@planu/cli 4.11.0 → 4.11.2

package/dist/engine/elicitation/question-grounding-gate.js

@@ -6,49 +6,98 @@ const GENERIC_QUESTION_PATTERNS = [
     /^what data is needed\??$/i,
     /^what are the requirements\??$/i,
 ];
+const REQUIRED_EVIDENCE = {
+    permission: ['capability:permission'],
+    provider: ['domain:billing'],
+    'billing-model': ['domain:billing'],
+    data: ['domain:data'],
+    failure: ['integration:'],
+    behavior: ['request:short-ambiguous'],
+    scope: ['request:short-ambiguous'],
+};
+const OPTION_CONCEPTS = [
+    [/\b(payment|billing|checkout|subscription|invoice|provider|vendor)\b/i, ['domain:billing']],
+    [/\b(database|schema|table|sql|persistence)\b/i, ['domain:data']],
+    [/\b(admin|role|auth|authorization|permission|access control)\b/i, ['capability:permission']],
+    [/\b(retry|backoff|queue|queued)\b/i, ['capability:retry']],
+    [/\b(docker|kubernetes|cloud|serverless)\b/i, ['capability:infrastructure']],
+];
+const NEUTRAL_TITLE_WORDS = new Set([
+    'access',
+    'apply',
+    'behavior',
+    'bounded',
+    'current',
+    'data',
+    'define',
+    'describe',
+    'existing',
+    'failure',
+    'in',
+    'include',
+    'keep',
+    'limit',
+    'maintenance',
+    'new',
+    'no',
+    'out',
+    'project',
+    'provider',
+    'request',
+    'scope',
+    'selection',
+    'the',
+    'use',
+]);
 export function validateQuestionGrounding(question, context) {
     const text = question.question.trim();
     if (GENERIC_QUESTION_PATTERNS.some((pattern) => pattern.test(text))) {
         return { passed: false, reason: 'Question is a generic reusable prompt.' };
     }
+    const requiredMarkers = REQUIRED_EVIDENCE[context.gap.kind] ?? [];
+    if (!requiredMarkers.some((marker) => hasEvidenceMarker(context.gap.evidence, marker))) {
+        return { passed: false, reason: 'Gap lacks affirmed evidence for this decision kind.' };
+    }
+    const groundingPhrases = context.gap.evidence
+        .filter((item) => /^(?:action|object|integration|project):/i.test(item))
+        .map((item) => item.slice(item.indexOf(':') + 1).toLowerCase())
+        .filter((item) => item.length > 1);
     const lowerQuestion = text.toLowerCase();
-    const lowerEvidence = [context.requestText, ...context.gap.evidence].join(' ').toLowerCase();
-    const evidenceTokens = tokenSet(lowerEvidence);
-    const hasRequestEvidence = Array.from(evidenceTokens).some((token) => token.length >= 3 && lowerQuestion.includes(token));
+    const hasRequestEvidence = groundingPhrases.some((phrase) => lowerQuestion.includes(phrase));
     if (!hasRequestEvidence) {
-        return {
-            passed: false,
-            reason: 'Question does not include evidence from the request or detected gap.',
-        };
+        return { passed: false, reason: 'Question does not include concrete request evidence.' };
     }
-    if (!/\bchanges?\b|\bthis changes\b|\baffects?\b|\bbecause\b|\bbecomes?\b/i.test(text)) {
-        return {
-            passed: false,
-            reason: 'Question does not explain why the answer matters for the spec.',
-        };
+    if (!/\bchanges?\b|\baffects?\b|\bbecause\b|\bbecomes?\b/i.test(text)) {
+        return { passed: false, reason: 'Question does not explain why the answer matters.' };
     }
-    return { passed: true };
+    const optionFailure = validateOptions(question, context);
+    return optionFailure ?? { passed: true };
 }
-function tokenSet(text) {
-    return new Set(text
-        .replace(/[^a-z0-9 ]/gi, ' ')
-        .split(/\s+/)
-        .filter((token) => !STOP_WORDS.has(token) && token.length > 2));
+function validateOptions(question, context) {
+    const evidenceText = `${context.requestText} ${context.gap.evidence.join(' ')}`.toLowerCase();
+    for (const option of question.options) {
+        const optionText = `${option.label} ${option.description}`;
+        for (const [pattern, markers] of OPTION_CONCEPTS) {
+            if (pattern.test(optionText) &&
+                !markers.some((marker) => hasEvidenceMarker(context.gap.evidence, marker))) {
+                return { passed: false, reason: 'Option introduces a domain concept without evidence.' };
+            }
+        }
+        const properNames = optionText.match(/\b(?:[A-Z]{2,}|[A-Z][a-z]+(?:[A-Z][A-Za-z]+)?)\b/g) ?? [];
+        const unsupported = properNames.find((name) => {
+            const lower = name.toLowerCase();
+            return !NEUTRAL_TITLE_WORDS.has(lower) && !evidenceText.includes(lower);
+        });
+        if (unsupported !== undefined) {
+            return {
+                passed: false,
+                reason: `Option introduces unsupported named candidate: ${unsupported}.`,
+            };
+        }
+    }
+    return null;
+}
+function hasEvidenceMarker(evidence, marker) {
+    return evidence.some((item) => item.toLowerCase().startsWith(marker));
 }
-const STOP_WORDS = new Set([
-    'the',
-    'and',
-    'for',
-    'this',
-    'that',
-    'with',
-    'from',
-    'what',
-    'when',
-    'where',
-    'should',
-    'action',
-    'object',
-    'risk',
-]);
 //# sourceMappingURL=question-grounding-gate.js.map

