@planu/cli 5.3.2 → 5.3.3

package/CHANGELOG.md

@@ -1,3 +1,20 @@
+## [5.3.3] - 2026-08-06
+
+### Bug Fixes
+- fix(release): tolerate empty ff-behind mirror list under set -u
+- fix(outbox): return a typed failure from delivery attempts for the reliability gate
+- fix(git): close SPEC-1396 debate findings and record review evidence
+- fix(git): never move the shared checkout from automatic paths (SPEC-1396)
+- fix(outbox): address SPEC-1271 debate review findings
+- fix(outbox): bounded fair durable spec.created recovery without blocking startup (SPEC-1271)
+
+### Chores
+- chore(planu): file SPEC-1396 git-safety dogfood bug
+- chore(planu): session checkpoint after SPEC-1271 cycle
+- chore(planu): SPEC-1271 done with debate evidence, file SPEC-1395
+- chore(planu): SPEC-1271 implementing with structured work plan, file SPEC-1394
+
+
 ## [5.3.2] - 2026-08-06
 
 ### Bug Fixes

package/dist/config/runtime-policy.json

@@ -51,5 +51,14 @@
     "leaseMultiplier": 3,
     "maximumRememberedTransitions": 1000,
     "minimumHeartbeatMs": 1000
+  },
+  "outbox": {
+    "sliceRecordBudget": 25,
+    "sliceTimeBudgetMs": 5000,
+    "backoffBaseMs": 30000,
+    "backoffCapMs": 1800000,
+    "maxAttempts": 3,
+    "diagnosticMaxLength": 500,
+    "continuationDelayMs": 250
   }
 }

package/dist/engine/autopilot/complete-loop.js

@@ -47,7 +47,10 @@ async function runWithProgress(projectPath, projectId, specId, action, fn) {
  */
 async function doAutoCreateBranch(projectId, specId) {
     const { handleCreateBranch } = await import('../../tools/git/branch-ops.js');
-    const result = await handleCreateBranch(projectId, specId);
+    // SPEC-1396: cascade side effect — create the ref, never move the shared checkout.
+    const result = await handleCreateBranch(projectId, specId, undefined, undefined, {
+        mutateCheckout: false,
+    });
     if (result.isError === true) {
         /* v8 ignore next */
         const msg = result.content[0]?.type === 'text' ? result.content[0].text : 'branch creation failed';

package/dist/engine/execution/outbox-worker.d.ts

@@ -18,12 +18,20 @@ export declare class TransactionalOutboxWorker {
         readonly clock?: () => Date;
         readonly limit?: number;
         readonly topics?: readonly string[];
+        readonly timeBudgetMs?: number;
     }): Promise<{
         readonly delivered: number;
+        readonly failed: number;
         readonly skipped: number;
+        readonly ineligible: number;
+        /** True when no eligible pending record remains in this scope right now. */
+        readonly exhausted: boolean;
     }>;
+    private attemptDelivery;
     private claim;
     private fail;
+    /** Deterministic exponential backoff with a validated cap; no random jitter. */
+    private computeNextAttemptAt;
     private complete;
     private deliveryKey;
     private fenceKey;

