@planu/cli 4.13.0 → 4.14.1

package/dist/tools/suggest-tooling/llm-security-catalog.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../../engine/technology-registry.js';
 // tools/suggest-tooling/llm-security-catalog.ts — SPEC-045
 // Builds LLM guardrails and MLOps tooling recommendation lines for suggest_tooling.
 import { readFile } from 'node:fs/promises';
@@ -44,7 +45,7 @@ export async function buildLlmSecurityToolingLines(knowledge) {
     }
     const config = await loadConfig();
     const lang = knowledge.language.toLowerCase();
-    const isNodeProject = lang === 'typescript' || lang === 'javascript';
+    const isNodeProject = lang === technologyValue('technology-typescript-969545') || lang === 'javascript';
     const isPythonProject = lang === 'python';
     const lines = ['', '## LLM Security & Guardrails', ''];
     lines.push(`**Provider detectado:** ${detection.provider ?? 'unknown'}`);

package/dist/tools/suggest-tooling/local-first-catalog.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../../engine/technology-registry.js';
 // tools/suggest-tooling/local-first-catalog.ts — SPEC-047
 // Builds local-first CRDT, storage, and sync tooling recommendation lines for suggest_tooling.
 import { readFile } from 'node:fs/promises';
@@ -42,10 +41,13 @@ function getPlatformTag(framework, stack) {
     if (fw.includes('react-native') || fw.includes('expo') || stackLower.includes('react-native')) {
         return 'react-native';
     }
-    if (fw.includes('flutter') || stackLower.includes('flutter')) {
-        return 'flutter';
+    if (fw.includes(technologyValue('technology-flutter-be1396')) ||
+        stackLower.includes(technologyValue('technology-flutter-be1396'))) {
+        return technologyValue('technology-flutter-be1396');
     }
-    if (fw.includes('tauri') || fw.includes('electron') || stackLower.includes('desktop')) {
+    if (fw.includes('tauri') ||
+        fw.includes(technologyValue('technology-electron-88b1de')) ||
+        stackLower.includes('desktop')) {
         return 'node';
     }
     return 'browser';

package/dist/tools/suggest-tooling/observability-catalog.js

@@ -1,5 +1,4 @@
-// tools/suggest-tooling/observability-catalog.ts — Observability tooling recommendations (SPEC-026a)
-// Generates observability-specific tooling recommendations based on detected stack.
+import { technologyValue } from '../../engine/technology-registry.js';
 // === Alert spec templates (base specs without specId) ===
 const ALERT_TEMPLATES = [
     {
@@ -191,7 +190,7 @@ function buildRecommendationLines(knowledge) {
     // Error tracking — always recommend Sentry first
     lines.push('#### 1. Error Tracking (Critical)');
     lines.push('**Recommended:** Sentry');
-    if (fw.includes('next') || fw.includes('react')) {
+    if (fw.includes('next') || fw.includes(technologyValue('technology-react-275976'))) {
         lines.push('**Install:** `npm install @sentry/nextjs` — run `npx @sentry/wizard@latest -i nextjs`');
     }
     else if (lang === 'python') {
@@ -214,7 +213,7 @@ function buildRecommendationLines(knowledge) {
     lines.push('');
     // Logging
     lines.push('#### 3. Structured Logging (Recommended)');
-    if (lang === 'typescript' || lang === 'javascript') {
+    if (lang === technologyValue('technology-typescript-969545') || lang === 'javascript') {
         lines.push('**Recommended:** Pino (fastest structured logger for Node.js)');
         lines.push('**Install:** `npm install pino` — outputs JSON by default');
     }

package/dist/tools/suggest-tooling/otel-catalog.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../../engine/technology-registry.js';
 // tools/suggest-tooling/otel-catalog.ts — SPEC-044
 // Loads and formats OTel tooling recommendations from the config catalog.
 import { readFile } from 'node:fs/promises';
@@ -25,7 +26,9 @@ async function loadOtelConfig() {
 /** Detect if a project has Kubernetes in its stack */
 function hasKubernetes(knowledge) {
     const all = [...knowledge.stack, ...Object.keys(knowledge.tooling)].map((s) => s.toLowerCase());
-    return all.some((s) => s.includes('kubernetes') || s.includes('k8s') || s.includes('helm'));
+    return all.some((s) => s.includes(technologyValue('technology-kubernetes-94abcb')) ||
+        s.includes('k8s') ||
+        s.includes('helm'));
 }
 /**
  * Build OTel tooling recommendation lines for projects with OTel detected or needed.

