nexus-agents 11.4.2 → 11.4.4

package/dist/{ast-rule-runner-UZS3CBHO.js → ast-rule-runner-UIBITXDJ.js}

@@ -9,11 +9,11 @@ import {
   getBuiltInAstRulesPath,
   loadRules,
   runAstQaRules
-} from "./chunk-EOIUMPFK.js";
-import "./chunk-M7JXKUFB.js";
+} from "./chunk-FYXIWH62.js";
+import "./chunk-WM2BE65D.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-DS6X6MFM.js";
-import "./chunk-NSELDEAX.js";
+import "./chunk-5FYSIB3L.js";
+import "./chunk-5TW3NLWA.js";
 import "./chunk-RUHKJC3X.js";
 import "./chunk-UFAK5UGH.js";
 import "./chunk-GR6WCJWY.js";
@@ -34,4 +34,4 @@ export {
   loadRules,
   runAstQaRules
 };
-//# sourceMappingURL=ast-rule-runner-UZS3CBHO.js.map
+//# sourceMappingURL=ast-rule-runner-UIBITXDJ.js.map

package/dist/{child-mcp-config-353PE3ID.js → child-mcp-config-EMNCNHKM.js}

@@ -1,10 +1,10 @@
 import {
   nexusMkdtempSync
 } from "./chunk-U7HL7FGS.js";
-import "./chunk-M7JXKUFB.js";
+import "./chunk-WM2BE65D.js";
 import "./chunk-XBEKMUTO.js";
-import "./chunk-DS6X6MFM.js";
-import "./chunk-NSELDEAX.js";
+import "./chunk-5FYSIB3L.js";
+import "./chunk-5TW3NLWA.js";
 import "./chunk-RUHKJC3X.js";
 import "./chunk-UFAK5UGH.js";
 import {
@@ -81,4 +81,4 @@ async function generateMcpConfig(options) {
 export {
   generateMcpConfig
 };
-//# sourceMappingURL=child-mcp-config-353PE3ID.js.map
+//# sourceMappingURL=child-mcp-config-EMNCNHKM.js.map

package/dist/{chunk-ME7LKSBK.js → chunk-4DHC2TDC.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-J7UDMLPP.js";
+} from "./chunk-4IN3DHXY.js";
 import {
   ReputationCache,
   assessReputation,
@@ -9,10 +9,10 @@ import {
   resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-HQ2SMW4Y.js";
+} from "./chunk-773AZVR3.js";
 import {
   hasToken
-} from "./chunk-KCESFTXP.js";
+} from "./chunk-N5DHPHPE.js";
 import {
   toContentTrustProvenanceRecord
 } from "./chunk-ZO6ZKR7L.js";
@@ -25,7 +25,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger,
   getTimeProvider
@@ -2647,4 +2647,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-ME7LKSBK.js.map
+//# sourceMappingURL=chunk-4DHC2TDC.js.map

package/dist/{chunk-J7UDMLPP.js → chunk-4IN3DHXY.js}

@@ -2,7 +2,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -285,4 +285,4 @@ export {
   ScmError,
   GitHubProvider
 };
-//# sourceMappingURL=chunk-J7UDMLPP.js.map
+//# sourceMappingURL=chunk-4IN3DHXY.js.map

package/dist/{chunk-DS6X6MFM.js → chunk-5FYSIB3L.js}

@@ -5,7 +5,7 @@ import {
   getDefaultRegistry,
   peekDefaultRegistry,
   unpricedCliCostPer1M
-} from "./chunk-NSELDEAX.js";
+} from "./chunk-5TW3NLWA.js";
 import {
   CLI_NAMES
 } from "./chunk-MTN5VMBX.js";
@@ -343,4 +343,4 @@ export {
   findBestModelForOutput,
   modelSupportsAll
 };
-//# sourceMappingURL=chunk-DS6X6MFM.js.map
+//# sourceMappingURL=chunk-5FYSIB3L.js.map

package/dist/{chunk-NSELDEAX.js → chunk-5TW3NLWA.js}

@@ -1645,7 +1645,7 @@ function setDefaultRegistry(registry) {
 }
 async function reloadDefaultRegistry() {
   globalRegistry = buildDefaultRegistry();
-  const { resetGlobalRegistry } = await import("./unified-registry-IZ46TOAY.js");
+  const { resetGlobalRegistry } = await import("./unified-registry-GXELRMCT.js");
   resetGlobalRegistry();
   return globalRegistry;
 }
@@ -1674,4 +1674,4 @@ export {
   setDefaultRegistry,
   reloadDefaultRegistry
 };
-//# sourceMappingURL=chunk-NSELDEAX.js.map
+//# sourceMappingURL=chunk-5TW3NLWA.js.map

package/dist/{chunk-MPYHD4EV.js → chunk-6MOCJOKU.js}

@@ -5,7 +5,7 @@ import {
   OPENAI_COMPAT_URL_ENV,
   err,
   ok
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -307,4 +307,4 @@ export {
   hostnameOf,
   redactApiKey
 };
-//# sourceMappingURL=chunk-MPYHD4EV.js.map
+//# sourceMappingURL=chunk-6MOCJOKU.js.map

package/dist/{chunk-HQ2SMW4Y.js → chunk-773AZVR3.js}

@@ -14,7 +14,7 @@ import {
 // src/security/input-sanitizer.ts
 var DANGEROUS_HTML_PATTERN = /<(picture|source|img)\b[^>]*>[\s\S]*?<\/\1>|<(picture|source|img)\b[^>]*\/?>/gi;
 var XML_INJECTION_PATTERN = /<\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\b[^>]*>/gi;
-var HTML_COMMENT_PATTERN = /<!--[\s\S]*?-->/g;
+var HTML_COMMENT_PATTERN = /\x3c!--[\s\S]*?-->/g;
 var INJECTION_PATTERNS = [
   {
     flag: "authority_claim",
@@ -177,7 +177,7 @@ function stripHtmlComments(content) {
   }
   return { cleaned, stripped };
 }
-var HTML_COMMENT_DETECT = /<!--[\s\S]*?-->/;
+var HTML_COMMENT_DETECT = /\x3c!--[\s\S]*?-->/;
 function detectInjectionPatterns(content) {
   const flags = /* @__PURE__ */ new Set();
   if (HTML_COMMENT_DETECT.test(content)) {
@@ -511,4 +511,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-HQ2SMW4Y.js.map
+//# sourceMappingURL=chunk-773AZVR3.js.map

