@aisdlc/core 2.2.4 → 2.4.0

package/dist/index.cjs

@@ -294,19 +294,26 @@ function extractPythonFunctions(content, filePath) {
   }
   return buildMetricsFromBlocks(blocks, content, filePath);
 }
-function processBraceLine(line, state, blocks, lineIndex, ext) {
-  if (!state.currentFn) {
-    const candidate = matchFunctionHeader(line, ext);
-    if (!candidate) return;
+function tryStartBraceFunction(line, state, ext) {
+  if (state.currentFn || state.inBlockComment || state.rawTerm) return;
+  const candidate = matchFunctionHeader(line, ext);
+  if (candidate) {
     state.currentFn = candidate;
     state.braceCount = 0;
     state.fnLines = [];
   }
-  state.fnLines.push(line);
-  const res = scanBracesInLine(line, state.inBlockComment, ext);
+}
+function updateBraceScanState(line, state, ext) {
+  const res = scanBracesInLine(line, state.inBlockComment, state.rawTerm, ext);
   state.inBlockComment = res.nowInBlock;
+  state.rawTerm = res.nowRawTerm;
   state.braceCount += res.delta;
-  if (state.braceCount === 0 && state.fnLines.length > 1) {
+}
+function processBraceLine(line, state, blocks, lineIndex, ext) {
+  tryStartBraceFunction(line, state, ext);
+  if (state.currentFn) state.fnLines.push(line);
+  updateBraceScanState(line, state, ext);
+  if (state.currentFn && state.braceCount === 0 && state.fnLines.length > 1) {
     blocks.push({ name: state.currentFn, body: state.fnLines.join("\n"), startLine: lineIndex });
     state.currentFn = null;
     state.fnLines = [];
@@ -316,98 +323,153 @@ function extractBraceFunctions(content, filePath) {
   const ext = path4__namespace.extname(filePath).toLowerCase();
   const lines = content.split("\n");
   const blocks = [];
-  const state = { currentFn: null, braceCount: 0, fnLines: [], inBlockComment: false };
+  const state = {
+    currentFn: null,
+    braceCount: 0,
+    fnLines: [],
+    inBlockComment: false,
+    rawTerm: null
+  };
   for (let i = 0; i < lines.length; i++) {
     processBraceLine(lines[i], state, blocks, i, ext);
   }
   return buildMetricsFromBlocks(blocks, content, filePath);
 }
+var HEADER_EXCLUSIONS = /* @__PURE__ */ new Set([
+  "if",
+  "for",
+  "foreach",
+  "while",
+  "switch",
+  "catch",
+  "select",
+  "match",
+  "class",
+  "struct",
+  "interface",
+  "record",
+  "enum",
+  "namespace",
+  "using",
+  "lock",
+  "fixed",
+  "synchronized",
+  "try",
+  "else"
+]);
 function matchCStyleHeader(line) {
   const match = line.match(
-    /(?:(?:public|private|protected|static|async|virtual|override|fn)\s+)*(?:function\s+([a-zA-Z0-9_$]+)|(?:[a-zA-Z0-9_<>[\]?]+\s+)+([a-zA-Z0-9_$]+)\s*\([^;{]*\)\s*(?:throws\s+[^{]+)?\{|([a-zA-Z0-9_$]+)\s*\([^;{]*\)\s*(?::\s*[^{]+\s*)?\{)/
+    /(?:(?:public|private|protected|internal|static|async|virtual|override|sealed|abstract|final|synchronized|default|fn)\s+)*(?:function\s+([a-zA-Z0-9_$]+)|(?:[a-zA-Z0-9_<>[\]?,.\s]+\s+)+([a-zA-Z0-9_$]+)\s*(?:<[^>]+>)?\s*\([^;{}]*\)\s*(?:where\s+[^{]+|throws\s+[^{]+)?\{|([a-zA-Z0-9_$]+)\s*\([^;{}]*\)\s*(?::\s*[^{]+\s*)?\{)/
   );
   if (!match) return null;
   const candidate = match[1] || match[2] || match[3];
-  const exclusions = ["if", "for", "while", "switch", "catch", "select", "match", "class", "struct"];
-  return candidate && !exclusions.includes(candidate) ? candidate : null;
+  return candidate && !HEADER_EXCLUSIONS.has(candidate) ? candidate : null;
 }
 function matchFunctionHeader(line, ext) {
   const trimmed = line.trim();
-  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*")) return null;
+  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*") || trimmed.startsWith("#")) {
+    return null;
+  }
   if (ext === ".go") {
-    const match = line.match(/func\s+(?:\([^)]*\)\s*)?([a-zA-Z0-9_$]+)\s*\(/);
+    const match = line.match(/func\s+(?:\([^)]*\)\s*)?([a-zA-Z0-9_$]+)\s*(?:\[[^\]]*\])?\s*\(/);
     return match ? match[1] : null;
   }
   if (ext === ".rs") {
-    const match = line.match(/(?:pub\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+([a-zA-Z0-9_$]+)\s*\(/);
+    const match = line.match(/(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?(?:unsafe\s+)?(?:const\s+)?fn\s+([a-zA-Z0-9_$]+)\s*(?:<[^>]*>)?\s*\(/);
     return match ? match[1] : null;
   }
   return matchCStyleHeader(line);
 }
-function handleStringChar(char, inString) {
-  if (char === inString) return { inString: null, skip: false };
-  return { inString, skip: char === "\\" };
-}
-function handleBlockState(char, next, inBlock) {
-  if (inBlock && char === "*" && next === "/") return { inBlock: false, skip: true };
-  return { inBlock, skip: false };
-}
-function checkCommentOrQuote(char, next, ext) {
-  if (char === "/" && next === "/") return { startBlock: false, quote: null, isLineComment: true };
-  if (char === "/" && next === "*") return { startBlock: true, quote: null, isLineComment: false };
-  const isQuote = char === '"' || char === "'" || char === "`" && ext === ".go";
-  return { startBlock: false, quote: isQuote ? char : null, isLineComment: false };
-}
-function stepSkippedState(char, next, inBlock, inString) {
-  if (inBlock) {
-    const res = handleBlockState(char, next, inBlock);
-    return { inBlock: res.inBlock, inString, skip: res.skip, handled: true };
-  }
-  if (inString) {
-    const res = handleStringChar(char, inString);
-    return { inBlock, inString: res.inString, skip: res.skip, handled: true };
-  }
-  return { inBlock, inString, skip: false, handled: false };
-}
-function checkCodeChar(char, next, ext) {
-  const trigger = checkCommentOrQuote(char, next, ext);
-  if (trigger.isLineComment) return { delta: 0, startBlock: false, quote: null, stop: true };
-  if (trigger.startBlock) return { delta: 0, startBlock: true, quote: null, stop: false };
-  if (trigger.quote) return { delta: 0, startBlock: false, quote: trigger.quote, stop: false };
-  const delta = char === "{" ? 1 : char === "}" ? -1 : 0;
-  return { delta, startBlock: false, quote: null, stop: false };
-}
-function applyCodeChar(res, state) {
-  if (res.stop) return { advance: 0, stop: true };
-  if (res.startBlock) {
+function detectRustOrGoRawString(sub, ext) {
+  if (ext === ".rs") {
+    const m = sub.match(/^r(#*)"/);
+    return m ? { term: `"${m[1]}`, advance: m[0].length - 1 } : null;
+  }
+  if (ext === ".go" && sub.startsWith("`")) {
+    return { term: "`", advance: 0 };
+  }
+  return null;
+}
+function detectCsJavaOrCppRawString(sub, ext) {
+  if (ext === ".cs" || ext === ".java") {
+    const m = sub.match(/^\$*("{3,})/);
+    if (m) return { term: m[1], advance: m[0].length - 1 };
+    const v = ext === ".cs" ? sub.match(/^(@\$|\$@|@)"/) : null;
+    return v ? { term: '"', advance: v[0].length - 1 } : null;
+  }
+  const cpp = sub.match(/^R"([a-zA-Z0-9_]*)\(/);
+  return cpp ? { term: `)${cpp[1]}"`, advance: cpp[0].length - 1 } : null;
+}
+function detectRawStringOpen(line, index, ext) {
+  const sub = line.slice(index);
+  return detectRustOrGoRawString(sub, ext) || detectCsJavaOrCppRawString(sub, ext);
+}
+function consumeRawOrBlock(line, index, state) {
