specforge-mcp 0.1.0

package/dist/engine/llm-security/mlops-requirements.js

@@ -0,0 +1,80 @@
+// engine/llm-security/mlops-requirements.ts — SPEC-045
+// MLOps and model governance requirements for LLM projects with fine-tuning or own embeddings.
+/**
+ * Generate model governance criteria for projects with fine-tuning.
+ */
+function buildModelGovernanceCriteria() {
+    return [
+        '- [ ] Los modelos en producción tienen versión semántica y están registrados en el model registry con metadatos de entrenamiento (arquitectura, dataset, fecha de corte, métricas de evaluación)',
+        '- [ ] Se monitorea drift de distribución entre datos de entrenamiento y distribución en producción con alertas automatizadas cuando el drift supera el threshold definido',
+        '- [ ] Los datasets de entrenamiento tienen provenance documentada — fuente, fecha de corte, licencia de uso, mecanismo de consentimiento',
+    ];
+}
+/**
+ * Generate privacy criteria for projects with own embeddings (GDPR right to erasure).
+ */
+function buildEmbeddingsPrivacyCriteria() {
+    return [
+        '- [ ] Los vectores de embedding derivados de datos de usuario se eliminan del vectorstore cuando el usuario ejerce el derecho de supresión (GDPR Art. 17) — no solo los documentos originales sino todos los vectores derivados de ellos',
+        '- [ ] El modelo de embedding usado está documentado en el spec — un cambio de modelo invalida todos los vectores existentes y requiere re-indexación completa',
+    ];
+}
+/**
+ * Generate MLOps section for HU.md for projects with fine-tuning or own embeddings.
+ */
+export function generateMlopsHuSection(detection) {
+    if (!detection.isLlmProject) {
+        return [];
+    }
+    const lines = [];
+    if (detection.hasFineTuning) {
+        lines.push('', '## MLOps & Model Governance', '');
+        lines.push(...buildModelGovernanceCriteria());
+    }
+    if (detection.hasEmbeddingsOwn) {
+        if (lines.length === 0) {
+            lines.push('', '## Embeddings Privacy (GDPR)', '');
+        }
+        else {
+            lines.push('', '### Embeddings Privacy (GDPR)', '');
+        }
+        lines.push(...buildEmbeddingsPrivacyCriteria());
+    }
+    if (lines.length > 0) {
+        lines.push('');
+    }
+    return lines;
+}
+/**
+ * Generate MLOps tooling recommendations per maturity level.
+ * Used by suggest_tooling.
+ */
+export function generateMlopsToolingLines(detection) {
+    if (!detection.isLlmProject || (!detection.hasFineTuning && !detection.hasRAG)) {
+        return [];
+    }
+    const lines = ['', '## MLOps & LLMOps Stack', ''];
+    if (detection.hasFineTuning) {
+        lines.push('### MLOps por Nivel de Madurez', '');
+        lines.push('**Inicio:** MLflow (open-source, self-hosted, experiment tracking + model registry)');
+        lines.push('- Docs: https://mlflow.org');
+        lines.push('');
+        lines.push('**Escala:** Weights & Biases (experiment tracking con UI avanzada) + BentoML (model serving)');
+        lines.push('- Docs: https://wandb.ai | https://bentoml.com');
+        lines.push('');
+        lines.push('**Enterprise:** Vertex AI Pipelines (GCP) o Azure ML Pipelines');
+        lines.push('- Docs: https://cloud.google.com/vertex-ai | https://azure.microsoft.com/ml');
+        lines.push('');
+    }
+    if (detection.hasRAG || detection.provider) {
+        lines.push('### LLMOps (Tracing & Observability)', '');
+        lines.push('**Langfuse** (tracing open-source, self-hosteable) — recomendado para inicio');
+        lines.push('- Docs: https://langfuse.com');
+        lines.push('');
+        lines.push('**LangSmith** (hosted, integrado con LangChain) — si ya usas LangChain framework');
+        lines.push('- Docs: https://smith.langchain.com');
+        lines.push('');
+    }
+    return lines;
+}
+//# sourceMappingURL=mlops-requirements.js.map

