nexus-agents 9.4.0 → 10.0.0

package/dist/{chunk-AFAM6GK3.js → chunk-O46IOND3.js}

@@ -1,13 +1,13 @@
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-VQGHQVD2.js";
+} from "./chunk-QPU7QKPT.js";
 import {
   createLogger,
   getTimeProvider,
   isRateLimitText,
   resolveCliSlot
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 
 // src/pipeline/expert-access-mode.ts
 var logger = createLogger({ component: "expert-bridge" });
@@ -78,7 +78,7 @@ async function dispatchWithMcpConfig(router, content, expertType, start, options
   let config;
   if (requestedAccessModeOf(options) === "default") {
     try {
-      const { generateMcpConfig } = await import("./child-mcp-config-IR7LRMIK.js");
+      const { generateMcpConfig } = await import("./child-mcp-config-FRWGQIHP.js");
       config = await generateMcpConfig();
       activeMcpConfigs.add(config);
     } catch (error) {
@@ -167,8 +167,8 @@ async function getRouter() {
   }
   if (cachedRouter !== null) return cachedRouter;
   routerInitPromise ??= (async () => {
-    const { createAllAdapters } = await import("./factory-3Z46455N.js");
-    const { createCompositeRouter } = await import("./composite-router-WCTNVMSX.js");
+    const { createAllAdapters } = await import("./factory-UBAUIA2M.js");
+    const { createCompositeRouter } = await import("./composite-router-VXQFXNET.js");
     const adapters = createAllAdapters();
     const superseded = generation !== routerGeneration;
     if (adapters.size === 0) {
@@ -179,7 +179,7 @@ async function getRouter() {
     if (superseded) return router;
     cachedRouter = router;
     try {
-      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-AZHN2TMH.js");
+      const { createCliCircuitBreakerIntegration } = await import("./cli-circuit-breaker-AM425BRL.js");
       cachedCircuitBreaker = createCliCircuitBreakerIntegration([...adapters.values()]);
     } catch (error) {
       const msg = error instanceof Error ? error.message : String(error);
@@ -320,4 +320,4 @@ export {
   tokenSplitFromUsage,
   executeExpert
 };
-//# sourceMappingURL=chunk-AFAM6GK3.js.map
+//# sourceMappingURL=chunk-O46IOND3.js.map

package/dist/{chunk-DYTB2XW2.js → chunk-O5OUJ3PX.js}

@@ -1,7 +1,7 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-EPCR2GOE.js";
+} from "./chunk-XFTTKOHK.js";
 import {
   ReputationCache,
   assessReputation,
@@ -9,10 +9,10 @@ import {
   resolveEnvMode,
   resolveReputationGatingMode,
   sanitizeInput
-} from "./chunk-JNRDNE26.js";
+} from "./chunk-MYM2TPNL.js";
 import {
   hasToken
-} from "./chunk-RI4IXOZT.js";
+} from "./chunk-KPGWNBDA.js";
 import {
   toContentTrustProvenanceRecord
 } from "./chunk-ZO6ZKR7L.js";
@@ -27,7 +27,7 @@ import {
   getErrorMessage,
   getTimeProvider,
   ok
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 import {
   CLI_SUBPROCESS_TIMEOUTS
 } from "./chunk-4PN3UVZV.js";
@@ -2645,4 +2645,4 @@ export {
   IssueTriage,
   createIssueTriage
 };
-//# sourceMappingURL=chunk-DYTB2XW2.js.map
+//# sourceMappingURL=chunk-O5OUJ3PX.js.map

package/dist/{chunk-VQGHQVD2.js → chunk-QPU7QKPT.js}

@@ -7,7 +7,7 @@ import {
   logGatewaySlotMapping,
   resolveOwnerCli,
   setGatewaySlotCatalog
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 
 // src/config/model-availability.ts
 var DEFAULT_TTL_MS = 6e4;
@@ -139,7 +139,7 @@ function discoverGatewayOnce(logger = defaultLogger) {
 }
 async function runProbe(logger) {
   try {
-    const { buildOpenAICompatAdapters: build } = await import("./openai-compat-adapter-PQ3JKWPZ.js");
+    const { buildOpenAICompatAdapters: build } = await import("./openai-compat-adapter-GSDOJ7TQ.js");
     return await build(logger);
   } catch (error) {
     return err(new ConfigError(`Gateway discovery threw: ${getErrorMessage(error)}`));
@@ -269,4 +269,4 @@ export {
   setGatewayRediscovery,
   ensureGatewayDiscovered
 };
-//# sourceMappingURL=chunk-VQGHQVD2.js.map
+//# sourceMappingURL=chunk-QPU7QKPT.js.map

package/dist/{chunk-DEQRRCHK.js → chunk-RBFHY2LF.js}

@@ -1,7 +1,7 @@
 import {
   getRandomProvider,
   getTimeProvider
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 
 // src/utils/id-utils.ts
 import { randomUUID } from "node:crypto";
@@ -24,4 +24,4 @@ export {
   generateHyphenId,
   generateUUID
 };
-//# sourceMappingURL=chunk-DEQRRCHK.js.map
+//# sourceMappingURL=chunk-RBFHY2LF.js.map

package/dist/{chunk-H4ACPMJS.js → chunk-SCQ5YAYO.js}

@@ -1,14 +1,14 @@
 import {
   GitHubProvider,
   ScmError
-} from "./chunk-EPCR2GOE.js";
+} from "./chunk-XFTTKOHK.js";
 import {
   resolveToken
-} from "./chunk-RI4IXOZT.js";
+} from "./chunk-KPGWNBDA.js";
 import {
   err,
   ok
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 
 // src/scm/factory.ts
 async function createScmProvider(config) {
@@ -41,4 +41,4 @@ export {
   createScmProvider,
   createGitHubProvider
 };
-//# sourceMappingURL=chunk-H4ACPMJS.js.map
+//# sourceMappingURL=chunk-SCQ5YAYO.js.map

package/dist/{chunk-LWLFWWA7.js → chunk-TQZSPGAZ.js}

@@ -1,10 +1,10 @@
 import {
   getTimeProvider
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 
 // src/version.ts
 import semver from "semver";
-var VERSION = true ? "9.4.0" : "dev";
+var VERSION = true ? "10.0.0" : "dev";
 var NODE_ENGINE_RANGE = ">=24";
 function isNodeVersionSupported(version) {
   return semver.satisfies(version, NODE_ENGINE_RANGE);
@@ -106,4 +106,4 @@ export {
   contextForLogging,
   measuredTrustTier
 };
-//# sourceMappingURL=chunk-LWLFWWA7.js.map
+//# sourceMappingURL=chunk-TQZSPGAZ.js.map

