@planu/cli 0.91.0 → 0.93.0

package/dist/types/test-reverse-engineer.d.ts

@@ -0,0 +1,32 @@
+export type TestFramework = 'playwright' | 'cypress' | 'jest' | 'unknown';
+export interface GeneratedAc {
+    text: string;
+    group: string;
+    skipped: boolean;
+}
+export interface TestReverseEngineerInput {
+    testFilePath: string;
+    projectPath?: string;
+    createSpec?: boolean;
+}
+/** Internal: maps a line number to its describe group name */
+export interface TestLineInfo {
+    lineNumber: number;
+    groupName: string;
+}
+/** Internal: a single test match extracted from file content */
+export interface TestFileMatch {
+    lineNumber: number;
+    description: string;
+    skipped: boolean;
+}
+export interface TestReverseEngineerResult {
+    detectedFramework: TestFramework;
+    totalTests: number;
+    skipCount: number;
+    generatedAcs: GeneratedAc[];
+    suggestedTitle: string;
+    suggestedTags: string[];
+    specId?: string;
+}
+//# sourceMappingURL=test-reverse-engineer.d.ts.map

package/dist/types/test-reverse-engineer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-reverse-engineer.d.ts","sourceRoot":"","sources":["../../src/types/test-reverse-engineer.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,YAAY,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB;IACxC,iBAAiB,EAAE,aAAa,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,WAAW,EAAE,CAAC;IAC5B,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB"}

package/dist/types/test-reverse-engineer.js

@@ -0,0 +1,3 @@
+// Types for reverse_engineer_tests tool (SPEC-299)
+export {};
+//# sourceMappingURL=test-reverse-engineer.js.map

package/dist/types/test-reverse-engineer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-reverse-engineer.js","sourceRoot":"","sources":["../../src/types/test-reverse-engineer.ts"],"names":[],"mappings":"AAAA,mDAAmD"}