package/dist/engine/llm-security/mlops-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mlops-requirements.js","sourceRoot":"","sources":["../../../src/engine/llm-security/mlops-requirements.ts"],"names":[],"mappings":"AAAA,uDAAuD;AACvD,+FAA+F;AAI/F;;GAEG;AACH,SAAS,4BAA4B;IACnC,OAAO;QACL,kMAAkM;QAClM,2KAA2K;QAC3K,0IAA0I;KAC3I,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,8BAA8B;IACrC,OAAO;QACL,0OAA0O;QAC1O,+JAA+J;KAChK,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,sBAAsB,CAAC,SAA6B;IAClE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,6BAA6B,EAAE,EAAE,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,GAAG,4BAA4B,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,IAAI,SAAS,CAAC,gBAAgB,EAAE,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,8BAA8B,EAAE,EAAE,CAAC,CAAC;QACrD,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,+BAA+B,EAAE,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,GAAG,8BAA8B,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAA6B;IACrE,IAAI,CAAC,SAAS,CAAC,YAAY,IAAI,CAAC,CAAC,SAAS,CAAC,aAAa,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/E,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,EAAE,EAAE,yBAAyB,EAAE,EAAE,CAAC,CAAC;IAE5D,IAAI,SAAS,CAAC,aAAa,EAAE,CAAC;QAC5B,KAAK,CAAC,IAAI,CAAC,gCAAgC,EAAE,EAAE,CAAC,CAAC;QACjD,KAAK,CAAC,IAAI,CACR,qFAAqF,CACtF,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;QACzC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CACR,8FAA8F,CAC/F,CAAC;QACF,KAAK,CAAC,IAAI,CAAC,gDAAgD,CAAC,CAAC;QAC7D,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC;QAC7E,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;QAC1F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,sCAAsC,EAAE,EAAE,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,8EAA8E,CAAC,CAAC;QAC3F,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;QAC/F,KAAK,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAClD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/engine/llm-security/owasp-llm-requirements.d.ts

@@ -0,0 +1,36 @@
+import type { LlmDetectionResult, LlmSecurityCriterion } from '../../types/index.js';
+/**
+ * Generate OWASP LLM Top 10 criteria based on project detection.
+ * LLM01+LLM02: always when LLM detected.
+ * LLM05: only when hasToolUse.
+ * LLM06: only when hasRAG.
+ * LLM09: only when high-risk domain (euAiActRisk is high-risk or unacceptable).
+ */
+export declare function generateOwaspLlmCriteria(detection: LlmDetectionResult): LlmSecurityCriterion[];
+/**
+ * Format OWASP LLM criteria as HU.md lines.
+ */
+export declare function formatOwaspCriteriaAsLines(criteria: LlmSecurityCriterion[]): string[];
+/**
+ * Generate credential management criteria for LLM API keys.
+ */
+export declare function generateCredentialManagementCriteria(): string[];
+/**
+ * SPEC-045 TD-P15-01: Detect vector DB usage from project stack.
+ */
+export declare function hasVectorDbInStack(stack: string[]): boolean;
+/**
+ * SPEC-045 TD-P15-02: Detect agentic AI frameworks from project stack.
+ */
+export declare function hasAgenticAiInStack(stack: string[]): boolean;
+/**
+ * SPEC-045 TD-P15-01: Generate vector/embedding security criteria for RAG projects
+ * that use vector DBs (Pinecone, Weaviate, Qdrant, Chroma, pgvector).
+ */
+export declare function generateVectorDbSecurityCriteria(stack: string[]): string[];
+/**
+ * SPEC-045 TD-P15-02: Generate agentic AI security criteria (OWASP GenAI Top 10 2025)
+ * when LangGraph, CrewAI, AutoGen, or Semantic Kernel is detected in the stack.
+ */
+export declare function generateAgenticAiSecurityCriteria(stack: string[]): string[];
+//# sourceMappingURL=owasp-llm-requirements.d.ts.map

package/dist/engine/llm-security/owasp-llm-requirements.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-llm-requirements.d.ts","sourceRoot":"","sources":["../../../src/engine/llm-security/owasp-llm-requirements.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AA8ErF;;;;;;GAMG;AACH,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,kBAAkB,GAAG,oBAAoB,EAAE,CA2B9F;AAED;;GAEG;AACH,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAYrF;AAED;;GAEG;AACH,wBAAgB,oCAAoC,IAAI,MAAM,EAAE,CAU/D;AAcD;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAG5D;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAc1E;AAED;;;GAGG;AACH,wBAAgB,iCAAiC,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAc3E"}