package/dist/engine/evidence-gates/lifecycle-gate.js

@@ -1,26 +1,39 @@
+import { hasAnyAffirmedMatch } from '../text-signal-boundaries.js';
 const CONTRACT_HINTS = {
-    api: /\b(api|rest|endpoint|openapi|http route|controller)\b/i,
-    graphql: /\b(graphql|gql|schema\.graphql|resolver)\b/i,
-    event: /\b(event|webhook|queue|topic|message broker|kafka|rabbitmq|pubsub)\b/i,
-    ui: /\b(ui contract|component contract|screen contract|design contract)\b/i,
-    mcp: /\b(mcp|tool contract|model context protocol|registerTool|server tool)\b/i,
+    api: [
+        /\b(?:public|external|rest|http)[ -]?api\b/i,
+        /\bapi\s+(?:endpoint|route|request|response|contract)\b/i,
+        /\b(?:rest|http)\s+(?:endpoint|route|contract)\b/i,
+        /\bopenapi\b/i,
+    ],
+    graphql: [/\b(?:graphql|gql)\s+(?:api|schema|resolver|contract)\b/i, /\bschema\.graphql\b/i],
+    event: [
+        /\b(?:event|message)\s+(?:contract|schema|producer|consumer|handler|queue|topic)\b/i,
+        /\b(?:message\s+broker|kafka|rabbitmq|pubsub|webhook\s+(?:delivery|contract|payload))\b/i,
+    ],
+    ui: [/\b(?:ui|component|screen|design)\s+contract\b/i],
+    mcp: [
+        /\bmcp\s+(?:tool|contract|server|protocol)\b/i,
+        /\b(?:tool\s+contract|model\s+context\s+protocol|registerTool|server\s+tool)\b/i,
+    ],
 };
 function isNonTrivial(spec) {
     return spec.scope !== 'trivial';
 }
 function normalizeCriterion(value) {
-    return value
-        .replace(/^-\s*\[[ x]\]\s*/i, '')
-        .replace(/^(AC\d+)\s*[:.)-]?\s*/i, '')
+    const withoutCheckbox = value.replace(/^-\s*\[[ x]\]\s*/i, '').trim();
+    const criterionOnly = /^(AC\d+)\s*[:.)-]?\s*$/i.exec(withoutCheckbox)?.[1];
+    if (criterionOnly) {
+        return criterionOnly.toLowerCase();
+    }
+    return withoutCheckbox
+        .replace(/^AC\d+\s*[:.)-]?\s*/i, '')
         .replace(/\s+/g, ' ')
         .trim()
         .toLowerCase();
 }
 function criterionAliases(value, index) {
-    const aliases = new Set([
-        normalizeCriterion(value),
-        normalizeCriterion(`AC${String(index + 1)}`),
-    ]);
+    const aliases = new Set([normalizeCriterion(value), `ac${String(index + 1)}`]);
     const explicit = /^(AC\d+)\b/i.exec(value)?.[1];
     if (explicit) {
         aliases.add(normalizeCriterion(explicit));
@@ -33,8 +46,8 @@ function hasText(value) {
 export function inferRequiredContractEvidence(spec, criteria) {
     const text = `${spec.title} ${spec.tags.join(' ')} ${criteria.join(' ')}`;
     const required = [];
-    for (const [kind, pattern] of Object.entries(CONTRACT_HINTS)) {
-        if (pattern.test(text)) {
+    for (const [kind, patterns] of Object.entries(CONTRACT_HINTS)) {
+        if (hasAnyAffirmedMatch(text, [...patterns])) {
             required.push(kind);
         }
     }

