@planu/cli 5.3.5 → 5.3.7

package/CHANGELOG.md

@@ -1,3 +1,53 @@
+## [5.3.7] - 2026-08-08
+
+### Bug Fixes
+- fix(scope-boundaries): split sentences regardless of next-sentence casing
+- fix(validate): fail lint on timeout and bound unbounded validate gates
+- fix(spec-1450): anchor scope-contradiction substring checks to word boundaries
+
+### Chores
+- chore(spec-1453): redact local home path from reproducer
+- chore(planu): record SPEC-1449 and SPEC-1450 done transitions
+- chore(spec-1450): integrate scope-contradiction matching after arbitrated review
+- chore(spec-1449): integrate validate gate timeouts after dual-provider approve
+- chore(specs): cut speculative scope from the skills backlog
+- chore(spec-1449): approve after 6-round independent review + Discovery evidence
+- chore(deps): override nanoid to >=3.3.17 for GHSA-2v37-7h3g-55p8
+- chore(planu): sync session state after SPEC-1449/1450 review cycle
+
+
+## [5.3.6] - 2026-08-07
+
+### Bug Fixes
+- fix(spec-1404): make filesystem hook watcher observation-only
+- fix(spec-1427): recognize exposed/exposes as affirmative scope drift
+- fix(spec-1427): stop scope-contradiction check from flagging boundary-preserving criteria
+- fix(spec-1415): arbitrate independent Codex review, harden fence and marker matching
+- fix(spec-1415): heal 35 truncated spec.md bodies with a one-shot script
+- fix(spec-migrator): preserve actionable estimation during portable spec import
+- fix(spec-1429): cover the two untested acceptance criteria and correct stale claims
+- fix(tests): match CLAUDE.md's current canonical release gate commands
+- fix(spec-format): stop discarding BDD criteria mixed with checklist bullets
+- fix(challenge-spec): count the challenge gate requirement against distinct scenario names
+
+### Refactoring
+- refactor(spec-migrator): extract importSpecEntry to satisfy max-lines-per-function
+
+### Chores
+- chore(planu): redact absolute home path from public spec reproducers
+- chore(planu): sync session state after SPEC-1403/1404 closure
+- chore(spec-1404): mark done after independent implementation review
+- chore(planu): move SPEC-1449/1450 to review with challenge resolution evidence
+- chore(planu): file SPEC-1449/1450 dogfood bugs, sync session state
+- chore(spec-1427): mark spec done and drop duplicate test ownership entry
+- chore(spec-1415): reconcile Files scope for done gate, file SPEC-1447 dogfood bug
+- chore(planu): approve SPEC-1415 after challenge/grounding gate fixes
+- chore(planu): sync SDD lifecycle state for SPEC-1404/1415/1427, file SPEC-1445/1446
+- chore(planu): mark SPEC-1429 and SPEC-1431 done, file SPEC-1443/1444
+- chore(planu): sync session-context checkpoint
+- chore(planu): close 8 verified-stale backlog specs
+
+
 ## [5.3.5] - 2026-08-06
 
 ### Bug Fixes

package/dist/config/runtime-policy.json

@@ -29,6 +29,7 @@
   "validation": {
     "defaultDeadlineMs": 1800000,
     "durableLintTimeoutMs": 150000,
+    "perGateTimeoutMs": 180000,
     "complianceCommandTimeoutMs": 900000,
     "noProgressTimeoutMs": 960000,
     "submissionLockWaitMs": 180,

package/dist/engine/convention-scanner/codebase-scanner.js

@@ -7,7 +7,7 @@ const MAX_VIOLATIONS_PER_CATEGORY = 50;
 // ── helpers ───────────────────────────────────────────────────────────────────
 function execSafe(cmd, cwd) {
     try {
-        return execSync(cmd, { cwd, stdio: ['pipe', 'pipe', 'pipe'] }).toString();
+        return execSync(cmd, { cwd, timeout: 5_000, stdio: ['pipe', 'pipe', 'pipe'] }).toString();
     }
     catch {
         return '';

