@planu/cli 4.13.0 → 5.0.0

package/dist/tools/tool-registry/core-tools.js

@@ -19,6 +19,7 @@ import { handleGenerateDiagram } from '../diagram-handler.js';
 import { handleCheckParallelSafety } from '../parallel-safety-handler.js';
 import { handleAnalyzePerformanceImpact } from '../performance-analysis-handler.js';
 import { handlePlanStatus } from '../status-handler.js';
+import { handleSessionCheckpoint } from '../session-checkpoint.js';
 import { handleValidateWorkflow } from '../validate-workflow.js';
 import { handleTransformCode } from '../transform-code-handler.js';
 import { handleConfigureTelemetry } from '../configure-telemetry.js';
@@ -42,8 +43,154 @@ import { handleDogfoodWatch } from '../dogfood-watch.js';
 import { SecurityReportTimeRangeEnum, SecurityReportFormatEnum, } from '../schemas/runtime-security.js';
 import { RenderSpecForProviderInputSchema, handleRenderSpecForProvider, } from '../render-spec-for-provider.js';
 import { handleTriageRequest, TriageRequestInputSchema } from '../triage-request.js';
+import { handleStoragePaths } from '../storage-paths-handler.js';
+import { handleStorageExport, handleStorageImport } from '../storage-bundle-handler.js';
+import { handleCancelJob, handleGetJob, handleRestartJob, handleWatchJob, } from '../jobs/handlers.js';
 // ── Registry ─────────────────────────────────────────────────────────────────
 const coreToolsRegistry = [
+    {
+        name: 'session_checkpoint',
+        description: 'Persist a compact, bounded session checkpoint to planu/session-context.md for the next session.',
+        schema: {
+            projectPath: z.string().trim().min(1).max(4096),
+        },
+        handler: handleSessionCheckpoint,
+        annotations: {
+            title: 'Session Checkpoint',
+            readOnlyHint: false,
+            destructiveHint: false,
+        },
+        wrap: 'safe',
+        group: 'core',
+    },
+    {
+        name: 'get_job',
+        description: 'Read the durable state and latest checkpoint or result for a local Planu job.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleGetJob,
+        annotations: {
+            title: 'Get Durable Job',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'watch_job',
+        description: 'Wait up to 30 seconds for a durable Planu job to change or reach a terminal state.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+            afterCursor: z
+                .string()
+                .regex(/^[a-f0-9]{64}$/)
+                .optional(),
+            timeoutMs: z.number().int().min(0).max(30_000).optional(),
+        },
+        handler: handleWatchJob,
+        annotations: {
+            title: 'Watch Durable Job',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'cancel_job',
+        description: 'Durably cancel a Planu job and fence any worker that still holds its former lease.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleCancelJob,
+        annotations: {
+            title: 'Cancel Durable Job',
+            readOnlyHint: false,
+            destructiveHint: true,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'restart_job',
+        description: 'Restart a cancelled or failed durable job and schedule its typed executor.',
+        schema: {
+            operationId: z.string().trim().min(1).max(128),
+            projectId: z.string().trim().min(1).max(128),
+            workspaceId: z.string().trim().min(1).max(128).optional(),
+        },
+        handler: handleRestartJob,
+        annotations: {
+            title: 'Restart Durable Job',
+            readOnlyHint: false,
+            destructiveHint: false,
+            idempotentHint: true,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_paths',
+        description: 'Resolve the canonical local-first Planu storage catalog, including ownership, lifecycle, sensitivity, retention and portability for every registered artifact family.',
+        schema: {
+            projectPath: z.string().min(1).max(4096).optional(),
+            logicalProjectId: z.string().min(1).max(128).optional(),
+            workspaceKeyHash: z.string().min(1).max(128).optional(),
+        },
+        handler: (args) => Promise.resolve(handleStoragePaths(args)),
+        annotations: {
+            title: 'Planu Storage Paths',
+            readOnlyHint: true,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_export',
+        description: 'Export a versioned, checksummed Planu runtime bundle with secret values redacted.',
+        schema: {
+            projectId: z.string().min(1).max(128),
+            outputPath: z.string().min(1).max(4096),
+        },
+        handler: handleStorageExport,
+        annotations: {
+            title: 'Export Planu Storage',
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
+    {
+        name: 'storage_import',
+        description: 'Verify and transactionally import a checksummed Planu runtime bundle.',
+        schema: { inputPath: z.string().min(1).max(4096) },
