@sienklogic/plan-build-run 2.11.0 → 2.12.1

package/plan-build-run/bin/lib/security-scan.cjs

@@ -0,0 +1,200 @@
+/**
+ * lib/security-scan.cjs — OWASP-style security scanning for Plan-Build-Run.
+ *
+ * Checks changed files against security rules inspired by the OWASP Top 10
+ * and common vulnerability patterns. Reports findings with severity levels.
+ * Controlled by config.features.security_scanning.
+ */
+
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+// ─── Security rules ───────────────────────────────────────────────────────────
+
+/**
+ * OWASP-inspired security rules.
+ * Each rule specifies a regex pattern and associated metadata.
+ */
+const SECURITY_RULES = [
+  {
+    id: 'SEC-001',
+    name: 'hardcoded-secret',
+    // Matches: const/let/var KEY = "value", assignment with key-like name containing long strings
+    pattern: /(?:api[_-]?key|secret|password|token|auth|credential|passwd|pwd)\s*[=:]\s*["'][^"']{8,}["']/i,
+    severity: 'high',
+    message: 'Potential hardcoded secret',
+  },
+  {
+    id: 'SEC-002',
+    name: 'eval-usage',
+    pattern: /\beval\s*\(/,
+    severity: 'high',
+    message: 'eval() with dynamic input — potential code injection',
+  },
+  {
+    id: 'SEC-003',
+    name: 'shell-injection',
+    // exec/spawn/execSync with string concatenation
+    pattern: /(?:exec|spawn|execSync|execFileSync)\s*\(\s*(?:[^)]*\+|`[^`]*\${)/,
+    severity: 'high',
+    message: 'Potential shell injection via string concatenation in exec/spawn',
+  },
+  {
+    id: 'SEC-004',
+    name: 'unsafe-regex',
+    // Nested quantifiers that can cause catastrophic backtracking
+    pattern: /\/[^/]*(?:\([^)]*[+*][^)]*\)[+*]|\([^)]*[+*][^)]*\)\{)/,
+    severity: 'medium',
+    message: 'Potentially catastrophic regex backtracking (nested quantifiers)',
+  },
+  {
+    id: 'SEC-005',
+    name: 'path-traversal',
+    // path.join/resolve with user input (variables named req, user, input, param, etc.)
+    pattern: /path\.(?:join|resolve)\s*\([^)]*(?:req\.|user|input|param|query|body)[^)]*\)/,
+    severity: 'medium',
+    message: 'Potential path traversal — unsanitized path with user input',
+  },
+  {
+    id: 'SEC-006',
+    name: 'prototype-pollution',
+    // Object bracket notation with dynamic keys that could be __proto__ or constructor
+    pattern: /(?:obj|target|dest|result)\s*\[\s*(?:key|prop|k)\s*\]\s*=/,
+    severity: 'high',
+    message: 'Potential prototype pollution via dynamic property assignment',
+  },
+  {
+    id: 'SEC-007',
+    name: 'insecure-random',
+    pattern: /Math\.random\(\)/,
+    severity: 'low',
+    message: 'Math.random() is not cryptographically secure — use crypto.randomBytes() for security-sensitive contexts',
+  },
+  {
+    id: 'SEC-008',
+    name: 'unvalidated-redirect',
+    // res.redirect with variable input
+    pattern: /res\.redirect\s*\(\s*(?:req\.|user|input|param|query|body|url)/,
+    severity: 'medium',
+    message: 'Potential open redirect — redirect destination should be validated',
+  },
+];
+
+// ─── Binary file extensions to skip ──────────────────────────────────────────
+
+const BINARY_EXTENSIONS = new Set([
+  '.png', '.jpg', '.jpeg', '.gif', '.bmp', '.ico', '.svg',
+  '.woff', '.woff2', '.ttf', '.eot', '.otf',
+  '.pdf', '.zip', '.gz', '.tar', '.7z',
+  '.mp3', '.mp4', '.avi', '.mov',
+  '.exe', '.dll', '.so', '.dylib',
+  '.pyc', '.class',
+]);
+
+// ─── Core functions ───────────────────────────────────────────────────────────
+
+/**
+ * Scan a list of files against all security rules.