package/dist/engine/llm-security/owasp-llm-requirements.js

@@ -0,0 +1,179 @@
+// engine/llm-security/owasp-llm-requirements.ts — SPEC-045
+// Generates OWASP LLM Top 10 criteria for specs targeting LLM projects.
+/** LLM01 — Prompt Injection: always required when LLM is detected */
+function buildLlm01Criteria() {
+    return {
+        category: 'LLM01-prompt-injection',
+        criterion: 'Toda entrada de usuario procesada por el LLM pasa por validación de intención — se rechaza input que contiene patrones de jailbreak conocidos (`ignore previous instructions`, `you are now`, `roleplay as`, `disregard your`, `new persona:`) o instrucciones de sistema embebidas marcadas con delimitadores de prompt',
+        rationale: 'OWASP LLM01: Prompt injection es el vector de ataque más común contra LLMs; el 49% de sistemas son vulnerables',
+        testable: true,
+    };
+}
+/** LLM02 — Insecure Output Handling: always required when LLM is detected */
+function buildLlm02Criteria() {
+    return {
+        category: 'LLM02-insecure-output',
+        criterion: 'La salida del LLM nunca se inyecta directamente en queries SQL, comandos shell, evaluaciones de expresiones o HTML renderizado sin sanitización previa; toda salida que se ejecuta como código pasa por sandbox aislado o validación estricta contra schema JSON definido',
+        rationale: 'OWASP LLM02: El output del LLM puede contener instrucciones maliciosas si no se sanitiza antes de ejecutarse',
+        testable: true,
+    };
+}
+/** LLM05 — Improper Tool Authorization: only when hasToolUse */
+function buildLlm05Criteria() {
+    return {
+        category: 'LLM05-tool-authorization',
+        criterion: 'Cada herramienta que el LLM puede invocar tiene un scope de permisos mínimos documentado en el spec; el LLM no puede invocar herramientas destructivas (`DELETE`, `DROP TABLE`, `rm -rf`, operaciones de escritura irreversibles) sin confirmación explícita del usuario en la sesión actual',
+        rationale: 'OWASP LLM05: Sin autorización adecuada el LLM puede abusar de herramientas con consecuencias destructivas',
+        testable: true,
+    };
+}
+/** LLM06 — Sensitive Information Disclosure: only when hasRAG */
+function buildLlm06Criteria() {
+    return {
+        category: 'LLM06-sensitive-disclosure',
+        criterion: 'Los documentos indexados en el vectorstore son auditados para PII antes de la indexación; el sistema de retrieval respeta la ACL del documento original — un usuario autenticado no puede recuperar documentos de otro usuario via consulta semántica al vectorstore',
+        rationale: 'OWASP LLM06: Los sistemas RAG pueden filtrar información sensible si no se controlan los permisos de retrieval',
+        testable: true,
+    };
+}
+/** LLM07 — System Prompt Leakage: always required when LLM is detected */
+function buildLlm07Criteria() {
+    return {
+        category: 'LLM07-system-prompt-leakage',
+        criterion: 'El system prompt no contiene credenciales, API keys, o lógica de negocio sensible — ' +
+            'únicamente instrucciones de comportamiento; si incluye información sensible, ' +
+            'se carga dinámicamente desde secrets manager en runtime. ' +
+            'El sistema no expone system prompts en respuestas de error ni en logs',
+        rationale: 'OWASP LLM07 2025: Los system prompts pueden ser extraídos por usuarios maliciosos; ' +
+            'credenciales o lógica de negocio embebida quedan expuestas',
+        testable: true,
+    };
+}
+/** LLM09 — Misinformation: only when high-risk domain */
+function buildLlm09Criteria() {
+    return {
+        category: 'LLM09-misinformation',
+        criterion: 'El sistema incluye disclaimer explícito de que las respuestas son generadas por IA y pueden contener errores o información desactualizada; para decisiones en dominios críticos se requiere revisión humana antes de actuar',
+        rationale: 'OWASP LLM09: En dominios de alto riesgo la desinformación del LLM puede tener consecuencias graves para usuarios',
+        testable: true,
+    };
+}
+/**
+ * Generate OWASP LLM Top 10 criteria based on project detection.
+ * LLM01+LLM02: always when LLM detected.
+ * LLM05: only when hasToolUse.
+ * LLM06: only when hasRAG.
+ * LLM09: only when high-risk domain (euAiActRisk is high-risk or unacceptable).
+ */
+export function generateOwaspLlmCriteria(detection) {
+    if (!detection.isLlmProject) {
+        return [];
+    }
+    const criteria = [
