nexus-agents 2.104.0 → 2.106.0

package/dist/{chunk-FVJ2LM2G.js → chunk-2J6HSR6X.js}

@@ -1,6 +1,6 @@
 import {
   getErrorMessage
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/cli/setup-config.ts
 import { copyFileSync, existsSync, mkdirSync, writeFileSync } from "fs";
@@ -77,4 +77,4 @@ function ensureBackup(outputPath) {
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=chunk-FVJ2LM2G.js.map
+//# sourceMappingURL=chunk-2J6HSR6X.js.map

package/dist/{chunk-47FQ3BU7.js → chunk-3YWBA5GE.js}

@@ -1,11 +1,11 @@
 import {
   resolveCliSlot
-} from "./chunk-RZ4A2RRN.js";
+} from "./chunk-MYXT7VPF.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/pipeline/expert-bridge.ts
 function resolveCliFromModelString(model) {
@@ -21,7 +21,7 @@ async function getMcpConfigPath() {
   if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;
   mcpConfigInitPromise ??= (async () => {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-XOIMNU6R.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-KP2XBOIB.js");
       const config = await generateMcpConfig();
       cachedMcpConfigPath = config.configPath;
       cachedMcpConfigCleanup = config.cleanup;
@@ -53,6 +53,13 @@ function totalTokensFromUsage(usage) {
   const total = (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0);
   return total > 0 ? total : void 0;
 }
+function tokenSplitFromUsage(usage) {
+  if (usage === void 0) return void 0;
+  const tokensIn = usage.inputTokens ?? 0;
+  const tokensOut = usage.outputTokens ?? 0;
+  if (tokensIn + tokensOut === 0) return void 0;
+  return { tokensIn, tokensOut };
+}
 function adaptCompositeRouter(compositeRouter) {
   return {
     async executeTask(task) {
@@ -64,12 +71,16 @@ function adaptCompositeRouter(compositeRouter) {
       if (result.ok) {
         const cli = resolveCliFromModelString(result.value.model);
         const tokensUsed = totalTokensFromUsage(result.value.usage);
+        const model = result.value.model;
+        const split = tokenSplitFromUsage(result.value.usage);
         return {
           ok: true,
           value: {
             text: result.value.text,
             ...cli !== void 0 && { cli },
-            ...tokensUsed !== void 0 && { tokensUsed }
+            ...tokensUsed !== void 0 && { tokensUsed },
+            ...model !== void 0 && { model },
+            ...split !== void 0 && { tokensIn: split.tokensIn, tokensOut: split.tokensOut }
           },
           error: { message: "" }
         };
@@ -82,8 +93,8 @@ var routerInitPromise = null;
 async function getRouter() {
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-UZQ3RGFQ.js");
-    const { createCompositeRouter } = await import("./composite-router-ZX64CEVG.js");
+    const { createAllAdapters } = await import("./factory-SM7AIAFL.js");
+    const { createCompositeRouter } = await import("./composite-router-GXLSZZQU.js");
     const adapters = createAllAdapters();
     if (adapters.size === 0) {
       routerInitPromise = null;
@@ -91,7 +102,7 @@ async function getRouter() {
     }
     cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-QMCG6JGV.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-PE3AYA56.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -129,7 +140,10 @@ async function dispatchWithRateLimitRetry(router, task, expertType, start) {
         expertType,
         durationMs,
         ...result.value.cli !== void 0 && { cli: result.value.cli },
-        ...result.value.tokensUsed !== void 0 && { tokensUsed: result.value.tokensUsed }
+        ...result.value.tokensUsed !== void 0 && { tokensUsed: result.value.tokensUsed },
+        ...result.value.model !== void 0 && { model: result.value.model },
+        ...result.value.tokensIn !== void 0 && { tokensIn: result.value.tokensIn },
+        ...result.value.tokensOut !== void 0 && { tokensOut: result.value.tokensOut }
       };
     }
     const isRateLimit = isRateLimitText(result.error.message);
@@ -196,6 +210,7 @@ ${prompt}`;
 export {
   shutdownExpertBridge,
   totalTokensFromUsage,
+  tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-47FQ3BU7.js.map
+//# sourceMappingURL=chunk-3YWBA5GE.js.map

