@aisdlc/core 2.2.4 → 2.4.0

package/dist/index.js

@@ -266,19 +266,26 @@ function extractPythonFunctions(content, filePath) {
   }
   return buildMetricsFromBlocks(blocks, content, filePath);
 }
-function processBraceLine(line, state, blocks, lineIndex, ext) {
-  if (!state.currentFn) {
-    const candidate = matchFunctionHeader(line, ext);
-    if (!candidate) return;
+function tryStartBraceFunction(line, state, ext) {
+  if (state.currentFn || state.inBlockComment || state.rawTerm) return;
+  const candidate = matchFunctionHeader(line, ext);
+  if (candidate) {
     state.currentFn = candidate;
     state.braceCount = 0;
     state.fnLines = [];
   }
-  state.fnLines.push(line);
-  const res = scanBracesInLine(line, state.inBlockComment, ext);
+}
+function updateBraceScanState(line, state, ext) {
+  const res = scanBracesInLine(line, state.inBlockComment, state.rawTerm, ext);
   state.inBlockComment = res.nowInBlock;
+  state.rawTerm = res.nowRawTerm;
   state.braceCount += res.delta;
-  if (state.braceCount === 0 && state.fnLines.length > 1) {
+}
+function processBraceLine(line, state, blocks, lineIndex, ext) {
+  tryStartBraceFunction(line, state, ext);
+  if (state.currentFn) state.fnLines.push(line);
+  updateBraceScanState(line, state, ext);
+  if (state.currentFn && state.braceCount === 0 && state.fnLines.length > 1) {
     blocks.push({ name: state.currentFn, body: state.fnLines.join("\n"), startLine: lineIndex });
     state.currentFn = null;
     state.fnLines = [];
@@ -288,98 +295,153 @@ function extractBraceFunctions(content, filePath) {
   const ext = path4.extname(filePath).toLowerCase();
   const lines = content.split("\n");
   const blocks = [];
-  const state = { currentFn: null, braceCount: 0, fnLines: [], inBlockComment: false };
+  const state = {
+    currentFn: null,
+    braceCount: 0,
+    fnLines: [],
+    inBlockComment: false,
+    rawTerm: null
+  };
   for (let i = 0; i < lines.length; i++) {
     processBraceLine(lines[i], state, blocks, i, ext);
   }
   return buildMetricsFromBlocks(blocks, content, filePath);
 }
+var HEADER_EXCLUSIONS = /* @__PURE__ */ new Set([
+  "if",
+  "for",
+  "foreach",
+  "while",
+  "switch",
+  "catch",
+  "select",
+  "match",
+  "class",
+  "struct",
+  "interface",
+  "record",
+  "enum",
+  "namespace",
+  "using",
+  "lock",
+  "fixed",
+  "synchronized",
+  "try",
+  "else"
+]);
 function matchCStyleHeader(line) {
   const match = line.match(
-    /(?:(?:public|private|protected|static|async|virtual|override|fn)\s+)*(?:function\s+([a-zA-Z0-9_$]+)|(?:[a-zA-Z0-9_<>[\]?]+\s+)+([a-zA-Z0-9_$]+)\s*\([^;{]*\)\s*(?:throws\s+[^{]+)?\{|([a-zA-Z0-9_$]+)\s*\([^;{]*\)\s*(?::\s*[^{]+\s*)?\{)/
+    /(?:(?:public|private|protected|internal|static|async|virtual|override|sealed|abstract|final|synchronized|default|fn)\s+)*(?:function\s+([a-zA-Z0-9_$]+)|(?:[a-zA-Z0-9_<>[\]?,.\s]+\s+)+([a-zA-Z0-9_$]+)\s*(?:<[^>]+>)?\s*\([^;{}]*\)\s*(?:where\s+[^{]+|throws\s+[^{]+)?\{|([a-zA-Z0-9_$]+)\s*\([^;{}]*\)\s*(?::\s*[^{]+\s*)?\{)/
   );
   if (!match) return null;
   const candidate = match[1] || match[2] || match[3];
-  const exclusions = ["if", "for", "while", "switch", "catch", "select", "match", "class", "struct"];
-  return candidate && !exclusions.includes(candidate) ? candidate : null;
+  return candidate && !HEADER_EXCLUSIONS.has(candidate) ? candidate : null;
 }
 function matchFunctionHeader(line, ext) {
   const trimmed = line.trim();
-  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*")) return null;
+  if (trimmed.startsWith("//") || trimmed.startsWith("/*") || trimmed.startsWith("*") || trimmed.startsWith("#")) {
+    return null;
+  }
   if (ext === ".go") {
-    const match = line.match(/func\s+(?:\([^)]*\)\s*)?([a-zA-Z0-9_$]+)\s*\(/);
+    const match = line.match(/func\s+(?:\([^)]*\)\s*)?([a-zA-Z0-9_$]+)\s*(?:\[[^\]]*\])?\s*\(/);
     return match ? match[1] : null;
   }
   if (ext === ".rs") {
-    const match = line.match(/(?:pub\s+)?(?:async\s+)?(?:unsafe\s+)?fn\s+([a-zA-Z0-9_$]+)\s*\(/);
+    const match = line.match(/(?:pub(?:\([^)]*\))?\s+)?(?:async\s+)?(?:unsafe\s+)?(?:const\s+)?fn\s+([a-zA-Z0-9_$]+)\s*(?:<[^>]*>)?\s*\(/);
     return match ? match[1] : null;
   }
   return matchCStyleHeader(line);
 }
-function handleStringChar(char, inString) {
-  if (char === inString) return { inString: null, skip: false };
-  return { inString, skip: char === "\\" };
-}
-function handleBlockState(char, next, inBlock) {
-  if (inBlock && char === "*" && next === "/") return { inBlock: false, skip: true };
-  return { inBlock, skip: false };
-}
-function checkCommentOrQuote(char, next, ext) {
-  if (char === "/" && next === "/") return { startBlock: false, quote: null, isLineComment: true };
-  if (char === "/" && next === "*") return { startBlock: true, quote: null, isLineComment: false };
-  const isQuote = char === '"' || char === "'" || char === "`" && ext === ".go";
-  return { startBlock: false, quote: isQuote ? char : null, isLineComment: false };
-}
-function stepSkippedState(char, next, inBlock, inString) {
-  if (inBlock) {
-    const res = handleBlockState(char, next, inBlock);
-    return { inBlock: res.inBlock, inString, skip: res.skip, handled: true };
-  }
-  if (inString) {
-    const res = handleStringChar(char, inString);
-    return { inBlock, inString: res.inString, skip: res.skip, handled: true };
-  }
-  return { inBlock, inString, skip: false, handled: false };
-}
-function checkCodeChar(char, next, ext) {
-  const trigger = checkCommentOrQuote(char, next, ext);
-  if (trigger.isLineComment) return { delta: 0, startBlock: false, quote: null, stop: true };
-  if (trigger.startBlock) return { delta: 0, startBlock: true, quote: null, stop: false };
-  if (trigger.quote) return { delta: 0, startBlock: false, quote: trigger.quote, stop: false };
-  const delta = char === "{" ? 1 : char === "}" ? -1 : 0;
-  return { delta, startBlock: false, quote: null, stop: false };
-}
-function applyCodeChar(res, state) {
-  if (res.stop) return { advance: 0, stop: true };
-  if (res.startBlock) {
+function detectRustOrGoRawString(sub, ext) {
+  if (ext === ".rs") {
+    const m = sub.match(/^r(#*)"/);
+    return m ? { term: `"${m[1]}`, advance: m[0].length - 1 } : null;
+  }
+  if (ext === ".go" && sub.startsWith("`")) {
+    return { term: "`", advance: 0 };
+  }
+  return null;
+}
+function detectCsJavaOrCppRawString(sub, ext) {
+  if (ext === ".cs" || ext === ".java") {
+    const m = sub.match(/^\$*("{3,})/);
+    if (m) return { term: m[1], advance: m[0].length - 1 };
+    const v = ext === ".cs" ? sub.match(/^(@\$|\$@|@)"/) : null;
+    return v ? { term: '"', advance: v[0].length - 1 } : null;
+  }
+  const cpp = sub.match(/^R"([a-zA-Z0-9_]*)\(/);
+  return cpp ? { term: `)${cpp[1]}"`, advance: cpp[0].length - 1 } : null;
+}
+function detectRawStringOpen(line, index, ext) {
+  const sub = line.slice(index);
+  return detectRustOrGoRawString(sub, ext) || detectCsJavaOrCppRawString(sub, ext);
+}
+function consumeRawOrBlock(line, index, state) {
+  if (state.inBlock) {
+    if (line[index] === "*" && line[index + 1] === "/") {
+      state.inBlock = false;
+      return { advance: 1, handled: true };
+    }
+    return { advance: 0, handled: true };
+  }
+  if (state.rawTerm) {
+    if (line.startsWith(state.rawTerm, index)) {
+      const len = state.rawTerm.length - 1;
+      state.rawTerm = null;
+      return { advance: len, handled: true };
+    }
+    return { advance: 0, handled: true };
+  }
+  return { advance: 0, handled: false };
+}
+function consumeNormalQuote(line, index, state) {
+  if (!state.inString) return { advance: 0, handled: false };