+  if (state.inBlock) {
+    if (line[index] === "*" && line[index + 1] === "/") {
+      state.inBlock = false;
+      return { advance: 1, handled: true };
+    }
+    return { advance: 0, handled: true };
+  }
+  if (state.rawTerm) {
+    if (line.startsWith(state.rawTerm, index)) {
+      const len = state.rawTerm.length - 1;
+      state.rawTerm = null;
+      return { advance: len, handled: true };
+    }
+    return { advance: 0, handled: true };
+  }
+  return { advance: 0, handled: false };
+}
+function consumeNormalQuote(line, index, state) {
+  if (!state.inString) return { advance: 0, handled: false };
+  const ch = line[index];
+  if (ch === "\\") return { advance: 1, handled: true };
+  if (ch === state.inString) state.inString = null;
+  return { advance: 0, handled: true };
+}
+function applyQuoteOrBrace(ch, state) {
+  if (ch === '"' || ch === "'") {
+    state.inString = ch;
+    return;
+  }
+  if (ch === "{") state.delta++;
+  if (ch === "}") state.delta--;
+}
+function stepActiveCodeToken(line, j, ext, state) {
+  const pair = line.slice(j, j + 2);
+  if (pair === "//") return { advance: 0, stop: true };
+  if (pair === "/*") {
     state.inBlock = true;
     return { advance: 1, stop: false };
   }
-  if (res.quote) {
-    state.inString = res.quote;
-    return { advance: 0, stop: false };
+  const rawOpen = detectRawStringOpen(line, j, ext);
+  if (rawOpen) {
+    state.rawTerm = rawOpen.term;
+    return { advance: rawOpen.advance, stop: false };
   }
-  state.delta += res.delta;
+  applyQuoteOrBrace(line[j], state);
   return { advance: 0, stop: false };
 }
-function scanBracesInLine(line, wasInBlock, ext) {
-  const state = { delta: 0, inBlock: wasInBlock, inString: null };
+function scanBracesInLine(line, wasInBlock, wasRawTerm, ext) {
+  const state = { delta: 0, inBlock: wasInBlock, rawTerm: wasRawTerm, inString: null };
   for (let j = 0; j < line.length; j++) {
-    const char = line[j];
-    const next = j + 1 < line.length ? line[j + 1] : "";
-    const skipped = stepSkippedState(char, next, state.inBlock, state.inString);
-    if (skipped.handled) {
-      state.inBlock = skipped.inBlock;
-      state.inString = skipped.inString;
-      if (skipped.skip) j++;
+    const rawOrBlock = consumeRawOrBlock(line, j, state);
+    if (rawOrBlock.handled) {
+      j += rawOrBlock.advance;
+      continue;
+    }
+    const quoteStep = consumeNormalQuote(line, j, state);
+    if (quoteStep.handled) {
+      j += quoteStep.advance;
       continue;
     }
-    const res = checkCodeChar(char, next, ext);
-    const step = applyCodeChar(res, state);
-    if (step.stop) break;
-    j += step.advance;
+    const codeStep = stepActiveCodeToken(line, j, ext, state);
+    if (codeStep.stop) break;
+    j += codeStep.advance;
   }
-  return { delta: state.delta, nowInBlock: state.inBlock };
+  return { delta: state.delta, nowInBlock: state.inBlock, nowRawTerm: state.rawTerm };
 }
 function buildMetricsFromBlocks(blocks, content, filePath) {
   if (blocks.length === 0) {
@@ -431,11 +493,20 @@ function buildMetricsFromBlocks(blocks, content, filePath) {
 }
 function detectPolyglotSmells(body) {
   const smells = [];
-  if (/#\s*noqa|#\s*type:\s*ignore|@SuppressWarnings/.test(body)) {
+  if (/#\s*noqa|#\s*type:\s*ignore|@SuppressWarnings|#pragma\s+warning\s+disable/.test(body)) {
     smells.push("Supresi\xF3n no autorizada de linter");
   }
   return smells;
 }
+function stripStringsAndComments(body, ext) {
+  let cleaned = body;
+  if (ext === ".py") {
+    cleaned = cleaned.replace(/"""[\s\S]*?"""|'''[\s\S]*?'''/g, '""').replace(/#.*/g, "");
+  } else {
+    cleaned = cleaned.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, "").replace(/r(#+)"[\s\S]*?"\1/g, '""').replace(/R"([a-zA-Z0-9_]*)\([\s\S]*?\)\1"/g, '""').replace(/\$*"{3,}[\s\S]*?"{3,}/g, '""').replace(/`[\s\S]*?`/g, '""');
+  }
+  return cleaned.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""');
+}
 function computeHalsteadMI(body, cyclomatic, loc, commentCount) {
   const cleanText = body.replace(/\/\*[\s\S]*?\*\/|\/\/.*|#.*/g, "");
   const tokens = cleanText.split(/[\s,;().{}[\]=+\-*/<>!&|:]+/).filter((t) => t.length > 0);
@@ -460,9 +531,11 @@ function countCommentsAndLoc(rawLines, isPy) {
 function calculatePolyglotMetrics(body, name, filePath, startLine) {
   const ext = path4__namespace.extname(filePath).toLowerCase();
   const rawLines = body.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
-  const { loc, commentCount, cleanLines } = countCommentsAndLoc(rawLines, ext === ".py");
-  const cyclomatic = computePolyglotCyclomatic(body, ext);
-  const cognitive = computePolyglotCognitive(cleanLines, ext === ".py");
+  const { loc, commentCount } = countCommentsAndLoc(rawLines, ext === ".py");
+  const strippedBody = stripStringsAndComments(body, ext);
+  const strippedLines = strippedBody.split(/\r?\n/).filter((l) => l.trim().length > 0);
+  const cyclomatic = computePolyglotCyclomatic(strippedBody, ext);
+  const cognitive = computePolyglotCognitive(strippedLines, ext === ".py");
   const maintainability = computeHalsteadMI(body, cyclomatic, loc, commentCount);
   return {
     functionName: name,
@@ -475,40 +548,60 @@ function calculatePolyglotMetrics(body, name, filePath, startLine) {
     line: startLine ? startLine + 1 : 1
   };
 }
-function computePolyglotCyclomatic(body, ext) {
-  let regex;
+function getCyclomaticPattern(ext) {
   if (ext === ".py") {
-    regex = /\b(if|elif|for|while|except)\b|\b(and|or)\b/g;
-  } else if (ext === ".go") {
-    regex = /\b(if|for|case|select)\b|&&|\|\|/g;
-  } else if (ext === ".rs") {
-    regex = /\b(if|for|while|match)\b|&&|\|\||\?/g;
-  } else {
-    regex = /\b(if|else\s+if|for|while|catch|case)\b|\?|&&|\|\|/g;
+    return /\b(if|elif|for|while|except|case)\b|\b(and|or)\b/g;
+  }
+  if (ext === ".go") {
+    return /\b(if|for|case|select)\b|&&|\|\|/g;
+  }
+  if (ext === ".rs") {
+    return /\b(if|for|while|match)\b|&&|\|\||\?/g;
+  }
+  if (ext === ".cs") {
+    return /\b(if|else\s+if|for|foreach|while|catch|case|when)\b|\?\?|\?\.(?=[a-zA-Z_])|&&|\|\|/g;
+  }
+  if (ext === ".java") {
+    return /\b(if|else\s+if|for|while|catch|case|when)\b|&&|\|\|/g;
   }
-  const cleanBody = body.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, "");
-  const matches = cleanBody.match(regex);
+  return /\b(if|else\s+if|for|while|catch|case)\b|\?|&&|\|\|/g;
+}
+function computePolyglotCyclomatic(strippedBody, ext) {
+  const regex = getCyclomaticPattern(ext);
+  const matches = strippedBody.match(regex);
   return 1 + (matches ? matches.length : 0);
 }
-function computePolyglotCognitive(lines, isPy) {
+var PY_COGNITIVE_RE = /\b(if|elif|for|while|except|match)\b/;
+var BRACE_COGNITIVE_RE = /\b(if|for|foreach|while|catch|match|select|switch)\b/;
+function computePythonCognitive(lines) {
+  let cognitive = 0;
+  const baseIndent = lines.length > 0 ? lines[0].length - lines[0].trimStart().length : 0;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (PY_COGNITIVE_RE.test(line)) {
