@planu/cli 4.13.0 → 4.14.1

package/dist/engine/multi-agent-review/security-analyzer.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // Planu — Security Analyzer (SPEC-483)
 // Rule-based analyzer: hardcoded secrets, missing Zod validation, dangerous APIs, OWASP markers.
 import { readFile, readdir } from 'node:fs/promises';
@@ -186,7 +187,8 @@ async function analyzeFile(filePath, root) {
         }
     });
     // Input validation: tool files that do not import zod
-    if ((rel.startsWith('src/tools/') || rel.includes('/tools/')) && !content.includes('zod')) {
+    if ((rel.startsWith('src/tools/') || rel.includes('/tools/')) &&
+        !content.includes(technologyValue('technology-zod-4f63cf'))) {
         findings.push({
             severity: 'medium',
             file: rel,

package/dist/engine/multi-app-detector/app-type.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../technology-registry.js';
 // Planu — Multi-app detector: app type inference helpers
 import { basename } from 'node:path';
 const DIR_TYPE_MAP = [
@@ -35,14 +34,14 @@ export function inferAppType(framework, appPath) {
 }
 export function isFrontendFramework(fw) {
     return [
-        'react',
-        'vue',
-        'angular',
-        'svelte',
-        'next.js',
-        'nuxt',
-        'astro',
-        'remix',
+        technologyValue('technology-react-275976'),
+        technologyValue('technology-vue-564382'),
+        technologyValue('technology-angular-a39f89'),
+        technologyValue('technology-svelte-c190ac'),
+        technologyValue('technology-next-js-0d857f'),
+        technologyValue('technology-nuxt-22c407'),
+        technologyValue('technology-astro-23661e'),
+        technologyValue('technology-remix-0c5d96'),
         'solidjs',
         'qwik',
         'gatsby',
@@ -51,19 +50,19 @@ export function isFrontendFramework(fw) {
 }
 export function isBackendFramework(fw) {
     return [
-        'express',
-        'fastapi',
-        'django',
-        'flask',
-        'gin',
-        'laravel',
+        technologyValue('technology-express-008231'),
+        technologyValue('technology-fastapi-6aee0e'),
+        technologyValue('technology-django-7d8a08'),
+        technologyValue('technology-flask-b87aa5'),
+        technologyValue('technology-gin-985adc'),
+        technologyValue('technology-laravel-c34cfa'),
         'spring',
-        'rails',
-        'nestjs',
+        technologyValue('technology-rails-2e1d59'),
+        technologyValue('technology-nestjs-2d0087'),
         'hono',
         'elysia',
-        'actix-web',
-        'axum',
+        technologyValue('technology-actix-web-ab3e35'),
+        technologyValue('technology-axum-af7119'),
         'phoenix',
         'ktor',
         'symfony',
@@ -71,6 +70,12 @@ export function isBackendFramework(fw) {
     ].includes(fw);
 }
 export function isMobileFramework(fw) {
-    return ['react-native', 'expo', 'flutter', 'swiftui', 'jetpack-compose'].includes(fw);
+    return [
+        'react-native',
+        'expo',
+        technologyValue('technology-flutter-be1396'),
+        technologyValue('technology-swiftui-b63400'),
+        'jetpack-compose',
+    ].includes(fw);
 }
 //# sourceMappingURL=app-type.js.map

package/dist/engine/multi-app-detector/core.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // Planu — Multi-app, monorepo, and API contract detection: core logic
 import { readdir } from 'node:fs/promises';
 import { join, basename } from 'node:path';
@@ -144,12 +145,12 @@ export async function detectApiContracts(projectPath) {
     }
     // GraphQL
     if (await hasAnyFile(projectPath, ['schema.graphql', 'schema.gql', '**/*.graphql'])) {
-        contracts.push({ type: 'graphql', endpoints: [] });
+        contracts.push({ type: technologyValue('technology-graphql-aed31c'), endpoints: [] });
     }
     // tRPC
     const deps = await collectDependencies(projectPath);
     if (deps.has('@trpc/server') || deps.has('@trpc/client')) {
-        contracts.push({ type: 'trpc', endpoints: [] });
+        contracts.push({ type: technologyValue('technology-trpc-7a75ed'), endpoints: [] });
     }
     // gRPC
     if (await hasAnyFile(projectPath, ['**/*.proto'])) {

