@planu/cli 5.0.0 → 5.2.0

package/dist/engine/minimality/policy-loader.js

@@ -1,9 +1,239 @@
-import { readFile } from 'node:fs/promises';
-import { dirname, join } from 'node:path';
+import { constants } from 'node:fs';
+import { lstat, open, readFile, realpath } from 'node:fs/promises';
+import { dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
 import { fileURLToPath } from 'node:url';
+const BUNDLED_POLICY_ID = 'bundled:minimal-implementation-gate';
+const PROJECT_CONFIG_ID = 'project:planu.json#minimalImplementationGate';
+const REDACTED_POLICY_MESSAGE = 'Minimality policy source is unavailable (external:redacted).';
+const REDACTED_BUNDLED_MESSAGE = 'Bundled minimality policy is unavailable (external:redacted).';
+const MAX_POLICY_BYTES = 1024 * 1024;
+const POLICY_READ_CHUNK_BYTES = 64 * 1024;
+class PolicySourceError extends Error {
+    code;
+    constructor(code) {
+        super(code === 'MINIMALITY_BUNDLED_POLICY_UNAVAILABLE'
+            ? REDACTED_BUNDLED_MESSAGE
+            : REDACTED_POLICY_MESSAGE);
+        this.name = 'PolicySourceError';
+        this.code = code;
+    }
+}
 function configPath() {
     return join(dirname(fileURLToPath(import.meta.url)), '../../config/minimal-implementation-gate.json');
 }
+function isOutside(root, candidate) {
+    const pathFromRoot = relative(root, candidate);
+    return pathFromRoot === '..' || pathFromRoot.startsWith(`..${sep}`) || isAbsolute(pathFromRoot);
+}
+function nodeErrorCode(error) {
+    return typeof error === 'object' && error !== null && 'code' in error
+        ? String(error.code)
+        : undefined;
+}
+function sourceErrorFor(error) {
+    if (error instanceof PolicySourceError) {
+        return error;
+    }
+    switch (nodeErrorCode(error)) {
+        case 'ENOENT':
+        case 'ENOTDIR':
+            return new PolicySourceError('MINIMALITY_POLICY_SOURCE_NOT_FOUND');
+        case 'ELOOP':
+            return new PolicySourceError('MINIMALITY_POLICY_SOURCE_SYMLINK_REJECTED');
+        case 'EISDIR':
+            return new PolicySourceError('MINIMALITY_POLICY_SOURCE_NOT_REGULAR');
+        case undefined:
+        default:
+            return new PolicySourceError('MINIMALITY_POLICY_SOURCE_UNREADABLE');
+    }
+}
+function sameIdentity(left, right) {
+    return left.dev === right.dev && left.ino === right.ino;
+}
+function sameStableMetadata(left, right) {
+    return (sameIdentity(left, right) &&
+        left.size === right.size &&
+        left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs);
+}
+async function assertNoSymlinkComponents(projectRoot, candidate) {
+    const relativePath = relative(projectRoot, candidate);
+    let current = projectRoot;
+    for (const component of relativePath.split(sep).filter(Boolean)) {
+        current = join(current, component);
+        let status;
+        try {
+            status = await lstat(current);
+        }
+        catch (error) {
+            throw sourceErrorFor(error);
+        }
+        if (status.isSymbolicLink()) {
+            throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_SYMLINK_REJECTED');
+        }
+    }
+}
+function validateExplicitPath(path) {
+    if (path.length === 0 ||
+        path.length > 4096 ||
+        /^project:/iu.test(path) ||
+        path.includes('\0') ||
+        path.includes('?') ||
+        path.includes('#') ||
+        (sep === '/' && path.includes('\\'))) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_INVALID_PATH');
+    }
+}
+async function readBoundedPolicy(handle) {
+    const chunks = [];
+    let offset = 0;
+    while (offset <= MAX_POLICY_BYTES) {
+        const remaining = MAX_POLICY_BYTES + 1 - offset;
+        const chunk = Buffer.allocUnsafe(Math.min(POLICY_READ_CHUNK_BYTES, remaining));
+        const { bytesRead } = await handle.read(chunk, 0, chunk.length, offset);
+        if (bytesRead === 0) {
+            break;
+        }
+        offset += bytesRead;
+        if (offset > MAX_POLICY_BYTES) {