+      const relIndent = Math.max(0, line.length - line.trimStart().length - baseIndent - 4);
+      cognitive += 1 + Math.floor(relIndent / 4);
+    }
+  }
+  return cognitive;
+}
+function computeBraceCognitive(lines) {
   let cognitive = 0;
   let nesting = 0;
-  for (const line of lines) {
-    if (isPy) {
-      const indent = line.length - line.trimStart().length;
-      if (/\b(if|elif|for|while|except)\b/.test(line)) {
-        cognitive += 1 + Math.floor(indent / 4);
-      }
-    } else {
-      if (line.includes("{")) nesting++;
-      if (line.includes("}")) nesting = Math.max(0, nesting - 1);
-      if (/\b(if|for|while|catch|match|select)\b/.test(line)) {
-        cognitive += 1 + nesting;
-      }
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (BRACE_COGNITIVE_RE.test(line)) {
+      cognitive += 1 + nesting;
     }
+    const opens = (line.match(/\{/g) || []).length;
+    const closes = (line.match(/\}/g) || []).length;
+    nesting = Math.max(0, nesting + opens - closes);
   }
   return cognitive;
 }
+function computePolyglotCognitive(lines, isPy) {
+  return isPy ? computePythonCognitive(lines) : computeBraceCognitive(lines);
+}
 function walkMdFiles(dir, fileList = [], excludeDirs = [
   "node_modules",
   ".git",
@@ -1092,9 +1185,54 @@ function collectTestCorpus(rootDir, allMdFiles) {
   }
   return { gherkinSources, combinedTests: testContents.join("\n") };
 }
-function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, taskErrors, ucErrors) {
+function isCucumberScenarioPassed(element) {
+  const steps = Array.isArray(element.steps) ? element.steps : [];
+  if (steps.length === 0) return false;
+  return steps.every((s) => {
+    const res = s.result;
+    return res && res.status === "passed";
+  });
+}
+function countCucumberScenarios(raw) {
+  let passed = 0;
+  let failed = 0;
+  for (const feat of raw) {
+    const elements = Array.isArray(feat.elements) ? feat.elements : [];
+    for (const el of elements) {
+      if (isCucumberScenarioPassed(el)) passed++;
+      else failed++;
+    }
+  }
+  return { passed, failed };
+}
+function parseCucumberReportFile(reportPath) {
+  if (!fs7__namespace.existsSync(reportPath)) return void 0;
+  try {
+    const raw = JSON.parse(fs7__namespace.readFileSync(reportPath, "utf-8"));
+    if (!Array.isArray(raw)) return void 0;
+    const { passed, failed } = countCucumberScenarios(raw);
+    return {
+      evaluatedFeatures: raw.length,
+      passedScenarios: passed,
+      failedScenarios: failed,
+      passed: passed + failed > 0 && failed === 0
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resolveCucumberReport(rootDir, options) {
+  const candidate = options.cucumberReportPath ? path4__namespace.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path4__namespace.join(rootDir, options.cucumberReportPath) : path4__namespace.join(rootDir, "reports", "cucumber-report.json");
+  const parsed = parseCucumberReportFile(candidate);
+  if (parsed) return parsed;
+  if (options.enforceCucumberExecution) {
+    return { evaluatedFeatures: 0, passedScenarios: 0, failedScenarios: 1, passed: false };
+  }
+  return void 0;
+}
+function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, taskErrors, ucErrors, rootDir, options) {
   return {
-    success: reqErrors === 0 && taskErrors === 0 && ucErrors === 0,
+    success: reqErrors === 0 && taskErrors === 0 && ucErrors === 0 && (!resolveCucumberReport(rootDir, options) || resolveCucumberReport(rootDir, options).passed),
     totalRequirements: reqAudit.length,
     passedRequirements: reqAudit.length - reqErrors,
     failedRequirements: reqErrors,
@@ -1105,6 +1243,7 @@ function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, ta
     tasks: taskAudit,
     useCaseFlows,
     failedUseCaseFlows: ucErrors,
+    ...resolveCucumberReport(rootDir, options) ? { cucumberExecution: resolveCucumberReport(rootDir, options) } : {},
     reportMarkdown: generateTestingCoverageReportMarkdown(reqAudit, taskAudit, reqErrors, taskErrors)
   };
 }
@@ -1156,7 +1295,9 @@ function verifyTestingCoverage(options = {}) {
     state.useCaseFlows,
     state.reqErrors,
     state.taskErrors,
-    state.ucErrors
+    state.ucErrors,
+    rootDir,
+    options
   );
 }
 
@@ -5532,6 +5673,277 @@ function verifyTasksGovernance(options = {}) {
   );
   return assembleGovernanceResult(data, reportMarkdown);
 }
+var BddStepRegistry = class {
+  definitions = [];
+  register(pattern, handler) {
+    this.definitions.push({ pattern, handler });
+    return this;
+  }
+  given(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  when(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  then(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  getDefinitions() {
+    return this.definitions;
+  }
+};
+var STEP_PREFIX_RE = /^(Given|When|Then|And|But|Dado|Cuando|Entonces|Y|Pero)\s+(.+)$/i;
+var SCENARIO_HEADER_RE = /^(Scenario|Escenario|Scenario Outline|Esquema del escenario):\s*(.+)$/i;
+function parseTableRowCells(line) {
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+}
+function attachStepTableRow(lastStep, cells) {
+  if (!lastStep || cells.length < 2) return;
+  if (!lastStep.table) lastStep.table = {};
+  lastStep.table[cells[0]] = cells[1];
+}
+function attachExampleRow(scenario, headers, cells) {
+  if (!scenario) return headers;
+  if (headers.length === 0) return cells;
+  const row = {};
+  for (let i = 0; i < headers.length; i++) {
+    row[headers[i]] = cells[i] ?? "";
+  }
+  scenario.examples.push(row);
+  return headers;
+}
+function createInitialParseState() {
+  return {
+    featureName: "Unnamed Feature",
+    featureTags: [],
+    pendingTags: [],
+    backgroundSteps: [],
+    scenarios: [],
+    currentScenario: null,
+    inBackground: false,
+    inExamples: false,
+    exampleHeaders: []
+  };
+}
+function handleStructuralHeaderLine(line, state) {
+  if (/^(Feature|Caracter[ií]stica):/i.test(line)) {
+    state.featureName = line.replace(/^(Feature|Caracter[ií]stica):\s*/i, "").trim();
+    state.featureTags.push(...state.pendingTags);
+    state.pendingTags = [];
+    return true;
+  }
+  if (/^(Background|Antecedentes):/i.test(line)) {
+    state.inBackground = true;
+    state.inExamples = false;
+    state.currentScenario = null;
+    return true;
+  }
+  if (/^(Examples|Ejemplos):/i.test(line)) {
+    state.inExamples = true;
+    state.exampleHeaders = [];
+    return true;
+  }
+  return false;
+}
+function startScenarioBlock(scenMatch, state) {
+  state.inBackground = false;
+  state.inExamples = false;
+  const block = {
+    name: scenMatch[2].trim(),
+    tags: [...state.featureTags, ...state.pendingTags],
+    isOutline: /outline|esquema/i.test(scenMatch[1]),
+    steps: [],
+    examples: []
+  };
+  state.pendingTags = [];
+  state.scenarios.push(block);
+  state.currentScenario = block;
+}
+function appendParsedStep(stepMatch, state) {
+  const step = { keyword: stepMatch[1], text: stepMatch[2].trim() };
+  if (state.inBackground) {
+    state.backgroundSteps.push(step);
