@planu/cli 4.13.0 → 5.0.0

package/dist/engine/spec-migrator/filesystem-import.js

@@ -3,14 +3,74 @@ import { readdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { parseFrontmatterLocal, validSpecType, validSpecScope, validSpecStatus, validRiskLevel, validSpecTarget, validDifficulty, } from './frontmatter-parser.js';
 const SPEC_FOLDER_ID_RE = /^(SPEC-\d{3,})/;
-function buildSpecFromMetadata(specId, entryName, projectId, metadata) {
+function optionalString(value) {
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function compatibleIdentity(existing, candidate) {
+    return (existing.id === candidate.id &&
+        existing.title === candidate.title &&
+        existing.slug === candidate.slug &&
+        (existing.uuid === undefined ||
+            candidate.uuid === undefined ||
+            existing.uuid === candidate.uuid));
+}
+function hasUuidIdentity(spec, uuid) {
+    return uuid !== undefined && (spec.uuid === uuid || spec.uuidAliases?.includes(uuid) === true);
+}
+function hasAnyUuidIdentity(existing, candidate) {
+    return [candidate.uuid, ...(candidate.uuidAliases ?? [])].some((uuid) => hasUuidIdentity(existing, uuid));
+}
+function isValidPortableMetadata(specId, metadata) {
+    return (metadata.id === specId &&
+        typeof metadata.title === 'string' &&
+        metadata.title.trim().length > 0 &&
+        validSpecType(metadata.type) !== null &&
+        validSpecScope(metadata.scope) !== null &&
+        validSpecStatus(metadata.status) !== null &&
+        validRiskLevel(metadata.risk) !== null &&
+        validSpecTarget(metadata.target) !== null &&
+        validDifficulty(metadata.difficulty) !== null);
+}
+function generationFromMetadata(metadata, fallbackGeneratedAt) {
+    const value = metadata.generation;
+    if (typeof value !== 'object' || value === null) {
+        return undefined;
+    }
+    const generationMetadata = value;
+    const method = generationMetadata.method;
+    if (method !== 'deterministic' && method !== 'internal-model' && method !== 'host') {
+        return undefined;
+    }
+    const host = optionalString(generationMetadata.host);
+    const modelId = optionalString(generationMetadata.modelId);
+    return {
+        method,
+        generatedAt: optionalString(generationMetadata.generatedAt) ?? fallbackGeneratedAt,
+        ...(host ? { host } : {}),
+        ...(modelId ? { modelId } : {}),
+    };
+}
+// eslint-disable-next-line max-lines-per-function, complexity -- portable metadata is normalized at one boundary
+function buildSpecFromMetadata(specId, entryName, projectPath, projectId, metadata) {
     const now = new Date().toISOString();
-    const folder = `planu/specs/${entryName}`;
+    const folder = join(projectPath, 'planu', 'specs', entryName);
+    const specPath = join(folder, 'spec.md');
     const slug = entryName.replace(/^SPEC-\d{3,}-/, '');
+    const stringList = (value) => Array.isArray(value) ? value.filter((item) => typeof item === 'string') : [];
+    const generation = generationFromMetadata(metadata, now);
     return {
         id: specId,
+        ...(optionalString(metadata.uuid) ? { uuid: optionalString(metadata.uuid) } : {}),
+        ...(Array.isArray(metadata.uuidAliases)
+            ? {
+                uuidAliases: metadata.uuidAliases
+                    .filter((value) => typeof value === 'string' && value.length > 0)
+                    .sort((left, right) => left.localeCompare(right)),
+            }
+            : {}),
         title: typeof metadata.title === 'string' ? metadata.title : specId,
         slug,
+        ...(optionalString(metadata.feature) ? { feature: optionalString(metadata.feature) } : {}),
         type: validSpecType(metadata.type) ?? 'feature',
         scope: validSpecScope(metadata.scope) ?? 'feature',
         status: validSpecStatus(metadata.status) ?? 'draft',
@@ -20,9 +80,9 @@ function buildSpecFromMetadata(specId, entryName, projectId, metadata) {
         projectId,
         createdAt: typeof metadata.created === 'string' ? new Date(metadata.created).toISOString() : now,
         updatedAt: now,
-        specPath: `${folder}/spec.md`,
-        technicalPath: `${folder}/technical.md`,
-        progressPath: `${folder}/progress.md`,
+        specPath,
+        technicalPath: specPath,
+        progressPath: '',
         estimation: {
             devHours: 0,
             reviewHours: 0,
@@ -41,10 +101,27 @@ function buildSpecFromMetadata(specId, entryName, projectId, metadata) {
             },
         },
         actuals: null,
-        tags: Array.isArray(metadata.tags) ? metadata.tags : [],
-        dependencies: [],
-        blockedBy: [],
-        gitBranch: `feat/${specId.toLowerCase()}-${slug}`,
+        tags: stringList(metadata.tags),
+        dependencies: stringList(metadata.dependencies),