+  const ch = line[index];
+  if (ch === "\\") return { advance: 1, handled: true };
+  if (ch === state.inString) state.inString = null;
+  return { advance: 0, handled: true };
+}
+function applyQuoteOrBrace(ch, state) {
+  if (ch === '"' || ch === "'") {
+    state.inString = ch;
+    return;
+  }
+  if (ch === "{") state.delta++;
+  if (ch === "}") state.delta--;
+}
+function stepActiveCodeToken(line, j, ext, state) {
+  const pair = line.slice(j, j + 2);
+  if (pair === "//") return { advance: 0, stop: true };
+  if (pair === "/*") {
     state.inBlock = true;
     return { advance: 1, stop: false };
   }
-  if (res.quote) {
-    state.inString = res.quote;
-    return { advance: 0, stop: false };
+  const rawOpen = detectRawStringOpen(line, j, ext);
+  if (rawOpen) {
+    state.rawTerm = rawOpen.term;
+    return { advance: rawOpen.advance, stop: false };
   }
-  state.delta += res.delta;
+  applyQuoteOrBrace(line[j], state);
   return { advance: 0, stop: false };
 }
-function scanBracesInLine(line, wasInBlock, ext) {
-  const state = { delta: 0, inBlock: wasInBlock, inString: null };
+function scanBracesInLine(line, wasInBlock, wasRawTerm, ext) {
+  const state = { delta: 0, inBlock: wasInBlock, rawTerm: wasRawTerm, inString: null };
   for (let j = 0; j < line.length; j++) {
-    const char = line[j];
-    const next = j + 1 < line.length ? line[j + 1] : "";
-    const skipped = stepSkippedState(char, next, state.inBlock, state.inString);
-    if (skipped.handled) {
-      state.inBlock = skipped.inBlock;
-      state.inString = skipped.inString;
-      if (skipped.skip) j++;
+    const rawOrBlock = consumeRawOrBlock(line, j, state);
+    if (rawOrBlock.handled) {
+      j += rawOrBlock.advance;
+      continue;
+    }
+    const quoteStep = consumeNormalQuote(line, j, state);
+    if (quoteStep.handled) {
+      j += quoteStep.advance;
       continue;
     }
-    const res = checkCodeChar(char, next, ext);
-    const step = applyCodeChar(res, state);
-    if (step.stop) break;
-    j += step.advance;
+    const codeStep = stepActiveCodeToken(line, j, ext, state);
+    if (codeStep.stop) break;
+    j += codeStep.advance;
   }
-  return { delta: state.delta, nowInBlock: state.inBlock };
+  return { delta: state.delta, nowInBlock: state.inBlock, nowRawTerm: state.rawTerm };
 }
 function buildMetricsFromBlocks(blocks, content, filePath) {
   if (blocks.length === 0) {
@@ -403,11 +465,20 @@ function buildMetricsFromBlocks(blocks, content, filePath) {
 }
 function detectPolyglotSmells(body) {
   const smells = [];
-  if (/#\s*noqa|#\s*type:\s*ignore|@SuppressWarnings/.test(body)) {
+  if (/#\s*noqa|#\s*type:\s*ignore|@SuppressWarnings|#pragma\s+warning\s+disable/.test(body)) {
     smells.push("Supresi\xF3n no autorizada de linter");
   }
   return smells;
 }
+function stripStringsAndComments(body, ext) {
+  let cleaned = body;
+  if (ext === ".py") {
+    cleaned = cleaned.replace(/"""[\s\S]*?"""|'''[\s\S]*?'''/g, '""').replace(/#.*/g, "");
+  } else {
+    cleaned = cleaned.replace(/\/\*[\s\S]*?\*\/|\/\/.*/g, "").replace(/r(#+)"[\s\S]*?"\1/g, '""').replace(/R"([a-zA-Z0-9_]*)\([\s\S]*?\)\1"/g, '""').replace(/\$*"{3,}[\s\S]*?"{3,}/g, '""').replace(/`[\s\S]*?`/g, '""');
+  }
+  return cleaned.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, '""');
+}
 function computeHalsteadMI(body, cyclomatic, loc, commentCount) {
   const cleanText = body.replace(/\/\*[\s\S]*?\*\/|\/\/.*|#.*/g, "");
   const tokens = cleanText.split(/[\s,;().{}[\]=+\-*/<>!&|:]+/).filter((t) => t.length > 0);
@@ -432,9 +503,11 @@ function countCommentsAndLoc(rawLines, isPy) {
 function calculatePolyglotMetrics(body, name, filePath, startLine) {
   const ext = path4.extname(filePath).toLowerCase();
   const rawLines = body.split(/\r?\n/).map((l) => l.trim()).filter((l) => l.length > 0);
-  const { loc, commentCount, cleanLines } = countCommentsAndLoc(rawLines, ext === ".py");
-  const cyclomatic = computePolyglotCyclomatic(body, ext);
-  const cognitive = computePolyglotCognitive(cleanLines, ext === ".py");
+  const { loc, commentCount } = countCommentsAndLoc(rawLines, ext === ".py");
+  const strippedBody = stripStringsAndComments(body, ext);
+  const strippedLines = strippedBody.split(/\r?\n/).filter((l) => l.trim().length > 0);
+  const cyclomatic = computePolyglotCyclomatic(strippedBody, ext);
+  const cognitive = computePolyglotCognitive(strippedLines, ext === ".py");
   const maintainability = computeHalsteadMI(body, cyclomatic, loc, commentCount);
   return {
     functionName: name,
@@ -447,40 +520,60 @@ function calculatePolyglotMetrics(body, name, filePath, startLine) {
     line: startLine ? startLine + 1 : 1
   };
 }
-function computePolyglotCyclomatic(body, ext) {
-  let regex;
+function getCyclomaticPattern(ext) {
   if (ext === ".py") {
-    regex = /\b(if|elif|for|while|except)\b|\b(and|or)\b/g;
-  } else if (ext === ".go") {
-    regex = /\b(if|for|case|select)\b|&&|\|\|/g;
-  } else if (ext === ".rs") {
-    regex = /\b(if|for|while|match)\b|&&|\|\||\?/g;
-  } else {
-    regex = /\b(if|else\s+if|for|while|catch|case)\b|\?|&&|\|\|/g;
+    return /\b(if|elif|for|while|except|case)\b|\b(and|or)\b/g;
+  }
+  if (ext === ".go") {
+    return /\b(if|for|case|select)\b|&&|\|\|/g;
+  }
+  if (ext === ".rs") {
+    return /\b(if|for|while|match)\b|&&|\|\||\?/g;
+  }
+  if (ext === ".cs") {
+    return /\b(if|else\s+if|for|foreach|while|catch|case|when)\b|\?\?|\?\.(?=[a-zA-Z_])|&&|\|\|/g;
+  }
+  if (ext === ".java") {
+    return /\b(if|else\s+if|for|while|catch|case|when)\b|&&|\|\|/g;
   }
-  const cleanBody = body.replace(/"(?:[^"\\]|\\.)*"|'(?:[^'\\]|\\.)*'/g, "");
-  const matches = cleanBody.match(regex);
+  return /\b(if|else\s+if|for|while|catch|case)\b|\?|&&|\|\|/g;
+}
+function computePolyglotCyclomatic(strippedBody, ext) {
+  const regex = getCyclomaticPattern(ext);
+  const matches = strippedBody.match(regex);
   return 1 + (matches ? matches.length : 0);
 }
-function computePolyglotCognitive(lines, isPy) {
+var PY_COGNITIVE_RE = /\b(if|elif|for|while|except|match)\b/;
+var BRACE_COGNITIVE_RE = /\b(if|for|foreach|while|catch|match|select|switch)\b/;
+function computePythonCognitive(lines) {
+  let cognitive = 0;
+  const baseIndent = lines.length > 0 ? lines[0].length - lines[0].trimStart().length : 0;
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (PY_COGNITIVE_RE.test(line)) {
+      const relIndent = Math.max(0, line.length - line.trimStart().length - baseIndent - 4);
+      cognitive += 1 + Math.floor(relIndent / 4);
+    }
+  }
+  return cognitive;
+}
+function computeBraceCognitive(lines) {
   let cognitive = 0;
   let nesting = 0;
-  for (const line of lines) {
-    if (isPy) {
-      const indent = line.length - line.trimStart().length;
-      if (/\b(if|elif|for|while|except)\b/.test(line)) {
-        cognitive += 1 + Math.floor(indent / 4);
-      }
-    } else {
-      if (line.includes("{")) nesting++;
-      if (line.includes("}")) nesting = Math.max(0, nesting - 1);
-      if (/\b(if|for|while|catch|match|select)\b/.test(line)) {
-        cognitive += 1 + nesting;
-      }
+  for (let i = 1; i < lines.length; i++) {
+    const line = lines[i];
+    if (BRACE_COGNITIVE_RE.test(line)) {
+      cognitive += 1 + nesting;
     }
+    const opens = (line.match(/\{/g) || []).length;
+    const closes = (line.match(/\}/g) || []).length;
+    nesting = Math.max(0, nesting + opens - closes);
   }
   return cognitive;
 }
+function computePolyglotCognitive(lines, isPy) {
+  return isPy ? computePythonCognitive(lines) : computeBraceCognitive(lines);
+}
