@planu/cli 4.11.0 → 4.11.2

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [4.11.2] - 2026-07-10
+
+### Bug Fixes
+- fix(specs): ground lifecycle output and adopt TypeScript 7
+
+### Chores
+- chore(deps): update patch dependencies
+
+
+## [4.11.1] - 2026-07-09
+
+### Bug Fixes
+- fix: benchmark representative graph sources
+- fix: verify release lockfile with pinned pnpm
+
+
 ## [4.11.0] - 2026-07-09
 
 ### Features

package/dist/engine/cascade-hooks/registry.js

@@ -9,7 +9,6 @@ import { gitAutoStageHook } from './hooks/git-auto-stage.hook.js';
 import { velocityProfileHook } from './hooks/velocity-profile.hook.js';
 import { estimateCalibrationHook } from './hooks/estimate-calibration.hook.js';
 import { lessonDriftHook } from './hooks/lesson-drift.hook.js';
-import { livingSpecsHook } from './hooks/living-specs.hook.js';
 import { nextSpecResolverHook } from './hooks/next-spec-resolver.hook.js';
 import { orchestrationPlanHook } from './hooks/orchestration-plan.hook.js';
 import { completeLoopHook } from './hooks/complete-loop.hook.js';
@@ -38,7 +37,6 @@ export const HOOKS = Object.freeze([
     velocityProfileHook,
     estimateCalibrationHook,
     lessonDriftHook,
-    livingSpecsHook,
     nextSpecResolverHook,
     orchestrationPlanHook,
     completeLoopHook,

package/dist/engine/challenge-scenarios-loader.d.ts

@@ -6,15 +6,15 @@ export declare const ChallengeScenarioPatternSchema: z.ZodObject<{
     triggerKeywords: z.ZodArray<z.ZodString>;
     scenario: z.ZodString;
     probability: z.ZodEnum<{
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
     }>;
     impact: z.ZodEnum<{
+        critical: "critical";
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
-        critical: "critical";
     }>;
     handlingKeywords: z.ZodArray<z.ZodString>;
     handlingFound: z.ZodString;

package/dist/engine/compliance-injector.d.ts

@@ -5,11 +5,11 @@ export declare const ComplianceFrameworkDefSchema: z.ZodObject<{
     name: z.ZodString;
     fullName: z.ZodString;
     type: z.ZodEnum<{
-        security: "security";
-        testing: "testing";
-        quality: "quality";
         accessibility: "accessibility";
         privacy: "privacy";
+        quality: "quality";
+        security: "security";
+        testing: "testing";
     }>;
     regions: z.ZodArray<z.ZodString>;
     triggerKeywords: z.ZodArray<z.ZodString>;

package/dist/engine/dashboard/kanban-logic.d.ts

@@ -1,6 +1,6 @@
 import type { DashboardMetrics, DashboardSpecCard, ProjectHealthScore, SpecStatusUpdateResult, StatusTransitionMap } from '../../types/index.js';
 /** Ordered list of valid spec statuses */
-export declare const VALID_STATUSES: readonly ["draft", "review", "approved", "implementing", "done", "discarded"];
+export declare const VALID_STATUSES: readonly ['draft', 'review', 'approved', 'implementing', 'done', 'discarded'];
 /** Valid forward + one-step-back transitions */
 export declare const STATUS_TRANSITIONS: StatusTransitionMap;
 /** Check if a status string is a valid spec status */

package/dist/engine/doc-generator/portal/risk-matrix-svg.d.ts

@@ -1,5 +1,5 @@
 import type { SpecRisk, RiskCategory } from '../../../types/risk.js';
-declare const IMPACT_LEVELS: readonly ["low", "medium", "high", "very_high", "critical"];
+declare const IMPACT_LEVELS: readonly ['low', 'medium', 'high', 'very_high', 'critical'];
 declare const PROB_LEVELS: readonly [20, 40, 60, 80, 100];
 declare const CATEGORY_COLORS: Record<RiskCategory, string>;
 /**

