@planu/cli 4.13.0 → 5.0.0

package/dist/engine/multi-app-detector/core.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../technology-registry.js';
 // Planu — Multi-app, monorepo, and API contract detection: core logic
 import { readdir } from 'node:fs/promises';
 import { join, basename } from 'node:path';
@@ -144,12 +145,12 @@ export async function detectApiContracts(projectPath) {
     }
     // GraphQL
     if (await hasAnyFile(projectPath, ['schema.graphql', 'schema.gql', '**/*.graphql'])) {
-        contracts.push({ type: 'graphql', endpoints: [] });
+        contracts.push({ type: technologyValue('technology-graphql-aed31c'), endpoints: [] });
     }
     // tRPC
     const deps = await collectDependencies(projectPath);
     if (deps.has('@trpc/server') || deps.has('@trpc/client')) {
-        contracts.push({ type: 'trpc', endpoints: [] });
+        contracts.push({ type: technologyValue('technology-trpc-7a75ed'), endpoints: [] });
     }
     // gRPC
     if (await hasAnyFile(projectPath, ['**/*.proto'])) {

package/dist/engine/multi-teammate-review/disagreement-counter.js

@@ -3,6 +3,7 @@
 import { join } from 'node:path';
 import { readFile } from 'node:fs/promises';
 import { atomicWriteFile } from '../safety/atomic-write-file.js';
+import { projectDataDir } from '../../storage/base-store.js';
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -12,7 +13,7 @@ const PURGE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
 // Path helper
 // ---------------------------------------------------------------------------
 function storePath(projectId) {
-    return join('planu', 'data', 'projects', projectId, 'disagreements.json');
+    return join(projectDataDir(projectId), 'disagreements.json');
 }
 function storeKey(k) {
     return `${k.specId}::${k.frontmatterSha}`;

package/dist/engine/multi-teammate-review/panel-orchestrator.js

@@ -179,7 +179,6 @@ export async function runReviewPanel(input, invoker) {
             // Fire telemetry event (fire-and-forget)
             sendTelemetryEvent({
                 event: 'panel_heterogeneity_violation',
-                installationId: 'anonymous',
                 properties: {
                     duplicateCount: hetResult.duplicates.length,
                     specId: input.specId ?? 'unknown',
@@ -296,7 +295,6 @@ export async function runReviewPanel(input, invoker) {
         // Emit telemetry for downgrade (fire-and-forget — never throws)
         sendTelemetryEvent({
             event: 'ram_guardrail_downgrade',
-            installationId: 'anonymous',
             properties: {
                 requested: ramDecision.requested,
                 allowed: ramDecision.allowed,

package/dist/engine/mutation-config-generator.js

@@ -1,3 +1,4 @@
+import { technologyValue } from './technology-registry.js';
 // engine/mutation-config-generator.ts — SPEC-323
 // Detects project stack and generates the appropriate mutation testing config file.
 import { readFile } from 'node:fs/promises';
@@ -15,13 +16,15 @@ async function detectStack(projectPath) {
             ...(pkg.dependencies ?? {}),
             ...(pkg.devDependencies ?? {}),
         };
-        const language = 'typescript' in deps ? 'typescript' : 'javascript';
+        const language = technologyValue('technology-typescript-969545') in deps
+            ? technologyValue('technology-typescript-969545')
+            : 'javascript';
         let testFramework = 'unknown';
-        if ('vitest' in deps) {
-            testFramework = 'vitest';
+        if (technologyValue('technology-vitest-a9127f') in deps) {
+            testFramework = technologyValue('technology-vitest-a9127f');
         }
-        else if ('jest' in deps) {
-            testFramework = 'jest';
+        else if (technologyValue('technology-jest-35e99f') in deps) {
+            testFramework = technologyValue('technology-jest-35e99f');
         }
         else if ('mocha' in deps) {
             testFramework = 'mocha';
@@ -32,13 +35,13 @@ async function detectStack(projectPath) {
         const hasPython = (await readFile(join(projectPath, 'setup.py'), 'utf8').catch(() => null)) !== null ||
             (await readFile(join(projectPath, 'pyproject.toml'), 'utf8').catch(() => null)) !== null;
         if (hasPython) {
-            return { language: 'python', testFramework: 'pytest' };
+            return { language: 'python', testFramework: technologyValue('technology-pytest-2b0121') };
         }
         const hasMaven = (await readFile(join(projectPath, 'pom.xml'), 'utf8').catch(() => null)) !== null;
         if (hasMaven) {
             return { language: 'java', testFramework: 'junit' };
         }
-        return { language: 'typescript', testFramework: 'unknown' };
+        return { language: technologyValue('technology-typescript-969545'), testFramework: 'unknown' };
     }
 }
 // ---------------------------------------------------------------------------

