nexarch 0.12.22 → 0.12.25

package/dist/commands/enroll.js

@@ -0,0 +1,87 @@
+import { hostname, platform, arch } from "node:os";
+import { mkdirSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+// Matches www.nexarch.ai — the default production host for the web app that
+// owns /api/agent-enrollments/exchange. Not the same service as
+// mcp.nexarch.ai (the MCP gateway); --host exists because staging and
+// self-hosted deployments serve the exchange route from a different origin.
+const DEFAULT_EXCHANGE_HOST = "https://www.nexarch.ai";
+const ERROR_MESSAGES = {
+    enrollment_invalid: "The enrollment code is invalid, expired, or already used. Ask whoever created it to issue a new one.",
+    enrollment_client_mismatch: "This code was issued for a different client type than the one passed to --client. Check the client code against the one configured when the enrollment was created.",
+    server_not_configured: "The Nexarch server is missing its gateway URL configuration (MCP_GATEWAY_PUBLIC_URL). This is a server-side issue — ask whoever operates that deployment to set it, then retry with the same code.",
+};
+function parseFlag(args, flag) {
+    return args.includes(flag);
+}
+function parseOptionValue(args, option) {
+    const idx = args.indexOf(option);
+    if (idx === -1)
+        return null;
+    const value = args[idx + 1];
+    if (!value || value.startsWith("--"))
+        return null;
+    return value;
+}
+function redactedManifest(manifest) {
+    return { ...manifest, credential: { ...manifest.credential, token: "(redacted — see saved file, or pass --print-token)" } };
+}
+/**
+ * Bootstraps a headless (browserless) MCP agent by redeeming a one-time
+ * enrollment code for a long-lived credential — the CLI equivalent of the
+ * curl snippet the workspace UI shows (headless-enrollment-form.tsx). Reuses
+ * the exact same unauthenticated exchange endpoint; the only thing this adds
+ * is host/platform auto-detection, an error message per failure mode instead
+ * of a raw JSON blob, and keeping the credential out of stdout/shell history
+ * by default.
+ */
+export async function enroll(args) {
+    const asJson = parseFlag(args, "--json");
+    const printToken = parseFlag(args, "--print-token");
+    const code = parseOptionValue(args, "--code");
+    const clientCode = parseOptionValue(args, "--client");
+    const clientVersion = parseOptionValue(args, "--client-version");
+    const host = parseOptionValue(args, "--host") ?? DEFAULT_EXCHANGE_HOST;
+    const outPath = parseOptionValue(args, "--out");
+    if (!code || !code.startsWith("nxe_")) {
+        throw new Error("Missing or invalid --code (expected a one-time code starting with 'nxe_' from the workspace UI).");
+    }
+    if (!clientCode) {
+        throw new Error("Missing --client (the client code configured for this enrollment, e.g. hermes-agent).");
+    }
+    const res = await fetch(`${host}/api/agent-enrollments/exchange`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({
+            code,
+            client: { code: clientCode, version: clientVersion ?? undefined },
+            host: { hostname: hostname(), platform: platform(), arch: arch() },
+        }),
+    });
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) {
+        const errorCode = typeof body.error === "string" ? body.error : null;
+        const message = (errorCode && ERROR_MESSAGES[errorCode]) ?? `Enrollment exchange failed (${errorCode ?? res.status}).`;
+        throw new Error(message);
+    }
+    const manifest = body;
+    const destination = outPath ?? join(homedir(), ".nexarch", "agent-credential.json");
+    mkdirSync(dirname(destination), { recursive: true });
+    writeFileSync(destination, JSON.stringify(manifest, null, 2), { mode: 0o600 });
+    if (asJson) {
+        const output = printToken ? manifest : redactedManifest(manifest);
+        process.stdout.write(`${JSON.stringify(output, null, 2)}\n`);
+        return;
+    }
+    console.log(`✓ Enrolled agent ${manifest.agent.ref} in workspace "${manifest.workspace.name}"`);