package/dist/engine/doc-generator/proposal/proposal-generator.d.ts

@@ -1,6 +1,6 @@
 import type { ProposalData } from '../../../types/docs.js';
 /** Canonical section IDs for includeSections / excludeSections filtering. */
-export declare const SECTION_IDS: readonly ["hero", "executive-summary", "scope", "spec-breakdown", "timeline", "budget", "investment-summary", "architecture", "risk", "decisions", "impact-analysis", "gap-analysis", "team-resources", "pricing-methodology", "design-system", "quality-metrics", "living-spec", "assumptions", "alternatives", "post-launch", "module-mapping"];
+export declare const SECTION_IDS: readonly ['hero', 'executive-summary', 'scope', 'spec-breakdown', 'timeline', 'budget', 'investment-summary', 'architecture', 'risk', 'decisions', 'impact-analysis', 'gap-analysis', 'team-resources', 'pricing-methodology', 'design-system', 'quality-metrics', 'living-spec', 'assumptions', 'alternatives', 'post-launch', 'module-mapping'];
 /**
  * Generate a self-contained HTML proposal document.
  * All sections are conditional — empty string returned when data is insufficient.

package/dist/engine/elicitation/answer-extractor.d.ts

@@ -1,7 +1,4 @@
 import type { DescriptionSignals } from '../../types/index.js';
-/**
- * Scan a feature description for pre-existing answers.
- * Any signal set to true means the corresponding question can be suppressed.
- */
+/** Scan a feature description for explicit, affirmed request evidence. */
 export declare function extractSignals(description: string): DescriptionSignals;
 //# sourceMappingURL=answer-extractor.d.ts.map