+        buildLlm01Criteria(),
+        buildLlm02Criteria(),
+        // LLM07 always required when LLM is detected
+        buildLlm07Criteria(),
+    ];
+    if (detection.hasToolUse) {
+        criteria.push(buildLlm05Criteria());
+    }
+    if (detection.hasRAG) {
+        criteria.push(buildLlm06Criteria());
+    }
+    const isHighRiskDomain = detection.euAiActRisk === 'high-risk' || detection.euAiActRisk === 'unacceptable';
+    if (isHighRiskDomain || detection.detectedHighRiskDomains.length > 0) {
+        criteria.push(buildLlm09Criteria());
+    }
+    return criteria;
+}
+/**
+ * Format OWASP LLM criteria as HU.md lines.
+ */
+export function formatOwaspCriteriaAsLines(criteria) {
+    if (criteria.length === 0) {
+        return [];
+    }
+    const lines = ['', '## OWASP LLM Top 10 Security Requirements', ''];
+    for (const c of criteria) {
+        const tag = c.category.split('-').slice(0, 1).join('').toUpperCase();
+        lines.push(`- [ ] **[${tag}]** ${c.criterion}`);
+    }
+    lines.push('');
+    return lines;
+}
+/**
+ * Generate credential management criteria for LLM API keys.
+ */
+export function generateCredentialManagementCriteria() {
+    return [
+        '',
+        '## LLM Credential Management',
+        '',
+        '- [ ] Las API keys de LLM rotan cada 90 días y se almacenan en secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password Secrets Automation) — nunca en `.env` commiteado al repositorio',
+        '- [ ] Se configura rate limiting en el cliente LLM para prevenir prompt flooding (`max_requests_per_minute` configurado)',
+        '- [ ] El token usage se registra por usuario/sesión en logs estructurados para detectar abuso y optimizar costos',
+        '',
+    ];
+}
+/** Vector DB names that trigger the embedding security section (SPEC-045 TD-P15-01) */
+const VECTOR_DB_NAMES = ['pinecone', 'weaviate', 'qdrant', 'chroma', 'pgvector', 'milvus'];
+/** Agentic AI framework names that trigger the agentic security section (SPEC-045 TD-P15-02) */
+const AGENTIC_AI_FRAMEWORKS = [
+    'langgraph',
+    'crewai',
+    'autogen',
+    'semantic-kernel',
+    'semantickernel',
+];
+/**
+ * SPEC-045 TD-P15-01: Detect vector DB usage from project stack.
+ */
+export function hasVectorDbInStack(stack) {
+    const lower = stack.map((s) => s.toLowerCase());
+    return lower.some((s) => VECTOR_DB_NAMES.some((v) => s.includes(v)));
+}
+/**
+ * SPEC-045 TD-P15-02: Detect agentic AI frameworks from project stack.
+ */
+export function hasAgenticAiInStack(stack) {
+    const lower = stack.map((s) => s.toLowerCase());
+    return lower.some((s) => AGENTIC_AI_FRAMEWORKS.some((f) => s.includes(f)));
+}
+/**
+ * SPEC-045 TD-P15-01: Generate vector/embedding security criteria for RAG projects
+ * that use vector DBs (Pinecone, Weaviate, Qdrant, Chroma, pgvector).
+ */
+export function generateVectorDbSecurityCriteria(stack) {
+    if (!hasVectorDbInStack(stack)) {
+        return [];
+    }
+    return [
+        '',
+        '## Vector DB & Embedding Security',
+        '',
+        '- [ ] Las embeddings no contienen PII sin cifrado — los documentos se anoninizan antes de generar embeddings',
+        '- [ ] El acceso a vector DB está autenticado y tiene rate limiting — las queries de usuarios anónimos están bloqueadas',
+        '- [ ] Las queries de similarity search tienen límite de resultados (top-k ≤ 100) para prevenir data exfiltration masiva',
+        '',
+    ];
+}
+/**
+ * SPEC-045 TD-P15-02: Generate agentic AI security criteria (OWASP GenAI Top 10 2025)
+ * when LangGraph, CrewAI, AutoGen, or Semantic Kernel is detected in the stack.
+ */
+export function generateAgenticAiSecurityCriteria(stack) {
+    if (!hasAgenticAiInStack(stack)) {
+        return [];
+    }
+    return [
+        '',
+        '## Agentic AI Security (OWASP GenAI 2025)',
+        '',
+        '- [ ] Agents tienen scope mínimo de herramientas (principle of least privilege) — cada agent solo puede invocar las herramientas explícitamente declaradas en su definición',
+        '- [ ] Cada acción de agent sobre recursos externos requiere confirmación humana o audit log — las acciones destructivas son bloqueadas sin aprobación explícita',
+        '- [ ] Los agent loops tienen límite de iteraciones (max steps configurado) — el sistema detiene al agent si supera el límite y notifica al usuario',
+        '',
+    ];
+}
+//# sourceMappingURL=owasp-llm-requirements.js.map