package/dist/engine/evidence-index/index-builder.js

@@ -155,8 +155,13 @@ function record(kind, value, status, source, reason) {
     return { kind, value, status, source, ...(reason ? { reason } : {}) };
 }
 function normalizeCriterion(value) {
-    return value
-        .replace(/^-\s*\[[ x]\]\s*/i, '')
+    const withoutCheckbox = value.replace(/^-\s*\[[ x]\]\s*/i, '').trim();
+    const criterionOnly = /^(AC\d+)\s*[:.)-]?\s*$/i.exec(withoutCheckbox)?.[1];
+    if (criterionOnly) {
+        return criterionOnly.toLowerCase();
+    }
+    return withoutCheckbox
+        .replace(/^AC\d+\s*[:.)-]?\s*/i, '')
         .replace(/\s+/g, ' ')
         .trim()
         .toLowerCase();

package/dist/engine/frontmatter-sha/frozen-fields.d.ts

@@ -2,6 +2,6 @@
  * Frontmatter fields that become immutable when a spec transitions to a terminal state
  * (done or discarded). Any change to these fields after the SHA freeze is a tamper signal.
  */
-export declare const FROZEN_FIELDS: readonly ["status", "scenarios", "spec_version", "id", "type", "target"];
+export declare const FROZEN_FIELDS: readonly ['status', 'scenarios', 'spec_version', 'id', 'type', 'target'];
 export type FrozenField = (typeof FROZEN_FIELDS)[number];
 //# sourceMappingURL=frozen-fields.d.ts.map

package/dist/engine/handoff-artifacts/schemas/red-tests-handoff.d.ts

@@ -8,10 +8,10 @@ export declare const RedTestsHandoffSchema: z.ZodObject<{
     testFiles: z.ZodArray<z.ZodString>;
     testFramework: z.ZodEnum<{
         jest: "jest";
-        vitest: "vitest";
+        playwright: "playwright";
         pytest: "pytest";
         rspec: "rspec";
-        playwright: "playwright";
+        vitest: "vitest";
     }>;
     expectedFailures: z.ZodArray<z.ZodString>;
     authoredBy: z.ZodString;

