@bluenotelogic/harness 0.1.0 → 0.2.0

package/dist/antigravity.d.ts

@@ -0,0 +1,26 @@
+import { type FileChange } from "./writers.js";
+export declare const ANTIGRAVITY_PLUGIN_NAME = "proofmem";
+export declare const ANTIGRAVITY_ENABLED_TOOLS: readonly ["persistent_save", "persistent_recall", "persistent_update", "persistent_archive", "preference_get", "preference_list", "preference_set", "preference_delete", "scratch_set", "scratch_get", "scratch_delete", "episodic_log", "episodic_recall", "session_start", "session_end", "session_recall", "dedup_scan", "contradiction_scan", "staleness_scan", "reminder_set", "reminder_list", "reminder_cancel", "bootstrap", "context", "harness_route", "feedback_file", "proposal_create", "graph_neighbors", "skills_list", "skills_get", "tools_list", "tools_get"];
+export interface AntigravityInstall {
+    configHome: string;
+    harnessHome: string;
+    mcpUrl: string;
+    serverName: string;
+    hookToken: string;
+    /** ISO-8601 expiry of hookToken, when the server reported one. Not secret. */
+    hookTokenExpiresAt?: string;
+    /** Run the workspace's own build/test/lint on Stop. Off unless the user passed --verify-gate. */
+    verifyGate: boolean;
+    memoryApiUrl?: string;
+}
+export declare function antigravityConfigHome(explicit: string | null): string;
+export declare function antigravityPluginRoot(configHome: string): string;
+export declare function antigravityHookTokenPath(configHome: string): string;
+export declare function assertAntigravityInstallTarget(configHome: string): void;
+/** Plan the complete Antigravity plugin without putting a credential in its MCP config. */
+export declare function planAntigravityInstall(opts: AntigravityInstall): FileChange[];
+/** Paths are exported for the CLI doctor and for black-box installer tests. */
+export declare function antigravityInstallPaths(configHome: string): {
+    pluginRoot: string;
+    tokenFile: string;
+};

