@planu/cli 4.11.1 → 4.11.3

package/CHANGELOG.md

@@ -1,3 +1,19 @@
+## [4.11.3] - 2026-07-10
+
+### Bug Fixes
+- fix(release): classify npm 404 visibility correctly
+- fix(planu): harden release and grounded spec flow
+
+
+## [4.11.2] - 2026-07-10
+
+### Bug Fixes
+- fix(specs): ground lifecycle output and adopt TypeScript 7
+
+### Chores
+- chore(deps): update patch dependencies
+
+
 ## [4.11.1] - 2026-07-09
 
 ### Bug Fixes

package/dist/config/elicitation-questions.json

@@ -2,8 +2,7 @@
   {
     "id": "users",
     "category": "users",
-    "questionTemplate": "Who are the primary users of \"{title}\"?",
-    "hint": "e.g., \"authenticated users\", \"admin only\", \"all visitors\"",
+    "questionTemplate": "Which actors, systems, or processes are explicitly in scope for \"{title}\"?",
     "required": true,
     "answerType": "text",
     "condition": "always"
@@ -11,8 +10,7 @@
   {
     "id": "success",
     "category": "success",
-    "questionTemplate": "How will you know when this feature is successfully implemented?",
-    "hint": "Describe the outcome from the user's perspective",
+    "questionTemplate": "Which explicit observations or checks will prove that \"{title}\" is complete?",
     "required": true,
     "answerType": "text",
     "condition": "always"
@@ -34,8 +32,7 @@
   {
     "id": "edge_cases",
     "category": "behavior",
-    "questionTemplate": "What should happen in error or edge cases?",
-    "hint": "e.g., \"show error message\", \"redirect to login\", \"fail silently\"",
+    "questionTemplate": "Which failure conditions are explicitly in scope?",
     "required": false,
     "answerType": "text",
     "condition": "always"
@@ -43,8 +40,7 @@
   {
     "id": "data",
     "category": "data",
-    "questionTemplate": "What data needs to be stored or retrieved for this feature?",
-    "hint": "List the key fields/entities involved",
+    "questionTemplate": "Does this request require a confirmed data change? If yes, describe only the known data boundary.",
     "required": false,
     "answerType": "text",
     "condition": "data",
@@ -53,18 +49,10 @@
   {
     "id": "api_contract",
     "category": "constraints",
-    "questionTemplate": "Does this require a new API endpoint or changes to existing ones?",
+    "questionTemplate": "Does this request explicitly require an API contract change?",
     "required": false,
     "answerType": "yes-no",
     "condition": "api",
     "conditionKeywords": ["api", "endpoint"]
-  },
-  {
-    "id": "performance",
-    "category": "constraints",
-    "questionTemplate": "Are there performance requirements (response time, load, etc.)?",
-    "required": false,
-    "answerType": "text",
-    "condition": "always"
   }
 ]

package/dist/engine/cascade-hooks/registry.js

@@ -9,7 +9,6 @@ import { gitAutoStageHook } from './hooks/git-auto-stage.hook.js';
 import { velocityProfileHook } from './hooks/velocity-profile.hook.js';
 import { estimateCalibrationHook } from './hooks/estimate-calibration.hook.js';
 import { lessonDriftHook } from './hooks/lesson-drift.hook.js';
-import { livingSpecsHook } from './hooks/living-specs.hook.js';
 import { nextSpecResolverHook } from './hooks/next-spec-resolver.hook.js';
 import { orchestrationPlanHook } from './hooks/orchestration-plan.hook.js';
 import { completeLoopHook } from './hooks/complete-loop.hook.js';
@@ -38,7 +37,6 @@ export const HOOKS = Object.freeze([
     velocityProfileHook,
     estimateCalibrationHook,
     lessonDriftHook,
-    livingSpecsHook,
     nextSpecResolverHook,
     orchestrationPlanHook,
     completeLoopHook,

