@cleocode/cleo 2026.9.7 → 2026.9.10

package/studio-dist/server/chunks/nexus-sqlite2-BBfY2xnY.js

@@ -1,1103 +0,0 @@
-import { b as getLogger, g as getCleoHome } from './paths-CV7S5-Zm.js';
-import { r as resolveDualScopeDbPath, b as createCleoRuntime, S as SQLiteAsyncSession, l as SQLiteAsyncPreparedQuery, m as SQLiteAsyncTransaction, n as SQLiteDialect, p as SQLiteAsyncDatabase, d as openDualScopeDb, q as resolveCorePackageMigrationsFolder, t as reconcileJournal, v as resolveConsolidatedJournalSiblings, x as migrateWithRetry, y as isSqliteBusy, z as ensureColumns } from './dual-scope-db-DKnWu1KM.js';
-import { resolve, join } from 'node:path';
-import './nexus-schema2-DP0Qd7CA.js';
-import { existsSync, copyFileSync } from 'node:fs';
-import { e as entityKind, s as sql, Y as jitCompatCheck } from './utils-BPSZyajG.js';
-import { r as DrizzleQueryError } from './query-promise-BkPmGPJy.js';
-import { N as NoopLogger, D as DefaultLogger } from './logger-DQIoyZbq.js';
-import { DatabaseSync } from 'node:sqlite';
-
-//#region ../core/dist/store/ports/domain-binding.js
-/**
-* Path-keyed domain binding registry — the single owner of every per-domain
-* Drizzle wrapper in the CLEO runtime.
-*
-* ## Why this module exists (E6-L13 · T12037)
-*
-* Before this leaf, each store facade (`sqlite.ts`, `memory-sqlite.ts`,
-* `conduit-sqlite.ts`, `nexus-sqlite.ts`, `skills-db.ts`) owned its OWN
-* process-global singleton quartet:
-*
-* ```ts
-* let _db: NodeSQLiteDatabase | null = null;
-* let _nativeDb: DatabaseSync | null = null;
-* let _dbPath: string | null = null;
-* let _initPromise: Promise<NodeSQLiteDatabase> | null = null;
-* ```
-*
-* Five independent caches over ONE shared `DatabaseSync` produced a documented
-* class of defects:
-*
-* - **Last-project-wins** — `_dbPath` held a single project. Touching project B
-*   reset the singleton, so an interleaved project-A query re-opened and
-*   re-migrated on every alternation (thrash, not just slowness).
-* - **Cross-domain staleness** — the tasks singleton could reference a
-*   `DatabaseSync` that the brain domain had already closed (T12019/T12020),
-*   surfacing as `database is not open` or, worse, a silently-nulled
-*   `sourceSessionId`.
-* - **Band-aid retry loops** — both `getDb` and `getBrainDb` grew bounded
-*   re-acquisition loops (T12035) purely to paper over the above.
-*
-* This module replaces all five with ONE registry keyed by
-* `${scope}::${canonical dbPath}::${domain}`, layered on the
-* {@link CleoRuntime} store registry (T12036). A binding is valid only while
-* the {@link ProjectStore} / {@link GlobalStore} instance it was established
-* against is still the one the runtime hands out AND its native handle is
-* open. Any eviction — a `close()`, a `_resetDualScopeDbCache`, an external
-* teardown — yields a fresh store object, which invalidates every binding
-* derived from it by identity comparison. No liveness polling, no retry loop,
-* no "last opened project".
-*
-* ## What a domain owns after this leaf
-*
-* A domain owns its `establish` function — the schema reconciliation it must
-* run against a native handle (legacy Drizzle wrapping, `runMigrations`,
-* vec0 extension loading, seed rows). It no longer owns caching, path
-* resolution, single-flight, or liveness. Those are this module's job.
-*
-* @packageDocumentation
-* @task T12037 (E6-L13)
-* @epic T11249 (E6)
-* @saga T11242 (SG-DB-SUBSTRATE-V2)
-*/
-/**
-* The process-wide {@link CleoRuntime} instance backing every domain port.
-*
-* A single runtime is correct here: the runtime registry is itself path-keyed,
-* so one instance serves every project the process touches. It is lazily
-* constructed so importing this module has no side effects (a hard constraint
-* — the Gate-13 chokepoint audit rejects import-time DB work).
-*/
-var _runtime = null;
-/**
-* Get (or lazily create) the process-wide {@link CleoRuntime}.
-*
-* @returns The shared runtime store registry.
-*/
-function getCleoRuntime() {
-	if (!_runtime) _runtime = createCleoRuntime();
-	return _runtime;
-}
-/**
-* Established bindings, keyed `${scope}::${canonical dbPath}::${domain}`.
-* Type-erased; {@link bindProjectDomain} re-applies the caller's type at the
-* boundary, which is sound because the key includes the domain id and each
-* domain passes exactly one `establish` shape.
-*/
-var _bindings = /* @__PURE__ */ new Map();
-/**
-* In-flight `establish` calls, same keying as {@link _bindings}. Concurrent
-* binders for one key share a single establishment (single-flight).
-*/
-var _inflight = /* @__PURE__ */ new Map();
-/**
-* Build the composite registry key for a domain binding.
-*
-* @param scope - The dual-scope discriminator.
-* @param dbPath - Canonical (already `path.resolve`d) database path.
-* @param domain - Stable domain id (e.g. `'tasks'`, `'brain'`).
-*/
-function bindingKey(scope, dbPath, domain) {
-	return `${scope}::${dbPath}::${domain}`;
-}
-/**
-* Extract the underlying `DatabaseSync` from a store's Drizzle handle.
-*
-* Drizzle's `node:sqlite` driver exposes the native connection as `$client`.
-* This is the ONLY place that reach-through happens — domains receive the
-* already-extracted handle.
-*
-* @param store - The runtime store to unwrap.
-* @returns The live native connection.
-* @throws If the Drizzle handle exposes no `$client`.
-*/
-function nativeOf(store) {
-	const native = store.db.$client;
-	if (!native) throw new Error(`T12037: CleoRuntime store for ${store.scope}::${store.dbPath} exposed no $client — cannot bind a domain schema to it.`);
-	return native;
-}
-/**
-* Reuse the cached binding for `key` if it is still valid.
-*
-* A binding is valid iff it was established against the SAME store instance
-* the runtime just returned (identity, not path — a reopened store is a new
-* object) and that store's native connection is still open.
-*
-* @param key - Composite registry key.
-* @param store - The store the runtime returned for this open.
-* @returns The still-valid row, or `undefined` if it must be re-established.
-*/
-function reuseValid(key, store) {
-	const row = _bindings.get(key);
-	if (!row) return void 0;
-	if (row.store !== store || !store.isOpen || !row.native.isOpen) {
-		_bindings.delete(key);
-		return;
-	}
-	return row;
-}
-/**
-* Establish (or reuse) `domain`'s binding against a store, single-flighted.
