@planu/cli 4.13.0 → 5.0.0

package/dist/storage/token-cache-store.js

@@ -21,13 +21,13 @@ export function loadTokenCache(projectHash, dataDir) {
         const raw = readFileSync(filePath, 'utf-8');
         const parsed = JSON.parse(raw);
         if (!Array.isArray(parsed)) {
-            return [];
+            throw new TypeError('Token cache root must be an array.');
         }
         const now = Date.now();
         return parsed.filter((entry) => typeof entry.expiresAt === 'number' && entry.expiresAt > now);
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new Error(`Token cache is corrupt: ${filePath}`, { cause: error });
     }
 }
 /**

package/dist/storage/token-ledger-store.js

@@ -1,6 +1,7 @@
 // storage/token-ledger-store.ts — Token usage ledger persistence (SPEC-182)
 import { existsSync, mkdirSync, readFileSync, writeFileSync, readdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
 import { withFileLock } from './file-mutex.js';
 const MAX_FILE_SIZE_MB = 10;
 const ROTATION_MONTHS = 6;
@@ -75,8 +76,8 @@ function readMonthFile(filePath) {
         }
         return parsed;
     }
-    catch {
-        return [];
+    catch (error) {
+        throw new Error(`Token ledger is corrupt: ${filePath}`, { cause: error });
     }
 }
 function writeMonthFile(filePath, entries) {
@@ -229,8 +230,11 @@ function listAvailableMonths(projectHash, dataDir) {
             .map((f) => f.slice(0, 7))
             .sort();
     }
-    catch {
-        return [];
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return [];
+        }
+        throw error;
     }
 }
 // ---------------------------------------------------------------------------
@@ -327,8 +331,9 @@ export async function rotateLedger(projectHash, dataDir) {
             try {
                 writeFileSync(filePath, '[]', 'utf-8');
             }
-            catch {
-                // ignore
+            catch (error) {
+                // reliability-cleanup: ARCHIVED_LEDGER_TRUNCATE — archive remains authoritative
+                reportClassifiedDegradation('ARCHIVED_LEDGER_TRUNCATE', error);
             }
         }
         writeFileSync(summaryPath, JSON.stringify(existing, null, 2), 'utf-8');
@@ -347,8 +352,8 @@ function readSummary(summaryPath) {
         }
         return parsed;
     }
-    catch {
-        return {};
+    catch (error) {
+        throw new Error(`Token aggregation is corrupt: ${summaryPath}`, { cause: error });
     }
 }
 //# sourceMappingURL=token-ledger-store.js.map

package/dist/storage/transition-log.js

@@ -8,6 +8,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { appendFile, readFile, mkdir } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
 import { projectDataDir } from './base-store.js';
+import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
 // ---------------------------------------------------------------------------
 // Path helper
 // ---------------------------------------------------------------------------
@@ -63,8 +64,8 @@ async function doAppend(filePath, input) {
             const parsed = JSON.parse(lastLine);
             prevSha = typeof parsed.sha === 'string' ? parsed.sha : '';
         }
-        catch {
-            prevSha = '';
+        catch (error) {
+            throw new Error(`Transition log chain tail is corrupt: ${filePath}`, { cause: error });
         }
     }
     const partial = {
@@ -121,8 +122,10 @@ export async function readTransitionLog(projectId, specId) {
                 entries.push(entry);
             }
         }
-        catch {
-            // skip malformed lines
+        catch (error) {
+            // reliability-compat: MALFORMED_TRANSITION_LINE — skip malformed historical lines
+            reportClassifiedDegradation('MALFORMED_TRANSITION_LINE', error);
+            continue;
         }
     }
     return entries;

package/dist/storage/trash-store.js

@@ -169,8 +169,11 @@ export async function countFiles(dirPath) {
         }
         return count;
     }
-    catch {
-        return 0;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 0;
+        }
+        throw error;
     }
 }
 /**
@@ -181,8 +184,11 @@ export async function pathExists(p) {
         await stat(p);
         return true;
     }
-    catch {
-        return false;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return false;
+        }
+        throw error;
     }
 }
 // ---------------------------------------------------------------------------
@@ -207,8 +213,11 @@ export async function getDirSize(dirPath) {
         }
         return total;
     }
-    catch {
-        return 0;
+    catch (error) {
+        if (error.code === 'ENOENT') {
+            return 0;
+        }
+        throw error;
     }
 }
 /**

