@planu/cli 5.3.27 → 5.3.29

package/dist/engine/scan-project/module-discoverer.js

@@ -2,9 +2,8 @@ import { technologyValue } from '../technology-registry.js';
 // engine/scan-project/module-discoverer.ts — Detects module boundaries in a project (SPEC-134)
 // Language-agnostic: supports monorepo, package-based, framework-based, and directory-based detection.
 import { readFile, readdir, stat } from 'node:fs/promises';
-import { join, relative, basename, dirname } from 'node:path';
+import { join, relative, basename } from 'node:path';
 import { glob } from 'glob';
-import { isNativeActive, fastFindFilesByName } from '../core-bridge.js';
 // === Constants ===
 const IGNORE_PATTERNS = [
     'node_modules',
@@ -210,29 +209,15 @@ async function detectMonorepo(projectPath) {
         return null;
     }
     const resolved = [];
-    if (isNativeActive()) {
-        // Rust: optimized directory resolution for monorepo patterns
-        const pkgJsonPaths = fastFindFilesByName(projectPath, ['package.json']);
-        // Filter directories that match the workspace globs (simplified heuristic).
-        const dirs = pkgJsonPaths
-            .map((p) => dirname(p))
-            .map((p) => relative(projectPath, p))
-            .filter((rel) => rel !== '' && !isIgnored(rel.split('/')[0] ?? ''));
-        // In a real implementation we would match against workspaceGlobs exactly,
-        // but for speed we take all dirs with package.json that aren't ignored.
-        resolved.push(...dirs);
-    }
-    if (resolved.length === 0) {
-        for (const pattern of workspaceGlobs) {
-            // Append '/' to match only directories (glob treats trailing slash as dir-only)
-            const dirPattern = pattern.endsWith('/') ? pattern : `${pattern}/`;
-            const matches = await glob(dirPattern, {
-                cwd: projectPath,
-                ignore: IGNORE_PATTERNS.map((p) => `**/${p}/**`),
-            });
-            // Strip trailing slash glob may add
-            resolved.push(...matches.map((m) => m.replace(/\/$/, '')));
-        }
+    for (const pattern of workspaceGlobs) {
+        // Append '/' to match only directories (glob treats trailing slash as dir-only)
+        const dirPattern = pattern.endsWith('/') ? pattern : `${pattern}/`;
+        const matches = await glob(dirPattern, {
+            cwd: projectPath,
+            ignore: IGNORE_PATTERNS.map((p) => `**/${p}/**`),
+        });
+        // Strip trailing slash glob may add
+        resolved.push(...matches.map((m) => m.replace(/\/$/, '')));
     }
     if (resolved.length === 0) {
         return null;
@@ -255,34 +240,6 @@ async function detectMonorepo(projectPath) {
 }
 // === Package-based detection ===
 async function detectPackageBased(projectPath) {
-    if (isNativeActive()) {
-        const manifests = fastFindFilesByName(projectPath, PACKAGE_MANIFESTS);
-        if (manifests.length > 0) {
-            const modules = [];
-            const seen = new Set();
-            for (const m of manifests) {
-                const rel = relative(projectPath, dirname(m));
-                if (rel === '' || rel.includes('/') || isIgnored(rel) || seen.has(rel)) {
-                    continue;
-                }
-                seen.add(rel);
-                const [estimatedFiles, language] = await Promise.all([
-                    countSourceFiles(join(projectPath, rel)),
-                    detectLanguage(join(projectPath, rel)),
-                ]);
-                modules.push({
-                    name: rel,
-                    path: rel,
-                    estimatedFiles,
-                    language,
-                    detectionMethod: 'package',
-                });
-            }
-            if (modules.length > 0) {
-                return modules;
-            }
-        }
-    }
     const subdirs = await getSubdirs(projectPath);
     const modules = [];
     for (const subdir of subdirs) {