package/dist/{chunk-LWLFWWA7.js.map → chunk-TQZSPGAZ.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/version.ts","../src/mcp/middleware/request-context.ts"],"sourcesContent":["/**\n * nexus-agents - Version constant\n *\n * Injected at build time via tsup define from package.json.\n * Do NOT edit VERSION manually — it is replaced during build.\n */\n\nimport semver from 'semver';\n\ndeclare const __NEXUS_VERSION__: string;\n\nexport const VERSION: string = typeof __NEXUS_VERSION__ !== 'undefined' ? __NEXUS_VERSION__ : 'dev';\n\n/** Supported Node.js versions. Pinned to package.json by a regression test. */\nexport const NODE_ENGINE_RANGE = '>=24';\n\n/** Returns whether a Node.js version satisfies the package engine requirement. */\nexport function isNodeVersionSupported(version: string): boolean {\n  return semver.satisfies(version, NODE_ENGINE_RANGE);\n}\n","/**\n * nexus-agents/mcp - Request Context Middleware\n *\n * Provides request ID generation and caller context tracking for MCP tools.\n * (Source: Issue #185 Phase 1 - Request context & PolicyFirewall integration)\n *\n * @module mcp/middleware/request-context\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { randomBytes } from 'node:crypto';\nimport { getTimeProvider } from '../../core/index.js';\nimport type { TrustTier } from '../../security/trust-types.js';\n\n/**\n * Authenticated user information.\n * (Source: Issue #739 - MCP authentication)\n */\nexport interface AuthenticatedUser {\n  /** Unique user/client identifier */\n  readonly id: string;\n  /** Human-readable name (optional) */\n  readonly name?: string;\n  /** Granted permissions/scopes (optional) */\n  readonly permissions?: readonly string[];\n}\n\n/**\n * Caller identification for audit trails.\n */\nexport interface CallerInfo {\n  /** Client identifier (e.g., 'claude-cli', 'gemini-cli') */\n  readonly clientId?: string;\n  /** User agent string if available */\n  readonly userAgent?: string;\n  /** Session ID for request correlation */\n  readonly sessionId?: string;\n  /** IP address or transport identifier */\n  readonly transport?: string;\n  /** Whether the request is authenticated (Issue #739) */\n  readonly authenticated?: boolean;\n  /** Authenticated user information (Issue #739) */\n  readonly authenticatedUser?: AuthenticatedUser;\n}\n\n/**\n * Request context for MCP tool invocations.\n * Immutable once created.\n */\nexport interface RequestContext {\n  /** Unique request identifier (format: req_<16 hex chars>) */\n  readonly requestId: string;\n  /** Timestamp when request was received (ISO 8601, ET) */\n  readonly timestamp: string;\n  /** Tool being invoked */\n  readonly toolName: string;\n  /** Caller information for audit */\n  readonly caller: CallerInfo;\n  /**\n   * Trust tier for this request (Issue #828).\n   * Derived from caller authentication state:\n   * - '1' = Authenticated + known client, or stdio (local-only)\n   * - '2' = Authenticated via network\n   * - '3' = Unauthenticated network request\n   * - '4' = Request with detected injection patterns (set by sanitizer)\n   */\n  readonly trustTier: TrustTier;\n  /** Trace ID for distributed tracing correlation */\n  readonly traceId?: string;\n  /** Parent span ID if part of a larger trace */\n  readonly parentSpanId?: string;\n}\n\n/**\n * Options for creating a request context.\n */\nexport interface CreateContextOptions {\n  /** Tool name being invoked */\n  toolName: string;\n  /** Optional caller information */\n  caller?: CallerInfo;\n  /** Optional explicit trust tier override (defaults to derived from caller) */\n  trustTier?: TrustTier;\n  /** Optional trace ID for correlation */\n  traceId?: string;\n  /** Optional parent span ID */\n  parentSpanId?: string;\n  /**\n   * Reuse this request id instead of minting a new one (#4981).\n   *\n   * Lets a nested layer join an outer layer's request identity while still\n   * deriving its OWN caller, trust tier and timestamp. Adopting the outer\n   * context object wholesale would discard those, which for a handler\n   * configured with `callerInfo` silently downgrades the trust tier and the\n   * audit actor.\n   */\n  inheritRequestId?: string;\n}\n\n/**\n * Generates a cryptographically secure request ID.\n * Format: req_<16 hex characters>\n *\n * @returns Unique request identifier\n */\nexport function generateRequestId(): string {\n  const bytes = randomBytes(8);\n  return `req_${bytes.toString('hex')}`;\n}\n\n/**\n * Generates a session ID for request correlation.\n * Format: sess_<12 hex characters>\n *\n * @returns Unique session identifier\n */\nexport function generateSessionId(): string {\n  const bytes = randomBytes(6);\n  return `sess_${bytes.toString('hex')}`;\n}\n\n/**\n * Formats timestamp in ISO 8601 format with ET timezone.\n * (Source: CLAUDE.md - Time Authority section)\n */\nfunction formatTimestamp(): string {\n  const now = new Date(getTimeProvider().now());\n  const formatter = new Intl.DateTimeFormat('en-US', {\n    timeZone: 'America/New_York',\n    timeZoneName: 'shortOffset',\n  });\n  const parts = formatter.formatToParts(now);\n  const offset = parts.find((p) => p.type === 'timeZoneName')?.value ?? '-05:00';\n  const base = now.toLocaleString('sv-SE', {\n    timeZone: 'America/New_York',\n    hour12: false,\n  });\n  return base.replace(' ', 'T') + offset.replace('GMT', '');\n}\n\n/**\n * Derives trust tier from caller authentication state (Issue #828).\n *\n * - Authenticated + known CLI client (claude, gemini, codex) → Tier 1\n * - stdio transport (local-only, no network) → Tier 1\n * - Authenticated via network → Tier 2\n * - Unauthenticated → Tier 3\n */\nexport function deriveTrustTier(caller: CallerInfo): TrustTier {\n  const knownClients = ['claude-cli', 'gemini-cli', 'codex-cli'];\n\n  if (caller.transport === 'stdio') return '1';\n\n  if (caller.authenticated === true) {\n    if (caller.clientId !== undefined && knownClients.includes(caller.clientId)) {\n      return '1';\n    }\n    return '2';\n  }\n\n  return '3';\n}\n\n/**\n * The MCP transports this server can identify (#6795). Only stdio ships in\n * this tree; a transport the server cannot identify is not recorded at all, so\n * its requests stay on the authentication branch of {@link deriveTrustTier}.\n */\nexport type McpServerTransport = 'stdio';\n\n/**\n * The transport the server connected, recorded by `connectTransport` (#6795).\n * Process-wide because an MCP server process connects one transport, and the\n * request context is built per call by middleware that never sees it.\n */\nlet serverTransport: McpServerTransport | undefined;\n\n/**\n * Record the transport the server is connected over, or `undefined` to clear\n * it (an unidentified transport, a failed connect, or test cleanup).\n */\nexport function recordServerTransport(transport: McpServerTransport | undefined): void {\n  serverTransport = transport;\n}\n\n/**\n * The caller information the server itself measured for every request: the\n * transport it arrived over (#6795). Empty when no transport was recorded, which\n * {@link measuredTrustTier} reports as unmeasured rather than as a tier.\n */\nexport function serverCallerInfo(): CallerInfo {\n  return serverTransport === undefined ? {} : { transport: serverTransport };\n}\n\n/**\n * Creates an immutable request context for an MCP tool invocation.\n *\n * @param options - Context creation options\n * @returns Immutable request context\n */\nexport function createRequestContext(options: CreateContextOptions): RequestContext {\n  const caller = options.caller ?? {};\n  const context: RequestContext = {\n    requestId: options.inheritRequestId ?? generateRequestId(),\n    timestamp: formatTimestamp(),\n    toolName: options.toolName,\n    caller,\n    trustTier: options.trustTier ?? deriveTrustTier(caller),\n    ...(options.traceId !== undefined && { traceId: options.traceId }),\n    ...(options.parentSpanId !== undefined && { parentSpanId: options.parentSpanId }),\n  };\n\n  // Freeze to ensure immutability\n  return Object.freeze(context);\n}\n\n/**\n * The request context for the call currently in flight (#4981).