@aisdlc/core 2.2.3 → 2.3.0

package/dist/index.cjs

@@ -5685,6 +5685,214 @@ function scanPnpmStore(pnpmDir, directNames, seen) {
     }
   }
 }
+function readTextIfExists(filePath) {
+  if (!fs7__namespace.existsSync(filePath)) return null;
+  try {
+    return fs7__namespace.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function extractTomlField(block, key) {
+  const m = block.match(new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, "m"));
+  return m ? m[1].trim() : void 0;
+}
+function extractPyprojectDirectDeps(content) {
+  const direct = /* @__PURE__ */ new Set();
+  const matches = content.matchAll(/^([a-zA-Z0-9_.-]+)\s*=\s*(?:["'{]|true)/gm);
+  for (const m of matches) {
+    const key = m[1].toLowerCase();
+    if (!["name", "version", "description", "license", "python", "readme"].includes(key)) {
+      direct.add(key);
+    }
+  }
+  return direct;
+}
+function parseSingleTomlBlock(block, lockPath, directNames) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version) return null;
+  const spdx = normalizeSpdxLicense(extractTomlField(block, "license") || "UNKNOWN");
+  return {
+    name,
+    version,
+    spdxLicense: spdx,
+    purl: `pkg:pypi/${name.toLowerCase()}@${version}`,
+    path: lockPath,
+    isDirect: directNames.size === 0 || directNames.has(name.toLowerCase())
+  };
+}
+function parseTomlPackageBlocks(content, lockPath, directNames, seen) {
+  for (const block of content.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseSingleTomlBlock(block, lockPath, directNames);
+    if (dep && !seen.has(`pypi:${dep.name}@${dep.version}`)) {
+      seen.set(`pypi:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
+  for (const [name, meta] of Object.entries(pkgs)) {
+    const rawVer = String(meta.version || "").replace(/^==/, "") || "unknown";
+    const spdx = normalizeSpdxLicense(meta.license || "UNKNOWN");
+    const key = `pypi:${name}@${rawVer}`;
+    if (!seen.has(key)) {
+      seen.set(key, {
+        name,
+        version: rawVer,
+        spdxLicense: spdx,
+        purl: `pkg:pypi/${name.toLowerCase()}@${rawVer}`,
+        path: lockPath,
+        isDirect
+      });
+    }
+  }
+}
+function scanPythonDependencies(rootDir, seen) {
+  const pyproject = readTextIfExists(path4__namespace.join(rootDir, "pyproject.toml")) || "";
+  const directNames = extractPyprojectDirectDeps(pyproject);
+  for (const lockName of ["poetry.lock", "uv.lock"]) {
+    const lockPath = path4__namespace.join(rootDir, lockName);
+    const content = readTextIfExists(lockPath);
+    if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
+  }
+  const pipfileLockPath = path4__namespace.join(rootDir, "Pipfile.lock");
+  const pipfileRaw = readTextIfExists(pipfileLockPath);
+  if (!pipfileRaw) return;
+  try {
+    const data = JSON.parse(pipfileRaw);
+    parsePipfileSection(data.default || {}, true, pipfileLockPath, seen);
+    parsePipfileSection(data.develop || {}, false, pipfileLockPath, seen);
+  } catch {
+  }
+}
+function parseGoRequireLine(line, goModPath) {
+  const cleaned = line.replace(/^require\s+/, "").trim();
+  const commentIdx = cleaned.indexOf("//");
+  const codePart = (commentIdx >= 0 ? cleaned.slice(0, commentIdx) : cleaned).trim();
+  const commentPart = commentIdx >= 0 ? cleaned.slice(commentIdx + 2).trim() : "";
+  const parts = codePart.split(/\s+/);
+  if (parts.length < 2) return null;
+  const modName = parts[0];
+  const rawVer = parts[1].replace(/^v/, "");
+  const isIndirect = /\bindirect\b/i.test(commentPart);
+  const licenseMatch = commentPart.match(/(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)/i);
+  const spdx = licenseMatch ? normalizeSpdxLicense(licenseMatch[1]) : "UNKNOWN";
+  return {
+    name: modName,
+    version: rawVer,
+    spdxLicense: spdx,
+    purl: `pkg:golang/${modName}@v${rawVer}`,
+    path: goModPath,
+    isDirect: !isIndirect
+  };
+}
+function extractGoCandidateLines(content) {
+  const out = [];
+  let inBlock = false;
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (/^require\s*\($/.test(trimmed)) inBlock = true;
+    else if (inBlock && trimmed === ")") inBlock = false;
+    else if (inBlock || trimmed.startsWith("require ")) out.push(trimmed);
+  }
+  return out;
+}
+function scanGoDependencies(rootDir, seen) {
+  const goModPath = path4__namespace.join(rootDir, "go.mod");
+  const content = readTextIfExists(goModPath);
+  if (!content) return;
+  for (const line of extractGoCandidateLines(content)) {
+    const dep = parseGoRequireLine(line, goModPath);
+    if (dep && !seen.has(`golang:${dep.name}@${dep.version}`)) {