package/dist/engine/elicitation/answer-extractor.js

@@ -1,96 +1,225 @@
 // src/engine/elicitation/answer-extractor.ts
-// SPEC-624: Extracts pre-existing answers from description to suppress redundant questions.
-const FRONTEND_TERMS = /\b(component|ui|page|css|style|layout|form|button|modal|dialog)\b/;
-const BACKEND_TERMS = /\b(api|endpoint|route|handler|migration|query|rpc|action|middleware)\b/;
-const INFRA_TERMS = /\b(deploy|ci|cd|docker|pipeline|config|env)\b/;
-const BILLING_TERMS = /\b(payment|billing|invoice|subscription|checkout|pricing|pay)\b/;
-const DATABASE_TERMS = /\b(database|schema|migration|table|query|sql|rls|rpc|persist|persistence|data access)\b/;
-const ACTION_RE = /\b(add|build|create|fix|update|remove|delete|integrate|sync|import|export|approve|reject|upload|download|migrate|configure|validate)\b\s+(?:(?:a|an|the|new)\s+)?([a-z0-9][a-z0-9 -]{1,60})/i;
-const ACTOR_TERMS = /\b(admin|administrator|manager|owner|customer|user|member|team|approver)\b/gi;
-const DATA_OBJECT_TERMS = /\b(account|profile|request|invoice|subscription|payment|order|report|file|avatar|table|policy|record|settings)\b/gi;
-const PERMISSION_TERMS = /\b(approval|approve|reject|admin|permission|role|rls|policy|access|auth|login|oauth|owner|manager)\b/;
-const DESTRUCTIVE_TERMS = /\b(delete|remove|archive|discard|drop|truncate|revoke|reset)\b/;
-const RISK_TERMS = /\b(approval|approve|payment|billing|auth|login|permission|role|delete|remove|migration|sync|webhook|external|api|rls|privacy|security)\b/gi;
-const PAYMENT_PROVIDERS = [
-    { name: 'Stripe', pattern: /\bstripe\b/ },
-    { name: 'PayPal', pattern: /\bpaypal\b/ },
-    { name: 'Paddle', pattern: /\bpaddle\b/ },
-    { name: 'Braintree', pattern: /\bbraintree\b/ },
-    { name: 'Square', pattern: /\bsquare\b/ },
-    { name: 'Adyen', pattern: /\badyen\b/ },
+// SPEC-624 / SPEC-1121: Extracts affirmed request evidence for contextual questions.
+const UI_TARGET_PATTERN = /\b(component|ui|page|css|style|layout|form|button|modal|dialog)\b/i;
+const TARGET_TERMS = [
+    ['frontend', UI_TARGET_PATTERN],
+    ['backend', /\b(endpoint|route|handler|middleware|controller|server action)\b/i],
+    [
+        'tooling',
+        /\b(compiler|typecheck|toolchain|typescript|build script|package alias|dependency|release guard)\b/i,
+    ],
+    ['infrastructure', /\b(deploy|ci|cd|docker|pipeline|configuration|environment)\b/i],
 ];
-/**
- * Scan a feature description for pre-existing answers.
- * Any signal set to true means the corresponding question can be suppressed.
- */
+const BILLING_TERMS = [
+    ['payment', /\bpayments?\b/i],
+    ['billing', /\bbilling\b/i],
+    ['invoice', /\binvoices?\b/i],
+    ['subscription', /\bsubscriptions?\b/i],
+    ['checkout', /\bcheckout\b/i],
+    ['pricing', /\bpricing\b/i],
+];
+const DATABASE_TERMS = [
+    ['database', /\bdatabases?\b/i],
+    ['schema', /\bschemas?\b/i],
+    ['table', /\btables?\b/i],
+    ['sql', /\bsql\b/i],
+    ['rls', /\brls\b/i],
+    ['persistence', /\b(?:persist|persists|persisted|persistence|data access)\b/i],
+    ['data-migration', /\b(?:database|schema|table)\s+migrations?\b|\bmigrate\s+(?:a\s+)?table\b/i],
+];
+const ACTOR_TERMS = [
+    ['admin', /\b(?:admin|administrator)\b/i],
+    ['manager', /\bmanager\b/i],
+    ['owner', /\bowner\b/i],
+    ['customer', /\bcustomer\b/i],
+    ['user', /\buser\b/i],
+    ['member', /\bmember\b/i],
+    ['team', /\bteam\b/i],
+    ['approver', /\bapprover\b/i],