package/dist/engine/execution/outbox-worker.js

@@ -1,20 +1,32 @@
 import { createHash } from 'node:crypto';
 import { BoundaryFailure } from '../../errors/error-taxonomy.js';
+import { getRuntimePolicy } from '../runtime-policy.js';
 function parseFence(value) {
     if (!value || typeof value !== 'object') {
         return undefined;
     }
     const fence = value;
+    const nextAttemptAtValid = fence.nextAttemptAt === undefined ||
+        (typeof fence.nextAttemptAt === 'string' && Number.isFinite(Date.parse(fence.nextAttemptAt)));
     if (fence.schemaVersion !== 1 ||
         typeof fence.workerId !== 'string' ||
         !Number.isSafeInteger(fence.fencingToken) ||
         typeof fence.leaseExpiresAt !== 'string' ||
         typeof fence.state !== 'string' ||
-        !['leased', 'failed', 'dead-letter', 'delivered'].includes(fence.state)) {
+        !['leased', 'failed', 'dead-letter', 'delivered'].includes(fence.state) ||
+        !nextAttemptAtValid) {
         throw new BoundaryFailure('Corrupt', 'outbox fence read', 'Quarantine the invalid fence record before retrying delivery.');
     }
     return fence;
 }
+/**
+ * Upper bound on how many rows a single internal page fetch may request while
+ * paging past ineligible head records (foreign lease, delivered self-heal) that
+ * consume no record budget. 1000 is the existing hard ceiling `listOutbox`
+ * already enforces, so this reuses that ceiling rather than introducing a new
+ * tunable.
+ */
+const OUTBOX_PAGE_FETCH_LIMIT = 1_000;
 /**
  * Durable outbox dispatcher. The sink must deduplicate `deliveryKey`; this stable key closes the
  * unavoidable crash window between an external acknowledgement and the local delivered marker.
@@ -26,7 +38,7 @@ export class TransactionalOutboxWorker {
     workerId;
     leaseMs;
     maxAttempts;
-    constructor(database, projectId, workspaceId, workerId, leaseMs = 30_000, maxAttempts = 3) {
+    constructor(database, projectId, workspaceId, workerId, leaseMs = 30_000, maxAttempts = getRuntimePolicy().outbox.maxAttempts) {
         this.database = database;
         this.projectId = projectId;
         this.workspaceId = workspaceId;
@@ -46,38 +58,83 @@ export class TransactionalOutboxWorker {
     async drain(deliver, options = {}) {
         const clock = options.clock ?? (() => new Date());
         const now = currentIso(clock, options.now);
+        const policy = getRuntimePolicy().outbox;
+        const timeBudgetMs = options.timeBudgetMs ?? policy.sliceTimeBudgetMs;
+        const startedAtMs = clock().getTime();
+        let recordBudget = options.limit ?? policy.sliceRecordBudget;
         let delivered = 0;
-        let skipped = 0;
-        const pending = this.database.listOutbox(this.projectId, this.workspaceId, {
-            pendingOnly: true,
-            limit: options.limit,
-            topics: options.topics,
-        });
-        for (const message of pending) {
-            const fence = this.claim(message, now);
-            if (!fence) {
-                skipped += 1;
-                continue;
-            }
-            try {
-                await deliver({
-                    deliveryKey: this.deliveryKey(message),
-                    fencingToken: fence.fencingToken,
-                    topic: message.topic,
-                    payload: message.payload,
-                });
-            }
-            catch {
-                const failure = new BoundaryFailure('DependencyUnavailable', 'outbox delivery', 'Retry with the stable delivery key after the dependency recovers.');
-                this.fail(message, fence, failure, currentIso(clock, options.now));
-                throw failure;
+        let failed = 0;
+        let ineligible = 0;
+        let cursorId = 0;
+        let timedOut = false;
+        while (recordBudget > 0 && !timedOut) {
+            const batch = this.database.listOutbox(this.projectId, this.workspaceId, {
+                pendingOnly: true,
+                limit: OUTBOX_PAGE_FETCH_LIMIT,
+                topics: options.topics,
+                eligibleAt: now,
+                afterId: cursorId,
+            });
+            if (batch.length === 0) {
+                break;
             }
-            if (!this.complete(message, fence, currentIso(clock, options.now))) {
-                throw new BoundaryFailure('Conflict', 'outbox delivery commit', 'Another worker owns the lease; retry with the stable delivery key.');
+            for (const message of batch) {
+                // Admission check between deliveries: never aborts an in-flight delivery.
+                if (clock().getTime() - startedAtMs > timeBudgetMs) {
+                    timedOut = true;
+                    break;
+                }
+                cursorId = message.id;