package/dist/engine/hooks/handlers/on-impl-change.d.ts

@@ -13,6 +13,18 @@ export declare function recordAnalysisTimestamp(specId: string, nowMs?: number,
  * Clear all rate limit timestamps (for testing).
  */
 export declare function clearRateLimitTimestamps(): void;
+/**
+ * Get the cached result from the last on-impl-change analysis.
+ * If projectPath is omitted, returns the most recently set result across all projects.
+ */
+export declare function getLastImplChangeResult(projectPath?: string): ImplChangeAnalysisResult | null;
+/**
+ * Reset the on-impl-change diagnostic cache.
+ * If projectPath is provided, clears only that project's cache.
+ * If omitted, clears all projects.
+ * Useful for testing.
+ */
+export declare function resetImplChangeCache(projectPath?: string): void;
 /**
  * Returns true for src/**\/*.ts files, excluding test files.
  * Test files are identified by the .test.ts or .spec.ts suffix.
@@ -26,9 +38,10 @@ export declare function findRelatedSpecs(filePath: string, specs: MinimalAnalyza
 /**
  * Handle an implementation file change event.
  * Fire-and-forget — all errors are caught internally.
- * When specs array and analyzeSpec function are provided, analyzes related specs.
- * When autoMarkDone is true (default), specs reaching 100% are automatically
- * transitioned to 'done' status via the spec store.
+ * When specs array and analyzeSpec function are provided, analyzes related specs
+ * and records the result as a diagnostic (see getLastImplChangeResult). It never
+ * transitions spec lifecycle status or writes spec.md — that requires an explicit
+ * reconcile_spec / update_status call by the user (SPEC-1404).
  */
-export declare function handleOnImplChange(event: WatcherEvent, projectPath: string, specs?: MinimalAnalyzableSpec[], analyzeSpec?: AnalyzeSpecFn, autoMarkDone?: boolean): Promise<ImplChangeAnalysisResult | undefined>;
+export declare function handleOnImplChange(event: WatcherEvent, projectPath: string, specs?: MinimalAnalyzableSpec[], analyzeSpec?: AnalyzeSpecFn): Promise<ImplChangeAnalysisResult | undefined>;
 //# sourceMappingURL=on-impl-change.d.ts.map

