@planu/cli 5.3.1 → 5.3.3

package/CHANGELOG.md

@@ -1,3 +1,35 @@
+## [5.3.3] - 2026-08-06
+
+### Bug Fixes
+- fix(release): tolerate empty ff-behind mirror list under set -u
+- fix(outbox): return a typed failure from delivery attempts for the reliability gate
+- fix(git): close SPEC-1396 debate findings and record review evidence
+- fix(git): never move the shared checkout from automatic paths (SPEC-1396)
+- fix(outbox): address SPEC-1271 debate review findings
+- fix(outbox): bounded fair durable spec.created recovery without blocking startup (SPEC-1271)
+
+### Chores
+- chore(planu): file SPEC-1396 git-safety dogfood bug
+- chore(planu): session checkpoint after SPEC-1271 cycle
+- chore(planu): SPEC-1271 done with debate evidence, file SPEC-1395
+- chore(planu): SPEC-1271 implementing with structured work plan, file SPEC-1394
+
+
+## [5.3.2] - 2026-08-06
+
+### Bug Fixes
+- fix(tools): restore declared bump_spec_version runtime tool (SPEC-1254)
+- fix(handoff): address SPEC-1255 debate review findings
+- fix(handoff): allow test-only specs to produce unblocked handoffs (SPEC-1255)
+
+### Chores
+- chore(planu): redact local paths from SPEC-1392 reproducer
+- chore(planu): SPEC-1254 and SPEC-1255 done with debate-review evidence
+- chore(planu): session checkpoint for debate-protocol batch
+- chore(planu): approve SPEC-1254/1255/1271, file SPEC-1386..1391, add debate-review rule
+- chore(planu): approve SPEC-1206 and SPEC-1250 with reviewer evidence, SPEC-1240 rework feedback
+
+
 ## [5.3.1] - 2026-08-05
 
 ### Bug Fixes

package/README.md

@@ -21,7 +21,7 @@ Planu is a Spec Driven Development stack for AI coding agents: an MCP server and
 - **Local change detection** — observes project changes without requiring a hosted configuration service.
 - **Unified Spec Format** — Requirements and technical details in a single, context-efficient `spec.md`.
 - **Atomic Integrity** — Indestructible writes and **Freeze-on-done** immutability (P0).
-- **28 official MCP tools** for the public SDD surface, with advanced workflows kept in skills, CLI commands, and internal pipelines.
+- **29 official MCP tools** for the public SDD surface, with advanced workflows kept in skills, CLI commands, and internal pipelines.
 - **Multi-agent compatible** — Optimized for Claude Code, Cursor, Windsurf, and Gemini CLI.
 
 ---

package/dist/config/official-sdd-tools.d.ts

@@ -1,4 +1,4 @@
 /** Single editable authority for the official local SDD tool surface. */
-export declare const OFFICIAL_SDD_TOOL_NAMES: readonly ['planu_status', 'session_checkpoint', 'facilitate', 'init_project', 'clarify_requirements', 'create_spec', 'list_specs', 'challenge_spec', 'check_readiness', 'update_status', 'update_status_batch', 'package_handoff', 'validate', 'get_job', 'watch_job', 'cancel_job', 'restart_job', 'reconcile_spec', 'create_rule', 'create_skill', 'skill_search', 'configure_code_graph', 'code_graph_status', 'submit_feedback', 'triage_feedback', 'resolve_feedback', 'sync_feedback', 'feedback_status'];
+export declare const OFFICIAL_SDD_TOOL_NAMES: readonly ['planu_status', 'session_checkpoint', 'facilitate', 'init_project', 'clarify_requirements', 'create_spec', 'list_specs', 'challenge_spec', 'check_readiness', 'update_status', 'update_status_batch', 'package_handoff', 'validate', 'get_job', 'watch_job', 'cancel_job', 'restart_job', 'reconcile_spec', 'create_rule', 'create_skill', 'skill_search', 'configure_code_graph', 'code_graph_status', 'submit_feedback', 'triage_feedback', 'resolve_feedback', 'sync_feedback', 'feedback_status', 'bump_spec_version'];
 export declare function readCanonicalToolNames(): string[];
 //# sourceMappingURL=official-sdd-tools.d.ts.map