\n *\n * Exists because a tool call passes through two middleware implementations\n * that each used to mint their own `RequestContext`, producing two unlinked\n * `req_*` ids and two `Tool invocation started` pairs per call. Argument\n * threading cannot fix that: `createSecureHandler` returns a 1-arity function,\n * so the chain's arity dispatch drops `ctx`, and 1-arity intermediaries such\n * as the `withPrerequisite` wrappers sit between the layers on some tools.\n * An ambient channel survives both.\n *\n * This mirrors the AbortSignal and progress-context storages the chain already\n * uses, so it is the established idiom here rather than a new mechanism.\n */\nconst requestContextStorage = new AsyncLocalStorage<ContextHolder>();\n\n/**\n * The ambient context plus its liveness.\n *\n * AsyncLocalStorage keeps a store reachable from anything spawned inside the\n * scope, including work that OUTLIVES the call — a `setTimeout`, or the\n * detached body `runAsJob` fires from inside the secure handler. Without this\n * flag such work still reads the context of a request that already completed,\n * and a nested handler for the same tool would adopt a finished identity, then\n * log neither a start (suppressed) nor a completion (the chain already closed\n * its own pair).\n *\n * Identity is not liveness, so the adoption gate needs both.\n */\ninterface ContextHolder {\n  readonly context: RequestContext;\n  settled: boolean;\n}\n\n/**\n * Runs `fn` with `context` as the ambient request context, so any nested layer\n * can adopt it instead of minting a second one.\n */\nexport function runWithRequestContext<T>(\n  context: RequestContext,\n  fn: () => Promise<T>\n): Promise<T> {\n  const holder: ContextHolder = { context, settled: false };\n  return requestContextStorage.run(holder, () =>\n    fn().finally(() => {\n      holder.settled = true;\n    })\n  );\n}\n\n/**\n * The ambient request context, or `undefined` when nothing established one.\n *\n * `undefined` is a real answer, not a failure: a caller that composes a secure\n * handler without the middleware chain — every direct test of it does — has no\n * outer context to inherit, and must mint its own.\n */\nexport function getCurrentRequestContext(): RequestContext | undefined {\n  const holder = requestContextStorage.getStore();\n  if (holder === undefined || holder.settled) return undefined;\n  return holder.context;\n}\n\n/**\n * Formats request context for logging.\n * Extracts essential fields for log context.\n *\n * @param ctx - Request context\n * @returns Log-friendly context object\n */\nexport function contextForLogging(ctx: RequestContext): Record<string, unknown> {\n  return {\n    requestId: ctx.requestId,\n    toolName: ctx.toolName,\n    trustTier: ctx.trustTier,\n    ...(ctx.caller.clientId !== undefined && { clientId: ctx.caller.clientId }),\n    ...(ctx.traceId !== undefined && { traceId: ctx.traceId }),\n  };\n}\n\n/**\n * Type guard to check if a value is a valid RequestContext.\n */\nexport function isRequestContext(value: unknown): value is RequestContext {\n  if (typeof value !== 'object' || value === null) {\n    return false;\n  }\n  const obj = value as Record<string, unknown>;\n  return (\n    typeof obj['requestId'] === 'string' &&\n    obj['requestId'].startsWith('req_') &&\n    typeof obj['timestamp'] === 'string' &&\n    typeof obj['toolName'] === 'string' &&\n    typeof obj['caller'] === 'object' &&\n    typeof obj['trustTier'] === 'string' &&\n    ['1', '2', '3', '4'].includes(obj['trustTier'])\n  );\n}\n\n/**\n * The request's trust tier ONLY when it was actually derived from caller\n * information (#4733).\n *\n * `createRequestContext` falls back to `caller = {}`, and `deriveTrustTier({})`\n * returns `'3'` — so an absent caller is indistinguishable from a genuinely\n * untrusted one at the reading end. Since #6795 the middleware chain supplies\n * the transport the server connected ({@link serverCallerInfo}), so a stdio\n * server measures tier 1; a context built with no recorded transport and no\n * authentication fact is still that fallback.\n *\n * Returning `undefined` for the fallback lets a consumer record `unmeasured`\n * rather than a constant that reads as a measurement.\n *\n * NOTE this is caller AUTHENTICATION (transport / authenticated / clientId),\n * not content provenance. A trusted client can submit hostile content. Consumers\n * wanting provenance need a different signal — `classifyTrust` is the closest,\n * but it requires a GitHub actor and does not apply to a bare goal string.\n */\nexport function measuredTrustTier(context: RequestContext): string | undefined {\n  // `caller` is always set by `createRequestContext` (to `{}` at minimum), but\n  // a partially-constructed context can omit it — and an absent caller is the\n  // same condition as an empty one: nothing was measured.\n  const caller: unknown = context.caller;\n  if (typeof caller !== 'object' || caller === null) return undefined;\n\n  // Gate on the fields `deriveTrustTier` actually reads, not on \"the object has\n  // any key at all\" (#4738 review). A caller carrying only `sessionId` or\n  // `userAgent` feeds nothing into the derivation, so a non-empty check would\n  // call the '3' fallback a measurement — reintroducing the constant this\n  // function exists to prevent, in the function that prevents it.\n  // `clientId` is NOT sufficient either: `deriveTrustTier` reads `clientId`\n  // only INSIDE the `authenticated === true` branch, so\n  // `{ clientId: 'claude-cli' }` returns the same '3' fallback as `{}`. (The\n  // removed env-sniffing `extractCallerInfo` produced exactly that shape.)\n  const info = caller as Partial<CallerInfo>;\n  // `authenticated: false` counts: it is a measured fact (\"we checked, they\n  // are not authenticated\"), which is different from the field being absent.\n  const derivable = info.transport !== undefined || info.authenticated !== undefined;\n\n  return derivable ? context.trustTier : undefined;\n}\n"],"mappings":";;;;;AAOA,OAAO,YAAY;AAIZ,IAAM,UAAkB,OAA2C,UAAoB;AAGvF,IAAM,oBAAoB;AAG1B,SAAS,uBAAuB,SAA0B;AAC/D,SAAO,OAAO,UAAU,SAAS,iBAAiB;AACpD;;;ACVA,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AA+FrB,SAAS,oBAA4B;AAC1C,QAAM,QAAQ,YAAY,CAAC;AAC3B,SAAO,OAAO,MAAM,SAAS,KAAK,CAAC;AACrC;AAiBA,SAAS,kBAA0B;AACjC,QAAM,MAAM,IAAI,KAAK,gBAAgB,EAAE,IAAI,CAAC;AAC5C,QAAM,YAAY,IAAI,KAAK,eAAe,SAAS;AAAA,IACjD,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AACD,QAAM,QAAQ,UAAU,cAAc,GAAG;AACzC,QAAM,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc,GAAG,SAAS;AACtE,QAAM,OAAO,IAAI,eAAe,SAAS;AAAA,IACvC,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AACD,SAAO,KAAK,QAAQ,KAAK,GAAG,IAAI,OAAO,QAAQ,OAAO,EAAE;AAC1D;AAUO,SAAS,gBAAgB,QAA+B;AAC7D,QAAM,eAAe,CAAC,cAAc,cAAc,WAAW;AAE7D,MAAI,OAAO,cAAc,QAAS,QAAO;AAEzC,MAAI,OAAO,kBAAkB,MAAM;AACjC,QAAI,OAAO,aAAa,UAAa,aAAa,SAAS,OAAO,QAAQ,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAcA,IAAI;AAMG,SAAS,sBAAsB,WAAiD;AACrF,oBAAkB;AACpB;AAOO,SAAS,mBAA+B;AAC7C,SAAO,oBAAoB,SAAY,CAAC,IAAI,EAAE,WAAW,gBAAgB;AAC3E;AAQO,SAAS,qBAAqB,SAA+C;AAClF,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAM,UAA0B;AAAA,IAC9B,WAAW,QAAQ,oBAAoB,kBAAkB;AAAA,IACzD,WAAW,gBAAgB;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,WAAW,QAAQ,aAAa,gBAAgB,MAAM;AAAA,IACtD,GAAI,QAAQ,YAAY,UAAa,EAAE,SAAS,QAAQ,QAAQ;AAAA,IAChE,GAAI,QAAQ,iBAAiB,UAAa,EAAE,cAAc,QAAQ,aAAa;AAAA,EACjF;AAGA,SAAO,OAAO,OAAO,OAAO;AAC9B;AAgBA,IAAM,wBAAwB,IAAI,kBAAiC;AAwB5D,SAAS,sBACd,SACA,IACY;AACZ,QAAM,SAAwB,EAAE,SAAS,SAAS,MAAM;AACxD,SAAO,sBAAsB;AAAA,IAAI;AAAA,IAAQ,MACvC,GAAG,EAAE,QAAQ,MAAM;AACjB,aAAO,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AASO,SAAS,2BAAuD;AACrE,QAAM,SAAS,sBAAsB,SAAS;AAC9C,MAAI,WAAW,UAAa,OAAO,QAAS,QAAO;AACnD,SAAO,OAAO;AAChB;AASO,SAAS,kBAAkB,KAA8C;AAC9E,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,IAAI;AAAA,IACd,WAAW,IAAI;AAAA,IACf,GAAI,IAAI,OAAO,aAAa,UAAa,EAAE,UAAU,IAAI,OAAO,SAAS;AAAA,IACzE,GAAI,IAAI,YAAY,UAAa,EAAE,SAAS,IAAI,QAAQ;AAAA,EAC1D;AACF;AAwCO,SAAS,kBAAkB,SAA6C;AAI7E,QAAM,SAAkB,QAAQ;AAChC,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAW1D,QAAM,OAAO;AAGb,QAAM,YAAY,KAAK,cAAc,UAAa,KAAK,kBAAkB;AAEzE,SAAO,YAAY,QAAQ,YAAY;AACzC;","names":[]}