package/dist/engine/hooks/handlers/on-impl-change.js

@@ -1,8 +1,7 @@
 // engine/hooks/handlers/on-impl-change.ts — on-impl-change hook handler (SPEC-137)
 // Triggered when source implementation files (src/**/*.ts) change.
-// Analyzes related specs, updates completion percentage, auto-reconciles if all criteria met.
-import { hashProjectPath } from '../../../storage/base-store.js';
-const UPDATE_STATUS_MODULE = '../../../tools/update-status/index.js';
+// Analyzes related specs and reports completion percentage as a diagnostic —
+// it never mutates spec lifecycle state (SPEC-1404).
 // ---------------------------------------------------------------------------
 // Rate limiter (per spec, 5 min cooldown)
 // ---------------------------------------------------------------------------
@@ -40,6 +39,38 @@ export function clearRateLimitTimestamps() {
     lastAnalysisTimestamps.clear();
 }
 // ---------------------------------------------------------------------------
+// Diagnostic cache (per-project, mirrors on-push-check.ts's cache pattern)
+// ---------------------------------------------------------------------------
+const lastImplChangeResultMap = new Map();
+/**
+ * Get the cached result from the last on-impl-change analysis.
+ * If projectPath is omitted, returns the most recently set result across all projects.
+ */
+export function getLastImplChangeResult(projectPath) {
+    if (projectPath !== undefined) {
+        return lastImplChangeResultMap.get(projectPath) ?? null;
+    }
+    let last = null;
+    for (const v of lastImplChangeResultMap.values()) {
+        last = v;
+    }
+    return last;
+}
+/**
+ * Reset the on-impl-change diagnostic cache.
+ * If projectPath is provided, clears only that project's cache.
+ * If omitted, clears all projects.
+ * Useful for testing.
+ */
+export function resetImplChangeCache(projectPath) {
+    if (projectPath !== undefined) {
+        lastImplChangeResultMap.delete(projectPath);
+    }
+    else {
+        lastImplChangeResultMap.clear();
+    }
+}
+// ---------------------------------------------------------------------------
 // Pattern matching
 // ---------------------------------------------------------------------------
 /**
@@ -98,11 +129,12 @@ export function findRelatedSpecs(filePath, specs) {
 /**
  * Handle an implementation file change event.
  * Fire-and-forget — all errors are caught internally.
- * When specs array and analyzeSpec function are provided, analyzes related specs.
- * When autoMarkDone is true (default), specs reaching 100% are automatically
- * transitioned to 'done' status via the spec store.
+ * When specs array and analyzeSpec function are provided, analyzes related specs
+ * and records the result as a diagnostic (see getLastImplChangeResult). It never
+ * transitions spec lifecycle status or writes spec.md — that requires an explicit
+ * reconcile_spec / update_status call by the user (SPEC-1404).
  */
-export async function handleOnImplChange(event, projectPath, specs, analyzeSpec, autoMarkDone = true) {
+export async function handleOnImplChange(event, projectPath, specs, analyzeSpec) {
     try {
         if (!isSourceFile(event.path)) {
             return;
@@ -133,53 +165,20 @@ export async function handleOnImplChange(event, projectPath, specs, analyzeSpec,
             });
             if (result.completionPct === 100) {
                 autoReconciled = true;
-                console.warn(`[hooks] Auto-reconcile triggered for ${spec.id} (100% completion)`);
-                if (autoMarkDone) {
-                    await markSpecDone(spec.id, projectPath);
-                }
+                console.warn(`[hooks] Spec ${spec.id} reached 100% completion (diagnostic only)`);
             }
         }
-        return {
+        const analysisResult = {
             changedFile: event.path,
             specsAnalyzed: results,
             autoReconciled,
         };
+        lastImplChangeResultMap.set(projectPath, analysisResult);
+        return analysisResult;
     }
     catch (err) {
         console.warn(`[hooks] on-impl-change error for ${event.path}:`, err);
         return undefined;
     }
 }
-// ---------------------------------------------------------------------------
-// Auto-done helper
-// ---------------------------------------------------------------------------
-/**
- * Mark a spec as 'done' in the spec store.
- * Errors are logged but not re-thrown so the hook pipeline continues.
- */
-async function markSpecDone(specId, projectPath) {
-    try {
-        const projectId = hashProjectPath(projectPath);
-        // SPEC-720: Route through handleUpdateStatus so all gates (DoD/validate/QA) run.
-        const updateStatusModule = (await import(UPDATE_STATUS_MODULE));
-        const result = await updateStatusModule.handleUpdateStatus({
-            specId,
-            status: 'done',
-            projectId,
-            projectPath,
-            trigger: 'fs-hook',
-            actor: 'system',
-        });
-        if (result.isError) {
-            const reason = result.content[0]?.type === 'text' ? result.content[0].text : 'gate blocked';
-            console.warn(`[hooks] Auto-done blocked for ${specId} (gates): ${reason}`);
-        }
-        else {
-            console.warn(`[hooks] Auto-done: spec ${specId} marked as 'done' via update_status gates`);
-        }
-    }
-    catch (err) {
-        console.warn(`[hooks] Auto-done failed for ${specId}:`, err);
-    }
-}
 //# sourceMappingURL=on-impl-change.js.map

package/dist/engine/living-spec-analyzer.d.ts

@@ -1,7 +1,10 @@
-import type { Spec, LivingSpecReport } from '../types/index.js';
+import type { Spec, LivingSpecReport, AnalyzeLivingSpecOptions } from '../types/index.js';
 /**
  * Analyze a spec's acceptance criteria against the codebase.
  * Returns a per-criterion assessment and overall completion percentage.
+ * Does not write ## Progress into spec.md unless options.writeProgress is true —
+ * callers that document a Progress write (reconcile_spec, auto-reconcile) opt in
+ * explicitly (SPEC-1404).
  */
-export declare function analyzeLivingSpec(spec: Spec, projectPath: string): Promise<LivingSpecReport>;
+export declare function analyzeLivingSpec(spec: Spec, projectPath: string, options?: AnalyzeLivingSpecOptions): Promise<LivingSpecReport>;
 //# sourceMappingURL=living-spec-analyzer.d.ts.map

