@mnemom/mnemom 0.10.0 → 0.12.0

package/dist/commands/protection.js

@@ -11,27 +11,53 @@ const PROTECTION_MODES = ["off", "observe", "nudge", "enforce"];
 const SURFACE_KEYS = ["incoming", "outgoing", "tool_calls", "tool_responses"];
 // Per ADR-037 Decision 4: deny public LLM endpoints + public DNS providers,
 // and the any-host CIDRs, at write time.
+// T8-4 (2026-05-19) extended the corpus per
+// `safe-house-hardening/audit/deny-list-completeness.md`: added emerging
+// LLM providers (Replicate, Together, Anyscale, Fireworks, xAI,
+// Perplexity, DeepSeek) and three reserved IP ranges (link-local v4/v6
+// + multicast v4).
+// Mirror lives at `mnemom-api/src/composition/validate.ts` —
+// must stay in sync; T8-4 F3 (filed) extracts to a shared package.
 const DENY_DOMAINS = new Set([
+    // OpenAI + Anthropic + Google
     "api.openai.com",
     "api.anthropic.com",
     "generativelanguage.googleapis.com",
+    "cloud.google.com",
+    // Other model-API providers (T8-4 additions 2026-05-19)
     "api.cohere.ai",
     "api.mistral.ai",
     "api.groq.com",
-    "cloud.google.com",
+    "replicate.com",
+    "api.replicate.com",
+    "api.together.xyz",
+    "api.together.ai",
+    "api.endpoints.anyscale.com",
+    "api.fireworks.ai",
+    "api.x.ai",
+    "api.perplexity.ai",
+    "api.deepseek.com",
+    // Public DNS providers
     "dns.google",
     "cloudflare-dns.com",
     "one.one.one.one",
     "dns.quad9.net",
 ]);
 const DENY_IP_PREFIXES = [
+    // Any-host
     "0.0.0.0/0",
     "::/0",
+    // Public DNS provider /24s
     "8.8.8.0/24",
     "8.8.4.0/24",
     "1.1.1.0/24",
     "1.0.0.0/24",
     "9.9.9.0/24",
+    // T8-4 additions 2026-05-19: reserved ranges with no legitimate
+    // trusted-source semantics. Link-local + multicast.
+    "169.254.0.0/16", // link-local IPv4 (RFC 3927) — SSRF/imds vector
+    "fe80::/10", // link-local IPv6 (RFC 4291)
+    "224.0.0.0/4", // multicast IPv4 (RFC 5771) — never legitimate trust target
 ];
 const DOMAIN_RE = /^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)+(:\d{1,5})?$/i;
 const AGENT_ID_RE = /^mnm-[a-z0-9-]{4,}$/i;
@@ -41,6 +67,12 @@ function isObject(v) {
 }
 function validateDomain(d) {
     const lower = d.toLowerCase();
+    // T8-4: explicit wildcard rejection. DOMAIN_RE already implicitly rejects
+    // a sole '*' (no dot), but `*.example.com` shapes also need an explicit
+    // guard — operator footgun if we ever loosened DOMAIN_RE.
+    if (lower.includes("*")) {
+        return "wildcards are not permitted in trusted_sources.domains; enumerate the specific hosts";
+    }
     if (DENY_DOMAINS.has(lower.split(":")[0])) {
         return "domain is on the static deny-list (public LLM/DNS endpoint)";
     }
@@ -191,7 +223,9 @@ export function validateProtectionCard(card) {
                 });
                 bad = true;
             }
-            if (nums.quarantine !== undefined && nums.block !== undefined && nums.quarantine > nums.block) {
+            if (nums.quarantine !== undefined &&
+                nums.block !== undefined &&
+                nums.quarantine > nums.block) {
                 checks.push({
                     name: "thresholds.quarantine",
                     passed: false,
@@ -214,11 +248,15 @@ export function validateProtectionCard(card) {
             checks.push({
                 name: "screen_surfaces",
                 passed: false,
-                message: 'Must be an object of booleans, not an array. Per ADR-037 use { incoming: true, outgoing: true, tool_calls: true, tool_responses: true }.',
+                message: "Must be an object of booleans, not an array. Per ADR-037 use { incoming: true, outgoing: true, tool_calls: true, tool_responses: true }.",
             });
         }
         else if (!isObject(card.screen_surfaces)) {
-            checks.push({ name: "screen_surfaces", passed: false, message: "Must be an object if present" });
+            checks.push({
+                name: "screen_surfaces",
+                passed: false,
