nexus-agents 2.97.1 → 2.99.0

package/dist/{registry-command-OVRRKYHO.js → registry-command-AX7Z4K4W.js}

@@ -1,8 +1,9 @@
 import {
   ModelCapabilitySchema,
   createLogger,
-  getInTreeCapabilitiesMatrix
-} from "./chunk-JTQLV374.js";
+  getDefaultRegistry,
+  loadGeneratedRegistryEntries
+} from "./chunk-M774MKHE.js";
 import {
   nexusDataPath
 } from "./chunk-CH7QIDHQ.js";
@@ -10,14 +11,8 @@ import "./chunk-PR4QN5HX.js";
 
 // src/cli/registry-command.ts
 import { createHash } from "crypto";
-import { existsSync as existsSync3, mkdirSync, readFileSync as readFileSync3, writeFileSync } from "fs";
-import { dirname as dirname2 } from "path";
-
-// src/config/capability-discovery.ts
-import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
-import { fileURLToPath } from "url";
-import { dirname, join } from "path";
-import { z } from "zod";
+import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { dirname } from "path";
 
 // src/config/capability-overlay.ts
 import { existsSync, readFileSync, statSync } from "fs";
@@ -179,208 +174,6 @@ function validateEntries(rawEntries, log, path) {
   return { entries, rejections };
 }
 
