@planu/cli 4.12.3 → 4.14.1

package/dist/storage/storybook-store.js

@@ -1,9 +1,9 @@
 // storage/storybook-store.ts — Persistence for Storybook component catalog (SPEC-432)
 import { join } from 'node:path';
-import { hashProjectPath, readJson, writeJson } from './base-store.js';
+import { hashProjectPath, projectDataDir, readJson, writeJson } from './base-store.js';
 function storybookPath(projectPath) {
     const id = hashProjectPath(projectPath);
-    return join('data', 'projects', id, 'storybook-components.json');
+    return join(projectDataDir(id), 'storybook-components.json');
 }
 export async function getStorybookComponents(projectPath) {
     const filePath = storybookPath(projectPath);

package/dist/storage/supabase-store.js

@@ -1,11 +1,12 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../engine/technology-registry.js';
 // storage/supabase-store.ts — Supabase integration persistence (SPEC-437)
 import { join } from 'node:path';
-import { hashProjectPath, readJson, writeJson } from './base-store.js';
+import { hashProjectPath, projectDataDir, readJson, writeJson } from './base-store.js';
+import { resolveSecretField, storeSecretField } from '../security/secret-field.js';
+import { writeSecureJson } from '../security/secure-json.js';
 function projectDir(projectPath) {
     const id = hashProjectPath(projectPath);
-    return join('data', 'projects', id, 'supabase');
+    return join(projectDataDir(id), technologyValue('technology-supabase-4d7594'));
 }
 function configPath(projectPath) {
     return join(projectDir(projectPath), 'config.json');
@@ -14,10 +15,27 @@ function syncPath(projectPath) {
     return join(projectDir(projectPath), 'sync.json');
 }
 export async function getSupabaseConfig(projectPath) {
-    return readJson(configPath(projectPath), null);
+    const config = await readJson(configPath(projectPath), null);
+    if (!config) {
+        return null;
+    }
+    return {
+        ...config,
+        serviceRoleKey: await resolveSecretField(config.serviceRoleKey),
+        ...(config.anonKey ? { anonKey: await resolveSecretField(config.anonKey) } : {}),
+    };
 }
 export async function saveSupabaseConfig(projectPath, config) {
-    await writeJson(configPath(projectPath), config);
+    const id = hashProjectPath(projectPath);
+    const serviceRoleKey = await storeSecretField(`${id}/supabase/service-role`, 'supabase-service-role', config.serviceRoleKey);
+    const anonKey = config.anonKey
+        ? await storeSecretField(`${id}/supabase/anon`, 'supabase-anon', config.anonKey)
+        : undefined;
+    await writeSecureJson(configPath(projectPath), {
+        ...config,
+        serviceRoleKey,
+        ...(anonKey ? { anonKey } : {}),
+    });
 }
 export async function getSupabaseSyncResult(projectPath) {
     return readJson(syncPath(projectPath), null);

package/dist/storage/tdd-policy-store.js

@@ -1,8 +1,7 @@
 // SPEC-452 — TDD Policy persistence
 import { readFile, writeFile, mkdir } from 'node:fs/promises';
 import { join } from 'node:path';
-import { safeJsonParse } from './base-store.js';
-const DATA_DIR = 'data/projects';
+import { projectDataDir, safeJsonParse } from './base-store.js';
 const FILE_NAME = 'tdd-policy.json';
 const DEFAULT_POLICY = {
     mode: 'soft',
@@ -10,17 +9,20 @@ const DEFAULT_POLICY = {
     requireEdgeTests: false,
 };
 export async function getTddPolicy(projectId) {
-    const filePath = join(DATA_DIR, projectId, FILE_NAME);
+    const filePath = join(projectDataDir(projectId), FILE_NAME);
     try {
         const raw = await readFile(filePath, 'utf-8');
         return { ...DEFAULT_POLICY, ...safeJsonParse(raw, {}) };
     }
-    catch {
-        return { ...DEFAULT_POLICY };
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return { ...DEFAULT_POLICY };
+        }
+        throw error;
     }
 }
 export async function saveTddPolicy(projectId, policy) {
-    const dir = join(DATA_DIR, projectId);
+    const dir = projectDataDir(projectId);
     await mkdir(dir, { recursive: true });
     await writeFile(join(dir, FILE_NAME), JSON.stringify(policy, null, 2), 'utf-8');
 }