+        handler: handleStorageImport,
+        annotations: {
+            title: 'Import Planu Storage',
+            readOnlyHint: false,
+            destructiveHint: false,
+            openWorldHint: false,
+        },
+        wrap: 'safe',
+        group: 'infrastructure',
+    },
     // ── generate_batch_script (SPEC-253) ──────────────────────────────────────
     {
         name: 'generate_batch_script',
@@ -106,7 +253,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleGenerateDiagram(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── check_parallel_safety (SPEC-373) ──────────────────────────────────────
@@ -123,7 +270,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleCheckParallelSafety(args)),
         annotations: { title: 'Check Parallel Safety', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── analyze_performance_impact (SPEC-300) ─────────────────────────────────
@@ -145,7 +292,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleAnalyzePerformanceImpact(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── planu_status (SPEC-223) ───────────────────────────────────────────────
@@ -198,7 +345,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleValidateWorkflow(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── transform_code (SPEC-077) ─────────────────────────────────────────────
@@ -223,7 +370,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleTransformCode(args)),
         annotations: { title: 'Transform Code', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── configure_telemetry (SPEC-200) ────────────────────────────────────────
@@ -272,7 +419,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleTelemetryHealth(args),
         annotations: { title: 'Telemetry Health', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── configure_observability (SPEC-165) ────────────────────────────────────
@@ -365,7 +512,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleRecommendModel(args)),
         annotations: { title: 'Recommend Model', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── export_spec (SPEC-097) ────────────────────────────────────────────────
@@ -393,7 +540,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleExportSpec(args),
         annotations: { readOnlyHint: false },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── decompose_spec (SPEC-157) ─────────────────────────────────────────────
@@ -425,7 +572,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleDecomposeSpec(args),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── facilitate (SPEC-037 + SPEC-264) ──────────────────────────────────────
@@ -557,7 +704,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleScanProject(args),
         annotations: { readOnlyHint: false },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── estimate_ai_cost (SPEC-069) ───────────────────────────────────────────
@@ -579,7 +726,7 @@ const coreToolsRegistry = [
         },
         handler: async (args) => handleEstimateAiCost(args),
         annotations: { title: 'Estimate AI Cost', readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'analysis',
     },
     // ── heal_spec_docs (SPEC-493) ─────────────────────────────────────────────
@@ -607,7 +754,7 @@ const coreToolsRegistry = [
             readOnlyHint: false,
             destructiveHint: false,
         },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── convert_to_bdd (SPEC-481) ─────────────────────────────────────────────
@@ -679,7 +826,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleIdeConfig(args)),
         annotations: { title: 'Generate IDE Config' },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── living_reconcile_spec (SPEC-330) ──────────────────────────────────────
@@ -702,7 +849,7 @@ const coreToolsRegistry = [
             readOnlyHint: false,
             destructiveHint: false,
         },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'spec',
     },
     // ── security_report (SPEC-084) ────────────────────────────────────────────
@@ -716,7 +863,7 @@ const coreToolsRegistry = [
         },
         handler: (args) => Promise.resolve(handleSecurityReport(args)),
         annotations: { readOnlyHint: true },
-        wrap: 'licensed',
+        wrap: 'governed',
         group: 'core',
     },
     // ── render_spec_for_provider (SPEC-670) ───────────────────────────────────

package/dist/tools/tool-registry/group-infra.js

@@ -1,19 +1,8 @@
-// SPEC-597-EXEMPT: canonical mapping (npm-package↔framework, keyword catalogue)
-// — must enumerate framework names by design; no detection logic to migrate.
-/* eslint-disable max-lines, max-lines-per-function -- thematic registry group consolidated by SPEC refactor-phase3 (commit aafeea60); each block is a declarative tool registration ~20 lines, split would re-create the ~120 register-*.ts files this phase intentionally collapsed */
-// tools/tool-registry/group-infra.ts — Declarative registry: infrastructure & platform tools.
