@aisdlc/core 2.2.4 → 2.3.0

package/dist/index.js

@@ -5657,6 +5657,214 @@ function scanPnpmStore(pnpmDir, directNames, seen) {
     }
   }
 }
+function readTextIfExists(filePath) {
+  if (!fs7.existsSync(filePath)) return null;
+  try {
+    return fs7.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function extractTomlField(block, key) {
+  const m = block.match(new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, "m"));
+  return m ? m[1].trim() : void 0;
+}
+function extractPyprojectDirectDeps(content) {
+  const direct = /* @__PURE__ */ new Set();
+  const matches = content.matchAll(/^([a-zA-Z0-9_.-]+)\s*=\s*(?:["'{]|true)/gm);
+  for (const m of matches) {
+    const key = m[1].toLowerCase();
+    if (!["name", "version", "description", "license", "python", "readme"].includes(key)) {
+      direct.add(key);
+    }
+  }
+  return direct;
+}
+function parseSingleTomlBlock(block, lockPath, directNames) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version) return null;
+  const spdx = normalizeSpdxLicense(extractTomlField(block, "license") || "UNKNOWN");
+  return {
+    name,
+    version,
+    spdxLicense: spdx,
+    purl: `pkg:pypi/${name.toLowerCase()}@${version}`,
+    path: lockPath,
+    isDirect: directNames.size === 0 || directNames.has(name.toLowerCase())
+  };
+}
+function parseTomlPackageBlocks(content, lockPath, directNames, seen) {
+  for (const block of content.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseSingleTomlBlock(block, lockPath, directNames);
+    if (dep && !seen.has(`pypi:${dep.name}@${dep.version}`)) {
+      seen.set(`pypi:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
+  for (const [name, meta] of Object.entries(pkgs)) {
+    const rawVer = String(meta.version || "").replace(/^==/, "") || "unknown";
+    const spdx = normalizeSpdxLicense(meta.license || "UNKNOWN");
+    const key = `pypi:${name}@${rawVer}`;
+    if (!seen.has(key)) {
+      seen.set(key, {
+        name,
+        version: rawVer,
+        spdxLicense: spdx,
+        purl: `pkg:pypi/${name.toLowerCase()}@${rawVer}`,
+        path: lockPath,
+        isDirect
+      });
+    }
+  }
+}
+function scanPythonDependencies(rootDir, seen) {
+  const pyproject = readTextIfExists(path4.join(rootDir, "pyproject.toml")) || "";
+  const directNames = extractPyprojectDirectDeps(pyproject);
+  for (const lockName of ["poetry.lock", "uv.lock"]) {
+    const lockPath = path4.join(rootDir, lockName);
+    const content = readTextIfExists(lockPath);
+    if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
+  }
+  const pipfileLockPath = path4.join(rootDir, "Pipfile.lock");
+  const pipfileRaw = readTextIfExists(pipfileLockPath);
+  if (!pipfileRaw) return;
+  try {
+    const data = JSON.parse(pipfileRaw);
+    parsePipfileSection(data.default || {}, true, pipfileLockPath, seen);
+    parsePipfileSection(data.develop || {}, false, pipfileLockPath, seen);
+  } catch {
+  }
+}
+function parseGoRequireLine(line, goModPath) {
+  const cleaned = line.replace(/^require\s+/, "").trim();
+  const commentIdx = cleaned.indexOf("//");
+  const codePart = (commentIdx >= 0 ? cleaned.slice(0, commentIdx) : cleaned).trim();
+  const commentPart = commentIdx >= 0 ? cleaned.slice(commentIdx + 2).trim() : "";
+  const parts = codePart.split(/\s+/);
+  if (parts.length < 2) return null;
+  const modName = parts[0];
+  const rawVer = parts[1].replace(/^v/, "");
+  const isIndirect = /\bindirect\b/i.test(commentPart);
+  const licenseMatch = commentPart.match(/(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)/i);
+  const spdx = licenseMatch ? normalizeSpdxLicense(licenseMatch[1]) : "UNKNOWN";
+  return {
+    name: modName,
+    version: rawVer,
+    spdxLicense: spdx,
+    purl: `pkg:golang/${modName}@v${rawVer}`,
+    path: goModPath,
+    isDirect: !isIndirect
+  };
+}
+function extractGoCandidateLines(content) {
+  const out = [];
+  let inBlock = false;
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (/^require\s*\($/.test(trimmed)) inBlock = true;
+    else if (inBlock && trimmed === ")") inBlock = false;
+    else if (inBlock || trimmed.startsWith("require ")) out.push(trimmed);
+  }
+  return out;
+}
+function scanGoDependencies(rootDir, seen) {
+  const goModPath = path4.join(rootDir, "go.mod");
+  const content = readTextIfExists(goModPath);
+  if (!content) return;
+  for (const line of extractGoCandidateLines(content)) {
+    const dep = parseGoRequireLine(line, goModPath);