package/dist/antigravity.js

@@ -0,0 +1,118 @@
+import { existsSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+import { planCredentialFile, readIfExists } from "./writers.js";
+export const ANTIGRAVITY_PLUGIN_NAME = "proofmem";
+// Which tools Antigravity offers its agent. This is a CLIENT-SIDE allowlist, not a security
+// boundary: the server enforces each token's scopes. secret_* stays unreachable because no
+// ProofMEM token is minted with secret:read/secret:write; skill/tool authoring is only hidden
+// here, since those tools need just memory:write. graph_entity_upsert/graph_edge_upsert are left
+// out because they need graph:write, which these tokens do not carry, so they could only fail.
+export const ANTIGRAVITY_ENABLED_TOOLS = [
+    "persistent_save", "persistent_recall", "persistent_update", "persistent_archive",
+    "preference_get", "preference_list", "preference_set", "preference_delete",
+    "scratch_set", "scratch_get", "scratch_delete",
+    "episodic_log", "episodic_recall",
+    "session_start", "session_end", "session_recall",
+    "dedup_scan", "contradiction_scan", "staleness_scan",
+    "reminder_set", "reminder_list", "reminder_cancel",
+    "bootstrap", "context", "harness_route",
+    "feedback_file", "proposal_create",
+    "graph_neighbors",
+    "skills_list", "skills_get", "tools_list", "tools_get",
+];
+const ASSET_FILES = [
+    "plugin.json",
+    "hooks.json",
+    "README.md",
+    "rules/proofmem.md",
+    "scripts/antigravity-hook.mjs",
+    "scripts/resolve-bash.mjs",
+];
+export function antigravityConfigHome(explicit) {
+    return resolve(explicit
+        ?? process.env["ANTIGRAVITY_CONFIG_HOME"]
+        ?? join(process.env["USERPROFILE"] || process.env["HOME"] || "", ".gemini", "config"));
+}
+export function antigravityPluginRoot(configHome) {
+    return join(configHome, "plugins", ANTIGRAVITY_PLUGIN_NAME);
+}
+export function antigravityHookTokenPath(configHome) {
+    return join(configHome, ANTIGRAVITY_PLUGIN_NAME, "hook-token");
+}
+function assetRoot() {
+    return fileURLToPath(new URL("../assets/antigravity-plugin/", import.meta.url));
+}
+function assertOwnedPlugin(pluginRoot) {
+    if (!existsSync(pluginRoot))
+        return;
+    const manifestPath = join(pluginRoot, "plugin.json");
+    const raw = readIfExists(manifestPath);
+    if (raw === null) {
+        throw new Error(`refusing to replace ${pluginRoot}: it exists but has no ProofMEM plugin manifest`);
+    }
+    try {
+        const manifest = JSON.parse(raw);
+        if (manifest["name"] !== ANTIGRAVITY_PLUGIN_NAME)
+            throw new Error("name is not proofmem");
+    }
+    catch (error) {
+        throw new Error(`refusing to replace ${pluginRoot}: plugin ownership is ambiguous (${error.message})`);
+    }
+}
+export function assertAntigravityInstallTarget(configHome) {
+    assertOwnedPlugin(antigravityPluginRoot(configHome));
+}
+function inferMemoryApiUrl(mcpUrl) {
+    const url = new URL(mcpUrl);
+    return new URL("/api", url.origin).toString().replace(/\/$/, "");
+}
+/** Plan the complete Antigravity plugin without putting a credential in its MCP config. */
+export function planAntigravityInstall(opts) {
+    const pluginRoot = antigravityPluginRoot(opts.configHome);
+    assertOwnedPlugin(pluginRoot);
+    const changes = ASSET_FILES.map((relative) => {
+        const target = join(pluginRoot, relative);
+        const source = join(assetRoot(), relative);
+        return { path: target, before: readIfExists(target), after: readFileSync(source, "utf8") };
+    });
+    const mcpPath = join(pluginRoot, "mcp_config.json");
+    const mcp = {
+        mcpServers: {
+            [opts.serverName]: {
+                serverUrl: opts.mcpUrl,
+                timeoutSeconds: 60,
+                enabledTools: [...ANTIGRAVITY_ENABLED_TOOLS],
+            },
+        },
+    };
+    changes.push({
+        path: mcpPath,
+        before: readIfExists(mcpPath),
+        after: `${JSON.stringify(mcp, null, 2)}\n`,
+    });
+    const hookTokenFile = antigravityHookTokenPath(opts.configHome);
+    const localConfigPath = join(pluginRoot, "harness-home.json");
+    const localConfig = {
+        harnessHome: resolve(opts.harnessHome),
+        hookTokenFile,
+        memoryApiUrl: opts.memoryApiUrl ?? inferMemoryApiUrl(opts.mcpUrl),
+        verifyGate: opts.verifyGate,
+        ...(opts.hookTokenExpiresAt ? { hookTokenExpiresAt: opts.hookTokenExpiresAt } : {}),
+    };
+    changes.push({
+        path: localConfigPath,
+        before: readIfExists(localConfigPath),
+        after: `${JSON.stringify(localConfig, null, 2)}\n`,
+    });
+    changes.push(planCredentialFile(hookTokenFile, readIfExists(hookTokenFile), opts.hookToken, "ProofMEM hook credential; owner-only and separate from Antigravity's OAuth store"));
+    return changes;
+}
+/** Paths are exported for the CLI doctor and for black-box installer tests. */
+export function antigravityInstallPaths(configHome) {
+    return {
+        pluginRoot: antigravityPluginRoot(configHome),
+        tokenFile: antigravityHookTokenPath(configHome),
+    };
+}
+//# sourceMappingURL=antigravity.js.map