package/dist/engine/llm-security/owasp-llm-requirements.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"owasp-llm-requirements.js","sourceRoot":"","sources":["../../../src/engine/llm-security/owasp-llm-requirements.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,wEAAwE;AAIxE,qEAAqE;AACrE,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,wBAAwB;QAClC,SAAS,EACP,0TAA0T;QAC5T,SAAS,EACP,gHAAgH;QAClH,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,uBAAuB;QACjC,SAAS,EACP,2QAA2Q;QAC7Q,SAAS,EACP,8GAA8G;QAChH,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,0BAA0B;QACpC,SAAS,EACP,8RAA8R;QAChS,SAAS,EACP,2GAA2G;QAC7G,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,iEAAiE;AACjE,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,4BAA4B;QACtC,SAAS,EACP,sQAAsQ;QACxQ,SAAS,EACP,gHAAgH;QAClH,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,6BAA6B;QACvC,SAAS,EACP,sFAAsF;YACtF,+EAA+E;YAC/E,2DAA2D;YAC3D,uEAAuE;QACzE,SAAS,EACP,qFAAqF;YACrF,4DAA4D;QAC9D,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,yDAAyD;AACzD,SAAS,kBAAkB;IACzB,OAAO;QACL,QAAQ,EAAE,sBAAsB;QAChC,SAAS,EACP,6NAA6N;QAC/N,SAAS,EACP,kHAAkH;QACpH,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,SAA6B;IACpE,IAAI,CAAC,SAAS,CAAC,YAAY,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,QAAQ,GAA2B;QACvC,kBAAkB,EAAE;QACpB,kBAAkB,EAAE;QACpB,6CAA6C;QAC7C,kBAAkB,EAAE;KACrB,CAAC;IAEF,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC;QACzB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACrB,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,MAAM,gBAAgB,GACpB,SAAS,CAAC,WAAW,KAAK,WAAW,IAAI,SAAS,CAAC,WAAW,KAAK,cAAc,CAAC;IACpF,IAAI,gBAAgB,IAAI,SAAS,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrE,QAAQ,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,0BAA0B,CAAC,QAAgC;IACzE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,KAAK,GAAa,CAAC,EAAE,EAAE,2CAA2C,EAAE,EAAE,CAAC,CAAC;IAC9E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACrE,KAAK,CAAC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oCAAoC;IAClD,OAAO;QACL,EAAE;QACF,8BAA8B;QAC9B,EAAE;QACF,iMAAiM;QACjM,0HAA0H;QAC1H,kHAAkH;QAClH,EAAE;KACH,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;AAE3F,gGAAgG;AAChG,MAAM,qBAAqB,GAAG;IAC5B,WAAW;IACX,QAAQ;IACR,SAAS;IACT,iBAAiB;IACjB,gBAAgB;CACjB,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAe;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gCAAgC,CAAC,KAAe;IAC9D,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,EAAE;QACF,mCAAmC;QACnC,EAAE;QACF,8GAA8G;QAC9G,wHAAwH;QACxH,yHAAyH;QACzH,EAAE;KACH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iCAAiC,CAAC,KAAe;IAC/D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,OAAO;QACL,EAAE;QACF,2CAA2C;QAC3C,EAAE;QACF,6KAA6K;QAC7K,iKAAiK;QACjK,oJAAoJ;QACpJ,EAAE;KACH,CAAC;AACJ,CAAC"}