-//
-// Phase 2 (refactor/registry-phase2): consolidates register-*.ts files for:
-//   webhook, dashboard, usage, license, auto-update, deploy, cross-repo-search, browser-validate,
-//   workers, plugins, registry, skill-registry, tool-groups, rbac, workspace, memory-config,
-//   onboarding, docs-registry, well-known
+import { technologyValue } from '../../engine/technology-registry.js';
 import { z } from 'zod';
 // ── safe handlers ────────────────────────────────────────────────────────────
-import { safe, safeLicensed, safeTracked } from '../safe-handler.js';
-// ── License tools (register-license-tools.ts) ───────────────────────────────
-import { handleActivateLicense, handleDeactivateLicense } from '../activate-license.js';
-import { handleLicenseStatus } from '../license-status.js';
-import { LicenseStatusOutputSchema, SpecIdSchema } from '../schemas/index.js';
+import { safe, safeGoverned, safeTracked } from '../safe-handler.js';
+import { SpecIdSchema } from '../schemas/index.js';
 // ── OAuth tools (register-oauth-tools.ts / register-configure-oauth-tool.ts) ─
 import { handleStartOAuthFlow, handleOAuthStatus, StartOAuthFlowInputSchema, OAuthStatusInputSchema, } from '../oauth-handler.js';
 import { handleConfigureOAuth } from '../configure-oauth-handler.js';
@@ -21,8 +10,6 @@ import { handleConfigureOAuth } from '../configure-oauth-handler.js';
 import { handleUsageStats } from '../usage-stats.js';
 import { handleUsageReport } from '../usage-report.js';
 import { handleToolUsageReport } from '../tool-usage-report.js';
-// ── Webhook tools (register-webhook-tools.ts) ────────────────────────────────
-import { handleStartWebhook, handleStopWebhook, handleWebhookStatus } from '../webhook.js';
 // ── Outbound webhook tools (register-outbound-webhook-tools.ts) ──────────────
 import { handleConfigureWebhook, handleOutboundWebhookStatus, handleRemoveWebhook, } from '../outbound-webhook-handler.js';
 // ── Dashboard tools (register-dashboard-tools.ts) ────────────────────────────
@@ -89,59 +76,26 @@ const SUPPORTED_EVENTS = [
     'validate.failed',
 ];
 const deployProviderEnum = z
-    .enum(['vercel', 'netlify', 'cloudflare-pages', 'fly', 'railway'])
+    .enum([
+    technologyValue('technology-vercel-9d3508'),
+    technologyValue('technology-netlify-58465a'),
+    'cloudflare-pages',
+    technologyValue('technology-fly-f4debd'),
+    technologyValue('technology-railway-e34d1c'),
+])
     .describe('Deploy provider: vercel | netlify | cloudflare-pages | fly | railway');
 export function registerInfraGroupTools(server) {
-    // ── License tools ──────────────────────────────────────────────────────────
-    server.registerTool('activate_license', {
-        description: 'Activate a Planu license key to unlock Pro/Team/Enterprise features. ' +
-            'Get your key at https://planu.dev/pricing.',
-        inputSchema: {
-            licenseKey: z
-                .string()
-                .max(500)
-                .describe('License key from Lemon Squeezy (e.g. XXXXXXXX-XXXX-...)'),
-            instanceName: z
-                .string()
-                .max(500)
-                .optional()
-                .describe('Optional name for this machine (defaults to hostname)'),
-        },
-        annotations: { title: 'Activate License', readOnlyHint: false },
-    }, safe(async (args) => handleActivateLicense(args)));
-    server.registerTool('deactivate_license', {
-        description: 'Deactivate your Planu license on this machine. ' +
-            'Frees up the activation slot so you can use it elsewhere.',
-        inputSchema: {
-            confirm: z
-                .boolean()
-                .describe('Set to true to confirm deactivation. This reverts to the Free plan.'),
-        },
-        annotations: { title: 'Deactivate License', destructiveHint: true },
-    }, safe(async (args) => handleDeactivateLicense(args)));
-    server.registerTool('license_status', {
-        description: 'Show your current Planu plan, limits, usage, and upgrade options.',
-        inputSchema: {
-            projectId: z
-                .string()
-                .max(500)
-                .optional()
-                .describe('Optional project ID to include project-specific usage'),
-        },
-        outputSchema: LicenseStatusOutputSchema,
-        annotations: { title: 'License Status', readOnlyHint: true },
-    }, safe(async (args) => handleLicenseStatus(args)));