+ *
+ * @param {string[]} changedFiles - File paths to scan (absolute or relative)
+ * @param {object} config - The .planning/config.json contents
+ * @returns {{ findings: Array, scanned: number }}
+ */
+function scanFiles(changedFiles, config) {
+  if (!config || !config.features || !config.features.security_scanning) {
+    return { findings: [], scanned: 0 };
+  }
+
+  const findings = [];
+  let scanned = 0;
+
+  for (const filePath of changedFiles) {
+    const ext = path.extname(filePath).toLowerCase();
+    if (BINARY_EXTENSIONS.has(ext)) {
+      continue;
+    }
+
+    let content;
+    try {
+      content = fs.readFileSync(filePath, 'utf-8');
+    } catch (_e) {
+      // File unreadable (permissions, doesn't exist) — skip
+      continue;
+    }
+
+    scanned++;
+    const isTestFile = /test/i.test(filePath);
+    const lines = content.split('\n');
+
+    for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+      const line = lines[lineIndex];
+
+      for (const rule of SECURITY_RULES) {
+        if (rule.pattern.test(line)) {
+          const severity = isTestFile ? 'info' : rule.severity;
+          findings.push({
+            ruleId: rule.id,
+            ruleName: rule.name,
+            file: filePath,
+            line: line.trim(),
+            lineNumber: lineIndex + 1,
+            severity,
+            message: rule.message,
+          });
+        }
+      }
+    }
+  }
+
+  return { findings, scanned };
+}
+
+/**
+ * Format scan results into a human-readable report.
+ *
+ * @param {{ findings: Array, scanned: number }} scanResult
+ * @returns {string} Formatted report string
+ */
+function formatFindings(scanResult) {
+  const { findings, scanned } = scanResult;
+
+  if (!findings || findings.length === 0) {
+    return `Security scan: ${scanned} file(s) scanned — no findings (clean)`;
+  }
+
+  // Group by severity
+  const bySeverity = { high: [], medium: [], low: [], info: [] };
+  for (const finding of findings) {
+    const bucket = bySeverity[finding.severity] || bySeverity.info;
+    bucket.push(finding);
+  }
+
+  const lines = [
+    `Security scan: ${scanned} file(s) scanned, ${findings.length} finding(s)`,
+    `  high: ${bySeverity.high.length}  medium: ${bySeverity.medium.length}  low: ${bySeverity.low.length}  info: ${bySeverity.info.length}`,
+    '',
+  ];
+
+  const severityOrder = ['high', 'medium', 'low', 'info'];
+  for (const sev of severityOrder) {
+    if (bySeverity[sev].length > 0) {
+      lines.push(`[${sev.toUpperCase()}]`);
+      for (const f of bySeverity[sev]) {
+        lines.push(`  ${f.ruleId} ${f.file}:${f.lineNumber} — ${f.message}`);
+      }
+      lines.push('');
+    }
+  }
+
+  return lines.join('\n').trim();
+}
+
+// ─── Exports ──────────────────────────────────────────────────────────────────
+
+module.exports = {
+  SECURITY_RULES,
+  scanFiles,
+  formatFindings,
+};

package/plan-build-run/bin/lib/skill-section.cjs

@@ -0,0 +1,98 @@
+'use strict';
+
+/**
+ * skill-section.cjs -- Targeted SKILL.md section extraction for Plan-Build-Run.
+ *
+ * Enables surgical extraction of specific sections from skill files (SKILL.md),
+ * reducing token usage by fetching only the needed section on demand.
+ *
+ * Exported functions:
+ *   skillSection(skillName, sectionQuery, pluginRoot)  -- Main entry point
+ *   resolveSkillPath(skillName, pluginRoot)            -- Resolve skill name to file path
+ *   listAvailableSkills(pluginRoot)                    -- List all available skill names
+ */
+
+const fs = require('fs');
+const path = require('path');
+const { extractSection, listHeadings } = require('./reference.cjs');
+
+/**
+ * Resolve a skill name to its SKILL.md file path.
+ *
+ * @param {string} skillName - Skill name (e.g., "build", "plan")
+ * @param {string} pluginRoot - Plugin root directory
+ * @returns {string | null} - Full path to SKILL.md, or null if not found
+ */
+function resolveSkillPath(skillName, pluginRoot) {
+  const skillPath = path.join(pluginRoot, 'skills', skillName, 'SKILL.md');
+  if (!fs.existsSync(skillPath)) return null;
+  return skillPath;
+}
+
+/**
+ * List all available skill names from the skills/ directory.