package/dist/config/official-sdd-tools.js

@@ -28,6 +28,7 @@ export const OFFICIAL_SDD_TOOL_NAMES = [
     'resolve_feedback',
     'sync_feedback',
     'feedback_status',
+    'bump_spec_version',
 ];
 export function readCanonicalToolNames() {
     return [...OFFICIAL_SDD_TOOL_NAMES];

package/dist/config/registries/hosts/codex.json

@@ -30,7 +30,8 @@
     "triage_feedback",
     "resolve_feedback",
     "sync_feedback",
-    "feedback_status"
+    "feedback_status",
+    "bump_spec_version"
   ],
   "unsupportedTools": ["challenge_spec", "red_team"],
   "restrictedTools": {

package/dist/config/runtime-policy.json

@@ -51,5 +51,14 @@
     "leaseMultiplier": 3,
     "maximumRememberedTransitions": 1000,
     "minimumHeartbeatMs": 1000
+  },
+  "outbox": {
+    "sliceRecordBudget": 25,
+    "sliceTimeBudgetMs": 5000,
+    "backoffBaseMs": 30000,
+    "backoffCapMs": 1800000,
+    "maxAttempts": 3,
+    "diagnosticMaxLength": 500,
+    "continuationDelayMs": 250
   }
 }

package/dist/engine/autopilot/complete-loop.js

@@ -47,7 +47,10 @@ async function runWithProgress(projectPath, projectId, specId, action, fn) {
  */
 async function doAutoCreateBranch(projectId, specId) {
     const { handleCreateBranch } = await import('../../tools/git/branch-ops.js');
-    const result = await handleCreateBranch(projectId, specId);
+    // SPEC-1396: cascade side effect — create the ref, never move the shared checkout.
+    const result = await handleCreateBranch(projectId, specId, undefined, undefined, {
+        mutateCheckout: false,
+    });
     if (result.isError === true) {
         /* v8 ignore next */
         const msg = result.content[0]?.type === 'text' ? result.content[0].text : 'branch creation failed';

package/dist/engine/execution/outbox-worker.d.ts

@@ -18,12 +18,20 @@ export declare class TransactionalOutboxWorker {
         readonly clock?: () => Date;
         readonly limit?: number;
         readonly topics?: readonly string[];
+        readonly timeBudgetMs?: number;
     }): Promise<{
         readonly delivered: number;
+        readonly failed: number;
         readonly skipped: number;
+        readonly ineligible: number;
+        /** True when no eligible pending record remains in this scope right now. */
+        readonly exhausted: boolean;
     }>;
+    private attemptDelivery;
     private claim;
     private fail;
+    /** Deterministic exponential backoff with a validated cap; no random jitter. */
+    private computeNextAttemptAt;
     private complete;
     private deliveryKey;
     private fenceKey;