package/dist/storage/tech-debt-store.js

@@ -1,12 +1,12 @@
-import { readJson, writeJson, hashProjectPath } from './base-store.js';
+import { readJson, writeJson, hashProjectPath, projectDataDir } from './base-store.js';
 import { withFileLock } from './file-mutex.js';
 function debtFile(projectPath) {
     const hash = hashProjectPath(projectPath);
-    return `data/projects/${hash}/tech-debt.json`;
+    return `${projectDataDir(hash)}/tech-debt.json`;
 }
 function configFile(projectPath) {
     const hash = hashProjectPath(projectPath);
-    return `data/projects/${hash}/tech-debt-config.json`;
+    return `${projectDataDir(hash)}/tech-debt-config.json`;
 }
 /** Load all tech debt items for a project. */
 export async function loadTechDebt(projectPath) {

package/dist/storage/technology-selection-store.d.ts

@@ -1,5 +1,5 @@
 import type { TechnologySelectionContract } from '../types/index.js';
-export declare const TECHNOLOGY_SELECTION_RELATIVE_PATH = ".planu/technology-selection.json";
+export declare const TECHNOLOGY_SELECTION_RELATIVE_PATH = "planu/technology-selection.json";
 export declare function readTechnologySelectionContract(projectPath: string): Promise<TechnologySelectionContract | null>;
 export declare function writeTechnologySelectionContract(projectPath: string, contract: TechnologySelectionContract): Promise<void>;
 //# sourceMappingURL=technology-selection-store.d.ts.map

package/dist/storage/technology-selection-store.js

@@ -4,7 +4,7 @@ import { dirname, join } from 'node:path';
 import { writeJsonSafe } from '../engine/safety/atomic-writer.js';
 import { safeJsonParse } from './base-store.js';
 import { withFileLock } from './file-mutex.js';
-export const TECHNOLOGY_SELECTION_RELATIVE_PATH = '.planu/technology-selection.json';
+export const TECHNOLOGY_SELECTION_RELATIVE_PATH = 'planu/technology-selection.json';
 function contractPath(projectPath) {
     return join(projectPath, TECHNOLOGY_SELECTION_RELATIVE_PATH);
 }
@@ -30,8 +30,11 @@ export async function readTechnologySelectionContract(projectPath) {
         const parsed = safeJsonParse(raw, null);
         return isTechnologySelectionContract(parsed) ? parsed : null;
     }
-    catch {
-        return null;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
     }
 }
 export async function writeTechnologySelectionContract(projectPath, contract) {

package/dist/storage/token-cache-store.js

@@ -21,13 +21,13 @@ export function loadTokenCache(projectHash, dataDir) {
         const raw = readFileSync(filePath, 'utf-8');
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
-            return [];
+            throw new TypeError('Token cache root must be an array.');
         }
         const now = Date.now();
         return parsed.filter((entry) => typeof entry.expiresAt === 'number' && entry.expiresAt > now);
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new Error(`Token cache is corrupt: ${filePath}`, { cause: error });
     }
 }
 /**

package/dist/storage/token-ledger-store.js

@@ -1,6 +1,7 @@
 // storage/token-ledger-store.ts — Token usage ledger persistence (SPEC-182)
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
 import { withFileLock } from './file-mutex.js';
 const MAX_FILE_SIZE_MB = 10;
 const ROTATION_MONTHS = 6;
@@ -75,8 +76,8 @@ function readMonthFile(filePath) {
         }
         return parsed;
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new Error(`Token ledger is corrupt: ${filePath}`, { cause: error });
     }
 }
 function writeMonthFile(filePath, entries) {
@@ -229,8 +230,11 @@ function listAvailableMonths(projectHash, dataDir) {
             .map((f) => f.slice(0, 7))
             .sort();
     }
-    catch {
-        return [];
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
     }
 }
 // ---------------------------------------------------------------------------
@@ -327,8 +331,9 @@ export async function rotateLedger(projectHash, dataDir) {
             try {
                 writeFileSync(filePath, '[]', 'utf-8');
             }
-            catch {
-                // ignore
+            catch (error) {
+                // reliability-cleanup: ARCHIVED_LEDGER_TRUNCATE — archive remains authoritative
+                reportClassifiedDegradation('ARCHIVED_LEDGER_TRUNCATE', error);
             }
         }
         writeFileSync(summaryPath, JSON.stringify(existing, null, 2), 'utf-8');
@@ -347,8 +352,8 @@ function readSummary(summaryPath) {
         }
         return parsed;
     }
-    catch {
-        return {};
+    catch (error) {
+        throw new Error(`Token aggregation is corrupt: ${summaryPath}`, { cause: error });
     }
 }
 //# sourceMappingURL=token-ledger-store.js.map