-*
-* @param key - Composite registry key.
-* @param store - The store to bind against.
-* @param establish - Domain schema reconciliation.
-*/
-async function bindAgainst(key, store, establish) {
-	const cached = reuseValid(key, store);
-	if (cached) return cached;
-	const pending = _inflight.get(key);
-	if (pending) {
-		const row = await pending;
-		if (row.store === store && row.native.isOpen) return row;
-		return bindAgainst(key, store, establish);
-	}
-	const native = nativeOf(store);
-	const flight = (async () => {
-		const row = {
-			store,
-			native,
-			db: await establish(native, store)
-		};
-		if (store.isOpen && native.isOpen) _bindings.set(key, row);
-		return row;
-	})();
-	_inflight.set(key, flight);
-	try {
-		return await flight;
-	} finally {
-		if (_inflight.get(key) === flight) _inflight.delete(key);
-	}
-}
-/**
-* Maximum consecutive attempts to obtain a binding over a LIVE connection.
-*
-* The shared consolidated `DatabaseSync` can be closed in the microtask gap
-* between the runtime resolving a store and `establish` finishing against it
-* (another domain's `closeDb()`, a `_resetDualScopeDbCache`, a fire-and-forget
-* brain write crossing a test boundary). One reacquisition is enough: closing
-* the dead store evicts it from BOTH the runtime registry and the dual-scope
-* chokepoint cache, so the retry necessarily opens a fresh connection.
-*
-* Before this module each facade carried its own copy of this loop
-* (T12020 · T12035). It lives here now — one implementation, every domain.
-*/
-var MAX_LIVENESS_ATTEMPTS = 2;
-/**
-* Obtain a binding whose connection is guaranteed live, with bounded
-* reacquisition.
-*
-* @param scope - Dual-scope discriminator, for the eviction filter.
-* @param key - Composite registry key.
-* @param dbPath - Canonical database path, for the eviction filter.
-* @param openStore - Opens (or reuses) the store for this key.
-* @param establish - Domain schema reconciliation.
-* @returns A row whose `native` was open at publication.
-* @throws When every attempt yielded a dead connection.
-*/
-async function bindLive(scope, key, dbPath, openStore, establish) {
-	let lastError;
-	for (let attempt = 0; attempt < MAX_LIVENESS_ATTEMPTS; attempt += 1) {
-		let store;
-		try {
-			store = await openStore();
-		} catch (err) {
-			lastError = err;
-			releaseDomainBindings({
-				scope,
-				dbPath
-			});
-			if (attempt + 1 >= MAX_LIVENESS_ATTEMPTS) throw err;
-			continue;
-		}
-		try {
-			const row = await bindAgainst(key, store, establish);
-			if (row.store.isOpen && row.native.isOpen) return row;
-		} catch (err) {
-			lastError = err;
-			if (store.isOpen) throw err;
-		}
-		releaseDomainBindings({
-			scope,
-			dbPath
-		});
-		try {
-			store.close();
-		} catch {}
-	}
-	if (lastError !== void 0) throw lastError;
-	throw new Error(`T12037: could not bind ${key} over a live connection after ${MAX_LIVENESS_ATTEMPTS} attempts — the consolidated handle was closed each time.`);
-}
-/**
-* Bind a project-scope domain schema to the {@link ProjectStore} for `cwd`.
-*
-* This is the replacement for every `getXxxDb(cwd)` project-domain facade.
-* The returned binding carries the store itself, so callers that need a
-* cross-domain transaction hold an explicit handle rather than reaching for a
-* process global.
-*
-* @typeParam TDb - The domain's Drizzle handle type.
-* @param domain - Stable domain id; part of the registry key.
-* @param cwd - Project working directory. Resolved to the canonical
-*   `cleo.db` path and forwarded as `exodusCwd` so a port open arms the
-*   exodus-on-open auto-migration exactly like the facade it replaces.
-* @param establish - Reconcile the domain's schema against the native handle
-*   and return the domain-typed Drizzle instance. Called once per
-*   (path, domain, store instance); MUST be idempotent because a store
-*   eviction re-runs it.
-* @returns The live {@link DomainBinding}.
-*/
-async function bindProjectDomain(domain, cwd, establish) {
-	const dbPath = resolve(resolveDualScopeDbPath("project", cwd));
-	return await bindLive("project", bindingKey("project", dbPath, domain), dbPath, () => getCleoRuntime().openProject(dbPath, { exodusCwd: cwd }), establish);
-}
-/**
-* Bind a global-scope domain schema to the {@link GlobalStore}.
-*
-* This is the replacement for every `getXxxDb()` global-domain facade
-* (nexus, skills, agents, telemetry).
-*
-* @typeParam TDb - The domain's Drizzle handle type.
-* @param domain - Stable domain id; part of the registry key.
-* @param establish - See {@link bindProjectDomain}.
-* @param cwd - Optional cwd forwarded as `exodusCwd` for the global scope's
-*   own legacy-fleet auto-migration.
-*/
-async function bindGlobalDomain(domain, establish, cwd) {
-	const dbPath = resolve(resolveDualScopeDbPath("global"));
-	return await bindLive("global", bindingKey("global", dbPath, domain), dbPath, () => getCleoRuntime().openGlobal({ exodusCwd: cwd }), establish);
-}
-/**
-* Bind a global-scope domain schema to an EXPLICIT database path.
-*
-* The path-aware sibling of {@link bindGlobalDomain}, for domains whose
-* lifecycle API accepts an on-disk path — notably the skills registry's
-* test-sandbox `{ path }` override. Never arms exodus-on-open.
-*
-* @typeParam TDb - The domain's Drizzle handle type.
-* @param domain - Stable domain id.
-* @param dbPath - Absolute path to a global-scope `cleo.db`.
-* @param establish - See {@link bindProjectDomain}.
-*/
-async function bindGlobalDomainAtPath(domain, dbPath, establish) {
-	const normalized = resolve(dbPath);
-	return await bindLive("global", bindingKey("global", normalized, domain), normalized, () => getCleoRuntime().openGlobalAt(normalized), establish);
-}
-/**
-* Synchronously read an ALREADY-established binding at an EXPLICIT path.
-*
-* @typeParam TDb - The domain's Drizzle handle type.
-* @param scope - Dual-scope discriminator.
-* @param dbPath - Absolute database path.
-* @param domain - Stable domain id.
-*/
-function peekDomainAtPath(scope, dbPath, domain) {
-	const row = _bindings.get(bindingKey(scope, resolve(dbPath), domain));
-	if (!row?.native.isOpen) return null;
-	return row;
-}
-/**
-* Drop cached bindings.
-*
-* Dropping a binding does NOT close any connection — the runtime registry and
-* the dual-scope chokepoint own connection lifecycle. This only forces the
-* next bind to re-run the domain's `establish`.
