@planu/cli 5.3.26 → 5.3.28

package/dist/engine/native-capability-policy.js

@@ -1,24 +0,0 @@
-export const NATIVE_CAPABILITY_POLICIES = [
-    {
-        capability: 'core-acceleration-v1',
-        classification: 'optimization',
-        fallback: 'typescript-visible-degradation',
-        parityContract: 'tests/integration/native-platform-matrix.test.ts',
-    },
-    {
-        capability: 'project-graph-v1',
-        classification: 'optimization',
-        fallback: 'typescript-visible-degradation',
-        parityContract: 'tests/integration/native-project-graph-e2e.test.ts',
-    },
-    {
-        capability: 'macos-keychain-v1',
-        classification: 'correctness-critical',
-        fallback: 'fail-closed',
-        parityContract: 'tests/security/macos-keychain.integration.test.ts',
-    },
-];
-export function nativeFallbackMode(capability) {
-    return (NATIVE_CAPABILITY_POLICIES.find((policy) => policy.capability === capability)?.fallback ?? null);
-}
-//# sourceMappingURL=native-capability-policy.js.map

package/dist/engine/native-platform.d.ts

@@ -1,3 +0,0 @@
-/** Detects musl through independent local signals and reports failed probes. */
-export declare function detectMusl(): boolean;
-//# sourceMappingURL=native-platform.d.ts.map

package/dist/engine/native-platform.js

@@ -1,44 +0,0 @@
-import { existsSync, readFileSync, readdirSync } from 'node:fs';
-import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
-let cachedMusl;
-function probeMuslSignal(code, probe) {
-    try {
-        return probe();
-    }
-    catch (error) {
-        void error;
-        /* reliability-optional: NATIVE_LIBC_PROBE_FAILED */
-        reportClassifiedDegradation(code, new Error('Native libc probe unavailable'));
-        return false;
-    }
-}
-/** Detects musl through independent local signals and reports failed probes. */
-export function detectMusl() {
-    if (cachedMusl !== undefined) {
-        return cachedMusl;
-    }
-    if (process.platform !== 'linux') {
-        cachedMusl = false;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_ALPINE_PROBE_FAILED', () => existsSync('/etc/alpine-release'))) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_REPORT_PROBE_FAILED', () => {
-        const reportApi = process.report;
-        const report = reportApi?.getReport();
-        return (report !== undefined &&
-            /musl/iu.test(typeof report === 'string' ? report : JSON.stringify(report)));
-    })) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    if (probeMuslSignal('NATIVE_LIBC_LDD_PROBE_FAILED', () => existsSync('/usr/bin/ldd') && /musl/iu.test(readFileSync('/usr/bin/ldd', 'utf8')))) {
-        cachedMusl = true;
-        return cachedMusl;
-    }
-    cachedMusl = probeMuslSignal('NATIVE_LIBC_LINKER_PROBE_FAILED', () => readdirSync('/lib').some((entry) => entry.startsWith('ld-musl-')));
-    return cachedMusl;
-}
-//# sourceMappingURL=native-platform.js.map

package/dist/engine/native-runtime-handshake.d.ts

@@ -1,20 +0,0 @@
-import type { NativeArtifactManifest, NativeRuntimeCompatibility, NativeRuntimeHandshake } from '../types/core-bridge.js';
-export declare const NATIVE_PROTOCOL_ABI = 1;
-export declare const NATIVE_CAPABILITY_ABI = 2;
-export declare const NATIVE_NODE_API_ABI = 4;
-/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
-export declare const RUNTIME_STORAGE_SCHEMA = 4;
-export declare function inspectNativeArtifact(artifactPath: string, trustedPublicKeyInput?: string | Buffer): {
-    artifactSha256: string;
-    manifest: NativeArtifactManifest | null;
-};
-export declare function negotiateNativeRuntime(handshake: NativeRuntimeHandshake | null, manifest: NativeArtifactManifest | null, expected: {
-    cliVersion: string;
-    target: string;
-    artifactSha256: string;
-    protocolAbi?: number;
-    capabilityAbi?: number;
-    nodeApiAbi?: number;
-    storageSchema?: number;
-}): NativeRuntimeCompatibility;
-//# sourceMappingURL=native-runtime-handshake.d.ts.map

