@planu/cli 4.14.1 → 5.0.0

package/dist/engine/migrations/remove-commercial-state.js

@@ -0,0 +1,343 @@
+import { lstat, readFile, readdir, unlink } from 'node:fs/promises';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { atomicWriteFile } from '../safety/atomic-write-file.js';
+import { withUpgradeLock } from '../auto-updater/upgrade-lock.js';
+import { deleteSecretField } from '../../security/secret-field.js';
+import { isSecretReference, parseSecretReference } from '../../security/secret-provider.js';
+import { globalDataDir } from '../../storage/base-store.js';
+import { resolveStorageLayout } from '../../storage/storage-layout.js';
+const TOP_LEVEL_USAGE_KEYS = [
+    'trialState',
+    'firstRunAt',
+    'dailyLimit',
+    'dailyCalls',
+    'remainingDailyCalls',
+    'currentTier',
+    'callsByTier',
+    'daysSinceFirstRun',
+    'isTrialActive',
+    'trialDaysLeft',
+];
+const EVENT_USAGE_KEYS = ['tier', 'trial', 'quota', 'dailyLimit', 'remainingDailyCalls'];
+const COMMERCIAL_HOST_ENV_KEYS = [
+    'SDD_LICENSE_KEY',
+    'SDD_OWNER_TOKEN',
+    'PLANU_LICENSE_KEY',
+    'PLANU_SKIP_TRIAL',
+];
+const ARCHIVED_USAGE = /^usage-\d{4}-\d{2}-\d{2}\.json$/u;
+function nodeError(error, code) {
+    return error instanceof Error && 'code' in error && error.code === code;
+}
+function cleanupCode(error) {
+    if (error instanceof Error && error.message.includes('symlink')) {
+        return 'SYMLINK_REJECTED';
+    }
+    if (error instanceof SyntaxError ||
+        (error instanceof Error && error.message.includes('malformed'))) {
+        return 'MALFORMED_JSON';
+    }
+    if (nodeError(error, 'EACCES') || nodeError(error, 'EPERM') || nodeError(error, 'EROFS')) {
+        return 'WRITE_DENIED';
+    }
+    if (error instanceof Error && error.message.includes('lock')) {
+        return 'LOCK_UNAVAILABLE';
+    }
+    return 'CLEANUP_FAILED';
+}
+async function regularFile(path) {
+    try {
+        const info = await lstat(path);
+        if (info.isSymbolicLink()) {
+            throw new Error('[Planu] cleanup symlink rejected');
+        }
+        if (!info.isFile()) {
+            throw new Error('[Planu] cleanup non-file rejected');
+        }
+        return true;
+    }
+    catch (error) {
+        if (nodeError(error, 'ENOENT')) {
+            return false;
+        }
+        throw error;
+    }
+}
+async function parseJsonFile(path) {
+    if (!(await regularFile(path))) {
+        return undefined;
+    }
+    try {
+        return JSON.parse(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        throw new Error('[Planu] cleanup malformed JSON', { cause: error });
+    }
+}
+function omitKnownKeys(record, keys) {
+    const forbidden = new Set(keys);
+    const entries = Object.entries(record).filter(([key]) => !forbidden.has(key));
+    return {
+        value: Object.fromEntries(entries),
+        changed: entries.length !== Object.keys(record).length,
+    };
+}
+function stripCommercialUsage(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+        return { value, changed: false };
+    }
+    const root = value;
+    const topLevel = omitKnownKeys(root, TOP_LEVEL_USAGE_KEYS);
+    let changed = topLevel.changed;
+    let events = topLevel.value.events;
+    if (Array.isArray(root.events)) {
+        const sourceEvents = root.events;
+        events = sourceEvents.map((event) => {
+            if (event === null || typeof event !== 'object' || Array.isArray(event)) {
+                return event;
+            }
+            const sanitized = omitKnownKeys(event, EVENT_USAGE_KEYS);
+            changed = sanitized.changed || changed;
+            return sanitized.value;
+        });
+    }
+    return {
+        value: Array.isArray(root.events) ? { ...topLevel.value, events } : topLevel.value,
+        changed,
+    };
+}
+async function rewriteJson(path, value, assertFence) {