+      seen.set(`golang:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractCargoDirectDeps(cargoToml) {
+  const map = /* @__PURE__ */ new Map();
+  let inDeps = false;
+  for (const line of cargoToml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inDeps = /^\[(?:dev-|build-)?dependencies\]$/.test(trimmed);
+      continue;
+    }
+    if (!inDeps || !trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
+    if (m) {
+      const licMatch = m[2].match(/license\s*=\s*["']([^"']+)["']/);
+      map.set(m[1], licMatch ? licMatch[1] : "UNKNOWN");
+    }
+  }
+  return map;
+}
+function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version || name === rootName) return null;
+  const blockLic = extractTomlField(block, "license") || directMeta.get(name) || "UNKNOWN";
+  return {
+    name,
+    version,
+    spdxLicense: normalizeSpdxLicense(blockLic),
+    purl: `pkg:cargo/${name}@${version}`,
+    path: cargoLockPath,
+    isDirect: directMeta.size === 0 || directMeta.has(name)
+  };
+}
+function scanRustDependencies(rootDir, seen) {
+  const cargoLockPath = path4__namespace.join(rootDir, "Cargo.lock");
+  const lockContent = readTextIfExists(cargoLockPath);
+  if (!lockContent) return;
+  const cargoToml = readTextIfExists(path4__namespace.join(rootDir, "Cargo.toml")) || "";
+  const directMeta = extractCargoDirectDeps(cargoToml);
+  const rootName = extractTomlField(cargoToml, "name");
+  for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseCargoLockBlock(block, rootName, directMeta, cargoLockPath);
+    if (dep && !seen.has(`cargo:${dep.name}@${dep.version}`)) {
+      seen.set(`cargo:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractXmlTag(xml, tag) {
+  const m = xml.match(new RegExp(`<${tag}>([^<]+)</${tag}>`));
+  return m ? m[1].trim() : void 0;
+}
+function resolveMavenBlockLicense(block, defaultLic) {
+  const tagLic = extractXmlTag(block, "license");
+  if (tagLic) return tagLic;
+  const commentLic = block.match(/<!--\s*(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)\s*-->/i)?.[1];
+  return commentLic || defaultLic;
+}
+function parseMavenDepBlock(block, defaultLic, pomPath) {
+  const groupId = extractXmlTag(block, "groupId");
+  const artifactId = extractXmlTag(block, "artifactId");
+  if (!groupId || !artifactId) return null;
+  const version = extractXmlTag(block, "version") || "unknown";
+  const inlineLic = resolveMavenBlockLicense(block, defaultLic);
+  return {
+    name: `${groupId}:${artifactId}`,
+    version,
+    spdxLicense: normalizeSpdxLicense(inlineLic),
+    purl: `pkg:maven/${groupId}/${artifactId}@${version}`,
+    path: pomPath,
+    isDirect: true
+  };
+}
+function scanMavenDependencies(rootDir, seen) {
+  const pomPath = path4__namespace.join(rootDir, "pom.xml");
+  const content = readTextIfExists(pomPath);
+  if (!content) return;
+  const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
+  const defaultLic = extractXmlTag(projectLicBlock, "name") || "UNKNOWN";
+  const depBlocks = content.match(/<dependency>[\s\S]*?<\/dependency>/g) || [];
+  for (const block of depBlocks) {
+    const dep = parseMavenDepBlock(block, defaultLic, pomPath);
+    if (dep && !seen.has(`maven:${dep.name}@${dep.version}`)) {
+      seen.set(`maven:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
@@ -5695,6 +5903,10 @@ function scanWithNativeFs(rootDir, options = {}) {
       scanPnpmStore(path4__namespace.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
+  scanPythonDependencies(rootDir, seen);
+  scanGoDependencies(rootDir, seen);
+  scanRustDependencies(rootDir, seen);
+  scanMavenDependencies(rootDir, seen);
   const allDeps = Array.from(seen.values());
   if (options.depth === "direct") {
     return allDeps.filter((d) => d.isDirect);
@@ -5764,10 +5976,17 @@ var SEVERITY_RANK = {
   LOW: 1,
   UNKNOWN: 0
 };
+function isExemptByVex(v, vexStatements) {
+  if (!vexStatements || vexStatements.length === 0) return false;
+  return vexStatements.some(
+    (stmt) => stmt.id === v.id && (stmt.state === "not_affected" || stmt.state === "fixed") && (!stmt.package || stmt.package === v.packageName)
+  );
+}
 function evaluateVulnerabilityThresholds(vulnerabilities, options) {
   const minRank = options?.failOnSeverity ? SEVERITY_RANK[options.failOnSeverity] ?? 3 : void 0;
   const maxScore = options?.maxCvssScore;
   const failing = vulnerabilities.filter((v) => {
+    if (isExemptByVex(v, options?.vexStatements)) return false;
     const rankMatch = minRank !== void 0 && SEVERITY_RANK[v.severity] >= minRank;
     const scoreMatch = maxScore !== void 0 && v.cvssV3Score !== void 0 && v.cvssV3Score >= maxScore;