package/dist/engine/local-first/crdt-generator.d.ts

@@ -0,0 +1,10 @@
+import type { CrdtLibrary, CrdtCriterion } from '../../types/index.js';
+export type { CrdtCriterion };
+/** Format CRDT criteria as HU.md lines. */
+export declare function formatCrdtCriteriaAsLines(criteria: CrdtCriterion[]): string[];
+/**
+ * Generate CRDT criteria for a project.
+ * Includes base convergence criteria + library-specific conflict resolution.
+ */
+export declare function generateCrdtCriteria(crdtLibrary: CrdtLibrary): CrdtCriterion[];
+//# sourceMappingURL=crdt-generator.d.ts.map

package/dist/engine/local-first/crdt-generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crdt-generator.d.ts","sourceRoot":"","sources":["../../../src/engine/local-first/crdt-generator.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACvE,YAAY,EAAE,aAAa,EAAE,CAAC;AA8D9B,2CAA2C;AAC3C,wBAAgB,yBAAyB,CAAC,QAAQ,EAAE,aAAa,EAAE,GAAG,MAAM,EAAE,CAY7E;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,WAAW,EAAE,WAAW,GAAG,aAAa,EAAE,CAE9E"}

package/dist/engine/local-first/crdt-generator.js

@@ -0,0 +1,77 @@
+// engine/local-first/crdt-generator.ts — SPEC-047
+// Generates CRDT acceptance criteria for create_spec HU.md content.
+/** Base CRDT convergence criteria applicable to all CRDT libraries. */
+function getConvergenceCriteria() {
+    return [
+        {
+            title: 'CRDT Convergence Property',
+            body: 'Las operaciones CRDT son conmutativas, asociativas e idempotentes — dos clientes con los mismos datos deben converger al mismo estado sin importar el orden de operaciones',
+            testable: true,
+        },
+        {
+            title: 'Merge Offline Changes',
+            body: 'El merge de cambios offline funciona correctamente: si usuario A y B editan el mismo documento offline, al sincronizar no hay pérdida de datos',
+            testable: true,
+        },
+        {
+            title: 'Extreme Offline — 72h scenario',
+            body: 'Un usuario puede trabajar 72h offline y sincronizar sin pérdida de datos ni conflictos irresolubles',
+            testable: true,
+        },
+    ];
+}
+/** Conflict resolution criteria based on data type. */
+function getConflictResolutionCriteria(crdtLibrary) {
+    const criteria = [
+        {
+            title: 'Last-Write-Wins Register',
+            body: 'Las operaciones de reemplazo total de documento usan Last-Write-Wins Registers con timestamps lógicos (Hybrid Logical Clocks)',
+            testable: true,
+        },
+        {
+            title: 'Conflict Resolution Documentation',
+            body: 'Los conflictos de tipo último-en-ganar están documentados con timestamps de vector clock, los conflictos estructurales usan merge semántico por tipo de dato',
+            testable: false,
+        },
+    ];
+    if (crdtLibrary === 'yjs') {
+        criteria.push({
+            title: 'Yjs Text — Sequence CRDT',
+            body: 'El texto colaborativo usa Yjs Y.Text (secuencia CRDT) — dos usuarios editando el mismo párrafo producen un merge sin pérdida de caracteres',
+            testable: true,
+        });
+        criteria.push({
+            title: 'Yjs Array — CRDT List',
+            body: 'Las listas de ítems usan Yjs Y.Array — inserción y eliminación concurrente producen resultados deterministas',
+            testable: true,
+        });
+    }
+    if (crdtLibrary === 'automerge') {
+        criteria.push({
+            title: 'Automerge Document Merge',
+            body: 'Las estructuras complejas usan Automerge Document — el merge JSON-CRDT preserva todos los campos editados concurrentemente',
+            testable: true,
+        });
+    }
+    return criteria;
+}
+/** Format CRDT criteria as HU.md lines. */
+export function formatCrdtCriteriaAsLines(criteria) {
+    const lines = ['', '## CRDT & Colaboración', ''];
+    for (const c of criteria) {
+        lines.push(`- [ ] **${c.title}**: ${c.body}`);
+        if (c.testable) {
+            lines.push('  - _Testable con property-based testing: dos clientes aplican operaciones en orden diferente y el estado final debe ser igual_');
+        }
+    }
+    lines.push('');
+    return lines;
+}
+/**
+ * Generate CRDT criteria for a project.
+ * Includes base convergence criteria + library-specific conflict resolution.
+ */
+export function generateCrdtCriteria(crdtLibrary) {
+    return [...getConvergenceCriteria(), ...getConflictResolutionCriteria(crdtLibrary)];
+}
+//# sourceMappingURL=crdt-generator.js.map

package/dist/engine/local-first/crdt-generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crdt-generator.js","sourceRoot":"","sources":["../../../src/engine/local-first/crdt-generator.ts"],"names":[],"mappings":"AAAA,kDAAkD;AAClD,oEAAoE;AAKpE,uEAAuE;AACvE,SAAS,sBAAsB;IAC7B,OAAO;QACL;YACE,KAAK,EAAE,2BAA2B;YAClC,IAAI,EAAE,4KAA4K;YAClL,QAAQ,EAAE,IAAI;SACf;QACD;YACE,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,gJAAgJ;YACtJ,QAAQ,EAAE,IAAI;SACf;QACD;YACE,KAAK,EAAE,gCAAgC;YACvC,IAAI,EAAE,qGAAqG;YAC3G,QAAQ,EAAE,IAAI;SACf;KACF,CAAC;AACJ,CAAC;AAED,uDAAuD;AACvD,SAAS,6BAA6B,CAAC,WAAwB;IAC7D,MAAM,QAAQ,GAAoB;QAChC;YACE,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,+HAA+H;YACrI,QAAQ,EAAE,IAAI;SACf;QACD;YACE,KAAK,EAAE,mCAAmC;YAC1C,IAAI,EAAE,8JAA8J;YACpK,QAAQ,EAAE,KAAK;SAChB;KACF,CAAC;IAEF,IAAI,WAAW,KAAK,KAAK,EAAE,CAAC;QAC1B,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,4IAA4I;YAClJ,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;QACH,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,uBAAuB;YAC9B,IAAI,EAAE,8GAA8G;YACpH,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;QAChC,QAAQ,CAAC,IAAI,CAAC;YACZ,KAAK,EAAE,0BAA0B;YACjC,IAAI,EAAE,4HAA4H;YAClI,QAAQ,EAAE,IAAI;SACf,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,2CAA2C;AAC3C,MAAM,UAAU,yBAAyB,CAAC,QAAyB;IACjE,MAAM,KAAK,GAAa,CAAC,EAAE,EAAE,wBAAwB,EAAE,EAAE,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;YACf,KAAK,CAAC,IAAI,CACR,iIAAiI,CAClI,CAAC;QACJ,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,WAAwB;IAC3D,OAAO,CAAC,GAAG,sBAAsB,EAAE,EAAE,GAAG,6BAA6B,CAAC,WAAW,CAAC,CAAC,CAAC;AACtF,CAAC"}