package/dist/tools/suggest-tooling/resilience-catalog.js

@@ -1,6 +1,4 @@
-// tools/suggest-tooling/resilience-catalog.ts — SPEC-034
-// Generates resilience library and health check recommendations
-// based on project language, stack, and detected patterns.
+import { technologyValue } from '../../engine/technology-registry.js';
 import { getJvmVersion, getRustVersion } from '../../config/version-defaults.js';
 const RESILIENCE_LIBRARY_BY_LANG = {
     nodejs: {
@@ -96,7 +94,14 @@ export function needsResilienceRecommendation(knowledge) {
  */
 export function needsHealthCheckRecommendation(knowledge) {
     const stackLower = knowledge.stack.map((s) => s.toLowerCase());
-    const hasMicroserviceSignals = stackLower.some((s) => ['kubernetes', 'k8s', 'docker', 'helm', 'istio', 'grpc'].some((kw) => s.includes(kw)));
+    const hasMicroserviceSignals = stackLower.some((s) => [
+        technologyValue('technology-kubernetes-94abcb'),
+        'k8s',
+        technologyValue('technology-docker-d548c5'),
+        'helm',
+        'istio',
+        'grpc',
+    ].some((kw) => s.includes(kw)));
     if (!hasMicroserviceSignals) {
         return false;
     }
@@ -112,7 +117,13 @@ export function needsHealthCheckRecommendation(knowledge) {
 export function hasDistributedRateLimitRisk(knowledge) {
     const stackLower = knowledge.stack.map((s) => s.toLowerCase());
     const hasLocalRateLimit = stackLower.some((s) => ['express-rate-limit', 'slowapi', 'golang.org/x/time/rate'].some((lib) => s.includes(lib)));
-    const hasMultiInstance = stackLower.some((s) => ['kubernetes', 'k8s', 'ecs', 'replicas', 'docker-compose'].some((kw) => s.includes(kw)));
+    const hasMultiInstance = stackLower.some((s) => [
+        technologyValue('technology-kubernetes-94abcb'),
+        'k8s',
+        'ecs',
+        'replicas',
+        technologyValue('technology-docker-compose-b0a828'),
+    ].some((kw) => s.includes(kw)));
     return hasLocalRateLimit && hasMultiInstance;
 }
 /**