-*
-* @param filter - Restrict the drop. Omit any field to match all values of it.
-*   `{ scope: 'project' }` drops every project-domain binding;
-*   `{ domain: 'brain' }` drops the brain binding for every project.
-*/
-function releaseDomainBindings(filter) {
-	if (!filter) {
-		_bindings.clear();
-		return;
-	}
-	const wantPath = filter.dbPath === void 0 ? void 0 : resolve(filter.dbPath);
-	for (const key of [..._bindings.keys()]) {
-		const sep = key.indexOf("::");
-		const lastSep = key.lastIndexOf("::");
-		const scope = key.slice(0, sep);
-		const dbPath = key.slice(sep + 2, lastSep);
-		const domain = key.slice(lastSep + 2);
-		if (filter.scope !== void 0 && scope !== filter.scope) continue;
-		if (wantPath !== void 0 && dbPath !== wantPath) continue;
-		if (filter.domain !== void 0 && domain !== filter.domain) continue;
-		_bindings.delete(key);
-	}
-}
-/**
-* Synchronously look up the native `DatabaseSync` of an ALREADY-established
-* project-domain binding.
-*
-* This exists solely to keep the legacy synchronous native getters
-* (`getNativeDb`, `getNativeTasksDb`, `getBrainNativeDb`) working while their
-* call sites migrate to the async binding. Unlike the module-global they
-* replace, this lookup is **path-keyed** — passing the caller's `cwd` returns
-* that project's handle rather than "whichever project was opened last".
-*
-* Returns `null` when nothing is bound yet or the connection has since
-* closed; callers must have awaited the domain's async binder first.
-*
-* @param domain - Stable domain id.
-* @param cwd - Project working directory; resolved to the canonical path.
-* @returns The live native connection, or `null`.
-*
-* @deprecated Read `.native` from the {@link DomainBinding} instead. Removed
-*   when the last synchronous native getter is retired (T12040 · E6-L16).
-*/
-function boundProjectNative(domain, cwd) {
-	return peekProjectDomain(domain, cwd)?.native ?? null;
-}
-/**
-* Synchronously read an ALREADY-established project-domain binding without
-* opening anything.
-*
-* Returns `null` when the domain is unbound for that project or its
-* connection has closed. Unlike {@link bindProjectDomain} this never triggers
-* an open, so it is safe on synchronous code paths (accessor predicates,
-* health probes) that must not force a migration.
-*
-* @typeParam TDb - The domain's Drizzle handle type, as passed to
-*   {@link bindProjectDomain}. Unchecked at runtime — the caller is
-*   responsible for using the same type it bound with.
-* @param domain - Stable domain id.
-* @param cwd - Project working directory.
-*/
-function peekProjectDomain(domain, cwd) {
-	const dbPath = resolve(resolveDualScopeDbPath("project", cwd));
-	const row = _bindings.get(bindingKey("project", dbPath, domain));
-	if (row?.native.isOpen) return row;
-	if (cwd !== void 0) return null;
-	const suffix = `::${domain}`;
-	let sole;
-	for (const [key, candidate] of _bindings) {
-		if (!key.startsWith("project::") || !key.endsWith(suffix)) continue;
-		if (!candidate.native.isOpen) continue;
-		if (sole) return null;
-		sole = candidate;
-	}
-	return sole ?? null;
-}
-/**
-* Synchronous sibling of {@link peekProjectDomain} for the global scope.
-*
-* @typeParam TDb - The domain's Drizzle handle type.
-* @param domain - Stable domain id.
-*/
-function peekGlobalDomain(domain) {
-	const dbPath = resolve(resolveDualScopeDbPath("global"));
-	const row = _bindings.get(bindingKey("global", dbPath, domain));
-	if (!row || !row.native.isOpen) return null;
-	return row;
-}
-
-//#region src/node-sqlite/session.ts
-var NodeSQLiteSession = class extends SQLiteAsyncSession {
-	static [entityKind] = "SQLJsSession";
-	logger;
-	constructor(client, dialect, relations, options = {}) {
-		super(dialect, "sync");
-		this.client = client;
-		this.relations = relations;
-		this.options = options;
-		this.logger = options.logger ?? new NoopLogger();
-	}
-	prepareQuery(query, mode, _prepare, executeMethod, mapper, queryMetadata) {
-		let stmt;
-		try {
-			stmt = this.client.prepare(query.sql);
-		} catch (e) {
-			throw new DrizzleQueryError(query.sql, query.params, e);
-		}
-		return new SQLiteAsyncPreparedQuery("sync", executeMethod, {
-			all: (params) => {
-				stmt.setReturnArrays(mode === "arrays");
-				const res = stmt.all(...params);
-				if (mode === "objects") return res.map((row) => ({ ...row }));
-				return res;
-			},
-			get: (params) => {
-				stmt.setReturnArrays(mode === "arrays");
-				const res = stmt.get(...params);
-				if (res && mode === "objects") return { ...res };
-				return res;
-			},
-			run: (params) => {
-				stmt.setReturnArrays(false);
-				return stmt.run(...params);
-			},
-			values: (params) => {
-				stmt.setReturnArrays(true);
-				return stmt.all(...params);
-			}
-		}, query, mapper, mode, this.logger, void 0, queryMetadata, void 0);
-	}
-	transaction(transaction, config = {}) {
-		const tx = new NodeSQLiteTransaction("sync", this.dialect, this, this.relations);
-		this.run(sql.raw(`begin${config.behavior ? ` ${config.behavior}` : ""}`));
-		try {
-			const result = transaction(tx);
-			this.run(sql`commit`);
-			return result;
-		} catch (err) {
-			this.run(sql`rollback`);
-			throw err;
-		}
-	}
-};
-var NodeSQLiteTransaction = class NodeSQLiteTransaction extends SQLiteAsyncTransaction {
-	static [entityKind] = "SQLJsTransaction";
-	transaction(transaction) {
-		const savepointName = `sp${this.nestedIndex + 1}`;
-		const tx = new NodeSQLiteTransaction("sync", this.dialect, this.session, this._.relations, this.nestedIndex + 1);
-		tx.run(sql.raw(`savepoint ${savepointName}`));
-		try {
-			const result = transaction(tx);
-			tx.run(sql.raw(`release savepoint ${savepointName}`));
-			return result;
-		} catch (err) {
-			tx.run(sql.raw(`rollback to savepoint ${savepointName}`));
-			throw err;
-		}
-	}
-};
-
-//#region src/node-sqlite/driver.ts
-var NodeSQLiteDatabase = class extends SQLiteAsyncDatabase {
-	static [entityKind] = "NodeSQLiteDatabase";
-};
-function construct(client, config = {}) {
-	const dialect = new SQLiteDialect({ useJitMappers: jitCompatCheck(config.jit) });
-	let logger;
-	if (config.logger === true) logger = new DefaultLogger();
-	else if (config.logger !== false) logger = config.logger;
-	const relations = config.relations ?? {};
-	const db = new NodeSQLiteDatabase("sync", dialect, new NodeSQLiteSession(client, dialect, relations, { logger }), relations);
-	db.$client = client;
-	return db;
-}
-function drizzle(...params) {
-	if (params[0] === void 0 || typeof params[0] === "string") return construct(params[0] === void 0 ? new DatabaseSync(":memory:") : new DatabaseSync(params[0]), params[1]);
-	const { connection, client, ...config } = params[0];
-	if (client) return construct(client, config);
-	if (typeof connection === "object") {
-		const { path, ...options } = connection;
-		return construct(new DatabaseSync(path ?? ":memory:", options), config);
-	}
-	return construct(new DatabaseSync(connection ?? ":memory:"), config);
-}
-(function(_drizzle) {
-	function mock(config) {
-		return construct({}, config);
-	}
-	_drizzle.mock = mock;
-})(drizzle || (drizzle = {}));
-
-//#region ../core/dist/store/nexus-sqlite.js
-/**
-* SQLite store for the NEXUS domain via drizzle-orm/node-sqlite + node:sqlite
-* (DatabaseSync).