package/dist/chunk-773AZVR3.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/security/input-sanitizer.ts","../src/security/reputation-model.ts","../src/security/env-mode.ts"],"sourcesContent":["/**\n * nexus-agents/security - Input Sanitizer\n *\n * Sanitizes untrusted GitHub input by stripping dangerous HTML/XML tags,\n * detecting injection patterns, and producing a SanitizedInput result\n * with full audit trail.\n *\n * Defense layer 1 of the three-layer hardening architecture.\n * See: docs/architecture/UNTRUSTED_INPUT_HARDENING.md\n *\n * @module security/input-sanitizer\n * (Source: Issue #818, #819 — Phase 1: Input Sanitization)\n */\n\nimport type {\n  InjectionFlag,\n  SanitizedInput,\n  SanitizerConfig,\n  StrippedElement,\n  TrustTier,\n  GitHubUserRole,\n} from './trust-types.js';\nimport { ROLE_DEFAULT_TRUST, SanitizerConfigSchema } from './trust-types.js';\n\n// ============================================================================\n// Dangerous HTML Patterns (Trail of Bits / GitHub Copilot vectors)\n// ============================================================================\n\n/**\n * HTML tags to strip. These are known injection vectors:\n * - `<picture>` / `<source>`: Trail of Bits GitHub Copilot injection\n * - `<img>`: Can carry injection via alt text or onerror\n */\nconst DANGEROUS_HTML_PATTERN =\n  /<(picture|source|img)\\b[^>]*>[\\s\\S]*?<\\/\\1>|<(picture|source|img)\\b[^>]*\\/?>/gi;\n\n// ============================================================================\n// XML-like Tags (Conversation History Injection)\n// ============================================================================\n\n/**\n * XML-like tags that mimic conversation structure or system prompts.\n */\nconst XML_INJECTION_PATTERN =\n  /<\\/?(system|human|assistant|instructions|user|prompt|context|tool_use|tool_result)\\b[^>]*>/gi;\n\n// ============================================================================\n// HTML Comments with Instructions\n// ============================================================================\n\nconst HTML_COMMENT_PATTERN = /\\x3c!--[\\s\\S]*?-->/g;\n\n// ============================================================================\n// Injection Pattern Detectors\n// ============================================================================\n\ninterface PatternMatch {\n  flag: InjectionFlag;\n  pattern: RegExp;\n}\n\nconst INJECTION_PATTERNS: readonly PatternMatch[] = [\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(as (?:a|the) (?:maintainer|admin|owner|security lead|repo owner|developer))\\b/i,\n  },\n  {\n    flag: 'authority_claim',\n    pattern: /\\b(i(?:'m| am) the (?:repo |project )?(?:owner|maintainer|admin))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(please (?:close|merge|label|mark|apply|delete|remove|approve|reject))\\b/i,\n  },\n  {\n    flag: 'instruction_pattern',\n    pattern: /\\b(you (?:should|must|need to) (?:close|merge|label|apply|delete))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(ignore (?:all )?previous (?:instructions|rules|prompts))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(forget (?:your |all )?(?:instructions|rules|safety))\\b/i,\n  },\n  {\n    flag: 'system_prompt_manipulation',\n    pattern: /\\b(new (?:instructions|rules|system prompt|directives))\\b/i,\n  },\n  {\n    flag: 'urgency_manipulation',\n    pattern: /\\b(critical|emergency|urgent|must act now|immediately|time[- ]?sensitive)\\b/i,\n  },\n  {\n    flag: 'fake_conversation',\n    pattern: /<(?:assistant|human|user|system)>/i,\n  },\n  // base64_encoded is detected separately by `looksLikeBase64Payload` below.\n  // The lookahead-based regex it replaced exhibited catastrophic backtracking\n  // on long hex-only inputs (#2191) — see `looksLikeBase64Payload` for the\n  // two-phase rewrite that preserves the #1811 SHA-hash false-positive guard.\n  {\n    flag: 'external_link_instruction',\n    pattern: /(?:apply|run|execute|install)\\s+(?:this\\s+)?(?:from\\s+)?https?:\\/\\//i,\n  },\n];\n\n/**\n * Two-phase base64-payload detection (#2191).\n *\n * The original `(?=[A-Za-z0-9+/]*[g-zG-Z+/=])[A-Za-z0-9+/]{40,}={0,2}` regex\n * was vulnerable to catastrophic backtracking — V8 took ~1.8s on a 50K\n * hex-only adversarial input. Splitting the check into two non-overlapping\n * phases removes the lookahead and makes the worst case linear.\n *\n *   Phase 1: find a 40+ run of base64-alphabet chars (no lookahead).\n *   Phase 2: confirm the matched substring contains a base64-discriminating\n *            char (g-z, G-Z, +, /, =) so SHA-1 / SHA-256 hex hashes don't\n *            false-positive (preserves #1811 behavior).\n *\n * Same detection coverage as the original; same false-positive resistance.\n */\nconst BASE64_RUN_GLOBAL = /[A-Za-z0-9+/]{40,}={0,2}/g;\nconst BASE64_DISCRIMINATOR = /[g-zG-Z+/=]/;\n\nfunction looksLikeBase64Payload(content: string): boolean {\n  // Iterate every 40+ base64-alphabet run rather than just the first one,\n  // so a long hex-only prefix doesn't mask a real base64 payload that\n  // appears later in the content.\n  for (const match of content.matchAll(BASE64_RUN_GLOBAL)) {\n    if (BASE64_DISCRIMINATOR.test(match[0])) return true;\n  }\n  return false;\n}\n\n// ============================================================================\n// HTML Entity Decoding (evasion defense)\n// ============================================================================\n\n/**\n * Dangerous-tag names we will still match after entity decoding.\n * Kept in sync with DANGEROUS_HTML_PATTERN and XML_INJECTION_PATTERN above.\n */\nconst DANGEROUS_TAG_NAMES =\n  'picture|source|img|system|human|assistant|instructions|user|prompt|context|tool_use|tool_result';\n\n/**\n * Detects whether the input contains entity-encoded forms of any dangerous\n * tag (&lt;picture, &#60;system, &#x3c;img …). Used as a cheap pre-check so\n * that benign content with legitimate entities (e.g. \"AT&amp;T\") is passed\n * through untouched and wasModified stays false.\n */\nconst ENCODED_DANGEROUS_TAG_PATTERN = new RegExp(\n  `&(?:lt|#0*60|#x0*3c);\\\\s*\\\\/?\\\\s*(?:${DANGEROUS_TAG_NAMES})\\\\b`,\n  'i'\n);\n\n/** Decodes the subset of HTML entities that can reconstruct tag syntax. */\nfunction decodeEntities(content: string): string {\n  return (\n    content\n      // Numeric (decimal) references\n      .replace(/&#(\\d+);/g, (_match, dec: string) => {\n        const code = Number.parseInt(dec, 10);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Numeric (hex) references\n      .replace(/&#x([0-9a-f]+);/gi, (_match, hex: string) => {\n        const code = Number.parseInt(hex, 16);\n        return Number.isFinite(code) ? String.fromCodePoint(code) : _match;\n      })\n      // Named entities most relevant to tag reconstruction\n      .replace(/&lt;/gi, '<')\n      .replace(/&gt;/gi, '>')\n      .replace(/&quot;/gi, '\"')\n      .replace(/&apos;/gi, \"'\")\n      // &amp; must be decoded last so that &amp;lt; does not resurface as <\n      .replace(/&amp;/gi, '&')\n  );\n}\n\n/**\n * Runs decodeEntities only if the input contains an entity-encoded dangerous\n * tag. This keeps benign content with legitimate entities untouched.\n */\nfunction applyEntityEvasionDefense(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  if (!ENCODED_DANGEROUS_TAG_PATTERN.test(content)) {\n    return { cleaned: content, stripped: [] };\n  }\n  const decoded = decodeEntities(content);\n  return {\n    cleaned: decoded,\n    stripped: [\n      {\n        tag: '&…;',\n        reason: 'HTML entity-encoded dangerous tag decoded for stripping (CWE-79)',\n        startIndex: 0,\n        length: content.length,\n      },\n    ],\n  };\n}\n\n// ============================================================================\n// Core Sanitization Functions\n// ============================================================================\n\n/** Strips dangerous HTML tags and records what was removed.\n * Loops until stable to prevent reconstructed patterns after removal (#1496). */\nfunction stripDangerousHtml(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n  /** True when the loop ran out of passes with the pattern still matching. */\n  incomplete: boolean;\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    DANGEROUS_HTML_PATTERN.lastIndex = 0;\n    if (!DANGEROUS_HTML_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(DANGEROUS_HTML_PATTERN, (match, _g1, _g2, offset: number) => {\n      stripped.push({\n        tag: match.slice(0, 30) + (match.length > 30 ? '...' : ''),\n        reason: 'Dangerous HTML tag (Trail of Bits injection vector)',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  // One more probe. The loop above exits either because the pattern stopped\n  // matching or because it ran out of passes, and the caller could not tell\n  // which — so unconverged content was returned as clean.