+{"version":3,"sources":["../src/version.ts","../src/mcp/middleware/request-context.ts"],"sourcesContent":["/**\n * nexus-agents - Version constant\n *\n * Injected at build time via tsup define from package.json.\n * Do NOT edit VERSION manually — it is replaced during build.\n */\n\nimport semver from 'semver';\n\ndeclare const __NEXUS_VERSION__: string;\n\nexport const VERSION: string = typeof __NEXUS_VERSION__ !== 'undefined' ? __NEXUS_VERSION__ : 'dev';\n\n/** Supported Node.js versions. Pinned to package.json by a regression test. */\nexport const NODE_ENGINE_RANGE = '>=24';\n\n/** Returns whether a Node.js version satisfies the package engine requirement. */\nexport function isNodeVersionSupported(version: string): boolean {\n  return semver.satisfies(version, NODE_ENGINE_RANGE);\n}\n","/**\n * nexus-agents/mcp - Request Context Middleware\n *\n * Provides request ID generation and caller context tracking for MCP tools.\n * (Source: Issue #185 Phase 1 - Request context & PolicyFirewall integration)\n *\n * @module mcp/middleware/request-context\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { randomBytes } from 'node:crypto';\nimport { getTimeProvider } from '../../core/index.js';\nimport type { TrustTier } from '../../security/trust-types.js';\n\n/**\n * Authenticated user information.\n * (Source: Issue #739 - MCP authentication)\n */\nexport interface AuthenticatedUser {\n  /** Unique user/client identifier */\n  readonly id: string;\n  /** Human-readable name (optional) */\n  readonly name?: string;\n  /** Granted permissions/scopes (optional) */\n  readonly permissions?: readonly string[];\n}\n\n/**\n * Caller identification for audit trails.\n */\nexport interface CallerInfo {\n  /** Client identifier (e.g., 'claude-cli', 'gemini-cli') */\n  readonly clientId?: string;\n  /** User agent string if available */\n  readonly userAgent?: string;\n  /** Session ID for request correlation */\n  readonly sessionId?: string;\n  /** IP address or transport identifier */\n  readonly transport?: string;\n  /** Whether the request is authenticated (Issue #739) */\n  readonly authenticated?: boolean;\n  /** Authenticated user information (Issue #739) */\n  readonly authenticatedUser?: AuthenticatedUser;\n}\n\n/**\n * Request context for MCP tool invocations.\n * Immutable once created.\n */\nexport interface RequestContext {\n  /** Unique request identifier (format: req_<16 hex chars>) */\n  readonly requestId: string;\n  /** Timestamp when request was received (ISO 8601, ET) */\n  readonly timestamp: string;\n  /** Tool being invoked */\n  readonly toolName: string;\n  /** Caller information for audit */\n  readonly caller: CallerInfo;\n  /**\n   * Trust tier for this request (Issue #828).\n   * Derived from caller authentication state:\n   * - '1' = Authenticated + known client, or stdio (local-only)\n   * - '2' = Authenticated via network\n   * - '3' = Unauthenticated network request\n   * - '4' = Request with detected injection patterns (set by sanitizer)\n   */\n  readonly trustTier: TrustTier;\n  /** Trace ID for distributed tracing correlation */\n  readonly traceId?: string;\n  /** Parent span ID if part of a larger trace */\n  readonly parentSpanId?: string;\n}\n\n/**\n * Options for creating a request context.\n */\nexport interface CreateContextOptions {\n  /** Tool name being invoked */\n  toolName: string;\n  /** Optional caller information */\n  caller?: CallerInfo;\n  /** Optional explicit trust tier override (defaults to derived from caller) */\n  trustTier?: TrustTier;\n  /** Optional trace ID for correlation */\n  traceId?: string;\n  /** Optional parent span ID */\n  parentSpanId?: string;\n  /**\n   * Reuse this request id instead of minting a new one (#4981).\n   *\n   * Lets a nested layer join an outer layer's request identity while still\n   * deriving its OWN caller, trust tier and timestamp. Adopting the outer\n   * context object wholesale would discard those, which for a handler\n   * configured with `callerInfo` silently downgrades the trust tier and the\n   * audit actor.\n   */\n  inheritRequestId?: string;\n}\n\n/**\n * Generates a cryptographically secure request ID.\n * Format: req_<16 hex characters>\n *\n * @returns Unique request identifier\n */\nexport function generateRequestId(): string {\n  const bytes = randomBytes(8);\n  return `req_${bytes.toString('hex')}`;\n}\n\n/**\n * Generates a session ID for request correlation.\n * Format: sess_<12 hex characters>\n *\n * @returns Unique session identifier\n */\nexport function generateSessionId(): string {\n  const bytes = randomBytes(6);\n  return `sess_${bytes.toString('hex')}`;\n}\n\n/**\n * Formats timestamp in ISO 8601 format with ET timezone.\n * (Source: CLAUDE.md - Time Authority section)\n */\nfunction formatTimestamp(): string {\n  const now = new Date(getTimeProvider().now());\n  const formatter = new Intl.DateTimeFormat('en-US', {\n    timeZone: 'America/New_York',\n    timeZoneName: 'shortOffset',\n  });\n  const parts = formatter.formatToParts(now);\n  const offset = parts.find((p) => p.type === 'timeZoneName')?.value ?? '-05:00';\n  const base = now.toLocaleString('sv-SE', {\n    timeZone: 'America/New_York',\n    hour12: false,\n  });\n  return base.replace(' ', 'T') + offset.replace('GMT', '');\n}\n\n/**\n * Derives trust tier from caller authentication state (Issue #828).\n *\n * - Authenticated + known CLI client (claude, gemini, codex) → Tier 1\n * - stdio transport (local-only, no network) → Tier 1\n * - Authenticated via network → Tier 2\n * - Unauthenticated → Tier 3\n */\nexport function deriveTrustTier(caller: CallerInfo): TrustTier {\n  const knownClients = ['claude-cli', 'gemini-cli', 'codex-cli'];\n\n  if (caller.transport === 'stdio') return '1';\n\n  if (caller.authenticated === true) {\n    if (caller.clientId !== undefined && knownClients.includes(caller.clientId)) {\n      return '1';\n    }\n    return '2';\n  }\n\n  return '3';\n}\n\n/**\n * The MCP transports this server can identify (#6795). Only stdio ships in\n * this tree; a transport the server cannot identify is not recorded at all, so\n * its requests stay on the authentication branch of {@link deriveTrustTier}.\n */\nexport type McpServerTransport = 'stdio';\n\n/**\n * The transport the server connected, recorded by `connectTransport` (#6795).\n * Process-wide because an MCP server process connects one transport, and the\n * request context is built per call by middleware that never sees it.\n */\nlet serverTransport: McpServerTransport | undefined;\n\n/**\n * Record the transport the server is connected over, or `undefined` to clear\n * it (an unidentified transport, a failed connect, or test cleanup).\n */\nexport function recordServerTransport(transport: McpServerTransport | undefined): void {\n  serverTransport = transport;\n}\n\n/**\n * The caller information the server itself measured for every request: the\n * transport it arrived over (#6795). Empty when no transport was recorded, which\n * {@link measuredTrustTier} reports as unmeasured rather than as a tier.\n */\nexport function serverCallerInfo(): CallerInfo {\n  return serverTransport === undefined ? {} : { transport: serverTransport };\n}\n\n/**\n * Creates an immutable request context for an MCP tool invocation.\n *\n * @param options - Context creation options\n * @returns Immutable request context\n */\nexport function createRequestContext(options: CreateContextOptions): RequestContext {\n  const caller = options.caller ?? {};\n  const context: RequestContext = {\n    requestId: options.inheritRequestId ?? generateRequestId(),\n    timestamp: formatTimestamp(),\n    toolName: options.toolName,\n    caller,\n    trustTier: options.trustTier ?? deriveTrustTier(caller),\n    ...(options.traceId !== undefined && { traceId: options.traceId }),\n    ...(options.parentSpanId !== undefined && { parentSpanId: options.parentSpanId }),\n  };\n\n  // Freeze to ensure immutability\n  return Object.freeze(context);\n}\n\n/**\n * The request context for the call currently in flight (#4981).