package/dist/engine/native-capability-policy.d.ts

@@ -0,0 +1,4 @@
+import type { NativeCapabilityPolicy, NativeFallbackMode } from '../types/core-bridge.js';
+export declare const NATIVE_CAPABILITY_POLICIES: readonly NativeCapabilityPolicy[];
+export declare function nativeFallbackMode(capability: string): NativeFallbackMode | null;
+//# sourceMappingURL=native-capability-policy.d.ts.map

package/dist/engine/native-capability-policy.js

@@ -0,0 +1,24 @@
+export const NATIVE_CAPABILITY_POLICIES = [
+    {
+        capability: 'core-acceleration-v1',
+        classification: 'optimization',
+        fallback: 'typescript-visible-degradation',
+        parityContract: 'tests/integration/native-platform-matrix.test.ts',
+    },
+    {
+        capability: 'project-graph-v1',
+        classification: 'optimization',
+        fallback: 'typescript-visible-degradation',
+        parityContract: 'tests/integration/native-project-graph-e2e.test.ts',
+    },
+    {
+        capability: 'macos-keychain-v1',
+        classification: 'correctness-critical',
+        fallback: 'fail-closed',
+        parityContract: 'tests/security/macos-keychain.integration.test.ts',
+    },
+];
+export function nativeFallbackMode(capability) {
+    return (NATIVE_CAPABILITY_POLICIES.find((policy) => policy.capability === capability)?.fallback ?? null);
+}
+//# sourceMappingURL=native-capability-policy.js.map

package/dist/engine/native-platform.d.ts

@@ -0,0 +1,3 @@
+/** Detects musl through independent local signals and reports failed probes. */
+export declare function detectMusl(): boolean;
+//# sourceMappingURL=native-platform.d.ts.map

package/dist/engine/native-platform.js

@@ -0,0 +1,44 @@
+import { existsSync, readFileSync, readdirSync } from 'node:fs';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
+let cachedMusl;
+function probeMuslSignal(code, probe) {
+    try {
+        return probe();
+    }
+    catch (error) {
+        void error;
+        /* reliability-optional: NATIVE_LIBC_PROBE_FAILED */
+        reportClassifiedDegradation(code, new Error('Native libc probe unavailable'));
+        return false;
+    }
+}
+/** Detects musl through independent local signals and reports failed probes. */
+export function detectMusl() {
+    if (cachedMusl !== undefined) {
+        return cachedMusl;
+    }
+    if (process.platform !== 'linux') {
+        cachedMusl = false;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_ALPINE_PROBE_FAILED', () => existsSync('/etc/alpine-release'))) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_REPORT_PROBE_FAILED', () => {
+        const reportApi = process.report;
+        const report = reportApi?.getReport();
+        return (report !== undefined &&
+            /musl/iu.test(typeof report === 'string' ? report : JSON.stringify(report)));
+    })) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    if (probeMuslSignal('NATIVE_LIBC_LDD_PROBE_FAILED', () => existsSync('/usr/bin/ldd') && /musl/iu.test(readFileSync('/usr/bin/ldd', 'utf8')))) {
+        cachedMusl = true;
+        return cachedMusl;
+    }
+    cachedMusl = probeMuslSignal('NATIVE_LIBC_LINKER_PROBE_FAILED', () => readdirSync('/lib').some((entry) => entry.startsWith('ld-musl-')));
+    return cachedMusl;
+}
+//# sourceMappingURL=native-platform.js.map