package/dist/types/velocity.d.ts

@@ -0,0 +1,147 @@
+import type { SpecScope, SpecType } from './common/primitives.js';
+/**
+ * A single week's throughput data point.
+ * weekLabel: ISO week string, e.g. "2026-W12"
+ */
+export interface ThroughputPoint {
+    weekLabel: string;
+    weekStart: string;
+    weekEnd: string;
+    specsCompleted: number;
+    specIds: string[];
+}
+/**
+ * Lead time statistics grouped by scope.
+ * Lead time = done timestamp - created timestamp (in hours).
+ */
+export interface LeadTimeStats {
+    avgHours: number;
+    medianHours: number;
+    minHours: number;
+    maxHours: number;
+    /** Number of specs used to compute these stats */
+    sampleSize: number;
+    /** Breakdown by scope */
+    byScope: Record<SpecScope, LeadTimeScopeStats>;
+}
+export interface LeadTimeScopeStats {
+    avgHours: number;
+    sampleSize: number;
+}
+/**
+ * Cycle time statistics.
+ * Cycle time = done timestamp - implementing timestamp (in hours).
+ */
+export interface CycleTimeStats {
+    avgHours: number;
+    medianHours: number;
+    sampleSize: number;
+}
+/**
+ * A single burndown data point for one week.
+ */
+export interface BurndownPoint {
+    weekLabel: string;
+    weekStart: string;
+    weekEnd: string;
+    /** Specs completed (done) up to and including this week */
+    completedCumulative: number;
+    /** Specs completed in this specific week */
+    completedThisWeek: number;
+    /** Specs created up to and including this week */
+    createdCumulative: number;
+    /** Backlog: total created - total completed */
+    backlog: number;
+}
+/**
+ * Flow efficiency: time spent in active states vs total lead time.
+ */
+export interface FlowEfficiencyStats {
+    /** 0.0-1.0 ratio of active time to total time */
+    efficiency: number;
+    /** Average hours spent in active states (implementing, review) */
+    avgActiveHours: number;
+    /** Average total lead time hours */
+    avgTotalHours: number;
+    sampleSize: number;
+}
+/**
+ * WIP (Work In Progress) snapshot.
+ */
+export interface WipSnapshot {
+    current: number;
+    specIds: string[];
+    avgAgeHours: number;
+}
+/**
+ * Full velocity report for a project.
+ */
+export interface VelocityReport {
+    projectId: string;
+    projectPath: string;
+    generatedAt: string;
+    /** Number of weeks analyzed */
+    weeks: number;
+    /** Applied filters */
+    filters: VelocityFilters;
+    /** Average specs completed per week */
+    avgThroughputPerWeek: number;
+    throughput: ThroughputPoint[];
+    leadTime: LeadTimeStats | null;
+    cycleTime: CycleTimeStats | null;
+    wip: WipSnapshot;
+    flowEfficiency: FlowEfficiencyStats | null;
+    burndown: BurndownPoint[];
+    /** Human-readable summary line */
+    summary: string;
+    /** Total specs done in the period */
+    totalDone: number;
+    /** Total specs in the project */
+    totalSpecs: number;
+}
+/**
+ * Trend comparison: last N weeks vs previous N weeks.
+ */
+export interface VelocityTrend {
+    projectId: string;
+    projectPath: string;
+    generatedAt: string;
+    compareWeeks: number;
+    recent: VelocityPeriodStats;
+    previous: VelocityPeriodStats;
+    throughputDelta: number;
+    leadTimeDelta: number | null;
+    trend: 'improving' | 'stable' | 'declining';
+    summary: string;
+}
+export interface VelocityPeriodStats {
+    label: string;
+    fromDate: string;
+    toDate: string;
+    avgThroughputPerWeek: number;
+    avgLeadTimeHours: number | null;
+    totalDone: number;
+}
+/**
+ * Input filters for velocity tools.
+ */
+export interface VelocityFilters {
+    weeks: number;
+    scope?: SpecScope;
+    type?: SpecType;
+}
+/** Input args for velocity_report tool */
+export interface VelocityReportInput {
+    projectPath: string;
+    weeks?: number;
+    scope?: SpecScope;
+    type?: SpecType;
+}
+/** Input args for velocity_trend tool */
+export interface VelocityTrendInput {
+    projectPath: string;
+    compareWeeks?: number;
+    scope?: SpecScope;
+    type?: SpecType;
+}
+//# sourceMappingURL=velocity.d.ts.map

package/dist/types/velocity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"velocity.d.ts","sourceRoot":"","sources":["../../src/types/velocity.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,wBAAwB,CAAC;AAElE;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,kDAAkD;IAClD,UAAU,EAAE,MAAM,CAAC;IACnB,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,2DAA2D;IAC3D,mBAAmB,EAAE,MAAM,CAAC;IAC5B,4CAA4C;IAC5C,iBAAiB,EAAE,MAAM,CAAC;IAC1B,kDAAkD;IAClD,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,iDAAiD;IACjD,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,cAAc,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB;IACtB,OAAO,EAAE,eAAe,CAAC;IACzB,uCAAuC;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,UAAU,EAAE,eAAe,EAAE,CAAC;IAC9B,QAAQ,EAAE,aAAa,GAAG,IAAI,CAAC;IAC/B,SAAS,EAAE,cAAc,GAAG,IAAI,CAAC;IACjC,GAAG,EAAE,WAAW,CAAC;IACjB,cAAc,EAAE,mBAAmB,GAAG,IAAI,CAAC;IAC3C,QAAQ,EAAE,aAAa,EAAE,CAAC;IAC1B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,iCAAiC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,mBAAmB,CAAC;IAC5B,QAAQ,EAAE,mBAAmB,CAAC;IAC9B,eAAe,EAAE,MAAM,CAAC;IACxB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,KAAK,EAAE,WAAW,GAAG,QAAQ,GAAG,WAAW,CAAC;IAC5C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,0CAA0C;AAC1C,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB;AAED,yCAAyC;AACzC,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,IAAI,CAAC,EAAE,QAAQ,CAAC;CACjB"}