package/dist/engine/multi-teammate-review/disagreement-counter.js

@@ -3,6 +3,7 @@
 import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { atomicWriteFile } from '../safety/atomic-write-file.js';
+import { projectDataDir } from '../../storage/base-store.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -12,7 +13,7 @@ const PURGE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 // Path helper
 // ---------------------------------------------------------------------------
 function storePath(projectId) {
-    return join('planu', 'data', 'projects', projectId, 'disagreements.json');
+    return join(projectDataDir(projectId), 'disagreements.json');
 }
 function storeKey(k) {
     return `${k.specId}::${k.frontmatterSha}`;

package/dist/engine/multi-teammate-review/panel-orchestrator.js

@@ -179,7 +179,6 @@ export async function runReviewPanel(input, invoker) {
             // Fire telemetry event (fire-and-forget)
             sendTelemetryEvent({
                 event: 'panel_heterogeneity_violation',
-                installationId: 'anonymous',
                 properties: {
                     duplicateCount: hetResult.duplicates.length,
                     specId: input.specId ?? 'unknown',
@@ -296,7 +295,6 @@ export async function runReviewPanel(input, invoker) {
         // Emit telemetry for downgrade (fire-and-forget — never throws)
         sendTelemetryEvent({
             event: 'ram_guardrail_downgrade',
-            installationId: 'anonymous',
             properties: {
                 requested: ramDecision.requested,
                 allowed: ramDecision.allowed,

package/dist/engine/mutation-config-generator.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // engine/mutation-config-generator.ts — SPEC-323
 // Detects project stack and generates the appropriate mutation testing config file.
 import { readFile } from 'node:fs/promises';
@@ -15,13 +16,15 @@ async function detectStack(projectPath) {
             ...(pkg.dependencies ?? {}),
             ...(pkg.devDependencies ?? {}),
         };
-        const language = 'typescript' in deps ? 'typescript' : 'javascript';
+        const language = technologyValue('technology-typescript-969545') in deps
+            ? technologyValue('technology-typescript-969545')
+            : 'javascript';
         let testFramework = 'unknown';
-        if ('vitest' in deps) {
-            testFramework = 'vitest';
+        if (technologyValue('technology-vitest-a9127f') in deps) {
+            testFramework = technologyValue('technology-vitest-a9127f');
         }
-        else if ('jest' in deps) {
-            testFramework = 'jest';
+        else if (technologyValue('technology-jest-35e99f') in deps) {
+            testFramework = technologyValue('technology-jest-35e99f');
         }
         else if ('mocha' in deps) {
             testFramework = 'mocha';
@@ -32,13 +35,13 @@ async function detectStack(projectPath) {
         const hasPython = (await readFile(join(projectPath, 'setup.py'), 'utf8').catch(() => null)) !== null ||
             (await readFile(join(projectPath, 'pyproject.toml'), 'utf8').catch(() => null)) !== null;
         if (hasPython) {
-            return { language: 'python', testFramework: 'pytest' };
+            return { language: 'python', testFramework: technologyValue('technology-pytest-2b0121') };
         }
         const hasMaven = (await readFile(join(projectPath, 'pom.xml'), 'utf8').catch(() => null)) !== null;
         if (hasMaven) {
             return { language: 'java', testFramework: 'junit' };
         }
-        return { language: 'typescript', testFramework: 'unknown' };
+        return { language: technologyValue('technology-typescript-969545'), testFramework: 'unknown' };
     }
 }
 // ---------------------------------------------------------------------------

package/dist/engine/native-capability-policy.d.ts

@@ -0,0 +1,4 @@
+import type { NativeCapabilityPolicy, NativeFallbackMode } from '../types/core-bridge.js';
+export declare const NATIVE_CAPABILITY_POLICIES: readonly NativeCapabilityPolicy[];
+export declare function nativeFallbackMode(capability: string): NativeFallbackMode | null;
+//# sourceMappingURL=native-capability-policy.d.ts.map

package/dist/engine/native-capability-policy.js

@@ -0,0 +1,24 @@
+export const NATIVE_CAPABILITY_POLICIES = [
+    {
+        capability: 'core-acceleration-v1',
+        classification: 'optimization',
+        fallback: 'typescript-visible-degradation',
+        parityContract: 'tests/integration/native-platform-matrix.test.ts',
+    },
+    {
+        capability: 'project-graph-v1',
+        classification: 'optimization',
+        fallback: 'typescript-visible-degradation',
+        parityContract: 'tests/integration/native-project-graph-e2e.test.ts',
+    },
+    {
+        capability: 'macos-keychain-v1',
+        classification: 'correctness-critical',
+        fallback: 'fail-closed',
+        parityContract: 'tests/security/macos-keychain.integration.test.ts',
+    },
+];
+export function nativeFallbackMode(capability) {
+    return (NATIVE_CAPABILITY_POLICIES.find((policy) => policy.capability === capability)?.fallback ?? null);
+}
+//# sourceMappingURL=native-capability-policy.js.map