package/dist/engine/native-runtime-handshake.d.ts

@@ -0,0 +1,20 @@
+import type { NativeArtifactManifest, NativeRuntimeCompatibility, NativeRuntimeHandshake } from '../types/core-bridge.js';
+export declare const NATIVE_PROTOCOL_ABI = 1;
+export declare const NATIVE_CAPABILITY_ABI = 2;
+export declare const NATIVE_NODE_API_ABI = 4;
+/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
+export declare const RUNTIME_STORAGE_SCHEMA = 4;
+export declare function inspectNativeArtifact(artifactPath: string, trustedPublicKeyInput?: string | Buffer): {
+    artifactSha256: string;
+    manifest: NativeArtifactManifest | null;
+};
+export declare function negotiateNativeRuntime(handshake: NativeRuntimeHandshake | null, manifest: NativeArtifactManifest | null, expected: {
+    cliVersion: string;
+    target: string;
+    artifactSha256: string;
+    protocolAbi?: number;
+    capabilityAbi?: number;
+    nodeApiAbi?: number;
+    storageSchema?: number;
+}): NativeRuntimeCompatibility;
+//# sourceMappingURL=native-runtime-handshake.d.ts.map

package/dist/engine/native-runtime-handshake.js

@@ -0,0 +1,230 @@
+/* eslint-disable complexity -- the fail-closed manifest boundary validates every signed field */
+/* eslint-disable @typescript-eslint/no-unnecessary-condition -- Partial models untrusted JSON at runtime */
+import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
+import { lstatSync, readFileSync } from 'node:fs';
+import { basename, dirname, join } from 'node:path';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
+export const NATIVE_PROTOCOL_ABI = 1;
+export const NATIVE_CAPABILITY_ABI = 2;
+export const NATIVE_NODE_API_ABI = 4;
+/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
+export const RUNTIME_STORAGE_SCHEMA = 4;
+export function inspectNativeArtifact(artifactPath, trustedPublicKeyInput) {
+    const hash = (value) => createHash('sha256').update(value).digest('hex');
+    let artifactSha256 = '';
+    const manifestPath = `${artifactPath}.manifest.json`;
+    try {
+        const currentUid = process.getuid?.();
+        for (const path of [artifactPath, manifestPath]) {
+            const stat = lstatSync(path);
+            if (stat.isSymbolicLink() ||
+                (process.platform !== 'win32' &&
+                    ((currentUid !== undefined && stat.uid !== currentUid) || (stat.mode & 0o022) !== 0))) {
+                return { artifactSha256, manifest: null };
+            }
+        }
+        artifactSha256 = hash(readFileSync(artifactPath));
+        const parsed = JSON.parse(readFileSync(manifestPath, 'utf8'));
+        if (typeof parsed !== 'object' ||
+            parsed === null ||
+            !('schemaVersion' in parsed) ||
+            parsed.schemaVersion !== 2 ||
+            !('artifactSha256' in parsed) ||
+            typeof parsed.artifactSha256 !== 'string' ||
+            !('capabilities' in parsed) ||
+            !Array.isArray(parsed.capabilities) ||
+            !parsed.capabilities.every((capability) => typeof capability === 'string')) {
+            return { artifactSha256, manifest: null };
+        }
+        const candidate = parsed;
+        const expectedSbomName = `${basename(artifactPath)}.sbom.json`;
+        const exactSemver = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
+        const expectedCapabilities = [
+            'core-acceleration-v1',
+            'project-graph-v1',
+            ...(candidate.platform === 'darwin' ? ['macos-keychain-v1'] : []),
+        ];
+        if (!exactSemver.test(candidate.cliVersion ?? '') ||
+            !exactSemver.test(candidate.engineVersion ?? '') ||
+            !/^[A-Za-z0-9._:-]{1,200}$/u.test(candidate.buildId ?? '') ||
+            candidate.protocolAbi !== NATIVE_PROTOCOL_ABI ||
+            candidate.capabilityAbi !== NATIVE_CAPABILITY_ABI ||
+            candidate.nodeApiAbi !== NATIVE_NODE_API_ABI ||
+            !Number.isSafeInteger(candidate.storageSchemaMin) ||
+            !Number.isSafeInteger(candidate.storageSchemaMax) ||
+            (candidate.storageSchemaMin ?? 0) < 1 ||
+            (candidate.storageSchemaMax ?? 0) < (candidate.storageSchemaMin ?? 0) ||
+            !['darwin', 'linux', 'win32'].includes(candidate.platform ?? '') ||
+            !['arm64', 'x64'].includes(candidate.arch ?? '') ||
+            (candidate.platform === 'linux'
+                ? !['glibc', 'musl'].includes(candidate.libc ?? '')