     return rankMatch || scoreMatch;
@@ -5897,42 +6116,77 @@ function buildCycloneDxComponent(dep) {
   }
   return comp;
 }
-function generateCycloneDxSbom(dependencies, options = {}) {
+function buildVexAnalysis(vex) {
+  if (!vex) return void 0;
+  return {
+    state: vex.state,
+    justification: vex.justification,
+    detail: vex.detail,
+    response: vex.response
+  };
+}
+function mapScaVulnToCycloneDx(v, vexStatements) {
+  const matchingVex = vexStatements.find(
+    (stmt) => stmt.id === v.id && (!stmt.package || stmt.package === v.packageName)
+  );
+  return {
+    id: v.id,
+    source: v.primaryUrl ? { name: "NVD/GHSA", url: v.primaryUrl } : void 0,
+    ratings: [{ score: v.cvssV3Score, severity: v.severity.toLowerCase(), method: "CVSSv3", vector: v.cvssV3Vector }],
+    analysis: buildVexAnalysis(matchingVex),
+    affects: [{ ref: `pkg:npm/${v.packageName}@${v.installedVersion}` }]
+  };
+}
+function mapStandaloneVex(stmt) {
+  return {
+    id: stmt.id,
+    analysis: buildVexAnalysis(stmt),
+    affects: stmt.package ? [{ ref: stmt.package }] : void 0
+  };
+}
+function buildCycloneDxVulnerabilities(vulnerabilities = [], vexStatements = []) {
+  const out = vulnerabilities.map((v) => mapScaVulnToCycloneDx(v, vexStatements));
+  const seenIds = new Set(out.map((item) => item.id));
+  for (const stmt of vexStatements) {
+    if (!seenIds.has(stmt.id)) {
+      out.push(mapStandaloneVex(stmt));
+      seenIds.add(stmt.id);
+    }
+  }
+  return out;
+}
+function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
-  if (options.rootDir) {
-    const pkgPath = path4__namespace.join(options.rootDir, "package.json");
-    if (fs7__namespace.existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
-        if (pkg.name) name = pkg.name;
-        if (pkg.version) version = pkg.version;
-      } catch {
-      }
-    }
+  if (!options.rootDir) return { name, version };
+  const pkgPath = path4__namespace.join(options.rootDir, "package.json");
+  if (!fs7__namespace.existsSync(pkgPath)) return { name, version };
+  try {
+    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    if (pkg.name) name = pkg.name;
+    if (pkg.version) version = pkg.version;
+  } catch {
   }
-  const components = dependencies.map(buildCycloneDxComponent);
+  return { name, version };
+}
+function buildBomMetadata(name, version) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.3.0" }],
+    component: { type: "application", name, version }
+  };
+}
+function generateCycloneDxSbom(dependencies, options = {}) {
+  const { name, version } = resolveProjectIdentity(options);
+  const cdxVulns = buildCycloneDxVulnerabilities(options.vulnerabilities, options.vexStatements);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
     serialNumber: `urn:uuid:${crypto__namespace.randomUUID()}`,
-    metadata: {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      tools: [
-        {
-          vendor: "AI-SDLC",
-          name: "@aisdlc/core",
-          version: "1.0.0"
-        }
-      ],
-      component: {
-        type: "application",
-        name,
-        version
-      }
-    },
-    components
+    metadata: buildBomMetadata(name, version),
+    components: dependencies.map(buildCycloneDxComponent),
+    ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
 function tryAtomicWrite(filePath, content) {
@@ -6100,17 +6354,24 @@ function parseExceptions(exceptions) {
   }
   return map;
 }
+function parseVexStatements(doc) {
+  const rawList = doc?.vex_statements || doc?.exceptions?.vex_statements || [];
+  if (!Array.isArray(rawList)) return [];
+  return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
+}
 function parseLicensePolicy(content) {
   try {
     const doc = yaml3__default.default.load(content);
     const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
     const exception_packages = parseExceptions(doc?.exceptions);
+    const vex_statements = parseVexStatements(doc);
     return {
       version: doc?.version || "1.0",
       permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
       restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
       blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
       exception_packages,
+      vex_statements,
       rawPolicy: doc
     };
   } catch {
@@ -6119,7 +6380,8 @@ function parseLicensePolicy(content) {
       permitted: DEFAULT_PERMITTED,
       restricted: DEFAULT_RESTRICTED,
       blocked: DEFAULT_BLOCKED,
-      exception_packages: {}
+      exception_packages: {},
+      vex_statements: []