package/dist/engine/handoff-artifacts/schemas.d.ts

@@ -5,11 +5,11 @@ export declare const SchemaVersion: z.ZodString;
 export declare const IntakeV1Schema: z.ZodObject<{
     schema_version: z.ZodString;
     kind: z.ZodEnum<{
-        idea: "idea";
-        "quick-fix": "quick-fix";
         "bug-spec": "bug-spec";
-        "feature-spec": "feature-spec";
         epic: "epic";
+        "feature-spec": "feature-spec";
+        idea: "idea";
+        "quick-fix": "quick-fix";
     }>;
     description: z.ZodString;
     confidence: z.ZodNumber;
@@ -38,9 +38,9 @@ export declare const ReviewFeedbackV1Schema: z.ZodObject<{
     }>;
     reviewer: z.ZodObject<{
         kind: z.ZodEnum<{
+            automation: "automation";
             human: "human";
             "spec-review-agent": "spec-review-agent";
-            automation: "automation";
         }>;
         agent: z.ZodString;
         verdict: z.ZodEnum<{
@@ -73,8 +73,8 @@ export declare const ValidationReportV1Schema: z.ZodObject<{
     }, z.core.$strip>>;
     reviewer: z.ZodObject<{
         kind: z.ZodEnum<{
-            human: "human";
             automation: "automation";
+            human: "human";
             "implementation-review-agent": "implementation-review-agent";
         }>;
         agent: z.ZodString;
@@ -104,13 +104,13 @@ export declare const ValidationReportV1Schema: z.ZodObject<{
             tag: z.ZodString;
             severity: z.ZodEnum<{
                 blocker: "blocker";
-                warning: "warning";
                 info: "info";
+                warning: "warning";
             }>;
             confidence: z.ZodEnum<{
+                high: "high";
                 low: "low";
                 medium: "medium";
-                high: "high";
             }>;
             target: z.ZodString;
             line: z.ZodOptional<z.ZodNumber>;
@@ -119,10 +119,10 @@ export declare const ValidationReportV1Schema: z.ZodObject<{
             blocksDone: z.ZodBoolean;
             evidenceSource: z.ZodArray<z.ZodObject<{
                 source: z.ZodEnum<{
-                    spec: "spec";
-                    runtime: "runtime";
                     policy: "policy";
                     "project-config": "project-config";
+                    runtime: "runtime";
+                    spec: "spec";
                 }>;
                 key: z.ZodString;
                 value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
@@ -142,10 +142,10 @@ export declare const ValidationReportV1Schema: z.ZodObject<{
         }, z.core.$strip>>;
         evidence: z.ZodArray<z.ZodObject<{
             source: z.ZodEnum<{
-                spec: "spec";
-                runtime: "runtime";
                 policy: "policy";
                 "project-config": "project-config";
+                runtime: "runtime";
+                spec: "spec";
             }>;
             key: z.ZodString;
             value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
@@ -159,11 +159,11 @@ export declare const ARTIFACT_SCHEMAS: {
     readonly intake: z.ZodObject<{
         schema_version: z.ZodString;
         kind: z.ZodEnum<{
-            idea: "idea";
-            "quick-fix": "quick-fix";
             "bug-spec": "bug-spec";
-            "feature-spec": "feature-spec";
             epic: "epic";
+            "feature-spec": "feature-spec";
+            idea: "idea";
+            "quick-fix": "quick-fix";
         }>;
         description: z.ZodString;
         confidence: z.ZodNumber;
@@ -192,9 +192,9 @@ export declare const ARTIFACT_SCHEMAS: {
         }>;
         reviewer: z.ZodObject<{
             kind: z.ZodEnum<{
+                automation: "automation";
                 human: "human";
                 "spec-review-agent": "spec-review-agent";
-                automation: "automation";
             }>;
             agent: z.ZodString;
             verdict: z.ZodEnum<{
@@ -227,8 +227,8 @@ export declare const ARTIFACT_SCHEMAS: {
         }, z.core.$strip>>;
         reviewer: z.ZodObject<{
             kind: z.ZodEnum<{
-                human: "human";
                 automation: "automation";
+                human: "human";
                 "implementation-review-agent": "implementation-review-agent";
             }>;
             agent: z.ZodString;
@@ -258,13 +258,13 @@ export declare const ARTIFACT_SCHEMAS: {
                 tag: z.ZodString;
                 severity: z.ZodEnum<{
                     blocker: "blocker";
-                    warning: "warning";
                     info: "info";
+                    warning: "warning";
                 }>;
                 confidence: z.ZodEnum<{
+                    high: "high";
                     low: "low";
                     medium: "medium";
-                    high: "high";
                 }>;
                 target: z.ZodString;
                 line: z.ZodOptional<z.ZodNumber>;
@@ -273,10 +273,10 @@ export declare const ARTIFACT_SCHEMAS: {
                 blocksDone: z.ZodBoolean;
                 evidenceSource: z.ZodArray<z.ZodObject<{
                     source: z.ZodEnum<{
-                        spec: "spec";
-                        runtime: "runtime";
                         policy: "policy";
                         "project-config": "project-config";
+                        runtime: "runtime";
+                        spec: "spec";
                     }>;
                     key: z.ZodString;
                     value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;
@@ -296,10 +296,10 @@ export declare const ARTIFACT_SCHEMAS: {
             }, z.core.$strip>>;
             evidence: z.ZodArray<z.ZodObject<{
                 source: z.ZodEnum<{
-                    spec: "spec";
-                    runtime: "runtime";
                     policy: "policy";
                     "project-config": "project-config";
+                    runtime: "runtime";
+                    spec: "spec";
                 }>;
                 key: z.ZodString;
                 value: z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean]>>;