+];
+const DATA_OBJECT_TERMS = [
+    ['account', /\baccounts?\b/i],
+    ['profile', /\bprofiles?\b/i],
+    ['request', /\brequests?\b/i],
+    ['invoice', /\binvoices?\b/i],
+    ['subscription', /\bsubscriptions?\b/i],
+    ['payment', /\bpayments?\b/i],
+    ['order', /\borders?\b/i],
+    ['report', /\breports?\b/i],
+    ['file', /\bfiles?\b/i],
+    ['avatar', /\bavatars?\b/i],
+    ['table', /\btables?\b/i],
+    ['policy', /\bpolic(?:y|ies)\b/i],
+    ['record', /\brecords?\b/i],
+    ['settings', /\bsettings\b/i],
+];
+const PERMISSION_TERMS = [
+    ['approval', /\b(?:approval|approve|approves|reject|rejects)\b/i],
+    ['authorization', /\b(?:authorization|permission|role|rbac|access control)\b/i],
+    ['authentication', /\b(?:auth|authentication|login|oauth)\b/i],
+    ['ownership', /\b(?:owner|allowed to|who can)\b/i],
+];
+const DESTRUCTIVE_TERMS = [
+    ['delete', /\b(?:delete|remove|archive|discard|drop|truncate|revoke|reset)\b/i],
+];
+const RISK_TERMS = [
+    ...BILLING_TERMS,
+    ...PERMISSION_TERMS,
+    ['delete', /\b(?:delete|remove|archive|discard|drop|truncate|revoke|reset)\b/i],
+    ['sync', /\bsync(?:hronize)?\b/i],
+    ['webhook', /\bwebhooks?\b/i],
+    ['external', /\b(?:external|third-party|remote)\b/i],
+    ['privacy', /\bprivacy\b/i],
+    ['security', /\bsecurity\b/i],
+];
+const ACTION_RE = /\b(add|adopt|build|create|fix|update|upgrade|replace|remove|delete|integrate|sync|import|export|approve|reject|upload|download|migrate|configure|validate|verify|retain|preserve)\b\s+(?:(?:a|an|the|new)\s+)?([a-z0-9][a-z0-9 -]{1,60})/i;
+const NEGATION_RE = /\b(?:no|not|never|without|exclude|excludes|excluding|neither|nor|do not|does not|don't|doesn't|must not|should not|isn't|aren't|non-goal)\b|\bout[- ]of[- ]scope\b/i;
+const EXAMPLE_RE = /\b(?:example|examples|for example|e\.g\.|such as)\b/i;
+const TEST_PROSE_RE = /\b(?:test|tests|tested|testing|fixture|fixtures|assert|assertion|coverage|regression)\b/i;
+const INTERNAL_API_CONTEXT_RE = /\b(?:compiler|programmatic|package|library|ast|type(?:script)?|declaration)\s+api\b|\bapi\s+(?:compatibility|surface)\b/i;
+const GENERIC_CANDIDATES = new Set([
+    'api',
+    'billing',
+    'checkout',
+    'integration',
+    'payment',
+    'provider',
+    'sdk',
+    'system',
+]);
+/** Scan a feature description for explicit, affirmed request evidence. */
 export function extractSignals(description) {
-    const lower = stripIncidentalReferences(description.toLowerCase());
-    const hasTarget = FRONTEND_TERMS.test(lower) || BACKEND_TERMS.test(lower) || INFRA_TERMS.test(lower);
-    const hasDatabase = DATABASE_TERMS.test(lower);
-    const hasUi = FRONTEND_TERMS.test(lower);
-    let namedProvider = null;
-    for (const { name, pattern } of PAYMENT_PROVIDERS) {
-        if (pattern.test(lower)) {
-            namedProvider = name;
-            break;
-        }
-    }
-    // hasBilling: billing/payment keywords OR a specific provider was named
-    const hasBilling = BILLING_TERMS.test(lower) || namedProvider !== null;
-    const wordCount = description.trim().split(/\s+/).length;
-    const hasScope = wordCount >= 10;
+    const cleaned = stripIncidentalReferences(description);
+    const segments = splitSegments(cleaned);
+    const targetTerms = collectAffirmedTerms(segments, TARGET_TERMS);
+    const billingTerms = collectAffirmedTerms(segments, BILLING_TERMS);
+    const databaseTerms = collectAffirmedTerms(segments, DATABASE_TERMS);