package/dist/engine/validation/validation-receipt.d.ts

@@ -3,6 +3,11 @@ import type { RuntimeDatabase } from '../../storage/runtime-db.js';
 import { type StorageCatalogContext } from '../../storage/storage-catalog.js';
 export { normalizeValidationCommand } from './validation-receipt-codec.js';
 export declare const LOCAL_VALIDATION_RECEIPT_ISSUER = "planu-local-validator";
+export declare class ValidationReceiptSignerUnavailableError extends Error {
+    readonly reason: 'PLATFORM_UNSUPPORTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE';
+    readonly code: 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
+    constructor(reason: 'PLATFORM_UNSUPPORTED' | 'PROVIDER_NONCANONICAL' | 'PROVIDER_UNAVAILABLE', remediation?: string);
+}
 export declare class ValidationReceiptStore implements ValidationReceiptPersistence {
     private readonly options;
     private readonly logDirectory;

package/dist/engine/validation/validation-receipt.js

@@ -6,11 +6,19 @@ import { reportClassifiedDegradation } from '../../errors/classified-degradation
 import { resolvedStorageArtifactPath, } from '../../storage/storage-catalog.js';
 import { formatSecretReference, getSecretProvider, parseSecretReference, SecretProviderError, } from '../../security/secret-provider.js';
 import { redactText } from '../../security/redactor.js';
-import { ValidationReceiptSignerUnavailableError } from '../macos-keychain-native-port.js';
 import { acquireLock, releaseLock } from '../safety/file-mutex.js';
 import { canonicalize, DIGEST, ISSUER_ID, PROJECT_ID, receiptCore, safeProof, sha256, SPEC_ID, validBindings, validReceiptShape, } from './validation-receipt-codec.js';
 export { normalizeValidationCommand } from './validation-receipt-codec.js';
 export const LOCAL_VALIDATION_RECEIPT_ISSUER = 'planu-local-validator';
+export class ValidationReceiptSignerUnavailableError extends Error {
+    reason;
+    code = 'VALIDATION_RECEIPT_SIGNER_UNAVAILABLE';
+    constructor(reason, remediation = 'Restart the MCP host and retry.') {
+        super(`[Planu] VALIDATION_RECEIPT_SIGNER_UNAVAILABLE:${reason} ${remediation}`);
+        this.reason = reason;
+        this.name = 'ValidationReceiptSignerUnavailableError';
+    }
+}
 export class ValidationReceiptStore {
     options;
     logDirectory;

package/dist/engine/validator/deep-code-checker.js

@@ -1,7 +1,7 @@
 // Planu — Validator: deep code checker
 // Performs real filesystem/grep analysis for spec criteria that go beyond file-name matching.
 import { readFile, stat } from 'node:fs/promises';
-import { join, relative } from 'node:path';
+import { join } from 'node:path';
 import { glob } from 'glob';
 const DEFAULT_IGNORE = ['node_modules/**', 'dist/**', 'build/**', '.git/**', 'coverage/**'];
 function escapeRegex(input) {
@@ -152,7 +152,6 @@ async function resolveFiles(scopeGlob, projectPath, exclude) {
     }
 }
 // ─── Checkers ─────────────────────────────────────────────────────────────────
-import { isNativeActive, fastFindPatterns } from '../core-bridge.js';
 function buildRegex(pattern) {
     try {
         return new RegExp(pattern, 'g');
@@ -174,32 +173,26 @@ function buildRegex(pattern) {
  */
 export async function grepCheck(config, projectPath, checkType) {
     const evidence = [];
-    if (isNativeActive()) {
-        const results = fastFindPatterns(projectPath, [config.pattern], [], config.exclude ? [config.exclude] : []);
-        evidence.push(...results.map((r) => `${relative(projectPath, r.path)}:${r.line}`));
-    }
-    else {
-        const files = await resolveFiles(config.scope, projectPath, config.exclude);
-        const regex = buildRegex(config.pattern);
-        if (regex) {
-            await Promise.all(files.map(async (file) => {
-                const fullPath = join(projectPath, file);
-                try {
-                    const content = await readFile(fullPath, 'utf-8');
-                    const lines = content.split('\n');
-                    for (let i = 0; i < lines.length; i++) {
-                        const line = lines[i];
-                        if (line !== undefined && regex.test(line)) {
-                            evidence.push(`${file}:${i + 1}`);
-                            regex.lastIndex = 0;
-                        }
+    const files = await resolveFiles(config.scope, projectPath, config.exclude);
+    const regex = buildRegex(config.pattern);
+    if (regex) {
+        await Promise.all(files.map(async (file) => {
+            const fullPath = join(projectPath, file);
+            try {
+                const content = await readFile(fullPath, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (line !== undefined && regex.test(line)) {
+                        evidence.push(`${file}:${i + 1}`);
+                        regex.lastIndex = 0;
                     }
                 }
-                catch {
-                    // Skip unreadable files
-                }
-            }));
-        }
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }));
     }
     const matchCount = evidence.length;
     const passed = checkType === 'grep_absent' ? matchCount === 0 : matchCount >= config.expected;