package/dist/storage/usage-store.d.ts

@@ -1,9 +1,5 @@
-import type { UsageLog, UsageEvent, TrialState } from '../types/index.js';
+import type { UsageLog, UsageEvent } from '../types/index.js';
 export declare function getUsageLog(): Promise<UsageLog>;
 export declare function appendUsageEvent(event: UsageEvent): Promise<void>;
 export declare function rotateUsageLog(): Promise<void>;
-export declare function getTrialState(): Promise<TrialState | null>;
-export declare function ensureTrialState(): Promise<TrialState>;
-export declare function getDailyCallCount(date: string): Promise<number>;
-export declare function getLastCallTimestamp(): Promise<string | null>;
 //# sourceMappingURL=usage-store.d.ts.map

package/dist/storage/usage-store.js

@@ -10,9 +10,6 @@ const MAX_EVENTS = 10_000;
 function usageFile() {
     return `${globalDataDir()}/usage.json`;
 }
-function firstRunFile() {
-    return `${globalDataDir()}/first-run.json`;
-}
 // ---------------------------------------------------------------------------
 // Usage log (data/global/usage.json)
 // ---------------------------------------------------------------------------
@@ -42,36 +39,4 @@ export async function appendUsageEvent(event) {
 export async function rotateUsageLog() {
     await withFileLock(usageFile(), rotateUsageLogLocked);
 }
-// ---------------------------------------------------------------------------
-// Trial state (data/global/first-run.json)
-// ---------------------------------------------------------------------------
-export async function getTrialState() {
-    return readJson(firstRunFile(), null);
-}
-export async function ensureTrialState() {
-    const existing = await getTrialState();
-    if (existing !== null) {
-        return existing;
-    }
-    const state = { firstRunAt: new Date().toISOString() };
-    await writeJson(firstRunFile(), state);
-    return state;
-}
-// ---------------------------------------------------------------------------
-// Computed helpers (derived from usage.json — no extra file)
-// ---------------------------------------------------------------------------
-export async function getDailyCallCount(date) {
-    const log = await getUsageLog();
-    return log.events.filter((event) => event.timestamp.startsWith(date)).length;
-}
-export async function getLastCallTimestamp() {
-    const log = await getUsageLog();
-    if (log.events.length === 0) {
-        return null;
-    }
-    const last = log.events[log.events.length - 1];
-    /* v8 ignore start -- always defined when length > 0 */
-    return last?.timestamp ?? null;
-    /* v8 ignore stop */
-}
 //# sourceMappingURL=usage-store.js.map

package/dist/storage/vector-store/migrator.js

@@ -3,6 +3,7 @@
 import { readJson, projectDataDir } from '../base-store.js';
 import { existsSync } from 'node:fs';
 import { TFIDFEngine } from '../../engine/vector-store/tfidf.js';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 /** Check if a migration marker exists (idempotency). */
 function migrationMarkerPath(projectId) {
     return `${projectDataDir(projectId)}/.vector-migrated`;
@@ -103,7 +104,9 @@ export async function migrateJsonToBackend(projectId, backend) {
             allTexts.push(...items);
         }
         catch (err) {
-            errors.push(err instanceof Error ? err.message : String(err));
+            // reliability-optional: VECTOR_MIGRATION_SOURCE — result reports partial migration
+            reportClassifiedDegradation('VECTOR_MIGRATION_SOURCE', err);
+            errors.push('A migration source could not be loaded.');
         }
     }
     // Build IDF from all texts
@@ -129,7 +132,9 @@ export async function migrateJsonToBackend(projectId, backend) {
             processed++;
         }
         catch (err) {
-            errors.push(`${item.id}: ${err instanceof Error ? err.message : String(err)}`);
+            // reliability-optional: VECTOR_MIGRATION_ENTRY — result reports partial migration
+            reportClassifiedDegradation('VECTOR_MIGRATION_ENTRY', err);
+            errors.push(`${item.id}: migration failed`);
         }
     }
     await markMigrated(projectId);