+    const permissionTerms = collectAffirmedTerms(segments, PERMISSION_TERMS);
+    const integrations = extractExternalIntegrations(segments);
+    const namedProvider = extractNamedBillingCandidate(segments);
+    const lower = cleaned.toLowerCase();
     const actionMatch = ACTION_RE.exec(lower);
     const action = actionMatch?.[1] ?? null;
     const domainObject = cleanDomainObject(actionMatch?.[2] ?? null);
-    const actors = uniqueMatches(lower, ACTOR_TERMS);
-    const dataObjects = uniqueMatches(lower, DATA_OBJECT_TERMS);
-    const riskTerms = uniqueMatches(lower, RISK_TERMS);
-    const integrations = [
-        ...PAYMENT_PROVIDERS.filter(({ pattern }) => pattern.test(lower)).map(({ name }) => name),
-        ...extractExternalIntegrations(lower),
-    ];
-    const hasPermissionRisk = PERMISSION_TERMS.test(lower);
-    const hasDestructiveAction = DESTRUCTIVE_TERMS.test(lower);
+    const wordCount = description.trim().split(/\s+/).filter(Boolean).length;
     return {
-        hasTarget,
-        hasBilling,
-        hasDatabase,
-        hasUi,
+        hasTarget: targetTerms.length > 0,
+        hasBilling: billingTerms.length > 0 || namedProvider !== null,
+        hasDatabase: databaseTerms.length > 0,
+        hasUi: segments.some((segment) => hasAffirmedMatch(segment, UI_TARGET_PATTERN)),
         namedProvider,
-        hasScope,
+        hasScope: wordCount >= 10,
         action,
         domainObject,
-        actors,
+        actors: collectAffirmedTerms(segments, ACTOR_TERMS),
         integrations,
-        dataObjects,
-        hasPermissionRisk,
-        hasDestructiveAction,
-        riskTerms,
+        dataObjects: collectAffirmedTerms(segments, DATA_OBJECT_TERMS),
+        hasPermissionRisk: permissionTerms.length > 0,
+        hasDestructiveAction: collectAffirmedTerms(segments, DESTRUCTIVE_TERMS).length > 0,
+        riskTerms: collectAffirmedTerms(segments, RISK_TERMS),
     };
 }
 function stripIncidentalReferences(description) {
     return description
-        .replace(/`[^`]*(?:\/|\.\w{1,8})[^`]*`/g, ' ')
-        .replace(/\b\S+\/\S+\b/g, ' ')
-        .replace(/\b[\w-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|css|scss|py|go|rs|java|rb|php)\b/g, ' ');
+        .replace(/```[\s\S]*?```/g, ' ')
+        .replace(/`[^`]+`/g, ' ')
+        .replace(/\[[^\]]*\]\([^)]*\)/g, ' ')
+        .replace(/https?:\/\/\S+/gi, ' ')
+        .replace(/\B@[\w.-]+\/[\w.-]+(?:@[\w.-]+)?/g, ' ')
+        .replace(/\b[\w.-]+\/[\w./-]+\b/g, ' ')
+        .replace(/\b[\w-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|css|scss|py|go|rs|java|rb|php)\b/gi, ' ')
+        .replace(/\b[a-z0-9]+(?:-[a-z0-9]+)+(?:@[^\s,;]+)?\b/gi, ' ');
+}
+function splitSegments(description) {
+    return description
+        .split(/(?:\r?\n|[.;!?]+)\s*/)
+        .map((segment) => segment.replace(/^\s*(?:[-*]|\d+[.)])\s*/, '').trim())
+        .filter(Boolean);
+}
+function collectAffirmedTerms(segments, definitions) {
+    const found = [];
+    for (const [name, pattern] of definitions) {
+        if (segments.some((segment) => hasAffirmedMatch(segment, pattern))) {
+            found.push(name);
+        }
+    }
+    return found;
+}
+function hasAffirmedMatch(segment, pattern) {
+    const flags = pattern.flags.replace('g', '');
+    const match = new RegExp(pattern.source, flags).exec(segment);
+    if (!match) {
+        return false;
+    }