+        blockedBy: stringList(metadata.blockedBy),
+        outOfScope: stringList(metadata.outOfScope),
+        ...(metadata.priority === 'P0'
+            ? { priority: 'high' }
+            : metadata.priority === 'high' ||
+                metadata.priority === 'medium' ||
+                metadata.priority === 'low'
+                ? { priority: metadata.priority }
+                : {}),
+        ...(metadata.spec_format_version === '0.x' || metadata.spec_format_version === '1.0'
+            ? { spec_format_version: metadata.spec_format_version }
+            : {}),
+        ...(optionalString(metadata.spec_version)
+            ? { spec_version: optionalString(metadata.spec_version) }
+            : {}),
+        ...(generation ? { generation } : {}),
+        gitBranch: typeof metadata.branch === 'string'
+            ? metadata.branch
+            : `feat/${specId.toLowerCase()}-${slug}`,
         impactAnalysis: null,
     };
 }
@@ -53,18 +130,18 @@ function buildSpecFromMetadata(specId, entryName, projectId, metadata) {
  * Reads frontmatter from each spec.md and creates a minimal Spec record in the store.
  * This ensures list_specs returns ALL specs, not just those created via create_spec.
  */
-export async function importFilesystemSpecs(projectPath, deps, projectId) {
+export async function importFilesystemSpecs(projectPath, deps, projectId, options = {}) {
     const specsRoot = join(projectPath, 'planu/specs');
-    const errors = [];
-    let importedCount = 0;
+    const failures = [];
+    const importedSpecIds = [];
     const storeSpecs = await deps.listSpecs(projectId);
-    const storeIds = new Set(storeSpecs.map((s) => s.id));
+    const specsById = new Map(storeSpecs.map((spec) => [spec.id, spec]));
     let entries;
     try {
         entries = await readdir(specsRoot, { withFileTypes: true });
     }
     catch {
-        return { importedCount: 0, errors: [] };
+        return { importedCount: 0, importedSpecIds, failures, errors: [] };
     }
     for (const entry of entries) {
         if (!entry.isDirectory()) {
@@ -75,22 +152,56 @@ export async function importFilesystemSpecs(projectPath, deps, projectId) {
             continue;
         }
         const specId = idMatch[1];
-        if (storeIds.has(specId)) {
-            continue;
-        }
         const specMdPath = join(specsRoot, entry.name, 'spec.md');
+        const relativeSpecPath = `planu/specs/${entry.name}/spec.md`;
+        let spec;
         try {
             const content = await readFile(specMdPath, 'utf-8');
             const { metadata } = parseFrontmatterLocal(content);
-            const spec = buildSpecFromMetadata(specId, entry.name, projectId, metadata);
+            if (options.strictPortableContract === true && !isValidPortableMetadata(specId, metadata)) {
+                failures.push({ specId, path: relativeSpecPath, code: 'INVALID_CONTRACT' });
+                continue;
+            }
+            spec = buildSpecFromMetadata(specId, entry.name, projectPath, projectId, metadata);
+        }
+        catch {
+            failures.push({ specId, path: relativeSpecPath, code: 'READ_FAILED' });
+            continue;
+        }
+        const existing = specsById.get(specId);
+        if (existing !== undefined) {
+            if (!compatibleIdentity(existing, spec)) {
+                failures.push({ specId, path: relativeSpecPath, code: 'INCOMPATIBLE_IDENTITY' });
+            }
+            continue;
+        }
+        if (storeSpecs.some((stored) => hasAnyUuidIdentity(stored, spec))) {
+            failures.push({ specId, path: relativeSpecPath, code: 'INCOMPATIBLE_IDENTITY' });
+            continue;
+        }
+        try {
             await deps.createSpec(projectId, spec);
-            storeIds.add(specId);
-            importedCount++;
+            specsById.set(specId, spec);
+            importedSpecIds.push(specId);
         }
-        catch (err) {
-            errors.push(`${specId}: ${err instanceof Error ? err.message : String(err)}`);
+        catch {
+            const winner = await deps.getSpecFresh?.(projectId, specId).catch(() => null);
+            if (winner !== undefined && winner !== null && compatibleIdentity(winner, spec)) {
+                specsById.set(specId, winner);
+                continue;
+            }
+            failures.push({
+                specId,
+                path: relativeSpecPath,
+                code: winner ? 'INCOMPATIBLE_IDENTITY' : 'CREATE_FAILED',
+            });
         }
     }
-    return { importedCount, errors };
+    return {
+        importedCount: importedSpecIds.length,
+        importedSpecIds,
+        failures,
+        errors: failures.map((failure) => `${failure.specId}: ${failure.code}`),
+    };
 }
 //# sourceMappingURL=filesystem-import.js.map