package/dist/storage/vector-store/sqlite-adapter.js

@@ -4,6 +4,7 @@ import { cosineSimilarity } from '../../engine/vector-store/similarity.js';
 import { projectDataDir, safeJsonParse } from '../base-store.js';
 import { mkdirSync, existsSync } from 'node:fs';
 import { dirname } from 'node:path';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
 /**
  * Attempt to dynamically import better-sqlite3.
  * Returns null if the package is not installed.
@@ -17,7 +18,9 @@ export async function tryLoadSqlite() {
         return mod.default;
         /* v8 ignore stop */
     }
-    catch {
+    catch (error) {
+        // reliability-optional: SQLITE_OPTIONAL_DRIVER — JSON backend remains available
+        reportClassifiedDegradation('SQLITE_OPTIONAL_DRIVER', error);
         return null;
     }
 }

package/dist/storage/webhook-server-store.js

@@ -1,7 +1,7 @@
 // storage/webhook-server-store.ts — Incoming webhook server config persistence (SPEC-359)
 import { join } from 'node:path';
-import { readJson, writeJson } from './base-store.js';
-const GLOBAL_CONFIG_PATH = join('data', 'global', 'webhook-server.json');
+import { globalDataDir, readJson, writeJson } from './base-store.js';
+const GLOBAL_CONFIG_PATH = join(globalDataDir(), 'webhook-server.json');
 export async function getWebhookServerConfig() {
     return readJson(GLOBAL_CONFIG_PATH, null);
 }

package/dist/tools/api-spec-generator-handler.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../engine/technology-registry.js';
 // tools/api-spec-generator-handler.ts — generate_spec_from_api tool handler (SPEC-286)
 import { readFile } from 'node:fs/promises';
 import { parseOpenApi } from '../engine/api-spec-generator/openapi-parser.js';
@@ -14,7 +15,7 @@ function detectContractType(content) {
     }
     // GraphQL SDL typically has type/schema/query keywords
     if (/\btype\s+\w+\s*\{/.test(trimmed) || /\bschema\s*\{/.test(trimmed)) {
-        return 'graphql';
+        return technologyValue('technology-graphql-aed31c');
     }
     // Fallback: attempt JSON parse
     try {
@@ -22,7 +23,7 @@ function detectContractType(content) {
         return 'openapi';
     }
     catch {
-        return 'graphql';
+        return technologyValue('technology-graphql-aed31c');
     }
 }
 function groupByEndpoint(contract) {

package/dist/tools/auto-update-handler.d.ts

@@ -9,17 +9,17 @@ export interface PinVersionInput {
 }
 /**
  * Checks npm registry and local config for update status.
- * Free tool — no license check.
+ * Checks update status without changing local state.
  */
 export declare function handleCheckUpdateStatus(): Promise<ToolResult>;
 /**
- * Enables auto-update by switching the MCP config to npx @planu/cli@latest.
- * Free tool — always benefits the user.
+ * Resolves a verified release and pins the MCP config to that exact version.
+ * Enables update checks for the local installation.
  */
 export declare function handleEnableAutoUpdate(args: EnableAutoUpdateInput): Promise<ToolResult>;
 /**
  * Pins Planu to a specific version in the MCP config.
- * Pro tool — requires license.
+ * Pins the local installation to an explicit version.
  */
 export declare function handlePinVersion(args: PinVersionInput): Promise<ToolResult>;
 //# sourceMappingURL=auto-update-handler.d.ts.map