-*
-* ## Dual-scope residency split (ADR-090 · T11648 — runtime read half)
-*
-* The nexus domain is now SPLIT across the two consolidated `cleo.db` files:
-*
-* - **GRAPH (project scope):** the four code-graph tables (`nexus_nodes`,
-*   `nexus_relations`, `nexus_contracts`, `nexus_code_index`) + the
-*   `nexus_relation_weights` plasticity sibling live in
-*   `<projectRoot>/.cleo/cleo.db` — the portable per-project living brain.
-*   This is where exodus WRITES them (`resolveTableTargetScope` in
-*   `store/exodus/table-name-map.ts`), so the runtime READS them from there too.
-* - **REGISTRY/identity (global scope):** the six cross-project tables
-*   (`nexus_project_registry`, `nexus_project_id_aliases`, `nexus_user_profile`,
-*   `nexus_sigils`, `nexus_audit_log`, `nexus_schema_meta`) stay in the GLOBAL
-*   `cleo.db` under {@link getCleoHome} (ADR-090 §2.2).
-*
-* `getNexusDb()` opens the PROJECT scope as `main` (via {@link openDualScopeDb}
-* ('project')) and ATTACHes the GLOBAL `cleo.db` under
-* {@link NEXUS_GLOBAL_ATTACH_ALIAS}. SQLite's bare-name resolution then routes
-* each query to the correct file with ZERO accessor changes: graph tables exist
-* in `main` (project) and resolve there; registry/identity tables are absent
-* from `main` and fall through to the attached GLOBAL db. The GLOBAL db also
-* carries empty graph tables (frozen T11363 migration leftovers), correctly
-* SHADOWED by `main`.
-*
-* ### Why this fix (T11648)
-*
-* T11538/T11539 moved the graph schema to PROJECT scope and routed exodus there,
-* but the runtime READ accessors still opened the GLOBAL handle — so after a
-* `cleo exodus migrate` the project held 24k+ `nexus_nodes` while the runtime
-* read 0 from global (`cleo nexus search-code` / `context` returned empty). This
-* module is the deferred runtime half: it reads the graph from the SAME scope
-* exodus writes it.
-*
-* This preserves the prior guarantees:
-* - Every nexus-domain open flows through the single pragma SSoT (ADR-068/069).
-* - DB Open Guard Gate 3 (`scripts/lint-no-direct-db-open.mjs`) stays green: the
-*   only native open is inside `dual-scope-db.ts` (the ATTACH below is a SQL
-*   statement on an already-chokepointed handle, not a `new DatabaseSync(`).
-*
-* ## COMPLETE-CUTOVER to prefixed `nexus_*` tables (T11578 · AC3)
-*
-* The nexus runtime READ + WRITE path targets PREFIXED consolidated tables. The
-* five PROJECT graph tables are owned by the consolidated cleo-project migration;
-* the six GLOBAL registry/identity tables by the consolidated cleo-global
-* migration. The former legacy drop/rebuild (`establishLegacyNexusSchema`) and
-* BARE registry tables (`project_registry`, …) are GONE. The runtime schema
-* barrel `schema/nexus-schema.ts` maps every export symbol to its prefixed
-* physical name — accessors need ZERO change.
-*
-* The `drizzle-nexus` migration set carries ONLY the delta the consolidated
-* migration cannot model: the `nexus_symbols_fts` FTS5 virtual table + its three
-* `nexus_nodes` triggers, the `nexus_relation_weights` plasticity-partition
-* sibling (T11545), and the `_nexus_meta` health-probe table (the reconcile
-* sentinel). The destructive half of the plasticity partition is applied
-* idempotently at open by `ensureNexusRelationWeights` (a no-op for the
-* already-narrow project-scope `nexus_relations`).
-*
-* @adr ADR-036 — registry/identity is global-only (relaxed for the 4 graph
-*   tables by ADR-090 §2.4).
-* @adr ADR-090 — nexus code-graph residency global→project scope split.
-* @task T5365
-* @task T11524 - E6-L4: route getNexusDb through the dual-scope chokepoint
-* @task T11578 - AC3: COMPLETE-CUTOVER nexus runtime → prefixed nexus_* tables
-* @task T11648 - ADR-090 runtime read half: route graph reads to project scope
-*/
-/** Schema version for newly created nexus databases. Single source of truth. */
-var NEXUS_SCHEMA_VERSION = "1.0.0";
-/**
-* SQLite ATTACH alias under which the GLOBAL consolidated `cleo.db` is mounted
-* into the PROJECT-scope nexus handle so the cross-project registry/identity
-* tables (`nexus_project_registry`, `nexus_user_profile`, `nexus_sigils`,
-* `nexus_project_id_aliases`, `nexus_audit_log`, `nexus_schema_meta`) stay
-* reachable by their BARE names (ADR-090 · T11648).
-*
-* SQLite resolves a bare table name against `main` first, then attached
-* databases in attach order. The PROJECT `cleo.db` (`main`) physically carries
-* ONLY the five graph tables (`nexus_nodes`, `nexus_relations`,
-* `nexus_contracts`, `nexus_code_index`, `nexus_relation_weights`), so those
-* bare names resolve to the populated project graph; the registry/identity
-* tables — absent from `main` — fall through to this attached GLOBAL db. The
-* GLOBAL db ALSO carries empty graph tables (frozen T11363 migration leftovers),
-* but those are correctly SHADOWED by `main` and never read or written.