package/dist/engine/native-runtime-handshake.js

@@ -1,230 +0,0 @@
-/* eslint-disable complexity -- the fail-closed manifest boundary validates every signed field */
-/* eslint-disable @typescript-eslint/no-unnecessary-condition -- Partial models untrusted JSON at runtime */
-import { createHash, createPublicKey, verify as verifySignature } from 'node:crypto';
-import { lstatSync, readFileSync } from 'node:fs';
-import { basename, dirname, join } from 'node:path';
-import { reportClassifiedDegradation } from '../errors/classified-degradation.js';
-export const NATIVE_PROTOCOL_ABI = 1;
-export const NATIVE_CAPABILITY_ABI = 2;
-export const NATIVE_NODE_API_ABI = 4;
-/** Must match RuntimeDatabase.schemaVersion and the Rust/native release contract. */
-export const RUNTIME_STORAGE_SCHEMA = 4;
-export function inspectNativeArtifact(artifactPath, trustedPublicKeyInput) {
-    const hash = (value) => createHash('sha256').update(value).digest('hex');
-    let artifactSha256 = '';
-    const manifestPath = `${artifactPath}.manifest.json`;
-    try {
-        const currentUid = process.getuid?.();
-        for (const path of [artifactPath, manifestPath]) {
-            const stat = lstatSync(path);
-            if (stat.isSymbolicLink() ||
-                (process.platform !== 'win32' &&
-                    ((currentUid !== undefined && stat.uid !== currentUid) || (stat.mode & 0o022) !== 0))) {
-                return { artifactSha256, manifest: null };
-            }
-        }
-        artifactSha256 = hash(readFileSync(artifactPath));
-        const parsed = JSON.parse(readFileSync(manifestPath, 'utf8'));
-        if (typeof parsed !== 'object' ||
-            parsed === null ||
-            !('schemaVersion' in parsed) ||
-            parsed.schemaVersion !== 2 ||
-            !('artifactSha256' in parsed) ||
-            typeof parsed.artifactSha256 !== 'string' ||
-            !('capabilities' in parsed) ||
-            !Array.isArray(parsed.capabilities) ||
-            !parsed.capabilities.every((capability) => typeof capability === 'string')) {
-            return { artifactSha256, manifest: null };
-        }
-        const candidate = parsed;
-        const expectedSbomName = `${basename(artifactPath)}.sbom.json`;
-        const exactSemver = /^(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)\.(?:0|[1-9]\d*)$/u;
-        const expectedCapabilities = [
-            'core-acceleration-v1',
-            'project-graph-v1',
-            ...(candidate.platform === 'darwin' ? ['macos-keychain-v1'] : []),
-        ];
-        if (!exactSemver.test(candidate.cliVersion ?? '') ||
-            !exactSemver.test(candidate.engineVersion ?? '') ||
-            !/^[A-Za-z0-9._:-]{1,200}$/u.test(candidate.buildId ?? '') ||
-            candidate.protocolAbi !== NATIVE_PROTOCOL_ABI ||
-            candidate.capabilityAbi !== NATIVE_CAPABILITY_ABI ||
-            candidate.nodeApiAbi !== NATIVE_NODE_API_ABI ||
-            !Number.isSafeInteger(candidate.storageSchemaMin) ||
-            !Number.isSafeInteger(candidate.storageSchemaMax) ||
-            (candidate.storageSchemaMin ?? 0) < 1 ||
-            (candidate.storageSchemaMax ?? 0) < (candidate.storageSchemaMin ?? 0) ||
-            !['darwin', 'linux', 'win32'].includes(candidate.platform ?? '') ||
-            !['arm64', 'x64'].includes(candidate.arch ?? '') ||
-            (candidate.platform === 'linux'
-                ? !['glibc', 'musl'].includes(candidate.libc ?? '')
-                : candidate.libc !== null) ||
-            candidate.target !==
-                [candidate.platform, candidate.arch, candidate.libc].filter(Boolean).join('-') ||
-            JSON.stringify(candidate.capabilities) !== JSON.stringify(expectedCapabilities) ||
-            !/^[a-f0-9]{64}$/u.test(candidate.artifactSha256 ?? '') ||
-            candidate.sbom?.format !== 'CycloneDX-1.5' ||
-            candidate.sbom.path !== expectedSbomName ||
-            !/^[a-f0-9]{64}$/u.test(candidate.sbom.sha256 ?? '') ||
-            !/^[a-f0-9]{40}$/u.test(candidate.provenance?.sourceCommit ?? '') ||
-            typeof candidate.provenance?.sourceTreeDirty !== 'boolean' ||
-            !Number.isSafeInteger(candidate.provenance?.sourceDateEpoch) ||
-            (candidate.provenance?.sourceDateEpoch ?? -1) < 0 ||
-            !candidate.provenance?.builder ||
-            candidate.provenance.builder.length > 256 ||
-            !candidate.provenance.rustToolchain ||
-            (candidate.provenance.zigVersion !== null &&
-                typeof candidate.provenance.zigVersion !== 'string') ||
-            candidate.signature?.algorithm !== 'Ed25519' ||
-            !/^[a-f0-9]{64}$/u.test(candidate.signature.keyId ?? '') ||
-            !/^[A-Za-z0-9+/]{86}==$/u.test(candidate.signature.value ?? '')) {
-            return { artifactSha256, manifest: null };
-        }
-        const sbomPath = join(dirname(artifactPath), expectedSbomName);
-        const sbomStat = lstatSync(sbomPath);
-        if (sbomStat.isSymbolicLink() ||
-            (process.platform !== 'win32' &&
-                ((process.getuid?.() !== undefined && sbomStat.uid !== process.getuid?.()) ||
-                    (sbomStat.mode & 0o022) !== 0)) ||
-            hash(readFileSync(sbomPath)) !== candidate.sbom.sha256) {
-            return { artifactSha256, manifest: null };
-        }
-        const sbomValue = JSON.parse(readFileSync(sbomPath, 'utf8'));
-        if (!isValidSbom(sbomValue, candidate.engineVersion, artifactSha256)) {
-            return { artifactSha256, manifest: null };
-        }
-        const { signature, ...unsigned } = candidate;
-        const publicKey = createPublicKey(trustedPublicKeyInput ??
-            readFileSync(join(import.meta.dirname, '..', 'config', 'native-release-public-key.pem')));
-        const publicDer = publicKey.export({ type: 'spki', format: 'der' });
-        if (hash(publicDer) !== signature.keyId ||
-            !verifySignature(null, Buffer.from(JSON.stringify(unsigned)), publicKey, Buffer.from(signature.value, 'base64'))) {
-            return { artifactSha256, manifest: null };
-        }