package/dist/engine/execution/outbox-worker.js

@@ -1,20 +1,32 @@
 import { createHash } from 'node:crypto';
 import { BoundaryFailure } from '../../errors/error-taxonomy.js';
+import { getRuntimePolicy } from '../runtime-policy.js';
 function parseFence(value) {
     if (!value || typeof value !== 'object') {
         return undefined;
     }
     const fence = value;
+    const nextAttemptAtValid = fence.nextAttemptAt === undefined ||
+        (typeof fence.nextAttemptAt === 'string' && Number.isFinite(Date.parse(fence.nextAttemptAt)));
     if (fence.schemaVersion !== 1 ||
         typeof fence.workerId !== 'string' ||
         !Number.isSafeInteger(fence.fencingToken) ||
         typeof fence.leaseExpiresAt !== 'string' ||
         typeof fence.state !== 'string' ||
-        !['leased', 'failed', 'dead-letter', 'delivered'].includes(fence.state)) {
+        !['leased', 'failed', 'dead-letter', 'delivered'].includes(fence.state) ||
+        !nextAttemptAtValid) {
         throw new BoundaryFailure('Corrupt', 'outbox fence read', 'Quarantine the invalid fence record before retrying delivery.');
     }
     return fence;
 }
+/**
+ * Upper bound on how many rows a single internal page fetch may request while
+ * paging past ineligible head records (foreign lease, delivered self-heal) that
+ * consume no record budget. 1000 is the existing hard ceiling `listOutbox`
+ * already enforces, so this reuses that ceiling rather than introducing a new
+ * tunable.
+ */
+const OUTBOX_PAGE_FETCH_LIMIT = 1_000;
 /**
  * Durable outbox dispatcher. The sink must deduplicate `deliveryKey`; this stable key closes the
  * unavoidable crash window between an external acknowledgement and the local delivered marker.
@@ -26,7 +38,7 @@ export class TransactionalOutboxWorker {
     workerId;
     leaseMs;
     maxAttempts;
-    constructor(database, projectId, workspaceId, workerId, leaseMs = 30_000, maxAttempts = 3) {
+    constructor(database, projectId, workspaceId, workerId, leaseMs = 30_000, maxAttempts = getRuntimePolicy().outbox.maxAttempts) {
         this.database = database;
         this.projectId = projectId;
         this.workspaceId = workspaceId;
@@ -46,38 +58,83 @@ export class TransactionalOutboxWorker {
     async drain(deliver, options = {}) {
         const clock = options.clock ?? (() => new Date());
         const now = currentIso(clock, options.now);
+        const policy = getRuntimePolicy().outbox;
+        const timeBudgetMs = options.timeBudgetMs ?? policy.sliceTimeBudgetMs;
+        const startedAtMs = clock().getTime();
+        let recordBudget = options.limit ?? policy.sliceRecordBudget;
         let delivered = 0;
-        let skipped = 0;
-        const pending = this.database.listOutbox(this.projectId, this.workspaceId, {
-            pendingOnly: true,
-            limit: options.limit,
-            topics: options.topics,
-        });
-        for (const message of pending) {
-            const fence = this.claim(message, now);
-            if (!fence) {
-                skipped += 1;
-                continue;
-            }
-            try {
-                await deliver({
-                    deliveryKey: this.deliveryKey(message),
-                    fencingToken: fence.fencingToken,
-                    topic: message.topic,
-                    payload: message.payload,
-                });
-            }
-            catch {
-                const failure = new BoundaryFailure('DependencyUnavailable', 'outbox delivery', 'Retry with the stable delivery key after the dependency recovers.');
-                this.fail(message, fence, failure, currentIso(clock, options.now));
-                throw failure;
+        let failed = 0;
+        let ineligible = 0;
+        let cursorId = 0;
+        let timedOut = false;
+        while (recordBudget > 0 && !timedOut) {
+            const batch = this.database.listOutbox(this.projectId, this.workspaceId, {
+                pendingOnly: true,
+                limit: OUTBOX_PAGE_FETCH_LIMIT,
+                topics: options.topics,
+                eligibleAt: now,
+                afterId: cursorId,
+            });
+            if (batch.length === 0) {
+                break;
             }
-            if (!this.complete(message, fence, currentIso(clock, options.now))) {
-                throw new BoundaryFailure('Conflict', 'outbox delivery commit', 'Another worker owns the lease; retry with the stable delivery key.');
+            for (const message of batch) {
+                // Admission check between deliveries: never aborts an in-flight delivery.
+                if (clock().getTime() - startedAtMs > timeBudgetMs) {
+                    timedOut = true;
+                    break;
+                }
+                cursorId = message.id;