+                message: "Must be an object if present",
+            });
         }
         else {
             const s = card.screen_surfaces;
@@ -245,7 +283,7 @@ export function validateProtectionCard(card) {
                 }
             }
             if (!bad) {
-                const enabled = SURFACE_KEYS.filter(k => s[k] === true).length;
+                const enabled = SURFACE_KEYS.filter((k) => s[k] === true).length;
                 checks.push({
                     name: "screen_surfaces",
                     passed: true,
@@ -260,11 +298,15 @@ export function validateProtectionCard(card) {
             checks.push({
                 name: "trusted_sources",
                 passed: false,
-                message: 'Must be an object of typed buckets, not an array. Per ADR-037 use { domains: [...], agent_ids: [...], ip_ranges: [...] } — the legacy [{pattern, ...}] shape is no longer accepted.',
+                message: "Must be an object of typed buckets, not an array. Per ADR-037 use { domains: [...], agent_ids: [...], ip_ranges: [...] } — the legacy [{pattern, ...}] shape is no longer accepted.",
             });
         }
         else if (!isObject(card.trusted_sources)) {
-            checks.push({ name: "trusted_sources", passed: false, message: "Must be an object if present" });
+            checks.push({
+                name: "trusted_sources",
+                passed: false,
+                message: "Must be an object if present",
+            });
         }
         else {
             const ts = card.trusted_sources;
@@ -290,7 +332,7 @@ export function validateProtectionCard(card) {
 function parseProtectionFile(filePath) {
     const raw = fs.readFileSync(filePath, "utf-8");
     const ext = path.extname(filePath).toLowerCase();
-    const format = (ext === ".yaml" || ext === ".yml") ? "yaml" : "json";
+    const format = ext === ".yaml" || ext === ".yml" ? "yaml" : "json";
     if (format === "yaml") {
         const parsed = yaml.load(raw);
         if (!parsed || typeof parsed !== "object") {
@@ -450,19 +492,20 @@ export async function protectionEditCommand(agentName, options = {}) {
     if (!original) {
         console.log(fmt.warn("No protection card found. Creating a template..."));
     }
-    const cardYaml = original || yaml.dump({
-        card_version: "protection/2026-04-26",
-        agent_id: agentId,
-        mode: "observe",
-        thresholds: { warn: 0.3, quarantine: 0.6, block: 0.9 },
-        screen_surfaces: {
-            incoming: true,
-            outgoing: true,
-            tool_calls: true,
-            tool_responses: true,
-        },
-        trusted_sources: { domains: [], agent_ids: [], ip_ranges: [] },
-    }, { lineWidth: 120, noRefs: true });
+    const cardYaml = original ||
+        yaml.dump({
+            card_version: "protection/2026-04-26",
+            agent_id: agentId,
+            mode: "observe",
+            thresholds: { warn: 0.3, quarantine: 0.6, block: 0.9 },
+            screen_surfaces: {
+                incoming: true,
+                outgoing: true,
+                tool_calls: true,
+                tool_responses: true,
+            },
+            trusted_sources: { domains: [], agent_ids: [], ip_ranges: [] },
+        }, { lineWidth: 120, noRefs: true });
     const tmpDir = os.tmpdir();
     const tmpFile = path.join(tmpDir, `mnemom-protection-${agentId}.yaml`);
     fs.writeFileSync(tmpFile, cardYaml);
@@ -474,14 +517,18 @@ export async function protectionEditCommand(agentName, options = {}) {
         try {
             fs.unlinkSync(tmpFile);
         }
-        catch { /* ignore */ }
+        catch {
+            /* ignore */
+        }
         process.exit(1);
     }
     const edited = fs.readFileSync(tmpFile, "utf-8");
     try {
         fs.unlinkSync(tmpFile);
     }
-    catch { /* ignore */ }
+    catch {
+        /* ignore */
+    }
     if (edited === cardYaml) {
         console.log("\nNo changes made.\n");
         return;