package/dist/chunk-3YWBA5GE.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/pipeline/expert-bridge.ts"],"sourcesContent":["/**\n * Expert Bridge — Programmatic access to the execute_expert pipeline (#1693)\n *\n * Provides a clean wrapper for calling experts with the full pipeline:\n * timeout, fallback cascade, degradation detection, heartbeat, outcome recording.\n *\n * DRY: reuses createBuiltInExpert + CompositeRouter instead of reimplementing.\n *\n * @module pipeline/expert-bridge\n */\n\nimport { createLogger, getTimeProvider } from '../core/index.js';\nimport type { BuiltInExpertType } from '../agents/experts/expert-config.js';\nimport { isRateLimitText } from '../adapters/rate-limit-detector.js';\nimport { resolveCliSlot } from '../config/model-availability.js';\nimport type { CliNameLiteral } from '../config/model-capabilities-types.js';\n\n/**\n * Resolves a CLI slot from the model string a (CLI or API) adapter returned.\n * Known models resolve to their exact slot; **unknown** models — new releases\n * or API/openrouter models not in the curated registry — fall back to the\n * vendor-derived slot (#3317 / #3293) so the outcome is recorded against a real\n * slot instead of being dropped with an undefined cli (the api-mode gap).\n * Returns undefined only when no model is present (the bridge failed before\n * dispatch — no execution to attribute).\n */\nfunction resolveCliFromModelString(model: string | undefined): CliNameLiteral | undefined {\n  return resolveCliSlot(model);\n}\n\nconst logger = createLogger({ component: 'expert-bridge' });\n\n/** Base delay for rate limit retry backoff (ms). Scales linearly: 3s, 6s, 9s. */\nconst RATE_LIMIT_BASE_DELAY_MS = 3000;\n\n/** Result of an expert execution. */\nexport interface ExpertBridgeResult {\n  readonly success: boolean;\n  readonly text: string;\n  readonly expertType: BuiltInExpertType;\n  readonly durationMs: number;\n  readonly error?: string;\n  /**\n   * CLI that actually executed the task, resolved from the underlying\n   * `CliResponse.model` via `getCliForModelId`. Undefined when the bridge\n   * failed before dispatch (no adapters / circuit-open / rate-limit cap).\n   * Callers writing to OutcomeStore should use this rather than hardcoding\n   * a cli — see #2823 (#1154 regression).\n   */\n  readonly cli?: CliNameLiteral;\n  /**\n   * Total tokens (input + output) the underlying CLI/adapter reported for this\n   * call, when available (#3396). Best-effort: `CliResponse.usage` is optional\n   * — CLI-subprocess paths whose `extractUsage` returns null leave this\n   * undefined. Consumers (budget enforcement #3395, model.called attribution\n   * #3387, routing-experience metrics) must tolerate `undefined`.\n   */\n  readonly tokensUsed?: number;\n  /**\n   * Concrete model id the underlying adapter reported (`CliResponse.model`),\n   * when present (#3387). Distinct from {@link cli} (the slot): one CLI can run\n   * several models. Undefined when the adapter didn't report a model or the\n   * bridge failed before dispatch. Required to emit a `model.called` event.\n   */\n  readonly model?: string;\n  /**\n   * Input/output token split from the adapter's `CliResponse.usage` (#3387),\n   * when reported. Best-effort like {@link tokensUsed}; both undefined together\n   * when no usage was available. `tokensIn + tokensOut` reconciles with\n   * `tokensUsed` (single source of truth — both derive from the same record).\n   */\n  readonly tokensIn?: number;\n  readonly tokensOut?: number;\n}\n\n/**\n * Execute an expert task with the full nexus-agents expert pipeline.\n *\n * Creates a built-in expert, executes via CompositeRouter (for intelligent\n * CLI routing), and records outcomes. Falls back gracefully on failure.\n *\n * @param expertType - Built-in expert type (code, architecture, security, qa, etc.)\n * @param prompt - Task prompt for the expert\n * @returns Expert result with text output\n */\n/** Minimal router interface for the bridge. */\ninterface RouterLike {\n  executeTask(task: { content: string; options?: Record<string, unknown> | undefined }): Promise<{\n    ok: boolean;\n    value: {\n      text: string;\n      cli?: CliNameLiteral;\n      tokensUsed?: number;\n      model?: string;\n      tokensIn?: number;\n      tokensOut?: number;\n    };\n    error: { message: string };\n  }>;\n}\n\n// Cached router — lazily initialized, reused across calls within a session\nlet cachedRouter: RouterLike | null = null;\n\n// Cached MCP config — generated once, reused across expert calls (#1708)\nlet cachedMcpConfigPath: string | null = null;\n// Cached cleanup for the cached config's tempdir (closes #2946). Previously\n// the cleanup returned by `generateMcpConfig` was thrown away, so\n// `/tmp/nexus-mcp-XXXXXX/` accumulated one entry per MCP server lifetime.\n// Stored here + invoked by `shutdownExpertBridge()` from the server's\n// graceful-shutdown path.\nlet cachedMcpConfigCleanup: (() => Promise<void>) | null = null;\n// Coalesces concurrent init under voter fan-out (closes #2969). consensus_vote\n// fans out N=7 callers on cold start; without this each one ran the full init\n// including a mkdtemp() that the loser N-1 instances never cleaned up.\nlet mcpConfigInitPromise: Promise<string | null> | null = null;\n\n/** Get or create cached MCP config path for expert CLI sessions (#1708). */\nasync function getMcpConfigPath(): Promise<string | null> {\n  if (cachedMcpConfigPath !== null) return cachedMcpConfigPath;\n  mcpConfigInitPromise ??= (async (): Promise<string | null> => {\n    try {\n      const { generateMcpConfig } = await import('../cli-adapters/child-mcp-config.js');\n      const config = await generateMcpConfig();\n      cachedMcpConfigPath = config.configPath;\n      cachedMcpConfigCleanup = config.cleanup;\n      return cachedMcpConfigPath;\n    } catch {\n      mcpConfigInitPromise = null; // allow retry on next call\n      return null; // MCP config not available — experts run without tools\n    }\n  })();\n  return mcpConfigInitPromise;\n}\n\n/**\n * Removes the cached MCP-config tempdir (closes #2946). Invoke from the\n * server's graceful-shutdown path so stale nexus-mcp-* tempdirs (under\n * the OS tmpdir, see child-mcp-config.ts) don't accumulate across daemon\n * restarts. Idempotent; safe to call multiple times. Never throws —\n * cleanup failures are logged and swallowed.\n */\nexport async function shutdownExpertBridge(): Promise<void> {\n  const cleanup = cachedMcpConfigCleanup;\n  if (cleanup === null) return;\n  cachedMcpConfigCleanup = null;\n  cachedMcpConfigPath = null;\n  mcpConfigInitPromise = null;\n  try {\n    await cleanup();\n  } catch (error: unknown) {\n    const msg = error instanceof Error ? error.message : String(error);\n    logger.debug('Expert-bridge MCP-config cleanup failed', { error: msg });\n  }\n}\n\n/** Cached circuit breaker for health monitoring (#1766). */\nlet cachedCircuitBreaker: {\n  getHealthStatus(): {\n    systemHealthy: boolean;\n    healthyCount: number;\n    clis: ReadonlyArray<{ name: string; healthy: boolean }>;\n  };\n} | null = null;\n\n/**\n * Adapt a CompositeRouter to the narrower RouterLike interface used by this\n * bridge. Previously did `as unknown as RouterLike` which hid any structural\n * mismatch between CompositeRouter's `Result<CliResponse, CliError>` and\n * RouterLike's flat `{ ok, value: { text }, error: { message } }` shape.\n * If CliResponse renames `.text` → `.output` (or similar), this adapter\n * breaks at compile time instead of silently returning wrong data (#1921).\n */\n/**\n * Total tokens from a best-effort `CliResponse.usage` record (#3396). Prefers\n * the reported `totalTokens`; falls back to input+output; returns undefined\n * when no usage was reported (so callers can distinguish \"0 tokens\" — which\n * never happens for a real call — from \"unknown\").\n */\nexport function totalTokensFromUsage(\n  usage: { totalTokens?: number; inputTokens?: number; outputTokens?: number } | undefined\n): number | undefined {\n  if (usage === undefined) return undefined;\n  if (typeof usage.totalTokens === 'number') return usage.totalTokens;\n  const total = (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0);\n  return total > 0 ? total : undefined;\n}\n\n/**\n * Per-direction token split from a best-effort `CliResponse.usage` record\n * (#3387). Unlike {@link totalTokensFromUsage} this keeps `tokensIn`/`tokensOut`\n * separate — the granularity `ModelCalledEvent` requires for attribution.\n * Returns undefined when no usage was reported or both directions are zero (no\n * real call), so callers skip emitting a noise event instead of recording\n * zeros. Reconciles with the total: `tokensIn + tokensOut === totalTokensFromUsage`.\n */\nexport function tokenSplitFromUsage(\n  usage: { inputTokens?: number; outputTokens?: number; totalTokens?: number } | undefined\n): { tokensIn: number; tokensOut: number } | undefined {\n  if (usage === undefined) return undefined;\n  const tokensIn = usage.inputTokens ?? 0;\n  const tokensOut = usage.outputTokens ?? 0;\n  if (tokensIn + tokensOut === 0) return undefined;\n  return { tokensIn, tokensOut };\n}\n\nfunction adaptCompositeRouter(\n  compositeRouter: import('../cli-adapters/composite-router.js').ICompositeRouter\n): RouterLike {\n  return {\n    async executeTask(task): Promise<{\n      ok: boolean;\n      value: {\n        text: string;\n        cli?: CliNameLiteral;\n        tokensUsed?: number;\n        model?: string;\n        tokensIn?: number;\n        tokensOut?: number;\n      };\n      error: { message: string };\n    }> {\n      const cliTask: import('../cli-adapters/types.js').CliTask = {\n        content: task.content,\n        ...(task.options !== undefined ? { options: task.options } : {}),\n      };\n      const result = await compositeRouter.executeTask(cliTask);\n      if (result.ok) {\n        // #2823: surface which CLI actually executed so callers writing to\n        // OutcomeStore don't have to hardcode 'claude' (the bug #1154 fixed\n        // and that regressed into the pipeline/ tree). Derive via the\n        // canonical model→cli mapping in the registry — if the underlying\n        // adapter didn't set `model` or the model isn't in the registry,\n        // cli stays undefined and downstream code can skip the record\n        // rather than lie.\n        const cli = resolveCliFromModelString(result.value.model);\n        // #3396: surface token usage (best-effort) so budget enforcement,\n        // attribution, and routing-experience metrics get real numbers instead\n        // of zeros. `usage` is optional and `totalTokens` may be absent — fall\n        // back to input+output, and leave undefined when no usage was reported.\n        const tokensUsed = totalTokensFromUsage(result.value.usage);\n        // #3387: also surface the concrete model + per-direction token split so\n        // a meaningful `model.called` event can be emitted. Both derive from the\n        // same CliResponse, so tokensIn+tokensOut reconciles with tokensUsed.\n        const model = result.value.model;\n        const split = tokenSplitFromUsage(result.value.usage);\n        return {\n          ok: true,\n          value: {\n            text: result.value.text,\n            ...(cli !== undefined && { cli }),\n            ...(tokensUsed !