\n  DANGEROUS_HTML_PATTERN.lastIndex = 0;\n  return { cleaned, stripped, incomplete: DANGEROUS_HTML_PATTERN.test(cleaned) };\n}\n\n/**\n * Strips XML-like tags that mimic conversation structure.\n *\n * Loops to remove a tag RECONSTRUCTED by an earlier removal (#1496):\n * `<sy` + `<system>` + `stem>` becomes `<system>` once the inner tag goes. Each\n * nesting level costs one pass, so depth N needs N+1 — and at depth 6 the loop\n * exhausted its budget and returned a live `<system>` tag as clean.\n */\nfunction stripXmlTags(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n  /** True when the loop ran out of passes with the pattern still matching. */\n  incomplete: boolean;\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    XML_INJECTION_PATTERN.lastIndex = 0;\n    if (!XML_INJECTION_PATTERN.test(cleaned)) break;\n    cleaned = cleaned.replace(XML_INJECTION_PATTERN, (match, _g1, offset: number) => {\n      stripped.push({\n        tag: match,\n        reason: 'XML-like conversation injection tag',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n  }\n  XML_INJECTION_PATTERN.lastIndex = 0;\n  return { cleaned, stripped, incomplete: XML_INJECTION_PATTERN.test(cleaned) };\n}\n\n/** Strips HTML comments that may contain hidden instructions.\n * Loops until stable to prevent reconstructed comment patterns (#1496). */\nfunction stripHtmlComments(content: string): {\n  cleaned: string;\n  stripped: StrippedElement[];\n} {\n  const stripped: StrippedElement[] = [];\n  let cleaned = content;\n  // Loop until stable: stripping may reveal new instruction-bearing comments\n  const MAX_PASSES = 5;\n  for (let pass = 0; pass < MAX_PASSES; pass++) {\n    HTML_COMMENT_PATTERN.lastIndex = 0;\n    const prevLength = cleaned.length;\n    cleaned = cleaned.replace(HTML_COMMENT_PATTERN, (match, offset: number) => {\n      // Unconditional: the old keyword list (ignore|execute|close|merge|delete|\n      // apply) let agent-directed text phrased around it survive, invisible in\n      // rendered markdown, into the prompt. The MCP-layer sanitizer already\n      // strips every comment and documents itself as strictly stronger; the two\n      // layers now agree, and a comment in a PR body is not content a reviewer\n      // reads anyway.\n      stripped.push({\n        tag: '<!-- ... -->',\n        reason: 'HTML comment (hidden content)',\n        startIndex: offset,\n        length: match.length,\n      });\n      return '';\n    });\n    if (cleaned.length === prevLength) break;\n  }\n  // Second pass: strip unclosed <!-- tags (incomplete comment injection)\n  let searchFrom = 0;\n  while (searchFrom < cleaned.length) {\n    const openIdx = cleaned.indexOf('<!--', searchFrom);\n    if (openIdx === -1) break;\n    const closeIdx = cleaned.indexOf('-->', openIdx + 4);\n    if (closeIdx === -1) {\n      stripped.push({\n        tag: '<!--',\n        reason: 'Unclosed HTML comment (potential injection vector)',\n        startIndex: openIdx,\n        length: cleaned.length - openIdx,\n      });\n      cleaned = cleaned.slice(0, openIdx);\n      break;\n    }\n    searchFrom = closeIdx + 3;\n  }\n  return { cleaned, stripped };\n}\n\n/** Non-global twin of HTML_COMMENT_PATTERN — `.test` must not carry lastIndex state. */\nconst HTML_COMMENT_DETECT = /\\x3c!--[\\s\\S]*?-->/;\n\n/**\n * Detects injection patterns in content without modifying it. `hidden_content`\n * is raised here for any HTML comment: the flag is in HOSTILE_INJECTION_FLAGS\n * and the reputation model acts on it, but nothing produced it, so that arm of\n * `hasHostileInjection` could never fire.\n */\nfunction detectInjectionPatterns(content: string): InjectionFlag[] {\n  const flags = new Set<InjectionFlag>();\n  if (HTML_COMMENT_DETECT.test(content)) {\n    flags.add('hidden_content');\n  }\n  for (const { flag, pattern } of INJECTION_PATTERNS) {\n    // Reset lastIndex for global patterns\n    pattern.lastIndex = 0;\n    if (pattern.test(content)) {\n      flags.add(flag);\n    }\n  }\n  if (looksLikeBase64Payload(content)) {\n    flags.add('base64_encoded');\n  }\n  return Array.from(flags);\n}\n\n/** Lower-cases an arbitrary role literal and maps it to a known role. */\nfunction normalizeRole(userRole: string): GitHubUserRole {\n  const lower = userRole.toLowerCase();\n  if (lower in ROLE_DEFAULT_TRUST) return lower as GitHubUserRole;\n  return 'unknown';\n}\n\n/**\n * Assigns trust tier based on user role and injection analysis.\n * Injection patterns can only DOWNGRADE trust, never upgrade.\n */\nfunction assignTrustTier(\n  userRole: GitHubUserRole,\n  injectionFlags: readonly InjectionFlag[],\n  allowlisted: boolean\n): TrustTier {\n  if (allowlisted) return '1';\n\n  // Defensive lowercase — the type says GitHubUserRole, but callers\n  // sometimes cast an unnormalized GitHub author_association literal\n  // (e.g. 'OWNER', 'MEMBER') directly. Normalize here so the maintainer\n  // exemption below matches regardless of case (CWE-178).\n  const normalizedRole = normalizeRole(userRole);\n  const baseTier = ROLE_DEFAULT_TRUST[normalizedRole];\n\n  // Content with injection patterns is downgraded to Tier 4 (hostile)\n  const hostileFlags: InjectionFlag[] = ['system_prompt_manipulation', 'fake_conversation'];\n  if (injectionFlags.some((f) => hostileFlags.includes(f))) return '4';\n\n  // Content with authority claims from non-maintainers is suspicious\n  if (\n    injectionFlags.includes('authority_claim') &&\n    normalizedRole !== 'owner' &&\n    normalizedRole !== 'maintainer'\n  ) {\n    return '4';\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Sanitizes untrusted GitHub input through the full Layer 1 pipeline:\n * 1. HTML stripping (picture/source/img tags)\n * 2. XML tag stripping (system/human/assistant)\n * 3. HTML comment stripping (instruction-bearing comments only)\n * 4. Injection pattern detection\n * 5. Trust tier assignment\n *\n * ⚠ **Use HostileInputFirewall.process() in agent code paths.** Calling\n * sanitizeInput() directly only runs Layer 1 — it does not evaluate the\n * Rule of Two and does not emit audit-trail events. An agent that processes\n * untrusted input while holding both write access and secrets violates the\n * Rule of Two; `evaluatePolicy` in policy-gate.ts enforces that per action,\n * and the firewall evaluates it per input as a signal (refusing only under\n * `NEXUS_FIREWALL_POLICY=enforce`). The live paths route their trust\n * decision through the firewall as of #4992 and keep direct sanitizeInput()\n * calls only for content cleaning of text they embed. Direct use of this\n * function is appropriate for unit tests and pure content analysis, not\n * for agent decision paths.\n *\n * @see packages/nexus-agents/src/security/firewall/firewall-pipeline.ts\n * @see packages/nexus-agents/src/security/policy-gate.ts\n * @param content - Raw untrusted content from GitHub\n * @param userRole - GitHub user's relationship to the repository\n * @param username - GitHub username (for allowlist check)\n * @param config - Optional sanitizer configuration\n * @returns SanitizedInput with cleaned content and audit data\n */\nexport function sanitizeInput(\n  content: string,\n  userRole: GitHubUserRole,\n  username: string,\n  config?: Partial<SanitizerConfig>\n): SanitizedInput {\n  const cfg = SanitizerConfigSchema.parse(config ?? {});\n  const truncatedContent = content.slice(0, cfg.maxInputLength);\n  const truncated = truncatedContent.length < content.length;\n  const allowlisted = cfg.allowlistedMaintainers.includes(username);\n\n  try {\n    // Pipeline: decode entity-encoded dangerous tags, then strip dangerous content\n    const entityDecoded = applyEntityEvasionDefense(truncatedContent);\n    const html = stripDangerousHtml(entityDecoded.cleaned);\n    const xml = stripXmlTags(html.cleaned);\n    const comments = stripHtmlComments(xml.cleaned);\n    const allStripped = [\n      ...entityDecoded.stripped,\n      ...html.stripped,\n      ...xml.stripped,\n      ...comments.stripped,\n    ];\n\n    // Detect on the original AND on what survived stripping, unioned.