-// src/config/capability-discovery.ts
-var GeneratedProvenanceSchema = z.object({
-  source: z.enum(["models.dev", "litellm"]),
-  fetchedAt: z.string(),
-  upstreamUrl: z.string()
-});
-var GeneratedModelEntrySchema = z.object({
-  id: z.string().min(1),
-  displayName: z.string().min(1),
-  provider: z.string().min(1),
-  contextWindow: z.number().int().positive(),
-  pricing: z.object({
-    inputPer1M: z.number().nonnegative(),
-    outputPer1M: z.number().nonnegative()
-  }).optional(),
-  maxOutputTokens: z.number().int().positive().optional(),
-  deprecated: z.boolean().optional(),
-  provenance: GeneratedProvenanceSchema
-});
-var GeneratedRegistrySchema = z.object({
-  version: z.literal(1),
-  generatedAt: z.string(),
-  entryCount: z.number().int().nonnegative(),
-  entries: z.array(GeneratedModelEntrySchema)
-});
-var LEGACY_200K_DEFAULT = { contextWindow: 2e5 };
-var FAIL_CLOSED_DEFAULT = { contextWindow: 8192 };
-var CapabilityDiscovery = class {
-  canonical;
-  generated;
-  overlay;
-  fallback;
-  logger;
-  generatedById;
-  constructor(config = {}) {
-    this.canonical = config.canonical ?? getInTreeCapabilitiesMatrix();
-    this.generated = config.generated ?? null;
-    this.overlay = config.overlay ?? [];
-    this.fallback = config.conservativeDefault ?? LEGACY_200K_DEFAULT;
-    this.logger = config.logger ?? createLogger({ component: "capability-discovery" });
-    this.generatedById = /* @__PURE__ */ new Map();
-    if (this.generated !== null) {
-      for (const entry of this.generated.entries) {
-        this.generatedById.set(entry.id, entry);
-      }
-    }
-  }
-  /** Synchronously resolve a model id through the four-tier chain. */
-  resolve(modelId) {
-    const t3 = this.lookupOverlay(modelId);
-    if (t3 !== void 0) return this.fromCanonical("t3", t3);
-    const t1 = this.lookupCanonical(modelId);
-    if (t1 !== void 0) return this.fromCanonical("t1", t1);
-    const t2 = this.lookupGenerated(modelId);
-    if (t2 !== void 0) return this.fromGenerated("t2", t2);
-    return this.fromFallback(modelId);
-  }
-  /** Exposes the configured fallback for testing / doctor command. */
-  getConservativeDefault() {
-    return this.fallback;
-  }
-  /** Count of entries per tier — used by `registry doctor` (#2179). */
-  getTierCounts() {
-    return {
-      t3: this.overlay.length,
-      t1: this.canonical.models.length,
-      t2: this.generatedById.size,
-      t4: 0
-    };
-  }
-  // -------------------------------------------------------------------------
-  // Tier lookups
-  // -------------------------------------------------------------------------
-  lookupOverlay(modelId) {
-    return this.overlay.find((m) => m.id === modelId);
-  }
-  lookupCanonical(modelId) {
-    return this.canonical.models.find((m) => m.id === modelId);
-  }
-  lookupGenerated(modelId) {
-    const direct = this.generatedById.get(modelId);
-    if (direct !== void 0) return direct;
-    for (const candidate of buildAliasCandidates(modelId)) {
-      const hit = this.generatedById.get(candidate);
-      if (hit !== void 0) return hit;
-    }
-    return void 0;
-  }
-  // -------------------------------------------------------------------------
-  // Result shaping
-  // -------------------------------------------------------------------------
-  fromCanonical(tier, entry) {
-    const base = {
-      tier,
-      id: entry.id,
-      displayName: entry.displayName,
-      provider: entry.provider,
-      contextWindow: entry.contextWindow,
-      canonical: entry,
-      ...entry.pricing !== void 0 ? { pricing: entry.pricing } : {},
-      ...entry.maxOutputTokens !== void 0 ? { maxOutputTokens: entry.maxOutputTokens } : {},
-      ...entry.deprecated !== void 0 ? { deprecated: entry.deprecated } : {}
-    };
-    return base;
-  }
-  fromGenerated(tier, entry) {
-    return {
-      tier,
-      id: entry.id,
-      displayName: entry.displayName,
-      provider: entry.provider,
-      contextWindow: entry.contextWindow,
-      provenance: entry.provenance,
-      ...entry.pricing !== void 0 ? { pricing: entry.pricing } : {},
-      ...entry.maxOutputTokens !== void 0 ? { maxOutputTokens: entry.maxOutputTokens } : {},
-      ...entry.deprecated !== void 0 ? { deprecated: entry.deprecated } : {}
-    };
-  }
-  fromFallback(modelId) {
-    this.logger.warn("Model resolved at T4 conservative default", {
-      modelId,
-      contextWindow: this.fallback.contextWindow
-    });
-    return {
-      tier: "t4",
-      id: modelId,
-      displayName: modelId,
-      provider: "unknown",
-      contextWindow: this.fallback.contextWindow,
-      ...this.fallback.maxOutputTokens !== void 0 ? { maxOutputTokens: this.fallback.maxOutputTokens } : {}
-    };
-  }
-};
-var KNOWN_PROVIDER_PREFIXES = [
-  "amazon-bedrock",
-  "google-vertex",
-  "azure-openai",
-  "openrouter",
-  "anthropic",
-  "openai",
-  "google",
-  "deepseek"
-];
-function buildAliasCandidates(modelId) {
-  const seen = /* @__PURE__ */ new Set([modelId]);
-  for (const prefix of KNOWN_PROVIDER_PREFIXES) {
-    seen.add(`${prefix}/${modelId}`);
-  }
-  const slash = modelId.indexOf("/");
-  if (slash !== -1) {
-    const tail = modelId.slice(slash + 1);
-    for (const prefix of KNOWN_PROVIDER_PREFIXES) {
-      seen.add(`${prefix}/${tail}`);
-    }
-  }
-  seen.delete(modelId);
-  return [...seen];
-}
-function defaultGeneratedRegistryPath() {
-  const here = dirname(fileURLToPath(import.meta.url));
-  return join(here, "model-registry.generated.json");
-}
-function loadBundledGeneratedRegistry(path = defaultGeneratedRegistryPath(), logger) {
-  const log = logger ?? createLogger({ component: "capability-discovery" });
-  if (!existsSync2(path)) {
-    log.warn("T2 generated registry file missing; falling back to T1 + T4", { path });
-    return null;
-  }
-  let raw;
-  try {
-    raw = JSON.parse(readFileSync2(path, "utf-8"));
-  } catch (err) {
-    const error = err instanceof Error ? err : new Error(String(err));
-    log.warn("T2 generated registry JSON parse failed; falling back to T1 + T4", {
-      path,
-      errorMessage: error.message
-    });
-    return null;
-  }
-  const parsed = GeneratedRegistrySchema.safeParse(raw);
-  if (!parsed.success) {
-    log.warn("T2 generated registry schema validation failed; falling back to T1 + T4", {
-      path,
-      errorMessage: parsed.error.message
-    });
-    return null;
-  }
-  return parsed.data;
-}
-var globalDiscovery;
-function getCapabilityDiscovery() {
-  globalDiscovery ??= new CapabilityDiscovery({
-    generated: loadBundledGeneratedRegistry(),
-    overlay: loadCapabilityOverlay().entries,
-    // Fail-closed default (#2177): unknown models get 8 K context and a
-    // structured warn instead of the silent 200 K fall-through the legacy
-    // getModelContextWindow used to return.
-    conservativeDefault: FAIL_CLOSED_DEFAULT
-  });
-  return globalDiscovery;
-}
-
 // src/cli/registry-command.ts
 var VALID_SUBCOMMANDS = ["doctor", "refresh"];
 function isValidRegistrySubcommand(v) {
@@ -390,6 +183,14 @@ async function registryCommand(subcommand, options = {}) {
   if (subcommand === "doctor") return doctorCommand(options);
   return refreshCommand(options);
 }
+var UNKNOWN_MODEL_CONTEXT_WINDOW = 8192;
+var ENTRY_SOURCES = [
+  "in-tree",
+  "models-dev",
+  "manifest",
+  "derived",
+  "generated"
+];
 function doctorCommand(options) {
   const report = buildDoctorReport(options);
   if (options.json === true) {
@@ -398,18 +199,26 @@ function doctorCommand(options) {
   return { text: formatDoctorReport(report), exitCode: 0 };
 }
 function buildDoctorReport(options) {
-  const bundledPath = defaultGeneratedRegistryPath();
-  const bundled = loadBundledGeneratedRegistry(bundledPath);
+  const entries = getDefaultRegistry().allEntries();
+  const sourceCounts = {
+    "in-tree": 0,
+    "models-dev": 0,
+    manifest: 0,
+    derived: 0,
+    generated: 0
+  };
+  for (const entry of entries) {
+    sourceCounts[entry.source] += 1;
+  }
+  const generated = loadGeneratedRegistryEntries();
   const overlay = loadCapabilityOverlay(options.overlayPath ?? process.env);
-  const discovery = getCapabilityDiscovery();
-  const fallback = discovery.getConservativeDefault();
   return {
-    tierCounts: discovery.getTierCounts(),
+    sourceCounts,
+    totalEntries: entries.length,
     bundled: {
-      path: bundledPath,
-      present: bundled !== null,
-      entryCount: bundled !== null ? bundled.entryCount : null,
-      generatedAt: bundled !== null ? bundled.generatedAt : null
+      path: generated.path,
+      status: generated.status,
+      entryCount: generated.entries.length
     },
     overlay: {
       path: overlay.path,
@@ -422,9 +231,8 @@ function buildDoctorReport(options) {
       })),
       envOverride: process.env[OVERLAY_ENV_VAR]
     },
-    conservativeDefault: {
-      contextWindow: fallback.contextWindow,
-      maxOutputTokens: fallback.maxOutputTokens ?? null
+    unknownIdFallback: {
+      contextWindow: UNKNOWN_MODEL_CONTEXT_WINDOW
     }
   };
 }
@@ -433,20 +241,17 @@ function formatDoctorReport(r) {
   lines.push("nexus-agents registry doctor");
   lines.push("============================");
   lines.push("");
-  lines.push("Tier counts (T3 overlay \u2192 T1 canonical \u2192 T2 bundled \u2192 T4 fallback):");
-  lines.push(`  T3 overlay   : ${String(r.tierCounts.t3)}`);
-  lines.push(`  T1 canonical : ${String(r.tierCounts.t1)}`);
-  lines.push(`  T2 bundled   : ${String(r.tierCounts.t2)}`);
+  lines.push(`Registry entries by source (total ${String(r.totalEntries)}):`);
+  for (const source of ENTRY_SOURCES) {
+    lines.push(`  ${source.padEnd(11)}: ${String(r.sourceCounts[source])}`);
+  }
   lines.push("");
-  lines.push("T2 bundled registry:");
+  lines.push("Bundled generated registry (long-tail breadth tier):");
   lines.push(`  path        : ${r.bundled.path}`);
-  lines.push(`  present     : ${r.bundled.present ? "yes" : "no (using T1 + T4 only)"}`);
-  if (r.bundled.present) {
-    lines.push(`  entryCount  : ${String(r.bundled.entryCount ?? "?")}`);
-    lines.push(`  generatedAt : ${r.bundled.generatedAt ?? "?"}`);
-  }
+  lines.push(`  status      : ${r.bundled.status}`);
+  lines.push(`  entryCount  : ${String(r.bundled.entryCount)}`);
   lines.push("");
-  lines.push("T3 user overlay:");
+  lines.push("T3 user overlay (reported for inspection):");
   lines.push(`  path        : ${r.overlay.path}`);
   lines.push(`  status      : ${r.overlay.status}`);
   lines.push(`  entryCount  : ${String(r.overlay.entryCount)}`);
@@ -459,11 +264,8 @@ function formatDoctorReport(r) {
     }
   }
   lines.push("");
-  lines.push("T4 conservative default (for unknown ids):");
-  lines.push(`  contextWindow : ${String(r.conservativeDefault.contextWindow)}`);
-  if (r.conservativeDefault.maxOutputTokens !== null) {
-    lines.push(`  maxOutputTokens: ${String(r.conservativeDefault.maxOutputTokens)}`);
-  }
+  lines.push("Unknown-id fallback (id resolves in no source):");
+  lines.push(`  contextWindow : ${String(r.unknownIdFallback.contextWindow)}`);
   return lines.join("\n");
 }
 var MAX_REFRESH_BYTES = 5 * 1024 * 1024;
@@ -525,7 +327,7 @@ async function refreshCommand(options) {
   if (options.dryRun === true) {
     return { text: formatRefreshReport("would write to", source, artifact, dest), exitCode: 0 };
   }
-  mkdirSync(dirname2(dest), { recursive: true });
+  mkdirSync(dirname(dest), { recursive: true });
   writeFileSync(dest, artifact.body, "utf-8");
   return {
     text: formatRefreshReport("wrote to", source, artifact, dest, [
@@ -559,7 +361,9 @@ function formatRegistryUsage() {
   return [
     "Usage:",
     "  nexus-agents registry doctor [--json]",
-    "      Inspect the four-tier capability discovery state.",
+    "      Inspect the merged ModelRegistry: per-source entry counts, the",
+    "      bundled generated registry, the user overlay, and the unknown-id",
+    "      fallback contextWindow.",
     "",
     "  nexus-agents registry refresh --source=<url> [--dry-run]",
     "      Download a signed model-registry.generated.json from <url>,",
@@ -575,4 +379,4 @@ export {
   isValidRegistrySubcommand,
   registryCommand
 };
-//# sourceMappingURL=registry-command-OVRRKYHO.js.map
+//# sourceMappingURL=registry-command-AX7Z4K4W.js.map