\n *\n * Exists because a tool call passes through two middleware implementations\n * that each used to mint their own `RequestContext`, producing two unlinked\n * `req_*` ids and two `Tool invocation started` pairs per call. Argument\n * threading cannot fix that: `createSecureHandler` returns a 1-arity function,\n * so the chain's arity dispatch drops `ctx`, and 1-arity intermediaries such\n * as the `withPrerequisite` wrappers sit between the layers on some tools.\n * An ambient channel survives both.\n *\n * This mirrors the AbortSignal and progress-context storages the chain already\n * uses, so it is the established idiom here rather than a new mechanism.\n */\nconst requestContextStorage = new AsyncLocalStorage<ContextHolder>();\n\n/**\n * The ambient context plus its liveness.\n *\n * AsyncLocalStorage keeps a store reachable from anything spawned inside the\n * scope, including work that OUTLIVES the call — a `setTimeout`, or the\n * detached body `runAsJob` fires from inside the secure handler. Without this\n * flag such work still reads the context of a request that already completed,\n * and a nested handler for the same tool would adopt a finished identity, then\n * log neither a start (suppressed) nor a completion (the chain already closed\n * its own pair).\n *\n * Identity is not liveness, so the adoption gate needs both.\n */\ninterface ContextHolder {\n  readonly context: RequestContext;\n  settled: boolean;\n}\n\n/**\n * Runs `fn` with `context` as the ambient request context, so any nested layer\n * can adopt it instead of minting a second one.\n */\nexport function runWithRequestContext<T>(\n  context: RequestContext,\n  fn: () => Promise<T>\n): Promise<T> {\n  const holder: ContextHolder = { context, settled: false };\n  return requestContextStorage.run(holder, () =>\n    fn().finally(() => {\n      holder.settled = true;\n    })\n  );\n}\n\n/**\n * The ambient request context, or `undefined` when nothing established one.\n *\n * `undefined` is a real answer, not a failure: a caller that composes a secure\n * handler without the middleware chain — every direct test of it does — has no\n * outer context to inherit, and must mint its own.\n */\nexport function getCurrentRequestContext(): RequestContext | undefined {\n  const holder = requestContextStorage.getStore();\n  if (holder === undefined || holder.settled) return undefined;\n  return holder.context;\n}\n\n/**\n * Formats request context for logging.\n * Extracts essential fields for log context.\n *\n * @param ctx - Request context\n * @returns Log-friendly context object\n */\nexport function contextForLogging(ctx: RequestContext): Record<string, unknown> {\n  return {\n    requestId: ctx.requestId,\n    toolName: ctx.toolName,\n    trustTier: ctx.trustTier,\n    ...(ctx.caller.clientId !== undefined && { clientId: ctx.caller.clientId }),\n    ...(ctx.traceId !== undefined && { traceId: ctx.traceId }),\n  };\n}\n\n/**\n * Type guard to check if a value is a valid RequestContext.\n */\nexport function isRequestContext(value: unknown): value is RequestContext {\n  if (typeof value !== 'object' || value === null) {\n    return false;\n  }\n  const obj = value as Record<string, unknown>;\n  return (\n    typeof obj['requestId'] === 'string' &&\n    obj['requestId'].startsWith('req_') &&\n    typeof obj['timestamp'] === 'string' &&\n    typeof obj['toolName'] === 'string' &&\n    typeof obj['caller'] === 'object' &&\n    typeof obj['trustTier'] === 'string' &&\n    ['1', '2', '3', '4'].includes(obj['trustTier'])\n  );\n}\n\n/**\n * The request's trust tier ONLY when it was actually derived from caller\n * information (#4733).\n *\n * `createRequestContext` falls back to `caller = {}`, and `deriveTrustTier({})`\n * returns `'3'` — so an absent caller is indistinguishable from a genuinely\n * untrusted one at the reading end. Since #6795 the middleware chain supplies\n * the transport the server connected ({@link serverCallerInfo}), so a stdio\n * server measures tier 1; a context built with no recorded transport and no\n * authentication fact is still that fallback.\n *\n * Returning `undefined` for the fallback lets a consumer record `unmeasured`\n * rather than a constant that reads as a measurement.\n *\n * NOTE this is caller AUTHENTICATION (transport / authenticated / clientId),\n * not content provenance. A trusted client can submit hostile content. Consumers\n * wanting provenance need a different signal — `classifyTrust` is the closest,\n * but it requires a GitHub actor and does not apply to a bare goal string.\n */\nexport function measuredTrustTier(context: RequestContext): string | undefined {\n  // `caller` is always set by `createRequestContext` (to `{}` at minimum), but\n  // a partially-constructed context can omit it — and an absent caller is the\n  // same condition as an empty one: nothing was measured.\n  const caller: unknown = context.caller;\n  if (typeof caller !== 'object' || caller === null) return undefined;\n\n  // Gate on the fields `deriveTrustTier` actually reads, not on \"the object has\n  // any key at all\" (#4738 review). A caller carrying only `sessionId` or\n  // `userAgent` feeds nothing into the derivation, so a non-empty check would\n  // call the '3' fallback a measurement — reintroducing the constant this\n  // function exists to prevent, in the function that prevents it.\n  // `clientId` is NOT sufficient either: `deriveTrustTier` reads `clientId`\n  // only INSIDE the `authenticated === true` branch, so\n  // `{ clientId: 'claude-cli' }` returns the same '3' fallback as `{}`. (The\n  // removed env-sniffing `extractCallerInfo` produced exactly that shape.)\n  const info = caller as Partial<CallerInfo>;\n  // `authenticated: false` counts: it is a measured fact (\"we checked, they\n  // are not authenticated\"), which is different from the field being absent.\n  const derivable = info.transport !== undefined || info.authenticated !== undefined;\n\n  return derivable ? context.trustTier : undefined;\n}\n"],"mappings":";;;;;AAOA,OAAO,YAAY;AAIZ,IAAM,UAAkB,OAA2C,WAAoB;AAGvF,IAAM,oBAAoB;AAG1B,SAAS,uBAAuB,SAA0B;AAC/D,SAAO,OAAO,UAAU,SAAS,iBAAiB;AACpD;;;ACVA,SAAS,yBAAyB;AAClC,SAAS,mBAAmB;AA+FrB,SAAS,oBAA4B;AAC1C,QAAM,QAAQ,YAAY,CAAC;AAC3B,SAAO,OAAO,MAAM,SAAS,KAAK,CAAC;AACrC;AAiBA,SAAS,kBAA0B;AACjC,QAAM,MAAM,IAAI,KAAK,gBAAgB,EAAE,IAAI,CAAC;AAC5C,QAAM,YAAY,IAAI,KAAK,eAAe,SAAS;AAAA,IACjD,UAAU;AAAA,IACV,cAAc;AAAA,EAChB,CAAC;AACD,QAAM,QAAQ,UAAU,cAAc,GAAG;AACzC,QAAM,SAAS,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,cAAc,GAAG,SAAS;AACtE,QAAM,OAAO,IAAI,eAAe,SAAS;AAAA,IACvC,UAAU;AAAA,IACV,QAAQ;AAAA,EACV,CAAC;AACD,SAAO,KAAK,QAAQ,KAAK,GAAG,IAAI,OAAO,QAAQ,OAAO,EAAE;AAC1D;AAUO,SAAS,gBAAgB,QAA+B;AAC7D,QAAM,eAAe,CAAC,cAAc,cAAc,WAAW;AAE7D,MAAI,OAAO,cAAc,QAAS,QAAO;AAEzC,MAAI,OAAO,kBAAkB,MAAM;AACjC,QAAI,OAAO,aAAa,UAAa,aAAa,SAAS,OAAO,QAAQ,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAcA,IAAI;AAMG,SAAS,sBAAsB,WAAiD;AACrF,oBAAkB;AACpB;AAOO,SAAS,mBAA+B;AAC7C,SAAO,oBAAoB,SAAY,CAAC,IAAI,EAAE,WAAW,gBAAgB;AAC3E;AAQO,SAAS,qBAAqB,SAA+C;AAClF,QAAM,SAAS,QAAQ,UAAU,CAAC;AAClC,QAAM,UAA0B;AAAA,IAC9B,WAAW,QAAQ,oBAAoB,kBAAkB;AAAA,IACzD,WAAW,gBAAgB;AAAA,IAC3B,UAAU,QAAQ;AAAA,IAClB;AAAA,IACA,WAAW,QAAQ,aAAa,gBAAgB,MAAM;AAAA,IACtD,GAAI,QAAQ,YAAY,UAAa,EAAE,SAAS,QAAQ,QAAQ;AAAA,IAChE,GAAI,QAAQ,iBAAiB,UAAa,EAAE,cAAc,QAAQ,aAAa;AAAA,EACjF;AAGA,SAAO,OAAO,OAAO,OAAO;AAC9B;AAgBA,IAAM,wBAAwB,IAAI,kBAAiC;AAwB5D,SAAS,sBACd,SACA,IACY;AACZ,QAAM,SAAwB,EAAE,SAAS,SAAS,MAAM;AACxD,SAAO,sBAAsB;AAAA,IAAI;AAAA,IAAQ,MACvC,GAAG,EAAE,QAAQ,MAAM;AACjB,aAAO,UAAU;AAAA,IACnB,CAAC;AAAA,EACH;AACF;AASO,SAAS,2BAAuD;AACrE,QAAM,SAAS,sBAAsB,SAAS;AAC9C,MAAI,WAAW,UAAa,OAAO,QAAS,QAAO;AACnD,SAAO,OAAO;AAChB;AASO,SAAS,kBAAkB,KAA8C;AAC9E,SAAO;AAAA,IACL,WAAW,IAAI;AAAA,IACf,UAAU,IAAI;AAAA,IACd,WAAW,IAAI;AAAA,IACf,GAAI,IAAI,OAAO,aAAa,UAAa,EAAE,UAAU,IAAI,OAAO,SAAS;AAAA,IACzE,GAAI,IAAI,YAAY,UAAa,EAAE,SAAS,IAAI,QAAQ;AAAA,EAC1D;AACF;AAwCO,SAAS,kBAAkB,SAA6C;AAI7E,QAAM,SAAkB,QAAQ;AAChC,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAW1D,QAAM,OAAO;AAGb,QAAM,YAAY,KAAK,cAAc,UAAa,KAAK,kBAAkB;AAEzE,SAAO,YAAY,QAAQ,YAAY;AACzC;","names":[]}