+    const prefix = segment.slice(0, match.index);
+    if (NEGATION_RE.test(prefix) || EXAMPLE_RE.test(prefix) || TEST_PROSE_RE.test(prefix)) {
+        return false;
+    }
+    const matchedText = match[0].toLowerCase();
+    if (matchedText === 'api' && INTERNAL_API_CONTEXT_RE.test(segment)) {
+        return false;
+    }
+    return true;
 }
 function cleanDomainObject(value) {
     if (value === null) {
         return null;
     }
     const cleaned = value
-        .replace(/\b(that|with|to|from|when|where|and|or|but|using|in)\b.*$/i, '')
+        .replace(/\b(that|with|to|from|when|where|and|or|but|using|in|while)\b.*$/i, '')
         .replace(/\s+/g, ' ')
         .trim();
     return cleaned.length > 0 ? cleaned : null;
 }
-function uniqueMatches(text, pattern) {
-    const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
-    const globalPattern = new RegExp(pattern.source, flags);
-    return Array.from(new Set(Array.from(text.matchAll(globalPattern)).map((match) => match[0])));
+function extractNamedBillingCandidate(segments) {
+    for (const segment of segments) {
+        if (!BILLING_TERMS.some(([, pattern]) => hasAffirmedMatch(segment, pattern))) {
+            continue;
+        }
+        const candidate = extractCandidate(segment, [
+            /\b(?:integrate|use|using|via|with)\s+(?:with\s+)?([a-z][a-z0-9-]{1,40})\b/i,
+            /\bprovider\s*(?:is|:)\s*([a-z][a-z0-9-]{1,40})\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:payment|billing|checkout)\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:payment|billing|checkout)\s+(?:api|sdk|integration|provider)\b/i,
+        ]);
+        if (candidate !== null) {
+            return normalizeCandidate(candidate);
+        }
+    }
+    return null;
+}
+function extractExternalIntegrations(segments) {
+    const integrations = [];
+    for (const segment of segments) {
+        if (INTERNAL_API_CONTEXT_RE.test(segment)) {
+            continue;
+        }
+        const candidate = extractCandidate(segment, [
+            /\b(?:integrate|integration with|sync|sync with)\s+(?:with\s+)?([a-z][a-z0-9-]{1,40})\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:api|webhook|sdk|integration)\b/i,
+        ]);
+        if (candidate !== null && isAffirmedCandidate(segment, candidate)) {
+            integrations.push(normalizeCandidate(candidate));
+        }
+    }
+    return Array.from(new Set(integrations));
+}
+function extractCandidate(segment, patterns) {
+    for (const pattern of patterns) {
+        const match = pattern.exec(segment);
+        const candidate = match?.[1];
+        if (candidate && !GENERIC_CANDIDATES.has(candidate.toLowerCase())) {
+            return candidate;
+        }
+    }
+    return null;
+}
+function isAffirmedCandidate(segment, candidate) {
+    const index = segment.toLowerCase().indexOf(candidate.toLowerCase());
+    const prefix = index < 0 ? segment : segment.slice(0, index);
+    return !NEGATION_RE.test(prefix) && !EXAMPLE_RE.test(prefix) && !TEST_PROSE_RE.test(prefix);
 }
-function extractExternalIntegrations(text) {
-    const matches = text.match(/\b([a-z][a-z0-9-]+)\s+(?:api|webhook|sdk|integration)\b/gi) ?? [];
-    return Array.from(new Set(matches.map((match) => match.replace(/\s+(api|webhook|sdk|integration)$/i, ''))));
+function normalizeCandidate(candidate) {
+    return candidate.charAt(0).toUpperCase() + candidate.slice(1);
 }
 //# sourceMappingURL=answer-extractor.js.map