package/dist/engine/native-platform.d.ts

@@ -0,0 +1,3 @@
+/** Detects musl through independent local signals and reports failed probes. */
+export declare function detectMusl(): boolean;
+//# sourceMappingURL=native-platform.d.ts.map

package/dist/engine/native-platform.js

@@ -0,0 +1,44 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
+let cachedMusl;
+function probeMuslSignal(code, probe) {
+    try {
+        return probe();
+    }
+    catch (error) {
+        void error;
+        /* reliability-optional: NATIVE_LIBC_PROBE_FAILED */
+        reportClassifiedDegradation(code, new Error('Native libc probe unavailable'));
+        return false;
+    }
+}
+/** Detects musl through independent local signals and reports failed probes. */
+export function detectMusl() {
+    if (cachedMusl !== undefined) {
+        return cachedMusl;
+    }
+    if (process.platform !== 'linux') {
+        cachedMusl = false;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_ALPINE_PROBE_FAILED', () => existsSync('/etc/alpine-release'))) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_REPORT_PROBE_FAILED', () => {
+        const reportApi = process.report;
+        const report = reportApi?.getReport();
+        return (report !== undefined &&
+            /musl/iu.test(typeof report === 'string' ? report : JSON.stringify(report)));
+    })) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_LDD_PROBE_FAILED', () => existsSync('/usr/bin/ldd') && /musl/iu.test(readFileSync('/usr/bin/ldd', 'utf8')))) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    cachedMusl = probeMuslSignal('NATIVE_LIBC_LINKER_PROBE_FAILED', () => readdirSync('/lib').some((entry) => entry.startsWith('ld-musl-')));
+    return cachedMusl;
+}
+//# sourceMappingURL=native-platform.js.map

package/dist/engine/native-runtime-handshake.d.ts

@@ -0,0 +1,20 @@
+import type { NativeArtifactManifest, NativeRuntimeCompatibility, NativeRuntimeHandshake } from '../types/core-bridge.js';
+export declare const NATIVE_PROTOCOL_ABI = 1;
+export declare const NATIVE_CAPABILITY_ABI = 2;
+export declare const NATIVE_NODE_API_ABI = 4;
+/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
+export declare const RUNTIME_STORAGE_SCHEMA = 4;
+export declare function inspectNativeArtifact(artifactPath: string, trustedPublicKeyInput?: string | Buffer): {
+    artifactSha256: string;
+    manifest: NativeArtifactManifest | null;
+};
+export declare function negotiateNativeRuntime(handshake: NativeRuntimeHandshake | null, manifest: NativeArtifactManifest | null, expected: {
+    cliVersion: string;
+    target: string;
+    artifactSha256: string;
+    protocolAbi?: number;
+    capabilityAbi?: number;
+    nodeApiAbi?: number;
+    storageSchema?: number;
+}): NativeRuntimeCompatibility;
+//# sourceMappingURL=native-runtime-handshake.d.ts.map

