fix(core): stamp canonical models.dev URL as bundled catalog provenance

The generator passed its input locator straight through as the provenance
stamp, so generating from a local payload copy recorded a machine-specific
path (e.g. /tmp/11959-models-dev.json) in the committed snapshot. Stamp
MODELS_DEV_URL for local-path inputs (the payload is models.dev data
regardless of where the machine stored it), keep URL inputs stamping
themselves, regenerate the snapshot, and pin the artifact's source field
with a test.

Co-authored-by: Qwen-Coder <[email protected]>
Patrol-Run: qwen-pr-closeout/jmuofqisz0a

packages/core/src/models/generated/model-registry.json

@@ -1,6 +1,6 @@
 {
-  "source": "/tmp/11959-models-dev.json",
-  "fetchedAt": "2026-09-30T08:20:49.890Z",
+  "source": "https://models.dev/api.json",
+  "fetchedAt": "2026-09-30T18:38:13.405Z",
   "projection": 1,
   "models": {
     "claude-fable-5": {

packages/core/src/models/model-catalog.test.ts

@@ -486,4 +486,11 @@ describe('model catalog', () => {
       200 * 1024,
     );
   });
+
+  it('stamps the committed snapshot with the canonical catalog URL', () => {
+    // Provenance must name where the data comes from, not the local path a
+    // maintainer happened to generate from (scripts/generate-model-catalog.ts
+    // stamps MODELS_DEV_URL for local-path inputs).
+    expect(bundled.source).toBe(MODELS_DEV_URL);
+  });
 });

scripts/generate-model-catalog.ts

@@ -27,7 +27,12 @@ import {
 
 const MAX_BYTES = 200 * 1024;
 
-const source = process.argv[2] ?? MODELS_DEV_URL;
+const input = process.argv[2] ?? MODELS_DEV_URL;
+// The provenance stamped into the committed snapshot must stay meaningful to
+// its readers: a local input path is machine-specific, so stamp the
+// canonical catalog URL instead — the payload is models.dev data regardless
+// of where this machine happened to store it.
+const source = /^https?:\/\//.test(input) ? input : MODELS_DEV_URL;
 
 async function fetchApi(url: string): Promise<ModelsDevApi> {
   const response = await fetch(url);
@@ -39,16 +44,16 @@ async function fetchApi(url: string): Promise<ModelsDevApi> {
   return (await response.json()) as ModelsDevApi;
 }
 
-const api: ModelsDevApi = /^https?:\/\//.test(source)
-  ? await fetchApi(source)
-  : JSON.parse(fs.readFileSync(source, 'utf8'));
+const api: ModelsDevApi = /^https?:\/\//.test(input)
+  ? await fetchApi(input)
+  : JSON.parse(fs.readFileSync(input, 'utf8'));
 
 const catalog = trimModelsDevCatalog(api, new Date().toISOString(), source);
 // A 200 that projects to nothing is not a catalog (a renamed upstream field
 // or a gateway error body); never overwrite the committed snapshot with it.
 if (Object.keys(catalog.models).length === 0) {
   throw new Error(
-    `no catalog entries projected from ${source}; leaving the committed snapshot untouched`,
+    `no catalog entries projected from ${input}; leaving the committed snapshot untouched`,
   );
 }
 const json = JSON.stringify(catalog, null, 2) + '\n';