 function walkMdFiles(dir, fileList = [], excludeDirs = [
   "node_modules",
   ".git",
@@ -1064,9 +1157,54 @@ function collectTestCorpus(rootDir, allMdFiles) {
   }
   return { gherkinSources, combinedTests: testContents.join("\n") };
 }
-function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, taskErrors, ucErrors) {
+function isCucumberScenarioPassed(element) {
+  const steps = Array.isArray(element.steps) ? element.steps : [];
+  if (steps.length === 0) return false;
+  return steps.every((s) => {
+    const res = s.result;
+    return res && res.status === "passed";
+  });
+}
+function countCucumberScenarios(raw) {
+  let passed = 0;
+  let failed = 0;
+  for (const feat of raw) {
+    const elements = Array.isArray(feat.elements) ? feat.elements : [];
+    for (const el of elements) {
+      if (isCucumberScenarioPassed(el)) passed++;
+      else failed++;
+    }
+  }
+  return { passed, failed };
+}
+function parseCucumberReportFile(reportPath) {
+  if (!fs7.existsSync(reportPath)) return void 0;
+  try {
+    const raw = JSON.parse(fs7.readFileSync(reportPath, "utf-8"));
+    if (!Array.isArray(raw)) return void 0;
+    const { passed, failed } = countCucumberScenarios(raw);
+    return {
+      evaluatedFeatures: raw.length,
+      passedScenarios: passed,
+      failedScenarios: failed,
+      passed: passed + failed > 0 && failed === 0
+    };
+  } catch {
+    return void 0;
+  }
+}
+function resolveCucumberReport(rootDir, options) {
+  const candidate = options.cucumberReportPath ? path4.isAbsolute(options.cucumberReportPath) ? options.cucumberReportPath : path4.join(rootDir, options.cucumberReportPath) : path4.join(rootDir, "reports", "cucumber-report.json");
+  const parsed = parseCucumberReportFile(candidate);
+  if (parsed) return parsed;
+  if (options.enforceCucumberExecution) {
+    return { evaluatedFeatures: 0, passedScenarios: 0, failedScenarios: 1, passed: false };
+  }
+  return void 0;
+}
+function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, taskErrors, ucErrors, rootDir, options) {
   return {
-    success: reqErrors === 0 && taskErrors === 0 && ucErrors === 0,
+    success: reqErrors === 0 && taskErrors === 0 && ucErrors === 0 && (!resolveCucumberReport(rootDir, options) || resolveCucumberReport(rootDir, options).passed),
     totalRequirements: reqAudit.length,
     passedRequirements: reqAudit.length - reqErrors,
     failedRequirements: reqErrors,
@@ -1077,6 +1215,7 @@ function assembleCoverageResult(reqAudit, taskAudit, useCaseFlows, reqErrors, ta
     tasks: taskAudit,
     useCaseFlows,
     failedUseCaseFlows: ucErrors,
+    ...resolveCucumberReport(rootDir, options) ? { cucumberExecution: resolveCucumberReport(rootDir, options) } : {},
     reportMarkdown: generateTestingCoverageReportMarkdown(reqAudit, taskAudit, reqErrors, taskErrors)
   };
 }
@@ -1128,7 +1267,9 @@ function verifyTestingCoverage(options = {}) {
     state.useCaseFlows,
     state.reqErrors,
     state.taskErrors,
-    state.ucErrors
+    state.ucErrors,
+    rootDir,
+    options
   );
 }
 
@@ -5504,6 +5645,277 @@ function verifyTasksGovernance(options = {}) {
   );
   return assembleGovernanceResult(data, reportMarkdown);
 }
+var BddStepRegistry = class {
+  definitions = [];
+  register(pattern, handler) {
+    this.definitions.push({ pattern, handler });
+    return this;
+  }
+  given(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  when(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  then(pattern, handler) {
+    return this.register(pattern, handler);
+  }
+  getDefinitions() {
+    return this.definitions;
+  }
+};
+var STEP_PREFIX_RE = /^(Given|When|Then|And|But|Dado|Cuando|Entonces|Y|Pero)\s+(.+)$/i;
+var SCENARIO_HEADER_RE = /^(Scenario|Escenario|Scenario Outline|Esquema del escenario):\s*(.+)$/i;
+function parseTableRowCells(line) {
+  return line.trim().replace(/^\|/, "").replace(/\|$/, "").split("|").map((c) => c.trim());
+}
+function attachStepTableRow(lastStep, cells) {
+  if (!lastStep || cells.length < 2) return;
+  if (!lastStep.table) lastStep.table = {};
+  lastStep.table[cells[0]] = cells[1];
+}
+function attachExampleRow(scenario, headers, cells) {
+  if (!scenario) return headers;
+  if (headers.length === 0) return cells;
+  const row = {};
+  for (let i = 0; i < headers.length; i++) {
+    row[headers[i]] = cells[i] ?? "";
+  }
+  scenario.examples.push(row);
+  return headers;
+}
+function createInitialParseState() {
+  return {
+    featureName: "Unnamed Feature",
+    featureTags: [],
+    pendingTags: [],
+    backgroundSteps: [],
+    scenarios: [],
+    currentScenario: null,
+    inBackground: false,
+    inExamples: false,
+    exampleHeaders: []
+  };
+}
+function handleStructuralHeaderLine(line, state) {
+  if (/^(Feature|Caracter[ií]stica):/i.test(line)) {
+    state.featureName = line.replace(/^(Feature|Caracter[ií]stica):\s*/i, "").trim();
+    state.featureTags.push(...state.pendingTags);
+    state.pendingTags = [];
+    return true;
+  }
+  if (/^(Background|Antecedentes):/i.test(line)) {
+    state.inBackground = true;
+    state.inExamples = false;
+    state.currentScenario = null;
+    return true;
+  }
+  if (/^(Examples|Ejemplos):/i.test(line)) {
+    state.inExamples = true;
+    state.exampleHeaders = [];
+    return true;
+  }
+  return false;
+}
+function startScenarioBlock(scenMatch, state) {
+  state.inBackground = false;
+  state.inExamples = false;
+  const block = {
+    name: scenMatch[2].trim(),
+    tags: [...state.featureTags, ...state.pendingTags],
+    isOutline: /outline|esquema/i.test(scenMatch[1]),
+    steps: [],
+    examples: []
+  };
+  state.pendingTags = [];
+  state.scenarios.push(block);
+  state.currentScenario = block;
+}
+function appendParsedStep(stepMatch, state) {
+  const step = { keyword: stepMatch[1], text: stepMatch[2].trim() };
+  if (state.inBackground) {
+    state.backgroundSteps.push(step);
+  } else if (state.currentScenario) {
+    state.currentScenario.steps.push(step);
+  }
+}
+function handleScenarioOrStepLine(line, state) {
+  const scenMatch = line.match(SCENARIO_HEADER_RE);
+  if (scenMatch) {
+    startScenarioBlock(scenMatch, state);
+    return;
+  }
+  const stepMatch = line.match(STEP_PREFIX_RE);
+  if (stepMatch) {
+    appendParsedStep(stepMatch, state);
+  }
+}
+function processFeatureLine(rawLine, state) {
+  const line = rawLine.trim();
+  if (!line || line.startsWith("#")) return;
+  if (line.startsWith("@")) {
+    const tags = line.split(/\s+/).filter((t) => t.startsWith("@"));
+    state.pendingTags.push(...tags);
+    return;
+  }
+  if (line.startsWith("|")) {
+    const cells = parseTableRowCells(line);
+    if (state.inExamples) {
+      state.exampleHeaders = attachExampleRow(state.currentScenario, state.exampleHeaders, cells);
+    } else {
+      const targetList = state.inBackground ? state.backgroundSteps : state.currentScenario?.steps || [];
+      attachStepTableRow(targetList[targetList.length - 1], cells);
+    }
+    return;
+  }
+  if (!handleStructuralHeaderLine(line, state)) {
+    handleScenarioOrStepLine(line, state);
+  }
+}
+function parseFeatureDocument(content) {
+  const state = createInitialParseState();
+  for (const rawLine of content.split(/\r?\n/)) {
+    processFeatureLine(rawLine, state);
+  }
+  return {
+    featureName: state.featureName,
+    tags: state.featureTags,
+    backgroundSteps: state.backgroundSteps,
+    scenarios: state.scenarios
+  };
+}
+function interpolatePlaceholders(text, row) {
+  let out = text;
+  for (const [k, v] of Object.entries(row)) {
+    out = out.replace(new RegExp(`<${k}>`, "g"), v);
+  }