\n    //\n    // Running only on the original meant a flag could never see a tag that\n    // exists ONLY after stripping — which is exactly the unconverged case. A\n    // six-deep `<sy<sy…<system foo>…stem>` payload left a live `<system>` in\n    // `content` while `injectionFlags` was `[]` and the author kept tier 3, so\n    // `assessPRReputation` and `assessReputation` saw no hostility at all. The\n    // `foo` attribute is what made it slip: `XML_INJECTION_PATTERN` matches\n    // `<system\\b[^>]*>` but the `fake_conversation` detector has no attribute\n    // form, so the ORIGINAL raised nothing.\n    const injectionFlags = [\n      ...new Set([\n        ...detectInjectionPatterns(truncatedContent),\n        ...detectInjectionPatterns(comments.cleaned),\n      ]),\n    ];\n\n    // Assign trust tier\n    const trustTier = assignTrustTier(userRole, injectionFlags, allowlisted);\n\n    return {\n      content: comments.cleaned,\n      originalLength: content.length,\n      trustTier,\n      contentTierMeasured: true,\n      userRole,\n      injectionFlags,\n      // Omitted when every loop converged, so no existing record changes shape.\n      ...(html.incomplete || xml.incomplete ? { sanitizationIncomplete: true } : {}),\n      strippedElements: allStripped,\n      truncated,\n      wasModified: truncated || allStripped.length > 0,\n      sanitizedAt: new Date().toISOString(),\n    };\n  } catch (err: unknown) {\n    return buildFailClosedResult(err, content, truncatedContent, userRole, allowlisted);\n  }\n}\n\n/**\n * Fail-closed result returned when the sanitizer pipeline throws.\n * Returns empty content at Tier-4 (or Tier-1 for allowlisted maintainers,\n * since their bypass is not regex-dependent) so downstream consumers\n * cannot act on untrusted content we could not validate.\n * CLAUDE.md: \"Fail closed on ambiguity.\"\n */\nfunction buildFailClosedResult(\n  err: unknown,\n  originalContent: string,\n  truncated: string,\n  userRole: GitHubUserRole,\n  allowlisted: boolean\n): SanitizedInput {\n  const message = err instanceof Error ? err.message : String(err);\n  return {\n    content: '',\n    originalLength: originalContent.length,\n    trustTier: allowlisted ? '1' : '4',\n    contentTierMeasured: true,\n    userRole,\n    injectionFlags: [],\n    strippedElements: [\n      {\n        tag: '(pipeline-failure)',\n        reason: `Sanitizer pipeline threw; input discarded as fail-closed: ${message}`,\n        startIndex: 0,\n        length: truncated.length,\n      },\n    ],\n    truncated: truncated.length < originalContent.length,\n    wasModified: true,\n    sanitizedAt: new Date().toISOString(),\n  };\n}\n","/**\n * nexus-agents/security - Reputation Model\n *\n * Lightweight trust model for GitHub users that assesses reputation\n * based on account age, contribution history, and behavioral signals.\n * Integrates with the trust classifier for comprehensive trust assessment.\n *\n * @module security/reputation-model\n * (Source: Issue #818, #824 — Phase 3: Reputation Model)\n */\n\nimport { z } from 'zod';\n\nimport { getTimeProvider } from '../core/index.js';\nimport { resolveEnvMode } from './env-mode.js';\nimport type { TrustTier, GitHubUserRole, InjectionFlag } from './trust-types.js';\nimport { TRUST_TIER_NUMERIC, ROLE_DEFAULT_TRUST } from './trust-types.js';\n\n// ============================================================================\n// Types\n// ============================================================================\n\n/**\n * Signals that indicate a suspicious actor.\n */\nexport const SuspiciousSignalSchema = z.enum([\n  'new_account',\n  'no_prior_contributions',\n  'injection_patterns_detected',\n  'rapid_comments',\n  'mismatched_authority_claim',\n]);\nexport type SuspiciousSignal = z.infer<typeof SuspiciousSignalSchema>;\n\n/**\n * GitHub user metadata for reputation assessment.\n */\nexport interface GitHubUserMetadata {\n  readonly username: string;\n  /**\n   * Account/activity fields are OPTIONAL (#3106). When a field is absent (the\n   * caller couldn't fetch it — e.g. the firewall before Phase 3 wiring), its\n   * signal is SKIPPED rather than fabricated: an unknown value must never be\n   * treated as benign (the old hardcoded `365`/`0`) nor as hostile. Only the\n   * `authorAssociation` + `injectionFlags` signals fire on absent activity data.\n   */\n  readonly accountAgeDays?: number;\n  readonly priorContributions?: number;\n  readonly recentCommentCount?: number;\n  readonly recentCommentWindowMinutes?: number;\n  readonly authorAssociation: string;\n  readonly injectionFlags: readonly InjectionFlag[];\n}\n\n/**\n * Result of a reputation assessment.\n */\nexport interface ReputationAssessment {\n  readonly username: string;\n  readonly userRole: GitHubUserRole;\n  /** Measurement coverage; absent on assessments created before coverage tracking. */\n  readonly coverage?: {\n    readonly activity: 'measured' | 'unmeasured';\n  };\n  readonly suspiciousSignals: readonly SuspiciousSignal[];\n  readonly isSuspicious: boolean;\n  readonly effectiveTrustTier: TrustTier;\n  readonly reputationScore: number;\n  readonly reason: string;\n  readonly assessedAt: string;\n}\n\n// ============================================================================\n// Configuration\n// ============================================================================\n\n/** Thresholds for suspicious behavior detection. */\n/** Approximate days per year, used to normalize account age to a 0–10 scale. */\nconst DAYS_PER_YEAR_APPROX = 36.5;\n\nconst SUSPICIOUS_THRESHOLDS = {\n  /** Account younger than this (days) is flagged. */\n  newAccountDays: 30,\n  /** Fewer contributions than this is flagged. */\n  minContributions: 1,\n  /** More comments than this in the window triggers rapid-comment flag. */\n  rapidCommentThreshold: 5,\n  /** Time window (minutes) for rapid comment detection. */\n  rapidCommentWindowMinutes: 10,\n} as const;\n\n// ============================================================================\n// Reputation Cache\n// ============================================================================\n\ninterface CacheEntry {\n  assessment: ReputationAssessment;\n  expiresAt: number;\n}\n\n// Canonical source: config/timeouts.ts (Issue #1046)\nimport { CACHE_TIMEOUTS } from '../config/timeouts.js';\n\nconst DEFAULT_TTL_MS: number = CACHE_TIMEOUTS.reputationTtlMs;\nconst DEFAULT_MAX_SIZE = 1000;\n\n/**\n * In-memory reputation cache with TTL and max size.\n * Reduces redundant assessments for the same user within a short window.\n * Evicts oldest entries when max size is exceeded.\n */\nexport class ReputationCache {\n  private readonly cache = new Map<string, CacheEntry>();\n  private readonly ttlMs: number;\n  private readonly maxSize: number;\n\n  constructor(ttlMs = DEFAULT_TTL_MS, maxSize = DEFAULT_MAX_SIZE) {\n    this.ttlMs = ttlMs;\n    this.maxSize = maxSize;\n  }\n\n  get(username: string): ReputationAssessment | undefined {\n    const entry = this.cache.get(username);\n    if (entry === undefined) return undefined;\n    if (getTimeProvider().now() > entry.expiresAt) {\n      this.cache.delete(username);\n      return undefined;\n    }\n    return entry.assessment;\n  }\n\n  set(username: string, assessment: ReputationAssessment): void {\n    if (this.cache.size >= this.maxSize && !this.cache.has(username)) {\n      this.evictOldest();\n    }\n    this.cache.set(username, {\n      assessment,\n      expiresAt: getTimeProvider().now() + this.ttlMs,\n    });\n  }\n\n  /** Evict a batch of oldest entries (10% of maxSize, minimum 1). */\n  private evictOldest(): void {\n    const batchSize = Math.max(1, Math.floor(this.maxSize * 0.1));\n    const keys = this.cache.keys();\n    for (let i = 0; i < batchSize; i++) {\n      const next = keys.next();\n      if (next.done === true) break;\n      this.cache.delete(next.value);\n    }\n  }\n\n  clear(): void {\n    this.cache.clear();\n  }\n\n  get size(): number {\n    return this.cache.size;\n  }\n}\n\n// ============================================================================\n// Suspicious Signal Detection\n// ============================================================================\n\n/** Only hostile-tier injection flags count — benign flags like\n * instruction_pattern (\"please remove\") must not trip the injection signal. */\nconst HOSTILE_INJECTION_FLAGS: readonly InjectionFlag[] = [\n  'system_prompt_manipulation',\n  'fake_conversation',\n  'authority_claim',\n  'hidden_content',\n];\n\nfunction hasHostileInjection(flags: readonly InjectionFlag[]): boolean {\n  return flags.some((f) => HOSTILE_INJECTION_FLAGS.includes(f));\n}\n\n/** Rapid-comment burst — only when both count and window are known (#3106). */\nfunction isRapidCommenting(m: GitHubUserMetadata): boolean {\n  return (\n    m.recentCommentCount !