package/dist/types/velocity.js

@@ -0,0 +1,4 @@
+// types/velocity.ts — Velocity metrics domain types (SPEC-288)
+// Lead Time, Throughput, Burndown, Cycle Time, WIP, Flow Efficiency
+export {};
+//# sourceMappingURL=velocity.js.map

package/dist/types/velocity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"velocity.js","sourceRoot":"","sources":["../../src/types/velocity.ts"],"names":[],"mappings":"AAAA,+DAA+D;AAC/D,oEAAoE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@planu/cli",
-  "version": "0.91.0",
+  "version": "0.93.0",
   "description": "Planu — MCP Server for Spec Driven Development. Manages specs, estimations, reverse engineering, and auto-learning across any language/framework.",
   "type": "module",
   "main": "dist/index.js",

package/src/config/domain-best-practices.json

@@ -0,0 +1,413 @@
+[
+  {
+    "id": "payments-idempotency-key",
+    "domain": "payments",
+    "label": "Idempotency key on payment requests",
+    "criterion": "Payment requests include an idempotency key to prevent duplicate charges on retries",
+    "critical": true,
+    "coverageKeywords": ["idempotency", "idempotent", "duplicate charge", "idempotency key"]
+  },
+  {
+    "id": "payments-retry-network-failure",
+    "domain": "payments",
+    "label": "Retry on network failure",
+    "criterion": "Failed payment requests due to network errors are retried with exponential back-off (max 3 retries)",
+    "critical": true,
+    "coverageKeywords": ["retry", "retries", "back-off", "backoff", "exponential", "network failure", "network error"]
+  },
+  {
+    "id": "payments-transaction-log",
+    "domain": "payments",
+    "label": "Transaction log",
+    "criterion": "Every payment attempt (success or failure) is recorded in an immutable transaction log with timestamp, amount, status, and provider reference",
+    "critical": true,
+    "coverageKeywords": ["transaction log", "audit log", "payment log", "immutable log", "payment record"]
+  },
+  {
+    "id": "payments-webhook-confirmation",
+    "domain": "payments",
+    "label": "Webhook confirmation",
+    "criterion": "Payment status is confirmed via provider webhook (not just API response) to handle async settlement",
+    "critical": false,
+    "coverageKeywords": ["webhook", "ipn", "callback", "async settlement", "payment notification"]
+  },
+  {
+    "id": "payments-refund-flow",
+    "domain": "payments",
+    "label": "Refund flow",
+    "criterion": "Refund flow is defined: who can trigger it, under which conditions, and how the ledger is updated",
+    "critical": false,
+    "coverageKeywords": ["refund", "chargeback", "reversal", "return payment"]
+  },
+  {
+    "id": "authentication-brute-force",
+    "domain": "authentication",
+    "label": "Brute force protection",
+    "criterion": "Login endpoint enforces rate limiting and account lockout after 5 consecutive failures",
+    "critical": true,
+    "coverageKeywords": [
+      "brute force",
+      "rate limit",
+      "account lockout",
+      "login throttle",
+      "failed attempts",
+      "max attempts"
+    ]
+  },
+  {
+    "id": "authentication-token-expiry",
+    "domain": "authentication",
+    "label": "Token expiry",
+    "criterion": "Access tokens have a defined expiry (max 1 hour); long-lived sessions use refresh tokens",
+    "critical": true,
+    "coverageKeywords": ["token expiry", "token expiration", "expires", "ttl", "access token lifetime", "short-lived"]
+  },
+  {
+    "id": "authentication-refresh-rotation",
+    "domain": "authentication",
+    "label": "Refresh token rotation",
+    "criterion": "Refresh tokens are rotated on each use (one-time use) to detect token theft",
+    "critical": false,
+    "coverageKeywords": ["refresh token rotation", "token rotation", "rotate refresh", "one-time refresh"]
+  },
+  {
+    "id": "authentication-logout-all",
+    "domain": "authentication",
+    "label": "Logout all devices",