+    await assertFence();
+    await atomicWriteFile(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+async function cleanUsage(path, assertFence) {
+    const document = await parseJsonFile(path);
+    const sanitized = stripCommercialUsage(document);
+    if (document === undefined || !sanitized.changed) {
+        return 0;
+    }
+    await rewriteJson(path, sanitized.value, assertFence);
+    return 1;
+}
+async function cleanHost(path, assertFence) {
+    const document = await parseJsonFile(path);
+    if (document === undefined || document === null || typeof document !== 'object') {
+        return 0;
+    }
+    const root = document;
+    const sanitizeContainer = (value) => {
+        if (value === null || typeof value !== 'object' || Array.isArray(value)) {
+            return { value, changed: false };
+        }
+        const container = value;
+        const planu = container.planu;
+        if (planu === null || typeof planu !== 'object' || Array.isArray(planu)) {
+            return { value, changed: false };
+        }
+        const entry = planu;
+        const env = entry.env;
+        if (env === null || typeof env !== 'object' || Array.isArray(env)) {
+            return { value, changed: false };
+        }
+        const sanitized = omitKnownKeys(env, COMMERCIAL_HOST_ENV_KEYS);
+        return {
+            value: sanitized.changed
+                ? { ...container, planu: { ...entry, env: sanitized.value } }
+                : value,
+            changed: sanitized.changed,
+        };
+    };
+    const mcpServers = sanitizeContainer(root.mcpServers);
+    const contextServers = sanitizeContainer(root.context_servers);
+    const changed = mcpServers.changed || contextServers.changed;
+    const sanitizedRoot = {
+        ...root,
+        ...(Object.hasOwn(root, 'mcpServers') ? { mcpServers: mcpServers.value } : {}),
+        ...(Object.hasOwn(root, 'context_servers') ? { context_servers: contextServers.value } : {}),
+    };
+    if (!changed) {
+        return 0;
+    }
+    await rewriteJson(path, sanitizedRoot, assertFence);
+    return 1;
+}
+async function removeFile(path, assertFence) {
+    if (!(await regularFile(path))) {
+        return 0;
+    }
+    await assertFence();
+    await unlink(path);
+    return 1;
+}
+async function matchingFiles(directory, predicate) {
+    try {
+        return (await readdir(directory)).filter(predicate).map((name) => join(directory, name));
+    }
+    catch (error) {
+        if (nodeError(error, 'ENOENT')) {
+            return [];
+        }
+        throw error;
+    }
+}
+async function licenseBackups(licensePath) {
+    const file = basename(licensePath);
+    const stem = file.endsWith('.json') ? file.slice(0, -5) : file;
+    return matchingFiles(dirname(licensePath), (entry) => entry === `${file}.bak` ||
+        (entry.startsWith(`${file}.bak.`) && /^\d+$/u.test(entry.slice(file.length + 5))) ||
+        (entry.startsWith(`${stem}.backup-`) && entry.endsWith('.json')));
+}
+async function hostPathsFromManifest(path) {
+    try {
+        const document = await parseJsonFile(path);
+        if (document === undefined || document === null || typeof document !== 'object') {
+            return [];
+        }
+        const records = document.installations;
+        if (!Array.isArray(records)) {
+            return [];
+        }
+        return records.flatMap((record) => {
+            if (record === null || typeof record !== 'object') {
+                return [];
+            }
+            const configPath = record.configPath;
+            return typeof configPath === 'string' && isAbsolute(configPath) ? [configPath] : [];
+        });
+    }
+    catch {
+        return [];
+    }
+}
+function defaultLegacyDataPaths() {
+    const packageRoot = fileURLToPath(new URL('../../../', import.meta.url));
+    return [
+        join(packageRoot, 'data', 'global'),