package/dist/tools/auto-update-handler.js

@@ -7,7 +7,7 @@ import { jsonResult, errText } from './response-helpers.js';
 // ---------------------------------------------------------------------------
 /**
  * Checks npm registry and local config for update status.
- * Free tool — no license check.
+ * Checks update status without changing local state.
  */
 export async function handleCheckUpdateStatus() {
     try {
@@ -19,8 +19,8 @@ export async function handleCheckUpdateStatus() {
     }
 }
 /**
- * Enables auto-update by switching the MCP config to npx @planu/cli@latest.
- * Free tool — always benefits the user.
+ * Resolves a verified release and pins the MCP config to that exact version.
+ * Enables update checks for the local installation.
  */
 export async function handleEnableAutoUpdate(args) {
     const confirm = args.confirm ?? false;
@@ -35,7 +35,7 @@ export async function handleEnableAutoUpdate(args) {
 }
 /**
  * Pins Planu to a specific version in the MCP config.
- * Pro tool — requires license.
+ * Pins the local installation to an explicit version.
  */
 export async function handlePinVersion(args) {
     if (!args.version || args.version.trim() === '') {

package/dist/tools/browser-validate-handler.js

@@ -1,3 +1,4 @@
+import { technologyValue } from '../engine/technology-registry.js';
 // tools/browser-validate-handler.ts — SPEC-308: Browser validation tool handler
 import * as fs from 'node:fs/promises';
 import * as path from 'node:path';
@@ -31,7 +32,7 @@ function parsePlaywrightOutput(output) {
 /** Run playwright tests against a saved test file. */
 async function runPlaywrightTests(testFilePath) {
     try {
-        const { stdout, stderr } = await execFileAsync('npx', ['playwright', 'test', testFilePath, '--reporter=line'], { timeout: 60_000 });
+        const { stdout, stderr } = await execFileAsync('npx', [technologyValue('technology-playwright-7827e8'), 'test', testFilePath, '--reporter=line'], { timeout: 60_000 });
         return parsePlaywrightOutput(stdout + stderr);
     }
     catch (err) {

package/dist/tools/challenge-spec/platform-challenge-scenarios-b.js

@@ -1,7 +1,4 @@
-// tools/challenge-spec/platform-challenge-scenarios-b.ts
-// SPEC-015b: Advanced challenge scenarios for bots, Web3, ML, data pipelines, IaC, and IoT
-// Bot + Web3 scenarios: platform-challenge-scenarios-b1.ts
-// ML + IaC + IoT scenarios: platform-challenge-scenarios-b2.ts
+import { technologyValue } from '../../engine/technology-registry.js';
 import { buildBotAdvancedChallenges, buildWeb3AdvancedChallenges, } from './platform-challenge-scenarios-b1.js';
 import { buildMLAdvancedChallenges, buildIaCAdvancedChallenges, buildIoTAdvancedChallenges, } from './platform-challenge-scenarios-b2.js';
 // === Public API ===
@@ -22,7 +19,13 @@ export function getAdvancedPlatformChallenges(spec, content, knowledge) {
         stack.some((s) => ['discord.js', 'telegraf', 'grammy', '@slack/bolt'].includes(s));
     const isML = category === 'ml' ||
         stack.some((s) => ['pytorch', 'tensorflow', 'sklearn', 'langchain', 'transformers'].includes(s));
-    const isIaC = stack.some((s) => ['terraform', 'pulumi', 'cdk', 'ansible', 'cloudformation'].includes(s));
+    const isIaC = stack.some((s) => [
+        technologyValue('technology-terraform-94dc3e'),
+        'pulumi',
+        'cdk',
+        'ansible',
+        'cloudformation',
+    ].includes(s));
     const isIoT = category === 'iot' ||
         stack.some((s) => ['platformio', 'arduino', 'zephyr', 'esp32', 'raspberry-pi'].includes(s));
     if (isBot) {