package/dist/engine/challenge-scenarios-loader.d.ts

@@ -6,15 +6,15 @@ export declare const ChallengeScenarioPatternSchema: z.ZodObject<{
     triggerKeywords: z.ZodArray<z.ZodString>;
     scenario: z.ZodString;
     probability: z.ZodEnum<{
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
     }>;
     impact: z.ZodEnum<{
+        critical: "critical";
+        high: "high";
         low: "low";
         medium: "medium";
-        high: "high";
-        critical: "critical";
     }>;
     handlingKeywords: z.ZodArray<z.ZodString>;
     handlingFound: z.ZodString;

package/dist/engine/compliance-injector.d.ts

@@ -5,11 +5,11 @@ export declare const ComplianceFrameworkDefSchema: z.ZodObject<{
     name: z.ZodString;
     fullName: z.ZodString;
     type: z.ZodEnum<{
-        security: "security";
-        testing: "testing";
-        quality: "quality";
         accessibility: "accessibility";
         privacy: "privacy";
+        quality: "quality";
+        security: "security";
+        testing: "testing";
     }>;
     regions: z.ZodArray<z.ZodString>;
     triggerKeywords: z.ZodArray<z.ZodString>;

package/dist/engine/dashboard/kanban-logic.d.ts

@@ -1,6 +1,6 @@
 import type { DashboardMetrics, DashboardSpecCard, ProjectHealthScore, SpecStatusUpdateResult, StatusTransitionMap } from '../../types/index.js';
 /** Ordered list of valid spec statuses */
-export declare const VALID_STATUSES: readonly ["draft", "review", "approved", "implementing", "done", "discarded"];
+export declare const VALID_STATUSES: readonly ['draft', 'review', 'approved', 'implementing', 'done', 'discarded'];
 /** Valid forward + one-step-back transitions */
 export declare const STATUS_TRANSITIONS: StatusTransitionMap;
 /** Check if a status string is a valid spec status */

package/dist/engine/doc-generator/portal/risk-matrix-svg.d.ts

@@ -1,5 +1,5 @@
 import type { SpecRisk, RiskCategory } from '../../../types/risk.js';
-declare const IMPACT_LEVELS: readonly ["low", "medium", "high", "very_high", "critical"];
+declare const IMPACT_LEVELS: readonly ['low', 'medium', 'high', 'very_high', 'critical'];
 declare const PROB_LEVELS: readonly [20, 40, 60, 80, 100];
 declare const CATEGORY_COLORS: Record<RiskCategory, string>;
 /**

package/dist/engine/doc-generator/proposal/proposal-generator.d.ts

@@ -1,6 +1,6 @@
 import type { ProposalData } from '../../../types/docs.js';
 /** Canonical section IDs for includeSections / excludeSections filtering. */
-export declare const SECTION_IDS: readonly ["hero", "executive-summary", "scope", "spec-breakdown", "timeline", "budget", "investment-summary", "architecture", "risk", "decisions", "impact-analysis", "gap-analysis", "team-resources", "pricing-methodology", "design-system", "quality-metrics", "living-spec", "assumptions", "alternatives", "post-launch", "module-mapping"];
+export declare const SECTION_IDS: readonly ['hero', 'executive-summary', 'scope', 'spec-breakdown', 'timeline', 'budget', 'investment-summary', 'architecture', 'risk', 'decisions', 'impact-analysis', 'gap-analysis', 'team-resources', 'pricing-methodology', 'design-system', 'quality-metrics', 'living-spec', 'assumptions', 'alternatives', 'post-launch', 'module-mapping'];
 /**
  * Generate a self-contained HTML proposal document.
  * All sections are conditional — empty string returned when data is insufficient.

package/dist/engine/elicitation/answer-extractor.d.ts

@@ -1,7 +1,4 @@
 import type { DescriptionSignals } from '../../types/index.js';
-/**
- * Scan a feature description for pre-existing answers.
- * Any signal set to true means the corresponding question can be suppressed.
- */
+/** Scan a feature description for explicit, affirmed request evidence. */
 export declare function extractSignals(description: string): DescriptionSignals;
 //# sourceMappingURL=answer-extractor.d.ts.map