package/dist/engine/spec-migrator/frontmatter-parser.js

@@ -3,34 +3,51 @@
 // --- Lightweight frontmatter parser ---
 const FM_RE = /^---\n([\s\S]*?)\n---\n/;
 const FM_KV_RE = /^(\w+):\s*(.+)$/;
+const FM_OBJECT_RE = /^(\w+):\s*$/;
+function parseScalar(val) {
+    if (val.startsWith('[') && val.endsWith(']')) {
+        return val
+            .slice(1, -1)
+            .split(',')
+            .map((item) => item.trim().replace(/^["']|["']$/g, ''));
+    }
+    if (val === 'null') {
+        return null;
+    }
+    if (/^\d+$/.test(val)) {
+        return parseInt(val, 10);
+    }
+    return val.replace(/^["']|["']$/g, '');
+}
 export function parseFrontmatterLocal(content) {
     const match = FM_RE.exec(content);
     if (!match?.[1]) {
         return { metadata: {} };
     }
     const metadata = {};
+    let activeObject = null;
     for (const line of match[1].split('\n')) {
-        const kv = FM_KV_RE.exec(line.trim());
+        const indent = line.length - line.trimStart().length;
+        const trimmed = line.trim();
+        const object = FM_OBJECT_RE.exec(trimmed);
+        if (object?.[1]) {
+            const value = {};
+            metadata[object[1]] = value;
+            activeObject = { indent, value };
+            continue;
+        }
+        const kv = FM_KV_RE.exec(trimmed);
         if (!kv?.[1] || kv[2] === undefined) {
             continue;
         }
         const key = kv[1];
         const val = kv[2].trim();
-        if (val.startsWith('[') && val.endsWith(']')) {
-            metadata[key] = val
-                .slice(1, -1)
-                .split(',')
-                .map((s) => s.trim().replace(/^["']|["']$/g, ''));
-        }
-        else if (val === 'null') {
-            metadata[key] = null;
-        }
-        else if (/^\d+$/.test(val)) {
-            metadata[key] = parseInt(val, 10);
-        }
-        else {
-            metadata[key] = val.replace(/^["']|["']$/g, '');
+        if (activeObject !== null && indent > activeObject.indent) {
+            activeObject.value[key] = parseScalar(val);
+            continue;
         }
+        activeObject = null;
+        metadata[key] = parseScalar(val);
     }
     return { metadata };
 }

package/dist/engine/spec-migrator/index.d.ts

@@ -3,6 +3,7 @@ export { filterUnprefixedSpecs, migrateSpecFolderNames } from './prefix-migratio
 export { discoverAndFlattenSpecs } from './flatten-specs.js';
 export { reconcileSpecPaths } from './reconcile-paths.js';
 export { importFilesystemSpecs } from './filesystem-import.js';
+export { buildCanonicalRepairPlan, repairDuplicateSpecIds, rollbackCanonicalRepair, } from './canonical-deduplicator.js';
 export { rewritePath, flattenSpecPath } from './path-utils.js';
 export { hasLegacyConfig } from './version-detection.js';
 export { validateMigrationResult, mergeMigrationResults, emptyMigrationResult, } from './migration-validator.js';