+                : candidate.libc !== null) ||
+            candidate.target !==
+                [candidate.platform, candidate.arch, candidate.libc].filter(Boolean).join('-') ||
+            JSON.stringify(candidate.capabilities) !== JSON.stringify(expectedCapabilities) ||
+            !/^[a-f0-9]{64}$/u.test(candidate.artifactSha256 ?? '') ||
+            candidate.sbom?.format !== 'CycloneDX-1.5' ||
+            candidate.sbom.path !== expectedSbomName ||
+            !/^[a-f0-9]{64}$/u.test(candidate.sbom.sha256 ?? '') ||
+            !/^[a-f0-9]{40}$/u.test(candidate.provenance?.sourceCommit ?? '') ||
+            typeof candidate.provenance?.sourceTreeDirty !== 'boolean' ||
+            !Number.isSafeInteger(candidate.provenance?.sourceDateEpoch) ||
+            (candidate.provenance?.sourceDateEpoch ?? -1) < 0 ||
+            !candidate.provenance?.builder ||
+            candidate.provenance.builder.length > 256 ||
+            !candidate.provenance.rustToolchain ||
+            (candidate.provenance.zigVersion !== null &&
+                typeof candidate.provenance.zigVersion !== 'string') ||
+            candidate.signature?.algorithm !== 'Ed25519' ||
+            !/^[a-f0-9]{64}$/u.test(candidate.signature.keyId ?? '') ||
+            !/^[A-Za-z0-9+/]{86}==$/u.test(candidate.signature.value ?? '')) {
+            return { artifactSha256, manifest: null };
+        }
+        const sbomPath = join(dirname(artifactPath), expectedSbomName);
+        const sbomStat = lstatSync(sbomPath);
+        if (sbomStat.isSymbolicLink() ||
+            (process.platform !== 'win32' &&
+                ((process.getuid?.() !== undefined && sbomStat.uid !== process.getuid?.()) ||
+                    (sbomStat.mode & 0o022) !== 0)) ||
+            hash(readFileSync(sbomPath)) !== candidate.sbom.sha256) {
+            return { artifactSha256, manifest: null };
+        }
+        const sbomValue = JSON.parse(readFileSync(sbomPath, 'utf8'));
+        if (!isValidSbom(sbomValue, candidate.engineVersion, artifactSha256)) {
+            return { artifactSha256, manifest: null };
+        }
+        const { signature, ...unsigned } = candidate;
+        const publicKey = createPublicKey(trustedPublicKeyInput ??
+            readFileSync(join(import.meta.dirname, '..', 'config', 'native-release-public-key.pem')));
+        const publicDer = publicKey.export({ type: 'spki', format: 'der' });
+        if (hash(publicDer) !== signature.keyId ||
+            !verifySignature(null, Buffer.from(JSON.stringify(unsigned)), publicKey, Buffer.from(signature.value, 'base64'))) {
+            return { artifactSha256, manifest: null };
+        }
+        return { artifactSha256, manifest: candidate };
+    }
+    catch (error) {
+        void error;
+        /* reliability-optional: NATIVE_ARTIFACT_INSPECTION_FAILED */
+        reportClassifiedDegradation('NATIVE_ARTIFACT_INSPECTION_FAILED', new Error('Native artifact inspection failed closed'));
+        return { artifactSha256, manifest: null };
+    }
+}
+function isValidSbom(value, engineVersion, artifactSha256) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    const sbom = value;
+    const componentsValid = Array.isArray(sbom.components) &&
+        sbom.components.length > 0 &&
+        sbom.components.every((component) => typeof component === 'object' &&
+            component !== null &&
+            typeof component['bom-ref'] === 'string' &&
+            typeof component.name === 'string' &&
+            typeof component.version === 'string');
+    const dependenciesValid = Array.isArray(sbom.dependencies) &&
+        sbom.dependencies.some((dependency) => typeof dependency === 'object' &&
+            dependency !== null &&
+            Array.isArray(dependency.dependsOn));
+    const hashes = sbom.metadata?.component?.hashes;
+    const artifactBound = Array.isArray(hashes) &&
+        hashes.some((entry) => typeof entry === 'object' &&
+            entry !== null &&
+            entry.alg === 'SHA-256' &&
+            entry.content === artifactSha256);
+    return (sbom.bomFormat === 'CycloneDX' &&
+        sbom.specVersion === '1.5' &&
+        sbom.version === 1 &&
+        sbom.metadata?.component?.name === 'planu-core' &&
+        sbom.metadata.component.version === engineVersion &&
+        componentsValid &&
+        dependenciesValid &&
+        artifactBound);