package/dist/engine/human-summary.js

@@ -1,5 +1,5 @@
 // engine/human-summary.ts — Plain-language one/two-sentence summaries for tool responses.
-// Rules: no IDs/hashes, no jargon, max 2 sentences, always end with a next-step suggestion.
+// Rules: no IDs/hashes, no jargon, max 2 sentences, and no invented next step for terminal states.
 /** create_spec — plan was created successfully */
 export function buildCreateSpecSummary(title, devHours) {
     const hours = devHours > 0 ? `Estimated ${String(devHours)}h` : 'Estimation ready';
@@ -8,7 +8,7 @@ export function buildCreateSpecSummary(title, devHours) {
 /** update_status — status transition completed */
 export function buildUpdateStatusSummary(title, newStatus) {
     if (newStatus === 'done') {
-        return `Done! "${title}" is complete and recorded. Run estimate or start a new plan when you're ready.`;
+        return `Done! "${title}" is complete and recorded.`;
     }
     if (newStatus === 'approved') {
         return `"${title}" is approved and ready to build. Start implementing whenever you like.`;
@@ -20,7 +20,7 @@ export function buildUpdateStatusSummary(title, newStatus) {
         return `"${title}" is now under review. Approve it or request changes to move forward.`;
     }
     if (newStatus === 'discarded') {
-        return `"${title}" has been discarded. Create a new plan whenever you want to restart.`;
+        return `"${title}" has been discarded.`;
     }
     return `"${title}" moved to ${newStatus}. Check the next step suggestion above to continue.`;
 }

package/dist/engine/implementation-contract/common.d.ts

@@ -1,5 +1,5 @@
 export declare const IMPLEMENTATION_CONTRACT_SECTION = "Implementation Contract";
-export declare const IMPLEMENTATION_CONTRACT_SUBSECTIONS: readonly ["User Outcome", "Behavior Contract", "File-Level Work Plan", "Acceptance-To-Verification Map", "Edge Cases And Failure Modes", "Non-Goals And Forbidden Approaches", "Verification Commands"];
+export declare const IMPLEMENTATION_CONTRACT_SUBSECTIONS: readonly ['User Outcome', 'Behavior Contract', 'File-Level Work Plan', 'Acceptance-To-Verification Map', 'Edge Cases And Failure Modes', 'Non-Goals And Forbidden Approaches', 'Verification Commands'];
 export declare function hasImplementationContract(specBody: string): boolean;
 export declare function extractTopLevelSection(body: string, sectionName: string): string;
 //# sourceMappingURL=common.d.ts.map

package/dist/engine/keyword-matcher/stopwords.d.ts

@@ -3,13 +3,13 @@
  * "validate input") but rarely represent a domain concept worth searching for.
  * Keep lowercase; callers normalize before lookup.
  */
-export declare const ACTION_VERBS: readonly ["commit", "write", "read", "delete", "create", "update", "export", "import", "store", "send", "push", "pull", "sync", "check", "validate", "verify", "fetch", "load", "save", "remove", "add", "get", "set", "put", "post", "patch", "run", "execute", "parse", "render", "build", "compile"];
+export declare const ACTION_VERBS: readonly ['commit', 'write', 'read', 'delete', 'create', 'update', 'export', 'import', 'store', 'send', 'push', 'pull', 'sync', 'check', 'validate', 'verify', 'fetch', 'load', 'save', 'remove', 'add', 'get', 'set', 'put', 'post', 'patch', 'run', 'execute', 'parse', 'render', 'build', 'compile'];
 /**
  * Generic English connectors and filler nouns that do not narrow a match.
  * Kept deliberately small — domain stopwords should go through
  * `KeywordMatchOptions.customStopwords`.
  */
-export declare const COMMON_STOPWORDS: readonly ["the", "and", "for", "that", "this", "with", "from", "into", "onto", "version", "control", "system", "data", "value", "field", "record", "user", "item", "thing", "stuff", "something", "anything"];
+export declare const COMMON_STOPWORDS: readonly ['the', 'and', 'for', 'that', 'this', 'with', 'from', 'into', 'onto', 'version', 'control', 'system', 'data', 'value', 'field', 'record', 'user', 'item', 'thing', 'stuff', 'something', 'anything'];
 /**
  * True if `word` is a known action verb (case-insensitive).
  */

package/dist/engine/provider-adapters/adapters/claude.d.ts

@@ -5,7 +5,7 @@ import type { ProviderRenderInput, ProviderRenderOutput, SpecRenderer } from '..
  */
 export declare const CLAUDE_TOOL_CALLOUT_MAP: Readonly<Record<string, readonly string[]>>;
 export declare class ClaudeRenderer implements SpecRenderer {
-    readonly kind: "claude";
+    readonly kind: 'claude';
     render(input: ProviderRenderInput): Promise<ProviderRenderOutput>;
 }
 //# sourceMappingURL=claude.d.ts.map