package/dist/engine/spec-migrator/index.js

@@ -9,6 +9,7 @@ export { discoverAndFlattenSpecs } from './flatten-specs.js';
 export { reconcileSpecPaths } from './reconcile-paths.js';
 // Import filesystem specs into the store
 export { importFilesystemSpecs } from './filesystem-import.js';
+export { buildCanonicalRepairPlan, repairDuplicateSpecIds, rollbackCanonicalRepair, } from './canonical-deduplicator.js';
 // Path utilities (re-exported for consumers that may depend on them)
 export { rewritePath, flattenSpecPath } from './path-utils.js';
 // Legacy config detection

package/dist/engine/spec-migrator/planu-canonical-policy.js

@@ -1,7 +1,14 @@
 // engine/spec-migrator/planu-canonical-policy.ts — SPEC-1017
 // Single source of truth for the strict Planu managed directory contract.
 export const PLANU_CANONICAL_POLICY = {
-    canonicalRootFiles: ['conventions.json', 'context.md', 'session-context.md', 'session.json'],
+    canonicalRootFiles: [
+        'conventions.json',
+        'context.md',
+        'project.json',
+        'session-context.md',
+        'session.json',
+        'technology-selection.json',
+    ],
     canonicalRootDirs: ['releases', 'specs'],
     canonicalSpecFiles: ['spec.md'],
     canonicalSpecDirs: [],
@@ -64,8 +71,10 @@ export function canonicalContractText() {
         'planu/',
         '  conventions.json',
         '  context.md',
+        '  project.json',
         '  session-context.md',
         '  session.json',
+        '  technology-selection.json',
         '  releases/',
         '    pending.json',
         '  specs/',