-        return { artifactSha256, manifest: candidate };
-    }
-    catch (error) {
-        void error;
-        /* reliability-optional: NATIVE_ARTIFACT_INSPECTION_FAILED */
-        reportClassifiedDegradation('NATIVE_ARTIFACT_INSPECTION_FAILED', new Error('Native artifact inspection failed closed'));
-        return { artifactSha256, manifest: null };
-    }
-}
-function isValidSbom(value, engineVersion, artifactSha256) {
-    if (typeof value !== 'object' || value === null) {
-        return false;
-    }
-    const sbom = value;
-    const componentsValid = Array.isArray(sbom.components) &&
-        sbom.components.length > 0 &&
-        sbom.components.every((component) => typeof component === 'object' &&
-            component !== null &&
-            typeof component['bom-ref'] === 'string' &&
-            typeof component.name === 'string' &&
-            typeof component.version === 'string');
-    const dependenciesValid = Array.isArray(sbom.dependencies) &&
-        sbom.dependencies.some((dependency) => typeof dependency === 'object' &&
-            dependency !== null &&
-            Array.isArray(dependency.dependsOn));
-    const hashes = sbom.metadata?.component?.hashes;
-    const artifactBound = Array.isArray(hashes) &&
-        hashes.some((entry) => typeof entry === 'object' &&
-            entry !== null &&
-            entry.alg === 'SHA-256' &&
-            entry.content === artifactSha256);
-    return (sbom.bomFormat === 'CycloneDX' &&
-        sbom.specVersion === '1.5' &&
-        sbom.version === 1 &&
-        sbom.metadata?.component?.name === 'planu-core' &&
-        sbom.metadata.component.version === engineVersion &&
-        componentsValid &&
-        dependenciesValid &&
-        artifactBound);
-}
-export function negotiateNativeRuntime(handshake, manifest, expected) {
-    if (!handshake) {
-        return {
-            compatible: false,
-            reasons: ['native runtime does not expose planuRuntimeHandshake'],
-            handshake: null,
-        };
-    }
-    if (!manifest) {
-        return {
-            compatible: false,
-            reasons: ['native artifact manifest is missing, unsafe or invalid'],
-            handshake,
-        };
-    }
-    const reasons = [];
-    const protocolAbi = expected.protocolAbi ?? NATIVE_PROTOCOL_ABI;
-    const capabilityAbi = expected.capabilityAbi ?? NATIVE_CAPABILITY_ABI;
-    const nodeApiAbi = expected.nodeApiAbi ?? NATIVE_NODE_API_ABI;
-    const storageSchema = expected.storageSchema ?? RUNTIME_STORAGE_SCHEMA;
-    const handshakeCapabilitiesValid = Array.isArray(handshake.capabilities) &&
-        handshake.capabilities.every((capability) => typeof capability === 'string');
-    const manifestCapabilitiesValid = Array.isArray(manifest.capabilities) &&
-        manifest.capabilities.every((capability) => typeof capability === 'string');
-    if (manifest.cliVersion !== expected.cliVersion) {
-        reasons.push(`CLI version mismatch: expected ${expected.cliVersion}, got ${manifest.cliVersion}`);
-    }
-    if (handshake.engineVersion !== expected.cliVersion) {
-        reasons.push(`engine version mismatch: expected ${expected.cliVersion}, got ${handshake.engineVersion}`);
-    }
-    if (handshake.engineVersion !== manifest.engineVersion) {
-        reasons.push('native engine version does not match artifact manifest');
-    }
-    if (handshake.buildId !== manifest.buildId) {
-        reasons.push('native build identity does not match artifact manifest');
-    }
-    if (handshake.protocolAbi !== protocolAbi) {
-        reasons.push(`protocol ABI mismatch: expected ${protocolAbi}, got ${handshake.protocolAbi}`);
-    }
-    if (handshake.protocolAbi !== manifest.protocolAbi) {
-        reasons.push('native protocol ABI does not match artifact manifest');
-    }
-    if (handshake.capabilityAbi !== capabilityAbi) {
-        reasons.push(`capability ABI mismatch: expected ${capabilityAbi}, got ${handshake.capabilityAbi}`);
-    }
-    if (handshake.capabilityAbi !== manifest.capabilityAbi) {
-        reasons.push('native capability ABI does not match artifact manifest');
-    }
-    if (handshake.nodeApiAbi !== nodeApiAbi) {
-        reasons.push(`Node-API ABI mismatch: expected ${nodeApiAbi}, got ${handshake.nodeApiAbi}`);
-    }
-    if (handshake.nodeApiAbi !== manifest.nodeApiAbi) {
-        reasons.push('native Node-API ABI does not match artifact manifest');
-    }
-    if (!handshakeCapabilitiesValid) {
-        reasons.push('native runtime capabilities are malformed');
-    }
-    if (!manifestCapabilitiesValid) {
-        reasons.push('native artifact manifest capabilities are malformed');
-    }
-    if (handshakeCapabilitiesValid &&
-        manifestCapabilitiesValid &&
-        JSON.stringify(handshake.capabilities) !== JSON.stringify(manifest.capabilities)) {
-        reasons.push('native capabilities do not match artifact manifest');
-    }
-    if (storageSchema < handshake.storageSchemaMin || storageSchema > handshake.storageSchemaMax) {
-        reasons.push(`storage schema ${storageSchema} is outside native range ${handshake.storageSchemaMin}-${handshake.storageSchemaMax}`);
-    }
-    if (handshake.storageSchemaMin !== manifest.storageSchemaMin ||
-        handshake.storageSchemaMax !== manifest.storageSchemaMax) {
-        reasons.push('native storage schema range does not match artifact manifest');
-    }
-    if (handshake.target !== expected.target) {
-        reasons.push(`target mismatch: expected ${expected.target}, got ${handshake.target}`);
-    }
-    if (handshake.target !== manifest.target) {
-        reasons.push('native target does not match artifact manifest');
-    }
-    if (manifest.target !== [manifest.platform, manifest.arch, manifest.libc].filter(Boolean).join('-')) {
-        reasons.push('native manifest target does not match platform/arch/libc dimensions');
-    }
-    if (manifest.artifactSha256 !== expected.artifactSha256) {
-        reasons.push('native artifact SHA-256 mismatch');
-    }
-    return { compatible: reasons.length === 0, reasons, handshake };
-}
-//# sourceMappingURL=native-runtime-handshake.js.map