     // ── OAuth tools ────────────────────────────────────────────────────────────
     server.registerTool('start_oauth_flow', {
         description: 'Start guided OAuth setup for supported integrations such as Figma, GitHub, Sentry, or Supabase.',
         inputSchema: StartOAuthFlowInputSchema,
         annotations: { title: 'Start OAuth Flow', readOnlyHint: false },
-    }, safeLicensed('start_oauth_flow', async (args) => handleStartOAuthFlow(args)));
+    }, safeGoverned('start_oauth_flow', async (args) => handleStartOAuthFlow(args)));
     server.registerTool('oauth_status', {
         description: 'Show which OAuth-backed integrations are connected for this project.',
         inputSchema: OAuthStatusInputSchema,
         annotations: { title: 'OAuth Status', readOnlyHint: true },
-    }, safeLicensed('oauth_status', async (args) => handleOAuthStatus(args)));
+    }, safeGoverned('oauth_status', async (args) => handleOAuthStatus(args)));
     server.registerTool('configure_oauth', {
         description: 'Inspect Planu MCP OAuth/API-key auth status or test a bearer token without exposing secrets.',
         inputSchema: {
@@ -152,7 +106,7 @@ export function registerInfraGroupTools(server) {
     }, safe(async (args) => handleConfigureOAuth(args)));
     // ── Usage tools ────────────────────────────────────────────────────────────
     server.registerTool('usage_stats', {
-        description: 'View your Planu usage statistics — tool calls, top tools, remaining daily calls. ' +
+        description: 'View your Planu usage statistics — tool calls, top tools, and execution health. ' +
             'Helps you understand how much of your plan you are using. ' +
             'For the last 30 days with no parameters prefer resource: planu://usage/stats.',
         inputSchema: {
@@ -195,45 +149,6 @@ export function registerInfraGroupTools(server) {
         },
         annotations: { title: 'Tool Usage Report', readOnlyHint: true },
     }, safe(async (args) => handleToolUsageReport(args)));
-    // ── Webhook tools (inbound) ────────────────────────────────────────────────
-    server.registerTool('start_webhook', {
-        description: 'Start a local HTTP server to receive Lemon Squeezy webhook events. ' +
-            'Configure the server URL in your Lemon Squeezy dashboard under Settings > Webhooks.',
-        inputSchema: {
-            port: z
-                .number()
-                .int()
-                .min(1)
-                .max(65535)
-                .optional()
-                .describe('Port to listen on (default: 2358)'),
-            secret: z
-                .string()
-                .optional()
-                .describe('Webhook secret from Lemon Squeezy dashboard for HMAC-SHA256 signature validation'),
-        },
-        annotations: { title: 'Start Webhook Server', readOnlyHint: false },
-    }, safe((args) => handleStartWebhook(args)));
-    server.registerTool('stop_webhook', {
-        description: 'Stop the running Lemon Squeezy webhook server.',
-        inputSchema: {
-            force: z
-                .boolean()
-                .optional()
-                .describe('Force stop even if events are being processed (default: false)'),
-        },
-        annotations: { title: 'Stop Webhook Server', destructiveHint: false },
-    }, safe((args) => handleStopWebhook(args)));
-    server.registerTool('webhook_status', {
-        description: 'Show whether the webhook server is running and display recently received events.',
-        inputSchema: {
-            includeEvents: z
-                .boolean()
-                .optional()
-                .describe('Include recent event log in the output (default: true)'),
-        },
-        annotations: { title: 'Webhook Status', readOnlyHint: true },
-    }, safe((args) => Promise.resolve(handleWebhookStatus(args))));
     // ── Outbound webhook tools ─────────────────────────────────────────────────
     server.registerTool('configure_webhook', {
         description: 'Register an outbound webhook endpoint to receive Planu spec lifecycle events. ' +
@@ -329,8 +244,8 @@ export function registerInfraGroupTools(server) {
         annotations: { readOnlyHint: true },
     }, safe(async (_args) => handleCheckUpdateStatus()));
     server.registerTool('enable_auto_update', {
-        description: 'Enable automatic updates for Planu by switching the MCP config to use ' +