package/dist/engine/spec-migrator/strict-planu-cleanup.js

@@ -17,16 +17,21 @@ async function pathIsDirectory(path) {
         return false;
     }
 }
+async function readDirectory(path) {
+    try {
+        return await readdir(path);
+    }
+    catch {
+        return [];
+    }
+}
 async function gitRmCached(projectPath, relPath) {
     if (!existsSync(join(projectPath, '.git'))) {
         return;
     }
     try {
-        const args = ['rm', '--cached', '--quiet', '--ignore-unmatch'];
-        if (await pathIsDirectory(join(projectPath, relPath))) {
-            args.push('-r');
-        }
-        args.push(relPath);
+        // This helper is only called for directories from removePath.
+        const args = ['rm', '--cached', '--quiet', '--ignore-unmatch', '-r', relPath];
         await execFileAsync('git', args, {
             cwd: projectPath,
             timeout: 5_000,
@@ -48,9 +53,6 @@ function appendSectionIfMissing(specContent, heading, body) {
 async function mergeLegacySpecFile(projectPath, specDir, fileName) {
     const specPath = join(specDir, 'spec.md');
     const legacyPath = join(specDir, fileName);
-    if (!existsSync(legacyPath) || !existsSync(specPath)) {
-        return false;
-    }
     const [specContent, legacyContent] = await Promise.all([
         readFile(specPath, 'utf-8'),
         readFile(legacyPath, 'utf-8'),
@@ -70,7 +72,6 @@ async function mergeLegacySpecFile(projectPath, specDir, fileName) {
         });
     }
     await safeUnlink(projectPath, legacyPath);
-    return true;
 }
 async function removePath(projectPath, absolutePath) {
     const rel = relative(projectPath, absolutePath);
@@ -116,13 +117,12 @@ async function updateGitignore(projectPath) {
     return true;
 }
 async function walkSpecDirectory(projectPath, specDir, result) {
-    const entries = await readdir(specDir).catch(() => []);
+    const entries = await readDirectory(specDir);
     for (const entry of entries) {
         const full = join(specDir, entry);
         if (mustMergeBeforeDeleteSpecFile(entry)) {
-            if (await mergeLegacySpecFile(projectPath, specDir, entry)) {
-                result.merged.push(relative(projectPath, full));
-            }
+            await mergeLegacySpecFile(projectPath, specDir, entry);
+            result.merged.push(relative(projectPath, full));
             continue;
         }
         const isDir = await pathIsDirectory(full);
@@ -134,11 +134,10 @@ async function walkSpecDirectory(projectPath, specDir, result) {
     }
 }
 async function shouldDeleteOrphanSpecDir(specDir) {
-    const entries = await readdir(specDir).catch(() => []);
-    if (entries.includes('spec.md')) {
-        return false;
-    }
-    return !entries.some((entry) => mustMergeBeforeDeleteSpecFile(entry));
+    const entries = await readDirectory(specDir);
+    // Legacy split files are only mergeable when the canonical destination exists.
+    // Keeping them without spec.md leaves a permanently non-canonical orphan behind.
+    return !entries.includes('spec.md');
 }
 export async function runStrictPlanuCleanup(projectPath) {
     const result = { deleted: [], merged: [], gitignoreUpdated: false };
@@ -146,7 +145,7 @@ export async function runStrictPlanuCleanup(projectPath) {
     if (!existsSync(planuDir)) {
         return result;
     }
-    const entries = await readdir(planuDir).catch(() => []);
+    const entries = await readDirectory(planuDir);
     for (const entry of entries) {
         const full = join(planuDir, entry);
         const isDir = await pathIsDirectory(full);
@@ -161,7 +160,7 @@ export async function runStrictPlanuCleanup(projectPath) {
         }
     }
     const releasesDir = join(planuDir, 'releases');
-    for (const entry of await readdir(releasesDir).catch(() => [])) {
+    for (const entry of await readDirectory(releasesDir)) {
         const rel = `releases/${entry}`;
         if (!isCanonicalReleaseFile(rel)) {
             const full = join(releasesDir, entry);
@@ -170,7 +169,7 @@ export async function runStrictPlanuCleanup(projectPath) {
         }
     }
     const specsDir = join(planuDir, 'specs');
-    for (const entry of await readdir(specsDir).catch(() => [])) {
+    for (const entry of await readDirectory(specsDir)) {
         const full = join(specsDir, entry);
         if (!(await pathIsDirectory(full)) || entry === 'data') {
             await removePath(projectPath, full);
@@ -198,7 +197,7 @@ export async function validateStrictPlanuLayout(projectPath, options = {}) {
     const offenders = [];
     const planuDir = join(projectPath, 'planu');
     if (options.includeRoot !== false) {
-        const entries = await readdir(planuDir).catch(() => []);
+        const entries = await readDirectory(planuDir);
         for (const entry of entries) {
             const full = join(planuDir, entry);
             const isDir = await pathIsDirectory(full);
@@ -207,7 +206,7 @@ export async function validateStrictPlanuLayout(projectPath, options = {}) {
                 offenders.push(relative(projectPath, full));
             }
         }
-        for (const entry of await readdir(join(planuDir, 'releases')).catch(() => [])) {
+        for (const entry of await readDirectory(join(planuDir, 'releases'))) {
             const rel = `releases/${entry}`;
             if (!isCanonicalReleaseFile(rel)) {
                 offenders.push(`planu/${rel}`);
@@ -215,7 +214,7 @@ export async function validateStrictPlanuLayout(projectPath, options = {}) {
         }
     }
     const scopedSpecDirs = resolveSpecDirsForValidation(projectPath, options.specPath) ??
-        (await readdir(join(planuDir, 'specs')).catch(() => [])).map((specDir) => join(planuDir, 'specs', specDir));
+        (await readDirectory(join(planuDir, 'specs'))).map((specDir) => join(planuDir, 'specs', specDir));
     for (const full of scopedSpecDirs) {
         const specDir = relative(join(planuDir, 'specs'), full);
         if (!(await pathIsDirectory(full)) || specDir === 'data') {
@@ -226,7 +225,7 @@ export async function validateStrictPlanuLayout(projectPath, options = {}) {
             offenders.push(relative(projectPath, full));
             continue;
         }
-        for (const entry of await readdir(full).catch(() => [])) {
+        for (const entry of await readDirectory(full)) {
             const entryPath = join(full, entry);
             const isDir = await pathIsDirectory(entryPath);
             if (isDir ? !isCanonicalSpecDir(entry) : !isCanonicalSpecFile(entry)) {