package/dist/registry-command-AX7Z4K4W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/registry-command.ts","../src/config/capability-overlay.ts"],"sourcesContent":["/**\n * `nexus-agents registry` CLI subcommands (epic #2174 / issue #2179).\n *\n * Two subcommands:\n *\n * - `doctor` — inspect the ModelRegistry: effective per-source entry counts,\n *   the bundled generated registry path/status, the user overlay (reported for\n *   inspection), and the unknown-id fallback contextWindow. Surfaces whatever\n *   overlay parse rejections occurred at load. Read-only. (#3293 migrated this\n *   off the deleted CapabilityDiscovery four-tier chain.)\n *\n * - `refresh` — download a signed `model-registry.generated.json` from a\n *   URL, SHA256-verify against a `.sha256` sidecar, write to the user's\n *   overlay location. Requires `--source=<url>` today; the GitHub-latest-\n *   release automation is #2180's concern.\n *\n * No runtime hot path touches the network — refresh is a one-shot,\n * user-initiated operation.\n *\n * @module cli/registry-command\n */\n\nimport { createHash } from 'node:crypto';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { dirname } from 'node:path';\nimport { nexusDataPath } from '../config/nexus-data-dir.js';\n\nimport { getDefaultRegistry, type EntrySource } from '../config/model-registry.js';\nimport { loadGeneratedRegistryEntries } from '../config/models-generated-loader.js';\nimport {\n  OVERLAY_ENV_VAR,\n  OVERLAY_MAX_BYTES,\n  defaultOverlayPath,\n  loadCapabilityOverlay,\n  resolveOverlayPath,\n} from '../config/capability-overlay.js';\n\n// ---------------------------------------------------------------------------\n// Dispatch\n// ---------------------------------------------------------------------------\n\nexport type RegistrySubcommand = 'doctor' | 'refresh';\n\nconst VALID_SUBCOMMANDS: readonly RegistrySubcommand[] = ['doctor', 'refresh'];\n\nexport function isValidRegistrySubcommand(v: string | undefined): v is RegistrySubcommand {\n  return v !== undefined && (VALID_SUBCOMMANDS as readonly string[]).includes(v);\n}\n\nexport interface RegistryCommandOptions {\n  readonly json?: boolean;\n  readonly source?: string;\n  readonly dryRun?: boolean;\n  readonly overlayPath?: string;\n  /** For tests: a fetch function. Defaults to `globalThis.fetch`. */\n  readonly fetchImpl?: typeof fetch;\n  /** For tests: override the default destination path. */\n  readonly destPath?: string;\n}\n\nexport interface RegistryCommandResult {\n  readonly text: string;\n  readonly exitCode: number;\n}\n\nexport async function registryCommand(\n  subcommand: RegistrySubcommand,\n  options: RegistryCommandOptions = {}\n): Promise<RegistryCommandResult> {\n  if (subcommand === 'doctor') return doctorCommand(options);\n  return refreshCommand(options);\n}\n\n// ---------------------------------------------------------------------------\n// doctor\n// ---------------------------------------------------------------------------\n\n/**\n * ContextWindow returned for an id no registry source resolves. This is the\n * old `FAIL_CLOSED_DEFAULT.contextWindow` value (#2177), preserved here after\n * the CapabilityDiscovery four-tier chain was deleted in #3293.\n */\nconst UNKNOWN_MODEL_CONTEXT_WINDOW = 8192;\n\n/** Every registry source, in report order. */\nconst ENTRY_SOURCES: readonly EntrySource[] = [\n  'in-tree',\n  'models-dev',\n  'manifest',\n  'derived',\n  'generated',\n];\n\ninterface DoctorReport {\n  /** Effective per-source counts over `getDefaultRegistry().allEntries()`. */\n  readonly sourceCounts: Record<EntrySource, number>;\n  readonly totalEntries: number;\n  readonly bundled: {\n    readonly path: string;\n    readonly status: 'loaded' | 'missing' | 'malformed';\n    readonly entryCount: number;\n  };\n  readonly overlay: {\n    readonly path: string;\n    readonly status: 'missing' | 'empty' | 'malformed' | 'too-large' | 'loaded';\n    readonly entryCount: number;\n    readonly rejections: readonly { index: number; id?: string; reason: string }[];\n    readonly envOverride: string | undefined;\n  };\n  readonly unknownIdFallback: {\n    readonly contextWindow: number;\n  };\n}\n\nfunction doctorCommand(options: RegistryCommandOptions): RegistryCommandResult {\n  const report = buildDoctorReport(options);\n  if (options.json === true) {\n    return { text: JSON.stringify(report, null, 2), exitCode: 0 };\n  }\n  return { text: formatDoctorReport(report), exitCode: 0 };\n}\n\nfunction buildDoctorReport(options: RegistryCommandOptions): DoctorReport {\n  // Effective per-source counts over the fully-merged registry: dedup/override\n  // across tiers has already happened, so `allEntries()` reflects what actually\n  // wins, grouped by the surviving entry's `source`.\n  const entries = getDefaultRegistry().allEntries();\n  const sourceCounts: Record<EntrySource, number> = {\n    'in-tree': 0,\n    'models-dev': 0,\n    manifest: 0,\n    derived: 0,\n    generated: 0,\n  };\n  for (const entry of entries) {\n    sourceCounts[entry.source] += 1;\n  }\n\n  // The bundled generated catalog (long-tail breadth tier) — reported from the\n  // same loader the registry ingests, so the path/status here matches reality.\n  const generated = loadGeneratedRegistryEntries();\n\n  // User overlay is reported for inspection only; the registry consumes the\n  // operator manifest, not this YAML overlay (kept by manifest-overlay.ts).\n  const overlay = loadCapabilityOverlay(options.overlayPath ?? process.env);\n\n  return {\n    sourceCounts,\n    totalEntries: entries.length,\n    bundled: {\n      path: generated.path,\n      status: generated.status,\n      entryCount: generated.entries.length,\n    },\n    overlay: {\n      path: overlay.path,\n      status: overlay.status,\n      entryCount: overlay.entries.length,\n      rejections: overlay.rejections.map((r) => ({\n        index: r.index,\n        ...(r.id !