package/dist/storage/transition-log.js

@@ -8,6 +8,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { appendFile, readFile, mkdir } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { projectDataDir } from './base-store.js';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
 // ---------------------------------------------------------------------------
 // Path helper
 // ---------------------------------------------------------------------------
@@ -63,8 +64,8 @@ async function doAppend(filePath, input) {
             const parsed = JSON.parse(lastLine);
             prevSha = typeof parsed.sha === 'string' ? parsed.sha : '';
         }
-        catch {
-            prevSha = '';
+        catch (error) {
+            throw new Error(`Transition log chain tail is corrupt: ${filePath}`, { cause: error });
         }
     }
     const partial = {
@@ -121,8 +122,10 @@ export async function readTransitionLog(projectId, specId) {
                 entries.push(entry);
             }
         }
-        catch {
-            // skip malformed lines
+        catch (error) {
+            // reliability-compat: MALFORMED_TRANSITION_LINE — skip malformed historical lines
+            reportClassifiedDegradation('MALFORMED_TRANSITION_LINE', error);
+            continue;
         }
     }
     return entries;

package/dist/storage/trash-store.js

@@ -169,8 +169,11 @@ export async function countFiles(dirPath) {
         }
         return count;
     }
-    catch {
-        return 0;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 0;
+        }
+        throw error;
     }
 }
 /**
@@ -181,8 +184,11 @@ export async function pathExists(p) {
         await stat(p);
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return false;
+        }
+        throw error;
     }
 }
 // ---------------------------------------------------------------------------
@@ -207,8 +213,11 @@ export async function getDirSize(dirPath) {
         }
         return total;
     }
-    catch {
-        return 0;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 0;
+        }
+        throw error;
     }
 }
 /**

package/dist/storage/vector-store/migrator.js

@@ -3,6 +3,7 @@
 import { readJson, projectDataDir } from '../base-store.js';
 import { existsSync } from 'node:fs';
 import { TFIDFEngine } from '../../engine/vector-store/tfidf.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 /** Check if a migration marker exists (idempotency). */
 function migrationMarkerPath(projectId) {
     return `${projectDataDir(projectId)}/.vector-migrated`;
@@ -103,7 +104,9 @@ export async function migrateJsonToBackend(projectId, backend) {
             allTexts.push(...items);
         }
         catch (err) {
-            errors.push(err instanceof Error ? err.message : String(err));
+            // reliability-optional: VECTOR_MIGRATION_SOURCE — result reports partial migration
+            reportClassifiedDegradation('VECTOR_MIGRATION_SOURCE', err);
+            errors.push('A migration source could not be loaded.');
         }
     }
     // Build IDF from all texts
@@ -129,7 +132,9 @@ export async function migrateJsonToBackend(projectId, backend) {
             processed++;
         }
         catch (err) {
-            errors.push(`${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+            // reliability-optional: VECTOR_MIGRATION_ENTRY — result reports partial migration
+            reportClassifiedDegradation('VECTOR_MIGRATION_ENTRY', err);
+            errors.push(`${item.id}: migration failed`);
         }
     }
     await markMigrated(projectId);

package/dist/storage/vector-store/sqlite-adapter.js

@@ -4,6 +4,7 @@ import { cosineSimilarity } from '../../engine/vector-store/similarity.js';
 import { projectDataDir, safeJsonParse } from '../base-store.js';
 import { mkdirSync, existsSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 /**
  * Attempt to dynamically import better-sqlite3.
  * Returns null if the package is not installed.
@@ -17,7 +18,9 @@ export async function tryLoadSqlite() {
         return mod.default;
         /* v8 ignore stop */
     }
-    catch {
+    catch (error) {
+        // reliability-optional: SQLITE_OPTIONAL_DRIVER — JSON backend remains available
+        reportClassifiedDegradation('SQLITE_OPTIONAL_DRIVER', error);
         return null;
     }
 }