package/dist/engine/elicitation/answer-extractor.js

@@ -1,96 +1,225 @@
 // src/engine/elicitation/answer-extractor.ts
-// SPEC-624: Extracts pre-existing answers from description to suppress redundant questions.
-const FRONTEND_TERMS = /\b(component|ui|page|css|style|layout|form|button|modal|dialog)\b/;
-const BACKEND_TERMS = /\b(api|endpoint|route|handler|migration|query|rpc|action|middleware)\b/;
-const INFRA_TERMS = /\b(deploy|ci|cd|docker|pipeline|config|env)\b/;
-const BILLING_TERMS = /\b(payment|billing|invoice|subscription|checkout|pricing|pay)\b/;
-const DATABASE_TERMS = /\b(database|schema|migration|table|query|sql|rls|rpc|persist|persistence|data access)\b/;
-const ACTION_RE = /\b(add|build|create|fix|update|remove|delete|integrate|sync|import|export|approve|reject|upload|download|migrate|configure|validate)\b\s+(?:(?:a|an|the|new)\s+)?([a-z0-9][a-z0-9 -]{1,60})/i;
-const ACTOR_TERMS = /\b(admin|administrator|manager|owner|customer|user|member|team|approver)\b/gi;
-const DATA_OBJECT_TERMS = /\b(account|profile|request|invoice|subscription|payment|order|report|file|avatar|table|policy|record|settings)\b/gi;
-const PERMISSION_TERMS = /\b(approval|approve|reject|admin|permission|role|rls|policy|access|auth|login|oauth|owner|manager)\b/;
-const DESTRUCTIVE_TERMS = /\b(delete|remove|archive|discard|drop|truncate|revoke|reset)\b/;
-const RISK_TERMS = /\b(approval|approve|payment|billing|auth|login|permission|role|delete|remove|migration|sync|webhook|external|api|rls|privacy|security)\b/gi;
-const PAYMENT_PROVIDERS = [
-    { name: 'Stripe', pattern: /\bstripe\b/ },
-    { name: 'PayPal', pattern: /\bpaypal\b/ },
-    { name: 'Paddle', pattern: /\bpaddle\b/ },
-    { name: 'Braintree', pattern: /\bbraintree\b/ },
-    { name: 'Square', pattern: /\bsquare\b/ },
-    { name: 'Adyen', pattern: /\badyen\b/ },
+// SPEC-624 / SPEC-1121: Extracts affirmed request evidence for contextual questions.
+const UI_TARGET_PATTERN = /\b(component|ui|page|css|style|layout|form|button|modal|dialog)\b/i;
+const TARGET_TERMS = [
+    ['frontend', UI_TARGET_PATTERN],
+    ['backend', /\b(endpoint|route|handler|middleware|controller|server action)\b/i],
+    [
+        'tooling',
+        /\b(compiler|typecheck|toolchain|typescript|build script|package alias|dependency|release guard)\b/i,
+    ],
+    ['infrastructure', /\b(deploy|ci|cd|docker|pipeline|configuration|environment)\b/i],
 ];
-/**
- * Scan a feature description for pre-existing answers.
- * Any signal set to true means the corresponding question can be suppressed.
- */
+const BILLING_TERMS = [
+    ['payment', /\bpayments?\b/i],
+    ['billing', /\bbilling\b/i],
+    ['invoice', /\binvoices?\b/i],
+    ['subscription', /\bsubscriptions?\b/i],
+    ['checkout', /\bcheckout\b/i],
+    ['pricing', /\bpricing\b/i],
+];
+const DATABASE_TERMS = [
+    ['database', /\bdatabases?\b/i],
+    ['schema', /\bschemas?\b/i],
+    ['table', /\btables?\b/i],
+    ['sql', /\bsql\b/i],
+    ['rls', /\brls\b/i],
+    ['persistence', /\b(?:persist|persists|persisted|persistence|data access)\b/i],
+    ['data-migration', /\b(?:database|schema|table)\s+migrations?\b|\bmigrate\s+(?:a\s+)?table\b/i],
+];
+const ACTOR_TERMS = [
+    ['admin', /\b(?:admin|administrator)\b/i],
+    ['manager', /\bmanager\b/i],
+    ['owner', /\bowner\b/i],
+    ['customer', /\bcustomer\b/i],
+    ['user', /\buser\b/i],
+    ['member', /\bmember\b/i],
+    ['team', /\bteam\b/i],
+    ['approver', /\bapprover\b/i],