+    "criterion": "Users can invalidate all active sessions from any device (global logout)",
+    "critical": false,
+    "coverageKeywords": ["logout all", "revoke all", "global logout", "invalidate sessions", "sign out everywhere"]
+  },
+  {
+    "id": "authorization-least-privilege",
+    "domain": "authorization",
+    "label": "Least privilege principle",
+    "criterion": "Each role is granted only the minimum permissions needed; no wildcard permissions",
+    "critical": true,
+    "coverageKeywords": [
+      "least privilege",
+      "minimum permissions",
+      "principle of least",
+      "no wildcard",
+      "scoped permissions"
+    ]
+  },
+  {
+    "id": "authorization-permission-check",
+    "domain": "authorization",
+    "label": "Server-side permission check",
+    "criterion": "Every protected action performs a server-side authorization check (not just UI guard)",
+    "critical": true,
+    "coverageKeywords": ["server-side auth", "authorization check", "rbac check", "permission check", "access control"]
+  },
+  {
+    "id": "authorization-audit-log",
+    "domain": "authorization",
+    "label": "Authorization audit log",
+    "criterion": "Permission grants and revocations are logged with actor, timestamp, and reason",
+    "critical": false,
+    "coverageKeywords": ["authorization log", "permission log", "audit trail", "role change log"]
+  },
+  {
+    "id": "file-upload-max-size",
+    "domain": "file-upload",
+    "label": "Max file size validation",
+    "criterion": "Uploaded files are rejected if they exceed the defined maximum size (enforce server-side, not just client-side)",
+    "critical": true,
+    "coverageKeywords": ["max size", "file size limit", "size limit", "maximum file size", "too large"]
+  },
+  {
+    "id": "file-upload-mime-type",
+    "domain": "file-upload",
+    "label": "MIME type validation",
+    "criterion": "File MIME type is validated server-side (magic bytes check, not just extension or Content-Type header)",
+    "critical": true,
+    "coverageKeywords": ["mime type", "file type", "magic bytes", "content type validation", "allowed types"]
+  },
+  {
+    "id": "file-upload-virus-scan",
+    "domain": "file-upload",
+    "label": "Virus scan mention",
+    "criterion": "Files are scanned for malware before being served or processed (or this requirement is explicitly deferred with justification)",
+    "critical": false,
+    "coverageKeywords": ["virus scan", "malware scan", "antivirus", "clamav", "file scan"]
+  },
+  {
+    "id": "file-upload-quota",
+    "domain": "file-upload",
+    "label": "Storage quota per user",
+    "criterion": "Per-user or per-tenant storage quota is enforced; uploads beyond quota are rejected with a clear error",
+    "critical": false,
+    "coverageKeywords": ["quota", "storage limit", "storage quota", "disk limit", "user quota"]
+  },
+  {
+    "id": "email-unsubscribe",
+    "domain": "email",
+    "label": "Unsubscribe link",
+    "criterion": "All marketing/notification emails include a one-click unsubscribe link compliant with CAN-SPAM/GDPR",
+    "critical": true,
+    "coverageKeywords": ["unsubscribe", "opt-out", "can-spam", "email opt out"]
+  },
+  {
+    "id": "email-bounce-handling",
+    "domain": "email",
+    "label": "Bounce handling",
+    "criterion": "Hard bounces are automatically suppressed from future sends; soft bounces are retried with back-off",
+    "critical": false,
+    "coverageKeywords": ["bounce", "hard bounce", "soft bounce", "email suppression", "bounce handling"]
+  },
+  {
+    "id": "email-delivery-tracking",
+    "domain": "email",
+    "label": "Delivery tracking",
+    "criterion": "Email delivery status (sent, delivered, opened, bounced) is tracked and stored for debugging",
+    "critical": false,
+    "coverageKeywords": ["delivery tracking", "email tracking", "open rate", "delivery status", "email logs"]
+  },
+  {
+    "id": "notifications-deduplication",