+            throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_UNREADABLE');
+        }
+        chunks.push(chunk.subarray(0, bytesRead));
+    }
+    return Buffer.concat(chunks, offset).toString('utf8');
+}
+async function resolvePolicySource(projectPath, explicitPath) {
+    if (explicitPath === undefined) {
+        return { path: configPath(), identifier: BUNDLED_POLICY_ID, bundled: true };
+    }
+    validateExplicitPath(explicitPath);
+    if (projectPath === undefined) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_OUTSIDE_ALLOWED_ROOT');
+    }
+    const lexicalRoot = resolve(projectPath);
+    const candidate = isAbsolute(explicitPath)
+        ? resolve(explicitPath)
+        : resolve(lexicalRoot, explicitPath);
+    if (isOutside(lexicalRoot, candidate)) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_OUTSIDE_ALLOWED_ROOT');
+    }
+    let canonicalRoot;
+    try {
+        canonicalRoot = await realpath(lexicalRoot);
+    }
+    catch {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_OUTSIDE_ALLOWED_ROOT');
+    }
+    await assertNoSymlinkComponents(lexicalRoot, candidate);
+    let candidateStatus;
+    let canonicalCandidate;
+    try {
+        [candidateStatus, canonicalCandidate] = await Promise.all([
+            lstat(candidate),
+            realpath(candidate),
+        ]);
+    }
+    catch (error) {
+        throw sourceErrorFor(error);
+    }
+    if (candidateStatus.isSymbolicLink()) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_SYMLINK_REJECTED');
+    }
+    if (!candidateStatus.isFile()) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_NOT_REGULAR');
+    }
+    if (isOutside(canonicalRoot, canonicalCandidate)) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_OUTSIDE_ALLOWED_ROOT');
+    }
+    const portablePath = relative(canonicalRoot, canonicalCandidate)
+        .replaceAll('\\', '/')
+        .normalize('NFC');
+    if (portablePath.length === 0 ||
+        portablePath.startsWith('../') ||
+        portablePath.startsWith('project:') ||
+        /^[a-z]:/iu.test(portablePath) ||
+        isAbsolute(portablePath)) {
+        throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_INVALID_PATH');
+    }
+    return {
+        path: candidate,
+        identifier: `project:${portablePath}`,
+        bundled: false,
+        projectRoot: lexicalRoot,
+    };
+}
+async function readStableJson(source) {
+    try {
+        if (source.projectRoot !== undefined) {
+            await assertNoSymlinkComponents(source.projectRoot, source.path);
+        }
+        const canonicalBefore = await realpath(source.path);
+        const pathBefore = await lstat(source.path, { bigint: true });
+        if (pathBefore.isSymbolicLink()) {
+            throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_SYMLINK_REJECTED');
+        }
+        if (!pathBefore.isFile()) {
+            throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_NOT_REGULAR');
+        }
+        let handle;
+        try {
+            handle = await open(source.path, constants.O_RDONLY | constants.O_NOFOLLOW);
+        }
+        catch (error) {
+            if (nodeErrorCode(error) === 'ELOOP') {
+                throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_CHANGED');
+            }
+            throw error;
+        }
+        try {
+            const handleBefore = await handle.stat({ bigint: true });
+            if (!handleBefore.isFile() || !sameIdentity(pathBefore, handleBefore)) {
+                throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_CHANGED');
+            }
+            if (handleBefore.size > BigInt(MAX_POLICY_BYTES)) {
+                throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_UNREADABLE');
+            }
+            const content = await readBoundedPolicy(handle);
+            let handleAfter;
+            let pathAfter;
+            let canonicalAfter;
+            try {
+                [handleAfter, pathAfter, canonicalAfter] = await Promise.all([
+                    handle.stat({ bigint: true }),