-*/
-var NEXUS_GLOBAL_ATTACH_ALIAS = "nexus_global";
-/**
-* Returns the nexus GRAPH DB path — the consolidated PROJECT `cleo.db`
-* (`<projectRoot>/.cleo/cleo.db`), where the four code-graph tables
-* (`nexus_nodes`, `nexus_relations`, `nexus_contracts`, `nexus_code_index`) and
-* the `nexus_relation_weights` plasticity sibling physically reside post the
-* ADR-090 residency split (T11538/T11539).
-*
-* ## ADR-090 residency move — runtime read half (T11648)
-*
-* Exodus WRITES the graph tables to PROJECT scope (per `resolveTableTargetScope`
-* in `store/exodus/table-name-map.ts`); this resolver routes the runtime READ
-* path to the SAME scope so the migrated graph is visible. Previously this
-* returned the GLOBAL `cleo.db` (`resolveDualScopeDbPath('global')`), which left
-* `cleo nexus search-code` / `context` reading the empty global graph tables —
-* the T11538/T11539 runtime-half gap this fix closes. The cross-project
-* registry/identity tables stay GLOBAL and are reached via the
-* {@link NEXUS_GLOBAL_ATTACH_ALIAS} attach (see {@link getNexusRegistryDbPath}).
-*
-* @param cwd - Optional working directory used to resolve the owning project
-*   root (forwarded to {@link resolveDualScopeDbPath}('project', cwd)).
-* @task T307
-* @epic T299
-* @task T11648 (ADR-090 runtime read half — route graph reads to project scope)
-* @why ADR-090 §2.1/§2.4 supersedes ADR-036's global-only assertion FOR THE
-*   GRAPH TABLES ONLY. The graph is per-project and must live in the portable
-*   `.cleo/cleo.db`; the registry/identity tables remain global-asserted in
-*   {@link getNexusRegistryDbPath}.
-*/
-function getNexusDbPath(cwd) {
-	return resolveDualScopeDbPath("project", cwd);
-}
-/**
-* Returns the cross-project nexus REGISTRY/identity DB path — the consolidated
-* GLOBAL `cleo.db` under `getCleoHome()`.
-*
-* The registry/identity tables (`nexus_project_registry`,
-* `nexus_project_id_aliases`, `nexus_user_profile`, `nexus_sigils`,
-* `nexus_audit_log`, `nexus_schema_meta`) are genuinely global (ADR-090 §2.2)
-* and MUST stay under `getCleoHome()`. The ADR-036 global-only assertion is
-* retained here as defence-in-depth (it was relaxed only for the four graph
-* tables, now homed in PROJECT scope via {@link getNexusDbPath}).
-*
-* @task T11648 (ADR-090 — registry stays global-asserted)
-* @adr ADR-036 — registry/identity is global-only.
-* @throws {Error} If the resolved path is not under `getCleoHome()`.
-*/
-function getNexusRegistryDbPath() {
-	const cleoHome = getCleoHome();
-	const registryPath = resolveDualScopeDbPath("global");
-	if (!registryPath.startsWith(cleoHome)) throw new Error(`BUG: getNexusRegistryDbPath() resolved to "${registryPath}" which is NOT under getCleoHome() ("${cleoHome}"). The nexus registry/identity tables are global-only per ADR-036/ADR-090 §2.2. This indicates a code path that bypasses canonical path resolution — fix the caller, do not suppress this error.`);
-	return registryPath;
-}
-/**
-* Idempotently ATTACH the GLOBAL consolidated `cleo.db` into a PROJECT-scope
-* nexus handle under {@link NEXUS_GLOBAL_ATTACH_ALIAS}, so the cross-project
-* registry/identity tables resolve by their bare names (ADR-090 · T11648).
-*
-* Safe to call repeatedly: if the alias is already attached (a sibling domain
-* opened the same shared project handle first, or a prior nexus open ran this),
-* the duplicate `ATTACH` throws and is swallowed. The global `cleo.db` is the
-* canonical registry home; we ensure its directory exists via the global open
-* resolver before attaching.
-*
-* @param nativeDb - The open PROJECT-scope `DatabaseSync` handle.
-* @task T11648
-*/
-function ensureGlobalRegistryAttached(nativeDb) {
-	const globalPath = getNexusRegistryDbPath();
-	const escaped = globalPath.replace(/'/g, "''");
-	const existing = nativeDb.prepare("PRAGMA database_list").all().find((row) => row.name === NEXUS_GLOBAL_ATTACH_ALIAS);
-	if (existing) {
-		if (existing.file === globalPath) return;
-		try {
-			nativeDb.exec(`DETACH DATABASE ${NEXUS_GLOBAL_ATTACH_ALIAS}`);
-		} catch {
-			return;
-		}
-	}
-	nativeDb.exec(`ATTACH DATABASE '${escaped}' AS ${NEXUS_GLOBAL_ATTACH_ALIAS}`);
-}
-/**
-* Resolve the absolute path to the drizzle-nexus migrations folder inside
-* @cleocode/core, using ESM-native module resolution (T1177).
-*
-* Delegates to {@link resolveCorePackageMigrationsFolder} which handles
-* bundled dist/, workspace dev, and global-install layouts uniformly via
-* `import.meta.resolve()` + `createRequire().resolve()` fallback.
-*/
-function resolveNexusMigrationsFolder() {
-	return resolveCorePackageMigrationsFolder("drizzle-nexus");
-}
-/**
-* Canonical filename within the nested `<cleoHome>/nexus/` subdirectory that
-* indicates the structural bug ADR-086 BANs. If this file exists, the install
-* has not yet run `scripts/migrate-nested-nexus.mjs`.
-*/
-var NESTED_NEXUS_SENTINEL = "nexus.db";
-/**
-* One-shot warning gate keyed on the absolute nested path. Prevents the
-* warning from spamming when `getNexusDb()` is called repeatedly within a
-* single process (e.g. CLI commands that re-open the handle, tests that
-* exercise nexus across many describe blocks).
-*
-* Exposed via {@link _resetNestedNexusWarningGate} for test hygiene.
-*/
-var _warnedNestedPaths = /* @__PURE__ */ new Set();
-/**
-* Returns the absolute path that, if present, indicates the install carries
-* the nested-nexus structural bug. ALWAYS `<cleoHome>/nexus/nexus.db`.
-*
-* Exposed for tests; production callers should use
-* {@link detectAndWarnOnNestedNexus} instead.
-*
-* @task T10321
-* @adr ADR-086
-*/
-function getNestedNexusSentinelPath() {
-	return join(getCleoHome(), "nexus", NESTED_NEXUS_SENTINEL);
-}
-/**
-* Detect the presence of the nested-nexus structural bug and emit a one-shot
-* warning via the canonical pino logger if found.
-*
-* The function is non-blocking and non-throwing — it never alters the
-* outcome of the surrounding `getNexusDb()` open. The canonical consolidated
-* open proceeds normally regardless of whether the nested debris is present.