== undefined && { tokensUsed }),\n            ...(model !== undefined && { model }),\n            ...(split !== undefined && { tokensIn: split.tokensIn, tokensOut: split.tokensOut }),\n          },\n          error: { message: '' },\n        };\n      }\n      return { ok: false, value: { text: '' }, error: { message: result.error.message } };\n    },\n  };\n}\n\n// Coalesces concurrent router init the same way mcpConfigInitPromise does\n// (closes #2969). N=7 voter fan-out previously ran createAllAdapters() N times\n// — N sets of CLI probe subprocesses, all but one discarded.\nlet routerInitPromise: Promise<RouterLike | null> | null = null;\n\n/** Get or create a cached CompositeRouter with circuit breaker monitoring. */\nasync function getRouter(): Promise<RouterLike | null> {\n  if (cachedRouter !== null) return cachedRouter;\n  routerInitPromise ??= (async (): Promise<RouterLike | null> => {\n    const { createAllAdapters } = await import('../cli-adapters/factory.js');\n    const { createCompositeRouter } = await import('../cli-adapters/composite-router.js');\n    const adapters = createAllAdapters();\n    if (adapters.size === 0) {\n      routerInitPromise = null; // allow retry once adapters become available\n      return null;\n    }\n    cachedRouter = adaptCompositeRouter(createCompositeRouter(adapters));\n\n    // Initialize circuit breaker monitoring (#1766)\n    try {\n      const { createCliCircuitBreakerIntegration } =\n        await import('../cli-adapters/cli-circuit-breaker.js');\n      cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);\n    } catch (error: unknown) {\n      // Circuit breaker not available — continue without it. Log so we can\n      // notice if initialization silently stops working (#1913 Class B).\n      const msg = error instanceof Error ? error.message : String(error);\n      logger.debug('Circuit breaker init failed; continuing without it', { error: msg });\n    }\n\n    return cachedRouter;\n  })();\n  return routerInitPromise;\n}\n\n/** Check CLI health before dispatch (#1766). */\nfunction checkCircuitHealth(): { healthy: boolean; message: string } {\n  if (cachedCircuitBreaker === null) return { healthy: true, message: '' };\n  const status = cachedCircuitBreaker.getHealthStatus();\n  if (!status.systemHealthy) {\n    return {\n      healthy: false,\n      message: `All CLI circuits open (${String(status.healthyCount)}/${String(status.clis.length)} healthy)`,\n    };\n  }\n  return { healthy: true, message: '' };\n}\n\n/** Dispatch task to router with rate limit retry (#1802). */\nasync function dispatchWithRateLimitRetry(\n  router: RouterLike,\n  task: { content: string; options?: Record<string, unknown> | undefined },\n  expertType: BuiltInExpertType,\n  start: number\n): Promise<ExpertBridgeResult> {\n  const maxAttempts = 3;\n  for (let attempt = 0; attempt < maxAttempts; attempt++) {\n    const result = await router.executeTask(task);\n    const durationMs = getTimeProvider().now() - start;\n\n    if (result.ok) {\n      logger.info('Expert executed successfully', {\n        expertType,\n        durationMs,\n        cli: result.value.cli,\n      });\n      return {\n        success: true,\n        text: result.value.text,\n        expertType,\n        durationMs,\n        ...(result.value.cli !== undefined && { cli: result.value.cli }),\n        ...(result.value.tokensUsed !== undefined && { tokensUsed: result.value.tokensUsed }),\n        ...(result.value.model !== undefined && { model: result.value.model }),\n        ...(result.value.tokensIn !== undefined && { tokensIn: result.value.tokensIn }),\n        ...(result.value.tokensOut !== undefined && { tokensOut: result.value.tokensOut }),\n      };\n    }\n\n    const isRateLimit = isRateLimitText(result.error.message);\n    if (isRateLimit && attempt < maxAttempts - 1) {\n      const backoffMs = RATE_LIMIT_BASE_DELAY_MS * (attempt + 1);\n      logger.warn('Expert rate limited, retrying', { expertType, attempt: attempt + 1, backoffMs });\n      await new Promise((resolve) => setTimeout(resolve, backoffMs));\n      continue;\n    }\n\n    logger.warn('Expert execution failed', { expertType, error: result.error.message });\n    return { success: false, text: '', expertType, durationMs, error: result.error.message };\n  }\n\n  return {\n    success: false,\n    text: '',\n    expertType,\n    durationMs: getTimeProvider().now() - start,\n    error: 'Max retry attempts exceeded',\n  };\n}\n\nexport async function executeExpert(\n  expertType: BuiltInExpertType,\n  prompt: string\n): Promise<ExpertBridgeResult> {\n  const start = getTimeProvider().now();\n  try {\n    const { BUILT_IN_EXPERTS } = await import('../agents/experts/expert-config.js');\n    const config = BUILT_IN_EXPERTS[expertType];\n    const fullPrompt = `${config.systemPrompt}\\n\\n${prompt}`;\n\n    const router = await getRouter();\n    if (router === null) {\n      return {\n        success: false,\n        text: `[No adapters] ${prompt}`,\n        expertType,\n        durationMs: getTimeProvider().now() - start,\n        error: 'No CLI adapters available',\n      };\n    }\n\n    // Check circuit breaker health before dispatch (#1766)\n    const health = checkCircuitHealth();\n    if (!health.healthy) {\n      logger.warn('Circuit breaker: all CLIs unavailable', { expertType, reason: health.message });\n      return {\n        success: false,\n        text: '',\n        expertType,\n        durationMs: getTimeProvider().now() - start,\n        error: health.message,\n      };\n    }\n\n    // Pass MCP config so CLI experts can call nexus-agents tools (#1708)\n    const mcpConfigPath = await getMcpConfigPath();\n    const task: { content: string; options?: Record<string, unknown> | undefined } = {\n      content: fullPrompt,\n    };\n    if (mcpConfigPath !== null) task.options = { mcpConfigPath };\n\n    return await dispatchWithRateLimitRetry(router, task, expertType, start);\n  } catch (error) {\n    const durationMs = getTimeProvider().now() - start;\n    const msg = error instanceof Error ? error.message : String(error);\n    logger.warn('Expert bridge error', { expertType, error: msg });\n    return { success: false, text: '', expertType, durationMs, error: msg };\n  }\n}\n"],"mappings":";;;;;;;;;;AA0BA,SAAS,0BAA0B,OAAuD;AACxF,SAAO,eAAe,KAAK;AAC7B;AAEA,IAAM,SAAS,aAAa,EAAE,WAAW,gBAAgB,CAAC;AAG1D,IAAM,2BAA2B;AAqEjC,IAAI,eAAkC;AAGtC,IAAI,sBAAqC;AAMzC,IAAI,yBAAuD;AAI3D,IAAI,uBAAsD;AAG1D,eAAe,mBAA2C;AACxD,MAAI,wBAAwB,KAAM,QAAO;AACzC,4BAA0B,YAAoC;AAC5D,QAAI;AACF,YAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,gCAAqC;AAChF,YAAM,SAAS,MAAM,kBAAkB;AACvC,4BAAsB,OAAO;AAC7B,+BAAyB,OAAO;AAChC,aAAO;AAAA,IACT,QAAQ;AACN,6BAAuB;AACvB,aAAO;AAAA,IACT;AAAA,EACF,GAAG;AACH,SAAO;AACT;AASA,eAAsB,uBAAsC;AAC1D,QAAM,UAAU;AAChB,MAAI,YAAY,KAAM;AACtB,2BAAyB;AACzB,wBAAsB;AACtB,yBAAuB;AACvB,MAAI;AACF,UAAM,QAAQ;AAAA,EAChB,SAAS,OAAgB;AACvB,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,WAAO,MAAM,2CAA2C,EAAE,OAAO,IAAI,CAAC;AAAA,EACxE;AACF;AAGA,IAAI,uBAMO;AAgBJ,SAAS,qBACd,OACoB;AACpB,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,OAAO,MAAM,gBAAgB,SAAU,QAAO,MAAM;AACxD,QAAM,SAAS,MAAM,eAAe,MAAM,MAAM,gBAAgB;AAChE,SAAO,QAAQ,IAAI,QAAQ;AAC7B;AAUO,SAAS,oBACd,OACqD;AACrD,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,WAAW,MAAM,eAAe;AACtC,QAAM,YAAY,MAAM,gBAAgB;AACxC,MAAI,WAAW,cAAc,EAAG,QAAO;AACvC,SAAO,EAAE,UAAU,UAAU;AAC/B;AAEA,SAAS,qBACP,iBACY;AACZ,SAAO;AAAA,IACL,MAAM,YAAY,MAWf;AACD,YAAM,UAAsD;AAAA,QAC1D,SAAS,KAAK;AAAA,QACd,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,YAAM,SAAS,MAAM,gBAAgB,YAAY,OAAO;AACxD,UAAI,OAAO,IAAI;AAQb,cAAM,MAAM,0BAA0B,OAAO,MAAM,KAAK;AAKxD,cAAM,aAAa,qBAAqB,OAAO,MAAM,KAAK;AAI1D,cAAM,QAAQ,OAAO,MAAM;AAC3B,cAAM,QAAQ,oBAAoB,OAAO,MAAM,KAAK;AACpD,eAAO;AAAA,UACL,IAAI;AAAA,UACJ,OAAO;AAAA,YACL,MAAM,OAAO,MAAM;AAAA,YACnB,GAAI,QAAQ,UAAa,EAAE,IAAI;AAAA,YAC/B,GAAI,eAAe,UAAa,EAAE,WAAW;AAAA,YAC7C,GAAI,UAAU,UAAa,EAAE,MAAM;AAAA,YACnC,GAAI,UAAU,UAAa,EAAE,UAAU,MAAM,UAAU,WAAW,MAAM,UAAU;AAAA,UACpF;AAAA,UACA,OAAO,EAAE,SAAS,GAAG;AAAA,QACvB;AAAA,MACF;AACA,aAAO,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,GAAG,GAAG,OAAO,EAAE,SAAS,OAAO,MAAM,QAAQ,EAAE;AAAA,IACpF;AAAA,EACF;AACF;AAKA,IAAI,oBAAuD;AAG3D,eAAe,YAAwC;AACrD,MAAI,iBAAiB,KAAM,QAAO;AAClC,yBAAuB,YAAwC;AAC7D,UAAM,EAAE,kBAAkB,IAAI,MAAM,OAAO,uBAA4B;AACvE,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,gCAAqC;AACpF,UAAM,WAAW,kBAAkB;AACnC,QAAI,SAAS,SAAS,GAAG;AACvB,0BAAoB;AACpB,aAAO;AAAA,IACT;AACA,mBAAe,qBAAqB,sBAAsB,QAAQ,CAAC;AAGnE,QAAI;AACF,YAAM,EAAE,mCAAmC,IACzC,MAAM,OAAO,mCAAwC;AACvD,6BAAuB,mCAAmC,CAAC,GAAG,SAAS,OAAO,CAAC,CAAC;AAAA,IAClF,SAAS,OAAgB;AAGvB,YAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,aAAO,MAAM,sDAAsD,EAAE,OAAO,IAAI,CAAC;AAAA,IACnF;AAEA,WAAO;AAAA,EACT,GAAG;AACH,SAAO;AACT;AAGA,SAAS,qBAA4D;AACnE,MAAI,yBAAyB,KAAM,QAAO,EAAE,SAAS,MAAM,SAAS,GAAG;AACvE,QAAM,SAAS,qBAAqB,gBAAgB;AACpD,MAAI,CAAC,OAAO,eAAe;AACzB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS,0BAA0B,OAAO,OAAO,YAAY,CAAC,IAAI,OAAO,OAAO,KAAK,MAAM,CAAC;AAAA,IAC9F;AAAA,EACF;AACA,SAAO,EAAE,SAAS,MAAM,SAAS,GAAG;AACtC;AAGA,eAAe,2BACb,QACA,MACA,YACA,OAC6B;AAC7B,QAAM,cAAc;AACpB,WAAS,UAAU,GAAG,UAAU,aAAa,WAAW;AACtD,UAAM,SAAS,MAAM,OAAO,YAAY,IAAI;AAC5C,UAAM,aAAa,gBAAgB,EAAE,IAAI,IAAI;AAE7C,QAAI,OAAO,IAAI;AACb,aAAO,KAAK,gCAAgC;AAAA,QAC1C;AAAA,QACA;AAAA,QACA,KAAK,OAAO,MAAM;AAAA,MACpB,CAAC;AACD,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,OAAO,MAAM;AAAA,QACnB;AAAA,QACA;AAAA,QACA,GAAI,OAAO,MAAM,QAAQ,UAAa,EAAE,KAAK,OAAO,MAAM,IAAI;AAAA,QAC9D,GAAI,OAAO,MAAM,eAAe,UAAa,EAAE,YAAY,OAAO,MAAM,WAAW;AAAA,QACnF,GAAI,OAAO,MAAM,UAAU,UAAa,EAAE,OAAO,OAAO,MAAM,MAAM;AAAA,QACpE,GAAI,OAAO,MAAM,aAAa,UAAa,EAAE,UAAU,OAAO,MAAM,SAAS;AAAA,QAC7E,GAAI,OAAO,MAAM,cAAc,UAAa,EAAE,WAAW,OAAO,MAAM,UAAU;AAAA,MAClF;AAAA,IACF;AAEA,UAAM,cAAc,gBAAgB,OAAO,MAAM,OAAO;AACxD,QAAI,eAAe,UAAU,cAAc,GAAG;AAC5C,YAAM,YAAY,4BAA4B,UAAU;AACxD,aAAO,KAAK,iCAAiC,EAAE,YAAY,SAAS,UAAU,GAAG,UAAU,CAAC;AAC5F,YAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,SAAS,CAAC;AAC7D;AAAA,IACF;AAEA,WAAO,KAAK,2BAA2B,EAAE,YAAY,OAAO,OAAO,MAAM,QAAQ,CAAC;AAClF,WAAO,EAAE,SAAS,OAAO,MAAM,IAAI,YAAY,YAAY,OAAO,OAAO,MAAM,QAAQ;AAAA,EACzF;AAEA,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN;AAAA,IACA,YAAY,gBAAgB,EAAE,IAAI,IAAI;AAAA,IACtC,OAAO;AAAA,EACT;AACF;AAEA,eAAsB,cACpB,YACA,QAC6B;AAC7B,QAAM,QAAQ,gBAAgB,EAAE,IAAI;AACpC,MAAI;AACF,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,6BAAoC;AAC9E,UAAM,SAAS,iBAAiB,UAAU;AAC1C,UAAM,aAAa,GAAG,OAAO,YAAY;AAAA;AAAA,EAAO,MAAM;AAEtD,UAAM,SAAS,MAAM,UAAU;AAC/B,QAAI,WAAW,MAAM;AACnB,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,iBAAiB,MAAM;AAAA,QAC7B;AAAA,QACA,YAAY,gBAAgB,EAAE,IAAI,IAAI;AAAA,QACtC,OAAO;AAAA,MACT;AAAA,IACF;AAGA,UAAM,SAAS,mBAAmB;AAClC,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,KAAK,yCAAyC,EAAE,YAAY,QAAQ,OAAO,QAAQ,CAAC;AAC3F,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM;AAAA,QACN;AAAA,QACA,YAAY,gBAAgB,EAAE,IAAI,IAAI;AAAA,QACtC,OAAO,OAAO;AAAA,MAChB;AAAA,IACF;AAGA,UAAM,gBAAgB,MAAM,iBAAiB;AAC7C,UAAM,OAA2E;AAAA,MAC/E,SAAS;AAAA,IACX;AACA,QAAI,kBAAkB,KAAM,MAAK,UAAU,EAAE,cAAc;AAE3D,WAAO,MAAM,2BAA2B,QAAQ,MAAM,YAAY,KAAK;AAAA,EACzE,SAAS,OAAO;AACd,UAAM,aAAa,gBAAgB,EAAE,IAAI,IAAI;AAC7C,UAAM,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACjE,WAAO,KAAK,uBAAuB,EAAE,YAAY,OAAO,IAAI,CAAC;AAC7D,WAAO,EAAE,SAAS,OAAO,MAAM,IAAI,YAAY,YAAY,OAAO,IAAI;AAAA,EACxE;AACF;","names":[]}