== undefined ? { id: r.id } : {}),\n        reason: r.reason,\n      })),\n      envOverride: process.env[OVERLAY_ENV_VAR],\n    },\n    unknownIdFallback: {\n      contextWindow: UNKNOWN_MODEL_CONTEXT_WINDOW,\n    },\n  };\n}\n\nfunction formatDoctorReport(r: DoctorReport): string {\n  const lines: string[] = [];\n  lines.push('nexus-agents registry doctor');\n  lines.push('============================');\n  lines.push('');\n  lines.push(`Registry entries by source (total ${String(r.totalEntries)}):`);\n  for (const source of ENTRY_SOURCES) {\n    lines.push(`  ${source.padEnd(11)}: ${String(r.sourceCounts[source])}`);\n  }\n  lines.push('');\n  lines.push('Bundled generated registry (long-tail breadth tier):');\n  lines.push(`  path        : ${r.bundled.path}`);\n  lines.push(`  status      : ${r.bundled.status}`);\n  lines.push(`  entryCount  : ${String(r.bundled.entryCount)}`);\n  lines.push('');\n  // User overlay reported for inspection; not consumed by the merged registry.\n  lines.push('T3 user overlay (reported for inspection):');\n  lines.push(`  path        : ${r.overlay.path}`);\n  lines.push(`  status      : ${r.overlay.status}`);\n  lines.push(`  entryCount  : ${String(r.overlay.entryCount)}`);\n  lines.push(`  env override: ${r.overlay.envOverride ?? '(not set)'}`);\n  if (r.overlay.rejections.length > 0) {\n    lines.push('  rejections  :');\n    for (const rej of r.overlay.rejections) {\n      const idPart = rej.id !== undefined ? ` id=${rej.id}` : '';\n      lines.push(`    - [${String(rej.index)}]${idPart} ${rej.reason}`);\n    }\n  }\n  lines.push('');\n  lines.push('Unknown-id fallback (id resolves in no source):');\n  lines.push(`  contextWindow : ${String(r.unknownIdFallback.contextWindow)}`);\n  return lines.join('\\n');\n}\n\n// ---------------------------------------------------------------------------\n// refresh\n// ---------------------------------------------------------------------------\n\nconst MAX_REFRESH_BYTES = 5 * 1024 * 1024;\n\nfunction missingSourceResult(): RegistryCommandResult {\n  return {\n    text: [\n      'registry refresh requires --source=<url>.',\n      '',\n      'The url should point at a model-registry.generated.json file with a',\n      'matching <url>.sha256 sidecar (single line containing the SHA256 hash).',\n      '',\n      'A signed GitHub release artifact is a planned default but not wired yet;',\n      `that is tracked in #2180. Use --source=<your-mirror-url> in the meantime.`,\n    ].join('\\n'),\n    exitCode: 2,\n  };\n}\n\ninterface VerifiedArtifact {\n  readonly body: string;\n  readonly sha256: string;\n}\n\nasync function fetchAndVerify(\n  source: string,\n  fetchImpl: typeof fetch\n): Promise<VerifiedArtifact | RegistryCommandResult> {\n  const body = await fetchWithCap(source, fetchImpl);\n  if (!body.ok || body.body === undefined) {\n    return { text: `Failed to fetch ${source}: ${body.error ?? 'unknown'}`, exitCode: 1 };\n  }\n  const sha = await fetchWithCap(`${source}.sha256`, fetchImpl);\n  if (!sha.ok || sha.body === undefined) {\n    return {\n      text: `Failed to fetch ${source}.sha256 for integrity check: ${sha.error ?? 'unknown'}`,\n      exitCode: 1,\n    };\n  }\n  const expected = sha.body.trim().split(/\\s+/)[0] ?? '';\n  if (expected === '') {\n    return { text: `SHA256 sidecar at ${source}.sha256 is empty`, exitCode: 1 };\n  }\n  const actual = createHash('sha256').update(body.body, 'utf-8').digest('hex');\n  if (actual.toLowerCase() !== expected.toLowerCase()) {\n    return {\n      text: `SHA256 mismatch: expected ${expected}, got ${actual}. Aborting write.`,\n      exitCode: 1,\n    };\n  }\n  return { body: body.body, sha256: actual };\n}\n\nfunction formatRefreshReport(\n  verb: 'would write to' | 'wrote to',\n  source: string,\n  artifact: VerifiedArtifact,\n  dest: string,\n  extraTail: readonly string[] = []\n): string {\n  return [\n    `registry refresh${verb.startsWith('would') ? ' --dry-run' : ''}`,\n    `source   : ${source}`,\n    `sha256   : ${artifact.sha256} (verified)`,\n    `bytes    : ${String(artifact.body.length)}`,\n    `${verb}: ${dest}`,\n    ...extraTail,\n  ].join('\\n');\n}\n\nasync function refreshCommand(options: RegistryCommandOptions): Promise<RegistryCommandResult> {\n  const source = options.source;\n  if (source === undefined || source === '') return missingSourceResult();\n\n  const artifact = await fetchAndVerify(source, options.fetchImpl ?? fetch);\n  if ('text' in artifact) return artifact;\n\n  const dest = options.destPath ?? nexusDataPath('model-registry.generated.json');\n  if (options.dryRun === true) {\n    return { text: formatRefreshReport('would write to', source, artifact, dest), exitCode: 0 };\n  }\n\n  mkdirSync(dirname(dest), { recursive: true });\n  writeFileSync(dest, artifact.body, 'utf-8');\n  return {\n    text: formatRefreshReport('wrote to', source, artifact, dest, [\n      '',\n      'The refreshed file takes precedence over the bundled registry on the next',\n      'run. Restart any running CLI / MCP server for the change to take effect.',\n    ]),\n    exitCode: 0,\n  };\n}\n\ninterface FetchResult {\n  readonly ok: boolean;\n  readonly body?: string;\n  readonly error?: string;\n}\n\nasync function fetchWithCap(url: string, fetchImpl: typeof fetch): Promise<FetchResult> {\n  try {\n    const response = await fetchImpl(url, { signal: AbortSignal.timeout(30_000) });\n    if (!response.ok) {\n      return { ok: false, error: `HTTP ${String(response.status)}` };\n    }\n    const body = await response.text();\n    if (body.length > MAX_REFRESH_BYTES) {\n      return {\n        ok: false,\n        error: `payload ${String(body.length)} bytes exceeds cap ${String(MAX_REFRESH_BYTES)}`,\n      };\n    }\n    return { ok: true, body };\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    return { ok: false, error: message };\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Usage\n// ---------------------------------------------------------------------------\n\nexport function formatRegistryUsage(): string {\n  return [\n    'Usage:',\n    '  nexus-agents registry doctor [--json]',\n    '      Inspect the merged ModelRegistry: per-source entry counts, the',\n    '      bundled generated registry, the user overlay, and the unknown-id',\n    '      fallback contextWindow.',\n    '',\n    '  nexus-agents registry refresh --source=<url> [--dry-run]',\n    '      Download a signed model-registry.generated.json from <url>,',\n    '      SHA256-verify against <url>.sha256, and write to:',\n    `      ${nexusDataPath('model-registry.generated.json')}`,\n    '',\n    `Overlay path (T3) is ${defaultOverlayPath()} by default,`,\n    `or whatever ${OVERLAY_ENV_VAR} points to. Overlay max size is ${String(OVERLAY_MAX_BYTES)} bytes.