package/dist/tools/challenge-spec/resilience-challenge-scenarios.d.ts

@@ -1,8 +1,9 @@
 import type { FailureScenario, Spec, ProjectKnowledge } from '../../types/index.js';
+import { type ChallengeCapabilities } from './scenarios-utils.js';
 export { EXTERNAL_CALL_KEYWORDS, VALIDATION_KEYWORDS, RATE_LIMIT_KEYWORDS, CONCURRENCY_KEYWORDS, SAGA_KEYWORDS, hasExternalCallSignal, hasValidationSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
 export { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
 /**
  * Main entry: generate all SPEC-034 resilience/concurrency challenges for a spec.
  */
-export declare function generateResilienceChallengeScenarios(spec: Spec, specContent: string, knowledge: ProjectKnowledge): FailureScenario[];
+export declare function generateResilienceChallengeScenarios(spec: Spec, specContent: string, knowledge: ProjectKnowledge, capabilities?: ChallengeCapabilities): FailureScenario[];
 //# sourceMappingURL=resilience-challenge-scenarios.d.ts.map

package/dist/tools/challenge-spec/resilience-challenge-scenarios.js

@@ -2,32 +2,35 @@
 // Barrel re-export for resilience/concurrency challenge scenarios.
 // Signal detectors + validation + cascade: resilience-challenge-scenarios-a.ts
 // Rate limit + concurrency + saga: resilience-challenge-scenarios-b.ts
-import { hasValidationSignal, hasExternalCallSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
+import { generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
 import { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
+import { detectChallengeCapabilities } from './scenarios-utils.js';
 export { EXTERNAL_CALL_KEYWORDS, VALIDATION_KEYWORDS, RATE_LIMIT_KEYWORDS, CONCURRENCY_KEYWORDS, SAGA_KEYWORDS, hasExternalCallSignal, hasValidationSignal, hasRateLimitSignal, hasConcurrencySignal, hasSagaSignal, generateValidationBoundaryScenarios, generateCascadeFailureScenarios, } from './resilience-challenge-scenarios-a.js';
 export { generateRateLimitBypassScenarios, generateConcurrencyScenarios, generateSagaFailureScenarios, } from './resilience-challenge-scenarios-b.js';
 /**
  * Main entry: generate all SPEC-034 resilience/concurrency challenges for a spec.
  */
-export function generateResilienceChallengeScenarios(spec, specContent, knowledge) {
+export function generateResilienceChallengeScenarios(spec, specContent, knowledge, capabilities) {
     const scenarios = [];
-    if (hasValidationSignal(spec, specContent)) {
+    const resolvedCapabilities = capabilities ?? detectChallengeCapabilities(spec, specContent);
+    if (resolvedCapabilities.validation &&
+        (resolvedCapabilities.userInput || resolvedCapabilities.networkApi)) {
         scenarios.push(...generateValidationBoundaryScenarios(spec));
     }
-    if (hasExternalCallSignal(spec, specContent)) {
+    if (resolvedCapabilities.externalService || resolvedCapabilities.payment) {
         scenarios.push(...generateCascadeFailureScenarios(spec));
     }
-    if (hasRateLimitSignal(spec, specContent)) {
+    if (resolvedCapabilities.rateLimit) {
         scenarios.push(...generateRateLimitBypassScenarios(spec));
     }
-    if (hasConcurrencySignal(spec, specContent)) {
+    if (resolvedCapabilities.concurrency) {
         // `concurrencyModel` may be present on enriched knowledge objects (ValidationResilienceProfile mixin)
         // but is not declared on the base ProjectKnowledge interface — intentional duck-type access.
         // ProjectKnowledge has no index signature, so `as unknown` intermediate is required.
         const concurrencyModel = knowledge.concurrencyModel;
         scenarios.push(...generateConcurrencyScenarios(spec, concurrencyModel ?? 'unknown'));
     }
-    if (hasSagaSignal(spec, specContent)) {
+    if (resolvedCapabilities.saga) {
         scenarios.push(...generateSagaFailureScenarios(spec));
     }
     return scenarios;

package/dist/tools/challenge-spec/scenario-collector.js

@@ -75,7 +75,7 @@ export function collectCapabilityScenarios(input) {
         'concurrency',
         'saga',
     ])) {
-        scenarios.push(...generateResilienceChallengeScenarios(spec, specContent, knowledge));
+        scenarios.push(...generateResilienceChallengeScenarios(spec, specContent, knowledge, capabilities));
     }
     const agileConfig = knowledge.agileConfig;
     if (agileConfig?.process === 'xp' && capabilities.xp) {