     };
   }
 }
@@ -6294,10 +6556,10 @@ function shouldGenerateSbom(options, rawPolicy) {
   if (options.generateSbom === false) return false;
   return Boolean(options.generateSbom || options.sbomPath || rawPolicy?.ci_gates?.generate_sbom);
 }
-function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies) {
+function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
   const sbomPath = options.sbomPath || path4__namespace.join(rootDir, "reports", "sbom.cdx.json");
-  const sbom = generateCycloneDxSbom(dependencies, { rootDir });
+  const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
 }
@@ -6310,9 +6572,9 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
 }
-function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies) {
+function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   return {
-    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies),
+    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements),
     noticesPath: maybeGenerateNotices(options, rootDir, rawPolicy, dependencies)
   };
 }
@@ -6341,7 +6603,7 @@ function buildSkippedVulnResult() {
     skipReason: "Trivy scanner is not installed on host environment. Vulnerability check gracefully skipped."
   };
 }
-function checkVulnerabilities(rootDir, options) {
+function checkVulnerabilities(rootDir, options, vexStatements) {
   if (options.scanVulnerabilities === false) {
     return { vulnerabilities: [], blocked: false };
   }
@@ -6349,7 +6611,10 @@ function checkVulnerabilities(rootDir, options) {
   if (!res.executed) {
     return buildSkippedVulnResult();
   }
-  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, options.vulnerabilityThresholds);
+  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, {
+    ...options.vulnerabilityThresholds,
+    vexStatements
+  });
   return { vulnerabilities: res.vulnerabilities, blocked: evalResult.blocked };
 }
 function assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData) {
@@ -6373,7 +6638,8 @@ function toCleanPolicy(policyWithRaw) {
     permitted: policyWithRaw.permitted,
     restricted: policyWithRaw.restricted,
     blocked: policyWithRaw.blocked,
-    exception_packages: policyWithRaw.exception_packages
+    exception_packages: policyWithRaw.exception_packages,
+    vex_statements: policyWithRaw.vex_statements
   };
 }
 function scanDependenciesForVerification(options, rootDir, rawPolicy) {
@@ -6393,8 +6659,15 @@ function verifyLicenses(options = {}) {
   }
   const dependencies = scanDependenciesForVerification(options, rootDir, policyWithRaw.rawPolicy);
   const { violations, permittedCount } = evaluateDependencyList(dependencies, policy);
-  const artifacts = handleDynamicScaArtifacts(options, rootDir, policyWithRaw.rawPolicy, dependencies);
-  const vulnData = checkVulnerabilities(rootDir, options);
+  const vulnData = checkVulnerabilities(rootDir, options, policy.vex_statements);
+  const artifacts = handleDynamicScaArtifacts(
+    options,
+    rootDir,
+    policyWithRaw.rawPolicy,
+    dependencies,
+    vulnData.vulnerabilities,
+    policy.vex_statements
+  );
   const reportMarkdown = generateLicenseReportMarkdown(dependencies, violations, policy, artifacts.sbomPath);
   return assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData);
 }
@@ -13090,6 +13363,7 @@ var LIFECYCLE_SKILL_TEMPLATES = [
     title: "Greenfield Project Inception & Delivery Playbook",
     description: "Orchestrate end-to-end AI-SDLC onboarding and Phase 0 Inception for brand-new (Greenfield) projects, from repository initialization (aisdlc init) and NAF v4 Vision (ARCH-INTRO-*) through ProductShape, STRIDE Threat Modeling, arc42 Architecture, and initial SDD increment delivery.",
     references: "[`process/02_product_definition.md`](../../process/02_product_definition.md), [`process/04b_data_protection_and_privacy.md`](../../process/04b_data_protection_and_privacy.md), [`process/05_architecture_arc42_nafv4.md`](../../process/05_architecture_arc42_nafv4.md), [`process/06_spec_driven_development.md`](../../process/06_spec_driven_development.md), and [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md).",
+    globs: "product/**, specs/product/**, architecture/**, templates/**",
     body: `## Purpose & Trigger
 Use this skill when starting a **brand-new software project from scratch (Greenfield)** or when \`specs/product/\` has no canonical baseline yet. It coordinates the sequential execution of AI-SDLC MCP/CLI tools and specialized role agents so no code is written before product vision, security enclaves, privacy-by-design controls, and architecture contracts exist.