+ *
+ * @param {string} pluginRoot - Plugin root directory
+ * @returns {string[]} - Array of skill names (directory names)
+ */
+function listAvailableSkills(pluginRoot) {
+  const skillsDir = path.join(pluginRoot, 'skills');
+  try {
+    return fs.readdirSync(skillsDir, { withFileTypes: true })
+      .filter(e => e.isDirectory())
+      .map(e => e.name);
+  } catch (_e) {
+    return [];
+  }
+}
+
+/**
+ * Extract a specific section from a skill's SKILL.md.
+ *
+ * @param {string} skillName - Skill name (e.g., "build", "plan")
+ * @param {string} sectionQuery - Section heading query (fuzzy matched)
+ * @param {string} pluginRoot - Plugin root directory
+ * @returns {object} - { skill, section, heading, content, char_count } or { error, available? }
+ */
+function skillSection(skillName, sectionQuery, pluginRoot) {
+  // Validate section query
+  if (!sectionQuery || !sectionQuery.trim()) {
+    return { error: 'Section query required' };
+  }
+
+  // Resolve skill path
+  const skillPath = resolveSkillPath(skillName, pluginRoot);
+  if (!skillPath) {
+    return {
+      error: `Skill not found: ${skillName}`,
+      available: listAvailableSkills(pluginRoot)
+    };
+  }
+
+  // Read skill content
+  let content;
+  try {
+    content = fs.readFileSync(skillPath, 'utf8');
+  } catch (e) {
+    return { error: `Cannot read skill file: ${e.message}` };
+  }
+
+  // Normalize query: replace hyphens with spaces for better fuzzy matching
+  const normalizedQuery = sectionQuery.replace(/-/g, ' ');
+
+  // Extract the requested section (try normalized first, then original)
+  let result = extractSection(content, normalizedQuery);
+  if (!result && normalizedQuery !== sectionQuery) {
+    result = extractSection(content, sectionQuery);
+  }
+  if (!result) {
+    return {
+      error: `Section '${sectionQuery}' not found in skill '${skillName}'`,
+      available: listHeadings(content)
+    };
+  }
+
+  return { skill: skillName, section: sectionQuery, ...result };
+}
+
+module.exports = { skillSection, resolveSkillPath, listAvailableSkills };

package/plan-build-run/bin/lib/spec-diff.cjs

@@ -0,0 +1,209 @@
+'use strict';
+/**
+ * spec-diff.cjs — Semantic spec diff engine for PLAN.md files.
+ *
+ * Compares two versions of a parsed spec and reports structural and
+ * content changes with breaking/non-breaking classification.
+ */
+
+const { parsePlanToSpec } = require('./spec-engine.cjs');
+
+// ─── Helpers ──────────────────────────────────────────────────────────────────
+
+/**
+ * Compare two values and return a Change record if they differ.
+ * @param {string} type - 'modified'|'frontmatter'
+ * @param {string} target - task ID or 'frontmatter'
+ * @param {string} field
+ * @param {*} before
+ * @param {*} after
+ * @returns {Change|null}
+ */
+function makeChange(type, target, field, before, after) {
+  const bStr = Array.isArray(before) ? JSON.stringify(before) : String(before || '');
+  const aStr = Array.isArray(after) ? JSON.stringify(after) : String(after || '');
+  if (bStr === aStr) return null;
+  return { type, target, field, before: bStr, after: aStr };
+}
+
+/**
+ * Compare fields of two objects and return Change[] for any differences.
+ * @param {Object} objA
+ * @param {Object} objB
+ * @param {string[]} fields
+ * @param {string} target
+ * @param {string} changeType
+ * @returns {Change[]}
+ */
+function compareFields(objA, objB, fields, target, changeType) {
+  const changes = [];
+  for (const field of fields) {
+    const c = makeChange(changeType, target, field, objA[field], objB[field]);
+    if (c) changes.push(c);
+  }
+  return changes;
+}
+
+// ─── Core Diff ────────────────────────────────────────────────────────────────
+
+/**
+ * Diff two StructuredPlan objects semantically.