+    "domain": "notifications",
+    "label": "Notification deduplication",
+    "criterion": "Duplicate notifications (same event, same user within a time window) are suppressed",
+    "critical": false,
+    "coverageKeywords": ["deduplication", "duplicate notification", "notification throttle", "suppress duplicate"]
+  },
+  {
+    "id": "notifications-delivery-retry",
+    "domain": "notifications",
+    "label": "Delivery retry",
+    "criterion": "Failed notification deliveries are retried with exponential back-off and a dead-letter queue",
+    "critical": false,
+    "coverageKeywords": ["retry", "dead letter", "dlq", "notification retry", "failed delivery"]
+  },
+  {
+    "id": "notifications-user-preferences",
+    "domain": "notifications",
+    "label": "User notification preferences",
+    "criterion": "Users can configure which notification types they receive (granular opt-in/opt-out per channel)",
+    "critical": false,
+    "coverageKeywords": ["notification preferences", "opt-in", "user preferences", "notification settings", "mute"]
+  },
+  {
+    "id": "search-empty-state",
+    "domain": "search",
+    "label": "Empty state handling",
+    "criterion": "Search returns a graceful empty state (not an error) when no results are found, with helpful suggestions",
+    "critical": false,
+    "coverageKeywords": ["empty state", "no results", "zero results", "empty search"]
+  },
+  {
+    "id": "search-typo-tolerance",
+    "domain": "search",
+    "label": "Typo tolerance / fuzzy match",
+    "criterion": "Search handles common typos and minor spelling variations (fuzzy matching or synonym support)",
+    "critical": false,
+    "coverageKeywords": ["fuzzy", "typo", "fuzzy match", "typo tolerance", "spell correction", "synonym"]
+  },
+  {
+    "id": "search-pagination",
+    "domain": "search",
+    "label": "Pagination / cursor",
+    "criterion": "Search results are paginated with a stable cursor or offset to avoid duplicates on page boundaries",
+    "critical": true,
+    "coverageKeywords": ["pagination", "page", "cursor", "offset", "next page", "load more"]
+  },
+  {
+    "id": "mobile-offline-sync",
+    "domain": "mobile-offline",
+    "label": "Offline sync conflict resolution",
+    "criterion": "Conflicts arising from offline edits are resolved with a defined strategy (last-write-wins, merge, or user prompt)",
+    "critical": true,
+    "coverageKeywords": ["conflict", "sync conflict", "offline sync", "merge conflict", "last write wins"]
+  },
+  {
+    "id": "mobile-offline-queue",
+    "domain": "mobile-offline",
+    "label": "Offline action queue",
+    "criterion": "Actions performed while offline are queued locally and replayed in order when connectivity is restored",
+    "critical": true,
+    "coverageKeywords": ["offline queue", "action queue", "replay", "offline action", "sync queue"]
+  },
+  {
+    "id": "mobile-offline-indicator",
+    "domain": "mobile-offline",
+    "label": "Offline indicator",
+    "criterion": "Users are clearly informed when the app is operating in offline mode",
+    "critical": false,
+    "coverageKeywords": ["offline indicator", "offline mode", "no connectivity", "connection lost", "offline banner"]
+  },
+  {
+    "id": "realtime-reconnect",
+    "domain": "realtime",
+    "label": "Auto-reconnect on disconnect",
+    "criterion": "Clients automatically reconnect with exponential back-off when the realtime connection drops",
+    "critical": true,
+    "coverageKeywords": ["reconnect", "auto-reconnect", "reconnection", "connection drop", "websocket reconnect"]
+  },
+  {
+    "id": "realtime-backpressure",
+    "domain": "realtime",
+    "label": "Backpressure handling",
+    "criterion": "Server-side message queues have a defined capacity limit; slow clients are disconnected or their messages are dropped with a warning",
+    "critical": false,