 
@@ -13147,6 +13421,7 @@ Use this skill when starting a **brand-new software project from scratch (Greenf
     title: "Legacy / Brownfield Retro-Inception Playbook",
     description: "Orchestrate progressive AI-SDLC adoption and Brownfield retro-inception on existing or legacy repositories without breaking production code, reverse-engineering architecture (ARCH-INTRO-*, CMP-*) and establishing baseline quality, security, and license audits before new SDD increments.",
     references: "[`process/02_product_definition.md`](../../process/02_product_definition.md), [`process/04_open_source_license_compliance.md`](../../process/04_open_source_license_compliance.md), [`process/04b_data_protection_and_privacy.md`](../../process/04b_data_protection_and_privacy.md), [`process/05_architecture_arc42_nafv4.md`](../../process/05_architecture_arc42_nafv4.md), [`process/10_quality_management_and_release_gates.md`](../../process/10_quality_management_and_release_gates.md), and [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md).",
+    globs: "architecture/**, specs/**, src/**, packages/**",
     body: `## Purpose & Trigger
 Use this skill when **adopting AI-SDLC in an existing or legacy codebase (Brownfield)** that already has production source code (\`src/\`, \`packages/\`, etc.) but lacks canonical PDaC specifications, arc42 architecture views, or deterministic quality/license/privacy gates.
 
@@ -13188,6 +13463,7 @@ Once the target domain's baseline artifacts (\`ARCH-INTRO-*\`, \`UC-*\`, \`FR-*\
     title: "Bounded SDD Feature & Bugfix Delivery Playbook",
     description: "Orchestrate the complete Spec-Driven Development (SDD) lifecycle for bounded feature increments, enhancements, and bugfixes (CHG-* / TSK-*), from upstream requirement derivation and 4-tier Git branching through Red-Green-Refactor TDD, Pre-Merge Audit Triad, all 11 Quality Gates, and canonical baseline integration.",
     references: "[`process/06_spec_driven_development.md`](../../process/06_spec_driven_development.md), [`process/08_citation_contract_and_drift.md`](../../process/08_citation_contract_and_drift.md), [`process/10_quality_management_and_release_gates.md`](../../process/10_quality_management_and_release_gates.md), [`process/11_git_branching_and_lifecycle.md`](../../process/11_git_branching_and_lifecycle.md), and [`process/09_agent_protocols.md`](../../process/09_agent_protocols.md).",
+    globs: "specs/changes/**, src/**, packages/**, tests/**",
     body: `## Purpose & Trigger
 Use this skill for **every evolutionary increment (new feature, enhancement, refactoring, or bugfix)** on a project that already has an AI-SDLC baseline. It enforces strict 360\xB0 traceability from upstream ProductShape (\`UC-*\`, \`FR-*\`) through SDD (\`CHG-*\`, \`HOF-*\`, \`TSK-*\`), TDD implementation, the 12 Quality Gates, and baseline promotion.