package/dist/tools/suggest-tooling/skills-catalog.js

@@ -1,14 +1,12 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// tools/suggest-tooling/skills-catalog.ts — SPEC-022 skills.sh catalog fetcher
-// Extracted from suggest-tooling.ts to stay within the 400-line file budget.
+import { technologyValue } from '../../engine/technology-registry.js';
 import { getJvmVersion } from '../../config/version-defaults.js';
+import { assertNetworkAllowed } from '../../engine/network-policy.js';
 // === SPEC-013: Mobile tooling lines ===
 export function buildMobileToolingLines(knowledge) {
     const mobileFrameworks = [
-        'swiftui',
+        technologyValue('technology-swiftui-b63400'),
         'uikit',
-        'flutter',
+        technologyValue('technology-flutter-be1396'),
         'react-native',
         'expo',
         'jetpack-compose',
@@ -20,7 +18,9 @@ export function buildMobileToolingLines(knowledge) {
     const isMobile = apps.some(
     /* v8 ignore start */ // null-coalescing fallback for framework is runtime-dependent
     (app) => mobileFrameworks.includes(app.framework ?? '') || app.mobilePlatform !== undefined);
-    const isIos = apps.some((app) => app.mobilePlatform === 'ios' || app.framework === 'swiftui' || app.framework === 'uikit');
+    const isIos = apps.some((app) => app.mobilePlatform === 'ios' ||
+        app.framework === technologyValue('technology-swiftui-b63400') ||
+        app.framework === 'uikit');
     const isAndroid = apps.some((app) => app.mobilePlatform === 'android' ||
         app.framework === 'compose' ||
         app.framework === 'xml-views');
@@ -166,6 +166,7 @@ async function fetchSkillsShCatalog(stack, language) {
     return new Promise((resolve) => {
         const stackParam = encodeURIComponent([...stack, language].join(',').toLowerCase());
         const url = `https://skills.sh/api/catalog?stack=${stackParam}`;
+        assertNetworkAllowed(url);
         // Dynamic import to avoid top-level import of https
         import('node:https')
             .then(({ default: https }) => {
@@ -209,7 +210,7 @@ function buildFallbackSkills(knowledge) {
     const skills = [];
     const stackLower = knowledge.stack.map((s) => s.toLowerCase());
     const lang = knowledge.language.toLowerCase();
-    if (lang === 'typescript' || lang === 'javascript') {
+    if (lang === technologyValue('technology-typescript-969545') || lang === 'javascript') {
         skills.push({
             name: 'typescript-patterns',
             description: 'TypeScript best practices, strict mode patterns, and type safety conventions',
@@ -217,7 +218,7 @@ function buildFallbackSkills(knowledge) {
             justification: `Project uses ${knowledge.language}`,
         });
     }
-    if (stackLower.some((s) => s.includes('react'))) {
+    if (stackLower.some((s) => s.includes(technologyValue('technology-react-275976')))) {
         skills.push({
             name: 'react-patterns',
             description: 'React component patterns, hooks best practices, and performance optimization',

package/dist/tools/suggest-tooling/supply-chain-catalog.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../../engine/technology-registry.js';
 // tools/suggest-tooling/supply-chain-catalog.ts — SPEC-046
 // Builds supply chain security tooling recommendation lines for suggest_tooling.
 import { readFile } from 'node:fs/promises';
@@ -25,7 +24,7 @@ async function loadConfig() {
 /** Map project language to SBOM tool key. */
 function getSbomToolKey(language) {
     const lang = language.toLowerCase();
-    if (lang === 'typescript' || lang === 'javascript') {
+    if (lang === technologyValue('technology-typescript-969545') || lang === 'javascript') {
         return 'nodejs';
     }
     if (lang === 'java' || lang === 'kotlin') {

package/dist/tools/supabase-handler.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../engine/technology-registry.js';
 import { getSupabaseConfig, saveSupabaseConfig, getSupabaseSyncResult, saveSupabaseSyncResult, } from '../storage/supabase-store.js';
 import { fetchTables, fetchRlsPolicies } from '../engine/supabase/schema-fetcher.js';
 import { generateRlsSpecTitle, generateRlsSpecDescription, generateRlsAcceptanceCriteria, classifyRlsRisk, } from '../engine/supabase/rls-spec-generator.js';
@@ -165,7 +166,7 @@ export async function handleGenerateRlsSpec(input) {
             projectPath,
             type: 'infra',
             target: 'database',
-            tags: ['security', 'rls', 'supabase', risk],
+            tags: ['security', 'rls', technologyValue('technology-supabase-4d7594'), risk],
         };
         try {
             const result = await handleCreateSpec(createInput);

package/dist/tools/token-intelligence-handler.js

@@ -1,12 +1,12 @@
 import { getEntries, getAggregation } from '../storage/token-ledger-store.js';
 import { hashProjectPath } from '../storage/base-store.js';
 import { buildTokenWasteReport, detectTokenWasteLoops, formatTokenWasteReport, loadTokenWastePolicy, recommendRelevantTools, } from '../engine/token-optimizer/index.js';
-import { join } from 'node:path';
+import { resolveStorageLayout } from '../storage/storage-layout.js';
 import { formatProjectGraphContext, queryProjectGraphSlice, } from '../engine/project-graph/index.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
-const DEFAULT_DATA_DIR = join(process.cwd(), 'data');
+const DEFAULT_DATA_DIR = resolveStorageLayout().data;
 const DEFAULT_VIEW = 'summary';
 const TOP_N_CONSUMERS = 5;
 const PROGRESS_BAR_LENGTH = 10;