-*
-* Idempotency: the first call for a given nested path emits the warning;
-* subsequent calls within the same process are no-ops. Tests can reset the
-* gate via {@link _resetNestedNexusWarningGate}.
-*
-* @returns `true` when the warning fired on this call; `false` otherwise.
-*
-* @task T10321
-* @adr ADR-086
-*/
-function detectAndWarnOnNestedNexus() {
-	let nestedPath;
-	try {
-		nestedPath = getNestedNexusSentinelPath();
-	} catch {
-		return false;
-	}
-	if (!existsSync(nestedPath)) return false;
-	if (_warnedNestedPaths.has(nestedPath)) return false;
-	_warnedNestedPaths.add(nestedPath);
-	const canonicalPath = getNexusDbPath();
-	getLogger("nexus-sqlite").warn({
-		nestedPath,
-		canonicalPath,
-		migrationCommand: "node scripts/migrate-nested-nexus.mjs",
-		adr: "ADR-086",
-		task: "T10321"
-	}, "Detected nested-nexus structural bug — canonical consolidated cleo.db is in use; nested duplicates at <cleoHome>/nexus/ are migration debris. Run the migration script to remove them.");
-	return true;
-}
-/**
-* Reset the one-shot warning gate. Tests only — production callers MUST NOT
-* use this.
-*
-* @internal
-* @task T10321
-*/
-function _resetNestedNexusWarningGate() {
-	_warnedNestedPaths.clear();
-}
-/**
-* Check whether a table exists in the SQLite database.
-*/
-function tableExists(nativeDb, tableName) {
-	return !!nativeDb.prepare("SELECT name FROM sqlite_master WHERE type='table' AND name=?").get(tableName);
-}
-/**
-* Check whether a virtual table (or any object) exists in the SQLite database.
-*
-* sqlite_master covers virtual tables, triggers, and regular tables alike.
-*/
-function objectExists(nativeDb, type, name) {
-	return !!nativeDb.prepare("SELECT name FROM sqlite_master WHERE type=? AND name=?").get(type, name);
-}
-/**
-* Idempotent FTS5 setup for nexus_symbols_fts (T1839).
-*
-* Creates the FTS5 virtual table indexed on label + file_path, installs the
-* three nexus_nodes triggers (INSERT/UPDATE/DELETE), and backfills any existing
-* nexus_nodes rows that are not yet represented in the FTS5 table.
-*
-* Called before drizzle migrations so existing DBs are covered. Each DDL
-* statement is guarded by IF NOT EXISTS / DROP IF EXISTS — safe to re-run.
-*
-* Uses nativeDb.exec() (not prepare().run()) to avoid the node:sqlite
-* first-statement-only limitation.
-*
-* @task T1839
-*/
-function ensureNexusFts5(nativeDb) {
-	if (!tableExists(nativeDb, "nexus_nodes")) return;
-	if (!objectExists(nativeDb, "table", "nexus_symbols_fts")) nativeDb.exec(`
-      CREATE VIRTUAL TABLE nexus_symbols_fts USING fts5(
-        node_id UNINDEXED,
-        label,
-        file_path,
-        tokenize = 'unicode61 remove_diacritics 1'
-      )
-    `);
-	nativeDb.exec(`DROP TRIGGER IF EXISTS nexus_nodes_fts_ai`);
-	nativeDb.exec(`
-    CREATE TRIGGER nexus_nodes_fts_ai
-    AFTER INSERT ON nexus_nodes
-    BEGIN
-      INSERT INTO nexus_symbols_fts(rowid, node_id, label, file_path)
-      VALUES (new.rowid, new.id, new.label, new.file_path);
-    END
-  `);
-	nativeDb.exec(`DROP TRIGGER IF EXISTS nexus_nodes_fts_ad`);
-	nativeDb.exec(`
-    CREATE TRIGGER nexus_nodes_fts_ad
-    AFTER DELETE ON nexus_nodes
-    BEGIN
-      DELETE FROM nexus_symbols_fts WHERE rowid = old.rowid;
-    END
-  `);
-	nativeDb.exec(`DROP TRIGGER IF EXISTS nexus_nodes_fts_au`);
-	nativeDb.exec(`
-    CREATE TRIGGER nexus_nodes_fts_au
-    AFTER UPDATE ON nexus_nodes
-    BEGIN
-      DELETE FROM nexus_symbols_fts WHERE rowid = old.rowid;
-      INSERT INTO nexus_symbols_fts(rowid, node_id, label, file_path)
-      VALUES (new.rowid, new.id, new.label, new.file_path);
-    END
-  `);
-	nativeDb.exec(`
-    INSERT INTO nexus_symbols_fts(rowid, node_id, label, file_path)
-    SELECT rowid, id, label, file_path
-    FROM nexus_nodes
-    WHERE rowid NOT IN (SELECT rowid FROM nexus_symbols_fts)
-  `);
-}
-/**
-* Idempotent safety net + partition completer for `nexus_relation_weights`
-* (T11545 · ADR-090 §5.3 · T11578 · AC3).
-*
-* The Hebbian plasticity columns were partitioned out of `nexus_relations` into
-* this sibling 1:1 table. After the AC3 cutover the consolidated cleo-global
-* migration (T11363) owns `nexus_relations` but still creates it with the THREE
-* inline plasticity columns (`weight`, `last_accessed_at`, `co_accessed_count`)
-* — the T11363 shape predates the partition. This safety net completes the
-* partition idempotently at runtime (the destructive column-DROP is kept OUT of
-* the journaled migration SQL, where re-runs would throw):
-*
-*   1. CREATE the sibling table (+ indexes) — covers fresh + pre-partition DBs.
-*   2. When the inline columns are still present on `nexus_relations`, BACKFILL
-*      any non-default plasticity state into the sibling table so no weights are
-*      lost, then DROP the three inline columns so the structural graph row is
-*      narrow (matching `nexus-schema.ts` + the must-pass fresh-init test).
-*
-* Every statement is guarded by IF-NOT-EXISTS / column-presence probes; safe to
-* re-run on every open (the DROP only fires while the inline columns exist).