`,\n  ].join('\\n');\n}\n\n// Dummy references to satisfy unused-var lint when destructuring is conditional.\nvoid existsSync;\nvoid readFileSync;\nvoid resolveOverlayPath;\n","/**\n * User YAML overlay loader for user model overrides (#2178).\n *\n * NOTE (#3293): the legacy CapabilityDiscovery resolver that consumed this\n * overlay was removed. This loader is retained — `registry doctor` reports\n * the overlay file for inspection, and `manifest-overlay.ts` reuses its\n * parsing helpers — but the overlay is NOT yet wired into the live\n * ModelRegistry. Wiring it in (so `models.yaml` actually affects resolution)\n * is tracked in #3351.\n *\n * Reads user-supplied model capability overrides from a YAML file. Fully\n * optional — missing file, empty file, malformed YAML, and schema-invalid\n * entries all return the empty overlay with structured warnings instead of\n * throwing. Operators use this to fix broken bundled / canonical entries\n * without needing an npm release, or to declare models the curated T1 /\n * generated T2 tiers don't cover.\n *\n * Precedent: LiteLLM's `register_model({...})` + aider's\n * `aider/resources/model-settings.yml`.\n *\n * @module config/capability-overlay\n */\n\nimport { existsSync, readFileSync, statSync } from 'node:fs';\nimport { parse as parseYaml } from 'yaml';\nimport { nexusDataPath } from './nexus-data-dir.js';\n\nimport type { ILogger } from '../core/index.js';\nimport { createLogger } from '../core/index.js';\nimport { ModelCapabilitySchema } from './model-capabilities-types.js';\nimport type { ModelCapability } from './model-capabilities-types.js';\n\n/** Environment variable an operator can set to override the default path. */\nexport const OVERLAY_ENV_VAR = 'NEXUS_MODEL_REGISTRY_OVERLAY';\n\n/** Max file size accepted for the overlay (1 MB — far larger than expected). */\nexport const OVERLAY_MAX_BYTES = 1 * 1024 * 1024;\n\n/**\n * Default overlay location: `<NEXUS_DATA_DIR>/models.yaml`. Returns the\n * absolute path without checking if it exists.\n */\nexport function defaultOverlayPath(): string {\n  return nexusDataPath('models.yaml');\n}\n\n/**\n * Resolves the overlay path: `$NEXUS_MODEL_REGISTRY_OVERLAY` wins if set,\n * otherwise the default `~/.nexus-agents/models.yaml`.\n */\nexport function resolveOverlayPath(env: NodeJS.ProcessEnv = process.env): string {\n  const override = env[OVERLAY_ENV_VAR];\n  if (override !== undefined && override !== '') return override;\n  return defaultOverlayPath();\n}\n\n// ---------------------------------------------------------------------------\n// Result shape\n// ---------------------------------------------------------------------------\n\n/** Structured reason for a rejected or skipped entry. */\nexport interface OverlayRejection {\n  readonly index: number;\n  readonly id?: string;\n  readonly reason: string;\n}\n\nexport interface OverlayLoadResult {\n  readonly entries: readonly ModelCapability[];\n  readonly rejections: readonly OverlayRejection[];\n  readonly path: string;\n  readonly status: 'missing' | 'empty' | 'malformed' | 'too-large' | 'loaded';\n}\n\n// ---------------------------------------------------------------------------\n// Loader\n// ---------------------------------------------------------------------------\n\n/**\n * Expected YAML root shape:\n *\n *   version: 1\n *   models:\n *     - id: claude-opus\n *       displayName: \"Claude Opus (overridden)\"\n *       provider: anthropic\n *       contextWindow: 1000000\n *       ...\n *     - ...\n *\n * or simply:\n *\n *   - id: ...\n *     ...\n *\n * Both a top-level array and an object with `models:` are accepted for\n * ergonomics; everything else is rejected with a structured reason.\n */\nexport function loadCapabilityOverlay(\n  pathOrEnv?: string | NodeJS.ProcessEnv,\n  logger?: ILogger\n): OverlayLoadResult {\n  const log = logger ?? createLogger({ component: 'capability-overlay' });\n  const path = resolvePath(pathOrEnv);\n\n  if (!existsSync(path)) {\n    return { entries: [], rejections: [], path, status: 'missing' };\n  }\n\n  const sizeStatus = checkSize(path, log);\n  if (sizeStatus !== undefined) return sizeStatus;\n\n  const bodyResult = readBody(path, log);\n  if ('result' in bodyResult) return bodyResult.result;\n  const body = bodyResult.body;\n  if (body === '') {\n    log.info('Model registry overlay file is empty', { path });\n    return { entries: [], rejections: [], path, status: 'empty' };\n  }\n\n  const parseResult = parseBody(body, path, log);\n  if ('result' in parseResult) return parseResult.result;\n  const parsed = parseResult.parsed;\n\n  const rawEntries = extractEntries(parsed);\n  if (rawEntries === undefined) {\n    log.warn('Model registry overlay has unrecognized shape; treated as empty', {\n      path,\n    });\n    return {\n      entries: [],\n      rejections: [{ index: -1, reason: 'Expected array or { models: [...] }' }],\n      path,\n      status: 'malformed',\n    };\n  }\n\n  const { entries, rejections } = validateEntries(rawEntries, log, path);\n  return { entries, rejections, path, status: 'loaded' };\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\nfunction resolvePath(pathOrEnv: string | NodeJS.ProcessEnv | undefined): string {\n  if (typeof pathOrEnv === 'string') return pathOrEnv;\n  if (pathOrEnv !