package/dist/antigravity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"antigravity.js","sourceRoot":"","sources":["../src/antigravity.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAW,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAmB,MAAM,cAAc,CAAC;AAEjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,UAAU,CAAC;AAElD,4FAA4F;AAC5F,2FAA2F;AAC3F,8FAA8F;AAC9F,iGAAiG;AACjG,+FAA+F;AAC/F,MAAM,CAAC,MAAM,yBAAyB,GAAG;IACvC,iBAAiB,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,oBAAoB;IACjF,gBAAgB,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,mBAAmB;IAC1E,aAAa,EAAE,aAAa,EAAE,gBAAgB;IAC9C,cAAc,EAAE,iBAAiB;IACjC,eAAe,EAAE,aAAa,EAAE,gBAAgB;IAChD,YAAY,EAAE,oBAAoB,EAAE,gBAAgB;IACpD,cAAc,EAAE,eAAe,EAAE,iBAAiB;IAClD,WAAW,EAAE,SAAS,EAAE,eAAe;IACvC,eAAe,EAAE,iBAAiB;IAClC,iBAAiB;IACjB,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,WAAW;CAC9C,CAAC;AAEX,MAAM,WAAW,GAAG;IAClB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,mBAAmB;IACnB,8BAA8B;IAC9B,0BAA0B;CAClB,CAAC;AAeX,MAAM,UAAU,qBAAqB,CAAC,QAAuB;IAC3D,OAAO,OAAO,CACZ,QAAQ;WACH,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;WACtC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CACxF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,UAAkB;IACtD,OAAO,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,uBAAuB,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,UAAkB;IACzD,OAAO,IAAI,CAAC,UAAU,EAAE,uBAAuB,EAAE,YAAY,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,aAAa,CAAC,IAAI,GAAG,CAAC,+BAA+B,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,iBAAiB,CAAC,UAAkB;IAC3C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO;IACpC,MAAM,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,iDAAiD,CACnF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,uBAAuB;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC5F,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,uBAAuB,UAAU,oCAAqC,KAAe,CAAC,OAAO,GAAG,CACjG,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B,CAAC,UAAkB;IAC/D,iBAAiB,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAc;IACvC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,IAAI,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnE,CAAC;AAED,2FAA2F;AAC3F,MAAM,UAAU,sBAAsB,CAAC,IAAwB;IAC7D,MAAM,UAAU,GAAG,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAC1D,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAE9B,MAAM,OAAO,GAAiB,WAAW,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC3C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,iBAAiB,CAAC,CAAC;IACpD,MAAM,GAAG,GAAG;QACV,UAAU,EAAE;YACV,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE;gBACjB,SAAS,EAAE,IAAI,CAAC,MAAM;gBACtB,cAAc,EAAE,EAAE;gBAClB,YAAY,EAAE,CAAC,GAAG,yBAAyB,CAAC;aAC7C;SACF;KACF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC;QAC7B,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;KAC3C,CAAC,CAAC;IAEH,MAAM,aAAa,GAAG,wBAAwB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,IAAI,CAAC,UAAU,EAAE,mBAAmB,CAAC,CAAC;IAC9D,MAAM,WAAW,GAAG;QAClB,WAAW,EAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC;QACtC,aAAa;QACb,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC;QACjE,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpF,CAAC;IACF,OAAO,CAAC,IAAI,CAAC;QACX,IAAI,EAAE,eAAe;QACrB,MAAM,EAAE,YAAY,CAAC,eAAe,CAAC;QACrC,KAAK,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI;KACnD,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CACV,kBAAkB,CAChB,aAAa,EACb,YAAY,CAAC,aAAa,CAAC,EAC3B,IAAI,CAAC,SAAS,EACd,kFAAkF,CACnF,CACF,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,uBAAuB,CAAC,UAAkB;IAIxD,OAAO;QACL,UAAU,EAAE,qBAAqB,CAAC,UAAU,CAAC;QAC7C,SAAS,EAAE,wBAAwB,CAAC,UAAU,CAAC;KAChD,CAAC;AACJ,CAAC"}

package/dist/bundle.d.ts

@@ -16,6 +16,10 @@
  * but no memory subscription"), not an auth failure, and must be reported as such — telling
  * someone their login failed when their billing lapsed sends them to the wrong place.
  *
+ * Behind the proofmem.com OAuth gateway the first step has already happened server-side: its
+ * `/oauth/token` performs that same exchange and returns the cmem_… key itself. See
+ * tenantTokenForSignIn() — exchanging that key a second time is the bug it exists to prevent.
+ *
  * Note the paths: Apache aliases `/api` to `api/v1`, so the live URL is
  * `/api/oidc_exchange.php`, NOT `/api/v1/oidc_exchange.php`.
  */
@@ -49,6 +53,8 @@ export interface HarnessBundle {
     token?: {
         value: string;
         label?: string;
+        /** ISO 8601 UTC. Non-secret -- safe to print, unlike `value`. */
+        expires_at?: string;
         usage?: string;
         codex_toml?: string;
     };
@@ -57,7 +63,23 @@ export interface HarnessBundle {
 export declare const SUPPORTED_BUNDLE_VERSION = 1;
 export declare class SubscriptionRequiredError extends Error {
 }
+/** Authenticated, but the identity lacks something the server needs (422). Re-login won't fix it. */
+export declare class IdentityIncompleteError extends Error {
+}
 export declare function exchangeForTenantToken(baseUrl: string, accessToken: string): Promise<string>;
+/** A ProofMEM tenant key — what the gateway's `/oauth/token` hands out. Never a Blue Note ID token. */
+export declare const TENANT_TOKEN_PATTERN: RegExp;
+/**
+ * The tenant token for the access token a sign-in produced.
+ *
+ * 🔴 Through the proofmem.com gateway the OAuth access token IS already the tenant token: the
+ * gateway exchanged the Blue Note ID token server-side before answering `/oauth/token`.
+ * Re-exchanging it sent a cmem_ key to Blue Note ID userinfo, which answers 401, so a sign-in
+ * through the gateway could never complete (pilot release blocker B1, 2026-10-25). A Blue Note
+ * ID token — a self-hosted deployment, or a server without the gateway — still goes through the
+ * exchange, unchanged.
+ */
+export declare function tenantTokenForSignIn(baseUrl: string, accessToken: string): Promise<string>;
 export declare function fetchBundle(baseUrl: string, tenantToken: string, opts?: {
     mintToken?: boolean;
 }): Promise<HarnessBundle>;