package/dist/engine/spec-registry/adapter.d.ts

@@ -1,8 +1,3 @@
-/**
- * Stack detection and spec adaptation for registry specs.
- * Detects project technology stack from config files and applies
- * framework-specific substitutions to spec content.
- */
 import type { StackDetectionResult, StackAdaptation } from '../../types/index.js';
 export declare function detectStack(projectPath: string): Promise<StackDetectionResult>;
 export declare function adaptSpec(specDir: string, projectStack: StackDetectionResult, adaptableMap?: Record<string, Record<string, string>>): Promise<StackAdaptation[]>;

package/dist/engine/spec-registry/adapter.js

@@ -1,5 +1,4 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
+import { technologyValue } from '../technology-registry.js';
 /**
  * Stack detection and spec adaptation for registry specs.
  * Detects project technology stack from config files and applies
@@ -59,49 +58,49 @@ function textContains(text, keyword) {
 // ---------------------------------------------------------------------------
 function detectNodeFramework(pkg) {
     if (hasDep(pkg, 'next')) {
-        return 'nextjs';
+        return technologyValue('technology-nextjs-c93379');
     }
-    if (hasDep(pkg, 'nuxt')) {
-        return 'nuxt';
+    if (hasDep(pkg, technologyValue('technology-nuxt-22c407'))) {
+        return technologyValue('technology-nuxt-22c407');
     }
-    if (hasDep(pkg, '@sveltejs/kit') || hasDep(pkg, 'svelte')) {
-        return 'sveltekit';
+    if (hasDep(pkg, '@sveltejs/kit') || hasDep(pkg, technologyValue('technology-svelte-c190ac'))) {
+        return technologyValue('technology-sveltekit-eefb03');
     }
-    if (hasDep(pkg, '@remix-run/node') || hasDep(pkg, 'remix')) {
-        return 'remix';
+    if (hasDep(pkg, '@remix-run/node') || hasDep(pkg, technologyValue('technology-remix-0c5d96'))) {
+        return technologyValue('technology-remix-0c5d96');
     }
-    if (hasDep(pkg, 'astro')) {
-        return 'astro';
+    if (hasDep(pkg, technologyValue('technology-astro-23661e'))) {
+        return technologyValue('technology-astro-23661e');
     }
-    if (hasDep(pkg, 'fastify')) {
-        return 'fastify';
+    if (hasDep(pkg, technologyValue('technology-fastify-cbe57e'))) {
+        return technologyValue('technology-fastify-cbe57e');
     }
-    if (hasDep(pkg, 'express')) {
-        return 'express';
+    if (hasDep(pkg, technologyValue('technology-express-008231'))) {
+        return technologyValue('technology-express-008231');
     }
     return 'unknown';
 }
 function detectNodeOrm(pkg) {
-    if (hasDep(pkg, '@prisma/client') || hasDep(pkg, 'prisma')) {
-        return 'prisma';
+    if (hasDep(pkg, '@prisma/client') || hasDep(pkg, technologyValue('technology-prisma-99497c'))) {
+        return technologyValue('technology-prisma-99497c');
     }
     if (hasDep(pkg, 'drizzle-orm')) {
-        return 'drizzle';
+        return technologyValue('technology-drizzle-424f22');
     }
-    if (hasDep(pkg, 'sequelize')) {
-        return 'sequelize';
+    if (hasDep(pkg, technologyValue('technology-sequelize-d18291'))) {
+        return technologyValue('technology-sequelize-d18291');
     }
-    if (hasDep(pkg, 'typeorm')) {
-        return 'typeorm';
+    if (hasDep(pkg, technologyValue('technology-typeorm-527d4d'))) {
+        return technologyValue('technology-typeorm-527d4d');
     }
     return undefined;
 }
 function detectNodeTestRunner(pkg) {
-    if (hasDevDep(pkg, 'vitest')) {
-        return 'vitest';
+    if (hasDevDep(pkg, technologyValue('technology-vitest-a9127f'))) {
+        return technologyValue('technology-vitest-a9127f');
     }
-    if (hasDevDep(pkg, 'jest')) {
-        return 'jest';
+    if (hasDevDep(pkg, technologyValue('technology-jest-35e99f'))) {
+        return technologyValue('technology-jest-35e99f');
     }
     if (hasDevDep(pkg, 'mocha')) {
         return 'mocha';
@@ -140,7 +139,7 @@ async function detectNodePackageManager(projectPath) {
 async function detectNodeStack(projectPath, pkg) {
     const result = { language: 'javascript', framework: 'unknown' };