+}
+export function negotiateNativeRuntime(handshake, manifest, expected) {
+    if (!handshake) {
+        return {
+            compatible: false,
+            reasons: ['native runtime does not expose planuRuntimeHandshake'],
+            handshake: null,
+        };
+    }
+    if (!manifest) {
+        return {
+            compatible: false,
+            reasons: ['native artifact manifest is missing, unsafe or invalid'],
+            handshake,
+        };
+    }
+    const reasons = [];
+    const protocolAbi = expected.protocolAbi ?? NATIVE_PROTOCOL_ABI;
+    const capabilityAbi = expected.capabilityAbi ?? NATIVE_CAPABILITY_ABI;
+    const nodeApiAbi = expected.nodeApiAbi ?? NATIVE_NODE_API_ABI;
+    const storageSchema = expected.storageSchema ?? RUNTIME_STORAGE_SCHEMA;
+    const handshakeCapabilitiesValid = Array.isArray(handshake.capabilities) &&
+        handshake.capabilities.every((capability) => typeof capability === 'string');
+    const manifestCapabilitiesValid = Array.isArray(manifest.capabilities) &&
+        manifest.capabilities.every((capability) => typeof capability === 'string');
+    if (manifest.cliVersion !== expected.cliVersion) {
+        reasons.push(`CLI version mismatch: expected ${expected.cliVersion}, got ${manifest.cliVersion}`);
+    }
+    if (handshake.engineVersion !== expected.cliVersion) {
+        reasons.push(`engine version mismatch: expected ${expected.cliVersion}, got ${handshake.engineVersion}`);
+    }
+    if (handshake.engineVersion !== manifest.engineVersion) {
+        reasons.push('native engine version does not match artifact manifest');
+    }
+    if (handshake.buildId !== manifest.buildId) {
+        reasons.push('native build identity does not match artifact manifest');
+    }
+    if (handshake.protocolAbi !== protocolAbi) {
+        reasons.push(`protocol ABI mismatch: expected ${protocolAbi}, got ${handshake.protocolAbi}`);
+    }
+    if (handshake.protocolAbi !== manifest.protocolAbi) {
+        reasons.push('native protocol ABI does not match artifact manifest');
+    }
+    if (handshake.capabilityAbi !== capabilityAbi) {
+        reasons.push(`capability ABI mismatch: expected ${capabilityAbi}, got ${handshake.capabilityAbi}`);
+    }
+    if (handshake.capabilityAbi !== manifest.capabilityAbi) {
+        reasons.push('native capability ABI does not match artifact manifest');
+    }
+    if (handshake.nodeApiAbi !== nodeApiAbi) {
+        reasons.push(`Node-API ABI mismatch: expected ${nodeApiAbi}, got ${handshake.nodeApiAbi}`);
+    }
+    if (handshake.nodeApiAbi !== manifest.nodeApiAbi) {
+        reasons.push('native Node-API ABI does not match artifact manifest');
+    }
+    if (!handshakeCapabilitiesValid) {
+        reasons.push('native runtime capabilities are malformed');
+    }
+    if (!manifestCapabilitiesValid) {
+        reasons.push('native artifact manifest capabilities are malformed');
+    }
+    if (handshakeCapabilitiesValid &&
+        manifestCapabilitiesValid &&
+        JSON.stringify(handshake.capabilities) !== JSON.stringify(manifest.capabilities)) {
+        reasons.push('native capabilities do not match artifact manifest');
+    }
+    if (storageSchema < handshake.storageSchemaMin || storageSchema > handshake.storageSchemaMax) {
+        reasons.push(`storage schema ${storageSchema} is outside native range ${handshake.storageSchemaMin}-${handshake.storageSchemaMax}`);
+    }
+    if (handshake.storageSchemaMin !== manifest.storageSchemaMin ||
+        handshake.storageSchemaMax !== manifest.storageSchemaMax) {
+        reasons.push('native storage schema range does not match artifact manifest');
+    }
+    if (handshake.target !== expected.target) {
+        reasons.push(`target mismatch: expected ${expected.target}, got ${handshake.target}`);
+    }
+    if (handshake.target !== manifest.target) {
+        reasons.push('native target does not match artifact manifest');
+    }
+    if (manifest.target !== [manifest.platform, manifest.arch, manifest.libc].filter(Boolean).join('-')) {
+        reasons.push('native manifest target does not match platform/arch/libc dimensions');
+    }
+    if (manifest.artifactSha256 !== expected.artifactSha256) {
+        reasons.push('native artifact SHA-256 mismatch');
+    }
+    return { compatible: reasons.length === 0, reasons, handshake };
+}
+//# sourceMappingURL=native-runtime-handshake.js.map