== undefined &&\n    m.recentCommentWindowMinutes !== undefined &&\n    m.recentCommentCount > SUSPICIOUS_THRESHOLDS.rapidCommentThreshold &&\n    m.recentCommentWindowMinutes <= SUSPICIOUS_THRESHOLDS.rapidCommentWindowMinutes\n  );\n}\n\n/** Authority claim from a non-maintainer role. */\nfunction isMismatchedAuthority(m: GitHubUserMetadata): boolean {\n  if (!m.injectionFlags.includes('authority_claim')) return false;\n  const association = m.authorAssociation.toUpperCase();\n  return association !== 'OWNER' && association !== 'MEMBER';\n}\n\n/** Detect all suspicious signals from user metadata. #3106: account/activity\n * signals are skipped when their data is absent — never fabricated. */\nfunction detectSuspiciousSignals(metadata: GitHubUserMetadata): SuspiciousSignal[] {\n  const signals: SuspiciousSignal[] = [];\n  const { accountAgeDays, priorContributions } = metadata;\n\n  if (accountAgeDays !== undefined && accountAgeDays < SUSPICIOUS_THRESHOLDS.newAccountDays) {\n    signals.push('new_account');\n  }\n  if (\n    priorContributions !== undefined &&\n    priorContributions < SUSPICIOUS_THRESHOLDS.minContributions\n  ) {\n    signals.push('no_prior_contributions');\n  }\n  if (hasHostileInjection(metadata.injectionFlags)) signals.push('injection_patterns_detected');\n  if (isRapidCommenting(metadata)) signals.push('rapid_comments');\n  if (isMismatchedAuthority(metadata)) signals.push('mismatched_authority_claim');\n\n  return signals;\n}\n\n/** Calculate a 0-100 reputation score. */\nfunction calculateReputationScore(\n  metadata: GitHubUserMetadata,\n  signals: readonly SuspiciousSignal[],\n  userRole: GitHubUserRole\n): number {\n  let score = 50; // baseline\n\n  // Role bonus\n  const roleBonus: Record<GitHubUserRole, number> = {\n    owner: 40,\n    maintainer: 35,\n    collaborator: 25,\n    contributor: 15,\n    member: 5,\n    unknown: 0,\n  };\n  score += roleBonus[userRole];\n\n  // Account age bonus (max +10). #3106: absent → no bonus (avoid NaN; an\n  // unknown account neither earns nor loses the age bonus).\n  if (metadata.accountAgeDays !== undefined) {\n    score += Math.min(metadata.accountAgeDays / DAYS_PER_YEAR_APPROX, 10);\n  }\n\n  // Contribution bonus (max +10). #3106: absent → no bonus.\n  if (metadata.priorContributions !== undefined) {\n    score += Math.min(metadata.priorContributions, 10);\n  }\n\n  // Suspicious signal penalties\n  const signalPenalty: Record<SuspiciousSignal, number> = {\n    new_account: -15,\n    no_prior_contributions: -10,\n    injection_patterns_detected: -25,\n    rapid_comments: -20,\n    mismatched_authority_claim: -30,\n  };\n  for (const signal of signals) {\n    score += signalPenalty[signal];\n  }\n\n  return Math.max(0, Math.min(100, Math.round(score)));\n}\n\n/** Map role string to GitHubUserRole. */\nfunction mapRole(association: string): GitHubUserRole {\n  switch (association.toUpperCase()) {\n    case 'OWNER':\n      return 'owner';\n    case 'MEMBER':\n      return 'member';\n    case 'COLLABORATOR':\n      return 'collaborator';\n    case 'CONTRIBUTOR':\n      return 'contributor';\n    default:\n      return 'unknown';\n  }\n}\n\n/** Determine effective trust tier from signals and role. */\nfunction determineEffectiveTier(\n  userRole: GitHubUserRole,\n  signals: readonly SuspiciousSignal[]\n): TrustTier {\n  const baseTier = ROLE_DEFAULT_TRUST[userRole];\n\n  // Hostile signals → Tier 4\n  const hostileSignals: SuspiciousSignal[] = [\n    'injection_patterns_detected',\n    'mismatched_authority_claim',\n  ];\n  if (signals.some((s) => hostileSignals.includes(s))) return '4';\n\n  // Multiple suspicious signals → downgrade by 1, CLAMPED AT TIER 3 (#4681).\n  //\n  // Tier 4 is the HOSTILE tier — `.rules/untrusted-input.md` defines it as\n  // \"injection patterns, hidden HTML, instruction-like content\". It is reached\n  // ONLY via `hostileSignals` above. The generic downgrade must not manufacture\n  // it, because the two most common signals (`new_account` and\n  // `no_prior_contributions`) BOTH fire automatically for any genuine\n  // first-time reporter — they are two readings of one fact, not independent\n  // evidence of hostility. Clamping at 4 meant an `unknown` author (base 3)\n  // filing an ordinary bug report was classified hostile; once enforce mode\n  // became the default (#4675) that refused every new account's first issue\n  // and escalated it to security.\n  //\n  // Tier 3 is the correct destination: \"untrusted\" — still processed, but\n  // never treated as instructions.\n  if (signals.length >= 2) {\n    const baseNumeric = TRUST_TIER_NUMERIC[baseTier];\n    const downgraded = Math.min(baseNumeric + 1, 3);\n    return String(downgraded) as TrustTier;\n  }\n\n  return baseTier;\n}\n\n// ============================================================================\n// Public API\n// ============================================================================\n\n/**\n * Assess a GitHub user's reputation for trust classification.\n *\n * @param metadata - User metadata from GitHub API or local context.\n * @param cache - Optional cache instance for TTL-based deduplication.\n * @returns ReputationAssessment with trust tier and suspicious signals.\n */\nexport function assessReputation(\n  metadata: GitHubUserMetadata,\n  cache?: ReputationCache\n): ReputationAssessment {\n  // Check cache first\n  const cached = cache?.get(metadata.username);\n  if (cached !== undefined) return cached;\n\n  const userRole = mapRole(metadata.authorAssociation);\n  const signals = detectSuspiciousSignals(metadata);\n  const score = calculateReputationScore(metadata, signals, userRole);\n  const effectiveTier = determineEffectiveTier(userRole, signals);\n\n  const assessment: ReputationAssessment = {\n    username: metadata.username,\n    userRole,\n    coverage: {\n      activity:\n        metadata.priorContributions !== undefined &&\n        metadata.recentCommentCount !== undefined &&\n        metadata.recentCommentWindowMinutes !== undefined\n          ? 'measured'\n          : 'unmeasured',\n    },\n    suspiciousSignals: signals,\n    isSuspicious: signals.length > 0,\n    effectiveTrustTier: effectiveTier,\n    reputationScore: score,\n    reason: buildReason(userRole, signals, effectiveTier),\n    assessedAt: new Date().toISOString(),\n  };\n\n  cache?.set(metadata.username, assessment);\n  return assessment;\n}\n\n/**\n * Reconcile a trust-classifier tier with a reputation assessment into the\n * effective tier to enforce (#3119 / epic #3118). Demotion-only — reputation\n * can only RAISE the tier number (more restrictive), never lower it.\n *\n * Invariants:\n * - **Allowlist/Tier-1 wins**: a classifier Tier 1 (owner/allowlisted maintainer)\n *   is authoritative — reputation never demotes it.\n * - **Absent reputation → classifier tier**: no assessment (stage off / not\n *   fetched) keeps the classifier/role-default tier — never fabricate a benign\n *   tier, never escalate on mere absence (fetch-failure ≠ hostile signal).\n * - **Score is advisory**: only `effectiveTrustTier` participates; the 0–100\n *   `reputationScore` never moves the gate.\n */\nexport function reconcileTrustTier(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined\n): TrustTier {\n  if (classifierTier === '1') return '1';\n  const repTier = reputation?.effectiveTrustTier;\n  if (repTier === undefined) return classifierTier;\n  return TRUST_TIER_NUMERIC[repTier] > TRUST_TIER_NUMERIC[classifierTier]\n    ? repTier\n    : classifierTier;\n}\n\n// ============================================================================\n// Reputation gating rollout (#3122 / epic #3118 Phase 4)\n// ============================================================================\n\n/**\n * Rollout mode for reputation-based tier gating, the same `off`/`audit`/\n * `enforce` shape as `NEXUS_FIREWALL_POLICY`: `off` (no reputation effect), `audit`\n * (compute + report the would-be demotion but enforce the classifier tier), or\n * `enforce` (apply the demotion). Default `enforce` since #4667 — see\n * {@link DEFAULT_REPUTATION_GATING_MODE} for the measurement that justified the\n * flip. (This block previously still described the pre-flip `audit` default.)\n */\nexport const ReputationGatingModeSchema = z.enum(['off', 'audit', 'enforce']);\nexport type ReputationGatingMode = z.infer<typeof ReputationGatingModeSchema>;\n\n/**\n * Default gating mode.\n *\n * Flipped `audit` → `enforce` in #4667. `audit` computed the demotion, logged\n * \"would block under enforce\", and let the actions through — so a detected\n * prompt injection changed nothing in the shipped configuration.