     if (await fileExists(join(projectPath, 'tsconfig.json'))) {
-        result.language = 'typescript';
+        result.language = technologyValue('technology-typescript-969545');
     }
     result.framework = detectNodeFramework(pkg);
     result.orm = detectNodeOrm(pkg);
@@ -158,20 +157,20 @@ async function detectPythonStack(projectPath) {
     const requirements = await readTextSafe(join(projectPath, 'requirements.txt'));
     const combined = [pyproject, requirements].filter(Boolean).join('\n');
     /* v8 ignore start -- Python framework detection branches */
-    if (textContains(combined, 'fastapi')) {
-        result.framework = 'fastapi';
+    if (textContains(combined, technologyValue('technology-fastapi-6aee0e'))) {
+        result.framework = technologyValue('technology-fastapi-6aee0e');
     }
-    else if (textContains(combined, 'django')) {
-        result.framework = 'django';
+    else if (textContains(combined, technologyValue('technology-django-7d8a08'))) {
+        result.framework = technologyValue('technology-django-7d8a08');
     }
-    else if (textContains(combined, 'flask')) {
-        result.framework = 'flask';
+    else if (textContains(combined, technologyValue('technology-flask-b87aa5'))) {
+        result.framework = technologyValue('technology-flask-b87aa5');
     }
-    if (textContains(combined, 'sqlalchemy')) {
-        result.orm = 'sqlalchemy';
+    if (textContains(combined, technologyValue('technology-sqlalchemy-37f268'))) {
+        result.orm = technologyValue('technology-sqlalchemy-37f268');
     }
-    if (textContains(combined, 'pytest')) {
-        result.testRunner = 'pytest';
+    if (textContains(combined, technologyValue('technology-pytest-2b0121'))) {
+        result.testRunner = technologyValue('technology-pytest-2b0121');
     }
     if (await fileExists(join(projectPath, 'poetry.lock'))) {
         result.packageManager = 'poetry';
@@ -193,13 +192,13 @@ async function detectGoStack(projectPath) {
         return result;
     }
     if (goMod.includes('github.com/gin-gonic/gin')) {
-        result.framework = 'gin';
+        result.framework = technologyValue('technology-gin-985adc');
     }
     else if (goMod.includes('github.com/gofiber/fiber')) {
-        result.framework = 'fiber';
+        result.framework = technologyValue('technology-fiber-77c3e6');
     }
     if (goMod.includes('gorm.io/gorm')) {
-        result.orm = 'gorm';
+        result.orm = technologyValue('technology-gorm-7f6614');
     }
     return result;
 }
@@ -209,14 +208,14 @@ async function detectRustStack(projectPath) {
     if (!cargo) {
         return result;
     }
-    if (textContains(cargo, 'actix-web')) {
-        result.framework = 'actix-web';
+    if (textContains(cargo, technologyValue('technology-actix-web-ab3e35'))) {
+        result.framework = technologyValue('technology-actix-web-ab3e35');
     }
-    else if (textContains(cargo, 'axum')) {
-        result.framework = 'axum';
+    else if (textContains(cargo, technologyValue('technology-axum-af7119'))) {
+        result.framework = technologyValue('technology-axum-af7119');
     }
-    if (textContains(cargo, 'diesel')) {
-        result.orm = 'diesel';
+    if (textContains(cargo, technologyValue('technology-diesel-f83cff'))) {
+        result.orm = technologyValue('technology-diesel-f83cff');
     }
     return result;
 }

package/dist/engine/spec-registry/client.js

@@ -2,6 +2,7 @@
 // HTTP client for the Planu spec registry. Uses node:https/http only (no external deps).
 import * as https from 'node:https';
 import * as http from 'node:http';
+import { assertNetworkAllowed } from '../network-policy.js';
 const DEFAULT_BASE_URL = 'https://registry.planu.dev/api/v1';
 const MAX_RETRIES = 3;
 const BASE_DELAY_MS = 1000;
@@ -71,6 +72,7 @@ async function request(url, options, body) {
 }
 /** Execute a single HTTP request. */
 function executeRequest(url, options, body) {
+    assertNetworkAllowed(url);
     return new Promise((resolve, reject) => {
         const transport = getTransport(url);
         const req = transport.request(url, options, (res) => {