package/dist/tools/challenge-spec/scenarios-data.js

@@ -4,7 +4,7 @@ const WRITE_SIGNALS = [
     /\b(transaction|persist|database write|save record|create record|update record|delete record)\b/i,
     /\b(order|checkout|submit form|mutation|multi-step write)\b/i,
 ];
-const CACHE_SIGNALS = [/\b(cache|real-time|realtime|concurrent|websocket|stale data)\b/i];
+const CACHE_SIGNALS = [/\b(cache|cached|real-time|realtime|websocket|stale data)\b/i];
 const DUPLICATE_OPERATION_SIGNALS = [
     /\b(submit|form|checkout|order|payment|create record|mutation|button click)\b/i,
     /\bduplicate\s+(?:request|submission|operation|record)\b/i,

package/dist/tools/challenge-spec/scenarios-desktop.js

@@ -1,5 +1,4 @@
-// tools/challenge-spec/scenarios-desktop.ts — Desktop auto-update edge case scenarios
-// SPEC-014b: interrupted download, permission issues, version regression, update during close.
+import { technologyValue } from '../../engine/technology-registry.js';
 import { contentMentions } from './scenarios-utils.js';
 /**
  * Generate desktop auto-update edge case scenarios.
@@ -8,7 +7,13 @@ import { contentMentions } from './scenarios-utils.js';
 export function generateDesktopAutoUpdateChallenges(_spec, specContent, knowledge) {
     const lower = specContent.toLowerCase();
     const isDesktop = knowledge.projectCategory === 'desktop' ||
-        contentMentions(lower, ['electron', 'tauri', 'auto-update', 'autoupdate', 'electron-updater']);
+        contentMentions(lower, [
+            technologyValue('technology-electron-88b1de'),
+            'tauri',
+            'auto-update',
+            'autoupdate',
+            'electron-updater',
+        ]);
     if (!isDesktop) {
         return [];
     }

package/dist/tools/challenge-spec/scenarios-failure.js

@@ -1,4 +1,4 @@
-// tools/challenge-spec/scenarios-failure.ts — Network, database, and resource failure scenarios
+import { technologyValue } from '../../engine/technology-registry.js';
 import { contentMentions, detectChallengeCapabilities } from './scenarios-utils.js';
 export function generateFailureScenarios(spec, content, _knowledge) {
     const scenarios = [];
@@ -46,7 +46,12 @@ export function generateFailureScenarios(spec, content, _knowledge) {
             scenario: 'Malformed or oversized input data',
             probability: 'high',
             impact: 'medium',
-            currentHandling: contentMentions(content, ['validat', 'sanitiz', 'schema', 'zod'])
+            currentHandling: contentMentions(content, [
+                'validat',
+                'sanitiz',
+                'schema',
+                technologyValue('technology-zod-4f63cf'),
+            ])
                 ? 'Validation mentioned in spec'
                 : 'Not explicitly addressed',
             requiredHandling: 'Validate input at the declared boundary and define payload limits.',

package/dist/tools/challenge-spec/scenarios-utils.d.ts

@@ -29,5 +29,5 @@ export interface ChallengeCapabilities {
 export declare function contentMentions(content: string, keywords: string[]): boolean;
 export declare function detectChallengeCapabilities(spec: Spec, specContent: string): ChallengeCapabilities;
 export declare function hasAnyChallengeCapability(capabilities: ChallengeCapabilities, names: (keyof ChallengeCapabilities)[]): boolean;
-export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
+export { hasAffirmedMatch, hasAnyAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.d.ts.map