\n *\n * Measured before flipping, over the real triage path with only the SCM\n * provider mocked: 5/5 hostile inputs blocked, 0 false positives across five\n * real repository issues (as OWNER and as an unaffiliated author), and 0 across\n * ordinary maintainer language (\"please close this\", \"URGENT\", \"you should\n * merge #88 first\"). The one synthetic false-positive class is a body quoting\n * an injection payload verbatim, which is arguably correct fail-closed\n * behaviour for a security report — and is now visible, because a tier-4\n * outcome emits a `RefuseAction` rather than silently approving less.\n *\n * `NEXUS_REPUTATION_GATING=audit` remains available to roll back.\n */\nexport const DEFAULT_REPUTATION_GATING_MODE: ReputationGatingMode = 'enforce';\n\n/**\n * Resolve the gating mode from the environment (invalid → default + warn, never\n * throws — #3130). Delegates to the shared `resolveEnvMode` so this flag and\n * `NEXUS_FIREWALL_POLICY` coerce identically.\n */\nexport function resolveReputationGatingMode(\n  env: NodeJS.ProcessEnv = process.env\n): ReputationGatingMode {\n  return resolveEnvMode(\n    env['NEXUS_REPUTATION_GATING'],\n    ReputationGatingModeSchema,\n    DEFAULT_REPUTATION_GATING_MODE,\n    'NEXUS_REPUTATION_GATING'\n  );\n}\n\n/** Outcome of applying the gating mode to a reputation assessment. */\nexport interface ReputationGateDecision {\n  /** Tier to actually enforce at the policy gate. */\n  readonly enforcedTier: TrustTier;\n  /** Tier reputation reconciliation computed (what `enforce` mode WOULD use). */\n  readonly reconciledTier: TrustTier;\n  /** True when reputation would demote but the mode (off/audit) did not enforce it. */\n  readonly demotionSuppressed: boolean;\n  readonly mode: ReputationGatingMode;\n}\n\n/**\n * Apply the rollout mode to a reputation assessment (#3122). `enforce` gates on\n * the reconciled (possibly demoted) tier; `audit`/`off` gate on the classifier\n * tier but report whether a demotion was suppressed (for telemetry). The\n * Tier-1/allowlist-wins and demotion-only invariants live in `reconcileTrustTier`,\n * so the allowlist remains the escape hatch in every mode.\n */\nexport function gateWithReputation(\n  classifierTier: TrustTier,\n  reputation: ReputationAssessment | undefined,\n  mode: ReputationGatingMode\n): ReputationGateDecision {\n  const reconciledTier =\n    mode === 'off' ? classifierTier : reconcileTrustTier(classifierTier, reputation);\n  const enforcedTier = mode === 'enforce' ? reconciledTier : classifierTier;\n  return {\n    enforcedTier,\n    reconciledTier,\n    demotionSuppressed: mode !== 'enforce' && reconciledTier !== classifierTier,\n    mode,\n  };\n}\n\n/** Build a human-readable reason string. */\nfunction buildReason(\n  role: GitHubUserRole,\n  signals: readonly SuspiciousSignal[],\n  tier: TrustTier\n): string {\n  if (signals.length === 0) {\n    return `Role ${role} → Tier ${tier} (no suspicious signals)`;\n  }\n  const signalList = signals.join(', ');\n  return `Role ${role} → Tier ${tier} (signals: ${signalList})`;\n}\n","/**\n * Shared resolver for `off`/`audit`/`enforce`-style security-mode env vars\n * (#3130). `resolveReputationGatingMode` (reputation gating, #3122) and\n * `resolveFirewallPolicyMode` (#5382) parse an enum env var, coerce an invalid\n * value to a safe default, and must NEVER throw — a security layer must not\n * fail-closed on a misconfiguration at startup. (`resolveAccessPolicyMode`,\n * the original second caller, went with the access-constraint deriver in\n * #5108.)\n *\n * Previously the coercion was silent: a typo'd `enforce` (`enfroce`) degraded\n * to the default with no signal. This helper keeps the never-throw coercion but\n * emits a one-line `warn` so the misconfiguration is observable, and guarantees\n * both flags behave identically.\n *\n * @module security/env-mode\n */\n\nimport type { ZodType } from 'zod';\nimport { createLogger } from '../core/index.js';\nimport type { ILogger } from '../core/index.js';\n\nconst defaultLogger = createLogger({ component: 'env-mode' });\n\n/**\n * Resolve an enum-valued env var to one of its allowed values, coercing an\n * invalid/typo'd value rather than throwing. Unset or empty → `fallback`\n * silently (absence is normal, not a misconfiguration). A non-empty value that\n * fails to parse → `invalidFallback` (default: `fallback`) plus a `warn`, since\n * an explicit-but-invalid value is an operator error worth surfacing. Never\n * throws.\n *\n * @param raw      The raw env value (e.g. `process.env['NEXUS_X']`).\n * @param schema   Zod enum schema for the allowed values.\n * @param fallback Returned when `raw` is absent or empty.\n * @param varName  Env var name, for the warning message.\n * @param options  `logger` (injectable for tests) and `invalidFallback` (the\n *                 mode an explicit-but-invalid value lands on; defaults to\n *                 `fallback`). See the inline docs on the parameter.\n */\nexport function resolveEnvMode<T extends string>(\n  raw: string | undefined,\n  schema: ZodType<T>,\n  fallback: T,\n  varName: string,\n  options: {\n    /** Injectable for testing; defaults to the module logger. */\n    readonly logger?: ILogger;\n    /**\n     * The mode an explicit-but-UNPARSEABLE value lands on. Defaults to\n     * `fallback`, so a caller that does not pass it is byte-identical to the\n     * previous behaviour.\n     *\n     * It exists because `fallback` answers two different questions with one\n     * value: what absence means, and what a typo means. For a flag whose unset\n     * default is the permissive end those answers should differ —\n     * `NEXUS_FIREWALL_POLICY=enfroce` used to resolve to `off`, so an operator\n     * who explicitly asked for enforcement got a gate that refuses nothing\n     * (refines #3130; ratified by a 7-voter panel at the supermajority bar,\n     * 5 of 6 approvers — rationale in the changeset).\n     *\n     * Constrained deliberately: typed as the same `T` as `fallback`, so it can\n     * only select among the flag's own modes and can never introduce a fourth\n     * behaviour. It must never be MORE permissive than `fallback` — a typo may\n     * tighten the gate, never loosen it. A caller whose unset default is\n     * already the strictest mode (e.g. `NEXUS_REPUTATION_GATING`, which\n     * defaults to `enforce`) has nothing to correct and should not pass it.\n     *\n     * Declared inline rather than as an exported interface: no caller needs the\n     * name (they pass object literals), and exporting it would add a symbol\n     * with no cross-file consumer, which the #3024 gate correctly rejects.\n     */\n    readonly invalidFallback?: T;\n  } = {}\n): T {\n  const { logger = defaultLogger, invalidFallback } = options;\n  if (typeof raw !== 'string' || raw.length === 0) return fallback;\n  const parsed = schema.safeParse(raw.toLowerCase());\n  if (parsed.success) return parsed.data;\n  const applied = invalidFallback ?? fallback;\n  // Name the mode actually applied, not just \"the default\": when `applied`\n  // differs from `fallback` a log line saying \"coercing to default\" would\n  // describe a value the process did not use.\n  logger.warn(`Invalid ${varName} value — coercing to ${applied}`, {\n    raw,\n    default: fallback,\n    applied,\n  });\n  return