+  } else if (state.currentScenario) {
+    state.currentScenario.steps.push(step);
+  }
+}
+function handleScenarioOrStepLine(line, state) {
+  const scenMatch = line.match(SCENARIO_HEADER_RE);
+  if (scenMatch) {
+    startScenarioBlock(scenMatch, state);
+    return;
+  }
+  const stepMatch = line.match(STEP_PREFIX_RE);
+  if (stepMatch) {
+    appendParsedStep(stepMatch, state);
+  }
+}
+function processFeatureLine(rawLine, state) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#")) return;
+  if (line.startsWith("@")) {
+    const tags = line.split(/\s+/).filter((t) => t.startsWith("@"));
+    state.pendingTags.push(...tags);
+    return;
+  }
+  if (line.startsWith("|")) {
+    const cells = parseTableRowCells(line);
+    if (state.inExamples) {
+      state.exampleHeaders = attachExampleRow(state.currentScenario, state.exampleHeaders, cells);
+    } else {
+      const targetList = state.inBackground ? state.backgroundSteps : state.currentScenario?.steps || [];
+      attachStepTableRow(targetList[targetList.length - 1], cells);
+    }
+    return;
+  }
+  if (!handleStructuralHeaderLine(line, state)) {
+    handleScenarioOrStepLine(line, state);
+  }
+}
+function parseFeatureDocument(content) {
+  const state = createInitialParseState();
+  for (const rawLine of content.split(/\r?\n/)) {
+    processFeatureLine(rawLine, state);
+  }
+  return {
+    featureName: state.featureName,
+    tags: state.featureTags,
+    backgroundSteps: state.backgroundSteps,
+    scenarios: state.scenarios
+  };
+}
+function interpolatePlaceholders(text, row) {
+  let out = text;
+  for (const [k, v] of Object.entries(row)) {
+    out = out.replace(new RegExp(`<${k}>`, "g"), v);
+  }
+  return out;
+}
+function expandScenarioOutlines(scenarios) {
+  const expanded = [];
+  for (const sc of scenarios) {
+    if (!sc.isOutline || sc.examples.length === 0) {
+      expanded.push(sc);
+      continue;
+    }
+    sc.examples.forEach((row, idx) => {
+      expanded.push({
+        name: `${sc.name} (Example #${idx + 1})`,
+        tags: sc.tags,
+        isOutline: false,
+        steps: sc.steps.map((st) => ({
+          keyword: st.keyword,
+          text: interpolatePlaceholders(st.text, row),
+          table: st.table
+        })),
+        examples: []
+      });
+    });
+  }
+  return expanded;
+}
+function matchStepDefinition(text, definitions) {
+  for (const entry of definitions) {
+    if (typeof entry.pattern === "string") {
+      if (entry.pattern === text) return { entry, args: [] };
+    } else {
+      const m = text.match(entry.pattern);
+      if (m) return { entry, args: m.slice(1) };
+    }
+  }
+  return null;
+}
+async function executeSingleStep(step, definitions) {
+  const matched = matchStepDefinition(step.text, definitions);
+  if (!matched) {
+    return { keyword: step.keyword, text: step.text, status: "undefined", durationMs: 0 };
+  }
+  const start = Date.now();
+  try {
+    await matched.entry.handler(matched.args, step.table);
+    return { keyword: step.keyword, text: step.text, status: "passed", durationMs: Date.now() - start };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      keyword: step.keyword,
+      text: step.text,
+      status: "failed",
+      durationMs: Date.now() - start,
+      errorMessage: msg
+    };
+  }
+}
+async function executeScenarioSteps(allSteps, definitions) {
+  const stepResults = [];
+  let status = "passed";
+  for (const step of allSteps) {
+    if (status !== "passed") {
+      stepResults.push({ keyword: step.keyword, text: step.text, status: "skipped", durationMs: 0 });
+      continue;
+    }
+    const res = await executeSingleStep(step, definitions);
+    stepResults.push(res);
+    if (res.status === "failed" || res.status === "undefined") {
+      status = res.status;
+    }
+  }
+  return { stepResults, status };
+}
+async function runAllExpandedScenarios(parsed, definitions) {
+  const expanded = expandScenarioOutlines(parsed.scenarios);
+  const out = [];
+  for (const sc of expanded) {
+    const combinedSteps = [...parsed.backgroundSteps, ...sc.steps];
+    const { stepResults, status } = await executeScenarioSteps(combinedSteps, definitions);
+    out.push({ name: sc.name, tags: sc.tags, status, steps: stepResults });
+  }
+  return out;
+}
+async function executeBddFeature(featurePath, registry, options = {}) {
+  const rootDir = options.rootDir || process.cwd();
+  const fullPath = path4__namespace.isAbsolute(featurePath) ? featurePath : path4__namespace.join(rootDir, featurePath);
+  const parsed = parseFeatureDocument(fs7__namespace.readFileSync(fullPath, "utf-8"));
+  const scenarios = await runAllExpandedScenarios(parsed, registry.getDefinitions());
+  const report = {
+    uri: path4__namespace.relative(rootDir, fullPath).replace(/\\/g, "/"),
+    featureName: parsed.featureName,
+    tags: parsed.tags,
+    scenarios,
+    passed: scenarios.length > 0 && scenarios.every((s) => s.status === "passed")
+  };
+  if (options.writeReportPath) writeCucumberJsonReport([report], options.writeReportPath);
+  return report;
+}
+function mapStepToCucumberJson(st) {
+  return {
+    keyword: `${st.keyword} `,
+    name: st.text,
+    result: {
+      status: st.status,
+      duration: st.durationMs * 1e6,
+      ...st.errorMessage ? { error_message: st.errorMessage } : {}
+    }
+  };
+}
+function mapFeatureToCucumberJson(r) {
+  return {
+    uri: r.uri,
+    name: r.featureName,
+    tags: r.tags.map((t) => ({ name: t })),
+    elements: r.scenarios.map((sc) => ({
+      type: "scenario",
+      name: sc.name,
+      tags: sc.tags.map((t) => ({ name: t })),
+      steps: sc.steps.map(mapStepToCucumberJson)
+    }))
+  };
+}
+function writeCucumberJsonReport(reports, outputPath) {
+  const dir = path4__namespace.dirname(outputPath);
+  if (!fs7__namespace.existsSync(dir)) fs7__namespace.mkdirSync(dir, { recursive: true });
+  const payload = JSON.stringify(reports.map(mapFeatureToCucumberJson), null, 2);
+  fs7__namespace.writeFileSync(outputPath, payload, "utf-8");
+}
 function isToolAvailable(toolName) {
   try {
     const cmd = process.platform === "win32" ? "where" : "which";
@@ -5685,6 +6097,214 @@ function scanPnpmStore(pnpmDir, directNames, seen) {
     }
   }
 }
+function readTextIfExists(filePath) {
+  if (!fs7__namespace.existsSync(filePath)) return null;
+  try {
+    return fs7__namespace.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function extractTomlField(block, key) {
+  const m = block.match(new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, "m"));
+  return m ? m[1].trim() : void 0;
+}
+function extractPyprojectDirectDeps(content) {
+  const direct = /* @__PURE__ */ new Set();
+  const matches = content.matchAll(/^([a-zA-Z0-9_.-]+)\s*=\s*(?:["'{]|true)/gm);
+  for (const m of matches) {
+    const key = m[1].toLowerCase();
+    if (!["name", "version", "description", "license", "python", "readme"].includes(key)) {
+      direct.add(key);
+    }
+  }
+  return direct;
+}