+ * @param {{ frontmatter: Object, tasks: Object[] }} specA
+ * @param {{ frontmatter: Object, tasks: Object[] }} specB
+ * @returns {{ changes: Change[], summary: string, breaking: boolean }}
+ */
+function diffSpecs(specA, specB) {
+  const changes = [];
+
+  // ─── Frontmatter comparison ───────────────────────────────────────────────
+  const fmFields = ['files_modified', 'must_haves', 'provides', 'consumes', 'implements', 'type', 'wave'];
+  const fmChanges = compareFields(specA.frontmatter, specB.frontmatter, fmFields, 'frontmatter', 'modified');
+  for (const c of fmChanges) {
+    changes.push({ ...c, target: 'frontmatter' });
+  }
+
+  // ─── Task comparison ──────────────────────────────────────────────────────
+  const mapA = new Map(specA.tasks.map(t => [t.id, t]));
+  const mapB = new Map(specB.tasks.map(t => [t.id, t]));
+
+  // Detect added tasks (in B not in A)
+  for (const [id, task] of mapB) {
+    if (!mapA.has(id)) {
+      changes.push({ type: 'added', target: id, field: 'task', before: '', after: task.name });
+    }
+  }
+
+  // Detect removed tasks (in A not in B)
+  for (const [id, task] of mapA) {
+    if (!mapB.has(id)) {
+      changes.push({ type: 'removed', target: id, field: 'task', before: task.name, after: '' });
+    }
+  }
+
+  // Detect modified tasks (same ID, different content)
+  const taskFields = ['name', 'files', 'action', 'verify', 'done'];
+  for (const [id, taskA] of mapA) {
+    if (!mapB.has(id)) continue;
+    const taskB = mapB.get(id);
+    const taskChanges = compareFields(taskA, taskB, taskFields, id, 'modified');
+    changes.push(...taskChanges);
+  }
+
+  // Detect reordered tasks (same task IDs, different order)
+  const idsA = specA.tasks.map(t => t.id);
+  const idsB = specB.tasks.map(t => t.id);
+  const sharedA = idsA.filter(id => mapB.has(id));
+  const sharedB = idsB.filter(id => mapA.has(id));
+  if (sharedA.join(',') !== sharedB.join(',') && sharedA.length > 0) {
+    changes.push({
+      type: 'reordered',
+      target: 'tasks',
+      field: 'order',
+      before: sharedA.join(', '),
+      after: sharedB.join(', '),
+    });
+  }
+
+  // ─── Breaking classification ──────────────────────────────────────────────
+  // Breaking = removed task or changed 'done' field (definition of done changed)
+  const breaking = changes.some(c =>
+    c.type === 'removed' ||
+    (c.type === 'modified' && c.field === 'done')
+  );
+
+  // ─── Summary ──────────────────────────────────────────────────────────────
+  let summary;
+  if (changes.length === 0) {
+    summary = 'No changes';
+  } else {
+    const added = changes.filter(c => c.type === 'added').length;
+    const removed = changes.filter(c => c.type === 'removed').length;
+    const modified = changes.filter(c => c.type === 'modified').length;
+    const reordered = changes.filter(c => c.type === 'reordered').length;
+    const parts = [];
+    if (added) parts.push(`${added} added`);
+    if (removed) parts.push(`${removed} removed`);
+    if (modified) parts.push(`${modified} modified`);
+    if (reordered) parts.push(`${reordered} reordered`);
+    summary = parts.join(', ') + (breaking ? ' (BREAKING)' : '');
+  }
+
+  return { changes, summary, breaking };
+}
+
+/**
+ * Convenience wrapper: diff two raw PLAN.md content strings.
+ * @param {string} contentA
+ * @param {string} contentB
+ * @returns {{ changes: Change[], summary: string, breaking: boolean }}
+ */
+function diffPlanFiles(contentA, contentB) {
+  const specA = parsePlanToSpec(contentA);
+  const specB = parsePlanToSpec(contentB);
+  return diffSpecs(specA, specB);
+}
+
+// ─── Formatter ────────────────────────────────────────────────────────────────
+
+/**
+ * Format a diff result as markdown or JSON.