+        join(homedir(), '.planu', 'data', 'global'),
+        join(homedir(), '.planu'),
+    ];
+}
+function defaultHostConfigPaths(home, project) {
+    return [
+        join(home, '.claude.json'),
+        join(home, '.cursor', 'mcp.json'),
+        join(home, '.codeium', 'windsurf', 'mcp_config.json'),
+        join(home, '.config', 'zed', 'settings.json'),
+        join(home, '.vscode', 'globalStorage', 'saoudrizwan.claude-dev', 'settings', 'cline_mcp_settings.json'),
+        join(home, '.continue', 'config.json'),
+        join(project, '.claude.json'),
+        join(project, '.cursor', 'mcp.json'),
+        join(project, '.windsurf', 'mcp.json'),
+        join(project, '.zed', 'settings.json'),
+        join(project, '.continue', 'config.json'),
+    ];
+}
+async function cleanDataDirectory(dataPath, assertFence, strict) {
+    const errors = [];
+    const attempt = async (operation, kind) => {
+        try {
+            const count = await operation();
+            if (kind === 'remove') {
+                removedFiles += count;
+            }
+            else {
+                updatedFiles += count;
+            }
+        }
+        catch (error) {
+            const code = cleanupCode(error);
+            errors.push(code);
+            if (strict) {
+                throw new Error(`[Planu] commercial cleanup failed: ${code}`, { cause: error });
+            }
+        }
+    };
+    let removedFiles = 0;
+    let updatedFiles = 0;
+    const licensePath = join(dataPath, 'license.json');
+    await attempt(async () => {
+        const licenseDocument = await parseJsonFile(licensePath);
+        if (licenseDocument && typeof licenseDocument === 'object') {
+            const reference = licenseDocument.licenseKey;
+            if (isSecretReference(reference) && parseSecretReference(reference).purpose === 'license') {
+                await assertFence();
+                await deleteSecretField(reference);
+            }
+        }
+        return removeFile(licensePath, assertFence);
+    }, 'remove');
+    await attempt(async () => {
+        let count = 0;
+        for (const backup of await licenseBackups(licensePath)) {
+            count += await removeFile(backup, assertFence);
+        }
+        return count;
+    }, 'remove');
+    await attempt(() => removeFile(join(dataPath, 'first-run.json'), assertFence), 'remove');
+    await attempt(() => cleanUsage(join(dataPath, 'usage.json'), assertFence), 'update');
+    let archives = [];
+    try {
+        archives = await matchingFiles(dataPath, (name) => ARCHIVED_USAGE.test(name));
+    }
+    catch (error) {
+        errors.push(cleanupCode(error));
+    }
+    for (const archive of archives) {
+        await attempt(() => cleanUsage(archive, assertFence), 'update');
+    }
+    return { removedFiles, updatedFiles, errors };
+}
+export async function removeCommercialState(options = {}) {
+    const layout = resolveStorageLayout();
+    const lockPath = options.lockPath ?? layout.installationManifest;
+    const errors = [];
+    const run = options.lockRunner ?? withUpgradeLock;
+    try {
+        return await run(lockPath, async (assertFence) => {
+            let removedFiles = 0;
+            let updatedFiles = 0;
+            const dataPaths = new Set([
+                options.globalDataPath ?? globalDataDir(),
+                ...(options.legacyGlobalDataPaths ?? defaultLegacyDataPaths()),
+            ]);
+            const hostPaths = new Set([
+                ...(options.hostConfigPaths ?? []),
+                ...defaultHostConfigPaths(options.homeDirectory ?? homedir(), options.projectDirectory ?? process.cwd()),
+                ...(await hostPathsFromManifest(layout.installationManifest)),
+            ]);
+            const attempt = async (operation) => {
+                try {
+                    const result = await operation();