== undefined) return resolveOverlayPath(pathOrEnv);\n  return resolveOverlayPath();\n}\n\ntype ReadBodyResult = { body: string } | { result: OverlayLoadResult };\nfunction readBody(path: string, log: ILogger): ReadBodyResult {\n  try {\n    return { body: readFileSync(path, 'utf-8').trim() };\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    log.warn('Model registry overlay file read failed; treated as empty', {\n      path,\n      errorMessage: message,\n    });\n    return {\n      result: {\n        entries: [],\n        rejections: [{ index: -1, reason: `file read error: ${message}` }],\n        path,\n        status: 'malformed',\n      },\n    };\n  }\n}\n\ntype ParseBodyResult = { parsed: unknown } | { result: OverlayLoadResult };\nfunction parseBody(body: string, path: string, log: ILogger): ParseBodyResult {\n  try {\n    return { parsed: parseYaml(body) };\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    log.warn('Model registry overlay YAML parse failed; treated as empty', {\n      path,\n      errorMessage: message,\n    });\n    return {\n      result: {\n        entries: [],\n        rejections: [{ index: -1, reason: `YAML parse error: ${message}` }],\n        path,\n        status: 'malformed',\n      },\n    };\n  }\n}\n\nfunction checkSize(path: string, log: ILogger): OverlayLoadResult | undefined {\n  let size: number;\n  try {\n    size = statSync(path).size;\n  } catch (err: unknown) {\n    const message = err instanceof Error ? err.message : String(err);\n    log.warn('Model registry overlay statSync failed; treated as missing', {\n      path,\n      errorMessage: message,\n    });\n    return { entries: [], rejections: [], path, status: 'missing' };\n  }\n  if (size <= OVERLAY_MAX_BYTES) return undefined;\n  log.warn('Model registry overlay exceeds size cap; refusing to load', {\n    path,\n    size,\n    maxBytes: OVERLAY_MAX_BYTES,\n  });\n  return {\n    entries: [],\n    rejections: [\n      {\n        index: -1,\n        reason: `file size ${String(size)} exceeds cap ${String(OVERLAY_MAX_BYTES)}`,\n      },\n    ],\n    path,\n    status: 'too-large',\n  };\n}\n\nfunction extractIdForError(raw: unknown): string | undefined {\n  if (raw === null || typeof raw !== 'object' || !('id' in raw)) return undefined;\n  const idValue = raw.id;\n  if (typeof idValue === 'string' && idValue !== '') return idValue;\n  return undefined;\n}\n\nfunction extractEntries(parsed: unknown): unknown[] | undefined {\n  if (Array.isArray(parsed)) return parsed as unknown[];\n  if (parsed !== null && typeof parsed === 'object') {\n    const obj = parsed as { models?: unknown };\n    if (Array.isArray(obj.models)) return obj.models as unknown[];\n  }\n  return undefined;\n}\n\ninterface ValidatedEntries {\n  readonly entries: readonly ModelCapability[];\n  readonly rejections: readonly OverlayRejection[];\n}\n\nfunction validateEntries(\n  rawEntries: readonly unknown[],\n  log: ILogger,\n  path: string\n): ValidatedEntries {\n  const entries: ModelCapability[] = [];\n  const rejections: OverlayRejection[] = [];\n  for (let i = 0; i < rawEntries.length; i++) {\n    const raw = rawEntries[i];\n    const idCandidate = extractIdForError(raw);\n    const parsed = ModelCapabilitySchema.safeParse(raw);\n    if (!parsed.success) {\n      const rejection: OverlayRejection = {\n        index: i,\n        ...(idCandidate !== undefined && idCandidate !== '' ? { id: idCandidate } : {}),\n        reason: parsed.error.message,\n      };\n      rejections.push(rejection);\n      log.warn('Model registry overlay entry rejected by schema', {\n        path,\n        index: i,\n        id: idCandidate,\n        errorMessage: parsed.error.message,\n      });\n      continue;\n    }\n    entries.push(parsed.data);\n  }\n  return { entries, rejections };\n}\n"],"mappings":";;;;;;;;;;;;AAsBA,SAAS,kBAAkB;AAC3B,SAAS,cAAAA,aAAY,WAAW,gBAAAC,eAAc,qBAAqB;AACnE,SAAS,eAAe;;;ACDxB,SAAS,YAAY,cAAc,gBAAgB;AACnD,SAAS,SAAS,iBAAiB;AAS5B,IAAM,kBAAkB;AAGxB,IAAM,oBAAoB,IAAI,OAAO;AAMrC,SAAS,qBAA6B;AAC3C,SAAO,cAAc,aAAa;AACpC;AAMO,SAAS,mBAAmB,MAAyB,QAAQ,KAAa;AAC/E,QAAM,WAAW,IAAI,eAAe;AACpC,MAAI,aAAa,UAAa,aAAa,GAAI,QAAO;AACtD,SAAO,mBAAmB;AAC5B;AA4CO,SAAS,sBACd,WACA,QACmB;AACnB,QAAM,MAAM,UAAU,aAAa,EAAE,WAAW,qBAAqB,CAAC;AACtE,QAAM,OAAO,YAAY,SAAS;AAElC,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,MAAM,QAAQ,UAAU;AAAA,EAChE;AAEA,QAAM,aAAa,UAAU,MAAM,GAAG;AACtC,MAAI,eAAe,OAAW,QAAO;AAErC,QAAM,aAAa,SAAS,MAAM,GAAG;AACrC,MAAI,YAAY,WAAY,QAAO,WAAW;AAC9C,QAAM,OAAO,WAAW;AACxB,MAAI,SAAS,IAAI;AACf,QAAI,KAAK,wCAAwC,EAAE,KAAK,CAAC;AACzD,WAAO,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,MAAM,QAAQ,QAAQ;AAAA,EAC9D;AAEA,QAAM,cAAc,UAAU,MAAM,MAAM,GAAG;AAC7C,MAAI,YAAY,YAAa,QAAO,YAAY;AAChD,QAAM,SAAS,YAAY;AAE3B,QAAM,aAAa,eAAe,MAAM;AACxC,MAAI,eAAe,QAAW;AAC5B,QAAI,KAAK,mEAAmE;AAAA,MAC1E;AAAA,IACF,CAAC;AACD,WAAO;AAAA,MACL,SAAS,CAAC;AAAA,MACV,YAAY,CAAC,EAAE,OAAO,IAAI,QAAQ,sCAAsC,CAAC;AAAA,MACzE;AAAA,MACA,QAAQ;AAAA,IACV;AAAA,EACF;AAEA,QAAM,EAAE,SAAS,WAAW,IAAI,gBAAgB,YAAY,KAAK,IAAI;AACrE,SAAO,EAAE,SAAS,YAAY,MAAM,QAAQ,SAAS;AACvD;AAMA,SAAS,YAAY,WAA2D;AAC9E,MAAI,OAAO,cAAc,SAAU,QAAO;AAC1C,MAAI,cAAc,OAAW,QAAO,mBAAmB,SAAS;AAChE,SAAO,mBAAmB;AAC5B;AAGA,SAAS,SAAS,MAAc,KAA8B;AAC5D,MAAI;AACF,WAAO,EAAE,MAAM,aAAa,MAAM,OAAO,EAAE,KAAK,EAAE;AAAA,EACpD,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAI,KAAK,6DAA6D;AAAA,MACpE;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,SAAS,CAAC;AAAA,QACV,YAAY,CAAC,EAAE,OAAO,IAAI,QAAQ,oBAAoB,OAAO,GAAG,CAAC;AAAA,QACjE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAGA,SAAS,UAAU,MAAc,MAAc,KAA+B;AAC5E,MAAI;AACF,WAAO,EAAE,QAAQ,UAAU,IAAI,EAAE;AAAA,EACnC,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAI,KAAK,8DAA8D;AAAA,MACrE;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,WAAO;AAAA,MACL,QAAQ;AAAA,QACN,SAAS,CAAC;AAAA,QACV,YAAY,CAAC,EAAE,OAAO,IAAI,QAAQ,qBAAqB,OAAO,GAAG,CAAC;AAAA,QAClE;AAAA,QACA,QAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACF;AAEA,SAAS,UAAU,MAAc,KAA6C;AAC5E,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI,EAAE;AAAA,EACxB,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,QAAI,KAAK,8DAA8D;AAAA,MACrE;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,WAAO,EAAE,SAAS,CAAC,GAAG,YAAY,CAAC,GAAG,MAAM,QAAQ,UAAU;AAAA,EAChE;AACA,MAAI,QAAQ,kBAAmB,QAAO;AACtC,MAAI,KAAK,6DAA6D;AAAA,IACpE;