package/dist/tools/challenge-spec/scenarios-utils.js

@@ -1,5 +1,5 @@
 // tools/challenge-spec/scenarios-utils.ts — Shared utilities for scenario generators
-import { hasAnyAffirmedMatch } from '../../engine/text-signal-boundaries.js';
+import { hasAnyAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 const CAPABILITY_SIGNALS = {
     networkApi: [
         /(?<!compiler\s)\bapi\b(?!\s+(?:compatibility|surface|package|type))/i,
@@ -15,7 +15,7 @@ const CAPABILITY_SIGNALS = {
         /\b(?:orm|prisma|drizzle|typeorm|sequelize)\b/i,
     ],
     authentication: [
-        /\b(?:auth(?:entication)?|login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i,
+        /\b(?:auth(?:entication|enticate)?|login|sign[ -]?in|password|jwt|oauth2?|session\s+auth)\b/i,
     ],
     authorization: [
         /\b(?:authori[sz]ation|permission|rbac|role-based|access\s+control|resource\s+ownership|tenant)\b/i,
@@ -26,10 +26,10 @@ const CAPABILITY_SIGNALS = {
         /\binputs?\s+(?:are\s+)?validat/i,
     ],
     externalService: [
-        /\b(?:third-party|external|remote|downstream)\s+(?:service|provider|dependency|system)\b/i,
+        /\b(?:third-party|external|remote|downstream)\s+(?:service|provider|dependency|system|api)\b/i,
         /\bwebhook\s+(?:provider|delivery|endpoint|request)\b/i,
     ],
-    payment: [/\b(?:payment|billing|checkout|invoice|stripe|paypal)\b/i],
+    payment: [/\b(?:payment|billing|invoice|stripe|paypal)\b/i],
     fileTransfer: [
         /\b(?:(?:large|binary|uploaded)\s+)?(?:file|image|media|attachment)\s+(?:upload|download|transfer|stream)\b/i,
         /\b(?:upload|download|stream)(?:ed|ing|s)?\s+(?:a\s+)?(?:(?:large|binary)\s+)?(?:file|image|media|attachment)\b/i,
@@ -43,8 +43,8 @@ const CAPABILITY_SIGNALS = {
     ],
     dataWrite: [
         /\b(?:database\s+transaction|persist(?:s|ed|ing)?\s+(?:record|entity|data)|write(?:s|ing)?\s+(?:record|entity|database))\b/i,
-        /\b(?:state-changing|data\s+mutation|atomic\s+database\s+write)\b/i,
-        /\b(?:transaction|atomic\s+write|update\s+(?:record|state)|modify\s+(?:record|state))\b/i,
+        /\b(?:state-changing|data\s+mutation|atomic\s+database\s+writes?)\b/i,
+        /\b(?:transaction|atomic\s+writes?|update\s+(?:record|state)|modify\s+(?:record|state))\b/i,
     ],
     cache: [/\b(?:cache|caching|cached\s+(?:data|response)|redis)\b/i],
     duplicateOperation: [
@@ -52,6 +52,7 @@ const CAPABILITY_SIGNALS = {
     ],
     concurrency: [
         /\b(?:concurren|race\s+condition|shared\s+state|parallel\s+write|atomic\s+increment|optimistic\s+lock)/i,
+        /\b(?:shared\b(?:\s+\w+){0,2}\s+(?:cache|resource|pool)|resource\s+(?:lock|pool))\b/i,
         /\b(?:counter|increment|balance|stock|quantity|vote|status\s+(?:update|transition))\b/i,
         /\b(?:file\s+upload|resource\s+manager|search\s+feed|list\s+endpoint|global\s+cache|session\s+state|cart\s+state|draft\s+state)\b/i,
     ],
@@ -76,8 +77,12 @@ const CAPABILITY_SIGNALS = {
     agent: [/\b(?:ai\s+agent|agent\s+contract|llm\s+agent|tool\s+call|autonomous\s+agent)\b/i],
     ddd: [/\b(?:domain-driven\s+design|ddd\s+aggregate|aggregate\s+root|bounded\s+context)\b/i],
     xp: [/\b(?:pair\s+programming|extreme\s+programming|xp\s+pair)\b/i],
-    validation: [/\b(?:input|payload|request|schema)\s+validat/i, /\b(?:zod|joi|json\s+schema)\b/i],
-    rateLimit: [/\b(?:rate[ -]?limit|throttl|request\s+quota)\b/i],
+    validation: [
+        /\b(?:input|payload|request|schema)\s+validat/i,
+        /\bvalidat(?:e|es|ed|ing|ion)\b/i,