applied;\n}\n"],"mappings":";;;;;;;;;;;;;;AAiCA,IAAM,yBACJ;AASF,IAAM,wBACJ;AAMF,IAAM,uBAAuB;AAW7B,IAAM,qBAA8C;AAAA,EAClD;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,EACX;AACF;AAiBA,IAAM,oBAAoB;AAC1B,IAAM,uBAAuB;AAE7B,SAAS,uBAAuB,SAA0B;AAIxD,aAAW,SAAS,QAAQ,SAAS,iBAAiB,GAAG;AACvD,QAAI,qBAAqB,KAAK,MAAM,CAAC,CAAC,EAAG,QAAO;AAAA,EAClD;AACA,SAAO;AACT;AAUA,IAAM,sBACJ;AAQF,IAAM,gCAAgC,IAAI;AAAA,EACxC,uCAAuC,mBAAmB;AAAA,EAC1D;AACF;AAGA,SAAS,eAAe,SAAyB;AAC/C,SACE,QAEG,QAAQ,aAAa,CAAC,QAAQ,QAAgB;AAC7C,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,qBAAqB,CAAC,QAAQ,QAAgB;AACrD,UAAM,OAAO,OAAO,SAAS,KAAK,EAAE;AACpC,WAAO,OAAO,SAAS,IAAI,IAAI,OAAO,cAAc,IAAI,IAAI;AAAA,EAC9D,CAAC,EAEA,QAAQ,UAAU,GAAG,EACrB,QAAQ,UAAU,GAAG,EACrB,QAAQ,YAAY,GAAG,EACvB,QAAQ,YAAY,GAAG,EAEvB,QAAQ,WAAW,GAAG;AAE7B;AAMA,SAAS,0BAA0B,SAGjC;AACA,MAAI,CAAC,8BAA8B,KAAK,OAAO,GAAG;AAChD,WAAO,EAAE,SAAS,SAAS,UAAU,CAAC,EAAE;AAAA,EAC1C;AACA,QAAM,UAAU,eAAe,OAAO;AACtC,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU;AAAA,MACR;AAAA,QACE,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AACF;AAQA,SAAS,mBAAmB,SAK1B;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,2BAAuB,YAAY;AACnC,QAAI,CAAC,uBAAuB,KAAK,OAAO,EAAG;AAC3C,cAAU,QAAQ,QAAQ,wBAAwB,CAAC,OAAO,KAAK,KAAK,WAAmB;AACrF,eAAS,KAAK;AAAA,QACZ,KAAK,MAAM,MAAM,GAAG,EAAE,KAAK,MAAM,SAAS,KAAK,QAAQ;AAAA,QACvD,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AAIA,yBAAuB,YAAY;AACnC,SAAO,EAAE,SAAS,UAAU,YAAY,uBAAuB,KAAK,OAAO,EAAE;AAC/E;AAUA,SAAS,aAAa,SAKpB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AACd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,0BAAsB,YAAY;AAClC,QAAI,CAAC,sBAAsB,KAAK,OAAO,EAAG;AAC1C,cAAU,QAAQ,QAAQ,uBAAuB,CAAC,OAAO,KAAK,WAAmB;AAC/E,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,wBAAsB,YAAY;AAClC,SAAO,EAAE,SAAS,UAAU,YAAY,sBAAsB,KAAK,OAAO,EAAE;AAC9E;AAIA,SAAS,kBAAkB,SAGzB;AACA,QAAM,WAA8B,CAAC;AACrC,MAAI,UAAU;AAEd,QAAM,aAAa;AACnB,WAAS,OAAO,GAAG,OAAO,YAAY,QAAQ;AAC5C,yBAAqB,YAAY;AACjC,UAAM,aAAa,QAAQ;AAC3B,cAAU,QAAQ,QAAQ,sBAAsB,CAAC,OAAO,WAAmB;AAOzE,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,MAAM;AAAA,MAChB,CAAC;AACD,aAAO;AAAA,IACT,CAAC;AACD,QAAI,QAAQ,WAAW,WAAY;AAAA,EACrC;AAEA,MAAI,aAAa;AACjB,SAAO,aAAa,QAAQ,QAAQ;AAClC,UAAM,UAAU,QAAQ,QAAQ,QAAQ,UAAU;AAClD,QAAI,YAAY,GAAI;AACpB,UAAM,WAAW,QAAQ,QAAQ,OAAO,UAAU,CAAC;AACnD,QAAI,aAAa,IAAI;AACnB,eAAS,KAAK;AAAA,QACZ,KAAK;AAAA,QACL,QAAQ;AAAA,QACR,YAAY;AAAA,QACZ,QAAQ,QAAQ,SAAS;AAAA,MAC3B,CAAC;AACD,gBAAU,QAAQ,MAAM,GAAG,OAAO;AAClC;AAAA,IACF;AACA,iBAAa,WAAW;AAAA,EAC1B;AACA,SAAO,EAAE,SAAS,SAAS;AAC7B;AAGA,IAAM,sBAAsB;AAQ5B,SAAS,wBAAwB,SAAkC;AACjE,QAAM,QAAQ,oBAAI,IAAmB;AACrC,MAAI,oBAAoB,KAAK,OAAO,GAAG;AACrC,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACA,aAAW,EAAE,MAAM,QAAQ,KAAK,oBAAoB;AAElD,YAAQ,YAAY;AACpB,QAAI,QAAQ,KAAK,OAAO,GAAG;AACzB,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,uBAAuB,OAAO,GAAG;AACnC,UAAM,IAAI,gBAAgB;AAAA,EAC5B;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAGA,SAAS,cAAc,UAAkC;AACvD,QAAM,QAAQ,SAAS,YAAY;AACnC,MAAI,SAAS,mBAAoB,QAAO;AACxC,SAAO;AACT;AAMA,SAAS,gBACP,UACA,gBACA,aACW;AACX,MAAI,YAAa,QAAO;AAMxB,QAAM,iBAAiB,cAAc,QAAQ;AAC7C,QAAM,WAAW,mBAAmB,cAAc;AAGlD,QAAM,eAAgC,CAAC,8BAA8B,mBAAmB;AACxF,MAAI,eAAe,KAAK,CAAC,MAAM,aAAa,SAAS,CAAC,CAAC,EAAG,QAAO;AAGjE,MACE,eAAe,SAAS,iBAAiB,KACzC,mBAAmB,WACnB,mBAAmB,cACnB;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAkCO,SAAS,cACd,SACA,UACA,UACA,QACgB;AAChB,QAAM,MAAM,sBAAsB,MAAM,UAAU,CAAC,CAAC;AACpD,QAAM,mBAAmB,QAAQ,MAAM,GAAG,IAAI,cAAc;AAC5D,QAAM,YAAY,iBAAiB,SAAS,QAAQ;AACpD,QAAM,cAAc,IAAI,uBAAuB,SAAS,QAAQ;AAEhE,MAAI;AAEF,UAAM,gBAAgB,0BAA0B,gBAAgB;AAChE,UAAM,OAAO,mBAAmB,cAAc,OAAO;AACrD,UAAM,MAAM,aAAa,KAAK,OAAO;AACrC,UAAM,WAAW,kBAAkB,IAAI,OAAO;AAC9C,UAAM,cAAc;AAAA,MAClB,GAAG,cAAc;AAAA,MACjB,GAAG,KAAK;AAAA,MACR,GAAG,IAAI;AAAA,MACP,GAAG,SAAS;AAAA,IACd;AAYA,UAAM,iBAAiB;AAAA,MACrB,GAAG,oBAAI,IAAI;AAAA,QACT,GAAG,wBAAwB,gBAAgB;AAAA,QAC3C,GAAG,wBAAwB,SAAS,OAAO;AAAA,MAC7C,CAAC;AAAA,IACH;AAGA,UAAM,YAAY,gBAAgB,UAAU,gBAAgB,WAAW;AAEvE,WAAO;AAAA,MACL,SAAS,SAAS;AAAA,MAClB,gBAAgB,QAAQ;AAAA,MACxB;AAAA,MACA,qBAAqB;AAAA,MACrB;AAAA,MACA;AAAA;AAAA,MAEA,GAAI,KAAK,cAAc,IAAI,aAAa,EAAE,wBAAwB,KAAK,IAAI,CAAC;AAAA,MAC5E,kBAAkB;AAAA,MAClB;AAAA,MACA,aAAa,aAAa,YAAY,SAAS;AAAA,MAC/C,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,IACtC;AAAA,EACF,SAAS,KAAc;AACrB,WAAO,sBAAsB,KAAK,SAAS,kBAAkB,UAAU,WAAW;AAAA,EACpF;AACF;AASA,SAAS,sBACP,KACA,iBACA,WACA,UACA,aACgB;AAChB,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,SAAO;AAAA,IACL,SAAS;AAAA,IACT,gBAAgB,gBAAgB;AAAA,IAChC,WAAW,cAAc,MAAM;AAAA,IAC/B,qBAAqB;AAAA,IACrB;AAAA,IACA,gBAAgB,CAAC;AAAA,IACjB,kBAAkB;AAAA,MAChB;AAAA,QACE,KAAK;AAAA,QACL,QAAQ,6DAA6D,OAAO;AAAA,QAC5E,YAAY;AAAA,QACZ,QAAQ,UAAU;AAAA,MACpB;AAAA,IACF;AAAA,IACA,WAAW,UAAU,SAAS,gBAAgB;AAAA,IAC9C,aAAa;AAAA,IACb,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA,EACtC;AACF;;;ACjgBA,SAAS,SAAS;;;ACUlB,IAAM,gBAAgB,aAAa,EAAE,WAAW,WAAW,CAAC;AAkBrD,SAAS,eACd,KACA,QACA,UACA,SACA,UA4BI,CAAC,GACF;AACH,QAAM,EAAE,SAAS,eAAe,gBAAgB,IAAI;AACpD,MAAI,OAAO,QAAQ,YAAY,IAAI,WAAW,EAAG,QAAO;AACxD,QAAM,SAAS,OAAO,UAAU,IAAI,YAAY,CAAC;AACjD,MAAI,OAAO,QAAS,QAAO,OAAO;AAClC,QAAM,UAAU,mBAAmB;AAInC,SAAO,KAAK,WAAW,OAAO,6BAAwB,OAAO,IAAI;AAAA,IAC/D;AAAA,IACA,SAAS;AAAA,IACT;AAAA,EACF,CAAC;AACD,SAAO;AACT;;;AD/DO,IAAM,yBAAyB,EAAE,KAAK;AAAA,EAC3C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AA+CD,IAAM,uBAAuB;AAE7B,IAAM,wBAAwB;AAAA;AAAA,EAE5B,gBAAgB;AAAA;AAAA,EAEhB,kBAAkB;AAAA;AAAA,EAElB,uBAAuB;AAAA;AAAA,EAEvB,2BAA2B;AAC7B;AAcA,IAAM,iBAAyB,eAAe;AAC9C,IAAM,mBAAmB;AAOlB,IAAM,kBAAN,MAAsB;AAAA,EACV,QAAQ,oBAAI,IAAwB;AAAA,EACpC;AAAA,EACA;AAAA,EAEjB,YAAY,QAAQ,gBAAgB,UAAU,kBAAkB;AAC9D,SAAK,QAAQ;AACb,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,IAAI,UAAoD;AACtD,UAAM,QAAQ,KAAK,MAAM,IAAI,QAAQ;AACrC,QAAI,UAAU,OAAW,QAAO;AAChC,QAAI,gBAAgB,EAAE,IAAI,IAAI,MAAM,WAAW;AAC7C,WAAK,MAAM,OAAO,QAAQ;AAC1B,aAAO;AAAA,IACT;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEA,IAAI,UAAkB,YAAwC;AAC5D,QAAI,KAAK,MAAM,QAAQ,KAAK,WAAW,CAAC,KAAK,MAAM,IAAI,QAAQ,GAAG;AAChE,WAAK,YAAY;AAAA,IACnB;AACA,SAAK,MAAM,IAAI,UAAU;AAAA,MACvB;AAAA,MACA,WAAW,gBAAgB,EAAE,IAAI,IAAI,KAAK;AAAA,IAC5C,CAAC;AAAA,EACH;AAAA;AAAA,EAGQ,cAAoB;AAC1B,UAAM,YAAY,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,UAAU,GAAG,CAAC;AAC5D,UAAM,OAAO,KAAK,MAAM,KAAK;AAC7B,aAAS,IAAI,GAAG,IAAI,WAAW,KAAK;AAClC,YAAM,OAAO,KAAK,KAAK;AACvB,UAAI,KAAK,SAAS,KAAM;AACxB,WAAK,MAAM,OAAO,KAAK,KAAK;AAAA,IAC9B;AAAA,EACF;AAAA,EAEA,QAAc;AACZ,SAAK,MAAM,MAAM;AAAA,EACnB;AAAA,EAEA,IAAI,OAAe;AACjB,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAQA,IAAM,0BAAoD;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,SAAS,oBAAoB,OAA0C;AACrE,SAAO,MAAM,KAAK,CAAC,MAAM,wBAAwB,SAAS,CAAC,CAAC;AAC9D;AAGA,SAAS,kBAAkB,GAAgC;AACzD,SACE,EAAE,uBAAuB,UACzB,EAAE,+BAA+B,UACjC,EAAE,qBAAqB,sBAAsB,yBAC7C,EAAE,8BAA8B,sBAAsB;AAE1D;AAGA,SAAS,sBAAsB,GAAgC;AAC7D,MAAI,CAAC,EAAE,eAAe,SAAS,iBAAiB,EAAG,QAAO;AAC1D,QAAM,cAAc,EAAE,kBAAkB,YAAY;AACpD,SAAO,gBAAgB,WAAW,gBAAgB;AACpD;AAIA,SAAS,wBAAwB,UAAkD;AACjF,QAAM,UAA8B,CAAC;AACrC,QAAM,EAAE,gBAAgB,mBAAmB,IAAI;AAE/C,MAAI,mBAAmB,UAAa,iBAAiB,sBAAsB,gBAAgB;AACzF,YAAQ,KAAK,aAAa;AAAA,EAC5B;AACA,MACE,uBAAuB,UACvB,qBAAqB,sBAAsB,kBAC3C;AACA,YAAQ,KAAK,wBAAwB;AAAA,EACvC;AACA,MAAI,oBAAoB,SAAS,cAAc,EAAG,SAAQ,KAAK,6BAA6B;AAC5F,MAAI,kBAAkB,QAAQ,EAAG,SAAQ,KAAK,gBAAgB;AAC9D,MAAI,sBAAsB,QAAQ,EAAG,SAAQ,KAAK,4BAA4B;AAE9E,SAAO;AACT;AAGA,SAAS,yBACP,UACA,SACA,UACQ;AACR,MAAI,QAAQ;AAGZ,QAAM,YAA4C;AAAA,IAChD,OAAO;AAAA,IACP,YAAY;AAAA,IACZ,cAAc;AAAA,IACd,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,SAAS;AAAA,EACX;AACA,WAAS,UAAU,QAAQ;AAI3B,MAAI,SAAS,mBAAmB,QAAW;AACzC,aAAS,KAAK,IAAI,SAAS,iBAAiB,sBAAsB,EAAE;AAAA,EACtE;AAGA,MAAI,SAAS,uBAAuB,QAAW;AAC7C,aAAS,KAAK,IAAI,SAAS,oBAAoB,EAAE;AAAA,EACnD;AAGA,QAAM,gBAAkD;AAAA,IACtD,aAAa;AAAA,IACb,wBAAwB;AAAA,IACxB,6BAA6B;AAAA,IAC7B,gBAAgB;AAAA,IAChB,4BAA4B;AAAA,EAC9B;AACA,aAAW,UAAU,SAAS;AAC5B,aAAS,cAAc,MAAM;AAAA,EAC/B;AAEA,SAAO,KAAK,IAAI,GAAG,KAAK,IAAI,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC;AACrD;AAGA,SAAS,QAAQ,aAAqC;AACpD,UAAQ,YAAY,YAAY,GAAG;AAAA,IACjC,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAGA,SAAS,uBACP,UACA,SACW;AACX,QAAM,WAAW,mBAAmB,QAAQ;AAG5C,QAAM,iBAAqC;AAAA,IACzC;AAAA,IACA;AAAA,EACF;AACA,MAAI,QAAQ,KAAK,CAAC,MAAM,eAAe,SAAS,CAAC,CAAC,EAAG,QAAO;AAiB5D,MAAI,QAAQ,UAAU,GAAG;AACvB,UAAM,cAAc,mBAAmB,QAAQ;AAC/C,UAAM,aAAa,KAAK,IAAI,cAAc,GAAG,CAAC;AAC9C,WAAO,OAAO,UAAU;AAAA,EAC1B;AAEA,SAAO;AACT;AAaO,SAAS,iBACd,UACA,OACsB;AAEtB,QAAM,SAAS,OAAO,IAAI,SAAS,QAAQ;AAC3C,MAAI,WAAW,OAAW,QAAO;AAEjC,QAAM,WAAW,QAAQ,SAAS,iBAAiB;AACnD,QAAM,UAAU,wBAAwB,QAAQ;AAChD,QAAM,QAAQ,yBAAyB,UAAU,SAAS,QAAQ;AAClE,QAAM,gBAAgB,uBAAuB,UAAU,OAAO;AAE9D,QAAM,aAAmC;AAAA,IACvC,UAAU,SAAS;AAAA,IACnB;AAAA,IACA,UAAU;AAAA,MACR,UACE,SAAS,uBAAuB,UAChC,SAAS,uBAAuB,UAChC,SAAS,+BAA+B,SACpC,aACA;AAAA,IACR;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc,QAAQ,SAAS;AAAA,IAC/B,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,IACjB,QAAQ,YAAY,UAAU,SAAS,aAAa;AAAA,IACpD,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,SAAO,IAAI,SAAS,UAAU,UAAU;AACxC,SAAO;AACT;AAgBO,SAAS,mBACd,gBACA,YACW;AACX,MAAI,mBAAmB,IAAK,QAAO;AACnC,QAAM,UAAU,YAAY;AAC5B,MAAI,YAAY,OAAW,QAAO;AAClC,SAAO,mBAAmB,OAAO,IAAI,mBAAmB,cAAc,IAClE,UACA;AACN;AAcO,IAAM,6BAA6B,EAAE,KAAK,CAAC,OAAO,SAAS,SAAS,CAAC;AAqBrE,IAAM,iCAAuD;AAO7D,SAAS,4BACd,MAAyB,QAAQ,KACX;AACtB,SAAO;AAAA,IACL,IAAI,yBAAyB;AAAA,IAC7B;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAoBO,SAAS,mBACd,gBACA,YACA,MACwB;AACxB,QAAM,iBACJ,SAAS,QAAQ,iBAAiB,mBAAmB,gBAAgB,UAAU;AACjF,QAAM,eAAe,SAAS,YAAY,iBAAiB;AAC3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,oBAAoB,SAAS,aAAa,mBAAmB;AAAA,IAC7D;AAAA,EACF;AACF;AAGA,SAAS,YACP,MACA,SACA,MACQ;AACR,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,QAAQ,IAAI,gBAAW,IAAI;AAAA,EACpC;AACA,QAAM,aAAa,QAAQ,KAAK,IAAI;AACpC,SAAO,QAAQ,IAAI,gBAAW,IAAI,cAAc,UAAU;AAC5D;","names":[]}