+    console.log(`  Scopes     : ${manifest.credential.scopes.join(", ")}`);
+    console.log(`  Expires    : ${manifest.credential.expiresAt ?? "never"}`);
+    console.log(`  MCP server : ${manifest.mcp.url}`);
+    console.log(`  Credential : saved to ${destination} (mode 600)`);
+    console.log(`\nExport it as ${manifest.mcp.auth.environmentVariable} in the agent runtime's own environment — read`);
+    console.log(`the token from that file rather than pasting it into a shell command or config file.`);
+    if (printToken) {
+        console.log(`\nToken: ${manifest.credential.token}`);
+    }
+}

package/dist/commands/init-agent.js

@@ -2,6 +2,7 @@ import { arch, homedir, hostname, platform, release, type as osType, userInfo }
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";
 import { basename, join, resolve } from "path";
 import * as readline from "node:readline/promises";
+import { createHash } from "node:crypto";
 import process from "process";
 import { requireCredentials } from "../lib/credentials.js";
 import { fetchAgentRegistryOrThrow } from "../lib/agent-registry.js";
@@ -19,6 +20,10 @@ const CLI_VERSION = (() => {
 })();
 const AGENT_ENTITY_TYPE = "agent";
 const TECH_COMPONENT_ENTITY_TYPE = "technology_component";
+/** Hashes the exact managed-section text a trust attestation will be minted for — see ADR-0112. */
+function sha256Hex(text) {
+    return createHash("sha256").update(text, "utf8").digest("hex");
+}
 function parseFlag(args, flag) {
     return args.includes(flag);
 }
@@ -337,7 +342,13 @@ function canonicalTargetKey(filePath) {
     const abs = resolve(filePath);
     return process.platform === "win32" || process.platform === "darwin" ? abs.toLowerCase() : abs;
 }
-function injectAgentConfigs(registry, runtimeCodes) {
+/**
+ * `dryRun: true` computes what WOULD happen (status + the exact section body,
+ * so a caller can hash it) without touching any file. Callers must resolve
+ * consent from the dry-run result before calling again with `dryRun: false`
+ * to actually write — see the ADR-0112 note at the call site.
+ */
+function injectAgentConfigs(registry, runtimeCodes, dryRun) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const sortedTargets = [...registry.instructionTargets]
         .filter((target) => target.matchMode === "exact")
@@ -356,8 +367,9 @@ function injectAgentConfigs(registry, runtimeCodes) {
         const sectionMarker = target.sectionMarker ?? sectionHeading;
         const managedBody = wrapManagedSection("agent-registration", sectionBody);
         if (!existsSync(filePath)) {
-            writeFileSync(filePath, `${managedBody}\n`, "utf8");
-            return { path: filePath, status: "injected" };
+            if (!dryRun)
+                writeFileSync(filePath, `${managedBody}\n`, "utf8");
+            return { path: filePath, status: "injected", sectionBody };
         }
         const existing = readFileSync(filePath, "utf8");
         if (target.insertionMode === "replace_section") {
@@ -371,23 +383,26 @@ function injectAgentConfigs(registry, runtimeCodes) {
                 replaced = `${before}${managedBody}\n`;
             }
             if (replaced !== existing) {
-                writeFileSync(filePath, replaced, "utf8");
-                return { path: filePath, status: "updated" };
+                if (!dryRun)
+                    writeFileSync(filePath, replaced, "utf8");
+                return { path: filePath, status: "updated", sectionBody };
             }
             if (existing.includes(managedBody) || existing.includes(sectionBody)) {
-                return { path: filePath, status: "already_present" };
+                return { path: filePath, status: "already_present", sectionBody };
             }
             const separator = existing.endsWith("\n") ? "" : "\n";
-            writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
-            return { path: filePath, status: "injected" };
+            if (!dryRun)
+                writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