+function parseSingleTomlBlock(block, lockPath, directNames) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version) return null;
+  const spdx = normalizeSpdxLicense(extractTomlField(block, "license") || "UNKNOWN");
+  return {
+    name,
+    version,
+    spdxLicense: spdx,
+    purl: `pkg:pypi/${name.toLowerCase()}@${version}`,
+    path: lockPath,
+    isDirect: directNames.size === 0 || directNames.has(name.toLowerCase())
+  };
+}
+function parseTomlPackageBlocks(content, lockPath, directNames, seen) {
+  for (const block of content.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseSingleTomlBlock(block, lockPath, directNames);
+    if (dep && !seen.has(`pypi:${dep.name}@${dep.version}`)) {
+      seen.set(`pypi:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
+  for (const [name, meta] of Object.entries(pkgs)) {
+    const rawVer = String(meta.version || "").replace(/^==/, "") || "unknown";
+    const spdx = normalizeSpdxLicense(meta.license || "UNKNOWN");
+    const key = `pypi:${name}@${rawVer}`;
+    if (!seen.has(key)) {
+      seen.set(key, {
+        name,
+        version: rawVer,
+        spdxLicense: spdx,
+        purl: `pkg:pypi/${name.toLowerCase()}@${rawVer}`,
+        path: lockPath,
+        isDirect
+      });
+    }
+  }
+}
+function scanPythonDependencies(rootDir, seen) {
+  const pyproject = readTextIfExists(path4__namespace.join(rootDir, "pyproject.toml")) || "";
+  const directNames = extractPyprojectDirectDeps(pyproject);
+  for (const lockName of ["poetry.lock", "uv.lock"]) {
+    const lockPath = path4__namespace.join(rootDir, lockName);
+    const content = readTextIfExists(lockPath);
+    if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
+  }
+  const pipfileLockPath = path4__namespace.join(rootDir, "Pipfile.lock");
+  const pipfileRaw = readTextIfExists(pipfileLockPath);
+  if (!pipfileRaw) return;
+  try {
+    const data = JSON.parse(pipfileRaw);
+    parsePipfileSection(data.default || {}, true, pipfileLockPath, seen);
+    parsePipfileSection(data.develop || {}, false, pipfileLockPath, seen);
+  } catch {
+  }
+}
+function parseGoRequireLine(line, goModPath) {
+  const cleaned = line.replace(/^require\s+/, "").trim();
+  const commentIdx = cleaned.indexOf("//");
+  const codePart = (commentIdx >= 0 ? cleaned.slice(0, commentIdx) : cleaned).trim();
+  const commentPart = commentIdx >= 0 ? cleaned.slice(commentIdx + 2).trim() : "";
+  const parts = codePart.split(/\s+/);
+  if (parts.length < 2) return null;
+  const modName = parts[0];
+  const rawVer = parts[1].replace(/^v/, "");
+  const isIndirect = /\bindirect\b/i.test(commentPart);
+  const licenseMatch = commentPart.match(/(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)/i);
+  const spdx = licenseMatch ? normalizeSpdxLicense(licenseMatch[1]) : "UNKNOWN";
+  return {
+    name: modName,
+    version: rawVer,
+    spdxLicense: spdx,
+    purl: `pkg:golang/${modName}@v${rawVer}`,
+    path: goModPath,
+    isDirect: !isIndirect
+  };
+}
+function extractGoCandidateLines(content) {
+  const out = [];
+  let inBlock = false;
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (/^require\s*\($/.test(trimmed)) inBlock = true;
+    else if (inBlock && trimmed === ")") inBlock = false;
+    else if (inBlock || trimmed.startsWith("require ")) out.push(trimmed);
+  }
+  return out;
+}
+function scanGoDependencies(rootDir, seen) {
+  const goModPath = path4__namespace.join(rootDir, "go.mod");
+  const content = readTextIfExists(goModPath);
+  if (!content) return;
+  for (const line of extractGoCandidateLines(content)) {
+    const dep = parseGoRequireLine(line, goModPath);
+    if (dep && !seen.has(`golang:${dep.name}@${dep.version}`)) {
+      seen.set(`golang:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractCargoDirectDeps(cargoToml) {
+  const map = /* @__PURE__ */ new Map();
+  let inDeps = false;
+  for (const line of cargoToml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inDeps = /^\[(?:dev-|build-)?dependencies\]$/.test(trimmed);
+      continue;
+    }
+    if (!inDeps || !trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
+    if (m) {
+      const licMatch = m[2].match(/license\s*=\s*["']([^"']+)["']/);
+      map.set(m[1], licMatch ? licMatch[1] : "UNKNOWN");
+    }
+  }
+  return map;
+}
+function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version || name === rootName) return null;
+  const blockLic = extractTomlField(block, "license") || directMeta.get(name) || "UNKNOWN";
+  return {
+    name,
+    version,
+    spdxLicense: normalizeSpdxLicense(blockLic),
+    purl: `pkg:cargo/${name}@${version}`,
+    path: cargoLockPath,
+    isDirect: directMeta.size === 0 || directMeta.has(name)
+  };
+}
+function scanRustDependencies(rootDir, seen) {
+  const cargoLockPath = path4__namespace.join(rootDir, "Cargo.lock");
+  const lockContent = readTextIfExists(cargoLockPath);
+  if (!lockContent) return;
+  const cargoToml = readTextIfExists(path4__namespace.join(rootDir, "Cargo.toml")) || "";
+  const directMeta = extractCargoDirectDeps(cargoToml);
+  const rootName = extractTomlField(cargoToml, "name");
+  for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseCargoLockBlock(block, rootName, directMeta, cargoLockPath);
+    if (dep && !seen.has(`cargo:${dep.name}@${dep.version}`)) {
+      seen.set(`cargo:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractXmlTag(xml, tag) {
+  const m = xml.match(new RegExp(`<${tag}>([^<]+)</${tag}>`));
+  return m ? m[1].trim() : void 0;
+}
+function resolveMavenBlockLicense(block, defaultLic) {
+  const tagLic = extractXmlTag(block, "license");
+  if (tagLic) return tagLic;
+  const commentLic = block.match(/<!--\s*(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)\s*-->/i)?.[1];
+  return commentLic || defaultLic;
+}
+function parseMavenDepBlock(block, defaultLic, pomPath) {
+  const groupId = extractXmlTag(block, "groupId");
+  const artifactId = extractXmlTag(block, "artifactId");
+  if (!groupId || !artifactId) return null;
+  const version = extractXmlTag(block, "version") || "unknown";
+  const inlineLic = resolveMavenBlockLicense(block, defaultLic);
+  return {
+    name: `${groupId}:${artifactId}`,
+    version,
+    spdxLicense: normalizeSpdxLicense(inlineLic),
+    purl: `pkg:maven/${groupId}/${artifactId}@${version}`,
+    path: pomPath,
+    isDirect: true
+  };
+}
+function scanMavenDependencies(rootDir, seen) {
+  const pomPath = path4__namespace.join(rootDir, "pom.xml");
+  const content = readTextIfExists(pomPath);
+  if (!content) return;
+  const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
+  const defaultLic = extractXmlTag(projectLicBlock, "name") || "UNKNOWN";
+  const depBlocks = content.match(/<dependency>[\s\S]*?<\/dependency>/g) || [];
+  for (const block of depBlocks) {
+    const dep = parseMavenDepBlock(block, defaultLic, pomPath);
+    if (dep && !seen.has(`maven:${dep.name}@${dep.version}`)) {
+      seen.set(`maven:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
@@ -5695,6 +6315,10 @@ function scanWithNativeFs(rootDir, options = {}) {