package/dist/{chunk-YZXCE5BB.js → chunk-AH4Y7Z6S.js}

@@ -4,10 +4,10 @@ import {
   loadPapersRegistry,
   loadTechniquesRegistry,
   savePapersRegistry
-} from "./chunk-JDL5WJDM.js";
+} from "./chunk-BCC27PGX.js";
 import {
   resolveToken
-} from "./chunk-KCESFTXP.js";
+} from "./chunk-N5DHPHPE.js";
 import {
   getTsMorph
 } from "./chunk-W654ME6B.js";
@@ -18,7 +18,7 @@ import {
   rankedItemTrustTier,
   trustTierLabel,
   withoutUntrustedMemory
-} from "./chunk-6RP53JXS.js";
+} from "./chunk-Y3A3VVGT.js";
 import {
   extractSystemPrompt,
   generateCacheKey,
@@ -41,7 +41,7 @@ import {
   sigmoidConfidence,
   tokenizeFiltered,
   truncateSentence
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -4296,4 +4296,4 @@ export {
   DEFAULT_CONTEXT_BUDGET_TOKENS,
   getContextPromptPrefix
 };
-//# sourceMappingURL=chunk-YZXCE5BB.js.map
+//# sourceMappingURL=chunk-AH4Y7Z6S.js.map

package/dist/{chunk-JDL5WJDM.js → chunk-BCC27PGX.js}

@@ -5,7 +5,7 @@ import {
   getErrorMessage,
   ok,
   resolveInsideRoot
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -213,4 +213,4 @@ export {
   loadPapersRegistry,
   savePapersRegistry
 };
-//# sourceMappingURL=chunk-JDL5WJDM.js.map
+//# sourceMappingURL=chunk-BCC27PGX.js.map

package/dist/{chunk-BPO2LQ67.js → chunk-BGELNT5F.js}

@@ -8,10 +8,10 @@ import {
   discoverGatewayCatalog,
   gatewayProxyUrl,
   readOpenAICompatEnv
-} from "./chunk-54UNI6GV.js";
+} from "./chunk-WSLPF7BX.js";
 import {
   redactGatewaySecrets
-} from "./chunk-MPYHD4EV.js";
+} from "./chunk-6MOCJOKU.js";
 import {
   DEFAULT_OPENAI_COMPAT_ENDPOINT,
   GATEWAY_COST_ENV,
@@ -28,7 +28,7 @@ import {
   isCliDisabled,
   symbols,
   writeLine
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   getTimeProvider
 } from "./chunk-GR6WCJWY.js";
@@ -384,4 +384,4 @@ export {
   formatGatewayReport,
   formatGatewaySlotWarnings
 };
-//# sourceMappingURL=chunk-BPO2LQ67.js.map
+//# sourceMappingURL=chunk-BGELNT5F.js.map

package/dist/{chunk-5CSM473L.js → chunk-DFRQP7AM.js}

@@ -1,13 +1,13 @@
 import {
   IN_FAMILY_FALLBACK_OPTION
-} from "./chunk-RGDZIWGS.js";
+} from "./chunk-VMGKPEVR.js";
 import {
   sanitizeErrorDetails
 } from "./chunk-7LKX7AUQ.js";
 import {
   classifyExtractedError,
   isTimeoutText
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   getTimeProvider
 } from "./chunk-GR6WCJWY.js";
@@ -158,4 +158,4 @@ export {
   SERVES_PROBE_PROMPT,
   probeServes
 };
-//# sourceMappingURL=chunk-5CSM473L.js.map
+//# sourceMappingURL=chunk-DFRQP7AM.js.map

package/dist/{chunk-UMLKKXBD.js → chunk-FGR6O454.js}

@@ -1,9 +1,9 @@
 import {
   loadPapersRegistry
-} from "./chunk-JDL5WJDM.js";
+} from "./chunk-BCC27PGX.js";
 import {
   getErrorMessage
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 
 // src/cli/research-helpers-synthesize.ts
 import { z } from "zod";
@@ -876,4 +876,4 @@ export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=chunk-UMLKKXBD.js.map
+//# sourceMappingURL=chunk-FGR6O454.js.map

package/dist/{chunk-CVOE6Q56.js → chunk-FQFCLNYM.js}

@@ -5,7 +5,7 @@ import {
   err,
   getErrorMessage,
   ok
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger,
   getTimeProvider
@@ -376,4 +376,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-CVOE6Q56.js.map
+//# sourceMappingURL=chunk-FQFCLNYM.js.map

package/dist/{chunk-EOIUMPFK.js → chunk-FYXIWH62.js}

@@ -3,7 +3,7 @@ import {
   ValidationError,
   formatZodError,
   resolveInsideRoot
-} from "./chunk-M7JXKUFB.js";
+} from "./chunk-WM2BE65D.js";
 import {
   createLogger
 } from "./chunk-GR6WCJWY.js";
@@ -249,4 +249,4 @@ export {
   collectAstQaFindings,
   runAstQaRules
 };
-//# sourceMappingURL=chunk-EOIUMPFK.js.map
+//# sourceMappingURL=chunk-FYXIWH62.js.map