package/dist/{chunk-46GXDOWQ.js → chunk-5UU6BQJ3.js}

@@ -2,7 +2,7 @@ import {
   createLogger,
   err,
   ok
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/scm/token-resolver.ts
 import { execFile } from "child_process";
@@ -87,4 +87,4 @@ export {
   hasToken,
   getTokenEnvVars
 };
-//# sourceMappingURL=chunk-46GXDOWQ.js.map
+//# sourceMappingURL=chunk-5UU6BQJ3.js.map

package/dist/{chunk-M54LGBTY.js → chunk-75NKH2VD.js}

@@ -5,13 +5,13 @@ import {
 } from "./chunk-6T3EPABN.js";
 import {
   generateId
-} from "./chunk-A5UJBVCQ.js";
+} from "./chunk-M6JRWJZW.js";
 import {
   getMemoryRegistry
 } from "./chunk-PQHVC4BD.js";
 import {
   SessionMemory
-} from "./chunk-UFTQXDUA.js";
+} from "./chunk-DLFJQ6W6.js";
 import {
   ErrorCode,
   NexusError,
@@ -24,7 +24,7 @@ import {
   getTimeProvider,
   ok,
   setSharedMobiMemDbPathResolver
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 import {
   nexusDataPath
 } from "./chunk-CH7QIDHQ.js";
@@ -5612,4 +5612,4 @@ export {
   reinitializeMemoryBackends,
   ToolMemoryManager
 };
-//# sourceMappingURL=chunk-M54LGBTY.js.map
+//# sourceMappingURL=chunk-75NKH2VD.js.map

package/dist/{chunk-ETGNZ6H2.js → chunk-BEWKRRNZ.js}

@@ -5,7 +5,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/cli-adapters/circuit-breaker-types.ts
 var CircuitErrorCode = {
@@ -354,4 +354,4 @@ export {
   CircuitBreakerRegistry,
   mapCliErrorToCategory
 };
-//# sourceMappingURL=chunk-ETGNZ6H2.js.map
+//# sourceMappingURL=chunk-BEWKRRNZ.js.map

package/dist/{chunk-I5QZ3PVT.js → chunk-BJQA6DSN.js}

@@ -2,7 +2,7 @@ import {
   CACHE_TIMEOUTS,
   createLogger,
   getTimeProvider
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/security/trust-types.ts
 import { z } from "zod";
@@ -560,4 +560,4 @@ export {
   resolveReputationGatingMode,
   gateWithReputation
 };
-//# sourceMappingURL=chunk-I5QZ3PVT.js.map
+//# sourceMappingURL=chunk-BJQA6DSN.js.map

package/dist/{chunk-WT46JLBD.js → chunk-CNIRLXNH.js}

@@ -9,11 +9,11 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-I5QZ3PVT.js";
+} from "./chunk-BJQA6DSN.js";
 import {
   createLogger,
   getTimeProvider
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/dogfooding/pr-reviewer-helpers.ts
 import { randomUUID } from "crypto";
@@ -288,4 +288,4 @@ export {
   formatReviewComment,
   createFailedReview
 };
-//# sourceMappingURL=chunk-WT46JLBD.js.map
+//# sourceMappingURL=chunk-CNIRLXNH.js.map

package/dist/{chunk-TFRXRKU5.js → chunk-CUX775NF.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-3TZUEGNB.js";
+} from "./chunk-U3Y6AWG5.js";
 import {
   ROLE_DEFAULT_TRUST,
   ReputationCache,
@@ -11,13 +11,13 @@ import {
   gateWithReputation,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-I5QZ3PVT.js";
+} from "./chunk-BJQA6DSN.js";
 import {
   createLogger,
   err,
   getTimeProvider,
   ok
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/security/trust-classifier.ts
 function mapAuthorAssociation(association) {
@@ -1390,4 +1390,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-TFRXRKU5.js.map
+//# sourceMappingURL=chunk-CUX775NF.js.map

package/dist/{chunk-UFTQXDUA.js → chunk-DLFJQ6W6.js}

@@ -4,7 +4,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/context/session-memory.ts
 import * as fs from "fs";
@@ -351,4 +351,4 @@ export {
   SessionMemory,
   createSessionMemory
 };
-//# sourceMappingURL=chunk-UFTQXDUA.js.map
+//# sourceMappingURL=chunk-DLFJQ6W6.js.map

package/dist/{chunk-I7UDM43R.js → chunk-DOIOSEDU.js}

@@ -1,6 +1,7 @@
 import {
   API_TIMEOUTS,
   CLI_TIMEOUTS,
+  ConfigError,
   INTERNAL_TIMEOUTS,
   MCP_TIMEOUTS,
   TEST_TIMEOUTS,
@@ -10,8 +11,10 @@ import {
   createGetRateLimitConfig,
   createGetRetryConfig,
   createGetTimeout,
-  createGetToolRateLimit
-} from "./chunk-WDVUKSIQ.js";
+  createGetToolRateLimit,
+  err,
+  ok
+} from "./chunk-2DHISFDY.js";
 
 // src/config/defaults.ts
 var CUSTOM_API_DEFAULT_MODEL = "gpt-4o";
@@ -226,8 +229,119 @@ var getCircuitBreakerConfig = createGetCircuitBreakerConfig(
 var getToolRateLimit = createGetToolRateLimit(DEFAULTS.TOOL_RATE_LIMITS);
 var getEnvVarDocumentation = createGetEnvVarDocumentation(DEFAULTS);
 