package/dist/engine/network-policy.d.ts

@@ -0,0 +1,27 @@
+import type { ClientRequest } from 'node:http';
+import type { NetworkConsentReceipt, NetworkPurpose, NetworkRequestPurpose } from '../types/network-policy.js';
+export declare const NETWORK_CONSENT_VERSION: 1;
+export declare class OfflineNetworkError extends Error {
+    readonly destination: string;
+    readonly code = "PLANU_OFFLINE_NETWORK_BLOCKED";
+    constructor(destination: string);
+}
+export declare class NetworkConsentRequiredError extends Error {
+    readonly destination: string;
+    readonly purpose: NetworkRequestPurpose;
+    readonly code = "PLANU_NETWORK_CONSENT_REQUIRED";
+    constructor(destination: string, purpose: NetworkRequestPurpose);
+}
+export declare function assertNetworkAllowed(destination: string, purpose?: NetworkRequestPurpose): void;
+/** Scope current-version consent to one explicit operation and its async descendants. */
+export declare function withNetworkConsent<T>(purpose: NetworkPurpose, operation: (receipt: NetworkConsentReceipt) => T): T;
+/** A purpose-aware fetch for code paths that obtained explicit user consent. */
+export declare function networkFetch(receipt: NetworkConsentReceipt, input: string | URL | Request, init?: RequestInit): Promise<Response>;
+export declare function networkHttpRequest(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpGet(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpsRequest(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+export declare function networkHttpsGet(receipt: NetworkConsentReceipt, ...args: unknown[]): ClientRequest;
+/** Install once; every unscoped fetch fails closed before touching the transport. */
+export declare function installNetworkPolicy(): void;
+export declare function restoreNetworkPolicyForTests(): void;
+//# sourceMappingURL=network-policy.d.ts.map