+    "coverageKeywords": ["backpressure", "back pressure", "slow consumer", "message queue limit", "buffer limit"]
+  },
+  {
+    "id": "realtime-auth",
+    "domain": "realtime",
+    "label": "Realtime channel authorization",
+    "criterion": "Each realtime channel/room enforces authorization; users cannot subscribe to channels they are not permitted to access",
+    "critical": true,
+    "coverageKeywords": ["channel auth", "room auth", "channel permission", "subscribe permission", "realtime auth"]
+  },
+  {
+    "id": "background-jobs-idempotency",
+    "domain": "background-jobs",
+    "label": "Job idempotency",
+    "criterion": "Background jobs are idempotent — running the same job twice produces the same outcome",
+    "critical": true,
+    "coverageKeywords": ["idempotent job", "job idempotency", "safe retry", "idempotent task"]
+  },
+  {
+    "id": "background-jobs-dead-letter",
+    "domain": "background-jobs",
+    "label": "Dead-letter queue",
+    "criterion": "Jobs that fail after max retries are moved to a dead-letter queue for inspection and manual replay",
+    "critical": false,
+    "coverageKeywords": ["dead letter", "dlq", "failed jobs", "job failure queue", "poison message"]
+  },
+  {
+    "id": "background-jobs-monitoring",
+    "domain": "background-jobs",
+    "label": "Job monitoring and alerting",
+    "criterion": "Job failures and queue depth metrics are monitored; alerts are sent when error rate exceeds threshold",
+    "critical": false,
+    "coverageKeywords": ["job monitoring", "queue monitoring", "job alert", "job metrics", "queue depth"]
+  },
+  {
+    "id": "api-public-versioning",
+    "domain": "api-public",
+    "label": "API versioning",
+    "criterion": "The public API uses explicit versioning (e.g. /v1/) and maintains backward compatibility within a version",
+    "critical": true,
+    "coverageKeywords": ["api versioning", "v1", "v2", "api version", "backward compatible", "versioned api"]
+  },
+  {
+    "id": "api-public-rate-limiting",
+    "domain": "api-public",
+    "label": "Rate limiting",
+    "criterion": "The public API enforces per-client rate limits with standard 429 responses and Retry-After headers",
+    "critical": true,
+    "coverageKeywords": ["rate limit", "rate limiting", "429", "retry-after", "throttle", "api quota"]
+  },
+  {
+    "id": "api-public-auth",
+    "domain": "api-public",
+    "label": "API key / token authentication",
+    "criterion": "Every public API endpoint requires authentication via API key or OAuth token; unauthenticated requests return 401",
+    "critical": true,
+    "coverageKeywords": ["api key", "api token", "oauth", "bearer token", "api authentication", "401"]
+  },
+  {
+    "id": "api-public-openapi",
+    "domain": "api-public",
+    "label": "OpenAPI documentation",
+    "criterion": "API is documented with an OpenAPI 3.x spec; documentation is kept in sync with implementation",
+    "critical": false,
+    "coverageKeywords": ["openapi", "swagger", "api documentation", "api spec", "api docs"]
+  },
+  {
+    "id": "data-export-format",
+    "domain": "data-export",
+    "label": "Standard export formats",
+    "criterion": "Data is exportable in at least one standard format (CSV, JSON, or XLSX) that users can open without special software",
+    "critical": true,
+    "coverageKeywords": ["csv", "json export", "xlsx", "export format", "download format"]
+  },
+  {
+    "id": "data-export-async",
+    "domain": "data-export",
+    "label": "Async export for large datasets",
+    "criterion": "Exports of large datasets are processed asynchronously; users receive a download link when the export is ready",
+    "critical": false,
+    "coverageKeywords": ["async export", "background export", "export job", "download link", "export notification"]
+  },
+  {
+    "id": "data-export-pii-redaction",
+    "domain": "data-export",
+    "label": "PII redaction option",