+// src/adapters/sdk/types.ts
+var PROVIDER_ENV_KEYS = {
+  anthropic: "ANTHROPIC_API_KEY",
+  openai: "OPENAI_API_KEY",
+  google: "GOOGLE_AI_API_KEY",
+  "custom-openai": "NEXUS_CUSTOM_API_KEY"
+};
+var CUSTOM_API_BASE_URL_ENV = "NEXUS_CUSTOM_API_BASE_URL";
+var CUSTOM_API_ALLOW_PRIVATE_ENV = "NEXUS_CUSTOM_API_ALLOW_PRIVATE";
+
+// src/adapters/sdk/custom-api-validation.ts
+import { isIPv4, isIPv6 } from "net";
+function validateCustomApiBaseUrl(raw, opts = {}) {
+  if (raw === void 0 || raw.trim() === "") {
+    return err(
+      new ConfigError(
+        "Custom API base URL is required but missing. Set NEXUS_CUSTOM_API_BASE_URL or pass `baseUrl` in config."
+      )
+    );
+  }
+  let url;
+  try {
+    url = new URL(raw);
+  } catch {
+    return err(new ConfigError(`Custom API base URL is not a valid URL: ${raw}`));
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return err(
+      new ConfigError(`Custom API base URL must use http or https, got "${url.protocol}" in ${raw}`)
+    );
+  }
+  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();
+  if (!allowPrivate) {
+    const rejection = classifyPrivateHost(url.hostname);
+    if (rejection !== null) {
+      return err(
+        new ConfigError(
+          `Custom API base URL rejected (SSRF guard, reason="${rejection.reason}"): ${rejection.message}. Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`
+        )
+      );
+    }
+  }
+  return ok(url);
+}
+function resolveAllowPrivateFromEnv() {
+  const v = process.env[CUSTOM_API_ALLOW_PRIVATE_ENV];
+  return v === "1" || v === "true";
+}
+function classifyPrivateHost(hostname) {
+  const stripped = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  const normalized = stripped.toLowerCase();
+  if (isIPv4(normalized)) {
+    return classifyIPv4(normalized);
+  }
+  if (isIPv6(normalized)) {
+    return classifyIPv6(normalized);
+  }
+  if (normalized === "localhost" || normalized.endsWith(".localhost") || normalized.endsWith(".local")) {
+    return {
+      reason: "loopback",
+      message: `hostname "${hostname}" resolves to loopback/mDNS`
+    };
+  }
+  return null;
+}
+var IPV4_RULES = [
+  { match: (a) => a === 127, reason: "loopback", label: "IPv4 loopback" },
+  { match: (a) => a === 10, reason: "private_range", label: "IPv4 private (10/8)" },
+  {
+    match: (a, b) => a === 172 && b >= 16 && b <= 31,
+    reason: "private_range",
+    label: "IPv4 private (172.16/12)"
+  },
+  {
+    match: (a, b) => a === 192 && b === 168,
+    reason: "private_range",
+    label: "IPv4 private (192.168/16)"
+  },
+  {
+    match: (a, b) => a === 169 && b === 254,
+    reason: "link_local",
+    label: "IPv4 link-local (169.254/16 \u2014 AWS IMDS)"
+  },
+  { match: (a) => a === 0, reason: "reserved", label: "IPv4 reserved (0/8)" }
+];
+function classifyIPv4(ip) {
+  const parts = ip.split(".").map((p) => Number.parseInt(p, 10));
+  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return null;
+  const [a, b] = parts;
+  for (const rule of IPV4_RULES) {
+    if (rule.match(a, b)) {
+      return { reason: rule.reason, message: `${rule.label} (${ip})` };
+    }
+  }
+  return null;
+}
+function classifyIPv6(ip) {
+  const lower = ip.toLowerCase();
+  if (lower === "::1") return { reason: "loopback", message: `IPv6 loopback (${ip})` };
+  if (lower.startsWith("fe80:"))
+    return { reason: "link_local", message: `IPv6 link-local (${ip})` };
+  if (/^fc|^fd/.test(lower)) {
+    return { reason: "private_range", message: `IPv6 unique-local (${ip}, fc00::/7)` };
+  }
+  return null;
+}
+
 export {
   CUSTOM_API_DEFAULT_MODEL,
-  DEFAULTS
+  DEFAULTS,
+  PROVIDER_ENV_KEYS,
+  CUSTOM_API_BASE_URL_ENV,
+  CUSTOM_API_ALLOW_PRIVATE_ENV,
+  validateCustomApiBaseUrl
 };
-//# sourceMappingURL=chunk-I7UDM43R.js.map
+//# sourceMappingURL=chunk-DOIOSEDU.js.map