+];
+const DATA_OBJECT_TERMS = [
+    ['account', /\baccounts?\b/i],
+    ['profile', /\bprofiles?\b/i],
+    ['request', /\brequests?\b/i],
+    ['invoice', /\binvoices?\b/i],
+    ['subscription', /\bsubscriptions?\b/i],
+    ['payment', /\bpayments?\b/i],
+    ['order', /\borders?\b/i],
+    ['report', /\breports?\b/i],
+    ['file', /\bfiles?\b/i],
+    ['avatar', /\bavatars?\b/i],
+    ['table', /\btables?\b/i],
+    ['policy', /\bpolic(?:y|ies)\b/i],
+    ['record', /\brecords?\b/i],
+    ['settings', /\bsettings\b/i],
+];
+const PERMISSION_TERMS = [
+    ['approval', /\b(?:approval|approve|approves|reject|rejects)\b/i],
+    ['authorization', /\b(?:authorization|permission|role|rbac|access control)\b/i],
+    ['authentication', /\b(?:auth|authentication|login|oauth)\b/i],
+    ['ownership', /\b(?:owner|allowed to|who can)\b/i],
+];
+const DESTRUCTIVE_TERMS = [
+    ['delete', /\b(?:delete|remove|archive|discard|drop|truncate|revoke|reset)\b/i],
+];
+const RISK_TERMS = [
+    ...BILLING_TERMS,
+    ...PERMISSION_TERMS,
+    ['delete', /\b(?:delete|remove|archive|discard|drop|truncate|revoke|reset)\b/i],
+    ['sync', /\bsync(?:hronize)?\b/i],
+    ['webhook', /\bwebhooks?\b/i],
+    ['external', /\b(?:external|third-party|remote)\b/i],
+    ['privacy', /\bprivacy\b/i],
+    ['security', /\bsecurity\b/i],
+];
+const ACTION_RE = /\b(add|adopt|build|create|fix|update|upgrade|replace|remove|delete|integrate|sync|import|export|approve|reject|upload|download|migrate|configure|validate|verify|retain|preserve)\b\s+(?:(?:a|an|the|new)\s+)?([a-z0-9][a-z0-9 -]{1,60})/i;
+const NEGATION_RE = /\b(?:no|not|never|without|exclude|excludes|excluding|neither|nor|do not|does not|don't|doesn't|must not|should not|isn't|aren't|non-goal)\b|\bout[- ]of[- ]scope\b/i;
+const EXAMPLE_RE = /\b(?:example|examples|for example|e\.g\.|such as)\b/i;
+const TEST_PROSE_RE = /\b(?:test|tests|tested|testing|fixture|fixtures|assert|assertion|coverage|regression)\b/i;
+const INTERNAL_API_CONTEXT_RE = /\b(?:compiler|programmatic|package|library|ast|type(?:script)?|declaration)\s+api\b|\bapi\s+(?:compatibility|surface)\b/i;
+const GENERIC_CANDIDATES = new Set([
+    'api',
+    'billing',
+    'checkout',
+    'integration',
+    'payment',
+    'provider',
+    'sdk',
+    'system',
+]);
+/** Scan a feature description for explicit, affirmed request evidence. */
 export function extractSignals(description) {
-    const lower = stripIncidentalReferences(description.toLowerCase());
-    const hasTarget = FRONTEND_TERMS.test(lower) || BACKEND_TERMS.test(lower) || INFRA_TERMS.test(lower);
-    const hasDatabase = DATABASE_TERMS.test(lower);
-    const hasUi = FRONTEND_TERMS.test(lower);
-    let namedProvider = null;
-    for (const { name, pattern } of PAYMENT_PROVIDERS) {
-        if (pattern.test(lower)) {
-            namedProvider = name;
-            break;
-        }
-    }
-    // hasBilling: billing/payment keywords OR a specific provider was named
-    const hasBilling = BILLING_TERMS.test(lower) || namedProvider !== null;
-    const wordCount = description.trim().split(/\s+/).length;
-    const hasScope = wordCount >= 10;
+    const cleaned = stripIncidentalReferences(description);
+    const segments = splitSegments(cleaned);
+    const targetTerms = collectAffirmedTerms(segments, TARGET_TERMS);
+    const billingTerms = collectAffirmedTerms(segments, BILLING_TERMS);
+    const databaseTerms = collectAffirmedTerms(segments, DATABASE_TERMS);
