@planu/cli 4.13.0 → 5.0.0

package/dist/engine/auto-updater/npm-registry.js

@@ -2,8 +2,10 @@
 // SPEC-443
 // Endpoint: https://registry.npmjs.org/-/package/@planu/cli/dist-tags
 // Timeout: 3 seconds. Fallback: null (never block the user).
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 const NPM_REGISTRY_URL = 'https://registry.npmjs.org/-/package/@planu/cli/dist-tags';
 const TIMEOUT_MS = 3_000;
+const EXACT_STABLE_SEMVER = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
 /** In-memory cache for the current process lifetime. */
 let cachedVersion = undefined;
 /**
@@ -12,6 +14,10 @@ let cachedVersion = undefined;
  * Returns null on timeout or any network error.
  */
 export async function fetchLatestVersion() {
+    if (process.env.PLANU_OFFLINE === '1') {
+        cachedVersion = null;
+        return null;
+    }
     if (cachedVersion !== undefined) {
         return cachedVersion;
     }
@@ -22,11 +28,13 @@ export async function fetchLatestVersion() {
     try {
         const res = await fetch(NPM_REGISTRY_URL, { signal: controller.signal });
         const tags = (await res.json());
-        const version = typeof tags.latest === 'string' ? tags.latest : null;
+        const version = typeof tags.latest === 'string' && EXACT_STABLE_SEMVER.test(tags.latest) ? tags.latest : null;
         cachedVersion = version;
         return version;
     }
-    catch {
+    catch (error) {
+        /* reliability-optional: NPM_RELEASE_LOOKUP_FAILED */
+        reportClassifiedDegradation('NPM_RELEASE_LOOKUP_FAILED', error);
         cachedVersion = null;
         return null;
     }

package/dist/engine/auto-updater/release-verifier.d.ts

@@ -0,0 +1,3 @@
+import type { ReleaseCommandRunner, ReleaseVerificationReport } from '../../types/atomic-upgrade.js';
+export declare function stageAndVerifyRelease(version: string, runner?: ReleaseCommandRunner): Promise<ReleaseVerificationReport>;
+//# sourceMappingURL=release-verifier.d.ts.map