package/dist/chunk-DOIOSEDU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/defaults.ts","../src/adapters/sdk/types.ts","../src/adapters/sdk/custom-api-validation.ts"],"sourcesContent":["/**\n * Central Configuration Defaults\n *\n * Consolidates common default values used across the codebase.\n * This prevents scattered magic numbers and ensures consistency.\n *\n * Usage:\n *   import { DEFAULTS, getTimeout, TIMEOUT_PROFILES } from '../config/defaults.js';\n *   const timeout = options.timeout ?? DEFAULTS.TIMEOUT_DEFAULTS.cliMs;\n *   const cliTimeout = getTimeoutForCli('claude', 'complex');\n *\n * Environment overrides can be added via NEXUS_* environment variables.\n *\n * @module config/defaults\n * (Source: Central config consolidation initiative)\n */\n\n// Re-export types from defaults-types\nexport type {\n  TaskComplexity,\n  TimeoutProfile,\n  KnownCliName,\n  TimeoutDefaults,\n  RateLimitDefaults,\n  ToolRateLimitConfig,\n  RetryDefaults,\n  CircuitBreakerDefaults,\n} from './defaults-types.js';\n\nexport { isTaskComplexity, isKnownCliName } from './defaults-types.js';\n\n// Re-export timeout profiles (delegates to config/timeouts.ts)\nexport {\n  TIMEOUT_PROFILES,\n  getTimeoutProfile,\n  getTimeoutForCli,\n} from './defaults-timeout-profiles.js';\n\n// Re-export canonical timeout modules (Issue #984)\nexport {\n  CLI_TIMEOUTS,\n  VOTE_TIMEOUTS,\n  MCP_TIMEOUTS,\n  WORKFLOW_TIMEOUTS,\n  GRAPH_TIMEOUTS,\n  PER_CLI_TASK_TIMEOUTS,\n  API_TIMEOUTS,\n  INTERNAL_TIMEOUTS,\n  TEST_TIMEOUTS,\n  TIMEOUT_ENV_VARS,\n  getCliTimeoutProfile,\n  getCliTimeout,\n  resolveVoteTimeout,\n  resolveEnvTimeout,\n  validateTimeout,\n  BACKOFF_CONFIG,\n  AGENT_ROUTER_TIMEOUTS,\n  CODEX_MCP_TIMEOUTS,\n} from './timeouts.js';\n\n// Re-export env helpers (internal use)\nexport { parseIntEnv, parseFloatEnv, parseBoolEnv } from './defaults-env.js';\n\nimport {\n  createGetTimeout,\n  createGetRetryConfig,\n  createGetRateLimitConfig,\n  createGetCircuitBreakerConfig,\n  createGetToolRateLimit,\n  createGetEnvVarDocumentation,\n} from './defaults-env.js';\nimport {\n  API_TIMEOUTS as _API,\n  WORKFLOW_TIMEOUTS as _WF,\n  MCP_TIMEOUTS as _MCP,\n  INTERNAL_TIMEOUTS as _INT,\n  TEST_TIMEOUTS as _TEST,\n  CLI_TIMEOUTS as _CLI,\n} from './timeouts.js';\n\n// ============================================================================\n// Default Model IDs (#2200 Child 4)\n// ============================================================================\n\n/**\n * Default model identifier for the custom OpenAI-compatible API gateway.\n *\n * Used by both `cli/setup-custom-api.ts` (write to nexus-agents.yaml) and\n * `adapters/auto-adapter.ts` (NEXUS_CUSTOM_MODEL env-var fallback). Single\n * source of truth so changes flow through all consumers.\n *\n * `gpt-4o` is widely supported across OpenAI-compatible gateways (vLLM,\n * LiteLLM, Together AI, etc.) — a pragmatic baseline rather than the\n * cheapest or most capable. Operators are expected to override.\n */\nexport const CUSTOM_API_DEFAULT_MODEL = 'gpt-4o';\n\n// ============================================================================\n// Central Defaults Object\n// ============================================================================\n\n/**\n * Central defaults object containing all configuration categories.\n */\nexport const DEFAULTS = {\n  /**\n   * Default timeout settings in milliseconds.\n   * Values sourced from config/timeouts.ts (Issue #984).\n   */\n  TIMEOUT_DEFAULTS: {\n    /** CLI tool execution timeout in milliseconds. */\n    cliMs: _CLI.default.standard,\n    /** Simple CLI task timeout (single function, quick query). */\n    cliSimpleMs: _CLI.default.simple,\n    /** Complex CLI task timeout (codebase-wide, deep analysis). */\n    cliComplexMs: _CLI.default.complex,\n    /** API request timeout in milliseconds. */\n    apiMs: _API.defaultMs,\n    /** Maximum API timeout in milliseconds. */\n    apiMaxMs: _API.maxMs,\n    /** Workflow-level timeout in milliseconds (5 minutes). */\n    workflowMs: _WF.workflowMs,\n    /** Maximum workflow timeout in milliseconds (30 minutes). */\n    workflowMaxMs: _WF.workflowMaxMs,\n    /** Step-level timeout in milliseconds. */\n    stepMs: _INT.selfEvalMs,\n    /** MCP operation default timeout in milliseconds (generic, not per-tool). */\n    mcpMs: _API.defaultMs,\n    /** MCP operation maximum timeout in milliseconds. */\n    mcpMaxMs: _MCP.maxMs,\n    /** Health check timeout in milliseconds. */\n    healthCheckMs: _INT.healthCheckMs,\n    /** Global test run timeout in milliseconds (10 minutes). */\n    testGlobalMs: _TEST.globalMs,\n    /** Per-task test timeout in milliseconds. */\n    testTaskMs: _TEST.taskMs,\n    /** Circuit breaker reset timeout in milliseconds. */\n    circuitBreakerResetMs: _INT.circuitBreakerResetMs,\n  },\n\n  /**\n   * Default rate limit settings for outbound operations.\n   */\n  RATE_LIMIT_DEFAULTS: {\n    /** Global requests per minute. */\n    requestsPerMinute: 60,\n    /** Whether rate limiting is enabled by default. */\n    enabled: true,\n    /** Maximum number of concurrent requests. */\n    maxConcurrent: 4,\n    /** Token bucket capacity. */\n    capacity: 100,\n    /** Token bucket refill rate per second. */\n    refillRate: 10,\n    /** Refill interval in milliseconds. */\n    refillIntervalMs: 100,\n  },\n\n  /**\n   * Per-tool rate limit defaults for MCP tools.\n   * (Source: Issue #274 Phase 2 - per-tool rate limits)\n   */\n  TOOL_RATE_LIMITS: {\n    orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 60_000 },\n    delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 60_000 },\n    workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 60_000 },\n    expert: { capacity: 30, refillRate: 30, refillIntervalMs: 60_000 },\n  },\n\n  /**\n   * Default retry strategy settings for transient failures.\n   */\n  RETRY_DEFAULTS: {\n    /** Maximum retry attempts before failing. */\n    maxRetries: 3,\n    /** Base delay between retries in milliseconds. */\n    baseDelayMs: 1_000,\n    /** Maximum delay between retries in milliseconds. */\n    maxDelayMs: 30_000,\n    /** Jitter factor (0-1) to randomize retry delays. */\n    jitterFactor: 0.1,\n  },\n\n  /**\n   * Workflow-specific retry defaults.\n   */\n  WORKFLOW_RETRY_DEFAULTS: {\n    /** Maximum retry attempts for workflow steps. */\n    maxRetries: 2,\n    /** Base delay for workflow retries in milliseconds. */\n    baseDelayMs: 2_000,\n    /** Maximum delay for workflow retries in milliseconds. */\n    maxDelayMs: 60_000,\n    /** Jitter factor for workflow retries. */\n    jitterFactor: 0.15,\n  },\n\n  /**\n   * CLI-specific retry defaults.\n   */\n  CLI_RETRY_DEFAULTS: {\n    /** Maximum retry attempts for CLI operations. */\n    maxRetries: 2,\n    /** Base delay for CLI retries in milliseconds. */\n    baseDelayMs: 5_000,\n    /** Maximum delay for CLI retries in milliseconds. */\n    maxDelayMs: 60_000,\n    /** Jitter factor for CLI retries. */\n    jitterFactor: 0.2,\n  },\n\n  /**\n   * Test framework retry defaults.\n   */\n  TEST_RETRY_DEFAULTS: {\n    /** Maximum retries per test task. */\n    maxRetries: 2,\n    /** Whether to retry failed tasks by default. */\n    retryFailedTasks: true,\n  },\n\n  /**\n   * Default buffer sizing for batching and chunked processing.\n   */\n  BUFFER_DEFAULTS: {\n    /** Preferred batch size for bulk operations. */\n    batchSize: 100,\n    /** Chunk size for streaming or segmented processing. */\n    chunkSize: 256,\n    /** Maximum items allowed in a buffer. */\n    maxItems: 1_000,\n    /** Maximum memory size in bytes (10 MB). */\n    maxMemoryBytes: 10 * 1024 * 1024,\n    /** Log buffer flush interval in milliseconds. */\n    logFlushIntervalMs: 5_000,\n  },\n\n  // WORKER_DEFAULTS removed in #2977 — the eight settings under this category\n  // (maxWorkers, poolSize, idleTimeoutMs, workflowMaxParallel, testParallelism,\n  // evaluationMaxWorkers, eventBusMaxHistory, swarmObserverMaxEvents) had zero\n  // production consumers. `getWorkerConfig()` was never called from anywhere\n  // in src/, and the matching NEXUS_WORKERS_* env vars were silent no-ops.\n  // Silent config rot is worse than missing knobs; re-add when a concrete\n  // consumer exists.\n\n  /**\n   * Default circuit breaker settings.\n   * (Source: Issue #81 - Circuit breaker for CLI failures)\n   */\n  CIRCUIT_BREAKER_DEFAULTS: {\n    /** Failure threshold to open circuit. */\n    failureThreshold: 5,\n    /** Reset timeout in milliseconds. */\n    resetTimeoutMs: 30_000,\n    /** Success threshold to close circuit in half-open state. */\n    halfOpenSuccessThreshold: 2,\n    /** Whether to count timeouts as failures. */\n    countTimeoutsAsFailures: true,\n    /** Whether to count auth failures as failures. */\n    countAuthFailuresAsFailures: false,\n    /** Whether to count rate limit errors as failures (#1529). */\n    countRateLimitsAsFailures: true,\n    /** Maximum requests allowed in half-open state. */\n    halfOpenMaxRequests: 3,\n  },\n\n  /**\n   * Default context/memory settings.\n   */\n  CONTEXT_DEFAULTS: {\n    /** Maximum context tokens. */\n    maxTokens: 100_000,\n    /** Token budget warning threshold (80%). */\n    warningThreshold: 0.8,\n    /** Token budget critical threshold (95%). */\n    criticalThreshold: 0.95,\n    /** Maximum history entries to retain. */\n    maxHistoryEntries: 1_000,\n  },\n\n  /**\n   * Default provider/model settings.\n   */\n  PROVIDER_DEFAULTS: {\n    /** Default timeout for provider API calls in ms. */\n    timeout: 30_000,\n    /** Maximum retries for provider requests. */\n    maxRetries: 3,\n    /** Default model tier. */\n    defaultTier: 'balanced' as const,\n    /** Default temperature. */\n    temperatureDefault: 0.3,\n    /** Minimum temperature. */\n    temperatureMin: 0,\n    /** Maximum temperature. */\n    temperatureMax: 1,\n    /** Billing mode: 'plan' (monthly subscription) or 'api' (pay-per-token). Env: NEXUS_BILLING_MODE */\n    billingMode: 'plan' as const,\n  },\n\n  /**\n   * Security-related defaults.\n   */\n  SECURITY_DEFAULTS: {\n    /** Maximum system prompt length in characters. */\n    maxSystemPromptLength: 4_000,\n    /** Default policy execution mode. */\n    policyDefaultMode: 'read-only' as const,\n    /** Default policy mode. */\n    policyMode: 'enforce' as const,\n    /** Default sandbox mode. */\n    sandboxMode: 'policy' as const,\n    /** Whether to fall back to policy mode if container unavailable. */\n    sandboxFallbackToPolicy: true,\n    /** Whether network is enabled in container mode. */\n    sandboxNetworkEnabled: false,\n  },\n} as const;\n\n// ============================================================================\n// Type Exports for DEFAULTS\n// ============================================================================\n\n/** Type for the DEFAULTS object (readonly/const). */\nexport type DefaultsConfig = typeof DEFAULTS;\n\n/** Type for timeout defaults (readonly/const). */\nexport type TimeoutDefaultsConst = typeof DEFAULTS.TIMEOUT_DEFAULTS;\n\n/** Type for rate limit defaults (readonly/const). */\nexport type RateLimitDefaultsConst = typeof DEFAULTS.RATE_LIMIT_DEFAULTS;\n\n/** Type for retry defaults (readonly/const). */\nexport type RetryDefaultsConst = typeof DEFAULTS.RETRY_DEFAULTS;\n\n/** Type for buffer defaults (readonly/const). */\nexport type BufferDefaults = typeof DEFAULTS.BUFFER_DEFAULTS;\n\n/** Type for circuit breaker defaults (readonly/const). */\nexport type CircuitBreakerDefaultsConst = typeof DEFAULTS.CIRCUIT_BREAKER_DEFAULTS;\n\n/** Type for context defaults (readonly/const). */\nexport type ContextDefaults = typeof DEFAULTS.CONTEXT_DEFAULTS;\n\n/** Type for provider defaults (readonly/const). */\nexport type ProviderDefaults = typeof DEFAULTS.PROVIDER_DEFAULTS;\n\n/** Type for security defaults (readonly/const). */\nexport type SecurityDefaults = typeof DEFAULTS.SECURITY_DEFAULTS;\n\n// ============================================================================\n// Environment Override Functions (bound to DEFAULTS)\n// ============================================================================\n\n/**\n * Get timeout with environment override support.\n *\n * @param key - Timeout key (e.g., 'cliMs', 'apiMs')\n * @returns Timeout value in milliseconds\n */\nexport const getTimeout = createGetTimeout(DEFAULTS.TIMEOUT_DEFAULTS);\n\n/**\n * Get retry config with environment override support.\n *\n * @returns Retry configuration\n */\nexport const getRetryConfig = createGetRetryConfig(DEFAULTS.RETRY_DEFAULTS);\n\n/**\n * Get rate limit config with environment override support.\n *\n * @returns Rate limit configuration\n */\nexport const getRateLimitConfig = createGetRateLimitConfig(DEFAULTS.RATE_LIMIT_DEFAULTS);\n\n/**\n * Gets the circuit breaker configuration.\n *\n * @returns Circuit breaker configuration\n */\nexport const getCircuitBreakerConfig = createGetCircuitBreakerConfig(\n  DEFAULTS.CIRCUIT_BREAKER_DEFAULTS\n);\n\n/**\n * Gets the tool rate limit configuration for a specific tool category.\n *\n * @param tool - Tool category (orchestrate, delegate, workflow, expert)\n * @returns Rate limit configuration\n */\nexport const getToolRateLimit = createGetToolRateLimit(DEFAULTS.TOOL_RATE_LIMITS);\n\n// ============================================================================\n// Documentation Helper\n// ============================================================================\n\n/**\n * Returns documentation for all environment variable overrides.