-*
-* @task T11545
-* @task T11578
-*/
-function ensureNexusRelationWeights(nativeDb) {
-	if (!tableExists(nativeDb, "nexus_relations")) return;
-	nativeDb.exec(`
-    CREATE TABLE IF NOT EXISTS nexus_relation_weights (
-      relation_id       TEXT PRIMARY KEY NOT NULL,
-      weight            REAL DEFAULT 0.0 NOT NULL,
-      last_accessed_at  TEXT,
-      co_accessed_count INTEGER DEFAULT 0 NOT NULL
-    )
-  `);
-	nativeDb.exec(`CREATE INDEX IF NOT EXISTS idx_nexus_relation_weights_last_accessed ON nexus_relation_weights (last_accessed_at)`);
-	nativeDb.exec(`CREATE INDEX IF NOT EXISTS idx_nexus_relation_weights_weight ON nexus_relation_weights (weight)`);
-	if (!nativeDb.prepare("PRAGMA table_info(nexus_relations)").all().some((c) => c.name === "weight")) return;
-	nativeDb.exec(`
-    INSERT OR IGNORE INTO nexus_relation_weights (relation_id, weight, last_accessed_at, co_accessed_count)
-    SELECT id, COALESCE(weight, 0.0), last_accessed_at, COALESCE(co_accessed_count, 0)
-      FROM nexus_relations
-     WHERE COALESCE(weight, 0.0) > 0.0
-        OR last_accessed_at IS NOT NULL
-        OR COALESCE(co_accessed_count, 0) > 0
-  `);
-	const fkWasOn = nativeDb.prepare("PRAGMA foreign_keys").get()?.foreign_keys === 1;
-	nativeDb.exec("PRAGMA foreign_keys=OFF");
-	try {
-		nativeDb.exec("DROP INDEX IF EXISTS idx_nexus_relations_last_accessed");
-		nativeDb.exec(`
-      CREATE TABLE nexus_relations__narrow (
-        id text PRIMARY KEY,
-        project_id text NOT NULL,
-        source_id text NOT NULL,
-        target_id text NOT NULL,
-        type text NOT NULL,
-        confidence real NOT NULL,
-        reason text,
-        step integer,
-        indexed_at text DEFAULT (datetime('now')) NOT NULL,
-        CHECK ("type" IN ('contains', 'defines', 'imports', 'accesses', 'calls', 'extends', 'implements', 'method_overrides', 'method_implements', 'has_method', 'has_property', 'member_of', 'step_in_process', 'handles_route', 'fetches', 'handles_tool', 'entry_point_of', 'wraps', 'queries', 'documents', 'applies_to', 'co_changed', 'co_cited_in_task')),
-        CHECK ("indexed_at" IS NULL OR "indexed_at" GLOB '[0-9][0-9][0-9][0-9]-[0-9][0-9]-[0-9][0-9]*')
-      )
-    `);
-		nativeDb.exec(`
-      INSERT INTO nexus_relations__narrow
-        (id, project_id, source_id, target_id, type, confidence, reason, step, indexed_at)
-      SELECT id, project_id, source_id, target_id, type, confidence, reason, step, indexed_at
-        FROM nexus_relations
-    `);
-		nativeDb.exec("DROP TABLE nexus_relations");
-		nativeDb.exec("ALTER TABLE nexus_relations__narrow RENAME TO nexus_relations");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_project ON nexus_relations (project_id)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_source ON nexus_relations (source_id)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_target ON nexus_relations (target_id)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_type ON nexus_relations (type)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_project_type ON nexus_relations (project_id, type)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_source_type ON nexus_relations (source_id, type)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_target_type ON nexus_relations (target_id, type)");
-		nativeDb.exec("CREATE INDEX IF NOT EXISTS idx_nexus_relations_confidence ON nexus_relations (confidence)");
-	} finally {
-		nativeDb.exec(`PRAGMA foreign_keys=${fkWasOn ? "ON" : "OFF"}`);
-	}
-}
-/**
-* Apply the nexus-domain DELTA migration + idempotent safety nets on top of the
-* PREFIXED consolidated graph tables the PROJECT dual-scope chokepoint already
-* created (T11578 · AC3 · ADR-090 T11648).
-*
-* ## COMPLETE-CUTOVER (T11578 · AC3) + residency move (ADR-090 · T11648)
-*
-* The consolidated cleo-project migration OWNS the five PREFIXED graph tables
-* in the PROJECT `cleo.db` `main` (`nexus_nodes`, `nexus_relations`,
-* `nexus_contracts`, `nexus_code_index`, `nexus_relation_weights`); the
-* cross-project registry/identity tables are owned by the cleo-global migration
-* and reached through the {@link NEXUS_GLOBAL_ATTACH_ALIAS} attach. The runtime
-* no longer drops/rebuilds a legacy shape (former `establishLegacyNexusSchema`).
-* The `drizzle-nexus` set carries ONLY the delta the consolidated migration
-* cannot model:
-*   - the `nexus_relation_weights` sibling (plasticity partition, T11545),
-*   - the `nexus_symbols_fts` FTS5 virtual table + its three triggers (over the
-*     project-scope `nexus_nodes`), and
-*   - the `_nexus_meta` health-probe table (also the reconcile sentinel).
-*
-* The reconcile sentinel is `_nexus_meta` (a table the nexus migration ITSELF
-* creates, NOT a consolidated-owned table). This keeps `reconcileJournal`
-* Scenario 2 (orphan deletion) dormant until the nexus migration set is journaled
-* — otherwise the consolidated PROJECT migration's journal entries (written FIRST
-* by `openDualScopeDb`) would look like orphans and be deleted, corrupting the
-* shared journal (mirrors the conduit `_conduit_meta` sentinel, AC4).
-*
-* @task T5365
-* @task T11578
-* @task T11648
-*/
-function runNexusMigrations(nativeDb, db, dbPath) {
-	const migrationsFolder = resolveNexusMigrationsFolder();
-	if (tableExists(nativeDb, "nexus_nodes")) {
-		const backupPath = dbPath.replace(/\.db$/, "-pre-cleo.db.bak");
-		if (!existsSync(backupPath)) try {
-			copyFileSync(dbPath, backupPath);
-		} catch {}
-	}
-	reconcileJournal(nativeDb, migrationsFolder, "_nexus_meta", "nexus", resolveConsolidatedJournalSiblings("drizzle-nexus"));
-	const MAX_RETRIES = 5;
-	const BASE_DELAY_MS = 100;
-	const MAX_DELAY_MS = 2e3;
-	let lastError;
-	for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) try {
-		migrateWithRetry(db, migrationsFolder, nativeDb, "_nexus_meta", "nexus");
-		lastError = void 0;
-		break;
-	} catch (err) {
-		if (!isSqliteBusy(err) || attempt === MAX_RETRIES) throw err;
-		lastError = err;
-		const delay = Math.min(BASE_DELAY_MS * 2 ** (attempt - 1) * (1 + Math.random() * .5), MAX_DELAY_MS);
-		Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.round(delay));
-	}
-	/* c8 ignore next 1 */
-	if (lastError) throw lastError;
-	ensureNexusRelationWeights(nativeDb);
-	ensureColumns(nativeDb, "nexus_nodes", [{
-		name: "is_external",
-		ddl: "integer DEFAULT 0"
-	}], "nexus");
-	ensureNexusFts5(nativeDb);
-}
-/**
-* Initialize the consolidated PROJECT `cleo.db` (the nexus GRAPH home) with the
-* GLOBAL `cleo.db` ATTACHed for registry/identity reads, plus the nexus DELTA
-* schema within it (lazy, singleton).