+            return { path: filePath, status: "injected", sectionBody };
         }
         if (existing.includes(managedBody) || existing.includes(sectionBody)) {
-            return { path: filePath, status: "already_present" };
+            return { path: filePath, status: "already_present", sectionBody };
         }
         const separator = existing.endsWith("\n") ? "" : "\n";
         const next = existing + separator + managedBody + "\n";
-        writeFileSync(filePath, next, "utf8");
-        return { path: filePath, status: "injected" };
+        if (!dryRun)
+            writeFileSync(filePath, next, "utf8");
+        return { path: filePath, status: "injected", sectionBody };
     };
     const seenTargets = new Set();
     const existingMatches = [];
@@ -552,7 +567,8 @@ function injectInitProjectReportingContract(path) {
     }
     writeFileSync(path, replaced !== existing ? replaced : `${existing}${existing.endsWith("\n") ? "" : "\n"}${managed}\n`, "utf8");
 }
-function injectGenericAgentConfig(registry) {
+/** Same dry-run contract as {@link injectAgentConfigs}. */
+function injectGenericAgentConfig(registry, dryRun) {
     const templateByCode = new Map(registry.instructionTemplates.map((t) => [t.code, t]));
     const genericTargets = [...registry.instructionTargets]
         .filter((t) => t.runtimeCode === "generic" && t.matchMode === "exact")
@@ -571,8 +587,9 @@ function injectGenericAgentConfig(registry) {
         const sectionHeading = target.sectionHeading ?? "## Nexarch Agent Registration";
         const managedBody = wrapManagedSection("agent-registration", sectionBody);
         if (!existsSync(filePath)) {
-            writeFileSync(filePath, `${managedBody}\n`, "utf8");
-            return [{ path: filePath, status: "injected" }];
+            if (!dryRun)
+                writeFileSync(filePath, `${managedBody}\n`, "utf8");
+            return [{ path: filePath, status: "injected", sectionBody }];
         }
         const existing = readFileSync(filePath, "utf8");
         if (target.insertionMode === "replace_section") {
@@ -581,19 +598,21 @@ function injectGenericAgentConfig(registry) {
                 replaced = replaceInjectedSection(existing, sectionHeading, managedBody);
             }
             if (replaced !== existing) {
-                writeFileSync(filePath, replaced, "utf8");
-                return [{ path: filePath, status: "updated" }];
+                if (!dryRun)
+                    writeFileSync(filePath, replaced, "utf8");
+                return [{ path: filePath, status: "updated", sectionBody }];
             }
             if (existing.includes(managedBody) || existing.includes(sectionBody)) {
-                return [{ path: filePath, status: "already_present" }];
+                return [{ path: filePath, status: "already_present", sectionBody }];
             }
         }
         if (existing.includes(managedBody) || existing.includes(sectionBody)) {
-            return [{ path: filePath, status: "already_present" }];
+            return [{ path: filePath, status: "already_present", sectionBody }];
         }
         const separator = existing.endsWith("\n") ? "" : "\n";
-        writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
-        return [{ path: filePath, status: "injected" }];
+        if (!dryRun)
+            writeFileSync(filePath, existing + separator + managedBody + "\n", "utf8");
+        return [{ path: filePath, status: "injected", sectionBody }];
     }
     const fallbackTemplate = templateByCode.get("nexarch_agent_registration_v1") ?? registry.instructionTemplates[0];
     if (!fallbackTemplate)
@@ -602,8 +621,9 @@ function injectGenericAgentConfig(registry) {
     const sectionBody = fallbackTemplate.body.trim();
     const managedBody = wrapManagedSection("agent-registration", sectionBody);
     if (!existsSync(fallbackPath)) {
-        writeFileSync(fallbackPath, `${managedBody}\n`, "utf8");
-        return [{ path: fallbackPath, status: "injected" }];
+        if (!dryRun)