\n *\n * @returns Markdown documentation string\n */\nexport const getEnvVarDocumentation = createGetEnvVarDocumentation(DEFAULTS);\n","/**\n * nexus-agents/adapters/sdk - Shared Types\n *\n * Type definitions for AI SDK adapter layer.\n *\n * @module adapters/sdk/types\n * (Source: Issue #1123 — AI SDK provider layer)\n */\n\n/**\n * Supported AI SDK provider identifiers.\n *\n * `custom-openai` is for OpenAI-compatible gateways (multi-vendor proxies,\n * self-hosted LLM servers, corporate model gateways) — uses the same\n * @ai-sdk/openai package but with a configurable `baseURL`.\n */\nexport type SdkProviderId = 'anthropic' | 'openai' | 'google' | 'custom-openai';\n\n/**\n * Configuration for creating an AI SDK adapter.\n */\nexport interface SdkAdapterConfig {\n  /** Provider identifier */\n  providerId: SdkProviderId;\n  /** Model to use (e.g., 'claude-sonnet-4-6', 'gpt-4o') */\n  modelId: string;\n  /** API key (falls back to environment variable) */\n  apiKey?: string;\n  /**\n   * Base URL for OpenAI-compatible gateways. Required when\n   * `providerId === 'custom-openai'`, ignored otherwise. Falls back to\n   * the `NEXUS_CUSTOM_API_BASE_URL` environment variable.\n   */\n  baseUrl?: string;\n  /** Request timeout in milliseconds */\n  timeout?: number;\n  /** Maximum retries on transient failures */\n  maxRetries?: number;\n}\n\n/**\n * Maps provider IDs to their environment variable names.\n */\nexport const PROVIDER_ENV_KEYS: Record<SdkProviderId, string> = {\n  anthropic: 'ANTHROPIC_API_KEY',\n  openai: 'OPENAI_API_KEY',\n  google: 'GOOGLE_AI_API_KEY',\n  'custom-openai': 'NEXUS_CUSTOM_API_KEY',\n};\n\n/**\n * Environment variable name for the custom gateway base URL.\n * Keep in sync with `SdkAdapterConfig.baseUrl`.\n */\nexport const CUSTOM_API_BASE_URL_ENV = 'NEXUS_CUSTOM_API_BASE_URL';\n\n/**\n * Escape hatch: set to `1`/`true` to allow the custom gateway base URL to\n * resolve to a loopback or RFC 1918 private address. Default is DENY —\n * SSRF defense. Only disable this when you know the gateway runs on a\n * trusted internal host and you accept the risk.\n */\nexport const CUSTOM_API_ALLOW_PRIVATE_ENV = 'NEXUS_CUSTOM_API_ALLOW_PRIVATE';\n","/**\n * Validation for the `custom-openai` SDK adapter's gateway URL.\n *\n * The base URL is user-provided, so without validation the adapter becomes\n * an SSRF vector: a malicious prompt that reshaped env vars, or a typo in\n * the config, could point nexus-agents at `http://169.254.169.254/` (AWS\n * metadata) or `http://localhost:5432/` (internal services). This module\n * rejects such URLs unless the user explicitly opts in via\n * `NEXUS_CUSTOM_API_ALLOW_PRIVATE=1`.\n *\n * Called out in the #2119 consensus vote by the Security Engineer role.\n *\n * @module adapters/sdk/custom-api-validation\n */\n\nimport { isIPv4, isIPv6 } from 'node:net';\nimport { ConfigError, ok, err, type Result } from '../../core/index.js';\nimport { CUSTOM_API_ALLOW_PRIVATE_ENV } from './types.js';\n\n/**\n * Why a given URL was rejected. Machine-readable so error messages can\n * distinguish root causes in downstream tooling.\n */\nexport type BaseUrlRejectionReason =\n  | 'empty'\n  | 'not_a_url'\n  | 'not_http_https'\n  | 'loopback'\n  | 'link_local'\n  | 'private_range'\n  | 'reserved';\n\ninterface RejectionDetail {\n  readonly reason: BaseUrlRejectionReason;\n  readonly message: string;\n}\n\n/**\n * Validates a user-provided custom-gateway base URL. Returns the URL as an\n * `ok` Result if it passes, or a `ConfigError` with a machine-readable\n * reason if it fails.\n *\n * Pass `{ allowPrivate: true }` (or set the env var) to bypass the SSRF\n * checks — use this only when the gateway is on a trusted internal host\n * and you accept the risk.\n */\nexport function validateCustomApiBaseUrl(\n  raw: string | undefined,\n  opts: { readonly allowPrivate?: boolean } = {}\n): Result<URL, ConfigError> {\n  if (raw === undefined || raw.trim() === '') {\n    return err(\n      new ConfigError(\n        'Custom API base URL is required but missing. Set NEXUS_CUSTOM_API_BASE_URL or pass `baseUrl` in config.'\n      )\n    );\n  }\n\n  let url: URL;\n  try {\n    url = new URL(raw);\n  } catch {\n    return err(new ConfigError(`Custom API base URL is not a valid URL: ${raw}`));\n  }\n\n  if (url.protocol !== 'http:' && url.protocol !== 'https:') {\n    return err(\n      new ConfigError(`Custom API base URL must use http or https, got \"${url.protocol}\" in ${raw}`)\n    );\n  }\n\n  const allowPrivate = opts.allowPrivate === true || resolveAllowPrivateFromEnv();\n  if (!allowPrivate) {\n    const rejection = classifyPrivateHost(url.hostname);\n    if (rejection !== null) {\n      return err(\n        new ConfigError(\n          `Custom API base URL rejected (SSRF guard, reason=\"${rejection.reason}\"): ${rejection.message}. ` +\n            `Set ${CUSTOM_API_ALLOW_PRIVATE_ENV}=1 to bypass if the gateway runs on a trusted internal host.`\n        )\n      );\n    }\n  }\n\n  return ok(url);\n}\n\nfunction resolveAllowPrivateFromEnv(): boolean {\n  // Deliberately strict (case-sensitive, not parseBoolEnv): this disables an\n  // SSRF guard, so we don't want extra case variants (e.g. `TRUE`) to loosen\n  // the control. Fail-closed on anything but exact `1`/`true` (#3297).\n  const v = process.env[CUSTOM_API_ALLOW_PRIVATE_ENV];\n  return v === '1' || v === 'true';\n}\n\n/**\n * Returns a rejection reason if the hostname resolves (by string form) to\n * a loopback, link-local, or RFC 1918 private address; `null` otherwise.\n *\n * Note: this is a string-level check. It does NOT perform DNS resolution,\n * so a public DNS name that secretly resolves to a private IP will pass.\n * Callers who need that level of defense should add a runtime connect\n * check and validate the socket peer address.\n */\nfunction classifyPrivateHost(hostname: string): RejectionDetail | null {\n  // URL.hostname wraps IPv6 literals in brackets (e.g. \"[::1]\"); strip them\n  // before the net-module checks, which expect bare forms.\n  const stripped =\n    hostname.startsWith('[') && hostname.endsWith(']') ? hostname.slice(1, -1) : hostname;\n  const normalized = stripped.toLowerCase();\n\n  // Literal IPv4 loopback or private-range address\n  if (isIPv4(normalized)) {\n    return classifyIPv4(normalized);\n  }\n\n  // Literal IPv6 loopback (::1), link-local (fe80::/10), unique-local (fc00::/7)\n  if (isIPv6(normalized)) {\n    return classifyIPv6(normalized);\n  }\n\n  // Hostname literals that resolve to loopback without needing DNS\n  if (\n    normalized === 'localhost' ||\n    normalized.endsWith('.localhost') ||\n    normalized.endsWith('.local') // mDNS\n  ) {\n    return {\n      reason: 'loopback',\n      message: `hostname \"${hostname}\" resolves to loopback/mDNS`,\n    };\n  }\n\n  return null;\n}\n\n/** IPv4 ranges the SSRF guard rejects, in order of specificity. */\nconst IPV4_RULES: ReadonlyArray<{\n  readonly match: (a: number, b: number) => boolean;\n  readonly reason: BaseUrlRejectionReason;\n  readonly label: string;\n}> = [\n  { match: (a) => a === 127, reason: 'loopback', label: 'IPv4 loopback' },\n  { match: (a) => a === 10, reason: 'private_range', label: 'IPv4 private (10/8)' },\n  {\n    match: (a, b) => a === 172 && b >= 16 && b <= 31,\n    reason: 'private_range',\n    label: 'IPv4 private (172.16/12)',\n  },\n  {\n    match: (a, b) => a === 192 && b === 168,\n    reason: 'private_range',\n    label: 'IPv4 private (192.168/16)',\n  },\n  {\n    match: (a, b) => a === 169 && b === 254,\n    reason: 'link_local',\n    label: 'IPv4 link-local (169.254/16 — AWS IMDS)',\n  },\n  { match: (a) => a === 0, reason: 'reserved', label: 'IPv4 reserved (0/8)' },\n];\n\nfunction classifyIPv4(ip: string): RejectionDetail | null {\n  const parts = ip.split('.').map((p) => Number.parseInt(p, 10));\n  if (parts.length !== 4 || parts.some((n) => Number.isNaN(n))) return null;\n  const [a, b] = parts as [number, number, number, number];\n  for (const rule of IPV4_RULES) {\n    if (rule.match(a, b)) {\n      return { reason: rule.reason, message: `${rule.label} (${ip})` };\n    }\n  }\n  return null;\n}\n\nfunction classifyIPv6(ip: string): RejectionDetail | null {\n  const lower = ip.toLowerCase();\n  if (lower === '::1') return { reason: 'loopback', message: `IPv6 loopback (${ip})` };\n  if (lower.startsWith('fe80:'))\n    return { reason: 'link_local', message: `IPv6 link-local (${ip})` };\n  // Unique-local: fc00::/7 → first byte has high bit set and second-high bit set\n  if (/^fc|^fd/.test(lower)) {\n    return { reason: 'private_range', message: `IPv6 unique-local (${ip}, fc00::/7)` };\n  }\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AA+FO,IAAM,2BAA2B;AASjC,IAAM,WAAW;AAAA;AAAA;AAAA;AAAA;AAAA,EAKtB,kBAAkB;AAAA;AAAA,IAEhB,OAAO,aAAK,QAAQ;AAAA;AAAA,IAEpB,aAAa,aAAK,QAAQ;AAAA;AAAA,IAE1B,cAAc,aAAK,QAAQ;AAAA;AAAA,IAE3B,OAAO,aAAK;AAAA;AAAA,IAEZ,UAAU,aAAK;AAAA;AAAA,IAEf,YAAY,kBAAI;AAAA;AAAA,IAEhB,eAAe,kBAAI;AAAA;AAAA,IAEnB,QAAQ,kBAAK;AAAA;AAAA,IAEb,OAAO,aAAK;AAAA;AAAA,IAEZ,UAAU,aAAK;AAAA;AAAA,IAEf,eAAe,kBAAK;AAAA;AAAA,IAEpB,cAAc,cAAM;AAAA;AAAA,IAEpB,YAAY,cAAM;AAAA;AAAA,IAElB,uBAAuB,kBAAK;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAqB;AAAA;AAAA,IAEnB,mBAAmB;AAAA;AAAA,IAEnB,SAAS;AAAA;AAAA,IAET,eAAe;AAAA;AAAA,IAEf,UAAU;AAAA;AAAA,IAEV,YAAY;AAAA;AAAA,IAEZ,kBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,kBAAkB;AAAA,IAChB,aAAa,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,IACtE,UAAU,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,IACnE,UAAU,EAAE,UAAU,GAAG,YAAY,GAAG,kBAAkB,IAAO;AAAA,IACjE,QAAQ,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAO;AAAA,EACnE;AAAA;AAAA;AAAA;AAAA,EAKA,gBAAgB;AAAA;AAAA,IAEd,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,yBAAyB;AAAA;AAAA,IAEvB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,oBAAoB;AAAA;AAAA,IAElB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,YAAY;AAAA;AAAA,IAEZ,cAAc;AAAA,EAChB;AAAA;AAAA;AAAA;AAAA,EAKA,qBAAqB;AAAA;AAAA,IAEnB,YAAY;AAAA;AAAA,IAEZ,kBAAkB;AAAA,EACpB;AAAA;AAAA;AAAA;AAAA,EAKA,iBAAiB;AAAA;AAAA,IAEf,WAAW;AAAA;AAAA,IAEX,WAAW;AAAA;AAAA,IAEX,UAAU;AAAA;AAAA,IAEV,gBAAgB,KAAK,OAAO;AAAA;AAAA,IAE5B,oBAAoB;AAAA,EACtB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAcA,0BAA0B;AAAA;AAAA,IAExB,kBAAkB;AAAA;AAAA,IAElB,gBAAgB;AAAA;AAAA,IAEhB,0BAA0B;AAAA;AAAA,IAE1B,yBAAyB;AAAA;AAAA,IAEzB,6BAA6B;AAAA;AAAA,IAE7B,2BAA2B;AAAA;AAAA,IAE3B,qBAAqB;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA,EAKA,kBAAkB;AAAA;AAAA,IAEhB,WAAW;AAAA;AAAA,IAEX,kBAAkB;AAAA;AAAA,IAElB,mBAAmB;AAAA;AAAA,IAEnB,mBAAmB;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAmB;AAAA;AAAA,IAEjB,SAAS;AAAA;AAAA,IAET,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,oBAAoB;AAAA;AAAA,IAEpB,gBAAgB;AAAA;AAAA,IAEhB,gBAAgB;AAAA;AAAA,IAEhB,aAAa;AAAA,EACf;AAAA;AAAA;AAAA;AAAA,EAKA,mBAAmB;AAAA;AAAA,IAEjB,uBAAuB;AAAA;AAAA,IAEvB,mBAAmB;AAAA;AAAA,IAEnB,YAAY;AAAA;AAAA,IAEZ,aAAa;AAAA;AAAA,IAEb,yBAAyB;AAAA;AAAA,IAEzB,uBAAuB;AAAA,EACzB;AACF;AA2CO,IAAM,aAAa,iBAAiB,SAAS,gBAAgB;AAO7D,IAAM,iBAAiB,qBAAqB,SAAS,cAAc;AAOnE,IAAM,qBAAqB,yBAAyB,SAAS,mBAAmB;AAOhF,IAAM,0BAA0B;AAAA,EACrC,SAAS;AACX;AAQO,IAAM,mBAAmB,uBAAuB,SAAS,gBAAgB;AAWzE,IAAM,yBAAyB,6BAA6B,QAAQ;;;ACvWpE,IAAM,oBAAmD;AAAA,EAC9D,WAAW;AAAA,EACX,QAAQ;AAAA,EACR,QAAQ;AAAA,EACR,iBAAiB;AACnB;AAMO,IAAM,0BAA0B;AAQhC,IAAM,+BAA+B;;;AC/C5C,SAAS,QAAQ,cAAc;AA+BxB,SAAS,yBACd,KACA,OAA4C,CAAC,GACnB;AAC1B,MAAI,QAAQ,UAAa,IAAI,KAAK,MAAM,IAAI;AAC1C,WAAO;AAAA,MACL,IAAI;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,IAAI,IAAI,GAAG;AAAA,EACnB,QAAQ;AACN,WAAO,IAAI,IAAI,YAAY,2CAA2C,GAAG,EAAE,CAAC;AAAA,EAC9E;AAEA,MAAI,IAAI,aAAa,WAAW,IAAI,aAAa,UAAU;AACzD,WAAO;AAAA,MACL,IAAI,YAAY,oDAAoD,IAAI,QAAQ,QAAQ,GAAG,EAAE;AAAA,IAC/F;AAAA,EACF;AAEA,QAAM,eAAe,KAAK,iBAAiB,QAAQ,2BAA2B;AAC9E,MAAI,CAAC,cAAc;AACjB,UAAM,YAAY,oBAAoB,IAAI,QAAQ;AAClD,QAAI,cAAc,MAAM;AACtB,aAAO;AAAA,QACL,IAAI;AAAA,UACF,qDAAqD,UAAU,MAAM,OAAO,UAAU,OAAO,SACpF,4BAA4B;AAAA,QACvC;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,GAAG,GAAG;AACf;AAEA,SAAS,6BAAsC;AAI7C,QAAM,IAAI,QAAQ,IAAI,4BAA4B;AAClD,SAAO,MAAM,OAAO,MAAM;AAC5B;AAWA,SAAS,oBAAoB,UAA0C;AAGrE,QAAM,WACJ,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AAC/E,QAAM,aAAa,SAAS,YAAY;AAGxC,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,aAAa,UAAU;AAAA,EAChC;AAGA,MAAI,OAAO,UAAU,GAAG;AACtB,WAAO,aAAa,UAAU;AAAA,EAChC;AAGA,MACE,eAAe,eACf,WAAW,SAAS,YAAY,KAChC,WAAW,SAAS,QAAQ,GAC5B;AACA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,SAAS,aAAa,QAAQ;AAAA,IAChC;AAAA,EACF;AAEA,SAAO;AACT;AAGA,IAAM,aAID;AAAA,EACH,EAAE,OAAO,CAAC,MAAM,MAAM,KAAK,QAAQ,YAAY,OAAO,gBAAgB;AAAA,EACtE,EAAE,OAAO,CAAC,MAAM,MAAM,IAAI,QAAQ,iBAAiB,OAAO,sBAAsB;AAAA,EAChF;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,KAAK,MAAM,KAAK;AAAA,IAC9C,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,MAAM;AAAA,IACpC,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA;AAAA,IACE,OAAO,CAAC,GAAG,MAAM,MAAM,OAAO,MAAM;AAAA,IACpC,QAAQ;AAAA,IACR,OAAO;AAAA,EACT;AAAA,EACA,EAAE,OAAO,CAAC,MAAM,MAAM,GAAG,QAAQ,YAAY,OAAO,sBAAsB;AAC5E;AAEA,SAAS,aAAa,IAAoC;AACxD,QAAM,QAAQ,GAAG,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,OAAO,SAAS,GAAG,EAAE,CAAC;AAC7D,MAAI,MAAM,WAAW,KAAK,MAAM,KAAK,CAAC,MAAM,OAAO,MAAM,CAAC,CAAC,EAAG,QAAO;AACrE,QAAM,CAAC,GAAG,CAAC,IAAI;AACf,aAAW,QAAQ,YAAY;AAC7B,QAAI,KAAK,MAAM,GAAG,CAAC,GAAG;AACpB,aAAO,EAAE,QAAQ,KAAK,QAAQ,SAAS,GAAG,KAAK,KAAK,KAAK,EAAE,IAAI;AAAA,IACjE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,aAAa,IAAoC;AACxD,QAAM,QAAQ,GAAG,YAAY;AAC7B,MAAI,UAAU,MAAO,QAAO,EAAE,QAAQ,YAAY,SAAS,kBAAkB,EAAE,IAAI;AACnF,MAAI,MAAM,WAAW,OAAO;AAC1B,WAAO,EAAE,QAAQ,cAAc,SAAS,oBAAoB,EAAE,IAAI;AAEpE,MAAI,UAAU,KAAK,KAAK,GAAG;AACzB,WAAO,EAAE,QAAQ,iBAAiB,SAAS,sBAAsB,EAAE,cAAc;AAAA,EACnF;AACA,SAAO;AACT;","names":[]}