package/dist/engine/auto-updater/release-verifier.js

@@ -0,0 +1,112 @@
+import { spawnSync } from 'node:child_process';
+import { currentNativePackageName, RUNTIME_STORAGE_SCHEMA } from '../core-bridge.js';
+import { redactFailureMessage, reportClassifiedDegradation, } from '../../errors/classified-degradation.js';
+const EXACT_VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/;
+const CLI_PACKAGE = '@planu/cli';
+const MCP_INITIALIZE = `${JSON.stringify({
+    jsonrpc: '2.0',
+    id: 1,
+    method: 'initialize',
+    params: {
+        protocolVersion: '2025-06-18',
+        capabilities: {},
+        clientInfo: { name: 'planu-upgrade-verifier', version: '1.0.0' },
+    },
+})}\n`;
+function commandFailure(label, result) {
+    const detail = result.error ?? new Error(result.stderr || result.stdout || 'unknown error');
+    return new Error(`[Planu upgrade] ${label}: ${redactFailureMessage(detail)}`);
+}
+function verifiesMcp(stdout, version) {
+    return stdout.split(/\r?\n/u).some((line) => {
+        if (line.trim() === '') {
+            return false;
+        }
+        try {
+            const message = JSON.parse(line);
+            return (message.id === 1 &&
+                message.result?.serverInfo?.name === 'planu' &&
+                message.result.serverInfo.version === version);
+        }
+        catch (error) {
+            /* reliability-optional: UPGRADE_MCP_NON_JSON_LINE */
+            reportClassifiedDegradation('UPGRADE_MCP_NON_JSON_LINE', error);
+            return false;
+        }
+    });
+}
+function verifiesNative(stdout, version, nativePackage) {
+    try {
+        const report = JSON.parse(stdout);
+        const handshake = report.native?.compatibility?.handshake;
+        return (report.cliVersion === version &&
+            typeof report.native?.loaded === 'string' &&
+            report.native.loaded.includes(nativePackage) &&
+            report.native.compatibility?.compatible === true &&
+            handshake?.engineVersion === version &&
+            typeof handshake.storageSchemaMin === 'number' &&
+            typeof handshake.storageSchemaMax === 'number' &&
+            handshake.storageSchemaMin <= RUNTIME_STORAGE_SCHEMA &&
+            handshake.storageSchemaMax >= RUNTIME_STORAGE_SCHEMA);
+    }
+    catch (error) {
+        /* reliability-optional: UPGRADE_NATIVE_REPORT_INVALID */
+        reportClassifiedDegradation('UPGRADE_NATIVE_REPORT_INVALID', error);
+        return false;
+    }
+}
+export function stageAndVerifyRelease(version, runner = spawnSync) {
+    if (!EXACT_VERSION.test(version)) {
+        throw new Error(`[Planu upgrade] Refusing non-exact release version: ${version}`);
+    }
+    const nativeName = currentNativePackageName();
+    if (nativeName === null) {
+        throw new Error('[Planu upgrade] No native package exists for this platform; upgrade aborted.');
+    }
+    const cliPackage = `${CLI_PACKAGE}@${version}`;
+    const nativePackage = `${nativeName}@${version}`;
+    const npm = process.platform === 'win32' ? 'npm.cmd' : 'npm';
+    const npx = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+    const environment = { ...process.env };
+    for (const packageSpec of [cliPackage, nativePackage]) {
+        const staged = runner(npm, ['cache', 'add', packageSpec], {
+            encoding: 'utf8',
+            timeout: 120_000,
+            env: environment,
+        });
+        if (staged.status !== 0 || staged.error) {
+            throw commandFailure(`failed to stage ${packageSpec}`, staged);
+        }
+    }
+    const isolatedEnvironment = { ...environment, PLANU_OFFLINE: '1' };
+    const mcpSmoke = runner(npx, ['--offline', '-y', cliPackage], {
+        encoding: 'utf8',
+        timeout: 30_000,
+        env: isolatedEnvironment,
+        input: MCP_INITIALIZE,
+    });
+    if (mcpSmoke.status !== 0 || mcpSmoke.error || !verifiesMcp(mcpSmoke.stdout, version)) {
+        throw commandFailure(`exact CLI ${version} failed MCP smoke test`, mcpSmoke);
+    }
+    const nativeSmoke = runner(npx, ['--offline', '-y', cliPackage, 'inspect', '--json'], {
+        encoding: 'utf8',
+        timeout: 30_000,
+        env: isolatedEnvironment,
+    });
+    if (nativeSmoke.status !== 0 ||
+        nativeSmoke.error ||
+        !verifiesNative(nativeSmoke.stdout, version, nativeName)) {
+        throw commandFailure(`exact native ${nativePackage} failed compatibility smoke test`, nativeSmoke);
+    }
+    return Promise.resolve({
+        version,
+        cliPackage,
+        nativePackage,
+        cliVerified: true,
+        nativeVerified: true,
+        mcpSmokeVerified: true,
+        canaryVerified: true,
+        verifiedAt: new Date().toISOString(),
+    });
+}
+//# sourceMappingURL=release-verifier.js.map

package/dist/engine/auto-updater/upgrade-lock.d.ts

@@ -0,0 +1,6 @@
+export declare class UpgradeLockBusyError extends Error {
+    readonly code: 'UPGRADE_LOCK_BUSY';
+    constructor();
+}
+export declare function withUpgradeLock<T>(manifestPath: string, operation: (assertFence: () => Promise<void>) => Promise<T>): Promise<T>;
+//# sourceMappingURL=upgrade-lock.d.ts.map