package/dist/storage/webhook-server-store.js

@@ -1,7 +1,7 @@
 // storage/webhook-server-store.ts — Incoming webhook server config persistence (SPEC-359)
 import { join } from 'node:path';
-import { readJson, writeJson } from './base-store.js';
-const GLOBAL_CONFIG_PATH = join('data', 'global', 'webhook-server.json');
+import { globalDataDir, readJson, writeJson } from './base-store.js';
+const GLOBAL_CONFIG_PATH = join(globalDataDir(), 'webhook-server.json');
 export async function getWebhookServerConfig() {
     return readJson(GLOBAL_CONFIG_PATH, null);
 }

package/dist/tools/api-spec-generator-handler.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../engine/technology-registry.js';
 // tools/api-spec-generator-handler.ts — generate_spec_from_api tool handler (SPEC-286)
 import { readFile } from 'node:fs/promises';
 import { parseOpenApi } from '../engine/api-spec-generator/openapi-parser.js';
@@ -14,7 +15,7 @@ function detectContractType(content) {
     }
     // GraphQL SDL typically has type/schema/query keywords
     if (/\btype\s+\w+\s*\{/.test(trimmed) || /\bschema\s*\{/.test(trimmed)) {
-        return 'graphql';
+        return technologyValue('technology-graphql-aed31c');
     }
     // Fallback: attempt JSON parse
     try {
@@ -22,7 +23,7 @@ function detectContractType(content) {
         return 'openapi';
     }
     catch {
-        return 'graphql';
+        return technologyValue('technology-graphql-aed31c');
     }
 }
 function groupByEndpoint(contract) {

package/dist/tools/auto-update-handler.d.ts

@@ -13,7 +13,7 @@ export interface PinVersionInput {
  */
 export declare function handleCheckUpdateStatus(): Promise<ToolResult>;
 /**
- * Enables auto-update by switching the MCP config to npx @planu/cli@latest.
+ * Resolves a verified release and pins the MCP config to that exact version.
  * Free tool — always benefits the user.
  */
 export declare function handleEnableAutoUpdate(args: EnableAutoUpdateInput): Promise<ToolResult>;

package/dist/tools/auto-update-handler.js

@@ -19,7 +19,7 @@ export async function handleCheckUpdateStatus() {
     }
 }
 /**
- * Enables auto-update by switching the MCP config to npx @planu/cli@latest.
+ * Resolves a verified release and pins the MCP config to that exact version.
  * Free tool — always benefits the user.
  */
 export async function handleEnableAutoUpdate(args) {

package/dist/tools/browser-validate-handler.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../engine/technology-registry.js';
 // tools/browser-validate-handler.ts — SPEC-308: Browser validation tool handler
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
@@ -31,7 +32,7 @@ function parsePlaywrightOutput(output) {
 /** Run playwright tests against a saved test file. */
 async function runPlaywrightTests(testFilePath) {
     try {
-        const { stdout, stderr } = await execFileAsync('npx', ['playwright', 'test', testFilePath, '--reporter=line'], { timeout: 60_000 });
+        const { stdout, stderr } = await execFileAsync('npx', [technologyValue('technology-playwright-7827e8'), 'test', testFilePath, '--reporter=line'], { timeout: 60_000 });
         return parsePlaywrightOutput(stdout + stderr);
     }
     catch (err) {