package/dist/commands/recipes.d.ts

@@ -0,0 +1,34 @@
+/**
+ * `mnemom recipes ...` commands — AEGIS-6b (Phase 2 Day 5).
+ *
+ *   mnemom recipes report-fn <recipe-id> [--summary "..."] [--evidence "..."]
+ *                                        [--agent <id>] [--checkpoint <id>]
+ *                                        [--json]
+ *   mnemom recipes report-fp <recipe-id> [--summary "..."] [--evidence "..."]
+ *                                        [--agent <id>] [--checkpoint <id>]
+ *                                        [--json]
+ *
+ * POSTs to /v1/recipes/:id/report (AEGIS-6a; mnemom-api#508). Authentication
+ * uses the same JWT/API-key resolution as every other authed CLI command.
+ * Idempotency-Key is generated per call by postApi(); the server folds the
+ * request body into the fingerprint per `feedback_idempotency_key_body_hash`.
+ *
+ * Output (human mode):
+ *   - candidate_id of the resulting sideband_analyses row
+ *   - status hint ("pending — admin review or auto-mode promotion will
+ *     determine the outcome")
+ *   - a pointer to the dashboard URL where the customer can track review
+ *     status. The customer-facing dashboard form (AEGIS-6c) is a future
+ *     follow-up; until it lands, the URL points to the static "report
+ *     filed" anchor and the candidate_id is the primary track-handle.
+ */
+interface ReportOpts {
+    summary?: string;
+    evidence?: string;
+    agent?: string;
+    checkpoint?: string;
+    json?: boolean;
+}
+export declare function recipesReportFnCommand(recipeId: string, opts: ReportOpts): Promise<void>;
+export declare function recipesReportFpCommand(recipeId: string, opts: ReportOpts): Promise<void>;
+export {};

package/dist/commands/recipes.js

@@ -0,0 +1,80 @@
+/**
+ * `mnemom recipes ...` commands — AEGIS-6b (Phase 2 Day 5).
+ *
+ *   mnemom recipes report-fn <recipe-id> [--summary "..."] [--evidence "..."]
+ *                                        [--agent <id>] [--checkpoint <id>]
+ *                                        [--json]
+ *   mnemom recipes report-fp <recipe-id> [--summary "..."] [--evidence "..."]
+ *                                        [--agent <id>] [--checkpoint <id>]
+ *                                        [--json]
+ *
+ * POSTs to /v1/recipes/:id/report (AEGIS-6a; mnemom-api#508). Authentication
+ * uses the same JWT/API-key resolution as every other authed CLI command.
+ * Idempotency-Key is generated per call by postApi(); the server folds the
+ * request body into the fingerprint per `feedback_idempotency_key_body_hash`.
+ *
+ * Output (human mode):
+ *   - candidate_id of the resulting sideband_analyses row
+ *   - status hint ("pending — admin review or auto-mode promotion will
+ *     determine the outcome")
+ *   - a pointer to the dashboard URL where the customer can track review
+ *     status. The customer-facing dashboard form (AEGIS-6c) is a future
+ *     follow-up; until it lands, the URL points to the static "report
+ *     filed" anchor and the candidate_id is the primary track-handle.
+ */
+import chalk from "chalk";
+import { reportRecipeFnFp, } from "../lib/api.js";
+import { requireAuth } from "../lib/auth.js";
+async function readSummary(opts) {
+    if (typeof opts.summary === "string" && opts.summary.trim()) {
+        return opts.summary.trim();
+    }
+    // Allow piping a longer description via stdin: `cat report.md | mnemom
+    // recipes report-fn rcp_abc`. The server requires a non-empty summary;
+    // we'd rather fail-here with a clear CLI message than send an empty
+    // body that 400s.
+    if (!process.stdin.isTTY) {
+        const chunks = [];
+        for await (const chunk of process.stdin) {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        }
+        const piped = Buffer.concat(chunks).toString("utf8").trim();
+        if (piped)
+            return piped;
+    }
+    throw new Error("summary required: pass --summary \"…\" or pipe text on stdin.");
+}
+async function runReport(recipeId, type, opts) {
+    await requireAuth();
+    const summary = await readSummary(opts);
+    const input = {
+        type,
+        summary,
+        ...(opts.evidence ? { evidence: opts.evidence } : {}),
+        ...(opts.agent ? { agent_id: opts.agent } : {}),
+        ...(opts.checkpoint ? { checkpoint_id: opts.checkpoint } : {}),
+    };
+    const result = await reportRecipeFnFp(recipeId, input);
+    if (opts.json) {
+        process.stdout.write(JSON.stringify(result) + "\n");
+        return;
+    }
+    const verb = type === "fn" ? "false-negative" : "false-positive";
+    const label = type === "fn" ? "FN" : "FP";
+    process.stdout.write([
+        chalk.green(`✓ ${label} report filed`),
+        `  candidate_id:       ${chalk.bold(result.candidate_id)}`,
+        `  related_recipe_id:  ${chalk.dim(result.related_recipe_id)}`,
+        `  status:             ${chalk.dim("pending — awaiting admin review or auto-mode promotion")}`,
+        "",
+        chalk.dim(`Track this ${verb} report under candidate id ${result.candidate_id}.`),
+        chalk.dim("Once the customer dashboard form (AEGIS-6c) ships, a direct URL will appear here."),
+        "",
+    ].join("\n"));
+}
+export async function recipesReportFnCommand(recipeId, opts) {
+    await runReport(recipeId, "fn", opts);
+}
+export async function recipesReportFpCommand(recipeId, opts) {
+    await runReport(recipeId, "fp", opts);
+}