 
@@ -13261,6 +13537,47 @@ description: >-
 
 Canonical Reference: ${skill.references}
 
+${skill.body}
+`;
+}
+function renderCursorSkillFile(skill) {
+  const globs = skill.globs || "";
+  return `---
+description: ${skill.id} (${skill.title}) - ${skill.description}
+globs: ${globs}
+alwaysApply: false
+---
+
+# ${skill.id} (${skill.title})
+
+Canonical Reference: ${skill.references}
+
+${skill.body}
+`;
+}
+function renderClaudeSkillFile(skill) {
+  return `---
+name: ${skill.id}
+description: ${skill.description}
+---
+
+# ${skill.id} (${skill.title})
+
+Canonical Reference: ${skill.references}
+
+${skill.body}
+`;
+}
+function renderCopilotSkillFile(skill) {
+  return `---
+name: ${skill.id}
+description: ${skill.description}
+---
+
+# ${skill.id} (${skill.title})
+
+Canonical Reference: ${skill.references}
+
 ${skill.body}
 `;
 }
@@ -15612,12 +15929,24 @@ function appendCursorFiles(dirs, files) {
   for (const agent of SPECIALIZED_AGENT_TEMPLATES) {
     files.push({ relPath: `.cursor/rules/${agent.id}.mdc`, content: renderCursorAgentFile(agent) });
   }
+  for (const skill of LIFECYCLE_SKILL_TEMPLATES) {
+    files.push({ relPath: `.cursor/rules/${skill.id}.mdc`, content: renderCursorSkillFile(skill) });
+  }
 }
 function appendClaudeFiles(dirs, files) {
-  dirs.push(".claude/agents");
+  dirs.push(".claude/agents", ".claude/skills");
   files.push({ relPath: "CLAUDE.md", content: STARTER_CLAUDE_RULES });
   for (const agent of SPECIALIZED_AGENT_TEMPLATES) {
-    files.push({ relPath: `.claude/agents/${agent.id}.md`, content: renderClaudeAgentFile(agent) });
+    const content = renderClaudeAgentFile(agent);
+    dirs.push(`.claude/skills/${agent.id}`);
+    files.push(
+      { relPath: `.claude/agents/${agent.id}.md`, content },
+      { relPath: `.claude/skills/${agent.id}/SKILL.md`, content }
+    );
+  }
+  for (const skill of LIFECYCLE_SKILL_TEMPLATES) {
+    dirs.push(`.claude/skills/${skill.id}`);
+    files.push({ relPath: `.claude/skills/${skill.id}/SKILL.md`, content: renderClaudeSkillFile(skill) });
   }
 }
 function appendCopilotFiles(dirs, files) {
@@ -15626,6 +15955,9 @@ function appendCopilotFiles(dirs, files) {
   for (const agent of SPECIALIZED_AGENT_TEMPLATES) {
     files.push({ relPath: `.github/agents/${agent.id}.agent.md`, content: renderCopilotAgentFile(agent) });
   }
+  for (const skill of LIFECYCLE_SKILL_TEMPLATES) {
+    files.push({ relPath: `.github/agents/${skill.id}.agent.md`, content: renderCopilotSkillFile(skill) });
+  }
 }
 function isTargetIncluded(targets, name) {
   return targets.has("all") || targets.has(name);
@@ -15875,9 +16207,148 @@ function initProject(options = {}) {
     tryInstallGitHook(destDir, options.dryRun)
   );
 }
+var DEFAULT_DLP_RULES = [
+  {
+    id: "DLP-001-PRIVATE-KEY",
+    description: "PEM / RSA / EC / OPENSSH Private Key Block",
+    pattern: "-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\\s\\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----",
+    replacement: "[REDACTED:PRIVATE_KEY]",
+    enabled: true
+  },
+  {
+    id: "DLP-002-API-TOKEN",
+    description: "Cloud, GitHub, Slack, OpenAI, Stripe, and AWS Access Tokens",
+    pattern: "\\b(?:gh[pousr]_[A-Za-z0-9_]{36,255}|github_pat_[0-9a-zA-Z_]{82}|sk-(?:proj-|live-)?[a-zA-Z0-9_-]{32,}|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*|(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99})\\b",
+    replacement: "[REDACTED:API_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-003-JWT",
+    description: "Plaintext JSON Web Token (JWT)",
+    pattern: "\\beyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b",
+    replacement: "[REDACTED:JWT_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-004-CREDIT-CARD",
+    description: "Payment Card Number (13-19 digits formatted)",
+    pattern: "\\b(?:\\d{4}[- ]\\d{4}[- ]\\d{4}[- ]\\d{4}|\\d{16})\\b",
+    replacement: "[REDACTED:CREDIT_CARD]",
+    enabled: true