package/dist/engine/provider-adapters/adapters/gemini.d.ts

@@ -5,7 +5,7 @@ import type { ProviderRenderInput, ProviderRenderOutput, SpecRenderer } from '..
  */
 export declare const GEMINI_API_VERSION = "v1beta";
 export declare class GeminiRenderer implements SpecRenderer {
-    readonly kind: "gemini";
+    readonly kind: 'gemini';
     render(input: ProviderRenderInput): Promise<ProviderRenderOutput>;
 }
 //# sourceMappingURL=gemini.d.ts.map

package/dist/engine/provider-adapters/adapters/gpt4.d.ts

@@ -1,6 +1,6 @@
 import type { ProviderRenderInput, ProviderRenderOutput, SpecRenderer } from '../../../types/provider-adapter.js';
 export declare class GPT4Renderer implements SpecRenderer {
-    readonly kind: "gpt4";
+    readonly kind: 'gpt4';
     render(input: ProviderRenderInput): Promise<ProviderRenderOutput>;
 }
 //# sourceMappingURL=gpt4.d.ts.map

package/dist/engine/provider-adapters/adapters/markdown.d.ts

@@ -1,6 +1,6 @@
 import type { ProviderRenderInput, ProviderRenderOutput, SpecRenderer } from '../../../types/provider-adapter.js';
 export declare class GenericMarkdownRenderer implements SpecRenderer {
-    readonly kind: "markdown";
+    readonly kind: 'markdown';
     render(input: ProviderRenderInput): Promise<ProviderRenderOutput>;
 }
 //# sourceMappingURL=markdown.d.ts.map

package/dist/engine/safety/atomic-write-file.d.ts

@@ -6,7 +6,7 @@ import type { AtomicWriteOptions } from '../../types/safety.js';
 export declare class SpecFrozenError extends Error {
     readonly specId: string;
     readonly fixHint: string;
-    readonly code: "SPEC_FROZEN";
+    readonly code: 'SPEC_FROZEN';
     constructor(specId: string, fixHint: string);
 }
 /**

package/dist/engine/safety/cross-process-lock.d.ts

@@ -3,7 +3,7 @@ declare const HEARTBEAT_INTERVAL_MS = 30000;
 export { HEARTBEAT_INTERVAL_MS };
 /** Thrown by withSpecLock when the lock is held by another live session. */
 export declare class LockBusyError extends Error {
-    readonly code: "LOCK_BUSY";
+    readonly code: 'LOCK_BUSY';
     readonly holder: CrossProcessLockMetadata;
     constructor(holder: CrossProcessLockMetadata);
 }

package/dist/engine/safety/path-sanitizer.d.ts

@@ -1,6 +1,6 @@
 import type { SafePath } from '../../types/safety.js';
 export declare class PathViolationError extends Error {
-    readonly code: "PATH_VIOLATION";
+    readonly code: 'PATH_VIOLATION';
     readonly input: string;
     constructor(message: string, input: string);
 }