+                const fence = this.claim(message, now);
+                if (!fence) {
+                    // Ineligible for a reason SQL cannot pre-filter (foreign unexpired lease,
+                    // self-healed delivered fence): consumes no record budget and does not
+                    // stop the worker from advancing to the next record in this same call.
+                    ineligible += 1;
+                    continue;
+                }
+                recordBudget -= 1;
+                const outcome = await this.attemptDelivery(message, fence, deliver, clock, options.now);
+                if (outcome.status === 'failed') {
+                    // Isolate the failure: continue offering remaining eligible records
+                    // instead of aborting the whole slice.
+                    failed += 1;
+                }
+                else {
+                    delivered += 1;
+                }
+                if (recordBudget === 0) {
+                    break;
+                }
             }
-            delivered += 1;
         }
-        return { delivered, skipped };
+        // Exact count of eligible work left unattempted (budget or time cutoff), not
+        // an estimate — this is what a further slice would find eligible right now.
+        const skipped = this.database.countEligibleOutbox(this.projectId, this.workspaceId, {
+            topics: options.topics,
+            eligibleAt: now,
+            afterId: cursorId,
+        });
+        return { delivered, failed, skipped, ineligible, exhausted: skipped === 0 };
+    }
+    async attemptDelivery(message, fence, deliver, clock, now) {
+        try {
+            await deliver({
+                deliveryKey: this.deliveryKey(message),
+                fencingToken: fence.fencingToken,
+                topic: message.topic,
+                payload: message.payload,
+            });
+        }
+        catch {
+            const failure = new BoundaryFailure('DependencyUnavailable', 'outbox delivery', 'Retry with the stable delivery key after the dependency recovers.');
+            this.fail(message, fence, failure, currentIso(clock, now));
+            return { status: 'failed' };
+        }
+        if (!this.complete(message, fence, currentIso(clock, now))) {
+            throw new BoundaryFailure('Conflict', 'outbox delivery commit', 'Another worker owns the lease; retry with the stable delivery key.');
+        }
+        return { status: 'delivered' };
     }
     claim(message, now) {
         return this.database.transaction(() => {
@@ -93,6 +150,12 @@ export class TransactionalOutboxWorker {
             if (existing?.state === 'leased' && existing.leaseExpiresAt > now) {
                 return undefined;
             }
+            if (existing?.state === 'failed' &&
+                existing.nextAttemptAt !== undefined &&
+                existing.nextAttemptAt > now) {
+                // Durable retry deadline not yet reached: not eligible, attempts unchanged.
+                return undefined;
+            }
             const fence = {
                 schemaVersion: 1,
                 workerId: this.workerId,
@@ -126,6 +189,7 @@ export class TransactionalOutboxWorker {
                 return false;
             }
             const attempts = current.attempts ?? 1;
+            const deadLettered = attempts >= this.maxAttempts;
             this.database.putRecord({
                 projectId: this.projectId,
                 workspaceId: this.workspaceId,
@@ -133,8 +197,9 @@ export class TransactionalOutboxWorker {
                 key,
                 value: {
                     ...current,
-                    state: attempts >= this.maxAttempts ? 'dead-letter' : 'failed',
+                    state: deadLettered ? 'dead-letter' : 'failed',
                     leaseExpiresAt: now,
+                    ...(deadLettered ? {} : { nextAttemptAt: this.computeNextAttemptAt(now, attempts) }),
                     lastError: error instanceof BoundaryFailure
                         ? error.message
                         : new BoundaryFailure('Internal', 'outbox failure recording', 'Inspect local diagnostics and retry safely.').message,
@@ -144,6 +209,12 @@ export class TransactionalOutboxWorker {
             return true;
         });
     }
+    /** Deterministic exponential backoff with a validated cap; no random jitter. */
+    computeNextAttemptAt(now, attempts) {
+        const policy = getRuntimePolicy().outbox;
+        const delayMs = Math.min(policy.backoffBaseMs * 2 ** (attempts - 1), policy.backoffCapMs);
+        return new Date(Date.parse(now) + delayMs).toISOString();
+    }
     complete(message, fence, now) {
         return this.database.transaction(() => {
             const key = this.fenceKey(message.id);

