/ci/.gitlab-ci.yml", content: STARTER_GITLAB_CI },
13381
- { relPath: "templates/ci/azure-pipelines.yml", content: STARTER_AZURE_PIPELINES },
13382
- { relPath: "templates/ci/bitbucket-pipelines.yml", content: STARTER_BITBUCKET_PIPELINES },
14071
+ ...STARTER_BASE_TEMPLATES,
14072
+ ...STARTER_SCHEMAS.map((s) => ({ relPath: s.relPath, content: s.content })),
13383
14073
  ...getCiWorkflowFiles(ciProvider),
13384
14074
  ...agentFiles,
13385
14075
  ...getArchitectureTemplates(archGranularity).map((t) => ({
@@ -13387,6 +14077,46 @@ function collectStarterFiles(ciProvider, agentFiles = [], archGranularity = "min
13387
14077
  content: t.content
13388
14078
  }))
13389
14079
  ];
14080
+ if (ciProvider === "github" || !ciProvider) {
14081
+ files.push({
14082
+ relPath: ".github/PULL_REQUEST_TEMPLATE.md",
14083
+ content: STARTER_GITHUB_PULL_REQUEST_TEMPLATE
14084
+ });
14085
+ }
14086
+ return files;
14087
+ }
14088
+ var STANDARD_AISDLC_SCRIPTS = {
14089
+ check: "aisdlc check",
14090
+ "check:fix": "aisdlc check --fix",
14091
+ "verify:quality": "aisdlc verify quality",
14092
+ "verify:all": "aisdlc verify all",
14093
+ "change:new": "aisdlc change new"
14094
+ };
14095
+ function injectMissingScripts(scripts) {
14096
+ let modified = false;
14097
+ for (const [key, val] of Object.entries(STANDARD_AISDLC_SCRIPTS)) {
14098
+ if (!scripts[key]) {
14099
+ scripts[key] = val;
14100
+ modified = true;
14101
+ }
14102
+ }
14103
+ return modified;
14104
+ }
14105
+ function updateConsumerPackageJson(destDir, dryRun) {
14106
+ const pkgPath = path4.join(destDir, "package.json");
14107
+ if (!fs7.existsSync(pkgPath)) return false;
14108
+ try {
14109
+ const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
14110
+ if (!pkg || typeof pkg !== "object") return false;
14111
+ pkg.scripts = pkg.scripts || {};
14112
+ const modified = injectMissingScripts(pkg.scripts);
14113
+ if (modified && !dryRun) {
14114
+ fs7.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n", "utf-8");
14115
+ }
14116
+ return modified;
14117
+ } catch {
14118
+ return false;
14119
+ }
13390
14120
  }
13391
14121
  function tryInstallGitHook(destDir, dryRun) {
13392
14122
  if (!dryRun && fs7.existsSync(path4.join(destDir, ".git"))) {
@@ -13429,30 +14159,38 @@ function buildInitSuccessResult(destDir, directoriesCreated, filesCreated, ciPro
13429
14159
  gitHookInstalled
13430
14160
  };
13431
14161
  }
14162
+ function validateInitOptions(options) {
14163
+ const ciRes = validateCiProvider(options.ci);
14164
+ if (!ciRes.valid) return { valid: false, archGranularity: "minimal", error: ciRes.error };
14165
+ const archRes = validateArchitectureGranularity(options.architecture);
14166
+ if (!archRes.valid) return { valid: false, archGranularity: "minimal", error: archRes.error };
14167
+ return { valid: true, ciProvider: ciRes.provider, archGranularity: archRes.granularity };
14168
+ }
13432
14169
  function initProject(options = {}) {
13433
14170
  const baseDir = options.rootDir || process.cwd();
13434
14171
  const destDir = path4.resolve(baseDir, options.targetDir || ".");
13435
- const ciRes = validateCiProvider(options.ci);
13436
- if (!ciRes.valid) return buildInitError(destDir, ciRes.error);
13437
- const archRes = validateArchitectureGranularity(options.architecture);
13438
- if (!archRes.valid) return buildInitError(destDir, archRes.error);
14172
+ const validated = validateInitOptions(options);
14173
+ if (!validated.valid) return buildInitError(destDir, validated.error);
13439
14174
  const agentTargets = resolveAgentTargets(options.agents);
13440
14175
  const { dirs: agentDirs, files: agentFiles } = collectAgentFiles(agentTargets);
13441
- const directories = mergeDirectories(getBaseDirectories(ciRes.provider), agentDirs);
14176
+ const directories = mergeDirectories(getBaseDirectories(validated.ciProvider), agentDirs);
13442
14177
  const directoriesCreated = createDirectoriesOnDisk(destDir, directories, options.dryRun);
13443
- const starterFiles = collectStarterFiles(ciRes.provider, agentFiles, archRes.granularity);
14178
+ const starterFiles = collectStarterFiles(validated.ciProvider, agentFiles, validated.archGranularity);
13444
14179
  const filesCreated = writeProjectFiles(destDir, starterFiles, options.dryRun);
14180
+ if (updateConsumerPackageJson(destDir, options.dryRun)) {
14181
+ filesCreated.push("package.json");
14182
+ }
13445
14183
  return buildInitSuccessResult(
13446
14184
  destDir,
13447
14185
  directoriesCreated,
13448
14186
  filesCreated,
13449
- ciRes.provider,
14187
+ validated.ciProvider,
13450
14188
  formatAgentsConfigured(agentTargets),
13451
- archRes.granularity,
14189
+ validated.archGranularity,
13452
14190
  tryInstallGitHook(destDir, options.dryRun)
13453
14191
  );
13454
14192
  }
13455
14193
 
13456
- export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, OpenSpecAdapter, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SAST_RULES, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_TASK_TEMPLATE, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generateQualityReport, generateSastReportMarkdown, generateSecretsReportMarkdown, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadProductHandoffSidecar, locateTaskInActiveChanges, maskSecret, normalizeSpdxLicense, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeReleaseKpiReport, writeThirdPartyNotices };
14194
+ export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, OpenSpecAdapter, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generateQualityReport, generateSastReportMarkdown, generateSecretsReportMarkdown, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadProductHandoffSidecar, locateTaskInActiveChanges, maskSecret, normalizeSpdxLicense, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAutonomyModeSection, renderClaudeAgentFile, renderCopilotAgentFile, renderCursorAgentFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeReleaseKpiReport, writeThirdPartyNotices };
13457
14195
  //# sourceMappingURL=index.js.map
13458
14196
  //# sourceMappingURL=index.js.map