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,39 +0,0 @@
-{
-  "schemaVersion": 2,
-  "cliVersion": "5.3.26",
-  "engineVersion": "5.3.26",
-  "buildId": "1-5.3.26-aarch64-apple-darwin",
-  "protocolAbi": 1,
-  "capabilityAbi": 2,
-  "nodeApiAbi": 4,
-  "capabilities": [
-    "core-acceleration-v1",
-    "project-graph-v1",
-    "macos-keychain-v1"
-  ],
-  "storageSchemaMin": 4,
-  "storageSchemaMax": 4,
-  "target": "darwin-arm64",
-  "platform": "darwin",
-  "arch": "arm64",
-  "libc": null,
-  "artifactSha256": "b2d852dc52754af4bb30c62703566f1904ef5d36905a500ee93dd659d2a5e1e2",
-  "sbom": {
-    "format": "CycloneDX-1.5",
-    "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "f40d46dc1cafb9791a5abb6b22715025ed1a46ebbece82949b770e92009a33d0"
-  },
-  "provenance": {
-    "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "2419aedc35345da335c3469eaf80b19f428fd53b",
-    "sourceTreeDirty": false,
-    "sourceDateEpoch": 1,
-    "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
-    "zigVersion": "0.16.0"
-  },
-  "signature": {
-    "algorithm": "Ed25519",
-    "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "chGhyQXfG6qVz8U+TCAugdrFAW9pvbketCjVF0BESmKZlIMKyzq15V3r8QSuBOGqCs3OtuORM0R6VRJEreHlAA=="
-  }
-}