       scanPnpmStore(path4__namespace.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
+  scanPythonDependencies(rootDir, seen);
+  scanGoDependencies(rootDir, seen);
+  scanRustDependencies(rootDir, seen);
+  scanMavenDependencies(rootDir, seen);
   const allDeps = Array.from(seen.values());
   if (options.depth === "direct") {
     return allDeps.filter((d) => d.isDirect);
@@ -5764,10 +6388,17 @@ var SEVERITY_RANK = {
   LOW: 1,
   UNKNOWN: 0
 };
+function isExemptByVex(v, vexStatements) {
+  if (!vexStatements || vexStatements.length === 0) return false;
+  return vexStatements.some(
+    (stmt) => stmt.id === v.id && (stmt.state === "not_affected" || stmt.state === "fixed") && (!stmt.package || stmt.package === v.packageName)
+  );
+}
 function evaluateVulnerabilityThresholds(vulnerabilities, options) {
   const minRank = options?.failOnSeverity ? SEVERITY_RANK[options.failOnSeverity] ?? 3 : void 0;
   const maxScore = options?.maxCvssScore;
   const failing = vulnerabilities.filter((v) => {
+    if (isExemptByVex(v, options?.vexStatements)) return false;
     const rankMatch = minRank !== void 0 && SEVERITY_RANK[v.severity] >= minRank;
     const scoreMatch = maxScore !== void 0 && v.cvssV3Score !== void 0 && v.cvssV3Score >= maxScore;
     return rankMatch || scoreMatch;
@@ -5897,42 +6528,77 @@ function buildCycloneDxComponent(dep) {
   }
   return comp;
 }
-function generateCycloneDxSbom(dependencies, options = {}) {
+function buildVexAnalysis(vex) {
+  if (!vex) return void 0;
+  return {
+    state: vex.state,
+    justification: vex.justification,
+    detail: vex.detail,
+    response: vex.response
+  };
+}
+function mapScaVulnToCycloneDx(v, vexStatements) {
+  const matchingVex = vexStatements.find(
+    (stmt) => stmt.id === v.id && (!stmt.package || stmt.package === v.packageName)
+  );
+  return {
+    id: v.id,
+    source: v.primaryUrl ? { name: "NVD/GHSA", url: v.primaryUrl } : void 0,
+    ratings: [{ score: v.cvssV3Score, severity: v.severity.toLowerCase(), method: "CVSSv3", vector: v.cvssV3Vector }],
+    analysis: buildVexAnalysis(matchingVex),
+    affects: [{ ref: `pkg:npm/${v.packageName}@${v.installedVersion}` }]
+  };
+}
+function mapStandaloneVex(stmt) {
+  return {
+    id: stmt.id,
+    analysis: buildVexAnalysis(stmt),
+    affects: stmt.package ? [{ ref: stmt.package }] : void 0
+  };
+}
+function buildCycloneDxVulnerabilities(vulnerabilities = [], vexStatements = []) {
+  const out = vulnerabilities.map((v) => mapScaVulnToCycloneDx(v, vexStatements));
+  const seenIds = new Set(out.map((item) => item.id));
+  for (const stmt of vexStatements) {
+    if (!seenIds.has(stmt.id)) {
+      out.push(mapStandaloneVex(stmt));
+      seenIds.add(stmt.id);
+    }
+  }
+  return out;
+}
+function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
-  if (options.rootDir) {
-    const pkgPath = path4__namespace.join(options.rootDir, "package.json");
-    if (fs7__namespace.existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
-        if (pkg.name) name = pkg.name;
-        if (pkg.version) version = pkg.version;
-      } catch {
-      }
-    }
+  if (!options.rootDir) return { name, version };
+  const pkgPath = path4__namespace.join(options.rootDir, "package.json");
+  if (!fs7__namespace.existsSync(pkgPath)) return { name, version };
+  try {
+    const pkg = JSON.parse(fs7__namespace.readFileSync(pkgPath, "utf-8"));
+    if (pkg.name) name = pkg.name;
+    if (pkg.version) version = pkg.version;
+  } catch {
   }
-  const components = dependencies.map(buildCycloneDxComponent);
+  return { name, version };
+}
+function buildBomMetadata(name, version) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.4.0" }],
+    component: { type: "application", name, version }
+  };
+}
+function generateCycloneDxSbom(dependencies, options = {}) {
+  const { name, version } = resolveProjectIdentity(options);
+  const cdxVulns = buildCycloneDxVulnerabilities(options.vulnerabilities, options.vexStatements);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
     serialNumber: `urn:uuid:${crypto__namespace.randomUUID()}`,
-    metadata: {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      tools: [
-        {
-          vendor: "AI-SDLC",
-          name: "@aisdlc/core",
-          version: "1.0.0"
-        }
-      ],
-      component: {
-        type: "application",
-        name,
-        version
-      }
-    },
-    components
+    metadata: buildBomMetadata(name, version),
+    components: dependencies.map(buildCycloneDxComponent),
+    ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
 function tryAtomicWrite(filePath, content) {
@@ -6100,17 +6766,24 @@ function parseExceptions(exceptions) {
   }
   return map;
 }
+function parseVexStatements(doc) {
+  const rawList = doc?.vex_statements || doc?.exceptions?.vex_statements || [];
+  if (!Array.isArray(rawList)) return [];
+  return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
+}
 function parseLicensePolicy(content) {
   try {
     const doc = yaml3__default.default.load(content);
     const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
     const exception_packages = parseExceptions(doc?.exceptions);
+    const vex_statements = parseVexStatements(doc);
     return {
       version: doc?.version || "1.0",
       permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
       restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
       blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
       exception_packages,
+      vex_statements,
       rawPolicy: doc
     };
   } catch {
@@ -6119,7 +6792,8 @@ function parseLicensePolicy(content) {
       permitted: DEFAULT_PERMITTED,
       restricted: DEFAULT_RESTRICTED,
       blocked: DEFAULT_BLOCKED,
-      exception_packages: {}
+      exception_packages: {},
+      vex_statements: []
     };
   }
 }
@@ -6294,10 +6968,10 @@ function shouldGenerateSbom(options, rawPolicy) {
   if (options.generateSbom === false) return false;
   return Boolean(options.generateSbom || options.sbomPath || rawPolicy?.ci_gates?.generate_sbom);
 }
-function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies) {
+function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
   const sbomPath = options.sbomPath || path4__namespace.join(rootDir, "reports", "sbom.cdx.json");
-  const sbom = generateCycloneDxSbom(dependencies, { rootDir });
+  const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
 }
@@ -6310,9 +6984,9 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
 }
-function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies) {
+function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   return {
-    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies),
+    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements),
     noticesPath: maybeGenerateNotices(options, rootDir, rawPolicy, dependencies)
   };
 }
@@ -6341,7 +7015,7 @@ function buildSkippedVulnResult() {
     skipReason: "Trivy scanner is not installed on host environment. Vulnerability check gracefully skipped."