+  },
+  {
+    id: "DLP-005-EMAIL",
+    description: "Personal or Corporate Email Address",
+    pattern: "\\b[A-Za-z0-9._%+-]+@(?!example\\.com|localhost|test\\.local)[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b",
+    replacement: "[REDACTED:EMAIL]",
+    enabled: true
+  },
+  {
+    id: "DLP-006-INTERNAL-URL",
+    description: "Internal Intranet / Corp Service URL",
+    pattern: "https?://(?:[A-Za-z0-9._-]+:[A-Za-z0-9._-]+@|[A-Za-z0-9.-]+\\.(?:internal|corp|intranet|local)\\b)[^\\s\"'`<>]*",
+    replacement: "[REDACTED:INTERNAL_URL]",
+    enabled: true
+  }
+];
+function createDefaultDlpPolicy() {
+  return {
+    version: "1.0",
+    enabled: true,
+    zero_data_retention_required: true,
+    rules: [...DEFAULT_DLP_RULES]
+  };
+}
+function normalizeParsedRule(raw, idx) {
+  if (typeof raw.pattern !== "string" || !raw.pattern) return null;
+  return {
+    id: typeof raw.id === "string" ? raw.id : `DLP-CUSTOM-${idx + 1}`,
+    description: typeof raw.description === "string" ? raw.description : "Custom DLP rule",
+    pattern: raw.pattern,
+    replacement: typeof raw.replacement === "string" ? raw.replacement : "[REDACTED]",
+    enabled: raw.enabled !== false
+  };
+}
+function parseDlpPolicy(yamlContent) {
+  const fallback = createDefaultDlpPolicy();
+  if (!yamlContent || !yamlContent.trim()) return fallback;
+  try {
+    const doc = yaml3__default.default.load(yamlContent);
+    if (!doc || typeof doc !== "object") return fallback;
+    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
+    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+    return {
+      version: typeof doc.version === "string" ? doc.version : "1.0",
+      enabled: doc.enabled !== false,
+      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
+      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+    };
+  } catch {
+    return fallback;
+  }
+}
+function loadDlpPolicy(rootDir, customPolicyPath) {
+  const base = rootDir || process.cwd();
+  const filePath = customPolicyPath ? path4__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path4__namespace.join(base, customPolicyPath) : path4__namespace.join(base, "dlp-policy.yaml");
+  if (!fs7__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
+  try {
+    return parseDlpPolicy(fs7__namespace.readFileSync(filePath, "utf-8"));
+  } catch {
+    return createDefaultDlpPolicy();
+  }
+}
+function applySingleDlpRule(text, rule) {
+  if (rule.enabled === false) return { output: text, matches: 0 };
+  try {
+    const regex = new RegExp(rule.pattern, "g");
+    let matches = 0;
+    const output = text.replace(regex, () => {
+      matches++;
+      return rule.replacement;
+    });
+    return { output, matches };
+  } catch {
+    return { output: text, matches: 0 };
+  }
+}
+function sanitizeDlpText(text, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || !text) {
+    return { sanitizedText: text, redactionCount: 0, triggeredRuleIds: [] };
+  }
+  let current = text;
+  let totalRedactions = 0;
+  const triggered = [];
+  for (const rule of policy.rules) {
+    const res = applySingleDlpRule(current, rule);
+    if (res.matches > 0) {
+      current = res.output;
+      totalRedactions += res.matches;
+      triggered.push(rule.id);
+    }
+  }
+  return {
+    sanitizedText: current,
+    redactionCount: totalRedactions,
+    triggeredRuleIds: triggered
+  };
+}
+function sanitizeDlpPayload(payload, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || payload === null || payload === void 0) return payload;
+  if (typeof payload === "string") {
+    return sanitizeDlpText(payload, policy).sanitizedText;
+  }
+  const serialized = JSON.stringify(payload);
+  const { sanitizedText } = sanitizeDlpText(serialized, policy);
+  try {
+    return JSON.parse(sanitizedText);
+  } catch {
+    return payload;
+  }
+}
 
 exports.ALL_ARCHITECTURE_TEMPLATES = ALL_ARCHITECTURE_TEMPLATES;