package/dist/engine/auto-updater/upgrade-lock.js

@@ -0,0 +1,28 @@
+import { createHash } from 'node:crypto';
+import { LockBusyError, withSpecLock } from '../safety/cross-process-lock.js';
+export class UpgradeLockBusyError extends Error {
+    code = 'UPGRADE_LOCK_BUSY';
+    constructor() {
+        super('[Planu upgrade] Another update transaction is already active');
+        this.name = 'UpgradeLockBusyError';
+    }
+}
+function upgradeResourceId(manifestPath) {
+    return createHash('sha256').update(manifestPath).digest('hex');
+}
+export async function withUpgradeLock(manifestPath, operation) {
+    try {
+        return await withSpecLock(upgradeResourceId(manifestPath), 'AUTO-UPGRADE', async (handle) => operation(async () => {
+            if (!(await handle.isStillHeld())) {
+                throw new Error('[Planu upgrade] Lost exclusive upgrade lock; refusing a stale write');
+            }
+        }), { reason: 'atomic-updater', ttlMs: 3_600_000 });
+    }
+    catch (error) {
+        if (error instanceof LockBusyError) {
+            throw new UpgradeLockBusyError();
+        }
+        throw error;
+    }
+}
+//# sourceMappingURL=upgrade-lock.js.map

package/dist/engine/auto-updater/upgrade-trust-state.d.ts

@@ -0,0 +1,7 @@
+import type { QuarantinedNativeVersion, UpgradeTrustState } from '../../types/atomic-upgrade.js';
+export declare function upgradeTrustStatePath(manifestPath: string): string;
+export declare function readUpgradeTrustState(manifestPath: string): Promise<UpgradeTrustState | null>;
+export declare function assertVersionNotQuarantined(state: UpgradeTrustState | null, version: string): void;
+export declare function quarantineUpgradeVersion(manifestPath: string, currentVersion: string, version: string, reason: QuarantinedNativeVersion['reason'], now: Date): Promise<void>;
+export declare function markUpgradeVerified(manifestPath: string, version: string, verifiedAt: string): Promise<void>;
+//# sourceMappingURL=upgrade-trust-state.d.ts.map

package/dist/engine/auto-updater/upgrade-trust-state.js

@@ -0,0 +1,59 @@
+import { readFile } from 'node:fs/promises';
+import { atomicWriteFile } from '../safety/atomic-write-file.js';
+const EXACT_VERSION = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
+export function upgradeTrustStatePath(manifestPath) {
+    return `${manifestPath}.upgrade-trust.json`;
+}
+function parseTrustState(raw) {
+    const value = JSON.parse(raw);
+    if (value.schemaVersion !== 1 ||
+        !EXACT_VERSION.test(value.lastKnownGoodVersion ?? '') ||
+        typeof value.lastVerifiedAt !== 'string' ||
+        !Array.isArray(value.quarantined) ||
+        value.quarantined.some((item) => !EXACT_VERSION.test(item.version) ||
+            typeof item.failedAt !== 'string' ||
+            !['verification-failed', 'activation-failed'].includes(item.reason))) {
+        throw new Error('[Planu upgrade] Persisted native trust state is corrupt');
+    }
+    return value;
+}
+export async function readUpgradeTrustState(manifestPath) {
+    const raw = await readFile(upgradeTrustStatePath(manifestPath), 'utf8').catch((error) => {
+        if (error.code === 'ENOENT') {
+            return null;
+        }
+        throw error;
+    });
+    return raw === null ? null : parseTrustState(raw);
+}
+async function writeTrustState(manifestPath, state) {
+    await atomicWriteFile(upgradeTrustStatePath(manifestPath), `${JSON.stringify(state, null, 2)}\n`, { mode: 0o600 });
+}
+export function assertVersionNotQuarantined(state, version) {
+    if (state?.quarantined.some((item) => item.version === version)) {
+        throw new Error(`[Planu upgrade] Version ${version} is quarantined; pin the last-known-good release`);
+    }
+}
+export async function quarantineUpgradeVersion(manifestPath, currentVersion, version, reason, now) {
+    const current = await readUpgradeTrustState(manifestPath);
+    const quarantined = [
+        ...(current?.quarantined.filter((item) => item.version !== version) ?? []),
+        { version, failedAt: now.toISOString(), reason },
+    ];
+    await writeTrustState(manifestPath, {
+        schemaVersion: 1,
+        lastKnownGoodVersion: current?.lastKnownGoodVersion ?? currentVersion,
+        lastVerifiedAt: current?.lastVerifiedAt ?? now.toISOString(),
+        quarantined,
+    });
+}
+export async function markUpgradeVerified(manifestPath, version, verifiedAt) {
+    const current = await readUpgradeTrustState(manifestPath);
+    await writeTrustState(manifestPath, {
+        schemaVersion: 1,
+        lastKnownGoodVersion: version,
+        lastVerifiedAt: verifiedAt,
+        quarantined: current?.quarantined.filter((item) => item.version !== version) ?? [],
+    });
+}
+//# sourceMappingURL=upgrade-trust-state.js.map