package/dist/tools/challenge-spec/platform-challenge-scenarios-b.js

@@ -1,7 +1,4 @@
-// tools/challenge-spec/platform-challenge-scenarios-b.ts
-// SPEC-015b: Advanced challenge scenarios for bots, Web3, ML, data pipelines, IaC, and IoT
-// Bot + Web3 scenarios: platform-challenge-scenarios-b1.ts
-// ML + IaC + IoT scenarios: platform-challenge-scenarios-b2.ts
+import { technologyValue } from '../../engine/technology-registry.js';
 import { buildBotAdvancedChallenges, buildWeb3AdvancedChallenges, } from './platform-challenge-scenarios-b1.js';
 import { buildMLAdvancedChallenges, buildIaCAdvancedChallenges, buildIoTAdvancedChallenges, } from './platform-challenge-scenarios-b2.js';
 // === Public API ===
@@ -22,7 +19,13 @@ export function getAdvancedPlatformChallenges(spec, content, knowledge) {
         stack.some((s) => ['discord.js', 'telegraf', 'grammy', '@slack/bolt'].includes(s));
     const isML = category === 'ml' ||
         stack.some((s) => ['pytorch', 'tensorflow', 'sklearn', 'langchain', 'transformers'].includes(s));
-    const isIaC = stack.some((s) => ['terraform', 'pulumi', 'cdk', 'ansible', 'cloudformation'].includes(s));
+    const isIaC = stack.some((s) => [
+        technologyValue('technology-terraform-94dc3e'),
+        'pulumi',
+        'cdk',
+        'ansible',
+        'cloudformation',
+    ].includes(s));
     const isIoT = category === 'iot' ||
         stack.some((s) => ['platformio', 'arduino', 'zephyr', 'esp32', 'raspberry-pi'].includes(s));
     if (isBot) {

package/dist/tools/challenge-spec/scenarios-desktop.js

@@ -1,5 +1,4 @@
-// tools/challenge-spec/scenarios-desktop.ts — Desktop auto-update edge case scenarios
-// SPEC-014b: interrupted download, permission issues, version regression, update during close.
+import { technologyValue } from '../../engine/technology-registry.js';
 import { contentMentions } from './scenarios-utils.js';
 /**
  * Generate desktop auto-update edge case scenarios.
@@ -8,7 +7,13 @@ import { contentMentions } from './scenarios-utils.js';
 export function generateDesktopAutoUpdateChallenges(_spec, specContent, knowledge) {
     const lower = specContent.toLowerCase();
     const isDesktop = knowledge.projectCategory === 'desktop' ||
-        contentMentions(lower, ['electron', 'tauri', 'auto-update', 'autoupdate', 'electron-updater']);
+        contentMentions(lower, [
+            technologyValue('technology-electron-88b1de'),
+            'tauri',
+            'auto-update',
+            'autoupdate',
+            'electron-updater',
+        ]);
     if (!isDesktop) {
         return [];
     }

package/dist/tools/challenge-spec/scenarios-failure.js

@@ -1,4 +1,4 @@
-// tools/challenge-spec/scenarios-failure.ts — Network, database, and resource failure scenarios
+import { technologyValue } from '../../engine/technology-registry.js';
 import { contentMentions, detectChallengeCapabilities } from './scenarios-utils.js';
 export function generateFailureScenarios(spec, content, _knowledge) {
     const scenarios = [];
@@ -46,7 +46,12 @@ export function generateFailureScenarios(spec, content, _knowledge) {
             scenario: 'Malformed or oversized input data',
             probability: 'high',
             impact: 'medium',
-            currentHandling: contentMentions(content, ['validat', 'sanitiz', 'schema', 'zod'])
+            currentHandling: contentMentions(content, [
+                'validat',
+                'sanitiz',
+                'schema',
+                technologyValue('technology-zod-4f63cf'),
+            ])
                 ? 'Validation mentioned in spec'
                 : 'Not explicitly addressed',
             requiredHandling: 'Validate input at the declared boundary and define payload limits.',

package/dist/tools/challenge-spec/security-challenge-scenarios.js

@@ -1,5 +1,4 @@
-// tools/challenge-spec/security-challenge-scenarios.ts — Security challenges for challenge_spec
-// SPEC-029 criteria 11, 24: authorization challenges and STRIDE-based challenges
+import { technologyValue } from '../../engine/technology-registry.js';
 import { detectSecurityProfiles } from '../../engine/security-analyzer.js';
 import { hasAnyAffirmedMatch } from './scenarios-utils.js';
 /**
@@ -106,7 +105,8 @@ export function generateSecurityTestCases(spec, framework) {
     }
     lines.push(`// Security tests for ${spec.title}`);
     lines.push('');
-    if (framework === 'jest' || framework === 'vitest') {
+    if (framework === technologyValue('technology-jest-35e99f') ||
+        framework === technologyValue('technology-vitest-a9127f')) {
         lines.push(`describe('Security: ${spec.title}', () => {`);
         lines.push(`  it('returns 401 when no authentication token is provided', async () => {`);
         lines.push(`    // Test unauthenticated access — expect 401`);