+        /\b(?:zod|joi|json\s+schema)\b/i,
+    ],
+    rateLimit: [/\b(?:rate[ -]?limit(?:ing|ed|s)?|throttl|request\s+quota)\b/i],
     saga: [/\b(?:saga|compensating\s+transaction|distributed\s+transaction)\b/i],
     platform: [
         /\b(?:smart\s+contract|solidity|discord\s+bot|telegram\s+bot|iot\s+device|firmware|infrastructure\s+as\s+code|terraform|machine\s+learning\s+model)\b/i,
@@ -88,19 +93,38 @@ function keywordPattern(keyword) {
     const suffix = /^[a-z0-9]+$/i.test(keyword) && keyword.length > 3 ? '[a-z0-9_-]*' : '';
     return new RegExp(`\\b${escaped}${suffix}\\b`, 'i');
 }
+function whitespaceFlexiblePattern(text) {
+    return text
+        .trim()
+        .split(/\s+/)
+        .map((token) => token.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'))
+        .join('\\s+');
+}
+function stripReaderPrefix(spec, specContent) {
+    const readerPrefix = [spec.title, spec.type, spec.scope, spec.target, spec.tags.join(' ')]
+        .filter(Boolean)
+        .join(' ');
+    const prefixPattern = whitespaceFlexiblePattern(readerPrefix);
+    if (prefixPattern.length === 0) {
+        return specContent;
+    }
+    return specContent.replace(new RegExp(`^\\s*${prefixPattern}(?=\\s|$)`, 'u'), '').trimStart();
+}
 /** Boundary-aware, affirmative replacement for advisory substring checks. */
 export function contentMentions(content, keywords) {
     return hasAnyAffirmedMatch(content, keywords.map(keywordPattern));
 }
 export function detectChallengeCapabilities(spec, specContent) {
-    const text = `${spec.title}\n${spec.tags.join(' ')}\n${specContent}`;
+    const contractSource = stripReaderPrefix(spec, specContent);
+    const source = contractSource.trim().length > 0 ? contractSource : spec.title;
+    const contract = stripMetaAnalysisText(stripNonContractText(source));
     return Object.fromEntries(Object.entries(CAPABILITY_SIGNALS).map(([capability, patterns]) => [
         capability,
-        hasAnyAffirmedMatch(text, patterns),
+        hasAnyAffirmedMatch(contract, patterns),
     ]));
 }
 export function hasAnyChallengeCapability(capabilities, names) {
     return names.some((name) => capabilities[name]);
 }
-export { hasAffirmedMatch, hasAnyAffirmedMatch, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
+export { hasAffirmedMatch, hasAnyAffirmedMatch, stripMetaAnalysisText, stripNonContractText, } from '../../engine/text-signal-boundaries.js';
 //# sourceMappingURL=scenarios-utils.js.map

package/dist/tools/challenge-spec/security-challenge-scenarios.js

@@ -1,5 +1,4 @@
-// tools/challenge-spec/security-challenge-scenarios.ts — Security challenges for challenge_spec
-// SPEC-029 criteria 11, 24: authorization challenges and STRIDE-based challenges
+import { technologyValue } from '../../engine/technology-registry.js';
 import { detectSecurityProfiles } from '../../engine/security-analyzer.js';
 import { hasAnyAffirmedMatch } from './scenarios-utils.js';
 /**
@@ -106,7 +105,8 @@ export function generateSecurityTestCases(spec, framework) {
     }
     lines.push(`// Security tests for ${spec.title}`);
     lines.push('');
-    if (framework === 'jest' || framework === 'vitest') {
+    if (framework === technologyValue('technology-jest-35e99f') ||
+        framework === technologyValue('technology-vitest-a9127f')) {
         lines.push(`describe('Security: ${spec.title}', () => {`);
         lines.push(`  it('returns 401 when no authentication token is provided', async () => {`);
         lines.push(`    // Test unauthenticated access — expect 401`);