package/dist/security/adapters/macos-keychain.d.ts

@@ -1,15 +1,17 @@
-import type { MacOSKeychainNativePort, MacOSKeychainOperation, SecretStoreAdapter } from '../../types/security.js';
+import type { MacOSKeychainOperation, SecretStoreAdapter } from '../../types/security.js';
 export declare class MacOSKeychainOperationError extends Error {
     readonly code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN';
     constructor(code: 'KEYCHAIN_TIMEOUT' | 'KEYCHAIN_OUTCOME_UNKNOWN', operation: MacOSKeychainOperation);
 }
 export declare class MacOSKeychainAdapter implements SecretStoreAdapter {
-    private readonly nativePort;
+    private readonly run;
     private readonly timeoutMs;
     readonly kind: 'macos-keychain';
     private readonly pending;
     private nextFence;
-    constructor(nativePort?: () => MacOSKeychainNativePort, timeoutMs?: number);
+    constructor(run?: (args: string[]) => Promise<{
+        stdout: string;
+    }>, timeoutMs?: number);
     get(id: string): Promise<string | null>;
     set(id: string, value: string): Promise<void>;
     delete(id: string): Promise<void>;

package/dist/security/adapters/macos-keychain.js

@@ -1,6 +1,20 @@
-import { requireMacOSKeychainNativePort } from '../../engine/core-bridge.js';
+import { execFile as execFileCallback } from 'node:child_process';
+import { promisify } from 'node:util';
+import { reportClassifiedDegradation } from '../../errors/classified-degradation.js';
+const execFile = promisify(execFileCallback);
 const TIMEOUT_MS = 10_000;
-const decoder = new TextDecoder('utf-8', { fatal: true });
+const SERVICE_LABEL = 'Planu';
+const MISSING_ITEM_EXIT_CODE = 44;
+async function defaultSecurityRun(args) {
+    return execFile('/usr/bin/security', args, { timeout: TIMEOUT_MS });
+}
+function isMissingCredentialExit(error) {
+    const failure = error;
+    return failure.code === MISSING_ITEM_EXIT_CODE || failure.code === String(MISSING_ITEM_EXIT_CODE);
+}
+function stripTrailingNewline(value) {
+    return value.endsWith('\n') ? value.slice(0, -1) : value;
+}
 export class MacOSKeychainOperationError extends Error {
     code;
     constructor(code, operation) {
@@ -12,13 +26,13 @@ export class MacOSKeychainOperationError extends Error {
     }
 }
 export class MacOSKeychainAdapter {
-    nativePort;
+    run;
     timeoutMs;
     kind = 'macos-keychain';
     pending = new Map();
     nextFence = 0;
-    constructor(nativePort = requireMacOSKeychainNativePort, timeoutMs = TIMEOUT_MS) {
-        this.nativePort = nativePort;
+    constructor(run = defaultSecurityRun, timeoutMs = TIMEOUT_MS) {
+        this.run = run;
         this.timeoutMs = timeoutMs;
         if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
             throw new Error('[Planu] macOS Keychain timeout must be a positive integer');
@@ -26,31 +40,78 @@ export class MacOSKeychainAdapter {
     }
     get(id) {
         return this.enqueue(id, 'get', false, async () => {
-            const secret = await this.nativePort().get(id);
-            if (secret === null) {
-                return null;
-            }
             try {
-                return decoder.decode(secret);
+                const result = await this.run([
+                    'find-generic-password',
+                    '-a',
+                    id,
+                    '-s',
+                    SERVICE_LABEL,
+                    '-w',
+                ]);
+                return Buffer.from(stripTrailingNewline(result.stdout), 'base64').toString('utf8');
             }
-            finally {
-                secret.fill(0);
+            catch (error) {
+                if (isMissingCredentialExit(error)) {
+                    return null;
+                }
+                throw error;
             }
         });
     }
     set(id, value) {
-        return this.enqueue(id, 'set', true, () => {
-            const secret = Buffer.from(value, 'utf8');
+        return this.enqueue(id, 'set', true, async () => {
             try {
-                return this.nativePort().set(id, secret);
+                await this.run(['delete-generic-password', '-a', id, '-s', SERVICE_LABEL]);
+            }
+            catch (error) {
+                if (!isMissingCredentialExit(error)) {
+                    throw error;
+                }
+                reportClassifiedDegradation('MACOS_SECRET_DELETE', error);
             }
-            finally {
-                secret.fill(0);
+            const encoded = Buffer.from(value, 'utf8').toString('base64');
+            await this.run([
+                'add-generic-password',
+                '-T',
+                '/usr/bin/security',
+                '-a',
+                id,
+                '-s',
+                SERVICE_LABEL,
+                '-w',
+                encoded,
+            ]);
+            try {
+                await this.run([
+                    'set-generic-password-partition-list',
+                    '-S',
+                    'apple:,apple-tool:',
+                    '-s',
+                    SERVICE_LABEL,
+                    '-a',
+                    id,
+                    '-k',
+                    '',
+                ]);
+            }
+            catch (error) {
+                reportClassifiedDegradation('MACOS_SECRET_PARTITION', error);
             }
         });
     }
     delete(id) {
-        return this.enqueue(id, 'delete', true, () => this.nativePort().delete(id));
+        return this.enqueue(id, 'delete', true, async () => {
+            try {
+                await this.run(['delete-generic-password', '-a', id, '-s', SERVICE_LABEL]);
+            }
+            catch (error) {
+                if (!isMissingCredentialExit(error)) {
+                    throw error;
+                }
+                reportClassifiedDegradation('MACOS_SECRET_DELETE', error);
+            }
+        });
     }
     enqueue(id, operation, mutates, execute) {
         const predecessor = this.pending.get(id)?.settled ?? Promise.resolve();