+  return out;
+}
+function expandScenarioOutlines(scenarios) {
+  const expanded = [];
+  for (const sc of scenarios) {
+    if (!sc.isOutline || sc.examples.length === 0) {
+      expanded.push(sc);
+      continue;
+    }
+    sc.examples.forEach((row, idx) => {
+      expanded.push({
+        name: `${sc.name} (Example #${idx + 1})`,
+        tags: sc.tags,
+        isOutline: false,
+        steps: sc.steps.map((st) => ({
+          keyword: st.keyword,
+          text: interpolatePlaceholders(st.text, row),
+          table: st.table
+        })),
+        examples: []
+      });
+    });
+  }
+  return expanded;
+}
+function matchStepDefinition(text, definitions) {
+  for (const entry of definitions) {
+    if (typeof entry.pattern === "string") {
+      if (entry.pattern === text) return { entry, args: [] };
+    } else {
+      const m = text.match(entry.pattern);
+      if (m) return { entry, args: m.slice(1) };
+    }
+  }
+  return null;
+}
+async function executeSingleStep(step, definitions) {
+  const matched = matchStepDefinition(step.text, definitions);
+  if (!matched) {
+    return { keyword: step.keyword, text: step.text, status: "undefined", durationMs: 0 };
+  }
+  const start = Date.now();
+  try {
+    await matched.entry.handler(matched.args, step.table);
+    return { keyword: step.keyword, text: step.text, status: "passed", durationMs: Date.now() - start };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    return {
+      keyword: step.keyword,
+      text: step.text,
+      status: "failed",
+      durationMs: Date.now() - start,
+      errorMessage: msg
+    };
+  }
+}
+async function executeScenarioSteps(allSteps, definitions) {
+  const stepResults = [];
+  let status = "passed";
+  for (const step of allSteps) {
+    if (status !== "passed") {
+      stepResults.push({ keyword: step.keyword, text: step.text, status: "skipped", durationMs: 0 });
+      continue;
+    }
+    const res = await executeSingleStep(step, definitions);
+    stepResults.push(res);
+    if (res.status === "failed" || res.status === "undefined") {
+      status = res.status;
+    }
+  }
+  return { stepResults, status };
+}
+async function runAllExpandedScenarios(parsed, definitions) {
+  const expanded = expandScenarioOutlines(parsed.scenarios);
+  const out = [];
+  for (const sc of expanded) {
+    const combinedSteps = [...parsed.backgroundSteps, ...sc.steps];
+    const { stepResults, status } = await executeScenarioSteps(combinedSteps, definitions);
+    out.push({ name: sc.name, tags: sc.tags, status, steps: stepResults });
+  }
+  return out;
+}
+async function executeBddFeature(featurePath, registry, options = {}) {
+  const rootDir = options.rootDir || process.cwd();
+  const fullPath = path4.isAbsolute(featurePath) ? featurePath : path4.join(rootDir, featurePath);
+  const parsed = parseFeatureDocument(fs7.readFileSync(fullPath, "utf-8"));
+  const scenarios = await runAllExpandedScenarios(parsed, registry.getDefinitions());
+  const report = {
+    uri: path4.relative(rootDir, fullPath).replace(/\\/g, "/"),
+    featureName: parsed.featureName,
+    tags: parsed.tags,
+    scenarios,
+    passed: scenarios.length > 0 && scenarios.every((s) => s.status === "passed")
+  };
+  if (options.writeReportPath) writeCucumberJsonReport([report], options.writeReportPath);
+  return report;
+}
+function mapStepToCucumberJson(st) {
+  return {
+    keyword: `${st.keyword} `,
+    name: st.text,
+    result: {
+      status: st.status,
+      duration: st.durationMs * 1e6,
+      ...st.errorMessage ? { error_message: st.errorMessage } : {}
+    }
+  };
+}
+function mapFeatureToCucumberJson(r) {
+  return {
+    uri: r.uri,
+    name: r.featureName,
+    tags: r.tags.map((t) => ({ name: t })),
+    elements: r.scenarios.map((sc) => ({
+      type: "scenario",
+      name: sc.name,
+      tags: sc.tags.map((t) => ({ name: t })),
+      steps: sc.steps.map(mapStepToCucumberJson)
+    }))
+  };
+}
+function writeCucumberJsonReport(reports, outputPath) {
+  const dir = path4.dirname(outputPath);
+  if (!fs7.existsSync(dir)) fs7.mkdirSync(dir, { recursive: true });
+  const payload = JSON.stringify(reports.map(mapFeatureToCucumberJson), null, 2);
+  fs7.writeFileSync(outputPath, payload, "utf-8");
+}
 function isToolAvailable(toolName) {
   try {
     const cmd = process.platform === "win32" ? "where" : "which";
@@ -5657,6 +6069,214 @@ function scanPnpmStore(pnpmDir, directNames, seen) {
     }
   }
 }
+function readTextIfExists(filePath) {
+  if (!fs7.existsSync(filePath)) return null;
+  try {
+    return fs7.readFileSync(filePath, "utf-8");
+  } catch {
+    return null;
+  }
+}
+function extractTomlField(block, key) {
+  const m = block.match(new RegExp(`^\\s*${key}\\s*=\\s*["']([^"']+)["']`, "m"));
+  return m ? m[1].trim() : void 0;
+}
+function extractPyprojectDirectDeps(content) {
+  const direct = /* @__PURE__ */ new Set();
+  const matches = content.matchAll(/^([a-zA-Z0-9_.-]+)\s*=\s*(?:["'{]|true)/gm);
+  for (const m of matches) {
+    const key = m[1].toLowerCase();
+    if (!["name", "version", "description", "license", "python", "readme"].includes(key)) {
+      direct.add(key);
+    }
+  }
+  return direct;
+}
+function parseSingleTomlBlock(block, lockPath, directNames) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version) return null;
+  const spdx = normalizeSpdxLicense(extractTomlField(block, "license") || "UNKNOWN");
+  return {
+    name,
+    version,
+    spdxLicense: spdx,
+    purl: `pkg:pypi/${name.toLowerCase()}@${version}`,
+    path: lockPath,
+    isDirect: directNames.size === 0 || directNames.has(name.toLowerCase())
+  };
+}
+function parseTomlPackageBlocks(content, lockPath, directNames, seen) {
+  for (const block of content.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseSingleTomlBlock(block, lockPath, directNames);
+    if (dep && !seen.has(`pypi:${dep.name}@${dep.version}`)) {
+      seen.set(`pypi:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function parsePipfileSection(pkgs, isDirect, lockPath, seen) {
+  for (const [name, meta] of Object.entries(pkgs)) {
+    const rawVer = String(meta.version || "").replace(/^==/, "") || "unknown";
+    const spdx = normalizeSpdxLicense(meta.license || "UNKNOWN");
+    const key = `pypi:${name}@${rawVer}`;
+    if (!seen.has(key)) {
+      seen.set(key, {
+        name,
+        version: rawVer,
+        spdxLicense: spdx,
+        purl: `pkg:pypi/${name.toLowerCase()}@${rawVer}`,
+        path: lockPath,
+        isDirect
+      });
+    }
+  }
+}
+function scanPythonDependencies(rootDir, seen) {
+  const pyproject = readTextIfExists(path4.join(rootDir, "pyproject.toml")) || "";
+  const directNames = extractPyprojectDirectDeps(pyproject);
+  for (const lockName of ["poetry.lock", "uv.lock"]) {
+    const lockPath = path4.join(rootDir, lockName);
+    const content = readTextIfExists(lockPath);
+    if (content) parseTomlPackageBlocks(content, lockPath, directNames, seen);
+  }
+  const pipfileLockPath = path4.join(rootDir, "Pipfile.lock");
+  const pipfileRaw = readTextIfExists(pipfileLockPath);
+  if (!pipfileRaw) return;
+  try {
+    const data = JSON.parse(pipfileRaw);
+    parsePipfileSection(data.default || {}, true, pipfileLockPath, seen);
+    parsePipfileSection(data.develop || {}, false, pipfileLockPath, seen);
+  } catch {
+  }
+}
+function parseGoRequireLine(line, goModPath) {
+  const cleaned = line.replace(/^require\s+/, "").trim();
+  const commentIdx = cleaned.indexOf("//");
+  const codePart = (commentIdx >= 0 ? cleaned.slice(0, commentIdx) : cleaned).trim();