-*
-* ## ADR-090 residency move — runtime read half (T11648)
-*
-* The four code-graph tables (`nexus_nodes`, `nexus_relations`, `nexus_contracts`,
-* `nexus_code_index`) + the `nexus_relation_weights` plasticity sibling now live
-* in PROJECT scope (`<projectRoot>/.cleo/cleo.db`) — that is where exodus WRITES
-* them. The runtime READ path therefore opens the PROJECT scope as `main` so the
-* graph is visible (previously it opened GLOBAL and read empty graph tables —
-* the T11538/T11539 gap). The cross-project registry/identity tables stay GLOBAL;
-* we open GLOBAL first (so its consolidated migration creates them) then ATTACH
-* it under {@link NEXUS_GLOBAL_ATTACH_ALIAS} so the registry/identity accessors —
-* which reference bare names (`nexus_project_registry`, `nexus_user_profile`,
-* `nexus_sigils`, `nexus_project_id_aliases`, `nexus_audit_log`,
-* `nexus_schema_meta`) — resolve via SQLite's bare-name fall-through to the
-* attached GLOBAL db. ADR-036's global-only assertion is relaxed for the four
-* graph tables ONLY (registry stays global-asserted in {@link getNexusRegistryDbPath}).
-*
-* Uses a promise guard so concurrent callers wait for the same initialization to
-* complete (migrations are async).
-*
-* @task T307
-* @task T11524 (E6-L4 — dual-scope chokepoint delegation)
-* @task T11578 (AC3 — prefixed `nexus_*` tables)
-* @task T11648 (ADR-090 runtime read half — project-scope graph + global attach)
-*/
-async function getNexusDb() {
-	return (await bindNexusDomain()).db.drizzle;
-}
-/**
-* Bind the nexus schema to the {@link ProjectStore} holding the code graph,
-* with the GLOBAL `cleo.db` ATTACHed for registry/identity reads.
-*
-* ## E6-L15 cutover (T12039)
-*
-* Replaces this module's singleton quintet (`_nexusDb` / `_nexusNativeDb` /
-* `_nexusDbPath` / `_nexusRegistryPath` / `_nexusInitPromise`). Path keying,
-* single-flight, and handle liveness move to the binding registry; this
-* function keeps only what is genuinely nexus-specific — the two-scope open
-* order and the registry ATTACH.
-*
-* The GLOBAL registry path is captured in the bound value rather than a
-* separate module-global, so a `CLEO_HOME` change invalidates exactly this
-* binding (and re-runs the global migration before re-attaching) instead of
-* resetting a process-wide singleton that other projects also depended on.
-*
-* @returns The live nexus-domain binding.
-*
-* @task T12039 (E6-L15)
-*/
-async function bindNexusDomain() {
-	const requestedRegistryPath = getNexusRegistryDbPath();
-	const bound = peekProjectDomain("nexus");
-	if (bound && bound.db.registryPath !== requestedRegistryPath) releaseDomainBindings({
-		scope: "project",
-		domain: "nexus"
-	});
-	detectAndWarnOnNestedNexus();
-	await openDualScopeDb("global");
-	const binding = await bindProjectDomain("nexus", void 0, (nativeDb, store) => {
-		ensureGlobalRegistryAttached(nativeDb);
-		const db = drizzle({ client: nativeDb });
-		runNexusMigrations(nativeDb, db, store.dbPath);
-		nativeDb.prepare(`INSERT OR IGNORE INTO nexus_schema_meta (key, value) VALUES ('schemaVersion', '${NEXUS_SCHEMA_VERSION}')`).run();
-		return {
-			drizzle: db,
-			registryPath: requestedRegistryPath
-		};
-	});
-	try {
-		ensureGlobalRegistryAttached(binding.native);
-	} catch {
-		releaseDomainBindings({
-			scope: "project",
-			domain: "nexus"
-		});
-		throw new Error("T12039: nexus binding lost its GLOBAL registry ATTACH and could not re-attach.");
-	}
-	return binding;
-}
-/**
-* Close the nexus-domain database connection and release resources.
-*
-* ## E6-L4 (T11524) · ADR-090 runtime read half (T11648)
-*
-* The nexus GRAPH domain now SHARES the consolidated PROJECT `cleo.db` handle
-* with the other project-tier domains (tasks/brain/conduit — all open it via
-* {@link openDualScopeDb}('project'), same cache key), with the GLOBAL `cleo.db`
-* ATTACHed for registry/identity reads. This function therefore must NOT close
-* the underlying `DatabaseSync` nor evict the dual-scope cache — doing so would
-* break in-flight queries from those siblings with "database is not open". It
-* only drops the nexus-domain singleton references; the shared handle's lifecycle
-* (and the global ATTACH) is owned by `openDualScopeDb` and torn down by a
-* coordinated reset (`closeAllDatabases` → `_resetDualScopeDbCache`).
-*/
-function closeNexusDb() {
-	releaseDomainBindings({
-		scope: "project",
-		domain: "nexus"
-	});
-}
-/**
-* Reset nexus singleton state without saving.
-* Used during tests or when the database file is recreated.
-* Safe to call multiple times.
-*
-* ## E6-L4 (T11524) · ADR-090 runtime read half (T11648)
-*
-* Drops only the nexus-domain singleton references — does NOT close the shared
-* dual-scope PROJECT `cleo.db` handle nor evict the dual-scope cache (that handle
-* is shared with the other project-tier domains). Mirrors {@link closeNexusDb}.
-*/
-function resetNexusDbState() {
-	releaseDomainBindings({
-		scope: "project",
-		domain: "nexus"
-	});
-}
-/**
-* Get the underlying node:sqlite DatabaseSync instance for the nexus domain.
-* Useful for direct PRAGMA calls or raw SQL operations.
-* Returns null if the database hasn't been initialized.
-*/
-function getNexusNativeDb() {
-	return boundProjectNative("nexus");
-}
-
-export { NEXUS_SCHEMA_VERSION as N, _resetNestedNexusWarningGate as _, getNexusNativeDb as a, bindNexusDomain as b, closeNexusDb as c, detectAndWarnOnNestedNexus as d, getNestedNexusSentinelPath as e, getNexusDbPath as f, getNexusDb as g, getNexusRegistryDbPath as h, resolveNexusMigrationsFolder as i, boundProjectNative as j, bindProjectDomain as k, bindGlobalDomainAtPath as l, peekDomainAtPath as m, drizzle as n, releaseDomainBindings as o, peekProjectDomain as p, peekGlobalDomain as q, resetNexusDbState as r, bindGlobalDomain as s };
-//# sourceMappingURL=nexus-sqlite2-BBfY2xnY.js.map