package/dist/tools/create-spec/autopilot-analyzer.d.ts

@@ -20,7 +20,7 @@ export declare function getEmptyAutopilotResult(): AutopilotAnalysis;
  * Analyze the project to enrich a spec with real file paths and patterns.
  * Runs automatically during create_spec — no user interaction needed.
  */
-export declare function analyzeProjectForSpec(projectPath: string, description: string, title: string, _knowledge: ProjectKnowledge | null, signal?: AbortSignal): Promise<AutopilotAnalysis>;
+export declare function analyzeProjectForSpec(projectPath: string, description: string, title: string, _knowledge: ProjectKnowledge | null): Promise<AutopilotAnalysis>;
 /**
  * SPEC-619 AC1: Detect broad-scope descriptions that mention 2+ major subsystems.
  * When true, create_spec should ask clarifying questions before proceeding.

package/dist/tools/create-spec/autopilot-analyzer.js

@@ -17,7 +17,7 @@ export function getEmptyAutopilotResult() {
  * Analyze the project to enrich a spec with real file paths and patterns.
  * Runs automatically during create_spec — no user interaction needed.
  */
-export async function analyzeProjectForSpec(projectPath, description, title, _knowledge, signal) {
+export async function analyzeProjectForSpec(projectPath, description, title, _knowledge) {
     const result = {
         suggestedFiles: { create: [], modify: [], test: [] },
         detectedPatterns: [],
@@ -44,7 +44,7 @@ export async function analyzeProjectForSpec(projectPath, description, title, _kn
     const keywords = extractKeywordsScorer(`${title} ${description}`);
     // Scan project files to find semantically related ones
     try {
-        const relatedFiles = await findRelevantFiles(projectPath, keywords, 10, signal);
+        const relatedFiles = await findRelevantFiles(projectPath, keywords, 10);
         if (relatedFiles.length === 0) {
             result.noRelatedFilesMessage =
                 'No related files detected — please populate ## Technical manually';

package/dist/tools/create-spec/relevance-scorer.d.ts

@@ -14,5 +14,5 @@ export declare function scoreFile(filePath: string, keywords: Set<string>): Prom
  * Scans `src/**\/\*.ts` and `tests/**\/\*.ts` under projectPath,
  * scores each, drops score=0 entries, returns top-`limit` by descending score.
  */
-export declare function findRelevantFiles(projectPath: string, keywords: Set<string>, limit?: number, signal?: AbortSignal): Promise<string[]>;
+export declare function findRelevantFiles(projectPath: string, keywords: Set<string>, limit?: number): Promise<string[]>;
 //# sourceMappingURL=relevance-scorer.d.ts.map