package/dist/engine/local-first/detector.d.ts

@@ -0,0 +1,7 @@
+import type { LocalFirstDetectionResult } from '../../types/index.js';
+/**
+ * Detect local-first architecture signals in a project.
+ * Returns a LocalFirstDetectionResult with all detected components.
+ */
+export declare function detectLocalFirst(projectPath: string): Promise<LocalFirstDetectionResult>;
+//# sourceMappingURL=detector.d.ts.map

package/dist/engine/local-first/detector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detector.d.ts","sourceRoot":"","sources":["../../../src/engine/local-first/detector.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,yBAAyB,EAI1B,MAAM,sBAAsB,CAAC;AAoP9B;;;GAGG;AACH,wBAAsB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAwB9F"}

package/dist/engine/local-first/detector.js

@@ -0,0 +1,233 @@
+// engine/local-first/detector.ts — SPEC-047
+// Detects CRDT libraries, sync backends, local storage, and offline signals.
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { glob } from 'glob';
+// === CRDT library package names ===
+const CRDT_PACKAGES = new Map([
+    ['yjs', 'yjs'],
+    ['@automerge/automerge', 'automerge'],
+    ['automerge', 'automerge'],
+    ['loro-crdt', 'loro-crdt'],
+    ['diamond-types', 'diamond-types'],
+]);
+// === Sync backend package names ===
+const SYNC_PACKAGES = new Map([
+    ['y-websocket', 'y-websocket'],
+    ['@hocuspocus/server', 'hocuspocus'],
+    ['hocuspocus', 'hocuspocus'],
+    ['@electric-sql/client', 'electric-sql'],
+    ['electric-sql', 'electric-sql'],
+    ['@powersync/service', 'powersync'],
+    ['powersync', 'powersync'],
+    ['@liveblocks/client', 'liveblocks'],
+    ['liveblocks', 'liveblocks'],
+]);
+// === Local storage package names mapped to engine ===
+const STORAGE_PACKAGES = new Map([
+    ['sql.js', 'SQLite-WASM'],
+    ['@sqlite.org/sqlite-wasm', 'SQLite-WASM'],
+    ['wa-sqlite', 'SQLite-WASM'],
+    ['better-sqlite3', 'SQLite-native'],
+    ['sqlite3', 'SQLite-native'],
+    ['react-native-sqlite-storage', 'SQLite-native'],
+    ['expo-sqlite', 'SQLite-native'],
+    ['op-sqlite', 'SQLite-native'],
+    ['leveldb', 'LevelDB'],
+    ['levelup', 'LevelDB'],
+    ['level', 'LevelDB'],
+]);
+// === Offline support signals ===
+const OFFLINE_PACKAGES = ['workbox-core', 'workbox-strategies', 'workbox-routing', 'workbox'];
+const OFFLINE_KEYWORDS = ['offline', 'local-first', 'local_first', 'pwa'];
+const OFFLINE_FILES = ['sw.js', 'service-worker.js', 'sw.ts', 'service-worker.ts'];
+// === IndexedDB signals (browser-native, no npm package) ===
+const INDEXEDDB_PACKAGES = ['idb', 'idb-keyval', 'dexie', 'localforage', 'rxdb', 'pouchdb'];
+// === LevelDB additional packages ===
+const LEVELDB_PACKAGES = ['abstract-level', 'memory-level', 'classic-level'];
+async function readFileOrNull(filePath) {
+    try {
+        return await readFile(filePath, 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+async function readPackageJson(projectPath) {
+    const content = await readFileOrNull(join(projectPath, 'package.json'));
+    if (!content) {
+        return null;
+    }
+    try {
+        const pkg = JSON.parse(content);
+        const all = {
+            ...(pkg.dependencies ?? {}),
+            ...(pkg.devDependencies ?? {}),
+        };
+        return all;
+    }
+    catch {
+        return null;
+    }
+}
+async function readPackageJsonFull(projectPath) {
+    const content = await readFileOrNull(join(projectPath, 'package.json'));
+    if (!content) {
+        return null;
+    }
+    try {
+        const pkg = JSON.parse(content);
+        return {
+            deps: {
+                ...(pkg.dependencies ?? {}),
+                ...(pkg.devDependencies ?? {}),
+            },
+            keywords: pkg.keywords ?? [],
+            description: pkg.description ?? '',
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Detect CRDT library from package.json dependencies. */
+async function detectCrdtLibrary(projectPath) {
+    const deps = await readPackageJson(projectPath);
+    if (!deps) {
+        return null;
+    }
+    for (const [pkg, lib] of CRDT_PACKAGES) {
+        if (pkg in deps) {
+            return lib;
+        }
+    }
+    return null;
+}
+/** Detect sync backend from package.json dependencies. */