+            writeFileSync(fallbackPath, `${managedBody}\n`, "utf8");
+        return [{ path: fallbackPath, status: "injected", sectionBody }];
     }
     const existing = readFileSync(fallbackPath, "utf8");
     const sectionHeading = "## Nexarch Agent Registration";
@@ -612,15 +632,17 @@ function injectGenericAgentConfig(registry) {
         replaced = replaceInjectedSection(existing, sectionHeading, managedBody);
     }
     if (replaced !== existing) {
-        writeFileSync(fallbackPath, replaced, "utf8");
-        return [{ path: fallbackPath, status: "updated" }];
+        if (!dryRun)
+            writeFileSync(fallbackPath, replaced, "utf8");
+        return [{ path: fallbackPath, status: "updated", sectionBody }];
     }
     if (existing.includes(managedBody) || existing.includes(sectionBody)) {
-        return [{ path: fallbackPath, status: "already_present" }];
+        return [{ path: fallbackPath, status: "already_present", sectionBody }];
     }
     const separator = existing.endsWith("\n") ? "" : "\n";
-    writeFileSync(fallbackPath, existing + separator + managedBody + "\n", "utf8");
-    return [{ path: fallbackPath, status: "injected" }];
+    if (!dryRun)
+        writeFileSync(fallbackPath, existing + separator + managedBody + "\n", "utf8");
+    return [{ path: fallbackPath, status: "injected", sectionBody }];
 }
 export async function initAgent(args) {
     const asJson = parseFlag(args, "--json");
@@ -1196,11 +1218,20 @@ export async function initAgent(args) {
         catch {
             // non-fatal
         }
-        let existingInstructionTargets = injectAgentConfigs(registry, explicitInstructionRuntimeTargets.length > 0
+        const runtimeTargetCodes = explicitInstructionRuntimeTargets.length > 0
             ? explicitInstructionRuntimeTargets
-            : (selectedClient ? [selectedClient] : []));
+            : (selectedClient ? [selectedClient] : []);
+        // Dry run first: figure out what WOULD be written — and, critically,
+        // whether the repo's files already match, which is how `alreadyConfigured`
+        // below decides consent is even needed — without writing anything yet.
+        // The write itself only happens after `instructionsWriteAllowed` is
+        // resolved. (Previously `injectAgentConfigs`/`injectGenericAgentConfig`
+        // wrote unconditionally here and the consent check only gated whether a
+        // trust attestation got added afterward — so CLAUDE.md/AGENTS.md could be
+        // modified before the human had said yes to anything.)
+        let existingInstructionTargets = injectAgentConfigs(registry, runtimeTargetCodes, true);
         if (existingInstructionTargets.length === 0) {
-            existingInstructionTargets = injectGenericAgentConfig(registry);
+            existingInstructionTargets = injectGenericAgentConfig(registry, true);
         }
         const alreadyConfigured = existingInstructionTargets.length > 0 && existingInstructionTargets.every((r) => r.status === "already_present");
         if (denyInstructionWriteFlag) {
@@ -1216,33 +1247,49 @@ export async function initAgent(args) {
             instructionsWriteAllowed = await confirmInstructionWrite();
         }
         if (instructionsWriteAllowed) {
-            agentConfigResults = existingInstructionTargets;
+            // Consent granted (flag or interactive confirm) — write for real.
+            agentConfigResults = injectAgentConfigs(registry, runtimeTargetCodes, false);
+            if (agentConfigResults.length === 0) {
+                agentConfigResults = injectGenericAgentConfig(registry, false);
+            }
         }
         else if (alreadyConfigured) {
+            // Nothing would change either way (every target already matches), so
+            // the dry-run result is accurate and no second pass is needed.
             agentConfigResults = existingInstructionTargets;
         }
-        // Inject trust attestation for any file actually written (injected/updated),
-        // plus all targets when instructionsWriteAllowed forces a refresh.