+                    removedFiles += result.removedFiles ?? 0;
+                    updatedFiles += result.updatedFiles ?? 0;
+                }
+                catch (error) {
+                    const code = cleanupCode(error);
+                    errors.push(code);
+                    if (options.strict) {
+                        throw new Error(`[Planu] commercial cleanup failed: ${code}`, { cause: error });
+                    }
+                }
+            };
+            for (const path of dataPaths) {
+                const result = await cleanDataDirectory(path, assertFence, options.strict === true);
+                removedFiles += result.removedFiles;
+                updatedFiles += result.updatedFiles;
+                errors.push(...result.errors);
+            }
+            for (const path of hostPaths) {
+                await attempt(async () => ({ updatedFiles: await cleanHost(path, assertFence) }));
+            }
+            return { removedFiles, updatedFiles, errors };
+        });
+    }
+    catch (error) {
+        if (options.strict) {
+            throw error;
+        }
+        return { removedFiles: 0, updatedFiles: 0, errors: [cleanupCode(error)] };
+    }
+}
+//# sourceMappingURL=remove-commercial-state.js.map

package/dist/engine/network-policy.js

@@ -49,6 +49,7 @@ function environmentConsent() {
 }
 function isNetworkPurpose(value) {
     return (value === 'dependency-audit' ||
+        value === 'feedback' ||
         value === 'integration' ||
         value === 'oauth' ||
         value === 'registry' ||

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "4.14.1",
-  "engineVersion": "4.14.1",
-  "buildId": "1-4.14.1-aarch64-apple-darwin",
+  "cliVersion": "5.0.0",
+  "engineVersion": "5.0.0",
+  "buildId": "1-5.0.0-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "5e2c55c2f381c543c0909efb8bc183ba9bbd44f8c4f5faacc61bb6d0a603e794",
+  "artifactSha256": "d276727c4cddf005cbeb70bda9f34d3c4dcb7d3412cbd0e9c7b98c662c0bdac0",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "04829beb5af09b1b805f3454bf58f9cbff09b6d6b08a18f9cf0591172d7cc413"
+    "sha256": "3716a15b7f30bb64bf0c741dbc9c1042fb0bc66a35ebbcb54fda80b88bf0190f"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "6f1f1f95b8f68ae5e9987ef924987e1e9112b27a",
+    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "vi1PiQ/jDc4F21zckyqwUSUPqCDb1qsp/UY7HO+a2puJBml0yh8WJKhvcQZ6RRyDZDrApq078WcNsGhncR+EBg=="
+    "value": "I9bHVmPRkBD2GdyS/HGW3zPavsTvN2DgBmAfBNhTcryNe6N25vyb4D/dIfw5BtZZ/pL0R1tbfolQKI1zvqlqBg=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@4.14.1",
+      "bom-ref": "pkg:cargo/planu-core@5.0.0",
       "type": "library",
       "name": "planu-core",
-      "version": "4.14.1",
+      "version": "5.0.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5e2c55c2f381c543c0909efb8bc183ba9bbd44f8c4f5faacc61bb6d0a603e794"
+          "content": "d276727c4cddf005cbeb70bda9f34d3c4dcb7d3412cbd0e9c7b98c662c0bdac0"
         }
       ]
     }
@@ -19,9 +19,9 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/aho-corasick@1.1.4",
+      "bom-ref": "pkg:cargo/aho-corasick@1.1.5",
       "name": "aho-corasick",
-      "version": "1.1.4",
+      "version": "1.1.5",
       "externalReferences": [
         {
           "type": "distribution",
@@ -955,7 +955,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:cargo/aho-corasick@1.1.4",
+      "ref": "pkg:cargo/aho-corasick@1.1.5",
       "dependsOn": [
         "pkg:cargo/memchr@2.8.3"
       ]
@@ -1048,7 +1048,7 @@
     {
       "ref": "pkg:cargo/globset@0.4.19",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/regex-automata@0.4.16",
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@4.14.1",
+      "ref": "pkg:cargo/planu-core@5.0.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1153,7 +1153,7 @@
     {
       "ref": "pkg:cargo/regex-automata@0.4.16",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