+                    lstat(source.path, { bigint: true }),
+                    realpath(source.path),
+                ]);
+            }
+            catch {
+                throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_CHANGED');
+            }
+            if (canonicalBefore !== canonicalAfter ||
+                !sameStableMetadata(pathBefore, pathAfter) ||
+                !sameStableMetadata(handleBefore, handleAfter) ||
+                !sameIdentity(pathAfter, handleAfter)) {
+                throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_CHANGED');
+            }
+            if (source.projectRoot !== undefined) {
+                try {
+                    await assertNoSymlinkComponents(source.projectRoot, source.path);
+                }
+                catch {
+                    throw new PolicySourceError('MINIMALITY_POLICY_SOURCE_CHANGED');
+                }
+            }
+            return JSON.parse(content);
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch (error) {
+        if (source.bundled) {
+            throw new PolicySourceError('MINIMALITY_BUNDLED_POLICY_UNAVAILABLE');
+        }
+        throw sourceErrorFor(error);
+    }
+}
 function isRecord(value) {
     return typeof value === 'object' && value !== null && !Array.isArray(value);
 }
@@ -109,10 +339,21 @@ async function readJson(path) {
     return JSON.parse(await readFile(path, 'utf-8'));
 }
 export async function loadMinimalImplementationPolicy(projectPath, options = {}) {
-    const defaultPolicyPath = options.defaultPolicyPath ?? configPath();
-    const defaultPolicy = validatePolicy(await readJson(defaultPolicyPath));
+    const source = await resolvePolicySource(projectPath, options.defaultPolicyPath);
+    let defaultPolicy;
+    try {
+        defaultPolicy = validatePolicy(await readStableJson(source));
+    }
+    catch (error) {
+        if (error instanceof PolicySourceError) {
+            throw error;
+        }
+        throw source.bundled
+            ? new PolicySourceError('MINIMALITY_BUNDLED_POLICY_UNAVAILABLE')
+            : new PolicySourceError('MINIMALITY_POLICY_SOURCE_UNREADABLE');
+    }
     const evidence = [
-        { source: 'policy', key: defaultPolicyPath },
+        { source: 'policy', key: source.identifier },
     ];
     let merged = defaultPolicy;
     if (projectPath !== undefined) {
@@ -121,7 +362,7 @@ export async function loadMinimalImplementationPolicy(projectPath, options = {})
             const config = await readJson(planuConfigPath);
             if (isRecord(config) && isRecord(config.minimalImplementationGate)) {
                 merged = validatePolicy(mergeDeep(defaultPolicy, config.minimalImplementationGate));
-                evidence.push({ source: 'project-config', key: 'planu.json.minimalImplementationGate' });
+                evidence.push({ source: 'project-config', key: PROJECT_CONFIG_ID });
             }
         }
         catch {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.0.0",
-  "engineVersion": "5.0.0",
-  "buildId": "1-5.0.0-aarch64-apple-darwin",
+  "cliVersion": "5.2.0",
+  "engineVersion": "5.2.0",
+  "buildId": "1-5.2.0-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "d276727c4cddf005cbeb70bda9f34d3c4dcb7d3412cbd0e9c7b98c662c0bdac0",
+  "artifactSha256": "d651b32dc2ec3d58adc720400cab3cfd0114388d2697c861038b913cda3ad711",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "3716a15b7f30bb64bf0c741dbc9c1042fb0bc66a35ebbcb54fda80b88bf0190f"
+    "sha256": "28c7421f2ee232830c3150449c51d89a494e2a4841a39af4348dcaaccb27f6cc"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
+    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "I9bHVmPRkBD2GdyS/HGW3zPavsTvN2DgBmAfBNhTcryNe6N25vyb4D/dIfw5BtZZ/pL0R1tbfolQKI1zvqlqBg=="
+    "value": "9R5L33t90yHh/8SXCNpjSRbCoIJ8wooiMtvkHpCKr1ByDK13NiUuH3v0uLiquqXbf4r6mMe5K4bWQ63nm/XQBg=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.0.0",
+      "bom-ref": "pkg:cargo/planu-core@5.2.0",