+async function detectSyncBackend(projectPath) {
+    const deps = await readPackageJson(projectPath);
+    if (!deps) {
+        return null;
+    }
+    for (const [pkg, backend] of SYNC_PACKAGES) {
+        if (pkg in deps) {
+            return backend;
+        }
+    }
+    return null;
+}
+/** Detect local storage engine from package.json dependencies. */
+async function detectLocalStorageEngine(projectPath) {
+    const deps = await readPackageJson(projectPath);
+    if (!deps) {
+        return null;
+    }
+    // STORAGE_PACKAGES covers SQLite variants and LevelDB
+    for (const [pkg, engine] of STORAGE_PACKAGES) {
+        if (pkg in deps) {
+            return engine;
+        }
+    }
+    // LevelDB alternative packages
+    for (const pkg of LEVELDB_PACKAGES) {
+        if (pkg in deps) {
+            return 'LevelDB';
+        }
+    }
+    // IndexedDB wrapper libraries (browser native engine)
+    for (const pkg of INDEXEDDB_PACKAGES) {
+        if (pkg in deps) {
+            return 'IndexedDB';
+        }
+    }
+    return null;
+}
+/** Detect offline support signals (service workers, workbox, keywords). */
+async function detectOfflineSupport(projectPath) {
+    const pkg = await readPackageJsonFull(projectPath);
+    if (pkg) {
+        // Check workbox packages
+        for (const offlinePkg of OFFLINE_PACKAGES) {
+            if (offlinePkg in pkg.deps) {
+                return true;
+            }
+        }
+        // Check package.json keywords and description
+        const combined = pkg.keywords.join(' ').toLowerCase() + ' ' + pkg.description.toLowerCase();
+        for (const kw of OFFLINE_KEYWORDS) {
+            if (combined.includes(kw)) {
+                return true;
+            }
+        }
+    }
+    // Check for service worker files
+    for (const swFile of OFFLINE_FILES) {
+        const content = await readFileOrNull(join(projectPath, 'public', swFile));
+        if (content !== null) {
+            return true;
+        }
+        const rootContent = await readFileOrNull(join(projectPath, swFile));
+        if (rootContent !== null) {
+            return true;
+        }
+    }
+    // Scan src files for service worker registration
+    try {
+        const files = await glob('**/*.{ts,js}', {
+            cwd: projectPath,
+            nodir: true,
+            maxDepth: 3,
+            ignore: ['node_modules/**', 'dist/**', 'build/**', '.git/**'],
+        });
+        for (const f of files.slice(0, 20)) {
+            const content = await readFileOrNull(join(projectPath, f));
+            if (content?.includes('serviceWorker') || content?.includes('service-worker')) {
+                return true;
+            }
+        }
+    }
+    catch {
+        // ignore
+    }
+    return false;
+}
+/** Collect human-readable signals that triggered detection. */
+function collectSignals(crdtLibrary, syncBackend, localStorageEngine, hasOfflineSupport) {
+    const signals = [];
+    if (crdtLibrary) {
+        signals.push(`CRDT library detected: ${crdtLibrary}`);
+    }
+    if (syncBackend) {
+        signals.push(`Sync backend detected: ${syncBackend}`);
+    }
+    if (localStorageEngine) {
+        signals.push(`Local storage engine detected: ${localStorageEngine}`);
+    }
+    if (hasOfflineSupport) {
+        signals.push('Offline support signals detected (service worker or workbox)');
+    }
+    return signals;
+}
+/**
+ * Detect local-first architecture signals in a project.
+ * Returns a LocalFirstDetectionResult with all detected components.
+ */
+export async function detectLocalFirst(projectPath) {
+    const [crdtLibrary, syncBackend, localStorageEngine, hasOfflineSupport] = await Promise.all([
+        detectCrdtLibrary(projectPath),
+        detectSyncBackend(projectPath),
+        detectLocalStorageEngine(projectPath),
+        detectOfflineSupport(projectPath),
+    ]);
+    const isLocalFirst = crdtLibrary !== null || syncBackend !== null;
+    const localFirstSignals = collectSignals(crdtLibrary, syncBackend, localStorageEngine, hasOfflineSupport);
+    return {
+        isLocalFirst,
+        crdtLibrary,
+        syncBackend,
+        localStorageEngine,
+        hasOfflineSupport,
+        localFirstSignals,
+    };
+}
+//# sourceMappingURL=detector.js.map