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,SAAO;AAAA,IACL,SAAS,CAAC;AAAA,IACV,YAAY;AAAA,MACV;AAAA,QACE,OAAO;AAAA,QACP,QAAQ,aAAa,OAAO,IAAI,CAAC,gBAAgB,OAAO,iBAAiB,CAAC;AAAA,MAC5E;AAAA,IACF;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,EACV;AACF;AAEA,SAAS,kBAAkB,KAAkC;AAC3D,MAAI,QAAQ,QAAQ,OAAO,QAAQ,YAAY,EAAE,QAAQ,KAAM,QAAO;AACtE,QAAM,UAAU,IAAI;AACpB,MAAI,OAAO,YAAY,YAAY,YAAY,GAAI,QAAO;AAC1D,SAAO;AACT;AAEA,SAAS,eAAe,QAAwC;AAC9D,MAAI,MAAM,QAAQ,MAAM,EAAG,QAAO;AAClC,MAAI,WAAW,QAAQ,OAAO,WAAW,UAAU;AACjD,UAAM,MAAM;AACZ,QAAI,MAAM,QAAQ,IAAI,MAAM,EAAG,QAAO,IAAI;AAAA,EAC5C;AACA,SAAO;AACT;AAOA,SAAS,gBACP,YACA,KACA,MACkB;AAClB,QAAM,UAA6B,CAAC;AACpC,QAAM,aAAiC,CAAC;AACxC,WAAS,IAAI,GAAG,IAAI,WAAW,QAAQ,KAAK;AAC1C,UAAM,MAAM,WAAW,CAAC;AACxB,UAAM,cAAc,kBAAkB,GAAG;AACzC,UAAM,SAAS,sBAAsB,UAAU,GAAG;AAClD,QAAI,CAAC,OAAO,SAAS;AACnB,YAAM,YAA8B;AAAA,QAClC,OAAO;AAAA,QACP,GAAI,gBAAgB,UAAa,gBAAgB,KAAK,EAAE,IAAI,YAAY,IAAI,CAAC;AAAA,QAC7E,QAAQ,OAAO,MAAM;AAAA,MACvB;AACA,iBAAW,KAAK,SAAS;AACzB,UAAI,KAAK,mDAAmD;AAAA,QAC1D;AAAA,QACA,OAAO;AAAA,QACP,IAAI;AAAA,QACJ,cAAc,OAAO,MAAM;AAAA,MAC7B,CAAC;AACD;AAAA,IACF;AACA,YAAQ,KAAK,OAAO,IAAI;AAAA,EAC1B;AACA,SAAO,EAAE,SAAS,WAAW;AAC/B;;;ADvOA,IAAM,oBAAmD,CAAC,UAAU,SAAS;AAEtE,SAAS,0BAA0B,GAAgD;AACxF,SAAO,MAAM,UAAc,kBAAwC,SAAS,CAAC;AAC/E;AAkBA,eAAsB,gBACpB,YACA,UAAkC,CAAC,GACH;AAChC,MAAI,eAAe,SAAU,QAAO,cAAc,OAAO;AACzD,SAAO,eAAe,OAAO;AAC/B;AAWA,IAAM,+BAA+B;AAGrC,IAAM,gBAAwC;AAAA,EAC5C;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAuBA,SAAS,cAAc,SAAwD;AAC7E,QAAM,SAAS,kBAAkB,OAAO;AACxC,MAAI,QAAQ,SAAS,MAAM;AACzB,WAAO,EAAE,MAAM,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,UAAU,EAAE;AAAA,EAC9D;AACA,SAAO,EAAE,MAAM,mBAAmB,MAAM,GAAG,UAAU,EAAE;AACzD;AAEA,SAAS,kBAAkB,SAA+C;AAIxE,QAAM,UAAU,mBAAmB,EAAE,WAAW;AAChD,QAAM,eAA4C;AAAA,IAChD,WAAW;AAAA,IACX,cAAc;AAAA,IACd,UAAU;AAAA,IACV,SAAS;AAAA,IACT,WAAW;AAAA,EACb;AACA,aAAW,SAAS,SAAS;AAC3B,iBAAa,MAAM,MAAM,KAAK;AAAA,EAChC;AAIA,QAAM,YAAY,6BAA6B;AAI/C,QAAM,UAAU,sBAAsB,QAAQ,eAAe,QAAQ,GAAG;AAExE,SAAO;AAAA,IACL;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB,SAAS;AAAA,MACP,MAAM,UAAU;AAAA,MAChB,QAAQ,UAAU;AAAA,MAClB,YAAY,UAAU,QAAQ;AAAA,IAChC;AAAA,IACA,SAAS;AAAA,MACP,MAAM,QAAQ;AAAA,MACd,QAAQ,QAAQ;AAAA,MAChB,YAAY,QAAQ,QAAQ;AAAA,MAC5B,YAAY,QAAQ,WAAW,IAAI,CAAC,OAAO;AAAA,QACzC,OAAO,EAAE;AAAA,QACT,GAAI,EAAE,OAAO,SAAY,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;AAAA,QACzC,QAAQ,EAAE;AAAA,MACZ,EAAE;AAAA,MACF,aAAa,QAAQ,IAAI,eAAe;AAAA,IAC1C;AAAA,IACA,mBAAmB;AAAA,MACjB,eAAe;AAAA,IACjB;AAAA,EACF;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,QAAkB,CAAC;AACzB,QAAM,KAAK,8BAA8B;AACzC,QAAM,KAAK,8BAA8B;AACzC,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,qCAAqC,OAAO,EAAE,YAAY,CAAC,IAAI;AAC1E,aAAW,UAAU,eAAe;AAClC,UAAM,KAAK,KAAK,OAAO,OAAO,EAAE,CAAC,KAAK,OAAO,EAAE,aAAa,MAAM,CAAC,CAAC,EAAE;AAAA,EACxE;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,sDAAsD;AACjE,QAAM,KAAK,mBAAmB,EAAE,QAAQ,IAAI,EAAE;AAC9C,QAAM,KAAK,mBAAmB,EAAE,QAAQ,MAAM,EAAE;AAChD,QAAM,KAAK,mBAAmB,OAAO,EAAE,QAAQ,UAAU,CAAC,EAAE;AAC5D,QAAM,KAAK,EAAE;AAEb,QAAM,KAAK,4CAA4C;AACvD,QAAM,KAAK,mBAAmB,EAAE,QAAQ,IAAI,EAAE;AAC9C,QAAM,KAAK,mBAAmB,EAAE,QAAQ,MAAM,EAAE;AAChD,QAAM,KAAK,mBAAmB,OAAO,EAAE,QAAQ,UAAU,CAAC,EAAE;AAC5D,QAAM,KAAK,mBAAmB,EAAE,QAAQ,eAAe,WAAW,EAAE;AACpE,MAAI,EAAE,QAAQ,WAAW,SAAS,GAAG;AACnC,UAAM,KAAK,iBAAiB;AAC5B,eAAW,OAAO,EAAE,QAAQ,YAAY;AACtC,YAAM,SAAS,IAAI,OAAO,SAAY,OAAO,IAAI,EAAE,KAAK;AACxD,YAAM,KAAK,UAAU,OAAO,IAAI,KAAK,CAAC,IAAI,MAAM,IAAI,IAAI,MAAM,EAAE;AAAA,IAClE;AAAA,EACF;AACA,QAAM,KAAK,EAAE;AACb,QAAM,KAAK,iDAAiD;AAC5D,QAAM,KAAK,qBAAqB,OAAO,EAAE,kBAAkB,aAAa,CAAC,EAAE;AAC3E,SAAO,MAAM,KAAK,IAAI;AACxB;AAMA,IAAM,oBAAoB,IAAI,OAAO;AAErC,SAAS,sBAA6C;AACpD,SAAO;AAAA,IACL,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,IACX,UAAU;AAAA,EACZ;AACF;AAOA,eAAe,eACb,QACA,WACmD;AACnD,QAAM,OAAO,MAAM,aAAa,QAAQ,SAAS;AACjD,MAAI,CAAC,KAAK,MAAM,KAAK,SAAS,QAAW;AACvC,WAAO,EAAE,MAAM,mBAAmB,MAAM,KAAK,KAAK,SAAS,SAAS,IAAI,UAAU,EAAE;AAAA,EACtF;AACA,QAAM,MAAM,MAAM,aAAa,GAAG,MAAM,WAAW,SAAS;AAC5D,MAAI,CAAC,IAAI,MAAM,IAAI,SAAS,QAAW;AACrC,WAAO;AAAA,MACL,MAAM,mBAAmB,MAAM,gCAAgC,IAAI,SAAS,SAAS;AAAA,MACrF,UAAU;AAAA,IACZ;AAAA,EACF;AACA,QAAM,WAAW,IAAI,KAAK,KAAK,EAAE,MAAM,KAAK,EAAE,CAAC,KAAK;AACpD,MAAI,aAAa,IAAI;AACnB,WAAO,EAAE,MAAM,qBAAqB,MAAM,oBAAoB,UAAU,EAAE;AAAA,EAC5E;AACA,QAAM,SAAS,WAAW,QAAQ,EAAE,OAAO,KAAK,MAAM,OAAO,EAAE,OAAO,KAAK;AAC3E,MAAI,OAAO,YAAY,MAAM,SAAS,YAAY,GAAG;AACnD,WAAO;AAAA,MACL,MAAM,6BAA6B,QAAQ,SAAS,MAAM;AAAA,MAC1D,UAAU;AAAA,IACZ;AAAA,EACF;AACA,SAAO,EAAE,MAAM,KAAK,MAAM,QAAQ,OAAO;AAC3C;AAEA,SAAS,oBACP,MACA,QACA,UACA,MACA,YAA+B,CAAC,GACxB;AACR,SAAO;AAAA,IACL,mBAAmB,KAAK,WAAW,OAAO,IAAI,eAAe,EAAE;AAAA,IAC/D,cAAc,MAAM;AAAA,IACpB,cAAc,SAAS,MAAM;AAAA,IAC7B,cAAc,OAAO,SAAS,KAAK,MAAM,CAAC;AAAA,IAC1C,GAAG,IAAI,KAAK,IAAI;AAAA,IAChB,GAAG;AAAA,EACL,EAAE,KAAK,IAAI;AACb;AAEA,eAAe,eAAe,SAAiE;AAC7F,QAAM,SAAS,QAAQ;AACvB,MAAI,WAAW,UAAa,WAAW,GAAI,QAAO,oBAAoB;AAEtE,QAAM,WAAW,MAAM,eAAe,QAAQ,QAAQ,aAAa,KAAK;AACxE,MAAI,UAAU,SAAU,QAAO;AAE/B,QAAM,OAAO,QAAQ,YAAY,cAAc,+BAA+B;AAC9E,MAAI,QAAQ,WAAW,MAAM;AAC3B,WAAO,EAAE,MAAM,oBAAoB,kBAAkB,QAAQ,UAAU,IAAI,GAAG,UAAU,EAAE;AAAA,EAC5F;AAEA,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,gBAAc,MAAM,SAAS,MAAM,OAAO;AAC1C,SAAO;AAAA,IACL,MAAM,oBAAoB,YAAY,QAAQ,UAAU,MAAM;AAAA,MAC5D;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AAAA,IACD,UAAU;AAAA,EACZ;AACF;AAQA,eAAe,aAAa,KAAa,WAA+C;AACtF,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,KAAK,EAAE,QAAQ,YAAY,QAAQ,GAAM,EAAE,CAAC;AAC7E,QAAI,CAAC,SAAS,IAAI;AAChB,aAAO,EAAE,IAAI,OAAO,OAAO,QAAQ,OAAO,SAAS,MAAM,CAAC,GAAG;AAAA,IAC/D;AACA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,KAAK,SAAS,mBAAmB;AACnC,aAAO;AAAA,QACL,IAAI;AAAA,QACJ,OAAO,WAAW,OAAO,KAAK,MAAM,CAAC,sBAAsB,OAAO,iBAAiB,CAAC;AAAA,MACtF;AAAA,IACF;AACA,WAAO,EAAE,IAAI,MAAM,KAAK;AAAA,EAC1B,SAAS,KAAc;AACrB,UAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,WAAO,EAAE,IAAI,OAAO,OAAO,QAAQ;AAAA,EACrC;AACF;AAMO,SAAS,sBAA8B;AAC5C,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS,cAAc,+BAA+B,CAAC;AAAA,IACvD;AAAA,IACA,wBAAwB,mBAAmB,CAAC;AAAA,IAC5C,eAAe,eAAe,mCAAmC,OAAO,iBAAiB,CAAC;AAAA,EAC5F,EAAE,KAAK,IAAI;AACb;","names":["existsSync","readFileSync"]}