-            '"npx -y @planu/cli@latest". Detects the config file automatically (~/.claude.json or ' +
+        description: 'Resolve the newest verified Planu release and pin the MCP config to its exact version. ' +
+            'Detects the config file automatically (~/.claude.json or ' +
             'Claude Desktop config). Creates a backup before any modification. ' +
             'Call with confirm=false (default) to preview the change; confirm=true to apply it.',
         inputSchema: {
@@ -366,7 +281,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Set to true to apply the pin immediately. Defaults to false (preview only).'),
         },
         annotations: { readOnlyHint: false, destructiveHint: false },
-    }, safeLicensed('pin_version', async (args) => handlePinVersion(args)));
+    }, safeGoverned('pin_version', async (args) => handlePinVersion(args)));
     // ── Deploy tools ────────────────────────────────────────────────────────────
     server.registerTool('configure_deploy_target', {
         description: 'Save credentials for a deploy provider (Vercel, Netlify, etc.). Stores the API token in data/{projectId}/deploy-config.json. Required before deploy_spec.',
@@ -472,7 +387,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Maximum results to return across all projects (default 50)'),
         },
         annotations: { title: 'Search All Projects', readOnlyHint: true },
-    }, safeLicensed('search_all_projects', async (args) => handleSearchAllProjects(args)));
+    }, safeGoverned('search_all_projects', async (args) => handleSearchAllProjects(args)));
     // ── Browser validate tools ─────────────────────────────────────────────────
     server.registerTool('validate_browser', {
         description: 'Extract UI-testable assertions from a spec and run them against a live URL using Playwright. ' +
@@ -518,7 +433,7 @@ export function registerInfraGroupTools(server) {
             value: ConfigureWorkersInputSchema.shape.value,
         },
         annotations: { title: 'Configure Workers', readOnlyHint: false },
-    }, safeLicensed('configure_workers', (args) => handleConfigureWorkers(args)));
+    }, safeGoverned('configure_workers', (args) => handleConfigureWorkers(args)));
     // ── Plugin tools ───────────────────────────────────────────────────────────
     server.registerTool('manage_plugins', {
         description: 'Manage Planu plugin lifecycle: search, list, activate, deactivate, uninstall, info. ' +
@@ -530,7 +445,7 @@ export function registerInfraGroupTools(server) {
             readOnlyHint: false,
             destructiveHint: false,
         },
-    }, safeLicensed('manage_plugins', async (args) => handleManagePlugins(args)));
+    }, safeGoverned('manage_plugins', async (args) => handleManagePlugins(args)));
     server.registerTool('scaffold_plugin', {
         description: 'Generate a starter plugin project with manifest, entry point, tests, and examples. ' +
             'The scaffold includes TypeScript config and example extensions for the selected types.',
@@ -539,7 +454,7 @@ export function registerInfraGroupTools(server) {
             title: 'Scaffold Plugin',
             readOnlyHint: false,
         },
-    }, safeLicensed('scaffold_plugin', async (args) => handleScaffoldPlugin(args)));
+    }, safeGoverned('scaffold_plugin', async (args) => handleScaffoldPlugin(args)));
     // ── Token optimizer tools ──────────────────────────────────────────────────
     server.registerTool('suggest_token_optimizer', {
         description: 'Detect whether RTK (Response Token Killer) or Headroom are configured in the project. ' +
@@ -548,7 +463,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('suggest_token_optimizer', async (args) => handleSuggestTokenOptimizer(args)));
+    }, safeGoverned('suggest_token_optimizer', async (args) => handleSuggestTokenOptimizer(args)));
     server.registerTool('token_optimizer_status', {
         description: 'Returns the installation status of RTK and Headroom token optimization tools. ' +
             'Includes version info and number of configured PreToolUse hooks.',
@@ -556,7 +471,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('token_optimizer_status', async (args) => handleTokenOptimizerStatus(args)));
+    }, safeGoverned('token_optimizer_status', async (args) => handleTokenOptimizerStatus(args)));
     // ── RBAC tools ─────────────────────────────────────────────────────────────