+    if (dep && !seen.has(`golang:${dep.name}@${dep.version}`)) {
+      seen.set(`golang:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractCargoDirectDeps(cargoToml) {
+  const map = /* @__PURE__ */ new Map();
+  let inDeps = false;
+  for (const line of cargoToml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inDeps = /^\[(?:dev-|build-)?dependencies\]$/.test(trimmed);
+      continue;
+    }
+    if (!inDeps || !trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
+    if (m) {
+      const licMatch = m[2].match(/license\s*=\s*["']([^"']+)["']/);
+      map.set(m[1], licMatch ? licMatch[1] : "UNKNOWN");
+    }
+  }
+  return map;
+}
+function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version || name === rootName) return null;
+  const blockLic = extractTomlField(block, "license") || directMeta.get(name) || "UNKNOWN";
+  return {
+    name,
+    version,
+    spdxLicense: normalizeSpdxLicense(blockLic),
+    purl: `pkg:cargo/${name}@${version}`,
+    path: cargoLockPath,
+    isDirect: directMeta.size === 0 || directMeta.has(name)
+  };
+}
+function scanRustDependencies(rootDir, seen) {
+  const cargoLockPath = path4.join(rootDir, "Cargo.lock");
+  const lockContent = readTextIfExists(cargoLockPath);
+  if (!lockContent) return;
+  const cargoToml = readTextIfExists(path4.join(rootDir, "Cargo.toml")) || "";
+  const directMeta = extractCargoDirectDeps(cargoToml);
+  const rootName = extractTomlField(cargoToml, "name");
+  for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseCargoLockBlock(block, rootName, directMeta, cargoLockPath);
+    if (dep && !seen.has(`cargo:${dep.name}@${dep.version}`)) {
+      seen.set(`cargo:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractXmlTag(xml, tag) {
+  const m = xml.match(new RegExp(`<${tag}>([^<]+)</${tag}>`));
+  return m ? m[1].trim() : void 0;
+}
+function resolveMavenBlockLicense(block, defaultLic) {
+  const tagLic = extractXmlTag(block, "license");
+  if (tagLic) return tagLic;
+  const commentLic = block.match(/<!--\s*(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)\s*-->/i)?.[1];
+  return commentLic || defaultLic;
+}
+function parseMavenDepBlock(block, defaultLic, pomPath) {
+  const groupId = extractXmlTag(block, "groupId");
+  const artifactId = extractXmlTag(block, "artifactId");
+  if (!groupId || !artifactId) return null;
+  const version = extractXmlTag(block, "version") || "unknown";
+  const inlineLic = resolveMavenBlockLicense(block, defaultLic);
+  return {
+    name: `${groupId}:${artifactId}`,
+    version,
+    spdxLicense: normalizeSpdxLicense(inlineLic),
+    purl: `pkg:maven/${groupId}/${artifactId}@${version}`,
+    path: pomPath,
+    isDirect: true
+  };
+}
+function scanMavenDependencies(rootDir, seen) {
+  const pomPath = path4.join(rootDir, "pom.xml");
+  const content = readTextIfExists(pomPath);
+  if (!content) return;
+  const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
+  const defaultLic = extractXmlTag(projectLicBlock, "name") || "UNKNOWN";
+  const depBlocks = content.match(/<dependency>[\s\S]*?<\/dependency>/g) || [];
+  for (const block of depBlocks) {
+    const dep = parseMavenDepBlock(block, defaultLic, pomPath);
+    if (dep && !seen.has(`maven:${dep.name}@${dep.version}`)) {
+      seen.set(`maven:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
@@ -5667,6 +5875,10 @@ function scanWithNativeFs(rootDir, options = {}) {
       scanPnpmStore(path4.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
+  scanPythonDependencies(rootDir, seen);
+  scanGoDependencies(rootDir, seen);
+  scanRustDependencies(rootDir, seen);
+  scanMavenDependencies(rootDir, seen);
   const allDeps = Array.from(seen.values());
   if (options.depth === "direct") {
     return allDeps.filter((d) => d.isDirect);
@@ -5736,10 +5948,17 @@ var SEVERITY_RANK = {
   LOW: 1,
   UNKNOWN: 0
 };
+function isExemptByVex(v, vexStatements) {
+  if (!vexStatements || vexStatements.length === 0) return false;
+  return vexStatements.some(
+    (stmt) => stmt.id === v.id && (stmt.state === "not_affected" || stmt.state === "fixed") && (!stmt.package || stmt.package === v.packageName)
+  );
+}
 function evaluateVulnerabilityThresholds(vulnerabilities, options) {
   const minRank = options?.failOnSeverity ? SEVERITY_RANK[options.failOnSeverity] ?? 3 : void 0;
   const maxScore = options?.maxCvssScore;
   const failing = vulnerabilities.filter((v) => {