package/dist/engine/living-spec-analyzer.js

@@ -12,8 +12,11 @@ const MAX_FILES_TO_SCAN = 80;
 /**
  * Analyze a spec's acceptance criteria against the codebase.
  * Returns a per-criterion assessment and overall completion percentage.
+ * Does not write ## Progress into spec.md unless options.writeProgress is true —
+ * callers that document a Progress write (reconcile_spec, auto-reconcile) opt in
+ * explicitly (SPEC-1404).
  */
-export async function analyzeLivingSpec(spec, projectPath) {
+export async function analyzeLivingSpec(spec, projectPath, options = {}) {
     const criteria = await extractCriteria(spec);
     const assessments = [];
     // Pre-load file index for the project (cached for all criteria)
@@ -30,7 +33,7 @@ export async function analyzeLivingSpec(spec, projectPath) {
     // SPEC-1010 PR-C: Write living spec analysis into the unified spec.md
     // ## Progress section instead of a standalone progress.md file.
     let progressUpdated = false;
-    if (spec.specPath) {
+    if (options.writeProgress === true && spec.specPath) {
         progressUpdated = await updateProgressInSpec(spec.specPath, assessments, completionPercent);
     }
     else if (spec.progressPath) {

package/dist/engine/planu-core.darwin-arm64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-aarch64-apple-darwin",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-aarch64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "arm64",
   "libc": null,
-  "artifactSha256": "27b347bd91597ca547e26cf2eb25f4e7d7d7ec83ed405511bf8b80a52075b6a5",
+  "artifactSha256": "5969aa547241ec63357a76a7019c62ff3daa81a8396f650e1f795cc7f1e81158",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-arm64.node.sbom.json",
-    "sha256": "cdacedfbf96f09a8815ea3b5b293d4d688d0a1216d5ac8e309c3031703144b76"
+    "sha256": "757ec9b87c1e0f2cbcd96194fa9d0c97f728b6c42789ea547f303d920e6bb542"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "V5w31e1ARajB+tq5/Zuqn/I6AS9upApk4U+3MQudZRJNXMsp+LynzSTuHb8Eg9G6AiXJxt88ZRtqJbAo2b0DAg=="
+    "value": "Ia+76Z663Ktv2bkf8x7TjdNXGsA/l8pCasDiSYsJmCbJ01jVxqO+qcRZ7ayNq6wrZ7/vD/OR4YyDhAv5bQvqBg=="
   }
 }

package/dist/engine/planu-core.darwin-arm64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.5",
+      "bom-ref": "pkg:cargo/planu-core@5.3.7",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.5",
+      "version": "5.3.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "27b347bd91597ca547e26cf2eb25f4e7d7d7ec83ed405511bf8b80a52075b6a5"
+          "content": "5969aa547241ec63357a76a7019c62ff3daa81a8396f650e1f795cc7f1e81158"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.5",
+      "ref": "pkg:cargo/planu-core@5.3.7",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.darwin-x64.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-x86_64-apple-darwin",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-x86_64-apple-darwin",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -17,15 +17,15 @@
   "platform": "darwin",
   "arch": "x64",
   "libc": null,
-  "artifactSha256": "7993a3dc2ff7947eb227812e88b329e870fd0e8b7b3ad152796bef8d77387745",
+  "artifactSha256": "53ce7d511df238b0fd1831ad04bc707b49595aeec2cf17cb010e292bdd0783db",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.darwin-x64.node.sbom.json",
-    "sha256": "cc3be430ad14a4bb6f233e60c7fccb055079b3f3aa0208c6e6f8eca9ee47e7a3"
+    "sha256": "fb6e23c6c74daed13132788a88c1d02b348d392baabeeda70d14d2f291830b29"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -34,6 +34,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "lL4RDYXTj5JyMi4aPH4Dq9r7u45cD/onxAOOGeQJglIrLryYfLTgvUw0bCxLIExD4LghbskIpbMO5RoxilsTCA=="
+    "value": "qk6XvA4l7UGWmK2xYdpnkdSp6FizRrviTgz8bXsKMohnF+X5epsXZKADWMOQuMOaD956mzmkAj35D+oJFsDxDw=="
   }
 }