package/dist/tools/create-spec/relevance-scorer.js

@@ -4,9 +4,6 @@
 import { readFile } from 'node:fs/promises';
 import { glob } from 'glob';
 import { join } from 'node:path';
-import { isNativeActive } from '../../engine/core-bridge.js';
-import { runNativeWorkerOperation } from '../../engine/execution/native-worker-runtime.js';
-import { hashProjectPath } from '../../storage/base-store.js';
 /** Stop words to exclude from keyword extraction. */
 const STOP_WORDS = new Set([
     // English stop words
@@ -136,23 +133,10 @@ export async function scoreFile(filePath, keywords) {
  * Scans `src/**\/\*.ts` and `tests/**\/\*.ts` under projectPath,
  * scores each, drops score=0 entries, returns top-`limit` by descending score.
  */
-export async function findRelevantFiles(projectPath, keywords, limit = 10, signal) {
+export async function findRelevantFiles(projectPath, keywords, limit = 10) {
     if (keywords.size === 0) {
         return [];
     }
-    if (isNativeActive()) {
-        const result = await runNativeWorkerOperation({
-            projectId: hashProjectPath(projectPath),
-            operation: 'find-relevant-files',
-            payload: { rootPath: projectPath, keywords: [...keywords], limit },
-            deadlineAt: Date.now() + 5_000,
-            signal,
-        });
-        if (!Array.isArray(result) || !result.every((filePath) => typeof filePath === 'string')) {
-            throw new Error('[Planu] Native relevance worker returned an invalid payload');
-        }
-        return result;
-    }
     const patterns = [join(projectPath, 'src/**/*.ts'), join(projectPath, 'tests/**/*.ts')];
     const candidates = [];
     for (const pattern of patterns) {

package/dist/tools/create-spec.js

@@ -1099,7 +1099,7 @@ async function prepareCreateSpecCandidate(initialParams, server) {
     if (constitutionCheck.blocked && constitutionCheck.errorResult) {
         return earlyPreparation(constitutionCheck.errorResult);
     }
-    const inlineAnalysis = await withBudget('create-spec-inline-analysis', getRuntimePolicy().createSpec.inlineAnalysisBudgetMs, (signal) => analyzeProjectForSpec(params.projectPath ?? '', params.description, spec.title, knowledge, signal));
+    const inlineAnalysis = await withBudget('create-spec-inline-analysis', getRuntimePolicy().createSpec.inlineAnalysisBudgetMs, () => analyzeProjectForSpec(params.projectPath ?? '', params.description, spec.title, knowledge));
     const autopilot = unwrapBudget(inlineAnalysis, getEmptyAutopilotResult());
     if (autopilot.isIdea) {
         return earlyPreparation({

package/dist/types/atomic-upgrade.d.ts

@@ -21,9 +21,7 @@ export interface UpgradeJournal {
 export interface ReleaseVerificationReport {
     version: string;
     cliPackage: string;
-    nativePackage: string;
     cliVerified: true;
-    nativeVerified: true;
     mcpSmokeVerified: true;
     canaryVerified: true;
     verifiedAt: string;