package/dist/{chunk-2B7332HE.js → chunk-E3JGMUGY.js}

@@ -1,14 +1,14 @@
 import {
   resolveToken
-} from "./chunk-46GXDOWQ.js";
+} from "./chunk-5UU6BQJ3.js";
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-3TZUEGNB.js";
+} from "./chunk-U3Y6AWG5.js";
 import {
   err,
   ok
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-2B7332HE.js.map
+//# sourceMappingURL=chunk-E3JGMUGY.js.map

package/dist/{chunk-IFO52GSQ.js → chunk-EBJJGYOQ.js}

@@ -1,13 +1,13 @@
 import {
   getToolMemory
-} from "./chunk-M54LGBTY.js";
+} from "./chunk-75NKH2VD.js";
 import {
   CLI_NAMES,
   StrategyDistiller,
   createLogger,
   getOutcomeStore,
   registerPersistentDistillerFactory
-} from "./chunk-WDVUKSIQ.js";
+} from "./chunk-2DHISFDY.js";
 import {
   ensureLearningDir,
   getRulesFile
@@ -273,4 +273,4 @@ export {
   inferTaskCategory,
   summarizeContextForPrompt
 };
-//# sourceMappingURL=chunk-IFO52GSQ.js.map
+//# sourceMappingURL=chunk-EBJJGYOQ.js.map