package/dist/engine/planu-core.darwin-x64.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.5",
+      "bom-ref": "pkg:cargo/planu-core@5.3.7",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.5",
+      "version": "5.3.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "7993a3dc2ff7947eb227812e88b329e870fd0e8b7b3ad152796bef8d77387745"
+          "content": "53ce7d511df238b0fd1831ad04bc707b49595aeec2cf17cb010e292bdd0783db"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.5",
+      "ref": "pkg:cargo/planu-core@5.3.7",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-aarch64-unknown-linux-gnu",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-aarch64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "glibc",
-  "artifactSha256": "58667d7bf48d685e0a68845bf986ab76d7669909994649fed71b76b5e19c0fd9",
+  "artifactSha256": "e028b42de742bd6fa24701f16fd98d1612c99910dd65b17c48397f7203ac9a67",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-gnu.node.sbom.json",
-    "sha256": "e167309ef0c22da6bbb804b6e59c64a2777aba539a718cd9225f2a5ffe16253f"
+    "sha256": "d832a0f7e5270482b8d9dc7aed5d5d8343ab692b35f9844c464cb211b0336c89"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "jPABgCINF4cuTxCuWa2h5suwGdPzU0lXP7oL45TvpMv8A1YP/Q5Lt4w/DIqRYYjlWzsqk228wu0O5f5V+S+kDw=="
+    "value": "T/tkZC0rxSANsXzAc7BPR/XuGXyF2Q80FlgZmlxOptgLFHNzPvMajWoryBvAPLo5M5/hgd1vfQrGdQUo4VwwAw=="
   }
 }

package/dist/engine/planu-core.linux-arm64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.5",
+      "bom-ref": "pkg:cargo/planu-core@5.3.7",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.5",
+      "version": "5.3.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "58667d7bf48d685e0a68845bf986ab76d7669909994649fed71b76b5e19c0fd9"
+          "content": "e028b42de742bd6fa24701f16fd98d1612c99910dd65b17c48397f7203ac9a67"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.5",
+      "ref": "pkg:cargo/planu-core@5.3.7",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-arm64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-aarch64-unknown-linux-musl",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-aarch64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "arm64",
   "libc": "musl",
-  "artifactSha256": "948e76211c8b7a4770c9f79e172184baf13fa7208a06cc149b6cd168ef5c1cf6",
+  "artifactSha256": "8088eca500977faa73bd856bfe230255496cadc0e6dedbe507b12f2a785bb842",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-arm64-musl.node.sbom.json",
-    "sha256": "fe1febc4c73090f46d5513ac83d98fa5fcc69b50b82aea2a9eb9bfc9943d9f58"
+    "sha256": "a9da9e9d6fe66aeb38d3b2a171070e5cff569165c338cfaf8dc7e9f9cc2111d5"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "W8DaJ4zBO7CgzNQ8Ygt3Fsq76sLt2AZgzRzfZLN2cxvOEsTK/aS+KgM/JpSfKbuv45c7wBgM5jUvLSPIh/qTAw=="
+    "value": "jg+UY6UJf0S/RDF81RiKUxgsa3ujNuBu7K2bUIsxpuP/rnKXmZrCPZX30BmSZoyYSVYspF9VVlfwlfDb6mZcAQ=="
   }
 }

package/dist/engine/planu-core.linux-arm64-musl.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.5",
+      "bom-ref": "pkg:cargo/planu-core@5.3.7",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.5",
+      "version": "5.3.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "948e76211c8b7a4770c9f79e172184baf13fa7208a06cc149b6cd168ef5c1cf6"
+          "content": "8088eca500977faa73bd856bfe230255496cadc0e6dedbe507b12f2a785bb842"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.5",
+      "ref": "pkg:cargo/planu-core@5.3.7",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-gnu.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-x86_64-unknown-linux-gnu",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-x86_64-unknown-linux-gnu",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "glibc",
-  "artifactSha256": "c1df1defdec7ecf99a65391798bb1452a0677193fc49778ebb621adf8f984da7",
+  "artifactSha256": "69b3f0f7054729ddda1c16481de50cd2371fc297bf2ca9bffd03291c596a853f",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-gnu.node.sbom.json",
-    "sha256": "1fa7db3a02d7cd799a500eb378a41dacde4eb5f694916b49ad651658c24f3a9d"
+    "sha256": "105e157699e6e089c740c37c50e666d0feef8b01939466e97e92c5fc3676b919"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "vtEQHO2zRWFl2vbnBxSjwxwT+VTgwuPDVxcYAoQaIBFNt3JSOeh/NwXfEmn43xQ66vvRW1wsu5mj5nIvz7B5DQ=="
+    "value": "ovSb2fxdlhx8Shy5vQUS6mDePdVnSMfMAfhyW/ukSKrPS8BCA7sNYdq5JQ+1d24qtLLhR0Y+Wi89ShHz61VHAA=="
   }
 }