package/dist/tools/token-recording.js

@@ -1,9 +1,9 @@
 // tools/token-recording.ts — Fire-and-forget token usage recording for all tool calls.
 // Called by safeWithTelemetry() after each successful tool execution.
-import { join } from 'node:path';
 import { countTokens, estimateCost } from '../engine/token-optimizer/counter.js';
 import { recordEntry } from '../storage/token-ledger-store.js';
 import { hashProjectPath } from '../storage/base-store.js';
+import { resolveStorageLayout } from '../storage/storage-layout.js';
 const SECRET_KEY_PATTERN = /(api[-_]?key|auth|bearer|credential|password|secret|token)/i;
 function stringifyForTokenCounting(value) {
     try {
@@ -42,7 +42,7 @@ export function recordToolTokens(toolName, projectPath, inputArgs, outputText, s
             cached: false,
         };
         const projectHash = hashProjectPath(projectPath);
-        const dataDir = join(process.cwd(), 'data');
+        const dataDir = resolveStorageLayout().data;
         void recordEntry(projectHash, dataDir, entry).catch((err) => {
             console.error('[planu] token-recording recordEntry failed:', err);
         });

package/dist/tools/token-savings-handler.js

@@ -1,8 +1,8 @@
 import { getEntries } from '../storage/token-ledger-store.js';
 import { calculateTokenSavings } from '../engine/token-savings-calculator.js';
 import { resolveProjectId, missingProjectIdError } from './resolve-project-id.js';
-import { join } from 'node:path';
-const DEFAULT_DATA_DIR = join(process.cwd(), 'data');
+import { resolveStorageLayout } from '../storage/storage-layout.js';
+const DEFAULT_DATA_DIR = resolveStorageLayout().data;
 export async function handleTokenSavingsReport(args) {
     const period = args.period ?? 'month';
     const projectId = resolveProjectId(args);

package/dist/tools/tool-registry/core-tools.js

@@ -42,8 +42,139 @@ import { handleDogfoodWatch } from '../dogfood-watch.js';
 import { SecurityReportTimeRangeEnum, SecurityReportFormatEnum, } from '../schemas/runtime-security.js';
 import { RenderSpecForProviderInputSchema, handleRenderSpecForProvider, } from '../render-spec-for-provider.js';
 import { handleTriageRequest, TriageRequestInputSchema } from '../triage-request.js';
+import { handleStoragePaths } from '../storage-paths-handler.js';
+import { handleStorageExport, handleStorageImport } from '../storage-bundle-handler.js';
+import { handleCancelJob, handleGetJob, handleRestartJob, handleWatchJob, } from '../jobs/handlers.js';
 // ── Registry ─────────────────────────────────────────────────────────────────
 const coreToolsRegistry = [
+    {
+        name: 'get_job',
+        description: 'Read the durable state and latest checkpoint or result for a local Planu job.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleGetJob,
+        annotations: {
+            title: 'Get Durable Job',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'watch_job',
+        description: 'Wait up to 30 seconds for a durable Planu job to change or reach a terminal state.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+            afterCursor: z
+                .string()
+                .regex(/^[a-f0-9]{64}$/)
+                .optional(),
+            timeoutMs: z.number().int().min(0).max(30_000).optional(),
+        },
+        handler: handleWatchJob,
+        annotations: {
+            title: 'Watch Durable Job',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'cancel_job',
+        description: 'Durably cancel a Planu job and fence any worker that still holds its former lease.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleCancelJob,
+        annotations: {
+            title: 'Cancel Durable Job',
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'restart_job',
+        description: 'Restart a cancelled or failed durable job and schedule its typed executor.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleRestartJob,
+        annotations: {
+            title: 'Restart Durable Job',
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_paths',
+        description: 'Resolve the canonical local-first Planu storage catalog, including ownership, lifecycle, sensitivity, retention and portability for every registered artifact family.',
+        schema: {
+            projectPath: z.string().min(1).max(4096).optional(),
+            logicalProjectId: z.string().min(1).max(128).optional(),
+            workspaceKeyHash: z.string().min(1).max(128).optional(),
+        },
+        handler: (args) => Promise.resolve(handleStoragePaths(args)),
+        annotations: {
+            title: 'Planu Storage Paths',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_export',
+        description: 'Export a versioned, checksummed Planu runtime bundle with secret values redacted.',
+        schema: {
+            projectId: z.string().min(1).max(128),
+            outputPath: z.string().min(1).max(4096),
+        },
+        handler: handleStorageExport,
+        annotations: {
+            title: 'Export Planu Storage',
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_import',
+        description: 'Verify and transactionally import a checksummed Planu runtime bundle.',
+        schema: { inputPath: z.string().min(1).max(4096) },
+        handler: handleStorageImport,
+        annotations: {
+            title: 'Import Planu Storage',
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
     // ── generate_batch_script (SPEC-253) ──────────────────────────────────────
     {
         name: 'generate_batch_script',