package/dist/engine/network-policy.js

@@ -0,0 +1,175 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+import { createRequire, syncBuiltinESMExports } from 'node:module';
+export const NETWORK_CONSENT_VERSION = 1;
+const consentStorage = new AsyncLocalStorage();
+const moduleFetch = globalThis.fetch.bind(globalThis);
+let originalFetch = moduleFetch;
+let installed = false;
+const consentReceiptToken = Symbol('planu.network-consent');
+const require = createRequire(import.meta.url);
+const httpModule = require('node:http');
+const httpsModule = require('node:https');
+const originalHttpRequest = httpModule.request;
+const originalHttpGet = httpModule.get;
+const originalHttpsRequest = httpsModule.request;
+const originalHttpsGet = httpsModule.get;
+export class OfflineNetworkError extends Error {
+    destination;
+    code = 'PLANU_OFFLINE_NETWORK_BLOCKED';
+    constructor(destination) {
+        super(`[Planu] Network access is blocked while PLANU_OFFLINE=1: ${destination}`);
+        this.destination = destination;
+        this.name = 'OfflineNetworkError';
+    }
+}
+export class NetworkConsentRequiredError extends Error {
+    destination;
+    purpose;
+    code = 'PLANU_NETWORK_CONSENT_REQUIRED';
+    constructor(destination, purpose) {
+        super(`[Planu] Network access for ${purpose} requires explicit consent at policy version ${String(NETWORK_CONSENT_VERSION)}`);
+        this.destination = destination;
+        this.purpose = purpose;
+        this.name = 'NetworkConsentRequiredError';
+    }
+}
+function environmentConsent() {
+    const entries = (process.env.PLANU_NETWORK_CONSENT ?? '')
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean);
+    const purposes = new Set();
+    for (const entry of entries) {
+        const [purpose, rawVersion] = entry.split('@');
+        if (isNetworkPurpose(purpose) && Number(rawVersion) === NETWORK_CONSENT_VERSION) {
+            purposes.add(purpose);
+        }
+    }
+    return purposes.size > 0 ? { purposes, version: NETWORK_CONSENT_VERSION } : undefined;
+}
+function isNetworkPurpose(value) {
+    return (value === 'dependency-audit' ||
+        value === 'feedback' ||
+        value === 'integration' ||
+        value === 'oauth' ||
+        value === 'registry' ||
+        value === 'telemetry' ||
+        value === 'updates');
+}
+function activeConsent() {
+    return consentStorage.getStore() ?? environmentConsent();
+}
+export function assertNetworkAllowed(destination, purpose = 'unclassified') {
+    if (process.env.PLANU_OFFLINE === '1') {
+        throw new OfflineNetworkError(destination);
+    }
+    // Legacy direct clients call this guard before creating a request. Consent is
+    // centrally enforced once the process-wide wrappers are installed; retaining
+    // the pre-install offline check keeps isolated library tests and CLI imports safe.
+    if (!installed) {
+        return;
+    }
+    const consent = activeConsent();
+    if (purpose === 'unclassified' ||
+        consent?.version !== NETWORK_CONSENT_VERSION ||
+        !consent.purposes.has(purpose)) {
+        throw new NetworkConsentRequiredError(destination, purpose);
+    }
+}
+/** Scope current-version consent to one explicit operation and its async descendants. */
+export function withNetworkConsent(purpose, operation) {
+    const inherited = activeConsent();
+    const purposes = new Set(inherited?.purposes ?? []);
+    purposes.add(purpose);
+    const receipt = {
+        purpose,
+        version: NETWORK_CONSENT_VERSION,
+        token: consentReceiptToken,
+    };