package/dist/engine/native-runtime-handshake.js

@@ -0,0 +1,230 @@
+/* eslint-disable complexity -- the fail-closed manifest boundary validates every signed field */
+/* eslint-disable @typescript-eslint/no-unnecessary-condition -- Partial models untrusted JSON at runtime */
+import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
+import { lstatSync, readFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
+export const NATIVE_PROTOCOL_ABI = 1;
+export const NATIVE_CAPABILITY_ABI = 2;
+export const NATIVE_NODE_API_ABI = 4;
+/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
+export const RUNTIME_STORAGE_SCHEMA = 4;
+export function inspectNativeArtifact(artifactPath, trustedPublicKeyInput) {
+    const hash = (value) => createHash('sha256').update(value).digest('hex');
+    let artifactSha256 = '';
+    const manifestPath = `${artifactPath}.manifest.json`;
+    try {
+        const currentUid = process.getuid?.();
+        for (const path of [artifactPath, manifestPath]) {
+            const stat = lstatSync(path);
+            if (stat.isSymbolicLink() ||
+                (process.platform !== 'win32' &&
+                    ((currentUid !== undefined && stat.uid !== currentUid) || (stat.mode & 0o022) !== 0))) {
+                return { artifactSha256, manifest: null };
+            }
+        }
+        artifactSha256 = hash(readFileSync(artifactPath));
+        const parsed = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        if (typeof parsed !== 'object' ||
+            parsed === null ||
+            !('schemaVersion' in parsed) ||
+            parsed.schemaVersion !== 2 ||
+            !('artifactSha256' in parsed) ||
+            typeof parsed.artifactSha256 !== 'string' ||
+            !('capabilities' in parsed) ||
+            !Array.isArray(parsed.capabilities) ||
+            !parsed.capabilities.every((capability) => typeof capability === 'string')) {
+            return { artifactSha256, manifest: null };
+        }
+        const candidate = parsed;
+        const expectedSbomName = `${basename(artifactPath)}.sbom.json`;
+        const exactSemver = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
+        const expectedCapabilities = [
+            'core-acceleration-v1',
+            'project-graph-v1',
+            ...(candidate.platform === 'darwin' ? ['macos-keychain-v1'] : []),
+        ];
+        if (!exactSemver.test(candidate.cliVersion ?? '') ||
+            !exactSemver.test(candidate.engineVersion ?? '') ||
+            !/^[A-Za-z0-9._:-]{1,200}$/u.test(candidate.buildId ?? '') ||
+            candidate.protocolAbi !== NATIVE_PROTOCOL_ABI ||
+            candidate.capabilityAbi !== NATIVE_CAPABILITY_ABI ||
+            candidate.nodeApiAbi !== NATIVE_NODE_API_ABI ||
+            !Number.isSafeInteger(candidate.storageSchemaMin) ||
+            !Number.isSafeInteger(candidate.storageSchemaMax) ||
+            (candidate.storageSchemaMin ?? 0) < 1 ||
+            (candidate.storageSchemaMax ?? 0) < (candidate.storageSchemaMin ?? 0) ||
+            !['darwin', 'linux', 'win32'].includes(candidate.platform ?? '') ||
+            !['arm64', 'x64'].includes(candidate.arch ?? '') ||
+            (candidate.platform === 'linux'
+                ? !['glibc', 'musl'].includes(candidate.libc ?? '')
+                : candidate.libc !== null) ||
+            candidate.target !==
+                [candidate.platform, candidate.arch, candidate.libc].filter(Boolean).join('-') ||
+            JSON.stringify(candidate.capabilities) !== JSON.stringify(expectedCapabilities) ||
+            !/^[a-f0-9]{64}$/u.test(candidate.artifactSha256 ?? '') ||
+            candidate.sbom?.format !== 'CycloneDX-1.5' ||
+            candidate.sbom.path !== expectedSbomName ||
+            !/^[a-f0-9]{64}$/u.test(candidate.sbom.sha256 ?? '') ||
+            !/^[a-f0-9]{40}$/u.test(candidate.provenance?.sourceCommit ?? '') ||
+            typeof candidate.provenance?.sourceTreeDirty !== 'boolean' ||
+            !Number.isSafeInteger(candidate.provenance?.sourceDateEpoch) ||
+            (candidate.provenance?.sourceDateEpoch ?? -1) < 0 ||
+            !candidate.provenance?.builder ||
+            candidate.provenance.builder.length > 256 ||
+            !candidate.provenance.rustToolchain ||
+            (candidate.provenance.zigVersion !== null &&
+                typeof candidate.provenance.zigVersion !== 'string') ||
+            candidate.signature?.algorithm !== 'Ed25519' ||
+            !/^[a-f0-9]{64}$/u.test(candidate.signature.keyId ?? '') ||
+            !/^[A-Za-z0-9+/]{86}==$/u.test(candidate.signature.value ?? '')) {
+            return { artifactSha256, manifest: null };
+        }
+        const sbomPath = join(dirname(artifactPath), expectedSbomName);
+        const sbomStat = lstatSync(sbomPath);
+        if (sbomStat.isSymbolicLink() ||
+            (process.platform !== 'win32' &&
+                ((process.getuid?.() !== undefined && sbomStat.uid !== process.getuid?.()) ||
+                    (sbomStat.mode & 0o022) !== 0)) ||
+            hash(readFileSync(sbomPath)) !== candidate.sbom.sha256) {
+            return { artifactSha256, manifest: null };
+        }
+        const sbomValue = JSON.parse(readFileSync(sbomPath, 'utf8'));
+        if (!isValidSbom(sbomValue, candidate.engineVersion, artifactSha256)) {
+            return { artifactSha256, manifest: null };
+        }
+        const { signature, ...unsigned } = candidate;
+        const publicKey = createPublicKey(trustedPublicKeyInput ??
+            readFileSync(join(import.meta.dirname, '..', 'config', 'native-release-public-key.pem')));
+        const publicDer = publicKey.export({ type: 'spki', format: 'der' });
+        if (hash(publicDer) !== signature.keyId ||
+            !verifySignature(null, Buffer.from(JSON.stringify(unsigned)), publicKey, Buffer.from(signature.value, 'base64'))) {
+            return { artifactSha256, manifest: null };
+        }
+        return { artifactSha256, manifest: candidate };
+    }
+    catch (error) {