+  const commentPart = commentIdx >= 0 ? cleaned.slice(commentIdx + 2).trim() : "";
+  const parts = codePart.split(/\s+/);
+  if (parts.length < 2) return null;
+  const modName = parts[0];
+  const rawVer = parts[1].replace(/^v/, "");
+  const isIndirect = /\bindirect\b/i.test(commentPart);
+  const licenseMatch = commentPart.match(/(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)/i);
+  const spdx = licenseMatch ? normalizeSpdxLicense(licenseMatch[1]) : "UNKNOWN";
+  return {
+    name: modName,
+    version: rawVer,
+    spdxLicense: spdx,
+    purl: `pkg:golang/${modName}@v${rawVer}`,
+    path: goModPath,
+    isDirect: !isIndirect
+  };
+}
+function extractGoCandidateLines(content) {
+  const out = [];
+  let inBlock = false;
+  for (const rawLine of content.split(/\r?\n/)) {
+    const trimmed = rawLine.trim();
+    if (/^require\s*\($/.test(trimmed)) inBlock = true;
+    else if (inBlock && trimmed === ")") inBlock = false;
+    else if (inBlock || trimmed.startsWith("require ")) out.push(trimmed);
+  }
+  return out;
+}
+function scanGoDependencies(rootDir, seen) {
+  const goModPath = path4.join(rootDir, "go.mod");
+  const content = readTextIfExists(goModPath);
+  if (!content) return;
+  for (const line of extractGoCandidateLines(content)) {
+    const dep = parseGoRequireLine(line, goModPath);
+    if (dep && !seen.has(`golang:${dep.name}@${dep.version}`)) {
+      seen.set(`golang:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractCargoDirectDeps(cargoToml) {
+  const map = /* @__PURE__ */ new Map();
+  let inDeps = false;
+  for (const line of cargoToml.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("[")) {
+      inDeps = /^\[(?:dev-|build-)?dependencies\]$/.test(trimmed);
+      continue;
+    }
+    if (!inDeps || !trimmed || trimmed.startsWith("#")) continue;
+    const m = trimmed.match(/^([a-zA-Z0-9_-]+)\s*=\s*(.+)$/);
+    if (m) {
+      const licMatch = m[2].match(/license\s*=\s*["']([^"']+)["']/);
+      map.set(m[1], licMatch ? licMatch[1] : "UNKNOWN");
+    }
+  }
+  return map;
+}
+function parseCargoLockBlock(block, rootName, directMeta, cargoLockPath) {
+  const name = extractTomlField(block, "name");
+  const version = extractTomlField(block, "version");
+  if (!name || !version || name === rootName) return null;
+  const blockLic = extractTomlField(block, "license") || directMeta.get(name) || "UNKNOWN";
+  return {
+    name,
+    version,
+    spdxLicense: normalizeSpdxLicense(blockLic),
+    purl: `pkg:cargo/${name}@${version}`,
+    path: cargoLockPath,
+    isDirect: directMeta.size === 0 || directMeta.has(name)
+  };
+}
+function scanRustDependencies(rootDir, seen) {
+  const cargoLockPath = path4.join(rootDir, "Cargo.lock");
+  const lockContent = readTextIfExists(cargoLockPath);
+  if (!lockContent) return;
+  const cargoToml = readTextIfExists(path4.join(rootDir, "Cargo.toml")) || "";
+  const directMeta = extractCargoDirectDeps(cargoToml);
+  const rootName = extractTomlField(cargoToml, "name");
+  for (const block of lockContent.split(/\[\[package\]\]/g).slice(1)) {
+    const dep = parseCargoLockBlock(block, rootName, directMeta, cargoLockPath);
+    if (dep && !seen.has(`cargo:${dep.name}@${dep.version}`)) {
+      seen.set(`cargo:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
+function extractXmlTag(xml, tag) {
+  const m = xml.match(new RegExp(`<${tag}>([^<]+)</${tag}>`));
+  return m ? m[1].trim() : void 0;
+}
+function resolveMavenBlockLicense(block, defaultLic) {
+  const tagLic = extractXmlTag(block, "license");
+  if (tagLic) return tagLic;
+  const commentLic = block.match(/<!--\s*(?:spdx|license)\s*:\s*([A-Za-z0-9.+-]+)\s*-->/i)?.[1];
+  return commentLic || defaultLic;
+}
+function parseMavenDepBlock(block, defaultLic, pomPath) {
+  const groupId = extractXmlTag(block, "groupId");
+  const artifactId = extractXmlTag(block, "artifactId");
+  if (!groupId || !artifactId) return null;
+  const version = extractXmlTag(block, "version") || "unknown";
+  const inlineLic = resolveMavenBlockLicense(block, defaultLic);
+  return {
+    name: `${groupId}:${artifactId}`,
+    version,
+    spdxLicense: normalizeSpdxLicense(inlineLic),
+    purl: `pkg:maven/${groupId}/${artifactId}@${version}`,
+    path: pomPath,
+    isDirect: true
+  };
+}
+function scanMavenDependencies(rootDir, seen) {
+  const pomPath = path4.join(rootDir, "pom.xml");
+  const content = readTextIfExists(pomPath);
+  if (!content) return;
+  const projectLicBlock = content.match(/<licenses>([\s\S]*?)<\/licenses>/)?.[1] || "";
+  const defaultLic = extractXmlTag(projectLicBlock, "name") || "UNKNOWN";
+  const depBlocks = content.match(/<dependency>[\s\S]*?<\/dependency>/g) || [];
+  for (const block of depBlocks) {
+    const dep = parseMavenDepBlock(block, defaultLic, pomPath);
+    if (dep && !seen.has(`maven:${dep.name}@${dep.version}`)) {
+      seen.set(`maven:${dep.name}@${dep.version}`, dep);
+    }
+  }
+}
 function scanWithNativeFs(rootDir, options = {}) {
   const directNames = extractDirectDepNames(rootDir, options.productionOnly);
   const seen = /* @__PURE__ */ new Map();
@@ -5667,6 +6287,10 @@ function scanWithNativeFs(rootDir, options = {}) {
       scanPnpmStore(path4.join(nmDir, ".pnpm"), directNames, seen);
     }
   }
+  scanPythonDependencies(rootDir, seen);
+  scanGoDependencies(rootDir, seen);
+  scanRustDependencies(rootDir, seen);
+  scanMavenDependencies(rootDir, seen);
   const allDeps = Array.from(seen.values());
   if (options.depth === "direct") {
     return allDeps.filter((d) => d.isDirect);
@@ -5736,10 +6360,17 @@ var SEVERITY_RANK = {
   LOW: 1,
   UNKNOWN: 0
 };
+function isExemptByVex(v, vexStatements) {
+  if (!vexStatements || vexStatements.length === 0) return false;
+  return vexStatements.some(
+    (stmt) => stmt.id === v.id && (stmt.state === "not_affected" || stmt.state === "fixed") && (!stmt.package || stmt.package === v.packageName)
+  );
+}
 function evaluateVulnerabilityThresholds(vulnerabilities, options) {
   const minRank = options?.failOnSeverity ? SEVERITY_RANK[options.failOnSeverity] ?? 3 : void 0;
   const maxScore = options?.maxCvssScore;
   const failing = vulnerabilities.filter((v) => {
+    if (isExemptByVex(v, options?.vexStatements)) return false;
     const rankMatch = minRank !== void 0 && SEVERITY_RANK[v.severity] >= minRank;
     const scoreMatch = maxScore !== void 0 && v.cvssV3Score !== void 0 && v.cvssV3Score >= maxScore;
     return rankMatch || scoreMatch;
@@ -5869,42 +6500,77 @@ function buildCycloneDxComponent(dep) {
   }
   return comp;
 }
-function generateCycloneDxSbom(dependencies, options = {}) {
+function buildVexAnalysis(vex) {
+  if (!vex) return void 0;
+  return {
+    state: vex.state,
+    justification: vex.justification,
+    detail: vex.detail,
+    response: vex.response
+  };
+}
+function mapScaVulnToCycloneDx(v, vexStatements) {
+  const matchingVex = vexStatements.find(
+    (stmt) => stmt.id === v.id && (!stmt.package || stmt.package === v.packageName)
+  );
+  return {
+    id: v.id,
+    source: v.primaryUrl ? { name: "NVD/GHSA", url: v.primaryUrl } : void 0,
+    ratings: [{ score: v.cvssV3Score, severity: v.severity.toLowerCase(), method: "CVSSv3", vector: v.cvssV3Vector }],
+    analysis: buildVexAnalysis(matchingVex),
+    affects: [{ ref: `pkg:npm/${v.packageName}@${v.installedVersion}` }]
+  };
+}
+function mapStandaloneVex(stmt) {
+  return {
+    id: stmt.id,
+    analysis: buildVexAnalysis(stmt),
+    affects: stmt.package ? [{ ref: stmt.package }] : void 0
+  };
+}
+function buildCycloneDxVulnerabilities(vulnerabilities = [], vexStatements = []) {