+    if (isExemptByVex(v, options?.vexStatements)) return false;
     const rankMatch = minRank !== void 0 && SEVERITY_RANK[v.severity] >= minRank;
     const scoreMatch = maxScore !== void 0 && v.cvssV3Score !== void 0 && v.cvssV3Score >= maxScore;
     return rankMatch || scoreMatch;
@@ -5869,42 +6088,77 @@ function buildCycloneDxComponent(dep) {
   }
   return comp;
 }
-function generateCycloneDxSbom(dependencies, options = {}) {
+function buildVexAnalysis(vex) {
+  if (!vex) return void 0;
+  return {
+    state: vex.state,
+    justification: vex.justification,
+    detail: vex.detail,
+    response: vex.response
+  };
+}
+function mapScaVulnToCycloneDx(v, vexStatements) {
+  const matchingVex = vexStatements.find(
+    (stmt) => stmt.id === v.id && (!stmt.package || stmt.package === v.packageName)
+  );
+  return {
+    id: v.id,
+    source: v.primaryUrl ? { name: "NVD/GHSA", url: v.primaryUrl } : void 0,
+    ratings: [{ score: v.cvssV3Score, severity: v.severity.toLowerCase(), method: "CVSSv3", vector: v.cvssV3Vector }],
+    analysis: buildVexAnalysis(matchingVex),
+    affects: [{ ref: `pkg:npm/${v.packageName}@${v.installedVersion}` }]
+  };
+}
+function mapStandaloneVex(stmt) {
+  return {
+    id: stmt.id,
+    analysis: buildVexAnalysis(stmt),
+    affects: stmt.package ? [{ ref: stmt.package }] : void 0
+  };
+}
+function buildCycloneDxVulnerabilities(vulnerabilities = [], vexStatements = []) {
+  const out = vulnerabilities.map((v) => mapScaVulnToCycloneDx(v, vexStatements));
+  const seenIds = new Set(out.map((item) => item.id));
+  for (const stmt of vexStatements) {
+    if (!seenIds.has(stmt.id)) {
+      out.push(mapStandaloneVex(stmt));
+      seenIds.add(stmt.id);
+    }
+  }
+  return out;
+}
+function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
-  if (options.rootDir) {
-    const pkgPath = path4.join(options.rootDir, "package.json");
-    if (fs7.existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
-        if (pkg.name) name = pkg.name;
-        if (pkg.version) version = pkg.version;
-      } catch {
-      }
-    }
+  if (!options.rootDir) return { name, version };
+  const pkgPath = path4.join(options.rootDir, "package.json");
+  if (!fs7.existsSync(pkgPath)) return { name, version };
+  try {
+    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
+    if (pkg.name) name = pkg.name;
+    if (pkg.version) version = pkg.version;
+  } catch {
   }
-  const components = dependencies.map(buildCycloneDxComponent);
+  return { name, version };
+}
+function buildBomMetadata(name, version) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.3.0" }],
+    component: { type: "application", name, version }
+  };
+}
+function generateCycloneDxSbom(dependencies, options = {}) {
+  const { name, version } = resolveProjectIdentity(options);
+  const cdxVulns = buildCycloneDxVulnerabilities(options.vulnerabilities, options.vexStatements);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
     serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-    metadata: {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      tools: [
-        {
-          vendor: "AI-SDLC",
-          name: "@aisdlc/core",
-          version: "1.0.0"
-        }
-      ],
-      component: {
-        type: "application",
-        name,
-        version
-      }
-    },
-    components
+    metadata: buildBomMetadata(name, version),
+    components: dependencies.map(buildCycloneDxComponent),
+    ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
 function tryAtomicWrite(filePath, content) {
@@ -6072,17 +6326,24 @@ function parseExceptions(exceptions) {
   }
   return map;
 }
+function parseVexStatements(doc) {
+  const rawList = doc?.vex_statements || doc?.exceptions?.vex_statements || [];
+  if (!Array.isArray(rawList)) return [];
+  return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
+}
 function parseLicensePolicy(content) {
   try {
     const doc = yaml3.load(content);
     const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
     const exception_packages = parseExceptions(doc?.exceptions);
+    const vex_statements = parseVexStatements(doc);
     return {
       version: doc?.version || "1.0",
       permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
       restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
       blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
       exception_packages,
+      vex_statements,