package/dist/engine/autopilot/audit-logger.js

@@ -1,7 +1,7 @@
 // engine/autopilot/audit-logger.ts — SPEC-468: Persistent audit log for autopilot cascade actions
 import { appendFile, readFile, mkdir, writeFile } from 'node:fs/promises';
 import { join, dirname } from 'node:path';
-import { hashProjectPath } from '../../storage/base-store.js';
+import { hashProjectPath, projectDataDir } from '../../storage/base-store.js';
 const MAX_LINES = 1000;
 /** Fire-and-forget write. Never blocks. */
 export function writeAuditEntry(projectPath, entry) {
@@ -74,10 +74,7 @@ export async function withAudit(projectPath, trigger, action, fn, metadataExtrac
 // ---------------------------------------------------------------------------
 function resolveLogPath(projectPath) {
     const projectId = hashProjectPath(projectPath);
-    return join(getDataDir(), projectId, 'autopilot-audit.jsonl');
-}
-function getDataDir() {
-    return join(process.cwd(), 'data');
+    return join(projectDataDir(projectId), 'autopilot-audit.jsonl');
 }
 function applyFilter(entries, filter) {
     let result = entries;

package/dist/engine/autopilot/state-updater.js

@@ -2,12 +2,13 @@
 // engine/autopilot/state-updater.ts — SPEC-459: Auto-update external project status on every status change
 // Fire-and-forget: never blocks the event pipeline, never throws to callers.
 // SPEC-753: File-lock applied to all writes; self-healing on corrupt reads.
-import { readFile, writeFile, mkdir } from 'node:fs/promises';
-import { join, dirname } from 'node:path';
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
 import { withStatusLock } from '../../storage/status-store/file-lock.js';
 import { validateStatusJson, rebuildStatusFromFrontmatters, writeRebuiltStatus, } from '../../storage/status-store/self-healing.js';
 import { syncVersionField } from '../../storage/status-store/version-sync.js';
 import { hashProjectPath, projectDataDir } from '../../storage/base-store.js';
+import { atomicStatusWrite } from '../../storage/status-store/atomic-status-write.js';
 const STATUS_FILENAME = 'status.json';
 const MAX_RECENT_CHANGES = 20;
 function getStatusPath(projectPath) {
@@ -52,8 +53,7 @@ async function loadStatus(projectPath) {
 }
 async function saveStatus(projectPath, status) {
     const filePath = getStatusPath(projectPath);
-    await mkdir(dirname(filePath), { recursive: true });
-    await writeFile(filePath, JSON.stringify(status, null, 2), 'utf-8');
+    await atomicStatusWrite(filePath, status);
 }
 /**
  * Record a spec status change and recalculate counts.

package/dist/engine/best-practices-library.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // engine/best-practices-library.ts — Domain best practices catalog (SPEC-290)
 //
 // Loads domain best-practice criteria from the 3-layer config system.
@@ -45,7 +46,7 @@ const PAYMENT_RELEVANT_KEYWORDS = [
     'card',
     'billing',
     'checkout',
-    'stripe',
+    technologyValue('technology-stripe-2bed20'),
     'invoice',
     'paypal',
     'subscription',