-        // Runs regardless of instructionsWriteAllowed so writes that happened before
-        // the consent check always get a trust block.
+        // Attest only files actually written (injected/updated) just now. When
+        // consent wasn't granted, nothing was written above — `existingInstructionTargets`
+        // is dry-run data with no corresponding file change — so there is
+        // nothing new to attest. An "already_present" target needs no fresh
+        // attestation either: its content, and whatever attestation it already
+        // carries from a prior run, hasn't changed.
         const attestationTargets = instructionsWriteAllowed
-            ? agentConfigResults
-            : existingInstructionTargets.filter((r) => r.status === "injected" || r.status === "updated");
+            ? agentConfigResults.filter((r) => r.status === "injected" || r.status === "updated")
+            : [];
         if (attestationTargets.length > 0) {
             trustAttestationAttempted = true;
-            try {
-                trustAttestation = await requestTrustAttestation(agentId);
-            }
-            catch {
-                trustAttestation = { ok: false, reason: "request failed" };
-            }
+            // Minted per target, not once for the batch: each file's managed
+            // section can carry different text (different templateCode per
+            // runtime), and the attestation has to bind to the exact bytes it
+            // covers — see ADR-0112. `trustAttestation` keeps the first result for
+            // the JSON summary field; every target still gets its own token.
             for (const r of attestationTargets) {
+                let targetAttestation;
+                try {
+                    targetAttestation = await requestTrustAttestation(agentId, sha256Hex(r.sectionBody));
+                }
+                catch {
+                    targetAttestation = { ok: false, reason: "request failed" };
+                }
+                if (!trustAttestation)
+                    trustAttestation = targetAttestation;
                 try {
-                    if (trustAttestation.ok) {
-                        injectTrustAttestationBlock(r.path, trustAttestation);
+                    if (targetAttestation.ok) {
+                        injectTrustAttestationBlock(r.path, targetAttestation);
                     }
                     else {
-                        injectTrustAttestationUnavailableBlock(r.path, trustAttestation.reason ?? "unknown");
+                        injectTrustAttestationUnavailableBlock(r.path, targetAttestation.reason ?? "unknown");
                     }
                     injectInitProjectReportingContract(r.path);
                 }

package/dist/commands/init-project-data.js

@@ -0,0 +1,181 @@
+import { basename } from "path";
+import { requireCredentials } from "../lib/credentials.js";
+import { callMcpTool } from "../lib/mcp.js";
+import { detectSourceRepository, resolveProjectIdentity } from "./init-project.js";
+/**
+ * Onboarding for a data-pipeline repository: dbt, Airflow, Dagster, Dataform,
+ * ksqlDB, or Spark (data-architecture-plan.md 1.3, H-06).
+ *
+ * Mirrors init-project-infra.ts's shape deliberately: register first, report
+ * what is still outstanding, never claim completion the write did not earn.
+ * Unlike the infrastructure path there is no state to read afterwards — every
+ * component this scan finds is written in the one pass, so a successful,
+ * non-dry-run write is enrichmentCompleted: true outright.
+ *
+ * The pipeline registers as a `project` (ADR 8a: evidence, not architecture,
+ * same identity resolution as a regular repo — H-05) sourcing an
+ * `application` (subtype app_custom_built — no application subtype names
+ * "data pipeline" specifically, and this is a detection fix, not an ontology
+ * change). Its models/DAGs/assets become `application_component` children
+ * using subtypes that already exist and are already legal
+ * (app_comp_data_pipeline, orchestrator_component) — verified live,
+ * 2026-08-24.
