nx_nexus_fetch.nx

nx_nexus_fetch.nx -- THE NEXUS MODS API DOOR (/compare/modding MD28, 2026-09-05): the modder's OWN API key, from the sovereign vault, over our own TLS, against api.nexusmods.com -- never a scraper through the mod page's Cloudflare challenge (measured 2026-09-05: nexusmods.com/skyrimspecialedition/mods/54994 answers the sovereign fetcher 403 Cf-Mitigated challenge, 8,279 B), never a bundled third-party client. THE FETCH LADDER IS THE SPINE'S OWN: nx_https_fetch_follow_hdr_best -- minimal TLS-1.3 hello, then the Chrome-JA3 hello, then TLS-1.2 -- with the api header injected into every 1.3 request. MEASURED 2026-09-06: the single-hello path (nx_https_fetch_hdr) completed the handshake with api.nexusmods.com and received ZERO application bytes (nrecs=1), which is what a fingerprint-gated CDN does to a bare client; the ladder exists for exactly that host class. THE KEY NEVER TOUCHES ARGV, STDOUT, A JOURNAL OR A LOG: it is opened by the estate's secret CLI (nx_secret get nexus_api -> /tmp/nxsecret.out, machine-bound AES-128-GCM vault), read once, used to build one request header, then the buffers are zeroed and the plaintext file is overwritten and unlinked. validate.json ECHOES the key in its body, so that body is never printed -- only the fields named below. usage: nx_nexus_fetch validate nx_nexus_fetch info <game_domain> <mod_id> nx_nexus_fetch files <game_domain> <mod_id> nx_nexus_fetch link <game_domain> <mod_id> <file_id> [nxm_key nxm_expires] nx_nexus_fetch fetch <game_domain> <mod_id> <file_id> <out-path> [nxm_key nxm_expires] exits: 0 ok | 2 usage | 3 NO-KEY (the vault could not open nexus_api) | 4 NET (the ladder returned nothing: bad url, trust, connect or every hello refused) | 5 HTTP (a status other than 200 -- the body's first bytes are printed, they carry the API's own reason) | 6 UNPARSED (200 but the named field is absent -- printed as absent, never invented) Every receipt is one line per record with key=value fields; the download receipt carries the sha256 of the bytes it wrote, sized from the file's DECLARED size_kb (an output buffer derived from the input, never a guessed cap). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0