package/dist/engine/security-analyzer/profile-detector.js

@@ -1,28 +1,58 @@
 // engine/security-analyzer/profile-detector.ts — Feature profile and auth detection
 // SPEC-029
+import { hasAnyAffirmedMatch } from '../text-signal-boundaries.js';
 // === Feature profile detection ===
-const PROFILE_KEYWORDS = [
-    { keywords: ['api', 'endpoint', 'route', 'rest', 'graphql'], profile: 'public-api' },
+const PROFILE_SIGNALS = [
     {
-        keywords: ['auth', 'login', 'signup', 'register', 'password', 'jwt', 'oauth', 'session'],
+        patterns: [
+            /(?<!compiler\s)\bapi\b(?!\s+(?:compatibility|surface|package|type))/i,
+            /\b(?:public|external|rest|http)[ -]?api\b/i,
+            /\bapi\s+(?:endpoint|route|request|response|server)\b/i,
+            /\b(?:http|rest)\s+(?:endpoint|route)\b/i,
+            /\bgraphql\s+(?:api|endpoint|resolver|schema)\b/i,
+        ],
+        profile: 'public-api',
+    },
+    {
+        patterns: [
+            /\b(?:auth(?:entication)?|login|sign[ -]?up|register\s+user|password|jwt|oauth2?|session\s+auth)\b/i,
+        ],
         profile: 'auth',
     },
     {
-        keywords: ['database', 'query', 'sql', 'db', 'schema', 'orm', 'repository'],
+        patterns: [
+            /\b(?:database|db-access|postgres(?:ql)?|mysql|sqlite|mongodb|dynamodb)\b/i,
+            /\b(?:sql|nosql)\s+(?:query|statement|table|database)\b/i,
+            /\b(?:database|persistence)\s+(?:query|schema|table|migration|transaction)\b/i,
+            /\b(?:orm|prisma|drizzle|typeorm|sequelize)\b/i,
+        ],
         profile: 'db-access',
     },
-    { keywords: ['upload', 'file', 'attachment', 'media', 'image'], profile: 'file-upload' },
-    { keywords: ['html', 'render', 'template', 'ui', 'frontend', 'view'], profile: 'html-render' },
     {
-        keywords: ['pii', 'personal', 'email', 'phone', 'ssn', 'gdpr', 'privacy'],
+        patterns: [
+            /\bfile[ -]?upload\b/i,
+            /\b(?:upload|attach)(?:ed|ment|ing|s)?\s+(?:file|image|media)\b/i,
+        ],
+        profile: 'file-upload',
+    },
+    {
+        patterns: [
+            /\b(?:html\s+render|render(?:ed|ing)?\s+html|ui\s+(?:component|view|rendering)|frontend\s+view|template\s+render)\b/i,
+        ],
+        profile: 'html-render',
+    },
+    {
+        patterns: [
+            /\b(?:pii|personal\s+(?:data|information)|user\s+email|email\s+address|phone\s+number|ssn|gdpr|privacy)\b/i,
+        ],
         profile: 'pii-data',
     },
 ];
 export function detectSecurityProfiles(title, description, tags) {
-    const lower = `${title} ${description} ${tags.join(' ')}`.toLowerCase();
+    const text = `${title}\n${description}\n${tags.join(' ')}`;
     const profiles = [];
-    for (const { keywords, profile } of PROFILE_KEYWORDS) {
-        if (keywords.some((kw) => lower.includes(kw))) {
+    for (const { patterns, profile } of PROFILE_SIGNALS) {
+        if (hasAnyAffirmedMatch(text, patterns)) {
             profiles.push(profile);
         }
     }
@@ -33,20 +63,22 @@ export function detectSecurityProfiles(title, description, tags) {
 }
 // === Auth mechanism detection ===
 export function detectAuthMechanism(description, tags) {
-    const lower = `${description} ${tags.join(' ')}`.toLowerCase();
-    if (lower.includes('jwt') || lower.includes('json web token')) {
+    const text = `${description}\n${tags.join(' ')}`;
+    if (hasAnyAffirmedMatch(text, [/\b(?:jwt|json\s+web\s+token)\b/i])) {
         return 'jwt';
     }
-    if (lower.includes('oauth') || lower.includes('oauth2')) {
+    if (hasAnyAffirmedMatch(text, [/\boauth2?\b/i])) {
         return 'oauth2';
     }
-    if (lower.includes('api key') || lower.includes('apikey') || lower.includes('api_key')) {
+    if (hasAnyAffirmedMatch(text, [/\bapi[ _-]?key\b/i])) {
         return 'api-key';
     }
-    if (lower.includes('session') || lower.includes('cookie')) {
+    if (hasAnyAffirmedMatch(text, [
+        /\b(?:session[ -]?based\s+authentication|session\s+auth|session\s+cookie)\b/i,
+    ])) {
         return 'session';
     }
-    if (lower.includes('basic auth') || lower.includes('basic authentication')) {
+    if (hasAnyAffirmedMatch(text, [/\bbasic\s+auth(?:entication)?\b/i])) {
         return 'basic';
     }
     return 'none';

package/dist/engine/spec-format/copula-blacklist.d.ts

@@ -1,7 +1,7 @@
 /** Spanish copulative verbs that indicate non-testable, state-describing criteria. */
-export declare const COPULA_VERBS_ES: readonly ["es", "son", "está", "están", "tiene", "tienen"];
+export declare const COPULA_VERBS_ES: readonly ['es', 'son', 'está', 'están', 'tiene', 'tienen'];
 /** English copulative verbs that indicate non-testable, state-describing criteria. */
-export declare const COPULA_VERBS_EN: readonly ["is", "are", "has", "have", "exists", "contains"];
+export declare const COPULA_VERBS_EN: readonly ['is', 'are', 'has', 'have', 'exists', 'contains'];
 export interface CopulaCheckResult {
     hit: boolean;
     verb?: string;