+    const permissionTerms = collectAffirmedTerms(segments, PERMISSION_TERMS);
+    const integrations = extractExternalIntegrations(segments);
+    const namedProvider = extractNamedBillingCandidate(segments);
+    const lower = cleaned.toLowerCase();
     const actionMatch = ACTION_RE.exec(lower);
     const action = actionMatch?.[1] ?? null;
     const domainObject = cleanDomainObject(actionMatch?.[2] ?? null);
-    const actors = uniqueMatches(lower, ACTOR_TERMS);
-    const dataObjects = uniqueMatches(lower, DATA_OBJECT_TERMS);
-    const riskTerms = uniqueMatches(lower, RISK_TERMS);
-    const integrations = [
-        ...PAYMENT_PROVIDERS.filter(({ pattern }) => pattern.test(lower)).map(({ name }) => name),
-        ...extractExternalIntegrations(lower),
-    ];
-    const hasPermissionRisk = PERMISSION_TERMS.test(lower);
-    const hasDestructiveAction = DESTRUCTIVE_TERMS.test(lower);
+    const wordCount = description.trim().split(/\s+/).filter(Boolean).length;
     return {
-        hasTarget,
-        hasBilling,
-        hasDatabase,
-        hasUi,
+        hasTarget: targetTerms.length > 0,
+        hasBilling: billingTerms.length > 0 || namedProvider !== null,
+        hasDatabase: databaseTerms.length > 0,
+        hasUi: segments.some((segment) => hasAffirmedMatch(segment, UI_TARGET_PATTERN)),
         namedProvider,
-        hasScope,
+        hasScope: wordCount >= 10,
         action,
         domainObject,
-        actors,
+        actors: collectAffirmedTerms(segments, ACTOR_TERMS),
         integrations,
-        dataObjects,
-        hasPermissionRisk,
-        hasDestructiveAction,
-        riskTerms,
+        dataObjects: collectAffirmedTerms(segments, DATA_OBJECT_TERMS),
+        hasPermissionRisk: permissionTerms.length > 0,
+        hasDestructiveAction: collectAffirmedTerms(segments, DESTRUCTIVE_TERMS).length > 0,
+        riskTerms: collectAffirmedTerms(segments, RISK_TERMS),
     };
 }
 function stripIncidentalReferences(description) {
     return description
-        .replace(/`[^`]*(?:\/|\.\w{1,8})[^`]*`/g, ' ')
-        .replace(/\b\S+\/\S+\b/g, ' ')
-        .replace(/\b[\w-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|css|scss|py|go|rs|java|rb|php)\b/g, ' ');
+        .replace(/```[\s\S]*?```/g, ' ')
+        .replace(/`[^`]+`/g, ' ')
+        .replace(/\[[^\]]*\]\([^)]*\)/g, ' ')
+        .replace(/https?:\/\/\S+/gi, ' ')
+        .replace(/\B@[\w.-]+\/[\w.-]+(?:@[\w.-]+)?/g, ' ')
+        .replace(/\b[\w.-]+\/[\w./-]+\b/g, ' ')
+        .replace(/\b[\w-]+\.(?:ts|tsx|js|jsx|mjs|cjs|json|md|css|scss|py|go|rs|java|rb|php)\b/gi, ' ')
+        .replace(/\b[a-z0-9]+(?:-[a-z0-9]+)+(?:@[^\s,;]+)?\b/gi, ' ');
+}
+function splitSegments(description) {
+    return description
+        .split(/(?:\r?\n|[.;!?]+)\s*/)
+        .map((segment) => segment.replace(/^\s*(?:[-*]|\d+[.)])\s*/, '').trim())
+        .filter(Boolean);
+}
+function collectAffirmedTerms(segments, definitions) {
+    const found = [];
+    for (const [name, pattern] of definitions) {
+        if (segments.some((segment) => hasAffirmedMatch(segment, pattern))) {
+            found.push(name);
+        }
+    }
+    return found;
+}
+function hasAffirmedMatch(segment, pattern) {
+    const flags = pattern.flags.replace('g', '');
+    const match = new RegExp(pattern.source, flags).exec(segment);
+    if (!match) {
+        return false;
+    }
+    const prefix = segment.slice(0, match.index);