package/dist/tools/tool-registry/group-infra.js

@@ -1,12 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-/* eslint-disable max-lines, max-lines-per-function -- thematic registry group consolidated by SPEC refactor-phase3 (commit aafeea60); each block is a declarative tool registration ~20 lines, split would re-create the ~120 register-*.ts files this phase intentionally collapsed */
-// tools/tool-registry/group-infra.ts — Declarative registry: infrastructure & platform tools.
-//
-// Phase 2 (refactor/registry-phase2): consolidates register-*.ts files for:
-//   webhook, dashboard, usage, license, auto-update, deploy, cross-repo-search, browser-validate,
-//   workers, plugins, registry, skill-registry, tool-groups, rbac, workspace, memory-config,
-//   onboarding, docs-registry, well-known
+import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
 // ── safe handlers ────────────────────────────────────────────────────────────
 import { safe, safeLicensed, safeTracked } from '../safe-handler.js';
@@ -89,7 +81,13 @@ const SUPPORTED_EVENTS = [
     'validate.failed',
 ];
 const deployProviderEnum = z
-    .enum(['vercel', 'netlify', 'cloudflare-pages', 'fly', 'railway'])
+    .enum([
+    technologyValue('technology-vercel-9d3508'),
+    technologyValue('technology-netlify-58465a'),
+    'cloudflare-pages',
+    technologyValue('technology-fly-f4debd'),
+    technologyValue('technology-railway-e34d1c'),
+])
     .describe('Deploy provider: vercel | netlify | cloudflare-pages | fly | railway');
 export function registerInfraGroupTools(server) {
     // ── License tools ──────────────────────────────────────────────────────────
@@ -329,8 +327,8 @@ export function registerInfraGroupTools(server) {
         annotations: { readOnlyHint: true },
     }, safe(async (_args) => handleCheckUpdateStatus()));
     server.registerTool('enable_auto_update', {
-        description: 'Enable automatic updates for Planu by switching the MCP config to use ' +
-            '"npx -y @planu/cli@latest". Detects the config file automatically (~/.claude.json or ' +
+        description: 'Resolve the newest verified Planu release and pin the MCP config to its exact version. ' +
+            'Detects the config file automatically (~/.claude.json or ' +
             'Claude Desktop config). Creates a backup before any modification. ' +
             'Call with confirm=false (default) to preview the change; confirm=true to apply it.',
         inputSchema: {