       "type": "library",
       "name": "planu-core",
-      "version": "5.0.0",
+      "version": "5.2.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d276727c4cddf005cbeb70bda9f34d3c4dcb7d3412cbd0e9c7b98c662c0bdac0"
+          "content": "d651b32dc2ec3d58adc720400cab3cfd0114388d2697c861038b913cda3ad711"
         }
       ]
     }
@@ -291,9 +291,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/globset@0.4.19",
+      "bom-ref": "pkg:cargo/globset@0.4.20",
       "name": "globset",
-      "version": "0.4.19",
+      "version": "0.4.20",
       "externalReferences": [
         {
           "type": "distribution",
@@ -529,9 +529,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/regex-automata@0.4.16",
+      "bom-ref": "pkg:cargo/regex-automata@0.4.18",
       "name": "regex-automata",
-      "version": "0.4.16",
+      "version": "0.4.18",
       "externalReferences": [
         {
           "type": "distribution",
@@ -1046,12 +1046,12 @@
       ]
     },
     {
-      "ref": "pkg:cargo/globset@0.4.19",
+      "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },
@@ -1069,10 +1069,10 @@
       "ref": "pkg:cargo/ignore@0.4.25",
       "dependsOn": [
         "pkg:cargo/crossbeam-deque@0.8.7",
-        "pkg:cargo/globset@0.4.19",
+        "pkg:cargo/globset@0.4.20",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/same-file@1.0.6",
         "pkg:cargo/walkdir@2.5.0",
         "pkg:cargo/winapi-util@0.1.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.0.0",
+      "ref": "pkg:cargo/planu-core@5.2.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1151,7 +1151,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/regex-automata@0.4.16",
+      "ref": "pkg:cargo/regex-automata@0.4.18",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
@@ -1167,7 +1167,7 @@
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.0.0",
-  "engineVersion": "5.0.0",
-  "buildId": "1-5.0.0-x86_64-apple-darwin",
+  "cliVersion": "5.2.0",
+  "engineVersion": "5.2.0",
+  "buildId": "1-5.2.0-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "2a60a40be81b9ca7cd5361b7e09b1c3987859c7d5a6b99ced609b53e761b4893",
+  "artifactSha256": "931a0f6bc94744521f33e6ac46fb7293fe49b14d225d76446e27dd7117f12ad9",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "d39947f0c747ec5ec03ed9565e1b9ef1115b3f1766262d89353b84bfbcd52e70"
+    "sha256": "ec531e41f6e0ef14b7fb2727370f817b761d28ae510c93790555796f5e2fac19"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
+    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "3o+oKVFgk4jbJLsRmVmxRUgQpZa9Tl+UHSob7J8swJGZo13M1Gsx+fombBfmhZXNnfeehp4aiEnRiQQ2FIWLAg=="
+    "value": "mgppJ+aunLo8AOPqEdBnmAXfDYzWQzdmehp7AASRUk8Wyk9/mQm9A22K5T5NiUN3flTqQCLPT6ZN2L9eWp5VCw=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.0.0",
+      "bom-ref": "pkg:cargo/planu-core@5.2.0",
       "type": "library",
       "name": "planu-core",
-      "version": "5.0.0",
+      "version": "5.2.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2a60a40be81b9ca7cd5361b7e09b1c3987859c7d5a6b99ced609b53e761b4893"
+          "content": "931a0f6bc94744521f33e6ac46fb7293fe49b14d225d76446e27dd7117f12ad9"
         }
       ]
     }
@@ -291,9 +291,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/globset@0.4.19",
+      "bom-ref": "pkg:cargo/globset@0.4.20",
       "name": "globset",
-      "version": "0.4.19",
+      "version": "0.4.20",
       "externalReferences": [
         {
           "type": "distribution",
@@ -529,9 +529,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/regex-automata@0.4.16",
+      "bom-ref": "pkg:cargo/regex-automata@0.4.18",
       "name": "regex-automata",
-      "version": "0.4.16",
+      "version": "0.4.18",
       "externalReferences": [
         {
           "type": "distribution",
@@ -1046,12 +1046,12 @@
       ]
     },
     {
-      "ref": "pkg:cargo/globset@0.4.19",
+      "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },
@@ -1069,10 +1069,10 @@
       "ref": "pkg:cargo/ignore@0.4.25",
       "dependsOn": [