+    return consentStorage.run({ purposes, version: NETWORK_CONSENT_VERSION }, () => operation(receipt));
+}
+/** A purpose-aware fetch for code paths that obtained explicit user consent. */
+export function networkFetch(receipt, input, init) {
+    const destination = typeof input === 'string' || input instanceof URL ? input.toString() : input.url;
+    try {
+        assertReceiptAllowed(receipt, destination);
+    }
+    catch (error) {
+        return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+    }
+    return originalFetch(input, init);
+}
+function assertReceiptAllowed(receipt, destination) {
+    if (receipt.token !== consentReceiptToken || receipt.version !== NETWORK_CONSENT_VERSION) {
+        throw new NetworkConsentRequiredError(destination, receipt.purpose);
+    }
+    assertNetworkAllowed(destination, receipt.purpose);
+}
+function requestDestination(protocol, args) {
+    const first = args[0];
+    if (typeof first === 'string') {
+        return first;
+    }
+    if (first instanceof URL) {
+        return first.toString();
+    }
+    const options = (first ?? {});
+    const hostname = options.hostname ?? options.host ?? 'localhost';
+    const port = options.port === undefined ? '' : `:${String(options.port)}`;
+    return `${protocol}//${hostname}${port}${options.path ?? '/'}`;
+}
+function guardedRequest(protocol, original) {
+    return (...args) => {
+        assertNetworkAllowed(requestDestination(protocol, args));
+        return original(...args);
+    };
+}
+function consentedRequest(receipt, protocol, original, args) {
+    assertReceiptAllowed(receipt, requestDestination(protocol, args));
+    return original(...args);
+}
+export function networkHttpRequest(receipt, ...args) {
+    return consentedRequest(receipt, 'http:', originalHttpRequest, args);
+}
+export function networkHttpGet(receipt, ...args) {
+    return consentedRequest(receipt, 'http:', originalHttpGet, args);
+}
+export function networkHttpsRequest(receipt, ...args) {
+    return consentedRequest(receipt, 'https:', originalHttpsRequest, args);
+}
+export function networkHttpsGet(receipt, ...args) {
+    return consentedRequest(receipt, 'https:', originalHttpsGet, args);
+}
+/** Install once; every unscoped fetch fails closed before touching the transport. */
+export function installNetworkPolicy() {
+    if (installed) {
+        return;
+    }
+    originalFetch = globalThis.fetch.bind(globalThis);
+    globalThis.fetch = (input, init) => {
+        const destination = typeof input === 'string' || input instanceof URL ? input.toString() : input.url;
+        try {
+            assertNetworkAllowed(destination);
+        }
+        catch (error) {
+            return Promise.reject(error instanceof Error ? error : new Error(String(error)));
+        }
+        return originalFetch(input, init);
+    };
+    httpModule.request = guardedRequest('http:', originalHttpRequest);
+    httpModule.get = guardedRequest('http:', originalHttpGet);
+    httpsModule.request = guardedRequest('https:', originalHttpsRequest);
+    httpsModule.get = guardedRequest('https:', originalHttpsGet);
+    syncBuiltinESMExports();
+    installed = true;
+}
+export function restoreNetworkPolicyForTests() {
+    globalThis.fetch = originalFetch === moduleFetch ? moduleFetch : originalFetch;
+    httpModule.request = originalHttpRequest;
+    httpModule.get = originalHttpGet;
+    httpsModule.request = originalHttpsRequest;
+    httpsModule.get = originalHttpsGet;
+    syncBuiltinESMExports();
+    installed = false;
+}
+//# sourceMappingURL=network-policy.js.map