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-aarch64-apple-darwin",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "d871c6912f7857fedb31608d895a4e80fbf550c18875d307cf068fa966412cb7",
+  "artifactSha256": "936cf103c37c5622595eba08d503131657a4718d37b84d9355fe3dd8b63f313a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "93613e9e650a12618265c467fd3007c96ad6c261dcf373ff321d70210c1fdf90"
+    "sha256": "a3350e8b345415b6b7881cd0ed7b1fa09a86e21530f790e08f93e74c0bfc4384"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "5A14AujfQn9F0F6V4dCbHhSlzyWfH43wAF+8tSzLXg0t7+yELQKNNH8XqNGSqL9qGHPVxSYeTu1nh/3qQECxBQ=="
+    "value": "bk6W0MZRvTB3XJtJPw0Oe9Brcs8vOa0ZyWNyx81gBZHTp1qRjQjyT+bWVWjMRl9ULBE8+Iu5Sd02wR0ZGZ3MCQ=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.2",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.2",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "d871c6912f7857fedb31608d895a4e80fbf550c18875d307cf068fa966412cb7"
+          "content": "936cf103c37c5622595eba08d503131657a4718d37b84d9355fe3dd8b63f313a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.2",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-x86_64-apple-darwin",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "2e160dbfb5616b778ea6bc1b85b6663ae9618c664824498e0089a3b82353923e",
+  "artifactSha256": "a00b4de15350f55e6b2dfbff7d172fe9c731f857b517ca903a3ef2faab5c9b2a",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "b4aa09e9d3bc3d5f4d0d80953f4d32389aa40fafabcac6895ebd296c4a2f6873"
+    "sha256": "7e25d45c059cf37c0f32d13526d9857d8b33e20e1326428d2ce6f6bf2684029b"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "xN3AVrLnDNmagcrLzUS+voWOuOHZhY4+i+nfep/66x39IdztoQEqh/jF1H/P5qxnIwGFuSztuCS3cG0pAsRqCw=="
+    "value": "JFfOtvnI+70+fijN8e5fJF4XqkwdZyAR8tOUxm+gdnM1okUI0EFUtqnb2nzPFzG4RnFZGSYgnoYJQpfd5zmnDw=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.2",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.2",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "2e160dbfb5616b778ea6bc1b85b6663ae9618c664824498e0089a3b82353923e"
+          "content": "a00b4de15350f55e6b2dfbff7d172fe9c731f857b517ca903a3ef2faab5c9b2a"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.2",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "c688e223eaed377810f13b4fb59b95269c6ac386e9e22122012322aa20b4119f",
+  "artifactSha256": "83c55f2f9e0f2bc32bca52de4d5ed248b09217d1893d2e05ce7880394e25a884",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "05e6cde28bdf46282c2024bec9491908e67cf0875a1043a879533fe26e2acf6c"
+    "sha256": "39ddcdd6a6c9fae71bbb1f6f1716a1352ee37bf81196b24eef318d4abb0b4b1d"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "evvZQIYp2VmYUaaLu8nK5yLjTSms9hMRYoF4zM3qsCHwLLKRThOR+KrFgZ9ySZk6WRWx9CE8F/c+pKFRi/7nBg=="
+    "value": "P1xQ4p3pp++gck7GGKW/Ue9/MdpedjnqGeuyl/76jzqFN5VmtA+L/5jlHvBc+qDPGkNT6wiXY8R3J5CHkjk5Cg=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.2",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.2",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c688e223eaed377810f13b4fb59b95269c6ac386e9e22122012322aa20b4119f"
+          "content": "83c55f2f9e0f2bc32bca52de4d5ed248b09217d1893d2e05ce7880394e25a884"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.2",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "ffe6b8382aded44408171166a385d31d25fa6a95919c14ec73ca5197351da8ac",