+                const fence = this.claim(message, now);
+                if (!fence) {
+                    // Ineligible for a reason SQL cannot pre-filter (foreign unexpired lease,
+                    // self-healed delivered fence): consumes no record budget and does not
+                    // stop the worker from advancing to the next record in this same call.
+                    ineligible += 1;
+                    continue;
+                }
+                recordBudget -= 1;
+                const outcome = await this.attemptDelivery(message, fence, deliver, clock, options.now);
+                if (outcome.status === 'failed') {
+                    // Isolate the failure: continue offering remaining eligible records
+                    // instead of aborting the whole slice.
+                    failed += 1;
+                }
+                else {
+                    delivered += 1;
+                }
+                if (recordBudget === 0) {
+                    break;
+                }
             }
-            delivered += 1;
         }
-        return { delivered, skipped };
+        // Exact count of eligible work left unattempted (budget or time cutoff), not
+        // an estimate — this is what a further slice would find eligible right now.
+        const skipped = this.database.countEligibleOutbox(this.projectId, this.workspaceId, {
+            topics: options.topics,
+            eligibleAt: now,
+            afterId: cursorId,
+        });
+        return { delivered, failed, skipped, ineligible, exhausted: skipped === 0 };
+    }
+    async attemptDelivery(message, fence, deliver, clock, now) {
+        try {
+            await deliver({
+                deliveryKey: this.deliveryKey(message),
+                fencingToken: fence.fencingToken,
+                topic: message.topic,
+                payload: message.payload,
+            });
+        }
+        catch {
+            const failure = new BoundaryFailure('DependencyUnavailable', 'outbox delivery', 'Retry with the stable delivery key after the dependency recovers.');
+            this.fail(message, fence, failure, currentIso(clock, now));
+            return { status: 'failed' };
+        }
+        if (!this.complete(message, fence, currentIso(clock, now))) {
+            throw new BoundaryFailure('Conflict', 'outbox delivery commit', 'Another worker owns the lease; retry with the stable delivery key.');
+        }
+        return { status: 'delivered' };
     }
     claim(message, now) {
         return this.database.transaction(() => {
@@ -93,6 +150,12 @@ export class TransactionalOutboxWorker {
             if (existing?.state === 'leased' && existing.leaseExpiresAt > now) {
                 return undefined;
             }
+            if (existing?.state === 'failed' &&
+                existing.nextAttemptAt !== undefined &&
+                existing.nextAttemptAt > now) {
+                // Durable retry deadline not yet reached: not eligible, attempts unchanged.
+                return undefined;
+            }
             const fence = {
                 schemaVersion: 1,
                 workerId: this.workerId,
@@ -126,6 +189,7 @@ export class TransactionalOutboxWorker {
                 return false;
             }
             const attempts = current.attempts ?? 1;
+            const deadLettered = attempts >= this.maxAttempts;
             this.database.putRecord({
                 projectId: this.projectId,
                 workspaceId: this.workspaceId,
@@ -133,8 +197,9 @@ export class TransactionalOutboxWorker {
                 key,
                 value: {
                     ...current,
-                    state: attempts >= this.maxAttempts ? 'dead-letter' : 'failed',
+                    state: deadLettered ? 'dead-letter' : 'failed',
                     leaseExpiresAt: now,
+                    ...(deadLettered ? {} : { nextAttemptAt: this.computeNextAttemptAt(now, attempts) }),
                     lastError: error instanceof BoundaryFailure
                         ? error.message
                         : new BoundaryFailure('Internal', 'outbox failure recording', 'Inspect local diagnostics and retry safely.').message,
@@ -144,6 +209,12 @@ export class TransactionalOutboxWorker {
             return true;
         });
     }
+    /** Deterministic exponential backoff with a validated cap; no random jitter. */
+    computeNextAttemptAt(now, attempts) {
+        const policy = getRuntimePolicy().outbox;
+        const delayMs = Math.min(policy.backoffBaseMs * 2 ** (attempts - 1), policy.backoffCapMs);
+        return new Date(Date.parse(now) + delayMs).toISOString();
+    }
     complete(message, fence, now) {
         return this.database.transaction(() => {
             const key = this.fenceKey(message.id);