         "pkg:cargo/crossbeam-deque@0.8.7",
-        "pkg:cargo/globset@0.4.19",
+        "pkg:cargo/globset@0.4.20",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/same-file@1.0.6",
         "pkg:cargo/walkdir@2.5.0",
         "pkg:cargo/winapi-util@0.1.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.0.0",
+      "ref": "pkg:cargo/planu-core@5.2.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1151,7 +1151,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/regex-automata@0.4.16",
+      "ref": "pkg:cargo/regex-automata@0.4.18",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
@@ -1167,7 +1167,7 @@
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.0.0",
-  "engineVersion": "5.0.0",
-  "buildId": "1-5.0.0-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.2.0",
+  "engineVersion": "5.2.0",
+  "buildId": "1-5.2.0-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "580ec92f1fb034b280b35c2d394b4d18c7803fae7d03b874ba9a1c64ee869721",
+  "artifactSha256": "9cb0106828b7045ee7c4c4f70fbbcaabc67f09f1a3466a034b171c4e326cce4c",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "2ac8dbb0048589ade03208731db1dbe1e16cc32190edbeea49dd06b253e921e3"
+    "sha256": "2204168dd49b9d8b05854175868efb7a38a00af37081451c273b8c5a4d34dc99"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "b0d7149aa13f1e9d4aebd7df741cf38d5726f376",
+    "sourceCommit": "121065e63e9fd2c067367e286ecba619ecc3f18a",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "Y+W+JFj6bDKCI18mpVqp6oceV6zaNjLbp9LCnLIt08pt/JynFvui7ZJC1Epd+rxd28swAFZQlSeJC7wTyh02Dg=="
+    "value": "sW/k0JsHybFw0odijKvzrpwNrYV9u58gCSE+IUdh6AAd810hXnmnmnnH4YugGOVhW8nLQyRhdEuimwwv5yn7Aw=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.0.0",
+      "bom-ref": "pkg:cargo/planu-core@5.2.0",
       "type": "library",
       "name": "planu-core",
-      "version": "5.0.0",
+      "version": "5.2.0",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "580ec92f1fb034b280b35c2d394b4d18c7803fae7d03b874ba9a1c64ee869721"
+          "content": "9cb0106828b7045ee7c4c4f70fbbcaabc67f09f1a3466a034b171c4e326cce4c"
         }
       ]
     }
@@ -291,9 +291,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/globset@0.4.19",
+      "bom-ref": "pkg:cargo/globset@0.4.20",
       "name": "globset",
-      "version": "0.4.19",
+      "version": "0.4.20",
       "externalReferences": [
         {
           "type": "distribution",
@@ -529,9 +529,9 @@
     },
     {
       "type": "library",
-      "bom-ref": "pkg:cargo/regex-automata@0.4.16",
+      "bom-ref": "pkg:cargo/regex-automata@0.4.18",
       "name": "regex-automata",
-      "version": "0.4.16",
+      "version": "0.4.18",
       "externalReferences": [
         {
           "type": "distribution",
@@ -1046,12 +1046,12 @@
       ]
     },
     {
-      "ref": "pkg:cargo/globset@0.4.19",
+      "ref": "pkg:cargo/globset@0.4.20",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/bstr@1.13.0",
         "pkg:cargo/log@0.4.33",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },
@@ -1069,10 +1069,10 @@
       "ref": "pkg:cargo/ignore@0.4.25",
       "dependsOn": [
         "pkg:cargo/crossbeam-deque@0.8.7",
-        "pkg:cargo/globset@0.4.19",
+        "pkg:cargo/globset@0.4.20",
         "pkg:cargo/log@0.4.33",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/same-file@1.0.6",
         "pkg:cargo/walkdir@2.5.0",
         "pkg:cargo/winapi-util@0.1.11"
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.0.0",
+      "ref": "pkg:cargo/planu-core@5.2.0",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",
@@ -1151,7 +1151,7 @@
       ]
     },
     {
-      "ref": "pkg:cargo/regex-automata@0.4.16",
+      "ref": "pkg:cargo/regex-automata@0.4.18",
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
@@ -1167,7 +1167,7 @@
       "dependsOn": [
         "pkg:cargo/aho-corasick@1.1.5",
         "pkg:cargo/memchr@2.8.3",
-        "pkg:cargo/regex-automata@0.4.16",
+        "pkg:cargo/regex-automata@0.4.18",
         "pkg:cargo/regex-syntax@0.8.11"
       ]
     },