   };
 }
-function checkVulnerabilities(rootDir, options) {
+function checkVulnerabilities(rootDir, options, vexStatements) {
   if (options.scanVulnerabilities === false) {
     return { vulnerabilities: [], blocked: false };
   }
@@ -6349,7 +7023,10 @@ function checkVulnerabilities(rootDir, options) {
   if (!res.executed) {
     return buildSkippedVulnResult();
   }
-  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, options.vulnerabilityThresholds);
+  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, {
+    ...options.vulnerabilityThresholds,
+    vexStatements
+  });
   return { vulnerabilities: res.vulnerabilities, blocked: evalResult.blocked };
 }
 function assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData) {
@@ -6373,7 +7050,8 @@ function toCleanPolicy(policyWithRaw) {
     permitted: policyWithRaw.permitted,
     restricted: policyWithRaw.restricted,
     blocked: policyWithRaw.blocked,
-    exception_packages: policyWithRaw.exception_packages
+    exception_packages: policyWithRaw.exception_packages,
+    vex_statements: policyWithRaw.vex_statements
   };
 }
 function scanDependenciesForVerification(options, rootDir, rawPolicy) {
@@ -6393,8 +7071,15 @@ function verifyLicenses(options = {}) {
   }
   const dependencies = scanDependenciesForVerification(options, rootDir, policyWithRaw.rawPolicy);
   const { violations, permittedCount } = evaluateDependencyList(dependencies, policy);
-  const artifacts = handleDynamicScaArtifacts(options, rootDir, policyWithRaw.rawPolicy, dependencies);
-  const vulnData = checkVulnerabilities(rootDir, options);
+  const vulnData = checkVulnerabilities(rootDir, options, policy.vex_statements);
+  const artifacts = handleDynamicScaArtifacts(
+    options,
+    rootDir,
+    policyWithRaw.rawPolicy,
+    dependencies,
+    vulnData.vulnerabilities,
+    policy.vex_statements
+  );
   const reportMarkdown = generateLicenseReportMarkdown(dependencies, violations, policy, artifacts.sbomPath);
   return assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData);
 }
@@ -15934,9 +16619,149 @@ function initProject(options = {}) {
     tryInstallGitHook(destDir, options.dryRun)
   );
 }
+var DEFAULT_DLP_RULES = [
+  {
+    id: "DLP-001-PRIVATE-KEY",
+    description: "PEM / RSA / EC / OPENSSH Private Key Block",
+    pattern: "-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\\s\\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----",
+    replacement: "[REDACTED:PRIVATE_KEY]",
+    enabled: true
+  },
+  {
+    id: "DLP-002-API-TOKEN",
+    description: "Cloud, GitHub, Slack, OpenAI, Stripe, and AWS Access Tokens",
+    pattern: "\\b(?:gh[pousr]_[A-Za-z0-9_]{36,255}|github_pat_[0-9a-zA-Z_]{82}|sk-(?:proj-|live-)?[a-zA-Z0-9_-]{32,}|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*|(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99})\\b",
+    replacement: "[REDACTED:API_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-003-JWT",
+    description: "Plaintext JSON Web Token (JWT)",
+    pattern: "\\beyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b",
+    replacement: "[REDACTED:JWT_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-004-CREDIT-CARD",
+    description: "Payment Card Number (13-19 digits formatted)",
+    pattern: "\\b(?:\\d{4}[- ]\\d{4}[- ]\\d{4}[- ]\\d{4}|\\d{16})\\b",
+    replacement: "[REDACTED:CREDIT_CARD]",
+    enabled: true
+  },
+  {
+    id: "DLP-005-EMAIL",
+    description: "Personal or Corporate Email Address",
+    pattern: "\\b[A-Za-z0-9._%+-]+@(?!example\\.com|localhost|test\\.local)[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b",
+    replacement: "[REDACTED:EMAIL]",
+    enabled: true
+  },
+  {
+    id: "DLP-006-INTERNAL-URL",
+    description: "Internal Intranet / Corp Service URL",
+    pattern: "https?://(?:[A-Za-z0-9._-]+:[A-Za-z0-9._-]+@|[A-Za-z0-9.-]+\\.(?:internal|corp|intranet|local)\\b)[^\\s\"'`<>]*",
+    replacement: "[REDACTED:INTERNAL_URL]",
+    enabled: true
+  }
+];
+function createDefaultDlpPolicy() {
+  return {
+    version: "1.0",
+    enabled: true,
+    zero_data_retention_required: true,
+    rules: [...DEFAULT_DLP_RULES]
+  };
+}
+function normalizeParsedRule(raw, idx) {
+  if (typeof raw.pattern !== "string" || !raw.pattern) return null;
+  return {
+    id: typeof raw.id === "string" ? raw.id : `DLP-CUSTOM-${idx + 1}`,
+    description: typeof raw.description === "string" ? raw.description : "Custom DLP rule",
+    pattern: raw.pattern,
+    replacement: typeof raw.replacement === "string" ? raw.replacement : "[REDACTED]",
+    enabled: raw.enabled !== false
+  };
+}
+function parseDlpPolicy(yamlContent) {
+  const fallback = createDefaultDlpPolicy();
+  if (!yamlContent || !yamlContent.trim()) return fallback;
+  try {
+    const doc = yaml3__default.default.load(yamlContent);
+    if (!doc || typeof doc !== "object") return fallback;
+    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
+    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+    return {
+      version: typeof doc.version === "string" ? doc.version : "1.0",
+      enabled: doc.enabled !== false,
+      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
+      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+    };
+  } catch {
+    return fallback;
+  }
+}
+function loadDlpPolicy(rootDir, customPolicyPath) {
+  const base = rootDir || process.cwd();
+  const filePath = customPolicyPath ? path4__namespace.isAbsolute(customPolicyPath) ? customPolicyPath : path4__namespace.join(base, customPolicyPath) : path4__namespace.join(base, "dlp-policy.yaml");
+  if (!fs7__namespace.existsSync(filePath)) return createDefaultDlpPolicy();
+  try {
+    return parseDlpPolicy(fs7__namespace.readFileSync(filePath, "utf-8"));
+  } catch {
+    return createDefaultDlpPolicy();