     server.registerTool('configure_roles', {
         description: 'Enable or disable Role-Based Access Control (RBAC) for a project. ' +
@@ -568,7 +483,7 @@ export function registerInfraGroupTools(server) {
             enabled: ConfigureRolesInputSchema.shape.enabled,
         },
         annotations: { title: 'Configure Roles (RBAC)', readOnlyHint: false },
-    }, safeLicensed('configure_roles', (args) => handleConfigureRoles(args)));
+    }, safeGoverned('configure_roles', (args) => handleConfigureRoles(args)));
     server.registerTool('assign_role', {
         description: 'Assign a role to a user for a project or a specific spec. ' +
             'Roles: Admin (full access), Architect (create/approve/configure), ' +
@@ -583,7 +498,7 @@ export function registerInfraGroupTools(server) {
             assignedBy: AssignRoleInputSchema.shape.assignedBy,
         },
         annotations: { title: 'Assign Role', readOnlyHint: false },
-    }, safeLicensed('assign_role', (args) => handleAssignRole(args)));
+    }, safeGoverned('assign_role', (args) => handleAssignRole(args)));
     // ── Framework registry tools ───────────────────────────────────────────────
     server.registerTool('check_spec_accuracy', {
         description: 'Validate spec content (spec.md text or acceptance criteria) against the framework registry ' +
@@ -786,7 +701,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Also audit ~/.claude/ global config (default: true)'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('audit_claude_config', async (args) => handleAuditClaudeConfig(args)));
+    }, safeGoverned('audit_claude_config', async (args) => handleAuditClaudeConfig(args)));
     server.registerTool('generate_docs_site', {
         description: 'Generate a static HTML documentation site from project specs, tools catalog, architecture diagrams, and metrics. ' +
             'Produces a navigable portal with dashboard, spec pages, tools catalog, Mermaid diagrams, and search.',
@@ -799,7 +714,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Site title (default: "Planu Documentation")'),
         },
         annotations: { readOnlyHint: false },
-    }, safeLicensed('generate_docs_site', async (args) => handleGenerateDocsSite(args)));
+    }, safeGoverned('generate_docs_site', async (args) => handleGenerateDocsSite(args)));
     // ── Memory config tools ────────────────────────────────────────────────────
     server.registerTool('configure_memory', {
         description: 'Configure persistent AI memory for your project using OpenMemory (local) or Mem0 Cloud. ' +
@@ -820,7 +735,7 @@ export function registerInfraGroupTools(server) {
                 .optional()
                 .describe('Mem0 API key — required for setup-mem0-cloud action. Get from https://app.mem0.ai'),
         },
-    }, safeLicensed('configure_memory', async (args) => handleConfigureMemory(args)));
+    }, safeGoverned('configure_memory', async (args) => handleConfigureMemory(args)));
     server.registerTool('memory_status', {
         description: 'Returns the current AI memory configuration status. ' +
             'Shows which provider is configured (none, openmemory, mem0-cloud) and the config file path.',
@@ -828,7 +743,7 @@ export function registerInfraGroupTools(server) {
         inputSchema: {
             projectPath: z.string().describe('Absolute path to the project root directory'),
         },
-    }, safeLicensed('memory_status', async (args) => handleMemoryStatus(args)));
+    }, safeGoverned('memory_status', async (args) => handleMemoryStatus(args)));
     // ── Code graph tools ──────────────────────────────────────────────────────
     server.registerTool('configure_code_graph', {
         description: 'Configure a local code graph MCP provider for the project. Supports Colby CodeGraph, CodeGraphContext, Pathfinder, and Axon. Writes the provider entry to .claude.json.',
@@ -845,14 +760,14 @@ export function registerInfraGroupTools(server) {
             ])
                 .describe('setup-colby-codegraph: configure @colbymchenry/codegraph | setup-codegraph-context: configure CodeGraphContext | setup-pathfinder: configure Pathfinder | setup-axon: configure Axon | status: show current provider status'),
         },
-    }, safeLicensed('configure_code_graph', async (args) => handleConfigureCodeGraph(args)));
+    }, safeGoverned('configure_code_graph', async (args) => handleConfigureCodeGraph(args)));