+  const out = vulnerabilities.map((v) => mapScaVulnToCycloneDx(v, vexStatements));
+  const seenIds = new Set(out.map((item) => item.id));
+  for (const stmt of vexStatements) {
+    if (!seenIds.has(stmt.id)) {
+      out.push(mapStandaloneVex(stmt));
+      seenIds.add(stmt.id);
+    }
+  }
+  return out;
+}
+function resolveProjectIdentity(options) {
   let name = options.projectName || "ai-sdlc-project";
   let version = options.projectVersion || "1.0.0";
-  if (options.rootDir) {
-    const pkgPath = path4.join(options.rootDir, "package.json");
-    if (fs7.existsSync(pkgPath)) {
-      try {
-        const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
-        if (pkg.name) name = pkg.name;
-        if (pkg.version) version = pkg.version;
-      } catch {
-      }
-    }
+  if (!options.rootDir) return { name, version };
+  const pkgPath = path4.join(options.rootDir, "package.json");
+  if (!fs7.existsSync(pkgPath)) return { name, version };
+  try {
+    const pkg = JSON.parse(fs7.readFileSync(pkgPath, "utf-8"));
+    if (pkg.name) name = pkg.name;
+    if (pkg.version) version = pkg.version;
+  } catch {
   }
-  const components = dependencies.map(buildCycloneDxComponent);
+  return { name, version };
+}
+function buildBomMetadata(name, version) {
+  return {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    tools: [{ vendor: "AI-SDLC", name: "@aisdlc/core", version: "2.4.0" }],
+    component: { type: "application", name, version }
+  };
+}
+function generateCycloneDxSbom(dependencies, options = {}) {
+  const { name, version } = resolveProjectIdentity(options);
+  const cdxVulns = buildCycloneDxVulnerabilities(options.vulnerabilities, options.vexStatements);
   return {
     bomFormat: "CycloneDX",
     specVersion: "1.5",
     version: 1,
     serialNumber: `urn:uuid:${crypto.randomUUID()}`,
-    metadata: {
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      tools: [
-        {
-          vendor: "AI-SDLC",
-          name: "@aisdlc/core",
-          version: "1.0.0"
-        }
-      ],
-      component: {
-        type: "application",
-        name,
-        version
-      }
-    },
-    components
+    metadata: buildBomMetadata(name, version),
+    components: dependencies.map(buildCycloneDxComponent),
+    ...cdxVulns.length > 0 ? { vulnerabilities: cdxVulns } : {}
   };
 }
 function tryAtomicWrite(filePath, content) {
@@ -6072,17 +6738,24 @@ function parseExceptions(exceptions) {
   }
   return map;
 }
+function parseVexStatements(doc) {
+  const rawList = doc?.vex_statements || doc?.exceptions?.vex_statements || [];
+  if (!Array.isArray(rawList)) return [];
+  return rawList.filter((item) => Boolean(item && typeof item.id === "string" && typeof item.state === "string"));
+}
 function parseLicensePolicy(content) {
   try {
     const doc = yaml3.load(content);
     const { permitted, restricted, blocked } = classifyCategories(doc?.categories);
     const exception_packages = parseExceptions(doc?.exceptions);
+    const vex_statements = parseVexStatements(doc);
     return {
       version: doc?.version || "1.0",
       permitted: permitted.length > 0 ? permitted : DEFAULT_PERMITTED,
       restricted: restricted.length > 0 ? restricted : DEFAULT_RESTRICTED,
       blocked: blocked.length > 0 ? blocked : DEFAULT_BLOCKED,
       exception_packages,
+      vex_statements,
       rawPolicy: doc
     };
   } catch {
@@ -6091,7 +6764,8 @@ function parseLicensePolicy(content) {
       permitted: DEFAULT_PERMITTED,
       restricted: DEFAULT_RESTRICTED,
       blocked: DEFAULT_BLOCKED,
-      exception_packages: {}
+      exception_packages: {},
+      vex_statements: []
     };
   }
 }
@@ -6266,10 +6940,10 @@ function shouldGenerateSbom(options, rawPolicy) {
   if (options.generateSbom === false) return false;
   return Boolean(options.generateSbom || options.sbomPath || rawPolicy?.ci_gates?.generate_sbom);
 }
-function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies) {
+function maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   if (!shouldGenerateSbom(options, rawPolicy)) return void 0;
   const sbomPath = options.sbomPath || path4.join(rootDir, "reports", "sbom.cdx.json");
-  const sbom = generateCycloneDxSbom(dependencies, { rootDir });
+  const sbom = generateCycloneDxSbom(dependencies, { rootDir, vulnerabilities, vexStatements });
   writeCycloneDxSbom(sbom, sbomPath);
   return sbomPath;
 }
@@ -6282,9 +6956,9 @@ function maybeGenerateNotices(options, rootDir, rawPolicy, dependencies) {
   writeThirdPartyNotices(noticesContent, noticesPath);
   return noticesPath;
 }
-function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies) {
+function handleDynamicScaArtifacts(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements) {
   return {
-    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies),
+    sbomPath: maybeGenerateSbom(options, rootDir, rawPolicy, dependencies, vulnerabilities, vexStatements),
     noticesPath: maybeGenerateNotices(options, rootDir, rawPolicy, dependencies)
   };
 }
@@ -6313,7 +6987,7 @@ function buildSkippedVulnResult() {
     skipReason: "Trivy scanner is not installed on host environment. Vulnerability check gracefully skipped."
   };
 }
-function checkVulnerabilities(rootDir, options) {
+function checkVulnerabilities(rootDir, options, vexStatements) {
   if (options.scanVulnerabilities === false) {
     return { vulnerabilities: [], blocked: false };
   }
@@ -6321,7 +6995,10 @@ function checkVulnerabilities(rootDir, options) {
   if (!res.executed) {
     return buildSkippedVulnResult();
   }
-  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, options.vulnerabilityThresholds);
+  const evalResult = evaluateVulnerabilityThresholds(res.vulnerabilities, {
+    ...options.vulnerabilityThresholds,
+    vexStatements
+  });
   return { vulnerabilities: res.vulnerabilities, blocked: evalResult.blocked };
 }
 function assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData) {
@@ -6345,7 +7022,8 @@ function toCleanPolicy(policyWithRaw) {
     permitted: policyWithRaw.permitted,
     restricted: policyWithRaw.restricted,
     blocked: policyWithRaw.blocked,
-    exception_packages: policyWithRaw.exception_packages
+    exception_packages: policyWithRaw.exception_packages,
+    vex_statements: policyWithRaw.vex_statements
   };
 }
 function scanDependenciesForVerification(options, rootDir, rawPolicy) {
@@ -6365,8 +7043,15 @@ function verifyLicenses(options = {}) {
   }
   const dependencies = scanDependenciesForVerification(options, rootDir, policyWithRaw.rawPolicy);
   const { violations, permittedCount } = evaluateDependencyList(dependencies, policy);
-  const artifacts = handleDynamicScaArtifacts(options, rootDir, policyWithRaw.rawPolicy, dependencies);
-  const vulnData = checkVulnerabilities(rootDir, options);
+  const vulnData = checkVulnerabilities(rootDir, options, policy.vex_statements);
+  const artifacts = handleDynamicScaArtifacts(
+    options,
+    rootDir,
+    policyWithRaw.rawPolicy,
+    dependencies,
+    vulnData.vulnerabilities,
+    policy.vex_statements
+  );
   const reportMarkdown = generateLicenseReportMarkdown(dependencies, violations, policy, artifacts.sbomPath);
   return assembleDynamicLicenseResult(dependencies, permittedCount, violations, reportMarkdown, artifacts, vulnData);
 }
@@ -15906,7 +16591,145 @@ function initProject(options = {}) {
     tryInstallGitHook(destDir, options.dryRun)
   );
 }
+var DEFAULT_DLP_RULES = [
+  {
+    id: "DLP-001-PRIVATE-KEY",
+    description: "PEM / RSA / EC / OPENSSH Private Key Block",