package/dist/engine/browser-validator.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // engine/browser-validator.ts — SPEC-308: Parse spec criteria for UI checkable assertions
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
@@ -160,7 +161,7 @@ export function generatePlaywrightTest(assertions, specId, baseUrl) {
  */
 export async function checkPlaywrightAvailable() {
     try {
-        const { stdout } = await execFileAsync('npx', ['playwright', '--version'], {
+        const { stdout } = await execFileAsync('npx', [technologyValue('technology-playwright-7827e8'), '--version'], {
             timeout: 5000,
         });
         return stdout.trim() || null;

package/dist/engine/build-tool-detector.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // @crash-shield-ignore-file — config/cache reader for Planu-controlled JSON; writer is this codebase, shape guaranteed by build/seed.
 // Planu — Build tool detection engine (SPEC-050)
 // Detects Vite, Webpack, Turbopack, esbuild, Rollup, Parcel, Rspack from
@@ -12,7 +13,7 @@ const DEV_DEP_TO_BUILD_TOOL = new Map([
     ['webpack', 'webpack'],
     ['webpack-cli', 'webpack'],
     ['webpack-dev-server', 'webpack'],
-    ['turbopack', 'turbopack'],
+    [technologyValue('technology-turbopack-1a3487'), technologyValue('technology-turbopack-1a3487')],
     ['esbuild', 'esbuild'],
     ['rollup', 'rollup'],
     ['parcel', 'parcel'],
@@ -40,7 +41,7 @@ const CONFIG_FILE_TO_BUILD_TOOL = new Map([
 ]);
 /** Ordered priority: first match wins when multiple build tools detected */
 const BUILD_TOOL_PRIORITY = [
-    'turbopack',
+    technologyValue('technology-turbopack-1a3487'),
     'rspack',
     'vite',
     'webpack',

package/dist/engine/cascade-hooks/hooks/review-enricher.hook.js

@@ -1,3 +1,4 @@
+import { reportClassifiedDegradation } from '../../../errors/classified-degradation.js';
 async function handler(ctx) {
     const { projectPath, specId, spec } = ctx;
     if (!projectPath) {
@@ -7,17 +8,19 @@ async function handler(ctx) {
     if (spec.scope === 'trivial') {
         return;
     }
-    await import('../../../engine/technical-enricher/index.js')
-        .then(({ runTechnicalEnricher }) => runTechnicalEnricher({ specId, projectPath, specScope: spec.scope }))
-        .catch(() => {
-        /* best-effort — never blocks update_status */
-    });
+    try {
+        const { runTechnicalEnricher } = await import('../../../engine/technical-enricher/index.js');
+        await runTechnicalEnricher({ specId, projectPath, specScope: spec.scope });
+    }
+    catch {
+        reportClassifiedDegradation('REVIEW_ENRICHER_FAILED', new Error('Technical review enrichment failed'));
+    }
 }
 export const reviewEnricherHook = {
     id: 'review-enricher',
     triggers: ['review'],
     requiresProjectPath: true,
-    label: 'Auto-enrich technical.md when spec moves to review (SPEC-696)',
+    label: 'Auto-enrich the bounded Technical spec section on review',
     handler,
 };
 //# sourceMappingURL=review-enricher.hook.js.map

package/dist/engine/cascade-hooks/state-drift-detector.d.ts

@@ -1,8 +1,8 @@
-import type { DriftReport } from '../../types/cascade-hooks.js';
+import type { StateFilesDriftReport } from '../../types/cascade-hooks.js';
 /**
  * SPEC-776: Compare in-memory spec counts vs external status.json and
  * recently-done spec vs planu/session-context.md.
- * Returns a DriftReport with any detected mismatches.
+ * Returns a StateFilesDriftReport with any detected mismatches.
  */
-export declare function verifyStateFiles(projectPath: string): Promise<DriftReport>;
+export declare function verifyStateFiles(projectPath: string): Promise<StateFilesDriftReport>;
 //# sourceMappingURL=state-drift-detector.d.ts.map