package/dist/engine/elicitation/decision-gap-detector.js

@@ -3,12 +3,11 @@ export function detectDecisionGaps(signals, _projectContext) {
     const gaps = [
         buildPermissionGap(signals),
         buildProviderGap(signals),
-        buildBillingModelGap(signals),
         buildDataGap(signals),
         buildFailureGap(signals),
     ].filter((gap) => gap !== null);
-    if (gaps.length === 0 && !signals.hasScope) {
-        gaps.push(buildBehaviorGap(signals));
+    if (gaps.length === 0 && isShortAmbiguous(signals)) {
+        gaps.push(buildScopeGap(signals));
     }
     return gaps.slice(0, MAX_GAPS);
 }
@@ -18,16 +17,19 @@ function buildPermissionGap(signals) {
     }
     const subject = formatSubject(signals);
     return makeGap({
-        id: 'permission-owner',
+        id: 'permission-boundary',
         kind: 'permission',
-        header: 'Permission',
-        question: `For ${subject}, who is allowed to perform this action? This changes permissions, validation, and audit behavior.`,
-        evidence: evidenceFrom(signals, ['permission-sensitive wording']),
+        header: 'Access',
+        question: `For ${subject}, which access boundary is intended? This changes authorization checks and audit criteria.`,
+        evidence: evidenceFrom(signals, ['capability:permission']),
         impact: 'Changes authorization checks and acceptance criteria.',
         options: options([
-            ['Role-based owner (Recommended)', 'Use the existing role or owner model for this action.'],
-            ['Admin only', 'Restrict the behavior to administrators.'],
-            ['Any signed-in user', 'Allow all authenticated users and keep checks minimal.'],
+            ['Existing access boundary', 'Apply the access boundary already defined by the project.'],
+            [
+                'New access boundary',
+                'Define the permitted actor without assuming a role or identity model.',
+            ],
+            ['Access control out of scope', 'Keep authorization changes outside this spec.'],
         ]),
     });
 }
@@ -37,38 +39,21 @@ function buildProviderGap(signals) {
     }
     const subject = formatSubject(signals);
     return makeGap({
-        id: 'payment-provider',
+        id: 'payment-provider-boundary',
         kind: 'provider',
         header: 'Provider',
-        question: `For ${subject}, which payment provider should own the payment flow? This changes API contracts, webhook handling, and test fixtures.`,
-        evidence: evidenceFrom(signals, ['billing/payment wording']),
-        impact: 'Changes integration code, webhook behavior, and verification fixtures.',
+        question: `For ${subject}, is payment-provider selection part of this spec? This changes integration ownership and acceptance criteria.`,
+        evidence: evidenceFrom(signals, ['domain:billing']),
+        impact: 'Changes integration ownership and acceptance criteria.',
         options: options([
-            ['Stripe (Recommended)', 'Use the most common provider for subscription and checkout flows.'],
-            ['PayPal', 'Use PayPal checkout and payment APIs.'],
             [
-                'No provider yet',
-                'Keep provider integration out of scope and define internal contracts only.',
+                'Provider selection in scope',
+                'Define selection criteria without choosing an unevidenced vendor.',
+            ],
+            [
+                'Provider selection out of scope',
+                'Limit the spec to behavior that does not choose a provider.',
             ],
-        ]),
-    });
-}
-function buildBillingModelGap(signals) {
-    if (!signals.hasBilling) {
-        return null;
-    }
-    const subject = formatSubject(signals);
-    return makeGap({
-        id: 'billing-model',
-        kind: 'billing-model',
-        header: 'Billing',
-        question: `For ${subject}, is the billing behavior recurring, one-time, or invoice-based? This changes states, events, and acceptance criteria.`,
-        evidence: evidenceFrom(signals, ['billing/payment wording']),
-        impact: 'Changes lifecycle states and acceptance criteria.',
-        options: options([
-            ['Recurring subscription (Recommended)', 'Model ongoing subscriptions and renewal states.'],
-            ['One-time checkout', 'Model a single payment completion flow.'],
-            ['Invoice-based', 'Model invoice creation, payment, and overdue states.'],
         ]),
     });
 }
@@ -78,81 +63,76 @@ function buildDataGap(signals) {
     }
     const subject = formatSubject(signals);
     return makeGap({
-        id: 'data-shape',
+        id: 'data-boundary',
         kind: 'data',
         header: 'Data',
-        question: `For ${subject}, what data must be stored or updated? This changes schema, validation, and migration work.`,
-        evidence: evidenceFrom(signals, ['database/data wording']),
-        impact: 'Changes schema, persistence, and validation requirements.',
+        question: `For ${subject}, which data shape belongs in scope? This changes persistence, validation, and migration criteria.`,
+        evidence: evidenceFrom(signals, ['domain:data']),
+        impact: 'Changes persistence, validation, and migration criteria.',
         options: options([
-            [
-                'Existing records only (Recommended)',
-                'Use existing tables or records without a new schema.',
-            ],
-            ['New table or field', 'Add persistence changes and migration coverage.'],