package/dist/{chunk-ECJ52NSK.js → chunk-TYLE7Z2S.js}

@@ -87,8 +87,10 @@ var SecurityConfigSchema = z.object({
   auth: z.object({
     /** Enable authentication for network-exposed transports (default: true) */
     enabled: z.boolean().default(true),
-    /** Authentication method (default: 'token') */
-    method: z.enum(["token", "oauth2"]).default("token"),
+    /** Authentication method (only 'token' is supported) */
+    method: z.enum(["token"], {
+      error: (issue) => issue.input === "oauth2" ? "security.auth.method 'oauth2' was never implemented and is no longer accepted. Set security.auth.method to 'token' for bearer-token authentication (#5681)." : void 0
+    }).default("token"),
     /** Header name for bearer token (default: 'Authorization') */
     tokenHeader: z.string().default("Authorization"),
     /** Token file path (default: ~/.nexus-agents/auth/server-token) */
@@ -101,4 +103,4 @@ export {
   DEFAULT_TOOL_RATE_LIMITS,
   SecurityConfigSchema
 };
-//# sourceMappingURL=chunk-ECJ52NSK.js.map
+//# sourceMappingURL=chunk-TYLE7Z2S.js.map

package/dist/{chunk-ECJ52NSK.js.map → chunk-TYLE7Z2S.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/schemas-security.ts"],"sourcesContent":["/**\n * nexus-agents/config - Security Configuration Schemas\n *\n * Schemas for security, policy, sandbox, timeout, and rate limiting.\n */\n\nimport { z } from 'zod';\n\n/**\n * The ONE default for `security.policy.defaultMode` (#6431). `DEFAULTS`,\n * `getPolicyValues`, the middleware `PolicyConfigSchema` and the policy\n * registry all read this constant; a second literal is how the config default\n * and the `?? 'read-only'` fallbacks drifted apart.\n *\n * `'read-write'` because the `deny-mutations-without-mode` rule fires on every\n * manifest-classified mutation tool under `'read-only'`, and nothing on the\n * MCP path sets the mode per call — so a `'read-only'` default would deny all\n * 20 mutation tools (the manifest's `readOnlyHint: false` entries) for every\n * operator the day enforcement defaults on (panel option A, 6-0).\n * `'read-only'` remains an operator opt-in lock, and `run { execute: true }`\n * is checked under it as the tool its selected strategy runs.\n */\nexport const DEFAULT_EXECUTION_MODE = 'read-write' as const;\n\n/**\n * Policy configuration schema.\n *\n * Controls authorization behavior for tool operations.\n * - defaultMode: the execution mode every MCP tool call is evaluated under.\n *   `'read-write'` (default) allows manifest-classified mutation tools;\n *   `'read-only'` is an operator lock that forbids every one of them — and\n *   `run { execute: true }` as its selected strategy's tool — once the\n *   firewall enforces (`NEXUS_MCP_POLICY_ENFORCE`), and is logged as a\n *   would-be denial in warn mode.\n * - policyMode: Whether to enforce denials or just warn (for migration). Not\n *   read for the effective firewall mode today — see\n *   `stagePolicyFirewallForRollout` (#4888, #4988).\n *\n * (Source: OWASP ASVS 4.0, Authorization Controls)\n */\nexport const PolicyConfigSchema = z.object({\n  /** Execution mode for tool operations (default: 'read-write'; 'read-only' is the opt-in lock, #6431) */\n  defaultMode: z.enum(['read-only', 'read-write']).default(DEFAULT_EXECUTION_MODE),\n  /** Policy enforcement mode (default: 'enforce') */\n  policyMode: z.enum(['enforce', 'warn']).default('enforce'),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicyConfigSchema>;\n\n/**\n * Sandbox configuration schema.\n *\n * Controls agent execution isolation.\n * - mode: 'none' (no isolation), 'policy' (allowlist enforcement), 'container' (Docker)\n * - fallbackToPolicy: Whether to fall back to policy mode if container unavailable\n *\n * (Source: Issue #175, ALIGNMENT_ROADMAP Phase 4)\n */\nexport const SandboxConfigSchema = z.object({\n  /** Sandbox execution mode (default: 'policy') */\n  mode: z.enum(['none', 'policy', 'container']).default('policy'),\n  /** Fall back to policy mode if container mode unavailable (default: true) */\n  fallbackToPolicy: z.boolean().default(true),\n  /** Docker image to use in container mode (default: 'node:22-alpine') */\n  dockerImage: z.string().optional(),\n  /** Enable network access in container mode (default: false) */\n  networkEnabled: z.boolean().default(false),\n});\n\nexport type SandboxConfig = z.infer<typeof SandboxConfigSchema>;\n\n/**\n * Timeout configuration schema.\n *\n * Controls timeout behavior for MCP operations to mitigate CVE-2026-0621.\n * - defaultTimeoutMs: Default timeout for operations\n * - maxTimeoutMs: Maximum allowed timeout\n * - enableLogging: Whether to log timeout events\n * - uriValidation: Whether to validate URIs against ReDoS patterns\n *\n * (Source: Issue #271, CVE-2026-0621 mitigation)\n */\nexport const TimeoutConfigSchema = z.object({\n  /** Default timeout in milliseconds (default: 30000) */\n  defaultTimeoutMs: z.number().positive().default(30000),\n  /** Maximum timeout in milliseconds (default: 300000) */\n  maxTimeoutMs: z.number().positive().default(300000),\n  /** Whether to log timeout events (default: true) */\n  enableLogging: z.boolean().default(true),\n  /** Enable URI validation to prevent ReDoS (default: true) */\n  uriValidation: z.boolean().default(true),\n  /** Per-tool timeout overrides in milliseconds (Issue #657) */\n  perToolTimeout: z.record(z.string(), z.number().positive().max(600000)).optional(),\n});\n\nexport type TimeoutConfig = z.infer<typeof TimeoutConfigSchema>;\n\n/**\n * Per-tool rate limit configuration.\n * Allows different limits for each tool category.\n *\n * (Source: Issue #274 Phase 2 - per-tool rate limits)\n */\nexport const ToolRateLimitSchema = z.object({\n  /** Maximum tokens (burst capacity) */\n  capacity: z.number().positive().default(10),\n  /** Tokens refilled per interval */\n  refillRate: z.number().positive().default(10),\n  /** Refill interval in milliseconds (default: 60000 = 1 minute) */\n  refillIntervalMs: z.number().positive().default(60000),\n});\n\nexport type ToolRateLimit = z.infer<typeof ToolRateLimitSchema>;\n\n/**\n * Default per-tool rate limits per Issue #274.\n */\nexport const DEFAULT_TOOL_RATE_LIMITS = {\n  orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 60000 },\n  delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 60000 },\n  workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 60000 },\n  expert: { capacity: 30, refillRate: 30, refillIntervalMs: 60000 },\n} as const satisfies Record<string, ToolRateLimit>;\n\n/**\n * Tool categories for rate limiting.\n */\nexport type ToolCategory = keyof typeof DEFAULT_TOOL_RATE_LIMITS;\n\n/**\n * Security configuration schema.\n */\nexport const SecurityConfigSchema = z.object({\n  allowedPaths: z.array(z.string()).default(['./']),\n  blockedPatterns: z.array(z.string()).default([]),\n  rateLimit: z\n    .object({\n      enabled: z.boolean().default(true),\n      requestsPerMinute: z.number().positive().default(60),\n      /** Per-tool rate limits (Issue #274 Phase 2) */\n      perTool: z.record(z.string(), ToolRateLimitSchema).optional(),\n    })\n    .default(() => ({ enabled: true, requestsPerMinute: 60 })),\n  secretsFile: z.string().optional(),\n  /** Policy firewall configuration */\n  policy: PolicyConfigSchema.optional(),\n  /** Sandbox execution configuration (Issue #175) */\n  sandbox: SandboxConfigSchema.optional(),\n  /** Timeout configuration (Issue #271, CVE-2026-0621) */\n  timeout: TimeoutConfigSchema.optional(),\n  /** Tool allowlist — when set, only listed tools are registered (Issue #740) */\n  toolAllowlist: z.array(z.string()).optional(),\n  /**\n   * Audit logging configuration (Issue #740 Phase 2).\n   *\n   * The block is optional and the inner defaults only apply when it is present:\n   * a config with no `audit:` block is audit-OFF (`initializeAuditLogger`\n   * returns null and startup warns). `config init` writes the block explicitly\n   * so a generated config is on by default (#5632).\n   */\n  audit: z\n    .object({\n      /** Enable audit logging (default when the block is present: true) */\n      enabled: z.boolean().default(true),\n      /** Log directory (default: ~/.nexus-agents/audit) */\n      logDir: z.string().optional(),\n      /** Minimum severity to log (default: 'info') */\n      minSeverity: z.enum(['info', 'warning', 'critical']).default('info'),\n      /** Enable tamper-evident hash chain (default: true) */\n      enableHashChain: z.boolean().default(true),\n      /** Maximum log file size in bytes (default: 10MB) */\n      maxFileSizeBytes: z\n        .number()\n        .positive()\n        .default(10 * 1024 * 1024),\n      /** Maximum number of log files to retain (default: 10) */\n      maxFiles: z.number().positive().default(10),\n    })\n    .optional(),\n  /** Authentication configuration (Issue #739) */\n  auth: z\n    .object({\n      /** Enable authentication for network-exposed transports (default: true) */\n      enabled: z.boolean().default(true),\n      /** Authentication method (default: 'token') */\n      method: z.enum(['token', 'oauth2']).default('token'),\n      /** Header name for bearer token (default: 'Authorization') */\n      tokenHeader: z.string().default('Authorization'),\n      /** Token file path (default: ~/.nexus-agents/auth/server-token) */\n      tokenFile: z.string().optional(),\n    })\n    .optional(),\n});\n\nexport type SecurityConfig = z.infer<typeof SecurityConfigSchema>;\n\n/**\n * Authentication configuration type.\n * (Source: Issue #739 - enable MCP authentication by default)\n */\nexport type AuthConfig = NonNullable<SecurityConfig['auth']>;\n"],"mappings":";AAMA,SAAS,SAAS;AAgBX,IAAM,yBAAyB;AAkB/B,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA,EAEzC,aAAa,EAAE,KAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAQ,sBAAsB;AAAA;AAAA,EAE/E,YAAY,EAAE,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,QAAQ,SAAS;AAC3D,CAAC;AAaM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,MAAM,EAAE,KAAK,CAAC,QAAQ,UAAU,WAAW,CAAC,EAAE,QAAQ,QAAQ;AAAA;AAAA,EAE9D,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC3C,CAAC;AAeM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAErD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA,EAElD,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAM,CAAC,EAAE,SAAS;AACnF,CAAC;AAUM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,EAE1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,EAE5C,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAK;AACvD,CAAC;AAOM,IAAM,2BAA2B;AAAA,EACtC,aAAa,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAAA,EACrE,UAAU,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAAA,EAClE,UAAU,EAAE,UAAU,GAAG,YAAY,GAAG,kBAAkB,IAAM;AAAA,EAChE,QAAQ,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAClE;AAUO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;AAAA,EAChD,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/C,WAAW,EACR,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,IAEnD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,EAC9D,CAAC,EACA,QAAQ,OAAO,EAAE,SAAS,MAAM,mBAAmB,GAAG,EAAE;AAAA,EAC3D,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,mBAAmB,SAAS;AAAA;AAAA,EAEpC,SAAS,oBAAoB,SAAS;AAAA;AAAA,EAEtC,SAAS,oBAAoB,SAAS;AAAA;AAAA,EAEtC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS5C,OAAO,EACJ,OAAO;AAAA;AAAA,IAEN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAE5B,aAAa,EAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA,IAEnE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEzC,kBAAkB,EACf,OAAO,EACP,SAAS,EACT,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,IAE3B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC5C,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA;AAAA,IAEN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEjC,QAAQ,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC,EAAE,QAAQ,OAAO;AAAA;AAAA,IAEnD,aAAa,EAAE,OAAO,EAAE,QAAQ,eAAe;AAAA;AAAA,IAE/C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,SAAS;AACd,CAAC;","names":[]}