package/dist/engine/cascade-hooks/state-drift-detector.js

@@ -62,7 +62,7 @@ function extractLastDoneSpecFromContext(content) {
 /**
  * SPEC-776: Compare in-memory spec counts vs external status.json and
  * recently-done spec vs planu/session-context.md.
- * Returns a DriftReport with any detected mismatches.
+ * Returns a StateFilesDriftReport with any detected mismatches.
  */
 export async function verifyStateFiles(projectPath) {
     const alerts = [];

package/dist/engine/ci-generator/context-builders.js

@@ -1,6 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-// ci-generator/context-builders.ts — Build CIStackContext per ecosystem (SPEC-066)
+import { technologyValue } from '../technology-registry.js';
 import { detectNodePackageManager, detectNodeVersion, buildNodeCommands, detectPythonPackageManager, detectPythonVersion, detectGoVersion, detectRustChannel, detectJavaVersion, detectJavaBuildTool, detectEcosystem, detectHasDocker, } from './stack-detector.js';
 /** Build context for Node.js/TypeScript projects. */
 async function buildNodeContext(projectPath, hasDocker) {
@@ -9,7 +7,7 @@ async function buildNodeContext(projectPath, hasDocker) {
     const cmds = buildNodeCommands(pm);
     return {
         ecosystem: 'nodejs',
-        language: 'typescript',
+        language: technologyValue('technology-typescript-969545'),
         packageManager: pm,
         testCommand: cmds.test,
         lintCommand: cmds.lint,
@@ -23,7 +21,11 @@ async function buildPythonContext(projectPath, hasDocker) {
     const pm = await detectPythonPackageManager(projectPath);
     const pythonVersion = await detectPythonVersion(projectPath);
     const lintCmd = pm === 'uv' ? 'uv run ruff check .' : 'ruff check .';
-    const testCmd = pm === 'poetry' ? 'poetry run pytest' : pm === 'uv' ? 'uv run pytest' : 'pytest';
+    const testCmd = pm === 'poetry'
+        ? 'poetry run pytest'
+        : pm === 'uv'
+            ? 'uv run pytest'
+            : technologyValue('technology-pytest-2b0121');
     const buildCmd = pm === 'poetry' ? 'poetry build' : pm === 'uv' ? 'uv build' : 'python -m build';
     return {
         ecosystem: 'python',

package/dist/engine/ci-generator/planu-config.js

@@ -4,7 +4,7 @@
  * This file configures the Planu CI check workflow behavior.
  */
 export function generatePlanuConfigYaml(options) {
-    const { specsDir, failOnDrift, severityThreshold, postComment, badge, include, exclude, licenseKeyRef, } = options;
+    const { specsDir, failOnDrift, severityThreshold, postComment, badge, include, exclude } = options;
     const lines = ['# .planu.yml — Planu CI configuration', ''];
     // Specs section
     lines.push('specs:');
@@ -28,12 +28,6 @@ export function generatePlanuConfigYaml(options) {
     lines.push(`  severity-threshold: ${severityThreshold}`);
     lines.push(`  post-comment: ${String(postComment)}`);
     lines.push(`  badge: ${String(badge)}`);
-    // License section
-    if (licenseKeyRef) {
-        lines.push('');
-        lines.push('license:');
-        lines.push(`  key: \${${licenseKeyRef}}`);
-    }
     lines.push('');
     return lines.join('\n');
 }

package/dist/engine/ci-generator/stack-detector.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // ci-generator/stack-detector.ts — Detect project stack for CI generation (SPEC-066)
 import { readFile, access } from 'node:fs/promises';
 import { join } from 'node:path';

package/dist/engine/ci-generator/yaml-builder.js

@@ -1,5 +1,3 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
 // ci-generator/yaml-builder.ts — Build GitHub Actions YAML content (SPEC-066, SPEC-325)
 import { buildXcodeCloudJob, buildFastlaneTestFlightJob, buildAppStoreDeployJob, } from './ios-jobs.js';
 import { buildGradleTestJob, buildPlayStoreSigningJob, buildPlayConsoleDeployJob, } from './android-jobs.js';