+  }
+}
+function applySingleDlpRule(text, rule) {
+  if (rule.enabled === false) return { output: text, matches: 0 };
+  try {
+    const regex = new RegExp(rule.pattern, "g");
+    let matches = 0;
+    const output = text.replace(regex, () => {
+      matches++;
+      return rule.replacement;
+    });
+    return { output, matches };
+  } catch {
+    return { output: text, matches: 0 };
+  }
+}
+function sanitizeDlpText(text, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || !text) {
+    return { sanitizedText: text, redactionCount: 0, triggeredRuleIds: [] };
+  }
+  let current = text;
+  let totalRedactions = 0;
+  const triggered = [];
+  for (const rule of policy.rules) {
+    const res = applySingleDlpRule(current, rule);
+    if (res.matches > 0) {
+      current = res.output;
+      totalRedactions += res.matches;
+      triggered.push(rule.id);
+    }
+  }
+  return {
+    sanitizedText: current,
+    redactionCount: totalRedactions,
+    triggeredRuleIds: triggered
+  };
+}
+function sanitizeDlpPayload(payload, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || payload === null || payload === void 0) return payload;
+  if (typeof payload === "string") {
+    return sanitizeDlpText(payload, policy).sanitizedText;
+  }
+  const serialized = JSON.stringify(payload);
+  const { sanitizedText } = sanitizeDlpText(serialized, policy);
+  try {
+    return JSON.parse(sanitizedText);
+  } catch {
+    return payload;
+  }
+}
 
 exports.ALL_ARCHITECTURE_TEMPLATES = ALL_ARCHITECTURE_TEMPLATES;
 exports.BRANCH_PATTERNS = BRANCH_PATTERNS;
+exports.BddStepRegistry = BddStepRegistry;
+exports.DEFAULT_DLP_RULES = DEFAULT_DLP_RULES;
 exports.DEFAULT_EXCLUDED_PATTERNS = DEFAULT_EXCLUDED_PATTERNS;
 exports.DEFAULT_EXCLUDES = DEFAULT_EXCLUDES;
 exports.DEFAULT_EXTENSIONS = DEFAULT_EXTENSIONS;
@@ -16082,6 +16907,7 @@ exports.analyzeBddVariantsForRequirement = analyzeBddVariantsForRequirement;
 exports.appendRevisionHistoryRow = appendRevisionHistoryRow;
 exports.applyRatchetMode = applyRatchetMode;
 exports.buildCycloneDxComponent = buildCycloneDxComponent;
+exports.buildCycloneDxVulnerabilities = buildCycloneDxVulnerabilities;
 exports.buildFeatureFileContent = buildFeatureFileContent;
 exports.buildGraphElements = buildGraphElements;
 exports.calculateJaccardSimilarity = calculateJaccardSimilarity;
@@ -16098,6 +16924,7 @@ exports.collectHistoricalKpis = collectHistoricalKpis;
 exports.computeCanonicalSha256 = computeCanonicalSha256;
 exports.computeSha256 = computeSha256;
 exports.computeViolationSignature = computeViolationSignature;
+exports.createDefaultDlpPolicy = createDefaultDlpPolicy;
 exports.createDefaultQualityPolicy = createDefaultQualityPolicy;
 exports.depositProductHandoffSidecar = depositProductHandoffSidecar;
 exports.detectActiveChangeForIntegration = detectActiveChangeForIntegration;
@@ -16109,6 +16936,7 @@ exports.emitCiOutput = emitCiOutput;
 exports.evaluateCompoundLicense = evaluateCompoundLicense;
 exports.evaluateSingleDependency = evaluateSingleDependency;
 exports.evaluateVulnerabilityThresholds = evaluateVulnerabilityThresholds;
+exports.executeBddFeature = executeBddFeature;
 exports.extractBaselineEntriesFromResults = extractBaselineEntriesFromResults;
 exports.extractCitations = extractCitations;
 exports.extractCommitKpisFromRange = extractCommitKpisFromRange;
@@ -16163,6 +16991,7 @@ exports.isPlaceholderOrIgnored = isPlaceholderOrIgnored;
 exports.isRequirementArtifact = isRequirementArtifact2;
 exports.isSemgrepInstalled = isSemgrepInstalled;
 exports.isToolAvailable = isToolAvailable;
+exports.loadDlpPolicy = loadDlpPolicy;
 exports.loadPrivacyPolicy = loadPrivacyPolicy;
 exports.loadProductHandoffSidecar = loadProductHandoffSidecar;
 exports.loadQualityBaseline = loadQualityBaseline;
@@ -16172,6 +17001,8 @@ exports.maskSecret = maskSecret;
 exports.normalizeSpdxLicense = normalizeSpdxLicense;
 exports.normalizeUri = normalizeUri;
 exports.parseCommitTrailers = parseCommitTrailers;
+exports.parseDlpPolicy = parseDlpPolicy;
+exports.parseFeatureDocument = parseFeatureDocument;
 exports.parseFrontmatter = parseFrontmatter;
 exports.parseFrontmatterId = parseFrontmatterId;
 exports.parseGenericDoc = parseGenericDoc;
@@ -16213,15 +17044,21 @@ exports.resolveSchemaForArtifact = resolveSchemaForArtifact;
 exports.resolveTargetFiles = resolveTargetFiles;
 exports.runGitleaksCli = runGitleaksCli;
 exports.runSemgrepCli = runSemgrepCli;
+exports.sanitizeDlpPayload = sanitizeDlpPayload;
+exports.sanitizeDlpText = sanitizeDlpText;
 exports.scaffoldSddChange = scaffoldSddChange;
 exports.scanAllProductHandoffs = scanAllProductHandoffs;
 exports.scanAllTestArtifacts = scanAllTestArtifacts;
 exports.scanContentForSecrets = scanContentForSecrets;
 exports.scanFileForPrivacyViolations = scanFileForPrivacyViolations;
 exports.scanFileForSast = scanFileForSast;
+exports.scanGoDependencies = scanGoDependencies;
 exports.scanInstalledLicenses = scanInstalledLicenses;
 exports.scanManualsInWorkspace = scanManualsInWorkspace;
+exports.scanMavenDependencies = scanMavenDependencies;
 exports.scanPnpmStore = scanPnpmStore;
+exports.scanPythonDependencies = scanPythonDependencies;
+exports.scanRustDependencies = scanRustDependencies;
 exports.scanSubdirectories = scanSubdirectories;
 exports.scanWithNativeFs = scanWithNativeFs;
 exports.scanWithSyft = scanWithSyft;
@@ -16252,6 +17089,7 @@ exports.walkMdFiles = walkMdFiles;
 exports.walkProjectFiles = walkProjectFiles;
 exports.walkSourceFiles = walkSourceFiles;
 exports.walkTaskFiles = walkTaskFiles;
+exports.writeCucumberJsonReport = writeCucumberJsonReport;
 exports.writeCycloneDxSbom = writeCycloneDxSbom;
 exports.writeQualityBaseline = writeQualityBaseline;
 exports.writeReleaseKpiReport = writeReleaseKpiReport;