-            ['Read-only data', 'Do not persist new state for this behavior.'],
+            ['Existing data shape', 'Use only data structures already present in the project.'],
+            ['New data shape', 'Define the required data change without assuming a database product.'],
+            ['Data change out of scope', 'Keep persistence changes outside this spec.'],
         ]),
     });
 }
 function buildFailureGap(signals) {
-    if (signals.integrations.length === 0 &&
-        !signals.riskTerms.includes('sync') &&
-        !signals.riskTerms.includes('api')) {
+    const integration = signals.integrations[0];
+    if (integration === undefined) {
         return null;
     }
     const subject = formatSubject(signals);
     return makeGap({
-        id: 'failure-handling',
+        id: 'failure-boundary',
         kind: 'failure',
         header: 'Failure',
-        question: `For ${subject}, what should happen if ${formatIntegration(signals)} fails? This changes retry, error, and user-visible behavior.`,
-        evidence: evidenceFrom(signals, signals.integrations.length > 0 ? signals.integrations : ['integration/API wording']),
-        impact: 'Changes error handling, retries, and tests.',
+        question: `For ${subject}, should ${integration} failure behavior be in scope? This changes error-handling and verification criteria.`,
+        evidence: evidenceFrom(signals, [`integration:${integration}`]),
+        impact: 'Changes error-handling and verification criteria.',
         options: options([
-            ['Show recoverable error (Recommended)', 'Return a clear error and preserve current state.'],
-            ['Retry automatically', 'Retry transient failures before surfacing an error.'],
-            ['Queue for later', 'Persist work for asynchronous retry.'],
+            [
+                'Failure behavior in scope',
+                'Define the observable failure outcome without assuming a recovery strategy.',
+            ],
+            ['Failure behavior out of scope', 'Limit this spec to the successful integration boundary.'],
         ]),
     });
 }
-function buildBehaviorGap(signals) {
+function buildScopeGap(signals) {
     const subject = formatSubject(signals);
     return makeGap({
-        id: 'behavior-outcome',
-        kind: 'behavior',
-        header: 'Behavior',
-        question: `For ${subject}, what observable outcome should prove the work is done? This becomes the primary acceptance criterion.`,
-        evidence: evidenceFrom(signals, ['short request']),
-        impact: 'Changes the main acceptance criterion and verification command.',
+        id: 'scope-outcome',
+        kind: 'scope',
+        header: 'Scope',
+        question: `For ${subject}, which observable outcome should define the scope? This changes the primary acceptance criterion.`,
+        evidence: evidenceFrom(signals, ['request:short-ambiguous']),
+        impact: 'Changes the primary acceptance criterion.',
         options: options([
-            ['User-visible workflow (Recommended)', 'Define the end-to-end behavior a user can observe.'],
-            ['Backend behavior', 'Define API, persistence, job, or integration behavior.'],
-            ['Cleanup or fix', 'Define the before/after bug or cleanup result.'],
+            ['Behavior change', 'Describe the concrete before-and-after behavior.'],
+            ['Bounded investigation', 'Limit the work to a finding and its verification evidence.'],
+            ['Maintenance outcome', 'Define the concrete cleanup or compatibility result.'],
         ]),
     });
 }
+function isShortAmbiguous(signals) {
+    return (!signals.hasScope &&
+        !signals.hasTarget &&
+        !signals.hasBilling &&
+        !signals.hasDatabase &&
+        !signals.hasPermissionRisk &&
+        signals.integrations.length === 0);
+}
 function makeGap(gap) {
     return { ...gap, multiSelect: gap.multiSelect ?? false, blocking: true };
 }
 function formatSubject(signals) {
     const action = signals.action ?? 'this request';
-    const object = signals.domainObject;
-    return object === null ? action : `${action} ${object}`;
-}
-function formatIntegration(signals) {
-    if (signals.integrations.length > 0) {
-        return signals.integrations[0] ?? 'the integration';
-    }
-    if (signals.riskTerms.includes('sync')) {
-        return 'the sync';
-    }
-    return 'the API';
+    return signals.domainObject === null ? action : `${action} ${signals.domainObject}`;
 }
 function evidenceFrom(signals, extra) {
     return [
         ...(signals.action ? [`action:${signals.action}`] : []),
         ...(signals.domainObject ? [`object:${signals.domainObject}`] : []),
-        ...signals.riskTerms.map((term) => `risk:${term}`),
         ...extra,
     ].slice(0, 6);
 }

package/dist/engine/elicitation/index.d.ts

@@ -5,7 +5,6 @@ export * from './question-generator.js';
 export * from './capability.js';
 export * from './elicit-helper.js';
 export * from './answer-extractor.js';
-export * from './option-builder.js';
 export * from './user-elicitor.js';
 export * from './decision-cache.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/engine/elicitation/index.js

@@ -6,7 +6,6 @@ export * from './question-generator.js';
 export * from './capability.js';
 export * from './elicit-helper.js';
 export * from './answer-extractor.js';
-export * from './option-builder.js';
 export * from './user-elicitor.js';
 export * from './decision-cache.js';
 //# sourceMappingURL=index.js.map