+    pattern: "-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\\s\\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----",
+    replacement: "[REDACTED:PRIVATE_KEY]",
+    enabled: true
+  },
+  {
+    id: "DLP-002-API-TOKEN",
+    description: "Cloud, GitHub, Slack, OpenAI, Stripe, and AWS Access Tokens",
+    pattern: "\\b(?:gh[pousr]_[A-Za-z0-9_]{36,255}|github_pat_[0-9a-zA-Z_]{82}|sk-(?:proj-|live-)?[a-zA-Z0-9_-]{32,}|AKIA[0-9A-Z]{16}|xox[baprs]-[0-9]{10,13}-[0-9]{10,13}[a-zA-Z0-9-]*|(?:sk|rk)_(?:live|test)_[0-9a-zA-Z]{24,99})\\b",
+    replacement: "[REDACTED:API_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-003-JWT",
+    description: "Plaintext JSON Web Token (JWT)",
+    pattern: "\\beyJ[A-Za-z0-9_-]{10,}\\.eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\b",
+    replacement: "[REDACTED:JWT_TOKEN]",
+    enabled: true
+  },
+  {
+    id: "DLP-004-CREDIT-CARD",
+    description: "Payment Card Number (13-19 digits formatted)",
+    pattern: "\\b(?:\\d{4}[- ]\\d{4}[- ]\\d{4}[- ]\\d{4}|\\d{16})\\b",
+    replacement: "[REDACTED:CREDIT_CARD]",
+    enabled: true
+  },
+  {
+    id: "DLP-005-EMAIL",
+    description: "Personal or Corporate Email Address",
+    pattern: "\\b[A-Za-z0-9._%+-]+@(?!example\\.com|localhost|test\\.local)[A-Za-z0-9.-]+\\.[A-Za-z]{2,}\\b",
+    replacement: "[REDACTED:EMAIL]",
+    enabled: true
+  },
+  {
+    id: "DLP-006-INTERNAL-URL",
+    description: "Internal Intranet / Corp Service URL",
+    pattern: "https?://(?:[A-Za-z0-9._-]+:[A-Za-z0-9._-]+@|[A-Za-z0-9.-]+\\.(?:internal|corp|intranet|local)\\b)[^\\s\"'`<>]*",
+    replacement: "[REDACTED:INTERNAL_URL]",
+    enabled: true
+  }
+];
+function createDefaultDlpPolicy() {
+  return {
+    version: "1.0",
+    enabled: true,
+    zero_data_retention_required: true,
+    rules: [...DEFAULT_DLP_RULES]
+  };
+}
+function normalizeParsedRule(raw, idx) {
+  if (typeof raw.pattern !== "string" || !raw.pattern) return null;
+  return {
+    id: typeof raw.id === "string" ? raw.id : `DLP-CUSTOM-${idx + 1}`,
+    description: typeof raw.description === "string" ? raw.description : "Custom DLP rule",
+    pattern: raw.pattern,
+    replacement: typeof raw.replacement === "string" ? raw.replacement : "[REDACTED]",
+    enabled: raw.enabled !== false
+  };
+}
+function parseDlpPolicy(yamlContent) {
+  const fallback = createDefaultDlpPolicy();
+  if (!yamlContent || !yamlContent.trim()) return fallback;
+  try {
+    const doc = yaml3.load(yamlContent);
+    if (!doc || typeof doc !== "object") return fallback;
+    const rawRules = Array.isArray(doc.rules) ? doc.rules : [];
+    const parsedRules = rawRules.map((r, i) => normalizeParsedRule(r, i)).filter((r) => r !== null);
+    return {
+      version: typeof doc.version === "string" ? doc.version : "1.0",
+      enabled: doc.enabled !== false,
+      zero_data_retention_required: Boolean(doc.zero_data_retention_required ?? true),
+      rules: parsedRules.length > 0 ? parsedRules : fallback.rules
+    };
+  } catch {
+    return fallback;
+  }
+}
+function loadDlpPolicy(rootDir, customPolicyPath) {
+  const base = rootDir || process.cwd();
+  const filePath = customPolicyPath ? path4.isAbsolute(customPolicyPath) ? customPolicyPath : path4.join(base, customPolicyPath) : path4.join(base, "dlp-policy.yaml");
+  if (!fs7.existsSync(filePath)) return createDefaultDlpPolicy();
+  try {
+    return parseDlpPolicy(fs7.readFileSync(filePath, "utf-8"));
+  } catch {
+    return createDefaultDlpPolicy();
+  }
+}
+function applySingleDlpRule(text, rule) {
+  if (rule.enabled === false) return { output: text, matches: 0 };
+  try {
+    const regex = new RegExp(rule.pattern, "g");
+    let matches = 0;
+    const output = text.replace(regex, () => {
+      matches++;
+      return rule.replacement;
+    });
+    return { output, matches };
+  } catch {
+    return { output: text, matches: 0 };
+  }
+}
+function sanitizeDlpText(text, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || !text) {
+    return { sanitizedText: text, redactionCount: 0, triggeredRuleIds: [] };
+  }
+  let current = text;
+  let totalRedactions = 0;
+  const triggered = [];
+  for (const rule of policy.rules) {
+    const res = applySingleDlpRule(current, rule);
+    if (res.matches > 0) {
+      current = res.output;
+      totalRedactions += res.matches;
+      triggered.push(rule.id);
+    }
+  }
+  return {
+    sanitizedText: current,
+    redactionCount: totalRedactions,
+    triggeredRuleIds: triggered
+  };
+}
+function sanitizeDlpPayload(payload, policy = createDefaultDlpPolicy()) {
+  if (!policy.enabled || payload === null || payload === void 0) return payload;
+  if (typeof payload === "string") {
+    return sanitizeDlpText(payload, policy).sanitizedText;
+  }
+  const serialized = JSON.stringify(payload);
+  const { sanitizedText } = sanitizeDlpText(serialized, policy);
+  try {
+    return JSON.parse(sanitizedText);
+  } catch {
+    return payload;
+  }
+}
 
-export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanInstalledLicenses, scanManualsInWorkspace, scanPnpmStore, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
+export { ALL_ARCHITECTURE_TEMPLATES, BRANCH_PATTERNS, BddStepRegistry, DEFAULT_DLP_RULES, DEFAULT_EXCLUDED_PATTERNS, DEFAULT_EXCLUDES, DEFAULT_EXTENSIONS, DEFAULT_PRIVACY_POLICY, DEFAULT_SAST_EXCLUDES, GENERAL_SOURCE_EXTENSIONS, KPI_SUMMARY_END_TAG, KPI_SUMMARY_START_TAG, LIFECYCLE_SKILL_TEMPLATES, OpenSpecAdapter, PII_SAST_RULES, PREPARE_COMMIT_MSG_SCRIPT, PROMPT_INJECTION_SIGNATURES, PROTECTED_BYPASS_PATTERNS, SARIF_SCHEMA_2_1_0, SARIF_VERSION, SAST_RULES, SCHEMA_SCHEMAS_ARCHITECTURE_ADR_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_COMPONENT_SCHEMA_JSON, SCHEMA_SCHEMAS_ARCHITECTURE_INTRODUCTION_AND_GOALS_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_MANIFEST_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_LICENSE_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_COMPLIANCE_QUALITY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_IDE_MCP_CONFIG_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_PRODUCTION_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_MANUALS_USER_MANUAL_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_DATA_ASSET_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_POLICY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_PRIVACY_PRIVACY_ROPA_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BOUNDED_CONTEXT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_BUSINESS_RULE_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_JOURNEY_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_REQUIREMENT_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_TERM_SCHEMA_JSON, SCHEMA_SCHEMAS_PRODUCT_USE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_HAZARD_SCHEMA_JSON, SCHEMA_SCHEMAS_SAFETY_SAFETY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_DESIGN_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_HANDOFF_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_PROPOSAL_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_RELEASE_KPIS_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SESSION_TELEMETRY_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_SPEC_SCHEMA_JSON, SCHEMA_SCHEMAS_SDD_TASKS_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ABUSE_CASE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_ENCLAVE_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_SECURITY_REQ_SCHEMA_JSON, SCHEMA_SCHEMAS_SECURITY_THREAT_ACTOR_SCHEMA_JSON, SCHEMA_SCHEMAS_WORKFLOW_AGENT_HANDOFF_SCHEMA_JSON, SECRET_RULES, SPECIALIZED_AGENT_TEMPLATES, STARTER_ANTIGRAVITY_MCP, STARTER_ANTIGRAVITY_RULES, STARTER_ARCH_ADR, STARTER_ARCH