package/dist/{repo-security-plan-X74TBYOV.js → repo-security-plan-N2GNWFER.js}

@@ -3,9 +3,9 @@ import {
   buildPlanFromAnalysis,
   generateSecurityPlan,
   resolveScannerData
-} from "./chunk-WXDWDGVL.js";
+} from "./chunk-BKUKBOGV.js";
 import "./chunk-HFOQKCD2.js";
-import "./chunk-JTQLV374.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -14,4 +14,4 @@ export {
   generateSecurityPlan,
   resolveScannerData
 };
-//# sourceMappingURL=repo-security-plan-X74TBYOV.js.map
+//# sourceMappingURL=repo-security-plan-N2GNWFER.js.map

package/dist/{research-helpers-synthesize-OSP6FGNV.js → research-helpers-synthesize-OKNU245Z.js}

@@ -1,13 +1,13 @@
 import {
   AttributedInsightSchema,
   synthesizeResearch
-} from "./chunk-T5TYWM5S.js";
+} from "./chunk-5WY3N7VX.js";
 import "./chunk-NUBSJGQZ.js";
-import "./chunk-JTQLV374.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
   AttributedInsightSchema,
   synthesizeResearch
 };
-//# sourceMappingURL=research-helpers-synthesize-OSP6FGNV.js.map
+//# sourceMappingURL=research-helpers-synthesize-OKNU245Z.js.map

package/dist/{routing-memory-5T5QJF47.js → routing-memory-3QXWGWB5.js}

@@ -2,7 +2,7 @@ import {
   DEFAULT_ROUTING_MEMORY_CONFIG,
   RoutingMemory,
   createRoutingMemory
-} from "./chunk-JTQLV374.js";
+} from "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -10,4 +10,4 @@ export {
   RoutingMemory,
   createRoutingMemory
 };
-//# sourceMappingURL=routing-memory-5T5QJF47.js.map
+//# sourceMappingURL=routing-memory-3QXWGWB5.js.map

package/dist/{session-memory-X7CJ6X4A.js → session-memory-AK4AJXGI.js}

@@ -6,8 +6,8 @@ import {
   SessionMemory,
   SessionMemoryError,
   createSessionMemory
-} from "./chunk-HIWO2WWP.js";
-import "./chunk-JTQLV374.js";
+} from "./chunk-DLNCQO6L.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -19,4 +19,4 @@ export {
   SessionMemoryError,
   createSessionMemory
 };
-//# sourceMappingURL=session-memory-X7CJ6X4A.js.map
+//# sourceMappingURL=session-memory-AK4AJXGI.js.map

package/dist/{setup-command-7KP3O3P3.js → setup-command-PHTP43V7.js}

@@ -8,19 +8,19 @@ import {
   runWizard,
   setupCommand,
   setupCommandAsync
-} from "./chunk-Y4TTYQUK.js";
-import "./chunk-NTBVUWU4.js";
-import "./chunk-5F7LHFAU.js";
-import "./chunk-N5656LE3.js";
-import "./chunk-OSHCOBDK.js";
-import "./chunk-UNOOL6EN.js";
+} from "./chunk-WHFCVKAV.js";
+import "./chunk-HFNHJZOK.js";
+import "./chunk-VPH2M5H7.js";
+import "./chunk-HBZUXO4Q.js";
+import "./chunk-CJODZY4U.js";
+import "./chunk-XO25FS24.js";
 import "./chunk-NUBSJGQZ.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-ML4IF3PS.js";
-import "./chunk-674NONPG.js";
-import "./chunk-HZGHPBTV.js";
+import "./chunk-EM7NUGMG.js";
+import "./chunk-A7XUXJWL.js";
+import "./chunk-AH67WRET.js";
 import "./chunk-ZM4O442V.js";
-import "./chunk-JTQLV374.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -34,4 +34,4 @@ export {
   setupCommand,
   setupCommandAsync
 };
-//# sourceMappingURL=setup-command-7KP3O3P3.js.map
+//# sourceMappingURL=setup-command-PHTP43V7.js.map

package/dist/{setup-config-YVIKUNOB.js → setup-config-ANAFKZGE.js}

@@ -1,10 +1,10 @@
 import {
   runConfigInitSync
-} from "./chunk-NTBVUWU4.js";
-import "./chunk-JTQLV374.js";
+} from "./chunk-HFNHJZOK.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
   runConfigInitSync
 };
-//# sourceMappingURL=setup-config-YVIKUNOB.js.map
+//# sourceMappingURL=setup-config-ANAFKZGE.js.map

package/dist/{setup-custom-api-FLV4SELI.js → setup-custom-api-FUA2ZUDD.js}

@@ -2,14 +2,14 @@ import {
   CUSTOM_API_ALLOW_PRIVATE_ENV,
   CUSTOM_API_BASE_URL_ENV,
   validateCustomApiBaseUrl
-} from "./chunk-65LE457J.js";
+} from "./chunk-J76KHBF3.js";
 import {
   CUSTOM_API_DEFAULT_MODEL
-} from "./chunk-UNOOL6EN.js";
+} from "./chunk-XO25FS24.js";
 import {
   err,
   ok
-} from "./chunk-JTQLV374.js";
+} from "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 
@@ -106,4 +106,4 @@ function buildShellFragment(params) {
 export {
   configureCustomApi
 };
-//# sourceMappingURL=setup-custom-api-FLV4SELI.js.map
+//# sourceMappingURL=setup-custom-api-FUA2ZUDD.js.map

package/dist/{tool-memory-QNEAKRKV.js → tool-memory-ZP3EMUP5.js}

@@ -3,12 +3,12 @@ import {
   getToolMemory,
   reinitializeMemoryBackends,
   shutdownToolMemory
-} from "./chunk-IHKPGTF3.js";
+} from "./chunk-ZOBDTJNG.js";
 import "./chunk-6T3EPABN.js";
-import "./chunk-HZGHPBTV.js";
+import "./chunk-AH67WRET.js";
 import "./chunk-PQHVC4BD.js";
-import "./chunk-HIWO2WWP.js";
-import "./chunk-JTQLV374.js";
+import "./chunk-DLNCQO6L.js";
+import "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -17,4 +17,4 @@ export {
   reinitializeMemoryBackends,
   shutdownToolMemory
 };
-//# sourceMappingURL=tool-memory-QNEAKRKV.js.map
+//# sourceMappingURL=tool-memory-ZP3EMUP5.js.map

package/dist/{weather-report-SUVIXWKI.js → weather-report-54XDO6GO.js}

@@ -3,7 +3,7 @@ import {
   getAdaptiveBonus,
   queryWithLookback,
   shouldExplore
-} from "./chunk-JTQLV374.js";
+} from "./chunk-M774MKHE.js";
 import "./chunk-CH7QIDHQ.js";
 import "./chunk-PR4QN5HX.js";
 export {
@@ -12,4 +12,4 @@ export {
   queryWithLookback,
   shouldExplore
 };
-//# sourceMappingURL=weather-report-SUVIXWKI.js.map
+//# sourceMappingURL=weather-report-54XDO6GO.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "nexus-agents",
-  "version": "2.97.1",
+  "version": "2.99.0",
   "description": "Governance substrate for AI coding agents — adversarial PR review, drift-detected rules, immutable audit, and closed-loop outcome routing for Claude, Codex, Gemini, and OpenCode",
   "mcpName": "io.github.nexus-substrate/nexus-agents",
   "license": "MIT",