+ */
+const RUNTIME_LABEL = {
+    dbt: "dbt model",
+    airflow: "Airflow DAG",
+    dagster: "Dagster asset",
+    dataform: "Dataform definition",
+    ksqldb: "ksqlDB script",
+    spark: "Spark job",
+};
+function readResult(raw) {
+    return JSON.parse(raw.content?.[0]?.text ?? "{}");
+}
+function slugify(value) {
+    return value.trim().toLowerCase().replace(/[^a-z0-9]+/g, "_").replace(/^_+|_+$/g, "").slice(0, 80);
+}
+function chunk(items, size) {
+    const out = [];
+    for (let i = 0; i < items.length; i += size)
+        out.push(items.slice(i, i + size));
+    return out;
+}
+export async function runDataProjectOnboarding(options, detection) {
+    const { dir, nameOverride, asJson, dryRun } = options;
+    const creds = requireCredentials();
+    const runtime = detection.runtime;
+    const displayName = nameOverride ?? basename(dir);
+    const projectDirSlug = slugify(displayName);
+    const detectedRepo = detectSourceRepository(dir);
+    const projectIdentity = dryRun
+        ? { key: `project:${projectDirSlug}`, source: "directory_slug" }
+        : await resolveProjectIdentity(creds.companyId, detectedRepo, displayName, projectDirSlug);
+    const projectRef = projectIdentity.key;
+    // The application and its components derive their slug from the RESOLVED
+    // project identity, not the current checkout's directory name — otherwise
+    // tier 1/2 dedupe the project entity but every application_component
+    // still mints fresh under application:01_jaffle_shop beside
+    // application:jaffle_shop, which is the same H-05 bug one level down.
+    const resolvedSlug = projectIdentity.key.split(":").slice(1).join(":") || projectDirSlug;
+    const applicationRef = `application:${resolvedSlug}`;
+    if (!asJson) {
+        console.log(`\nDetected a ${runtime} data pipeline — ${detection.signals.join(", ")}.`);
+        if (projectIdentity.source !== "directory_slug") {
+            console.log(`  Identity: matched existing project via ${projectIdentity.source.replace(/_/g, " ")} (${projectRef})`);
+        }
+        console.log(dryRun
+            ? `Dry run — nothing below is written. ${displayName} would be registered as ${projectRef} sourcing ${applicationRef}.`
+            : `Registering ${displayName} as ${projectRef} sourcing ${applicationRef}.`);
+    }
+    const scanProvenance = {
+        source: "nexarch_cli_init_project",
+        source_dir: dir,
+        scanned_at: new Date().toISOString(),
+        data_runtime: runtime,
+        ...(detectedRepo?.url ? { repository_url: detectedRepo.url, source_repository_url: detectedRepo.url } : {}),
+    };
+    const projectEntity = {
+        entityRef: projectRef,
+        entityTypeCode: "project",
+        entitySubtypeCode: "project_repository",
+        name: displayName,
+        confidence: 1,
+        attributes: scanProvenance,
+    };
+    const applicationEntity = {
+        entityRef: applicationRef,
+        entityTypeCode: "application",
+        entitySubtypeCode: "app_custom_built",
+        name: displayName,
+        description: `${runtime} data pipeline (${detection.signals.join(", ")}).`,
+        confidence: 1,
+        attributes: scanProvenance,
+    };
+    const componentEntities = detection.components.map((c) => ({
+        entityRef: `application_component:${resolvedSlug}_${c.slug}`,
+        entityTypeCode: "application_component",
+        entitySubtypeCode: c.subtypeCode,
+        name: c.name,
+        description: `${RUNTIME_LABEL[runtime]} at ${c.relativePath}`,
+        confidence: 0.9,
+        attributes: { source: "nexarch_cli_init_project", data_runtime: runtime, source_path: c.relativePath },
+    }));
+    const entities = [projectEntity, applicationEntity, ...componentEntities];
+    const relationships = [
+        { fromEntityRef: applicationRef, toEntityRef: projectRef, relationshipTypeCode: "sourced_from", confidence: 1 },