package/dist/tools/tool-registry/group-quality-compliance.js

@@ -1,11 +1,4 @@
-/* eslint-disable max-lines -- thematic registry group consolidated by SPEC refactor-phase3 (commit aafeea60); each block is a declarative tool registration ~20 lines, split would re-create the ~120 register-*.ts files this phase intentionally collapsed */
-// tools/tool-registry/group-quality-compliance.ts — Declarative registry: quality & compliance tools.
-//
-// Phase 3 (refactor/registry-phase3): consolidates register-*.ts files for:
-//   compliance, compliance-audit, compliance-gate, compliance-test,
-//   security, audit-trail, schema-parity, schema-generator,
-//   tdd, coverage, eval-skill, ears, spec-lint, readiness, approval,
-//   governance, spec-322 (api contract), spec-323 (tdd scaffold), spec-331 (orchestration plan)
+import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
 import { safeLicensed, safeTracked } from '../safe-handler.js';
 import { projectIdSchema, withProject } from '../tool-registry-helpers.js';
@@ -365,7 +358,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .min(1)
                 .describe(COMPLIANCE_TEST_FRAMEWORK_DESCRIBE),
             outputFormat: z
-                .enum(['jest', 'gherkin', 'markdown'])
+                .enum([technologyValue('technology-jest-35e99f'), 'gherkin', 'markdown'])
                 .optional()
                 .describe(TEST_FORMAT_DESCRIBE),
         },
@@ -528,10 +521,10 @@ export function registerQualityComplianceGroupTools(s) {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root.'),
             specId: SpecIdSchema.describe('Spec ID to analyze (e.g. SPEC-042).'),
             library: z
-                .enum(['zod', 'yup', 'valibot', 'all'])
+                .enum([technologyValue('technology-zod-4f63cf'), 'yup', 'valibot', 'all'])
                 .describe('Schema library. Values: zod, yup, valibot, all.'),
             outputFormat: z
-                .enum(['typescript', 'javascript'])
+                .enum([technologyValue('technology-typescript-969545'), 'javascript'])
                 .describe('Output format. Values: typescript, javascript.'),
             outputPath: z
                 .string()
@@ -1144,7 +1137,7 @@ export function registerQualityComplianceGroupTools(s) {
                 .max(4096)
                 .describe('Absolute path to the API contract file. For OpenAPI: .json or .yaml file. For GraphQL: .graphql, .gql, or .sdl file.'),
             contractFormat: z
-                .enum(['openapi', 'graphql', 'auto'])
+                .enum(['openapi', technologyValue('technology-graphql-aed31c'), 'auto'])
                 .optional()
                 .describe('Format of the contract file. Valid values: openapi, graphql, auto. auto (default) detects format from the file extension: .json/.yaml → openapi, .graphql/.gql/.sdl → graphql.'),
         },

package/dist/tools/update-status/approval-gates.d.ts

@@ -0,0 +1,13 @@
+import type { FormatGateOutput } from '../../types/spec/inputs.js';
+import type { Spec } from '../../types/spec/core.js';
+export interface ComplianceGateResult {
+    skipped: boolean;
+    score: number | null;
+    issues: string[];
+    blocked: boolean;
+}
+/** Run the optional compliance check for a transition into review. */
+export declare function checkComplianceGate(specId: string, projectId: string, projectPath: string | undefined): Promise<ComplianceGateResult>;
+/** Validate canonical spec format before approval, preserving audited bypass warnings. */
+export declare function checkApprovedFormatGate(spec: Spec, newStatus: string, forceApprove?: boolean | undefined): Promise<FormatGateOutput>;
+//# sourceMappingURL=approval-gates.d.ts.map