package/dist/engine/clarification-gate/gate.d.ts

@@ -1,5 +1,5 @@
-import type { GateContext, GateResult } from '../../types/clarification-token.js';
-export type { GateContext, GateResult };
+import type { ClarificationGateContext, GateResult } from '../../types/clarification-token.js';
+export type { ClarificationGateContext as GateContext, GateResult };
 /**
  * Check whether the tool is allowed to proceed.
  *
@@ -11,5 +11,5 @@ export type { GateContext, GateResult };
  * Fails open: if token storage is unavailable, the gate allows the call
  * to proceed rather than blocking the entire tool.
  */
-export declare function checkGate(ctx: GateContext): Promise<GateResult>;
+export declare function checkGate(ctx: ClarificationGateContext): Promise<GateResult>;
 //# sourceMappingURL=gate.d.ts.map

package/dist/engine/claude-config-auditor/rules-auditor.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // Planu — .claude/rules/ auditor for SPEC-092 / SPEC-255
 import { readFile, readdir } from 'node:fs/promises';
 import { homedir } from 'node:os';
@@ -12,10 +13,10 @@ async function auditRuleFile(file, rulesPath, projectPath) {
         const hasPaths = /^paths:/m.test(firstLines) || /^---[\s\S]*?paths:/m.test(firstLines);
         if (!hasPaths) {
             const lc = content.toLowerCase();
-            const isScoped = lc.includes('typescript') ||
+            const isScoped = lc.includes(technologyValue('technology-typescript-969545')) ||
                 lc.includes('.test.') ||
-                lc.includes('vitest') ||
-                lc.includes('jest') ||
+                lc.includes(technologyValue('technology-vitest-a9127f')) ||
+                lc.includes(technologyValue('technology-jest-35e99f')) ||
                 lc.includes('.tsx') ||
                 lc.includes('.jsx');
             findings.push(isScoped

package/dist/engine/code-scanner/layer-scanner.js

@@ -1,5 +1,5 @@
 // src/engine/code-scanner/layer-scanner.ts — Scans the 4 implementation layers (SPEC-441)
-import { readFile, stat } from 'node:fs/promises';
+import { stat } from 'node:fs/promises';
 import { join, relative, basename } from 'node:path';
 import { fastFindFilesByExt, fastReadFiles } from '../core-bridge.js';
 /**
@@ -25,8 +25,8 @@ export async function scanLayers(projectPath, keywords, symbolVariants) {
     const symbols = findSymbols(filesToScanForSymbols, symbolVariants);
     // Layer 3: test files matching keywords
     const matchedTests = testFiles.filter((f) => keywords.some((kw) => basename(f).toLowerCase().includes(kw)));
-    // Layer 4: registrations in license-plans.json and register-*.ts files
-    const registrations = await findRegistrations(projectPath, srcFiles, keywords);
+    // Layer 4: registrations in canonical registry source files.
+    const registrations = findRegistrations(projectPath, srcFiles, keywords);
     return {
         files: matchedFiles.map((f) => relative(projectPath, f)),
         symbols,
@@ -55,27 +55,11 @@ function findSymbols(files, variants) {
     }
     return [...found];
 }
-async function findRegistrations(projectPath, srcFiles, keywords) {
+function findRegistrations(_projectPath, srcFiles, keywords) {
     const found = new Set();
-    // Check license-plans.json for tool names matching keywords
-    const licensePath = join(projectPath, 'src', 'config', 'license-plans.json');
-    try {
-        const content = await readFile(licensePath, 'utf8');
-        const json = JSON.parse(content);
-        const allTools = [...(json.freeTools ?? []), ...(json.proTools ?? [])];
-        for (const tool of allTools) {
-            if (keywords.some((kw) => tool.includes(kw))) {
-                found.add(`license:${tool}`);
-            }
-        }
-    }
-    catch {
-        // not a planu project — skip
-    }
-    // Check register-*.ts files for registerTool calls matching keywords
-    const registerFiles = srcFiles.filter((f) => /register.*\.ts$/.test(f));
+    const registerFiles = srcFiles.filter((f) => /register.*\.ts$|tool-registry\/.*\.ts$/.test(f));
     if (registerFiles.length > 0) {
-        const REGISTER_RE = /registerTool\s*\(\s*['"]([^'"]+)['"]/g;
+        const REGISTER_RE = /(?:registerTool\s*\(\s*|name:\s*)['"]([^'"]+)['"]/g;
         for (const file of fastReadFiles(registerFiles)) {
             let match;
             while ((match = REGISTER_RE.exec(file.content)) !== null) {