package/dist/engine/planu-core.linux-x64-gnu.node.sbom.json

@@ -4,14 +4,14 @@
   "version": 1,
   "metadata": {
     "component": {
-      "bom-ref": "pkg:cargo/planu-core@5.3.5",
+      "bom-ref": "pkg:cargo/planu-core@5.3.7",
       "type": "library",
       "name": "planu-core",
-      "version": "5.3.5",
+      "version": "5.3.7",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "c1df1defdec7ecf99a65391798bb1452a0677193fc49778ebb621adf8f984da7"
+          "content": "69b3f0f7054729ddda1c16481de50cd2371fc297bf2ca9bffd03291c596a853f"
         }
       ]
     }
@@ -1106,7 +1106,7 @@
       "dependsOn": []
     },
     {
-      "ref": "pkg:cargo/planu-core@5.3.5",
+      "ref": "pkg:cargo/planu-core@5.3.7",
       "dependsOn": [
         "pkg:cargo/core-foundation@0.10.1",
         "pkg:cargo/hmac@0.12.1",

package/dist/engine/planu-core.linux-x64-musl.node.manifest.json

@@ -1,8 +1,8 @@
 {
   "schemaVersion": 2,
-  "cliVersion": "5.3.5",
-  "engineVersion": "5.3.5",
-  "buildId": "1-5.3.5-x86_64-unknown-linux-musl",
+  "cliVersion": "5.3.7",
+  "engineVersion": "5.3.7",
+  "buildId": "1-5.3.7-x86_64-unknown-linux-musl",
   "protocolAbi": 1,
   "capabilityAbi": 2,
   "nodeApiAbi": 4,
@@ -16,15 +16,15 @@
   "platform": "linux",
   "arch": "x64",
   "libc": "musl",
-  "artifactSha256": "0116080409d8d34a70bcd11545d83ef0055475bac5338e1390eb2694296f64e1",
+  "artifactSha256": "bf270b2b6a40ba2211487f2da514183717cdc24b28cbee53f8d62af0462317bd",
   "sbom": {
     "format": "CycloneDX-1.5",
     "path": "planu-core.linux-x64-musl.node.sbom.json",
-    "sha256": "26de786cbe886f27871dba4af38506dbbefd7823503a3af1ec91e506b10efd41"
+    "sha256": "6630878e3b9ae9e9a552a1d26d57e61575bd0507ef62270d375a4f47e5c3134d"
   },
   "provenance": {
     "builder": "scripts/build-rust-local.sh",
-    "sourceCommit": "1ebfd1609a251513993d8635170963f6dab1420e",
+    "sourceCommit": "2ec2f2db1b564d710e56bee0b7637b49c540ca32",
     "sourceTreeDirty": false,
     "sourceDateEpoch": 1,
     "rustToolchain": "rustc 1.95.0 (59807616e 2026-04-14)",
@@ -33,6 +33,6 @@
   "signature": {
     "algorithm": "Ed25519",
     "keyId": "e2ee765cb5ad9fbdc433ece332bce26d746d5e350b3acde0721a4c8c6337ff7b",
-    "value": "UVlIbDnlrHlchfrOyYRZu/Rj8qQQkbiaPKNf8ei7B1+rXkHdryVRUiC06/UP3aaydkDVXhdkLOQmvLw1JbnyDA=="
+    "value": "jd3TfnFE+uJqatv0qIhNiO1Pd/c0GxogpwD0Mp30gzgO/65Dv8McDE2YtA3aVSKfQDLtj8hKhZqKCcDgC4FFAw=="
   }
 }