+        void error;
+        /* reliability-optional: NATIVE_ARTIFACT_INSPECTION_FAILED */
+        reportClassifiedDegradation('NATIVE_ARTIFACT_INSPECTION_FAILED', new Error('Native artifact inspection failed closed'));
+        return { artifactSha256, manifest: null };
+    }
+}
+function isValidSbom(value, engineVersion, artifactSha256) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const sbom = value;
+    const componentsValid = Array.isArray(sbom.components) &&
+        sbom.components.length > 0 &&
+        sbom.components.every((component) => typeof component === 'object' &&
+            component !== null &&
+            typeof component['bom-ref'] === 'string' &&
+            typeof component.name === 'string' &&
+            typeof component.version === 'string');
+    const dependenciesValid = Array.isArray(sbom.dependencies) &&
+        sbom.dependencies.some((dependency) => typeof dependency === 'object' &&
+            dependency !== null &&
+            Array.isArray(dependency.dependsOn));
+    const hashes = sbom.metadata?.component?.hashes;
+    const artifactBound = Array.isArray(hashes) &&
+        hashes.some((entry) => typeof entry === 'object' &&
+            entry !== null &&
+            entry.alg === 'SHA-256' &&
+            entry.content === artifactSha256);
+    return (sbom.bomFormat === 'CycloneDX' &&
+        sbom.specVersion === '1.5' &&
+        sbom.version === 1 &&
+        sbom.metadata?.component?.name === 'planu-core' &&
+        sbom.metadata.component.version === engineVersion &&
+        componentsValid &&
+        dependenciesValid &&
+        artifactBound);
+}
+export function negotiateNativeRuntime(handshake, manifest, expected) {
+    if (!handshake) {
+        return {
+            compatible: false,
+            reasons: ['native runtime does not expose planuRuntimeHandshake'],
+            handshake: null,
+        };
+    }
+    if (!manifest) {
+        return {
+            compatible: false,
+            reasons: ['native artifact manifest is missing, unsafe or invalid'],
+            handshake,
+        };
+    }
+    const reasons = [];
+    const protocolAbi = expected.protocolAbi ?? NATIVE_PROTOCOL_ABI;
+    const capabilityAbi = expected.capabilityAbi ?? NATIVE_CAPABILITY_ABI;
+    const nodeApiAbi = expected.nodeApiAbi ?? NATIVE_NODE_API_ABI;
+    const storageSchema = expected.storageSchema ?? RUNTIME_STORAGE_SCHEMA;
+    const handshakeCapabilitiesValid = Array.isArray(handshake.capabilities) &&
+        handshake.capabilities.every((capability) => typeof capability === 'string');
+    const manifestCapabilitiesValid = Array.isArray(manifest.capabilities) &&
+        manifest.capabilities.every((capability) => typeof capability === 'string');
+    if (manifest.cliVersion !== expected.cliVersion) {
+        reasons.push(`CLI version mismatch: expected ${expected.cliVersion}, got ${manifest.cliVersion}`);
+    }
+    if (handshake.engineVersion !== expected.cliVersion) {
+        reasons.push(`engine version mismatch: expected ${expected.cliVersion}, got ${handshake.engineVersion}`);
+    }
+    if (handshake.engineVersion !== manifest.engineVersion) {
+        reasons.push('native engine version does not match artifact manifest');
+    }
+    if (handshake.buildId !== manifest.buildId) {
+        reasons.push('native build identity does not match artifact manifest');
+    }
+    if (handshake.protocolAbi !== protocolAbi) {
+        reasons.push(`protocol ABI mismatch: expected ${protocolAbi}, got ${handshake.protocolAbi}`);
+    }
+    if (handshake.protocolAbi !== manifest.protocolAbi) {
+        reasons.push('native protocol ABI does not match artifact manifest');
+    }
+    if (handshake.capabilityAbi !== capabilityAbi) {
+        reasons.push(`capability ABI mismatch: expected ${capabilityAbi}, got ${handshake.capabilityAbi}`);
+    }
+    if (handshake.capabilityAbi !== manifest.capabilityAbi) {
+        reasons.push('native capability ABI does not match artifact manifest');
+    }
+    if (handshake.nodeApiAbi !== nodeApiAbi) {
+        reasons.push(`Node-API ABI mismatch: expected ${nodeApiAbi}, got ${handshake.nodeApiAbi}`);
+    }
+    if (handshake.nodeApiAbi !== manifest.nodeApiAbi) {
+        reasons.push('native Node-API ABI does not match artifact manifest');
+    }
+    if (!handshakeCapabilitiesValid) {
+        reasons.push('native runtime capabilities are malformed');
+    }
+    if (!manifestCapabilitiesValid) {
+        reasons.push('native artifact manifest capabilities are malformed');
+    }
+    if (handshakeCapabilitiesValid &&
+        manifestCapabilitiesValid &&
+        JSON.stringify(handshake.capabilities) !== JSON.stringify(manifest.capabilities)) {
+        reasons.push('native capabilities do not match artifact manifest');
+    }
+    if (storageSchema < handshake.storageSchemaMin || storageSchema > handshake.storageSchemaMax) {
+        reasons.push(`storage schema ${storageSchema} is outside native range ${handshake.storageSchemaMin}-${handshake.storageSchemaMax}`);
+    }
+    if (handshake.storageSchemaMin !== manifest.storageSchemaMin ||
+        handshake.storageSchemaMax !== manifest.storageSchemaMax) {
+        reasons.push('native storage schema range does not match artifact manifest');
+    }
+    if (handshake.target !== expected.target) {
+        reasons.push(`target mismatch: expected ${expected.target}, got ${handshake.target}`);
+    }
+    if (handshake.target !== manifest.target) {
+        reasons.push('native target does not match artifact manifest');
+    }
+    if (manifest.target !== [manifest.platform, manifest.arch, manifest.libc].filter(Boolean).join('-')) {
+        reasons.push('native manifest target does not match platform/arch/libc dimensions');
+    }
+    if (manifest.artifactSha256 !== expected.artifactSha256) {
+        reasons.push('native artifact SHA-256 mismatch');
+    }
+    return { compatible: reasons.length === 0, reasons, handshake };
+}
+//# sourceMappingURL=native-runtime-handshake.js.map