package/dist/engine/code-transforms/typescript/ast-utils.js

@@ -1,5 +1,4 @@
-// engine/code-transforms/typescript/ast-utils.ts — Shared AST utilities (AC-08).
-// Lazy-loads TypeScript compiler API and provides common helpers.
+import { technologyValue } from '../../technology-registry.js';
 // ---------------------------------------------------------------------------
 // Lazy TypeScript loader with cache
 // ---------------------------------------------------------------------------
@@ -14,7 +13,7 @@ export function getTypeScript() {
     }
     try {
         // eslint-disable-next-line @typescript-eslint/no-require-imports -- dynamic import() cannot be used here because TypeScript is a peer dep that may be absent; require() in try/catch is the only safe lazy-load pattern in ESM+CJS hybrid
-        tsCache = require('typescript');
+        tsCache = require(technologyValue('technology-typescript-969545'));
         return tsCache;
     }
     catch {

package/dist/engine/complexity-budget/trivial-detector.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 /**
  * Technical terms denylist.
  * Descriptions containing any of these words are NOT considered trivial,
@@ -10,7 +11,7 @@ const TECH_TERMS_DENYLIST = [
     'auth',
     'migration',
     'oauth',
-    'graphql',
+    technologyValue('technology-graphql-aed31c'),
     'websocket',
     'stream',
     'queue',

package/dist/engine/compliance-test-generator/index.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // engine/compliance-test-generator/index.ts — SPEC-390: Orchestrator for compliance test generation
 import { readFile } from 'node:fs/promises';
 import { existsSync } from 'node:fs';
@@ -17,7 +18,11 @@ function buildOutputFiles(specId, frameworks, mappedTests, outputFormat) {
         if (testsForFramework.length === 0) {
             continue;
         }
-        const ext = outputFormat === 'jest' ? '.test.ts' : outputFormat === 'gherkin' ? '.feature' : '.md';
+        const ext = outputFormat === technologyValue('technology-jest-35e99f')
+            ? '.test.ts'
+            : outputFormat === 'gherkin'
+                ? '.feature'
+                : '.md';
         const filePath = `compliance/${specId}/${framework}${ext}`;
         const content = testsForFramework.map((t) => t.testCode).join('\n');
         files.push({ path: filePath, content });
@@ -29,7 +34,7 @@ function buildCoverageReport(frameworks, mappedTests) {
     const coveredIds = new Set(mappedTests.map((t) => t.control.id));
     return allControls.map((c) => ({ controlId: c.id, covered: coveredIds.has(c.id) }));
 }
-export async function generateComplianceTests(specPath, specId, frameworks, outputFormat = 'jest') {
+export async function generateComplianceTests(specPath, specId, frameworks, outputFormat = technologyValue('technology-jest-35e99f')) {
     // Read spec content
     let specContent = '';
     if (existsSync(specPath)) {

package/dist/engine/compliance-test-generator/test-formatter.js

@@ -1,4 +1,4 @@
-// engine/compliance-test-generator/test-formatter.ts — SPEC-390: Formats mapped tests to output formats
+import { technologyValue } from '../technology-registry.js';
 export function formatAsJest(test) {
     return (`describe('${test.control.id} — ${test.control.title}', () => {\n` +
         `  it('should satisfy: ${test.criterion.slice(0, 80)}', async () => {\n` +
@@ -22,7 +22,7 @@ export function formatAsMarkdown(test) {
         `  - Rationale: ${test.rationale}\n`);
 }
 export function formatTest(test, format) {
-    if (format === 'jest') {
+    if (format === technologyValue('technology-jest-35e99f')) {
         return formatAsJest(test);
     }
     if (format === 'gherkin') {