+ * @param {{ changes: Change[], summary: string, breaking: boolean }} diff
+ * @param {'markdown'|'json'} format
+ * @returns {string}
+ */
+function formatDiff(diff, format) {
+  if (format === 'json') {
+    return JSON.stringify(diff.changes, null, 2);
+  }
+
+  // Markdown format
+  if (diff.changes.length === 0) {
+    return '## Spec Diff\n\nNo changes';
+  }
+
+  const added = diff.changes.filter(c => c.type === 'added');
+  const removed = diff.changes.filter(c => c.type === 'removed');
+  const modified = diff.changes.filter(c => c.type === 'modified');
+  const reordered = diff.changes.filter(c => c.type === 'reordered');
+
+  let md = `## Spec Diff\n\n**Summary:** ${diff.summary}\n`;
+  if (diff.breaking) md += '\n> WARNING: Breaking changes detected\n';
+
+  if (added.length > 0) {
+    md += '\n### Added\n';
+    for (const c of added) {
+      md += `- Task \`${c.target}\`: ${c.after}\n`;
+    }
+  }
+  if (removed.length > 0) {
+    md += '\n### Removed\n';
+    for (const c of removed) {
+      md += `- Task \`${c.target}\`: ${c.before}\n`;
+    }
+  }
+  if (modified.length > 0) {
+    md += '\n### Modified\n';
+    for (const c of modified) {
+      md += `- \`${c.target}\` / \`${c.field}\`\n`;
+      md += `  - Before: \`${c.before.slice(0, 80)}${c.before.length > 80 ? '...' : ''}\`\n`;
+      md += `  - After: \`${c.after.slice(0, 80)}${c.after.length > 80 ? '...' : ''}\`\n`;
+    }
+  }
+  if (reordered.length > 0) {
+    md += '\n### Reordered\n';
+    for (const c of reordered) {
+      md += `- Task order changed: ${c.before} -> ${c.after}\n`;
+    }
+  }
+
+  return md;
+}
+
+// ─── Exports ──────────────────────────────────────────────────────────────────
+
+module.exports = {
+  diffSpecs,
+  diffPlanFiles,
+  formatDiff,
+  compareFields,
+};

package/plan-build-run/bin/lib/spec-engine.cjs

@@ -0,0 +1,189 @@
+'use strict';
+/**
+ * spec-engine.cjs — Parses PLAN.md files into structured JS objects.
+ *
+ * Provides programmatic access to plan frontmatter and XML task definitions.
+ * Used by spec-diff, reverse-spec, impact-analysis, and pbr-tools spec CLI.
+ */
+
+const { extractFrontmatter, reconstructFrontmatter } = require('./frontmatter.cjs');
+
+// ─── Attribute Parsing ────────────────────────────────────────────────────────
+
+/**
+ * Parse attributes from an opening XML tag string.
+ * e.g. 'id="01-T1" type="auto" tdd="true" complexity="simple"'
+ * @param {string} tagString
+ * @returns {Object<string, string>}
+ */
+function parseAttributes(tagString) {
+  const attrs = {};
+  // Match key="value" or key='value'
+  const re = /([a-zA-Z_][a-zA-Z0-9_-]*)=["']([^"']*)["']/g;
+  let m;
+  while ((m = re.exec(tagString)) !== null) {
+    attrs[m[1]] = m[2];
+  }
+  return attrs;
+}
+
+// ─── Element Extraction ───────────────────────────────────────────────────────
+
+/**
+ * Extract inner text of a named XML element from a string.
+ * Handles multiline content. Returns null if element not found.
+ * @param {string} content
+ * @param {string} tagName
+ * @returns {string|null}
+ */
+function extractElement(content, tagName) {
+  // Use a non-greedy match between opening and closing tag
+  const re = new RegExp(`<${tagName}[^>]*>([\\s\\S]*?)<\\/${tagName}>`, '');
+  const m = content.match(re);
+  if (!m) return null;
+  return m[1].trim();
+}
+
+// ─── Task Parser ──────────────────────────────────────────────────────────────
+
+/**
+ * Parse a single <task ...>...</task> XML block into a StructuredTask object.