package/dist/bundle.js

@@ -16,6 +16,10 @@
  * but no memory subscription"), not an auth failure, and must be reported as such — telling
  * someone their login failed when their billing lapsed sends them to the wrong place.
  *
+ * Behind the proofmem.com OAuth gateway the first step has already happened server-side: its
+ * `/oauth/token` performs that same exchange and returns the cmem_… key itself. See
+ * tenantTokenForSignIn() — exchanging that key a second time is the bug it exists to prevent.
+ *
  * Note the paths: Apache aliases `/api` to `api/v1`, so the live URL is
  * `/api/oidc_exchange.php`, NOT `/api/v1/oidc_exchange.php`.
  */
@@ -23,6 +27,9 @@
 export const SUPPORTED_BUNDLE_VERSION = 1;
 export class SubscriptionRequiredError extends Error {
 }
+/** Authenticated, but the identity lacks something the server needs (422). Re-login won't fix it. */
+export class IdentityIncompleteError extends Error {
+}
 export async function exchangeForTenantToken(baseUrl, accessToken) {
     const res = await fetch(`${baseUrl}/api/oidc_exchange.php`, {
         method: "POST",
@@ -30,7 +37,18 @@ export async function exchangeForTenantToken(baseUrl, accessToken) {
     });
     if (res.status === 403) {
         const body = (await res.json().catch(() => ({})));
-        throw new SubscriptionRequiredError(String(body["error"] ?? "This Blue Note Account has no Blue Note Memory subscription"));
+        throw new SubscriptionRequiredError(String(body["error"] ?? "This Blue Note Account has no ProofMEM subscription"));
+    }
+    // 422 = the token was ACCEPTED but the identity behind it cannot be used (e.g. no verified
+    // email because the client asked for the wrong scope). Reporting that as a failed exchange
+    // sends people to re-authenticate, which cannot possibly help — the server's message names
+    // the actual cause, so pass it through verbatim.
+    if (res.status === 422) {
+        const body = (await res.json().catch(() => ({})));
+        throw new IdentityIncompleteError(String(body["error"] ?? "This Blue Note Account is missing a required claim"));
+    }
+    if (res.status === 503) {
+        throw new Error("Blue Note ID is temporarily unavailable — nothing is wrong with your login. Try again shortly.");
     }
     if (!res.ok) {
         throw new Error(`token exchange failed: ${res.status} ${await snippet(res)}`);
@@ -42,6 +60,23 @@ export async function exchangeForTenantToken(baseUrl, accessToken) {
     }
     return token;
 }
+/** A ProofMEM tenant key — what the gateway's `/oauth/token` hands out. Never a Blue Note ID token. */
+export const TENANT_TOKEN_PATTERN = /^cmem_[A-Za-z0-9_-]{16,}$/;
+/**
+ * The tenant token for the access token a sign-in produced.
+ *
+ * 🔴 Through the proofmem.com gateway the OAuth access token IS already the tenant token: the
+ * gateway exchanged the Blue Note ID token server-side before answering `/oauth/token`.
+ * Re-exchanging it sent a cmem_ key to Blue Note ID userinfo, which answers 401, so a sign-in
+ * through the gateway could never complete (pilot release blocker B1, 2026-10-25). A Blue Note
+ * ID token — a self-hosted deployment, or a server without the gateway — still goes through the
+ * exchange, unchanged.
+ */
+export async function tenantTokenForSignIn(baseUrl, accessToken) {
+    if (TENANT_TOKEN_PATTERN.test(accessToken))
+        return accessToken;
+    return exchangeForTenantToken(baseUrl, accessToken);
+}
 export async function fetchBundle(baseUrl, tenantToken, opts = {}) {
     const url = new URL(`${baseUrl}/api/harness_bootstrap.php`);
     if (opts.mintToken)