package/dist/tools/update-status/approval-gates.js

@@ -0,0 +1,81 @@
+import { validateSpecFormat } from '../../core/spec-validator.js';
+import { getComplianceGateConfig } from '../../storage/compliance-gate-config-store.js';
+import { formatKeyValue } from '../output-formatter.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+/** Run the optional compliance check for a transition into review. */
+export async function checkComplianceGate(specId, projectId, projectPath) {
+    if (!projectPath) {
+        return { skipped: true, score: null, issues: [], blocked: false };
+    }
+    try {
+        const { scoreCompliance } = await import('../../engine/verifier/compliance-scorer.js');
+        const result = await scoreCompliance(specId, projectPath);
+        const score = result.score;
+        const issues = result.criteriaDetails
+            .filter((detail) => detail.status === 'unverified')
+            .map((detail) => detail.criterion)
+            .slice(0, 5);
+        const config = await getComplianceGateConfig(projectId);
+        const blocked = (config?.mode ?? 'soft') === 'hard' && score < (config?.threshold ?? 90);
+        return { skipped: false, score, issues, blocked };
+    }
+    catch (error) {
+        /* reliability-optional: COMPLIANCE_GATE_UNAVAILABLE — optional gate is explicitly skipped */
+        reportClassifiedDegradation('COMPLIANCE_GATE_UNAVAILABLE', error);
+        return { skipped: true, score: null, issues: [], blocked: false };
+    }
+}
+/** Validate canonical spec format before approval, preserving audited bypass warnings. */
+export async function checkApprovedFormatGate(spec, newStatus, forceApprove = false) {
+    if (newStatus !== 'approved') {
+        return { blockResult: null, qualityWarnings: [] };
+    }
+    let result;
+    try {
+        result = await validateSpecFormat(spec, {
+            readinessMode: 'strict',
+            bypassReason: forceApprove ? 'forceApprove' : undefined,
+        });
+    }
+    catch (error) {
+        /* reliability-optional: FORMAT_GATE_UNAVAILABLE — caller receives explicit degraded result */
+        reportClassifiedDegradation('FORMAT_GATE_UNAVAILABLE', error);
+        return { blockResult: null, qualityWarnings: [] };
+    }
+    if (result.valid) {
+        const qualityWarnings = result.warnings
+            .filter((warning) => warning.message.includes('[BYPASSED: forceApprove]'))
+            .map((warning) => `[${warning.code}] ${warning.message.replace('[BYPASSED: forceApprove] ', '')} (path: ${warning.path})`);
+        return { blockResult: null, qualityWarnings };
+    }
+    const message = `Spec format validation failed with ${String(result.errors.length)} error(s) — fix before approving, or pass forceApprove: true to bypass with warnings.`;
+    const blockResult = {
+        content: [
+            {
+                type: 'text',
+                text: formatKeyValue({
+                    error: 'SPEC_FORMAT_INVALID',
+                    message,
+                    errors: result.errors.length,
+                    warnings: result.warnings.length,
+                    firstError: result.errors[0]?.message,
+                    firstErrorPath: result.errors[0]?.path,
+                }, 'Spec format invalid'),
+            },
+        ],
+        isError: true,
+        structuredContent: {
+            error: 'SPEC_FORMAT_INVALID',
+            message,
+            errors: result.errors,
+            warnings: result.warnings,
+            code: 422,
+            context: { specId: spec.id, errors: result.errors, warnings: result.warnings },
+            fixHint: result.errors[0]
+                ? `Fix: ${result.errors[0].message}. Path: ${result.errors[0].path}. Or pass forceApprove: true.`
+                : 'Fix all format errors before approving, or pass forceApprove: true to bypass with warnings.',
+        },
+    };
+    return { blockResult, qualityWarnings: [] };
+}
+//# sourceMappingURL=approval-gates.js.map

package/dist/tools/update-status/batch.js

@@ -1,6 +1,7 @@
 // tools/update-status/batch.ts — SPEC-1017 batch status transitions
 import { handleUpdateStatus } from './index.js';
 import { resolveProjectIdOrAutoDetect } from '../resolve-project-id.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 function firstText(result) {
     const first = result.content[0];
     return first?.type === 'text' ? first.text : JSON.stringify(result.structuredContent ?? {});
@@ -76,8 +77,9 @@ export async function handleUpdateStatusBatch(input) {
         const { runStrictPlanuCleanup } = await import('../../engine/spec-migrator/index.js');
         await runStrictPlanuCleanup(resolved.projectPath);
     }
-    catch {
-        /* best-effort final pass */
+    catch (error) {
+        /* reliability-cleanup: POST_BATCH_STRICT_CLEANUP — validation remains fail-closed */
+        reportClassifiedDegradation('POST_BATCH_STRICT_CLEANUP', error);
     }
     const text = [
         `Batch status transition complete: ${input.status}`,