+  "artifactSha256": "6f31cf91ea1ae1bde34191ab4a7b7c2d6a58dcdb7206f18dcefcc1dfb42b349b",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "6612f0831ad90d8d69aa88bbc53658d5dc55d5ff3e337e4253cb8943c7471aa5"
+    "sha256": "c90938e79cf8fb28eb448b50b683c624c65ddfd34ee50515b3b999465d55cc83"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "3AhxDy080JazcjbYv9SH3w6tpj4iKKLlhI95pAy1/VQ8c9iDEDLmTfFaQv4R1FXjEAUSqZ/hYZEAQ0A3XpQPCA=="
+    "value": "uvmtUXDibJr1Kf/Y1D1IiFea7pMuBcx2UWIonJHde2OweiQqQ1++KkoPMLGAIxfsSTncVTdXpU7nGiGpIm3jAQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.2",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.2",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "ffe6b8382aded44408171166a385d31d25fa6a95919c14ec73ca5197351da8ac"
+          "content": "6f31cf91ea1ae1bde34191ab4a7b7c2d6a58dcdb7206f18dcefcc1dfb42b349b"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.2",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "c1aeb15763bf3ee0b2d37ac694340fe65cfc106f95f6813c2e188c099c826013",
+  "artifactSha256": "125329171f49f6a9d37b2503c64e74238c1b4ad4f22a56177a58e64f5297ea8c",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "cd651b3c7af8a03fb3725d6342ee679dfef8272b65bc28e9f523dbfb88fa0ed8"
+    "sha256": "edb71690879e6a06c47b15db5d2ecd5c45d0d96f574dfb025e4ede5201925ca8"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "T9ypzN3DZ+ks4rQIjeuMKqxHHxGc7Qm/ep9zyVEsU6BvzVjOaiZijDkJXsiaNS8AqfrZkmnr6I/HtWNCqiqjCw=="
+    "value": "8E8ysYR9C83WqDmoU9pE+Qz8skx8fRTDRQY58Cz3CWkvU0Ul5FqTVqsMmOCGMtbQnKloSTpqejDr4wfieZcOBw=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.2",
+      "bom-ref": "pkg:cargo/planu-core@5.3.3",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.2",
+      "version": "5.3.3",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c1aeb15763bf3ee0b2d37ac694340fe65cfc106f95f6813c2e188c099c826013"
+          "content": "125329171f49f6a9d37b2503c64e74238c1b4ad4f22a56177a58e64f5297ea8c"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.2",
+      "ref": "pkg:cargo/planu-core@5.3.3",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.2",
-  "engineVersion": "5.3.2",
-  "buildId": "1-5.3.2-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.3",
+  "engineVersion": "5.3.3",
+  "buildId": "1-5.3.3-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "d44f03ecaed34427ca6ed682ce695f432d25eac3366fc5e779cfa78fe39d504b",
+  "artifactSha256": "0e4804010d87a4089e8fd59af5d0b61ba6a572ff20f9f55b1caa904af861f030",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "86d8219cdb5f5205d458cfa205ef619f68997f7a414f04a3a30f53704650b488"
+    "sha256": "b90757ad531f433d3152e0e90a090afe261e5463f88accb49abd5b19f909a326"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "30226657c1e66411b6ff233c2ea82e47573d533a",
+    "sourceCommit": "30eda7a2ba11647e835b0079c526bed77f189c8e",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "O6Ay8rgviCK8bLJJbkQAsX9msRJoCxB2jkgpY6+v+7oyVohsZ3hKly1kFnQ35WRbibF4l2TBchxZI7IlKbAgCg=="
+    "value": "cff322qqiXm/iOOexje+zv117NOLslTpYswuxD7tgzZ86aQL30/W+bGQ2W6Qe2VVhhoG60WDXpMbwiyQndvFBg=="
   }
 }