package/dist/engine/handoff-packager.d.ts

@@ -16,6 +16,9 @@ export declare function extractCanonicalFileOwnership(content: string): {
     toModify: string[];
     toCreate: string[];
     toTest: string[];
+    /** Test paths as declared, before conflict filtering — used to exclude conflicted
+     *  paths from other categories even though they no longer appear in `toTest`. */
+    toTestDeclared: string[];
     blockers: string[];
 };
 export declare function packageHandoff(spec: Spec, knowledge: ProjectKnowledge): Promise<HandoffPackage>;

package/dist/engine/handoff-packager.js

@@ -174,7 +174,14 @@ export function normalizeChangedFilePath(value) {
 export function extractCanonicalFileOwnership(content) {
     const filesSection = sectionContentAtLevel(content, 'Files', 2);
     if (filesSection === null) {
-        return { present: false, toModify: [], toCreate: [], toTest: [], blockers: [] };
+        return {
+            present: false,
+            toModify: [],
+            toCreate: [],
+            toTest: [],
+            toTestDeclared: [],
+            blockers: [],
+        };
     }
     const blockers = [];
     const addBlocker = (blocker) => {
@@ -215,6 +222,7 @@ export function extractCanonicalFileOwnership(content) {
         toCreate: toCreate.filter((path) => !conflicts.includes(path)),
         toModify: toModify.filter((path) => !conflicts.includes(path)),
         toTest: toTest.filter((path) => !conflicts.includes(path)),
+        toTestDeclared: toTest,
         blockers,
     };
 }
@@ -541,7 +549,7 @@ export async function packageHandoff(spec, knowledge) {
     const canonicalFiles = extractCanonicalFileOwnership(rawSpecContent);
     const canonicalOwnership = extractStrictCanonicalOwnership(ownershipContent);
     const workPlanOwnership = extractFileLevelWorkPlanOwnership(ownershipContent);
-    const testOwnedPaths = new Set(canonicalFiles.toTest);
+    const testOwnedPaths = new Set(canonicalFiles.toTestDeclared);
     const explicitOwnership = canonicalOwnership.present
         ? {
             ...canonicalOwnership,
@@ -574,7 +582,9 @@ export async function packageHandoff(spec, knowledge) {
     }
     const blockers = [
         ...(criteria.length === 0 ? ['Missing BDD acceptance criteria'] : []),
-        ...(toModify.length + toCreate.length === 0 ? ['Missing file ownership / target files'] : []),
+        ...(toModify.length + toCreate.length + canonicalFiles.toTest.length === 0
+            ? ['Missing file ownership / target files']
+            : []),
         ...(operational.testPlan.length === 0 ? ['Missing test plan'] : []),
         ...(operational.risks.length === 0 ? ['Missing risk analysis'] : []),
         ...(operational.ownership.length === 0 ? ['Missing ownership'] : []),
@@ -594,6 +604,7 @@ export async function packageHandoff(spec, knowledge) {
         criteria,
         filesToModify: toModify,
         filesToCreate: toCreate,
+        filesToTest: canonicalFiles.toTest,
         ownership: operational.ownership,
         testPlan: operational.testPlan,
         risks: operational.risks,
@@ -626,6 +637,10 @@ function renderPersistedHandoff(pkg) {
         '## Files To Create',
         ...pkg.filesToCreate.map((filePath) => `- ${filePath}`),
         '',
+        '## Test Files',
+        // eslint-disable-next-line @typescript-eslint/no-unnecessary-condition -- compat guard: callers may construct a HandoffPackage object predating this field
+        ...(pkg.filesToTest ?? []).map((filePath) => `- ${filePath}`),
+        '',
         '## Ownership',
         ...pkg.ownership.map((item) => `- ${item}`),
         '',