       rawPolicy: doc
     };
   } catch {
@@ -6091,7 +6352,8 @@ function parseLicensePolicy(content) {
       permitted: DEFAULT_PERMITTED,
       restricted: DEFAULT_RESTRICTED,
       blocked: DEFAULT_BLOCKED,
-      exception_packages: {}
+      exception_packages: {},
+      vex_statements: []
     };
   }
 }
@@ -6266,10 +6528,10 @@ function shouldGenerateSbom(options, rawPolicy) {
   if (options.generateSbom === false) return false;
   return Boolean(options.generateSbom || options.sbomPath || rawPolicy?.ci_gates?.generate_sbom);
 }
-function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies) {
+function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
   const sbomPath = options.sbomPath || path4.join(rootDir, "reports", "sbom.cdx.json");
-  const sbom = generateCycloneDxSbom(dependencies, { rootDir });
+  const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
 }
@@ -6282,9 +6544,9 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
 }
-function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies) {
+function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   return {
-    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies),
+    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements),
     noticesPath: maybeGenerateNotices(options, rootDir, rawPolicy, dependencies)
   };
 }
@@ -6313,7 +6575,7 @@ function buildSkippedVulnResult() {
     skipReason: "Trivy scanner is not installed on host environment. Vulnerability check gracefully skipped."
   };
 }
-function checkVulnerabilities(rootDir, options) {
+function checkVulnerabilities(rootDir, options, vexStatements) {
   if (options.scanVulnerabilities === false) {
     return { vulnerabilities: [], blocked: false };
   }
@@ -6321,7 +6583,10 @@ function checkVulnerabilities(rootDir, options) {
   if (!res.executed) {
     return buildSkippedVulnResult();
   }
-  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, options.vulnerabilityThresholds);
+  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, {
+    ...options.vulnerabilityThresholds,
+    vexStatements
+  });
   return { vulnerabilities: res.vulnerabilities, blocked: evalResult.blocked };
 }
 function assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData) {
@@ -6345,7 +6610,8 @@ function toCleanPolicy(policyWithRaw) {
     permitted: policyWithRaw.permitted,
     restricted: policyWithRaw.restricted,
     blocked: policyWithRaw.blocked,
-    exception_packages: policyWithRaw.exception_packages
+    exception_packages: policyWithRaw.exception_packages,
+    vex_statements: policyWithRaw.vex_statements
   };
 }
 function scanDependenciesForVerification(options, rootDir, rawPolicy) {
@@ -6365,8 +6631,15 @@ function verifyLicenses(options = {}) {
   }
   const dependencies = scanDependenciesForVerification(options, rootDir, policyWithRaw.rawPolicy);
   const { violations, permittedCount } = evaluateDependencyList(dependencies, policy);
-  const artifacts = handleDynamicScaArtifacts(options, rootDir, policyWithRaw.rawPolicy, dependencies);
-  const vulnData = checkVulnerabilities(rootDir, options);
+  const vulnData = checkVulnerabilities(rootDir, options, policy.vex_statements);
+  const artifacts = handleDynamicScaArtifacts(
+    options,
+    rootDir,
+    policyWithRaw.rawPolicy,
+    dependencies,
+    vulnData.vulnerabilities,
+    policy.vex_statements
+  );
   const reportMarkdown = generateLicenseReportMarkdown(dependencies, violations, policy, artifacts.sbomPath);
   return assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData);
 }
@@ -15906,7 +16179,145 @@ function initProject(options = {}) {
     tryInstallGitHook(destDir, options.dryRun)
   );
 }
+var DEFAULT_DLP_RULES = [
+  {
+    id: "DLP-001-PRIVATE-KEY",
+    description: "PEM / RSA / EC / OPENSSH Private Key Block",
+    pattern: "-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\\s\\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----",
+    replacement: "[REDACTED:PRIVATE_KEY]",
+    enabled: true
+  },
+  {
+    id: "DLP-002-API-TOKEN",
+    description: "Cloud, GitHub, Slack, OpenAI, Stripe, and AWS Access Tokens",
+    pattern: "\\b(?:gh[pousr]_[A-Za-z0-9_]{36,255}|github_pat_[0-9a-zA-Z_]{82}|sk-(?:proj-|live-)?[a-zA-Z0-9_-]{32,}|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*|(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99})\\b",
+    replacement: "[REDACTED:API_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-003-JWT",