+        ...componentEntities.map((c) => ({
+            fromEntityRef: c.entityRef,
+            toEntityRef: applicationRef,
+            relationshipTypeCode: "part_of",
+            confidence: 0.9,
+        })),
+    ];
+    if (dryRun) {
+        if (asJson) {
+            process.stdout.write(`${JSON.stringify({ ok: true, dryRun: true, wrote: false, projectRef, applicationRef, dataRuntime: runtime, registrationStatus: "skeleton_only", enrichmentCompleted: false, detection, plan: { entities, relationships } }, null, 2)}\n`);
+            return;
+        }
+        console.log(`\nWould write ${entities.length} entit${entities.length === 1 ? "y" : "ies"} (${componentEntities.length} pipeline component(s)):`);
+        for (const e of entities.slice(0, 20))
+            console.log(`    ${e.entityRef}  (${e.entityTypeCode} / ${e.entitySubtypeCode})`);
+        if (entities.length > 20)
+            console.log(`    … and ${entities.length - 20} more`);
+        console.log(`\nWould write ${relationships.length} relationship(s).`);
+        console.log(`\nNothing was written. Re-run without --dry-run to register.`);
+        return;
+    }
+    const policiesRaw = await callMcpTool("nexarch_get_applied_policies", {});
+    const policyBundleHash = readResult(policiesRaw).policyBundleHash ?? null;
+    if (!policyBundleHash) {
+        throw new Error("Policy bootstrap is missing for this workspace. Complete workspace setup before registering a project.");
+    }
+    const agentContext = {
+        agentId: "nexarch-cli:init-project",
+        agentRunId: `init-project-data-${Date.now()}`,
+        repoRef: dir,
+        repoPath: dir,
+        observedAt: new Date().toISOString(),
+        source: "nexarch-cli",
+        model: "n/a",
+        provider: "n/a",
+    };
+    const policyContext = { policyBundleHash, alignmentSummary: { score: 1, violations: [], waivers: [] } };
+    let succeeded = 0;
+    let failed = 0;
+    for (const batch of chunk(entities, 400)) {
+        const raw = await callMcpTool("nexarch_upsert_entities", { entities: batch, agentContext, policyContext, companyId: creds.companyId }, { companyId: creds.companyId });
+        const result = readResult(raw);
+        succeeded += Number(result.summary?.succeeded ?? 0);
+        failed += Number(result.summary?.failed ?? 0);
+    }
+    for (const batch of chunk(relationships, 400)) {
+        await callMcpTool("nexarch_upsert_relationships", { relationships: batch, agentContext, policyContext, companyId: creds.companyId }, { companyId: creds.companyId });
+    }
+    if (projectIdentity.source === "directory_slug") {
+        try {
+            await callMcpTool("nexarch_register_alias", { alias: displayName, canonicalExternalKey: projectRef, canonicalName: displayName, entityTypeCode: "project", companyId: creds.companyId }, { companyId: creds.companyId });
+        }
+        catch {
+            // Non-fatal — see resolveProjectIdentity's tier 2.
+        }
+    }
+    if (!asJson) {
+        console.log(`  ✓ Registered ${projectRef} sourcing ${applicationRef}`);
+        console.log(`  ✓ Registered ${componentEntities.length} ${RUNTIME_LABEL[runtime]}(s) as application_component, part_of ${applicationRef}`);
+        if (failed > 0)
+            console.log(`  ! ${failed} entit${failed === 1 ? "y" : "ies"} failed to write — see JSON output (--json) for details.`);
+    }
+    else {
+        process.stdout.write(`${JSON.stringify({
+            ok: failed === 0,
+            projectRef,
+            applicationRef,
+            dataRuntime: runtime,
+            registrationStatus: "enriched",
+            enrichmentCompleted: true,
+            detection,
+            summary: { entitiesRequested: entities.length, entitiesSucceeded: succeeded, entitiesFailed: failed, relationshipsWritten: relationships.length },
+        }, null, 2)}\n`);
+    }
+}