     server.registerTool('code_graph_status', {
         description: 'Returns the current code graph MCP provider status from .claude.json, including the active provider if one is configured.',
         annotations: { title: 'Code Graph Status', readOnlyHint: true },
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
-    }, safeLicensed('code_graph_status', async (args) => handleCodeGraphStatus(args)));
+    }, safeGoverned('code_graph_status', async (args) => handleCodeGraphStatus(args)));
     // ── Onboarding tools ───────────────────────────────────────────────────────
     server.registerTool('start_onboarding', {
         description: 'Start interactive onboarding for a new project. Generates personalized recommendations based on your role, project type, and team size. Returns a markdown guide with next steps.',
@@ -867,7 +782,7 @@ export function registerInfraGroupTools(server) {
             teamSize: z.enum(['1', '2-5', '6-20', '20+']).describe('Team size: 1, 2-5, 6-20, 20+'),
         },
         annotations: { readOnlyHint: false },
-    }, safeLicensed('start_onboarding', async (args) => handleStartOnboarding(args)));
+    }, safeGoverned('start_onboarding', async (args) => handleStartOnboarding(args)));
     server.registerTool('guided_tour', {
         description: 'Get a step-by-step guided tour of a Planu feature area. Returns markdown with numbered steps, examples, and tool hints.',
         inputSchema: {
@@ -883,14 +798,14 @@ export function registerInfraGroupTools(server) {
                 .describe('Tour area: spec-lifecycle, team-collaboration, integrations, ai-tools, security, reporting'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('guided_tour', async (args) => handleGuidedTour(args)));
+    }, safeGoverned('guided_tour', async (args) => handleGuidedTour(args)));
     server.registerTool('onboarding_checklist', {
         description: 'Check what onboarding steps are complete for a project. Verifies planu.json, CLAUDE.md, specs, rules, and skills. Returns a checklist with progress percentage.',
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('onboarding_checklist', async (args) => handleOnboardingChecklist(args)));
+    }, safeGoverned('onboarding_checklist', async (args) => handleOnboardingChecklist(args)));
     server.registerTool('quick_start', {
         description: 'Get a quick start guide for a common project archetype. Returns a markdown guide with copy-paste commands.',
         inputSchema: {
@@ -905,14 +820,14 @@ export function registerInfraGroupTools(server) {
                 .describe('Optional project path to personalize the guide'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('quick_start', async (args) => handleQuickStart(args)));
+    }, safeGoverned('quick_start', async (args) => handleQuickStart(args)));
     server.registerTool('onboarding_progress', {
         description: 'View onboarding progress for a project. Shows setup checklist, profile, and next recommended steps.',
         inputSchema: {
             projectPath: z.string().min(1).max(4096).describe('Absolute path to the project root'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('onboarding_progress', async (args) => handleOnboardingProgress(args)));
+    }, safeGoverned('onboarding_progress', async (args) => handleOnboardingProgress(args)));
     // ── Docs registry tools ────────────────────────────────────────────────────
     server.registerTool('validate_docs_registry', {
         description: 'Check all entries in the built-in docs-registry.json for broken or slow links. ' +
@@ -925,7 +840,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Absolute path to the project root (used for context only).'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('validate_docs_registry', async (args) => {
+    }, safeGoverned('validate_docs_registry', async (args) => {
         return handleValidateDocsRegistry(args);
     }));
     server.registerTool('discover_docs_url', {
@@ -940,7 +855,7 @@ export function registerInfraGroupTools(server) {
                 .describe('Package or library name to look up (e.g. "axios", "requests", "tokio").'),
         },
         annotations: { readOnlyHint: true },
-    }, safeLicensed('discover_docs_url', async (args) => {
+    }, safeGoverned('discover_docs_url', async (args) => {
         return handleDiscoverDocsUrl(args);
     }));
     // ── GC tools ───────────────────────────────────────────────────────────────