+    description: "Plaintext JSON Web Token (JWT)",
+    pattern: "\\beyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b",
+    replacement: "[REDACTED:JWT_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-004-CREDIT-CARD",
+    description: "Payment Card Number (13-19 digits formatted)",
+    pattern: "\\b(?:\\d{4}[- ]\\d{4}[- ]\\d{4}[- ]\\d{4}|\\d{16})\\b",
+    replacement: "[REDACTED:CREDIT_CARD]",
+    enabled: true
+  },
+  {
+    id: "DLP-005-EMAIL",
+    description: "Personal or Corporate Email Address",
+    pattern: "\\b[A-Za-z0-9._%+-]+@(?!example\\.com|localhost|test\\.local)[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b",
+    replacement: "[REDACTED:EMAIL]",
+    enabled: true
+  },
+  {
+    id: "DLP-006-INTERNAL-URL",
+    description: "Internal Intranet / Corp Service URL",
+    pattern: "https?://(?:[A-Za-z0-9._-]+:[A-Za-z0-9._-]+@|[A-Za-z0-9.-]+\\.(?:internal|corp|intranet|local)\\b)[^\\s\"'`<>]*",
+    replacement: "[REDACTED:INTERNAL_URL]",
+    enabled: true
+  }
+];
+function createDefaultDlpPolicy() {
+  return {
+    version: "1.0",
+    enabled: true,
+    zero_data_retention_required: true,
+    rules: [...DEFAULT_DLP_RULES]
+  };
+}
+function normalizeParsedRule(raw, idx) {
+  if (typeof raw.pattern !== "string" || !raw.pattern) return null;
+  return {
+    id: typeof raw.id === "string" ? raw.id : `DLP-CUSTOM-${idx + 1}`,
+    description: typeof raw.description === "string" ? raw.description : "Custom DLP rule",
+    pattern: raw.pattern,
+    replacement: typeof raw.replacement === "string" ? raw.replacement : "[REDACTED]",
+    enabled: raw.enabled !== false
+  };
+}
+function parseDlpPolicy(yamlContent) {
+  const fallback = createDefaultDlpPolicy();
+  if (!yamlContent || !yamlContent.trim()) return fallback;
+  try {
+    const doc = yaml3.load(yamlContent);
+    if (!doc || typeof doc !== "object") return fallback;
+    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
+    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+    return {
+      version: typeof doc.version === "string" ? doc.version : "1.0",
+      enabled: doc.enabled !== false,
+      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
+      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+    };
+  } catch {
+    return fallback;
+  }
+}
+function loadDlpPolicy(rootDir, customPolicyPath) {
+  const base = rootDir || process.cwd();
+  const filePath = customPolicyPath ? path4.isAbsolute(customPolicyPath) ? customPolicyPath : path4.join(base, customPolicyPath) : path4.join(base, "dlp-policy.yaml");
+  if (!fs7.existsSync(filePath)) return createDefaultDlpPolicy();
+  try {
+    return parseDlpPolicy(fs7.readFileSync(filePath, "utf-8"));
+  } catch {
+    return createDefaultDlpPolicy();
+  }
+}
+function applySingleDlpRule(text, rule) {
+  if (rule.enabled === false) return { output: text, matches: 0 };
+  try {
+    const regex = new RegExp(rule.pattern, "g");
+    let matches = 0;
+    const output = text.replace(regex, () => {
+      matches++;
+      return rule.replacement;
+    });
+    return { output, matches };
+  } catch {
+    return { output: text, matches: 0 };
+  }
+}
+function sanitizeDlpText(text, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || !text) {
+    return { sanitizedText: text, redactionCount: 0, triggeredRuleIds: [] };
+  }
+  let current = text;
+  let totalRedactions = 0;
+  const triggered = [];
+  for (const rule of policy.rules) {
+    const res = applySingleDlpRule(current, rule);
+    if (res.matches > 0) {
+      current = res.output;
+      totalRedactions += res.matches;
+      triggered.push(rule.id);
+    }
+  }
+  return {
+    sanitizedText: current,
+    redactionCount: totalRedactions,
+    triggeredRuleIds: triggered
+  };
+}
+function sanitizeDlpPayload(payload, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || payload === null || payload === void 0) return payload;
+  if (typeof payload === "string") {
+    return sanitizeDlpText(payload, policy).sanitizedText;
+  }
+  const serialized = JSON.stringify(payload);
+  const { sanitizedText } = sanitizeDlpText(serialized, policy);
+  try {
+    return JSON.parse(sanitizedText);
+  } catch {
+    return payload;
+  }
+}
 
-export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
+export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseDlpPolicy, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map