@@ -1165,7 +1165,7 @@
     {
       "ref": "pkg:cargo/regex@1.12.3",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/regex-automata@0.4.16",
         "pkg:cargo/regex-syntax@0.8.11"

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "4.14.1",
-  "engineVersion": "4.14.1",
-  "buildId": "1-4.14.1-x86_64-apple-darwin",
+  "cliVersion": "5.0.0",
+  "engineVersion": "5.0.0",
+  "buildId": "1-5.0.0-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "2e14070f47213e77ececc8356d5ab4958e4a112fb111d435a7e4a863798652ee",
+  "artifactSha256": "2a60a40be81b9ca7cd5361b7e09b1c3987859c7d5a6b99ced609b53e761b4893",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "95fa5c13261a93392b7282618d176f6eabf25f99e0040093bab9f24143ebcd5b"
+    "sha256": "d39947f0c747ec5ec03ed9565e1b9ef1115b3f1766262d89353b84bfbcd52e70"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "6f1f1f95b8f68ae5e9987ef924987e1e9112b27a",
+    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "MZBcitfBBFES/26bEys2oh3kjw1tIvhmqEyFi9NIrtbLZ2gYVd65+mOrMr5cHxy3tRPY4iSC5taCm1mN4yovAw=="
+    "value": "3o+oKVFgk4jbJLsRmVmxRUgQpZa9Tl+UHSob7J8swJGZo13M1Gsx+fombBfmhZXNnfeehp4aiEnRiQQ2FIWLAg=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@4.14.1",
+      "bom-ref": "pkg:cargo/planu-core@5.0.0",
       "type": "library",
       "name": "planu-core",
-      "version": "4.14.1",
+      "version": "5.0.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2e14070f47213e77ececc8356d5ab4958e4a112fb111d435a7e4a863798652ee"
+          "content": "2a60a40be81b9ca7cd5361b7e09b1c3987859c7d5a6b99ced609b53e761b4893"
         }
       ]
     }
@@ -19,9 +19,9 @@
   "components": [
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/aho-corasick@1.1.4",
+      "bom-ref": "pkg:cargo/aho-corasick@1.1.5",
       "name": "aho-corasick",
-      "version": "1.1.4",
+      "version": "1.1.5",
       "externalReferences": [
         {
           "type": "distribution",
@@ -955,7 +955,7 @@
   ],
   "dependencies": [
     {
-      "ref": "pkg:cargo/aho-corasick@1.1.4",
+      "ref": "pkg:cargo/aho-corasick@1.1.5",
       "dependsOn": [
         "pkg:cargo/memchr@2.8.3"
       ]
@@ -1048,7 +1048,7 @@
     {
       "ref": "pkg:cargo/globset@0.4.19",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/regex-automata@0.4.16",
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@4.14.1",
+      "ref": "pkg:cargo/planu-core@5.0.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1153,7 +1153,7 @@
     {
       "ref": "pkg:cargo/regex-automata@0.4.16",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
@@ -1165,7 +1165,7 @@
     {
       "ref": "pkg:cargo/regex@1.12.3",
       "dependsOn": [
-        "pkg:cargo/aho-corasick@1.1.4",
+        "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
         "pkg:cargo/regex-automata@0.4.16",
         "pkg:cargo/regex-syntax@0.8.11"

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "4.14.1",
-  "engineVersion": "4.14.1",
-  "buildId": "1-4.14.1-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.0.0",
+  "engineVersion": "5.0.0",
+  "buildId": "1-5.0.0-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "7b2674568f17b8f6028f9c818fb27120e2fc8af019cceb1cddc28ff000464b33",
+  "artifactSha256": "580ec92f1fb034b280b35c2d394b4d18c7803fae7d03b874ba9a1c64ee869721",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "87ec5a6e82cc40ad7d1099a094001e957439136c3db225d54dbb26c38a0f9be3"
+    "sha256": "2ac8dbb0048589ade03208731db1dbe1e16cc32190edbeea49dd06b253e921e3"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "6f1f1f95b8f68ae5e9987ef924987e1e9112b27a",
+    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "9oo9TAoyxROAwZulw5JAxc4dwiVkgbkjIG2UG0rIGOZqghdgD3GnYRwPAho18dg/y1cGnH74pnTNWrPibaJGBw=="
+    "value": "Y+W+JFj6bDKCI18mpVqp6oceV6zaNjLbp9LCnLIt08pt/JynFvui7ZJC1Epd+rxd28swAFZQlSeJC7wTyh02Dg=="
   }
 }