+{"version":3,"sources":["../src/config/schemas-security.ts"],"sourcesContent":["/**\n * nexus-agents/config - Security Configuration Schemas\n *\n * Schemas for security, policy, sandbox, timeout, and rate limiting.\n */\n\nimport { z } from 'zod';\n\n/**\n * The ONE default for `security.policy.defaultMode` (#6431). `DEFAULTS`,\n * `getPolicyValues`, the middleware `PolicyConfigSchema` and the policy\n * registry all read this constant; a second literal is how the config default\n * and the `?? 'read-only'` fallbacks drifted apart.\n *\n * `'read-write'` because the `deny-mutations-without-mode` rule fires on every\n * manifest-classified mutation tool under `'read-only'`, and nothing on the\n * MCP path sets the mode per call — so a `'read-only'` default would deny all\n * 20 mutation tools (the manifest's `readOnlyHint: false` entries) for every\n * operator the day enforcement defaults on (panel option A, 6-0).\n * `'read-only'` remains an operator opt-in lock, and `run { execute: true }`\n * is checked under it as the tool its selected strategy runs.\n */\nexport const DEFAULT_EXECUTION_MODE = 'read-write' as const;\n\n/**\n * Policy configuration schema.\n *\n * Controls authorization behavior for tool operations.\n * - defaultMode: the execution mode every MCP tool call is evaluated under.\n *   `'read-write'` (default) allows manifest-classified mutation tools;\n *   `'read-only'` is an operator lock that forbids every one of them — and\n *   `run { execute: true }` as its selected strategy's tool — once the\n *   firewall enforces (`NEXUS_MCP_POLICY_ENFORCE`), and is logged as a\n *   would-be denial in warn mode.\n * - policyMode: Whether to enforce denials or just warn (for migration). Not\n *   read for the effective firewall mode today — see\n *   `stagePolicyFirewallForRollout` (#4888, #4988).\n *\n * (Source: OWASP ASVS 4.0, Authorization Controls)\n */\nexport const PolicyConfigSchema = z.object({\n  /** Execution mode for tool operations (default: 'read-write'; 'read-only' is the opt-in lock, #6431) */\n  defaultMode: z.enum(['read-only', 'read-write']).default(DEFAULT_EXECUTION_MODE),\n  /** Policy enforcement mode (default: 'enforce') */\n  policyMode: z.enum(['enforce', 'warn']).default('enforce'),\n});\n\nexport type PolicyConfig = z.infer<typeof PolicyConfigSchema>;\n\n/**\n * Sandbox configuration schema.\n *\n * Controls agent execution isolation.\n * - mode: 'none' (no isolation), 'policy' (allowlist enforcement), 'container' (Docker)\n * - fallbackToPolicy: Whether to fall back to policy mode if container unavailable\n *\n * (Source: Issue #175, ALIGNMENT_ROADMAP Phase 4)\n */\nexport const SandboxConfigSchema = z.object({\n  /** Sandbox execution mode (default: 'policy') */\n  mode: z.enum(['none', 'policy', 'container']).default('policy'),\n  /** Fall back to policy mode if container mode unavailable (default: true) */\n  fallbackToPolicy: z.boolean().default(true),\n  /** Docker image to use in container mode (default: 'node:22-alpine') */\n  dockerImage: z.string().optional(),\n  /** Enable network access in container mode (default: false) */\n  networkEnabled: z.boolean().default(false),\n});\n\nexport type SandboxConfig = z.infer<typeof SandboxConfigSchema>;\n\n/**\n * Timeout configuration schema.\n *\n * Controls timeout behavior for MCP operations to mitigate CVE-2026-0621.\n * - defaultTimeoutMs: Default timeout for operations\n * - maxTimeoutMs: Maximum allowed timeout\n * - enableLogging: Whether to log timeout events\n * - uriValidation: Whether to validate URIs against ReDoS patterns\n *\n * (Source: Issue #271, CVE-2026-0621 mitigation)\n */\nexport const TimeoutConfigSchema = z.object({\n  /** Default timeout in milliseconds (default: 30000) */\n  defaultTimeoutMs: z.number().positive().default(30000),\n  /** Maximum timeout in milliseconds (default: 300000) */\n  maxTimeoutMs: z.number().positive().default(300000),\n  /** Whether to log timeout events (default: true) */\n  enableLogging: z.boolean().default(true),\n  /** Enable URI validation to prevent ReDoS (default: true) */\n  uriValidation: z.boolean().default(true),\n  /** Per-tool timeout overrides in milliseconds (Issue #657) */\n  perToolTimeout: z.record(z.string(), z.number().positive().max(600000)).optional(),\n});\n\nexport type TimeoutConfig = z.infer<typeof TimeoutConfigSchema>;\n\n/**\n * Per-tool rate limit configuration.\n * Allows different limits for each tool category.\n *\n * (Source: Issue #274 Phase 2 - per-tool rate limits)\n */\nexport const ToolRateLimitSchema = z.object({\n  /** Maximum tokens (burst capacity) */\n  capacity: z.number().positive().default(10),\n  /** Tokens refilled per interval */\n  refillRate: z.number().positive().default(10),\n  /** Refill interval in milliseconds (default: 60000 = 1 minute) */\n  refillIntervalMs: z.number().positive().default(60000),\n});\n\nexport type ToolRateLimit = z.infer<typeof ToolRateLimitSchema>;\n\n/**\n * Default per-tool rate limits per Issue #274.\n */\nexport const DEFAULT_TOOL_RATE_LIMITS = {\n  orchestrate: { capacity: 10, refillRate: 10, refillIntervalMs: 60000 },\n  delegate: { capacity: 20, refillRate: 20, refillIntervalMs: 60000 },\n  workflow: { capacity: 5, refillRate: 5, refillIntervalMs: 60000 },\n  expert: { capacity: 30, refillRate: 30, refillIntervalMs: 60000 },\n} as const satisfies Record<string, ToolRateLimit>;\n\n/**\n * Tool categories for rate limiting.\n */\nexport type ToolCategory = keyof typeof DEFAULT_TOOL_RATE_LIMITS;\n\n/**\n * Security configuration schema.\n */\nexport const SecurityConfigSchema = z.object({\n  allowedPaths: z.array(z.string()).default(['./']),\n  blockedPatterns: z.array(z.string()).default([]),\n  rateLimit: z\n    .object({\n      enabled: z.boolean().default(true),\n      requestsPerMinute: z.number().positive().default(60),\n      /** Per-tool rate limits (Issue #274 Phase 2) */\n      perTool: z.record(z.string(), ToolRateLimitSchema).optional(),\n    })\n    .default(() => ({ enabled: true, requestsPerMinute: 60 })),\n  secretsFile: z.string().optional(),\n  /** Policy firewall configuration */\n  policy: PolicyConfigSchema.optional(),\n  /** Sandbox execution configuration (Issue #175) */\n  sandbox: SandboxConfigSchema.optional(),\n  /** Timeout configuration (Issue #271, CVE-2026-0621) */\n  timeout: TimeoutConfigSchema.optional(),\n  /** Tool allowlist — when set, only listed tools are registered (Issue #740) */\n  toolAllowlist: z.array(z.string()).optional(),\n  /**\n   * Audit logging configuration (Issue #740 Phase 2).\n   *\n   * The block is optional and the inner defaults only apply when it is present:\n   * a config with no `audit:` block is audit-OFF (`initializeAuditLogger`\n   * returns null and startup warns). `config init` writes the block explicitly\n   * so a generated config is on by default (#5632).\n   */\n  audit: z\n    .object({\n      /** Enable audit logging (default when the block is present: true) */\n      enabled: z.boolean().default(true),\n      /** Log directory (default: ~/.nexus-agents/audit) */\n      logDir: z.string().optional(),\n      /** Minimum severity to log (default: 'info') */\n      minSeverity: z.enum(['info', 'warning', 'critical']).default('info'),\n      /** Enable tamper-evident hash chain (default: true) */\n      enableHashChain: z.boolean().default(true),\n      /** Maximum log file size in bytes (default: 10MB) */\n      maxFileSizeBytes: z\n        .number()\n        .positive()\n        .default(10 * 1024 * 1024),\n      /** Maximum number of log files to retain (default: 10) */\n      maxFiles: z.number().positive().default(10),\n    })\n    .optional(),\n  /** Authentication configuration (Issue #739) */\n  auth: z\n    .object({\n      /** Enable authentication for network-exposed transports (default: true) */\n      enabled: z.boolean().default(true),\n      /** Authentication method (only 'token' is supported) */\n      method: z\n        .enum(['token'], {\n          error: (issue) =>\n            issue.input === 'oauth2'\n              ? \"security.auth.method 'oauth2' was never implemented and is no longer accepted. \" +\n                \"Set security.auth.method to 'token' for bearer-token authentication (#5681).\"\n              : undefined,\n        })\n        .default('token'),\n      /** Header name for bearer token (default: 'Authorization') */\n      tokenHeader: z.string().default('Authorization'),\n      /** Token file path (default: ~/.nexus-agents/auth/server-token) */\n      tokenFile: z.string().optional(),\n    })\n    .optional(),\n});\n\nexport type SecurityConfig = z.infer<typeof SecurityConfigSchema>;\n\n/**\n * Authentication configuration type.\n * (Source: Issue #739 - enable MCP authentication by default)\n */\nexport type AuthConfig = NonNullable<SecurityConfig['auth']>;\n"],"mappings":";AAMA,SAAS,SAAS;AAgBX,IAAM,yBAAyB;AAkB/B,IAAM,qBAAqB,EAAE,OAAO;AAAA;AAAA,EAEzC,aAAa,EAAE,KAAK,CAAC,aAAa,YAAY,CAAC,EAAE,QAAQ,sBAAsB;AAAA;AAAA,EAE/E,YAAY,EAAE,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,QAAQ,SAAS;AAC3D,CAAC;AAaM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,MAAM,EAAE,KAAK,CAAC,QAAQ,UAAU,WAAW,CAAC,EAAE,QAAQ,QAAQ;AAAA;AAAA,EAE9D,kBAAkB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAE1C,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,gBAAgB,EAAE,QAAQ,EAAE,QAAQ,KAAK;AAC3C,CAAC;AAeM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAK;AAAA;AAAA,EAErD,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAM;AAAA;AAAA,EAElD,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,eAAe,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,EAEvC,gBAAgB,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,GAAM,CAAC,EAAE,SAAS;AACnF,CAAC;AAUM,IAAM,sBAAsB,EAAE,OAAO;AAAA;AAAA,EAE1C,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,EAE1C,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,EAE5C,kBAAkB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,GAAK;AACvD,CAAC;AAOM,IAAM,2BAA2B;AAAA,EACtC,aAAa,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAAA,EACrE,UAAU,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAAA,EAClE,UAAU,EAAE,UAAU,GAAG,YAAY,GAAG,kBAAkB,IAAM;AAAA,EAChE,QAAQ,EAAE,UAAU,IAAI,YAAY,IAAI,kBAAkB,IAAM;AAClE;AAUO,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,cAAc,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC;AAAA,EAChD,iBAAiB,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,CAAC;AAAA,EAC/C,WAAW,EACR,OAAO;AAAA,IACN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA,IACjC,mBAAmB,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA;AAAA,IAEnD,SAAS,EAAE,OAAO,EAAE,OAAO,GAAG,mBAAmB,EAAE,SAAS;AAAA,EAC9D,CAAC,EACA,QAAQ,OAAO,EAAE,SAAS,MAAM,mBAAmB,GAAG,EAAE;AAAA,EAC3D,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,EAEjC,QAAQ,mBAAmB,SAAS;AAAA;AAAA,EAEpC,SAAS,oBAAoB,SAAS;AAAA;AAAA,EAEtC,SAAS,oBAAoB,SAAS;AAAA;AAAA,EAEtC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAS5C,OAAO,EACJ,OAAO;AAAA;AAAA,IAEN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEjC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA;AAAA,IAE5B,aAAa,EAAE,KAAK,CAAC,QAAQ,WAAW,UAAU,CAAC,EAAE,QAAQ,MAAM;AAAA;AAAA,IAEnE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEzC,kBAAkB,EACf,OAAO,EACP,SAAS,EACT,QAAQ,KAAK,OAAO,IAAI;AAAA;AAAA,IAE3B,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE;AAAA,EAC5C,CAAC,EACA,SAAS;AAAA;AAAA,EAEZ,MAAM,EACH,OAAO;AAAA;AAAA,IAEN,SAAS,EAAE,QAAQ,EAAE,QAAQ,IAAI;AAAA;AAAA,IAEjC,QAAQ,EACL,KAAK,CAAC,OAAO,GAAG;AAAA,MACf,OAAO,CAAC,UACN,MAAM,UAAU,WACZ,gKAEA;AAAA,IACR,CAAC,EACA,QAAQ,OAAO;AAAA;AAAA,IAElB,aAAa,EAAE,OAAO,EAAE,QAAQ,eAAe;AAAA;AAAA,IAE/C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC,EACA,SAAS;AACd,CAAC;","names":[]}