package/dist/types/core-bridge.d.ts

@@ -1,4 +1,3 @@
-import type { SpecAnnotation } from './living-spec/annotations.js';
 export type { SpecAnnotation } from './living-spec/annotations.js';
 export interface FileHash {
     path: string;
@@ -9,79 +8,6 @@ export interface FileMetadata {
     mtime: number;
     size: number;
 }
-/** Versioned contract returned by a native runtime before it may execute work. */
-export interface NativeRuntimeHandshake {
-    engineVersion: string;
-    buildId: string;
-    protocolAbi: number;
-    capabilityAbi: number;
-    nodeApiAbi: number;
-    capabilities: string[];
-    storageSchemaMin: number;
-    storageSchemaMax: number;
-    target: string;
-}
-/** Externally generated release metadata stored next to the native artifact. */
-export interface NativeArtifactManifest extends NativeRuntimeHandshake {
-    schemaVersion: 2;
-    cliVersion: string;
-    artifactSha256: string;
-    platform: NodeJS.Platform;
-    arch: string;
-    libc: 'glibc' | 'musl' | null;
-    sbom: {
-        format: 'CycloneDX-1.5';
-        path: string;
-        sha256: string;
-    };
-    provenance: {
-        builder: string;
-        sourceCommit: string;
-        sourceTreeDirty: boolean;
-        sourceDateEpoch: number;
-        rustToolchain: string;
-        zigVersion: string | null;
-    };
-    signature: {
-        algorithm: 'Ed25519';
-        keyId: string;
-        value: string;
-    };
-}
-export interface NativeRuntimeCompatibility {
-    compatible: boolean;
-    reasons: string[];
-    handshake: NativeRuntimeHandshake | null;
-}
-export type NativeFallbackClass = 'optimization' | 'correctness-critical';
-export type NativeFallbackMode = 'typescript-visible-degradation' | 'fail-closed';
-export interface NativeCapabilityPolicy {
-    readonly capability: string;
-    readonly classification: NativeFallbackClass;
-    readonly fallback: NativeFallbackMode;
-    readonly parityContract: string;
-}
-export interface NativeCapabilityDiagnostic {
-    capability: string;
-    state: 'available' | 'degraded' | 'unavailable';
-    fallback: NativeFallbackMode;
-}
-export interface NativeLoadDiagnostic {
-    attempted: string[];
-    errors: string[];
-    loaded?: string;
-    artifactSha256?: string;
-    origin?: 'local' | 'package';
-    compatibility?: NativeRuntimeCompatibility;
-    rejectedOverrides?: string[];
-    capabilities?: NativeCapabilityDiagnostic[];
-    executionScope?: 'isolated-worker-and-keychain-port';
-}
-export interface NativePlatformInfo {
-    platform: NodeJS.Platform;
-    arch: string;
-    libc: 'glibc' | 'musl' | null;
-}
 export interface DriftResult {
     foundKeywords: string[];
     fileCount: number;
@@ -207,38 +133,4 @@ export interface ProjectGraphNeighborRs {
     edgeId: string;
     relation: string;
 }
-export interface PlanuCore {
-    /** Mandatory for runtimes loaded by the versioned bridge. */
-    planuRuntimeHandshake?(): NativeRuntimeHandshake;
-    hashProjectPath(projectPath: string): string;
-    isSafeProjectId(projectId: string): boolean;
-    getProjectDataPath(baseDir: string, project_id: string): string | null;
-    scanAndHashFiles(rootPath: string): FileHash[];
-    scanProjectMetadata(rootPath: string): FileMetadata[];
-    scanSpecAnnotations(rootPath: string): SpecAnnotation[];
-    checkAcCoverage(filePaths: string[], keywords: string[]): string[];
-    fastDetectDriftParallel(rootPath: string, keywords: string[]): DriftResult;
-    fastFindDuplicateBlocks(paths: string[], minLines: number): DuplicateRawBlockRs[];
-    fastFindPatterns(rootPath: string, patterns: string[], extensions: string[], exclude: string[]): FastGrepMatch[];
-    fastFindFilesByName(rootPath: string, names: string[]): string[];
-    fastFindFilesByExt(rootPath: string, extensions: string[]): string[];
-    fastReadFiles(paths: string[]): FileContent[];
-    fastScanSpecs(rootPath: string): SpecBriefRs[];
-    fastVerifyGapsChain(filePath: string): GapsLogChainResultRs;
-    fastAppendGapEntry(filePath: string, id: string, timestamp: string, specId: string, description: string, severity: string, affectedSpecs: string[]): string;
-    fastCosineSimilarity(v1: number[], v2: number[]): number;
-    fastHnswSearchFlat(query: number[], nodes: VectorNode[], topK: number): NativeVectorSearchResult[];
-    fastHmacSign(secret: string, data: string): string;
-    fastHmacVerify(secret: string, data: string, signature: string): boolean;
-    macosKeychainSet?(account: string, secret: Buffer): Promise<void>;
-    macosKeychainGet?(account: string): Promise<Buffer | null>;
-    macosKeychainDelete?(account: string): Promise<void>;
-    scanProjectGraphSources?(rootPath: string, limits: ResolvedProjectGraphLimitsRs): ProjectGraphSourceFileRs[];
-    extractTsRelations?(rootPath: string, paths: string[], limits: ResolvedProjectGraphLimitsRs): TsRelationRs[];
-    queryAffectedNodes?(seed: string, edges: GraphEdgeInputRs[], relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): AffectedNodeRs[];
-    queryAffectedNodesCompact?(seed: string, edges: CompactGraphEdgesRs, relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): AffectedNodeRs[];
-    queryShortestPath?(from: string, to: string, edges: GraphEdgeInputRs[], relationFilter: string[], limits: ResolvedProjectGraphLimitsRs): ShortestPathResultRs;
-    selectCompactGraphSlice?(seeds: string[], nodes: GraphNodeInputRs[], edges: GraphEdgeInputRs[], limits: ResolvedProjectGraphLimitsRs): CompactGraphSliceRs;
-    selectCompactGraphSliceCompact?(seeds: string[], nodeIds: string[], edges: CompactGraphEdgesRs, limits: ResolvedProjectGraphLimitsRs): CompactGraphSliceRs;
-}
 //# sourceMappingURL=core-bridge.d.ts.map