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.1",
-  "engineVersion": "5.3.1",
-  "buildId": "1-5.3.1-aarch64-apple-darwin",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "9496b35ee4f02409d2ba5d5a32b07069f188bbe39b88ab0cc3a350fe476dce2a",
+  "artifactSha256": "936cf103c37c5622595eba08d503131657a4718d37b84d9355fe3dd8b63f313a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "1e8ba252b6c59727c3572a4cc086f55900f1dfbe2f8b52ab01efbb566825bf27"
+    "sha256": "a3350e8b345415b6b7881cd0ed7b1fa09a86e21530f790e08f93e74c0bfc4384"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "shwkLDoc3YH1TfCx9BXJ3sWZFkQnmUw5PF5ix0NUQIJ9zy79t1+97tCj+XxYMHr5/aEdAleDSI14AHARpTb+AQ=="
+    "value": "bk6W0MZRvTB3XJtJPw0Oe9Brcs8vOa0ZyWNyx81gBZHTp1qRjQjyT+bWVWjMRl9ULBE8+Iu5Sd02wR0ZGZ3MCQ=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.1",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.1",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9496b35ee4f02409d2ba5d5a32b07069f188bbe39b88ab0cc3a350fe476dce2a"
+          "content": "936cf103c37c5622595eba08d503131657a4718d37b84d9355fe3dd8b63f313a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.1",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.1",
-  "engineVersion": "5.3.1",
-  "buildId": "1-5.3.1-x86_64-apple-darwin",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "8835b07d4b8a9d96c2c38d5ba7a0ee31f556a68bab2c49f3c397d813a0b467e9",
+  "artifactSha256": "a00b4de15350f55e6b2dfbff7d172fe9c731f857b517ca903a3ef2faab5c9b2a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "cd3fde2fa5c346e6f6b4ee377eec73e63ac20ae85d6793769c33f49ce884e181"
+    "sha256": "7e25d45c059cf37c0f32d13526d9857d8b33e20e1326428d2ce6f6bf2684029b"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "BQIqLTSOP1v1gEBU6wBRH9d2G+81wpqFTtpxI1ObAfMEv22/HmXMhDieRK7ijSdhaJ0OwRE3qprfFqbYJ30pAg=="
+    "value": "JFfOtvnI+70+fijN8e5fJF4XqkwdZyAR8tOUxm+gdnM1okUI0EFUtqnb2nzPFzG4RnFZGSYgnoYJQpfd5zmnDw=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.1",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.1",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "8835b07d4b8a9d96c2c38d5ba7a0ee31f556a68bab2c49f3c397d813a0b467e9"
+          "content": "a00b4de15350f55e6b2dfbff7d172fe9c731f857b517ca903a3ef2faab5c9b2a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.1",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.1",
-  "engineVersion": "5.3.1",
-  "buildId": "1-5.3.1-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "aa7ba305602ab0cc30ed8859ae7b8aea49fc319161d583a84a39c43fc3080b2d",
+  "artifactSha256": "83c55f2f9e0f2bc32bca52de4d5ed248b09217d1893d2e05ce7880394e25a884",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "70863618fef07e482c7e5b70b7ec0f2eb86aeabb3639b458364d99be726d02b3"
+    "sha256": "39ddcdd6a6c9fae71bbb1f6f1716a1352ee37bf81196b24eef318d4abb0b4b1d"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "kwHa3R8NyX8dZ2Bb2+5+fMVTipEy8C0oHJ0P0LadjVhd5KJaXqfLPIu6a+rUkq9v/j1AUievoDE/BhgN8ukzBA=="
+    "value": "P1xQ4p3pp++gck7GGKW/Ue9/MdpedjnqGeuyl/76jzqFN5VmtA+L/5jlHvBc+qDPGkNT6wiXY8R3J5CHkjk5Cg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.1",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.1",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "aa7ba305602ab0cc30ed8859ae7b8aea49fc319161d583a84a39c43fc3080b2d"
+          "content": "83c55f2f9e0f2bc32bca52de4d5ed248b09217d1893d2e05ce7880394e25a884"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.1",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.1",
-  "engineVersion": "5.3.1",
-  "buildId": "1-5.3.1-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "d767b6ef1ec48f8bd745e02d39a53ef0efa052a15c3370ba65d3365e817cf454",
+  "artifactSha256": "6f31cf91ea1ae1bde34191ab4a7b7c2d6a58dcdb7206f18dcefcc1dfb42b349b",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "cf84110894384279fa1712a7b582767dd1dbebc72c1f4d3b53937d45109edc19"
+    "sha256": "c90938e79cf8fb28eb448b50b683c624c65ddfd34ee50515b3b999465d55cc83"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "cff22e20c8f95a4081485b852254fa5fbe1532ef",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "0jHhH3Ng3cOPbyiCfBZqdMVbp7i3tP7JnViKwaJqEF65k1M4NTootCYDahfaxcOPQbdyywqgoGBn9D/c8x6dAA=="
+    "value": "uvmtUXDibJr1Kf/Y1D1IiFea7pMuBcx2UWIonJHde2OweiQqQ1++KkoPMLGAIxfsSTncVTdXpU7nGiGpIm3jAQ=="
   }
 }