+ * @param {string} xmlBlock - The full task XML including opening/closing tags
+ * @returns {StructuredTask}
+ */
+function parseTaskXml(xmlBlock) {
+  // Extract attributes from opening <task> tag
+  const openTagMatch = xmlBlock.match(/^<task([^>]*)>/);
+  const attrs = openTagMatch ? parseAttributes(openTagMatch[1]) : {};
+
+  // Extract mandatory elements
+  const name = extractElement(xmlBlock, 'name') || '';
+  const filesRaw = extractElement(xmlBlock, 'files') || '';
+  const action = extractElement(xmlBlock, 'action') || '';
+  const verifyRaw = extractElement(xmlBlock, 'verify') || '';
+  const done = extractElement(xmlBlock, 'done') || '';
+
+  // Parse files: split by newline, filter empty
+  const files = filesRaw
+    .split(/\r?\n/)
+    .map(f => f.trim())
+    .filter(Boolean);
+
+  // Normalize verify: strip inner <automated> wrapper if present for human-readable access
+  // but keep full verify text
+  const verify = verifyRaw;
+
+  // Extract optional <feature> element
+  let feature = undefined;
+  const featureRaw = extractElement(xmlBlock, 'feature');
+  if (featureRaw !== null) {
+    const behavior = extractElement(featureRaw, 'behavior');
+    const implementation = extractElement(featureRaw, 'implementation');
+    feature = {};
+    if (behavior !== null) feature.behavior = behavior;
+    if (implementation !== null) feature.implementation = implementation;
+  }
+
+  const task = {
+    id: attrs.id || '',
+    type: attrs.type || '',
+    tdd: attrs.tdd || 'false',
+    complexity: attrs.complexity || '',
+    name,
+    files,
+    action,
+    verify,
+    done,
+  };
+
+  if (feature !== undefined) {
+    task.feature = feature;
+  }
+
+  return task;
+}
+
+// ─── Plan Parser ──────────────────────────────────────────────────────────────
+
+/**
+ * Parse a full PLAN.md content string into a StructuredPlan object.
+ * @param {string} planContent - Raw content of a PLAN.md file
+ * @returns {{ frontmatter: Object, tasks: StructuredTask[], raw: string }}
+ */
+function parsePlanToSpec(planContent) {
+  // Extract YAML frontmatter
+  const frontmatter = extractFrontmatter(planContent);
+
+  // Find all <task ...>...</task> blocks (non-greedy, multiline)
+  const taskRe = /<task\b[^>]*>[\s\S]*?<\/task>/g;
+  const taskBlocks = planContent.match(taskRe) || [];
+
+  const tasks = taskBlocks.map(block => parseTaskXml(block));
+
+  return {
+    frontmatter,
+    tasks,
+    raw: planContent,
+  };
+}
+
+// ─── Serializer ───────────────────────────────────────────────────────────────
+
+/**
+ * Serialize a StructuredPlan back into PLAN.md format markdown string.
+ * Produces a valid round-trip representation.
+ * @param {{ frontmatter: Object, tasks: StructuredTask[], raw?: string }} spec
+ * @returns {string}
+ */
+function serializeSpec(spec) {
+  const { frontmatter, tasks } = spec;
+
+  // Reconstruct frontmatter block
+  const yamlStr = reconstructFrontmatter(frontmatter);
+  let output = `---\n${yamlStr}\n---\n\n`;
+
+  // Reconstruct each task
+  for (const task of tasks) {
+    const attrs = [
+      `id="${task.id}"`,
+      `type="${task.type}"`,
+      `tdd="${task.tdd}"`,
+      `complexity="${task.complexity}"`,
+    ].join(' ');
+
+    output += `<task ${attrs}>\n`;
+    output += `<name>${task.name}</name>\n`;
+    output += `<files>\n`;
+    for (const f of task.files) {
+      output += `${f}\n`;
+    }
+    output += `</files>\n`;
+    output += `<action>\n${task.action}\n</action>\n`;
+
+    if (task.feature) {
+      output += `<feature>\n`;
+      if (task.feature.behavior) {
+        output += `<behavior>\n${task.feature.behavior}\n</behavior>\n`;
+      }
+      if (task.feature.implementation) {
+        output += `<implementation>\n${task.feature.implementation}\n</implementation>\n`;
+      }
+      output += `</feature>\n`;
+    }
+
+    output += `<verify>\n${task.verify}\n</verify>\n`;
+    output += `<done>${task.done}</done>\n`;
+    output += `</task>\n\n`;
+  }
+
+  return output.trimEnd() + '\n';
+}
+
+// ─── Exports ──────────────────────────────────────────────────────────────────
+
+module.exports = {
+  parseAttributes,
+  parseTaskXml,
+  parsePlanToSpec,
+  serializeSpec,
+};