package/dist/types/core-bridge.js

@@ -1,3 +1,3 @@
-// src/types/core-bridge.ts — Types for the native Rust engine
+// src/types/core-bridge.ts — Types for the TypeScript fallback engine
 export {};
 //# sourceMappingURL=core-bridge.js.map

package/dist/types/durable-job.d.ts

@@ -1,5 +1,3 @@
-import type { DurableJobRecord } from '../storage/runtime-db.js';
-import type { NativeWorkerCall, NativeWorkerOperation } from './native-worker.js';
 import type { ValidationArtifactDigests, ValidationFreshnessLease } from './validation-receipt.js';
 export interface DurableJobIdentity {
     readonly operationId: string;
@@ -15,13 +13,6 @@ export interface WatchJobInput extends DurableJobIdentity {
 export interface DurableJobRuntimeOptions {
     readonly databasePath?: string;
 }
-export interface NativeDurableJobPayload {
-    readonly kind: 'native-worker';
-    readonly operation: NativeWorkerOperation;
-    readonly payload: Readonly<Record<string, unknown>>;
-    readonly deadlineAt: number;
-    readonly cancellationId?: string;
-}
 export interface ValidateDurableJobPayload {
     readonly kind: 'validate';
     readonly schemaVersion: 2;
@@ -44,35 +35,4 @@ export interface ValidateDurableJobPayload {
     readonly freshnessLease?: ValidationFreshnessLease;
     readonly specPath: string;
 }
-export type NativeWorkerRunner = (call: NativeWorkerCall) => Promise<unknown>;
-export interface DurableJobExecutorOptions {
-    readonly runtime: {
-        list(projectId: string, workspaceId?: string): readonly DurableJobRecord[];
-        claim(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly leaseMs: number;
-        }): DurableJobRecord | undefined;
-        renew(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly leaseMs: number;
-            readonly fencingToken: number;
-        }): boolean;
-        get(input: DurableJobIdentity): DurableJobRecord;
-        complete(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly fencingToken: number;
-            readonly result: unknown;
-        }): DurableJobRecord;
-        fail(input: DurableJobIdentity & {
-            readonly workerId: string;
-            readonly fencingToken: number;
-            readonly error: string;
-        }): DurableJobRecord;
-    };
-    readonly workerId: string;
-    readonly leaseMs?: number;
-    readonly heartbeatMs?: number;
-    readonly maxConcurrency?: number;
-    readonly runNative?: NativeWorkerRunner;
-}
 //# sourceMappingURL=durable-job.d.ts.map

package/dist/types/security.d.ts

@@ -97,11 +97,6 @@ export interface SecurityPatternsConfig {
     complianceCriteria: Record<string, string[]>;
 }
 export type SecretStoreKind = 'macos-keychain' | 'linux-secret-service' | 'windows-credential-manager' | 'environment';
-export interface MacOSKeychainNativePort {
-    set(account: string, secret: Buffer): Promise<void>;
-    get(account: string): Promise<Buffer | null>;
-    delete(account: string): Promise<void>;
-}
 export type MacOSKeychainOperation = 'get' | 'set' | 'delete';
 export interface MacOSKeychainPendingOperation {
     readonly fence: number;