package/dist/engine/network-policy.d.ts

@@ -0,0 +1,27 @@
+import type { ClientRequest } from 'node:http';
+import type { NetworkConsentReceipt, NetworkPurpose, NetworkRequestPurpose } from '../types/network-policy.js';
+export declare const NETWORK_CONSENT_VERSION: 1;
+export declare class OfflineNetworkError extends Error {
+    readonly destination: string;
+    readonly code = "PLANU_OFFLINE_NETWORK_BLOCKED";
+    constructor(destination: string);
+}
+export declare class NetworkConsentRequiredError extends Error {
+    readonly destination: string;
+    readonly purpose: NetworkRequestPurpose;
+    readonly code = "PLANU_NETWORK_CONSENT_REQUIRED";
+    constructor(destination: string, purpose: NetworkRequestPurpose);
+}
+export declare function assertNetworkAllowed(destination: string, purpose?: NetworkRequestPurpose): void;
+/** Scope current-version consent to one explicit operation and its async descendants. */
+export declare function withNetworkConsent<T>(purpose: NetworkPurpose, operation: (receipt: NetworkConsentReceipt) => T): T;
+/** A purpose-aware fetch for code paths that obtained explicit user consent. */
+export declare function networkFetch(receipt: NetworkConsentReceipt, input: string | URL | Request, init?: RequestInit): Promise<Response>;
+export declare function networkHttpRequest(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpGet(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpsRequest(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpsGet(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+/** Install once; every unscoped fetch fails closed before touching the transport. */
+export declare function installNetworkPolicy(): void;
+export declare function restoreNetworkPolicyForTests(): void;
+//# sourceMappingURL=network-policy.d.ts.map