+    "criterion": "Exports intended for non-admin users have a PII redaction option to prevent inadvertent data leaks",
+    "critical": false,
+    "coverageKeywords": ["pii redaction", "redact pii", "anonymize export", "data masking", "privacy export"]
+  },
+  {
+    "id": "multi-tenant-isolation",
+    "domain": "multi-tenant",
+    "label": "Tenant data isolation",
+    "criterion": "Tenant data is strictly isolated at the database level (row-level security or separate schemas); cross-tenant access is impossible by default",
+    "critical": true,
+    "coverageKeywords": [
+      "tenant isolation",
+      "data isolation",
+      "row-level security",
+      "rls",
+      "cross-tenant",
+      "tenant boundary"
+    ]
+  },
+  {
+    "id": "multi-tenant-rate-limiting",
+    "domain": "multi-tenant",
+    "label": "Per-tenant rate limiting",
+    "criterion": "Rate limits and resource quotas are enforced per tenant to prevent noisy-neighbor effects",
+    "critical": false,
+    "coverageKeywords": ["tenant rate limit", "per-tenant", "noisy neighbor", "tenant quota", "tenant throttle"]
+  },
+  {
+    "id": "multi-tenant-onboarding",
+    "domain": "multi-tenant",
+    "label": "Tenant provisioning flow",
+    "criterion": "Tenant onboarding flow is defined: how new tenants are created, their initial configuration, and admin assignment",
+    "critical": false,
+    "coverageKeywords": ["tenant onboarding", "tenant provisioning", "new tenant", "tenant setup", "tenant creation"]
+  },
+  {
+    "id": "gdpr-consent-tracking",
+    "domain": "gdpr",
+    "label": "Consent tracking",
+    "criterion": "User consent for data processing is explicitly captured, stored with timestamp, and can be withdrawn at any time",
+    "critical": true,
+    "coverageKeywords": ["consent", "consent tracking", "user consent", "gdpr consent", "data processing consent"]
+  },
+  {
+    "id": "gdpr-right-to-erasure",
+    "domain": "gdpr",
+    "label": "Right to erasure (right to be forgotten)",
+    "criterion": "Users can request deletion of all their personal data; deletion propagates to backups within 30 days",
+    "critical": true,
+    "coverageKeywords": [
+      "right to erasure",
+      "right to be forgotten",
+      "data deletion",
+      "delete account",
+      "erase data",
+      "gdpr delete"
+    ]
+  },
+  {
+    "id": "gdpr-data-export",
+    "domain": "gdpr",
+    "label": "Data portability / export",
+    "criterion": "Users can export all their personal data in a machine-readable format (GDPR Article 20)",
+    "critical": true,
+    "coverageKeywords": ["data portability", "data export", "download my data", "gdpr export", "article 20"]
+  },
+  {
+    "id": "gdpr-retention-policy",
+    "domain": "gdpr",
+    "label": "Data retention policy",
+    "criterion": "A data retention policy is defined: how long each data category is kept and what happens on expiry (deletion or anonymization)",
+    "critical": false,
+    "coverageKeywords": ["retention policy", "data retention", "data expiry", "retention period", "auto-delete"]
+  }
+]

package/src/config/ide-registry.json

@@ -199,6 +199,31 @@
       },
       "serverKey": "mcpServers",
       "wrapperKey": "mcpServers"
+    },
+    {
+      "id": "opencode",
+      "name": "OpenCode",
+      "configPath": {
+        "darwin": "opencode.json",
+        "win32": "opencode.json",
+        "linux": "opencode.json"
+      },
+      "globalConfigPath": {
+        "darwin": "~/.config/opencode/opencode.json",
+        "win32": "~/.config/opencode/opencode.json",
+        "linux": "~/.config/opencode/opencode.json"
+      },
+      "configFormat": "json",
+      "mcpSupport": "native",
+      "docsUrl": "https://opencode.ai/docs/mcp-servers/",
+      "binaryNames": ["opencode"],
+      "configDirs": {
+        "darwin": [".opencode"],
+        "win32": [".opencode"],
+        "linux": [".opencode"]
+      },
+      "serverKey": "mcp",
+      "wrapperKey": "mcp"
     }
   ]
 }