package/dist/{chunk-TFQMVUWQ.js → chunk-V5FGXVSX.js}

@@ -1,13 +1,13 @@
 import {
   createAutoAdapter
-} from "./chunk-ONYCBTOH.js";
+} from "./chunk-O3VPGING.js";
 import {
   ensureGatewayDiscovered,
   gatewayDiscoveryGeneration
-} from "./chunk-VQGHQVD2.js";
+} from "./chunk-QPU7QKPT.js";
 import {
   getDefaultCliCircuitBreakerRegistry
-} from "./chunk-AYBOQE2Y.js";
+} from "./chunk-VHOOJ4FG.js";
 import {
   CircularBuffer,
   ConfigError,
@@ -32,7 +32,7 @@ import {
   recordRateLimitEvent,
   toRateLimitError,
   warnIfGatewayCostUndeclared
-} from "./chunk-7XJZTSHW.js";
+} from "./chunk-WI73OZAU.js";
 import {
   TASK_SPECIALIZATION_MATRIX,
   detectTaskCategory
@@ -946,8 +946,6 @@ var UnifiedAdapterRegistry = class {
   getSnapshot() {
     return {
       taskRouting: TASK_SPECIALIZATION_MATRIX.map((spec) => this.resolveRouting(spec)),
-      /** @deprecated Use {@link RegistrySnapshot.cachedArms}; removed in 10.0, #6291. */
-      cachedAdapters: [...this.cliAdapters.keys()].filter(isCliName),
       cachedArms: [...this.cliAdapters.keys()],
       availableModels: getInTreeCapabilitiesMatrix().models.length
     };
@@ -1056,4 +1054,4 @@ export {
   getGlobalRegistry,
   resetGlobalRegistry
 };
-//# sourceMappingURL=chunk-TFQMVUWQ.js.map
+//# sourceMappingURL=chunk-V5FGXVSX.js.map