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAgCH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAEvD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,wBAAwB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAChF,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,MAAM,IAAI,yBAAyB,CACjC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,6DAA6D,CAAC,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,WAAmB,EACnB,OAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,4BAA4B,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAChF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnG,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,0BAA0B,wBAAwB,IAAI;YAChG,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAwC,CAAC;IACtE,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAwC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAa;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAkCH,2FAA2F;AAC3F,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC;AAE1C,MAAM,OAAO,yBAA0B,SAAQ,KAAK;CAAG;AAEvD,qGAAqG;AACrG,MAAM,OAAO,uBAAwB,SAAQ,KAAK;CAAG;AAErD,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAAe,EACf,WAAmB;IAEnB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,wBAAwB,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAChF,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,MAAM,IAAI,yBAAyB,CACjC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,qDAAqD,CAAC,CAC/E,CAAC;IACJ,CAAC;IACD,2FAA2F;IAC3F,2FAA2F;IAC3F,2FAA2F;IAC3F,iDAAiD;IACjD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA4B,CAAC;QAC7E,MAAM,IAAI,uBAAuB,CAC/B,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,oDAAoD,CAAC,CAC9E,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,gGAAgG,CAAC,CAAC;IACpH,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChF,CAAC;IACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAC;AAEhE;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,WAAmB;IAC7E,IAAI,oBAAoB,CAAC,IAAI,CAAC,WAAW,CAAC;QAAE,OAAO,WAAW,CAAC;IAC/D,OAAO,sBAAsB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAAe,EACf,WAAmB,EACnB,OAAgC,EAAE;IAElC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,OAAO,4BAA4B,CAAC,CAAC;IAC5D,IAAI,IAAI,CAAC,SAAS;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC3B,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;KAChF,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjF,CAAC;IACD,OAAO,cAAc,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACrG,MAAM,CAAC,GAAG,GAA8B,CAAC;IAEzC,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1C,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,GAAG,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnG,IAAI,OAAO,GAAG,wBAAwB,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,qCAAqC,OAAO,0BAA0B,wBAAwB,IAAI;YAChG,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAwC,CAAC;IACtE,MAAM,MAAM,GAAG,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,UAAU,CAAwC,CAAC;IACrE,MAAM,OAAO,GAAG,OAAO,IAAI,OAAO,CAAC,YAAY,CAAC,CAAC;IACjD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC9E,CAAC;IAED,OAAO,GAAoB,CAAC;AAC9B,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,GAAa;IAClC,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 /**
- * bnl-harness — point this machine at Blue Note Memory in one command.
+ * bnl-harness — point this machine at ProofMEM in one command.
  *
  *     npx @bluenotelogic/harness init
  *
@@ -10,15 +10,14 @@
  *
  * THE IMPORTANT PART — the `.mcp.json` this writes carries NO TOKEN:
  *
- *     { "mcpServers": { "mem": { "type": "http", "url": "https://mem.bnlgit.com/mcp" } } }
+ *     { "mcpServers": { "proofmem": { "type": "http", "url": "https://proofmem.com/mcp" } } }
  *
  * OAuth-capable hosts (Claude Code, VS Code) discover auth from the endpoint's 401 +
  * WWW-Authenticate, run the browser flow against Blue Note ID, and store their own
  * credentials. Nothing secret is written into a repo file, so the file is safe to commit
  * and there is nothing to rotate.
  *
- * Codex and CI cannot do that yet, so `--mint-token` exists for them — and it writes the
- * token to `~/.codex/.env`, never into a repo. Minting is OPT-IN precisely so the default
- * path creates no credential and no database row.
+ * Codex and hook subprocesses cannot do that yet, so token minting remains explicit: `--codex`
+ * writes only to `~/.codex/.env`, while `--antigravity` writes a separate owner-only hook key.
  */
 export {};