_ARCHITECTURE_CONSTRAINTS, STARTER_ARCH_COMPONENT, STARTER_ARCH_CONTEXT_AND_SCOPE, STARTER_ARCH_CROSS_CUTTING_CONCEPTS, STARTER_ARCH_DEPLOYMENT_VIEW, STARTER_ARCH_GLOSSARY, STARTER_ARCH_INTRODUCTION_AND_GOALS, STARTER_ARCH_LEVEL_1_WHITEBOX, STARTER_ARCH_QUALITY_REQUIREMENTS, STARTER_ARCH_RISKS_AND_TECHNICAL_DEBT, STARTER_ARCH_RUNTIME_VIEW, STARTER_ARCH_SOLUTION_STRATEGY, STARTER_AZURE_PIPELINES, STARTER_BASE_TEMPLATES, STARTER_BITBUCKET_PIPELINES, STARTER_CLAUDE_RULES, STARTER_COMPLIANCE_LICENSE_MANIFEST_YAML, STARTER_COPILOT_RULES, STARTER_CURSOR_CORE_RULES, STARTER_CURSOR_MCP, STARTER_CURSOR_PRODUCT_RULES, STARTER_CURSOR_QUALITY_RULES, STARTER_GITHUB_CI, STARTER_GITHUB_DEPLOY_DASHBOARD, STARTER_GITHUB_PR_KPI, STARTER_GITHUB_PULL_REQUEST_TEMPLATE, STARTER_GITHUB_SDD_INTEGRATE, STARTER_GITLAB_CI, STARTER_LICENSE_POLICY, STARTER_PRIVACY_POLICY, STARTER_PROCESS_README, STARTER_PULL_REQUEST_TEMPLATE, STARTER_QUALITY_POLICY, STARTER_REQUIREMENT_TEMPLATE, STARTER_SCHEMAS, STARTER_SCHEMAS_MAP, STARTER_TASK_TEMPLATE, STARTER_TEMPLATES_CI_AZURE_PIPELINES_YML, STARTER_TEMPLATES_CI_BITBUCKET_PIPELINES_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_CI_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_DEPLOY_DASHBOARD_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_PR_KPI_SUMMARY_YML, STARTER_TEMPLATES_CI_GITHUB_WORKFLOWS_SDD_INTEGRATE_ON_MERGE_YML, STARTER_TEMPLATES_CI__GITLAB_CI_YML, STARTER_TEMPLATES_COMPLIANCE_COMMERCIAL_ACQUISITION_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_PRODUCTION_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_MANUALS_USER_MANUAL_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DATA_ASSET_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_DPIA_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_PRIVACY_PRIVACY_ROPA_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BOUNDED_CONTEXT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_BUSINESS_RULE_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_JOURNEY_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_REQUIREMENT_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_TERM_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USER_DESIGN_FEEDBACK_TEMPLATE_MD, STARTER_TEMPLATES_PRODUCT_USE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_HAZARD_TEMPLATE_MD, STARTER_TEMPLATES_SAFETY_SAFETY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SDD_DESIGN_TEMPLATE_MD, STARTER_TEMPLATES_SDD_HANDOFF_TEMPLATE_YAML, STARTER_TEMPLATES_SDD_PROPOSAL_TEMPLATE_MD, STARTER_TEMPLATES_SDD_PULL_REQUEST_TEMPLATE_MD, STARTER_TEMPLATES_SDD_SPEC_TEMPLATE_MD, STARTER_TEMPLATES_SDD_TASKS_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ABUSE_CASE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_ENCLAVE_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_SECURITY_REQ_TEMPLATE_MD, STARTER_TEMPLATES_SECURITY_THREAT_ACTOR_TEMPLATE_MD, STARTER_TEMPLATES_WORKFLOW_AGENT_HANDOFF_TEMPLATE_MD, STARTER_VSCODE_MCP, STARTER_WORKFLOW_HANDOFF_TEMPLATE, STARTER__GITHUB_PULL_REQUEST_TEMPLATE_MD, SpecKitAdapter, TYPE_TO_SCHEMA_MAP, VALID_AGENT_TARGETS, VALID_ARCHITECTURE_GRANULARITIES, VALID_AUTONOMY_MODES, VALID_CHANGE_PROFILES, VALID_CI_PROVIDERS, aggregateCommitKpiRecords, aggregatePrKpis, aggregateReleaseKpis, analyzeBddVariantsForRequirement, appendRevisionHistoryRow, applyRatchetMode, buildCycloneDxComponent, buildCycloneDxVulnerabilities, buildFeatureFileContent, buildGraphElements, calculateJaccardSimilarity, calculateMetrics, calculateRating, calculateShannonEntropy, checkGherkinInSync, checkoutTaskBranch, classifyBranch, classifyMetricFromMessage, collectAgentFiles, collectDashboardMetrics, collectHistoricalKpis, computeCanonicalSha256, computeSha256, computeViolationSignature, createDefaultDlpPolicy, createDefaultQualityPolicy, depositProductHandoffSidecar, detectActiveChangeForIntegration, detectAuthorIdentity, detectLanguage, detectProfileFromChange, detectPromptInjection, emitCiOutput, evaluateCompoundLicense, evaluateSingleDependency, evaluateVulnerabilityThresholds, executeBddFeature, extractBaselineEntriesFromResults, extractCitations, extractCommitKpisFromRange, extractDirectDepNames, extractFeatureTags, extractFrontmatter, extractFunctions, extractFunctionsBraceLanguages, extractFunctionsPolyglot, extractFunctionsPython, extractFunctionsTypeScriptAst, extractGherkinBlock, extractGherkinFeatures, extractNormativeText, findChangeWorkspaceDir, findLicenseFile, formatCommitTrailers, formatPrKpiMarkdown, formatReleaseKpiMarkdown, generateBranchHierarchyPlan, generateCycloneDxSbom, generateDashboardReport, generateDuplicatesReportMarkdown, generateGovernanceReportMarkdown, generateLicenseReportMarkdown, generatePdacReportMarkdown, generatePrivacyReportMarkdown, generateQualityReport, generateRopaInventoryMarkdown, generateSastReportMarkdown, generateSecretsReportMarkdown, generateSecuritySarifReport, generateSuppressionsAuditReport, generateTestingCoverageReportMarkdown, generateThirdPartyNotices, generateTraceabilityReportMarkdown, getArchitectureTemplates, getCytoscapeScript, getGitDiffLines, getNextCorrelativeNumber, getSddAdapter, inferArtifactTypeFromId, inferMissingTrailers, initProject, injectKpisIntoPrBody, installGitHooks, integrateSddChange, isGitleaksInstalled, isMetricWorsened, isPathProtectedFromPatch, isPlaceholderOrIgnored, isRequirementArtifact2 as isRequirementArtifact, isSemgrepInstalled, isToolAvailable, loadDlpPolicy, loadPrivacyPolicy, loadProductHandoffSidecar, loadQualityBaseline, locateTaskInActiveChanges, mapSastSeverityToSarifLevel, maskSecret, normalizeSpdxLicense, normalizeUri, parseCommitTrailers, parseDlpPolicy, parseFeatureDocument, parseFrontmatter, parseFrontmatterId, parseGenericDoc, parseLicensePolicy, parseMarkdownFrontmatter, parseQualityPolicy, parseRequirementFile, parseSecuritySuppression, parseSpecCatalogScope, parseTasksDoc, parseTasksFromContent, parseTrivyVulnerabilities, processPackageDir, readCodeCoverageSummary, readPackageJson, renderAntigravityAgentFile, renderAntigravitySkillFile, renderAutonomyModeSection, renderClaudeAgentFile, renderClaudeSkillFile, renderCopilotAgentFile, renderCopilotSkillFile, renderCursorAgentFile, renderCursorSkillFile, renderDashboardHtml, renderManualsTab, resolveAgentTargets, resolveBranchHierarchy, resolveCiEnvironment, resolveCytoscapePath, resolveDefaultBranchBase, resolveFeatureFilePath, resolveGitRef, resolveLicenseFromFile, resolveReleaseBaseBranch, resolveSastCwe, resolveSastOwasp, resolveSchemaForArtifact, resolveTargetFiles, runGitleaksCli, runSemgrepCli, sanitizeDlpPayload, sanitizeDlpText, scaffoldSddChange, scanAllProductHandoffs, scanAllTestArtifacts, scanContentForSecrets, scanFileForPrivacyViolations, scanFileForSast, scanGoDependencies, scanInstalledLicenses, scanManualsInWorkspace, scanMavenDependencies, scanPnpmStore, scanPythonDependencies, scanRustDependencies, scanSubdirectories, scanWithNativeFs, scanWithSyft, scanWithTrivy, serializeSarifDocument, slugify, syncPdacDigests, tokenizeTitle, updateCitationsInContent, validateAgainstSchema, validateArtifactSchema, verifyArtifactDuplicates, verifyArtifactsSchemas, verifyLicenses, verifyManuals, verifyPdacGraph, verifyPrivacy, verifyProgressiveFriction, verifyQualityGate, verifySast, verifySddIntegration, verifySecrets, verifyTasksGovernance, verifyTestingCoverage, verifyTraceability, walkDir, walkMdFiles, walkProjectFiles, walkSourceFiles, walkTaskFiles, writeCucumberJsonReport, writeCycloneDxSbom, writeQualityBaseline, writeReleaseKpiReport, writeSecuritySarifReport, writeThirdPartyNotices };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map