 exports.BRANCH_PATTERNS = BRANCH_PATTERNS;
+exports.DEFAULT_DLP_RULES = DEFAULT_DLP_RULES;
 exports.DEFAULT_EXCLUDED_PATTERNS = DEFAULT_EXCLUDED_PATTERNS;
 exports.DEFAULT_EXCLUDES = DEFAULT_EXCLUDES;
 exports.DEFAULT_EXTENSIONS = DEFAULT_EXTENSIONS;
@@ -16023,6 +16494,7 @@ exports.analyzeBddVariantsForRequirement = analyzeBddVariantsForRequirement;
 exports.appendRevisionHistoryRow = appendRevisionHistoryRow;
 exports.applyRatchetMode = applyRatchetMode;
 exports.buildCycloneDxComponent = buildCycloneDxComponent;
+exports.buildCycloneDxVulnerabilities = buildCycloneDxVulnerabilities;
 exports.buildFeatureFileContent = buildFeatureFileContent;
 exports.buildGraphElements = buildGraphElements;
 exports.calculateJaccardSimilarity = calculateJaccardSimilarity;
@@ -16039,6 +16511,7 @@ exports.collectHistoricalKpis = collectHistoricalKpis;
 exports.computeCanonicalSha256 = computeCanonicalSha256;
 exports.computeSha256 = computeSha256;
 exports.computeViolationSignature = computeViolationSignature;
+exports.createDefaultDlpPolicy = createDefaultDlpPolicy;
 exports.createDefaultQualityPolicy = createDefaultQualityPolicy;
 exports.depositProductHandoffSidecar = depositProductHandoffSidecar;
 exports.detectActiveChangeForIntegration = detectActiveChangeForIntegration;
@@ -16104,6 +16577,7 @@ exports.isPlaceholderOrIgnored = isPlaceholderOrIgnored;
 exports.isRequirementArtifact = isRequirementArtifact2;
 exports.isSemgrepInstalled = isSemgrepInstalled;
 exports.isToolAvailable = isToolAvailable;
+exports.loadDlpPolicy = loadDlpPolicy;
 exports.loadPrivacyPolicy = loadPrivacyPolicy;
 exports.loadProductHandoffSidecar = loadProductHandoffSidecar;
 exports.loadQualityBaseline = loadQualityBaseline;
@@ -16113,6 +16587,7 @@ exports.maskSecret = maskSecret;
 exports.normalizeSpdxLicense = normalizeSpdxLicense;
 exports.normalizeUri = normalizeUri;
 exports.parseCommitTrailers = parseCommitTrailers;
+exports.parseDlpPolicy = parseDlpPolicy;
 exports.parseFrontmatter = parseFrontmatter;
 exports.parseFrontmatterId = parseFrontmatterId;
 exports.parseGenericDoc = parseGenericDoc;
@@ -16132,8 +16607,11 @@ exports.renderAntigravityAgentFile = renderAntigravityAgentFile;
 exports.renderAntigravitySkillFile = renderAntigravitySkillFile;
 exports.renderAutonomyModeSection = renderAutonomyModeSection;
 exports.renderClaudeAgentFile = renderClaudeAgentFile;
+exports.renderClaudeSkillFile = renderClaudeSkillFile;
 exports.renderCopilotAgentFile = renderCopilotAgentFile;
+exports.renderCopilotSkillFile = renderCopilotSkillFile;
 exports.renderCursorAgentFile = renderCursorAgentFile;
+exports.renderCursorSkillFile = renderCursorSkillFile;
 exports.renderDashboardHtml = renderDashboardHtml;
 exports.renderManualsTab = renderManualsTab;
 exports.resolveAgentTargets = resolveAgentTargets;
@@ -16151,15 +16629,21 @@ exports.resolveSchemaForArtifact = resolveSchemaForArtifact;
 exports.resolveTargetFiles = resolveTargetFiles;
 exports.runGitleaksCli = runGitleaksCli;
 exports.runSemgrepCli = runSemgrepCli;
+exports.sanitizeDlpPayload = sanitizeDlpPayload;
+exports.sanitizeDlpText = sanitizeDlpText;
 exports.scaffoldSddChange = scaffoldSddChange;
 exports.scanAllProductHandoffs = scanAllProductHandoffs;
 exports.scanAllTestArtifacts = scanAllTestArtifacts;
 exports.scanContentForSecrets = scanContentForSecrets;
 exports.scanFileForPrivacyViolations = scanFileForPrivacyViolations;
 exports.scanFileForSast = scanFileForSast;
+exports.scanGoDependencies = scanGoDependencies;
 exports.scanInstalledLicenses = scanInstalledLicenses;
 exports.scanManualsInWorkspace = scanManualsInWorkspace;
+exports.scanMavenDependencies = scanMavenDependencies;
 exports.scanPnpmStore = scanPnpmStore;
+exports.scanPythonDependencies = scanPythonDependencies;
+exports.scanRustDependencies = scanRustDependencies;
 exports.scanSubdirectories = scanSubdirectories;
 exports.scanWithNativeFs = scanWithNativeFs;
 exports.scanWithSyft = scanWithSyft;