+    if (NEGATION_RE.test(prefix) || EXAMPLE_RE.test(prefix) || TEST_PROSE_RE.test(prefix)) {
+        return false;
+    }
+    const matchedText = match[0].toLowerCase();
+    if (matchedText === 'api' && INTERNAL_API_CONTEXT_RE.test(segment)) {
+        return false;
+    }
+    return true;
 }
 function cleanDomainObject(value) {
     if (value === null) {
         return null;
     }
     const cleaned = value
-        .replace(/\b(that|with|to|from|when|where|and|or|but|using|in)\b.*$/i, '')
+        .replace(/\b(that|with|to|from|when|where|and|or|but|using|in|while)\b.*$/i, '')
         .replace(/\s+/g, ' ')
         .trim();
     return cleaned.length > 0 ? cleaned : null;
 }
-function uniqueMatches(text, pattern) {
-    const flags = pattern.flags.includes('g') ? pattern.flags : `${pattern.flags}g`;
-    const globalPattern = new RegExp(pattern.source, flags);
-    return Array.from(new Set(Array.from(text.matchAll(globalPattern)).map((match) => match[0])));
+function extractNamedBillingCandidate(segments) {
+    for (const segment of segments) {
+        if (!BILLING_TERMS.some(([, pattern]) => hasAffirmedMatch(segment, pattern))) {
+            continue;
+        }
+        const candidate = extractCandidate(segment, [
+            /\b(?:integrate|use|using|via|with)\s+(?:with\s+)?([a-z][a-z0-9-]{1,40})\b/i,
+            /\bprovider\s*(?:is|:)\s*([a-z][a-z0-9-]{1,40})\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:payment|billing|checkout)\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:payment|billing|checkout)\s+(?:api|sdk|integration|provider)\b/i,
+        ]);
+        if (candidate !== null) {
+            return normalizeCandidate(candidate);
+        }
+    }
+    return null;
+}
+function extractExternalIntegrations(segments) {
+    const integrations = [];
+    for (const segment of segments) {
+        if (INTERNAL_API_CONTEXT_RE.test(segment)) {
+            continue;
+        }
+        const candidate = extractCandidate(segment, [
+            /\b(?:integrate|integration with|sync|sync with)\s+(?:with\s+)?([a-z][a-z0-9-]{1,40})\b/i,
+            /\b([a-z][a-z0-9-]{1,40})\s+(?:api|webhook|sdk|integration)\b/i,
+        ]);
+        if (candidate !== null && isAffirmedCandidate(segment, candidate)) {
+            integrations.push(normalizeCandidate(candidate));
+        }
+    }
+    return Array.from(new Set(integrations));
+}
+function extractCandidate(segment, patterns) {
+    for (const pattern of patterns) {
+        const match = pattern.exec(segment);
+        const candidate = match?.[1];
+        if (candidate && !GENERIC_CANDIDATES.has(candidate.toLowerCase())) {
+            return candidate;
+        }
+    }
+    return null;
+}
+function isAffirmedCandidate(segment, candidate) {
+    const index = segment.toLowerCase().indexOf(candidate.toLowerCase());
+    const prefix = index < 0 ? segment : segment.slice(0, index);
+    return !NEGATION_RE.test(prefix) && !EXAMPLE_RE.test(prefix) && !TEST_PROSE_RE.test(prefix);
 }
-function extractExternalIntegrations(text) {
-    const matches = text.match(/\b([a-z][a-z0-9-]+)\s+(?:api|webhook|sdk|integration)\b/gi) ?? [];
-    return Array.from(new Set(matches.map((match) => match.replace(/\s+(api|webhook|sdk|integration)$/i, ''))));
+function normalizeCandidate(candidate) {
+    return candidate.charAt(0).toUpperCase() + candidate.slice(1);
 }
 //# sourceMappingURL=answer-extractor.js.map