package/dist/commands/status.js

@@ -1,26 +1,13 @@
 import { getGatewayUrl } from "../lib/config.js";
 import { resolveAgentId, getAgent, getIntegrity, getTraces } from "../lib/api.js";
 import { isLoggedIn, getAuthInfo } from "../lib/auth.js";
-import { detectOpenClaw, detectProviders, getCurrentModel, getSmoltbotConfiguredProviders, PROVIDER_CONFIG_KEYS, } from "../lib/openclaw.js";
-import { formatModelName, detectProvider } from "../lib/models.js";
-import { refreshModelCache } from "../lib/model-cache.js";
 import { fmt } from "../lib/format.js";
 const DASHBOARD_URL = "https://mnemom.ai";
-const PROVIDER_LABELS = {
-    anthropic: "Anthropic",
-    openai: "OpenAI",
-    gemini: "Gemini",
-};
-const AIP_SUPPORT = {
-    anthropic: "Full (thinking blocks)",
-    openai: "Via reasoning summaries",
-    gemini: "Full (thought parts)",
-};
 export async function statusCommand(agentName) {
     console.log(fmt.header("mnemom status"));
     console.log();
     const checks = [];
-    // 1. Check auth status
+    // 1. Auth status
     const authCheck = await checkAuthStatus();
     checks.push(authCheck);
     if (authCheck.status === "error") {
@@ -31,55 +18,25 @@ export async function statusCommand(agentName) {
     // Resolve agent ID from server
     const agentId = await resolveAgentId(agentName);
     const gatewayUrl = getGatewayUrl();
-    // 2. Check OpenClaw configuration
-    const openclawCheck = checkOpenClawConfig();
-    checks.push(openclawCheck);
-    // 3. Check configured providers
-    const providerChecks = checkConfiguredProviders();
-    checks.push(...providerChecks);
-    // 4. Check current model
-    const modelCheck = checkCurrentModel();
-    checks.push(modelCheck);
-    // 5. Test gateway connectivity
+    // 2. Gateway connectivity
     const gatewayCheck = await checkGatewayConnectivity(gatewayUrl);
     checks.push(gatewayCheck);
-    // 6. Test API connectivity
+    // 3. API connectivity
     const apiCheck = await checkApiConnectivity(agentId);
     checks.push(apiCheck);
     // Print all checks
     printChecks(checks);
-    // Show configuration details
+    // Configuration details
     console.log(fmt.section("Configuration"));
     console.log();
     console.log(fmt.label("Agent ID: ", agentId));
     console.log(fmt.label("Gateway:  ", gatewayUrl));
     console.log(fmt.label("Dashboard:", ` ${DASHBOARD_URL}/agents/${agentId}`));
-    // Show current model info
-    const { fullPath, provider, modelId } = getCurrentModel();
-    if (fullPath) {
-        console.log(`\nCurrent Model: ${fullPath}`);
-        if (modelId) {
-            console.log(`  (${formatModelName(modelId)})`);
-        }
-        if (provider && (provider === "smoltbot" || provider.startsWith("smoltbot"))) {
-            console.log("  Status: Traced mode ACTIVE");
-        }
-        else {
-            console.log("  Status: Traced mode NOT ACTIVE");
-            if (modelId) {
-                const detectedProvider = detectProvider(modelId);
-                const configKey = detectedProvider ? PROVIDER_CONFIG_KEYS[detectedProvider] : "mnemom";
-                console.log(`\n  To enable: openclaw models set ${configKey}/${modelId}`);
-            }
-        }
-    }
-    // Show provider summary
-    showProviderSummary();
-    // Show trace summary if available
+    // Trace summary if API connectivity is healthy
     if (apiCheck.status === "ok") {
         await showTraceSummary(agentId);
     }
-    // Show overall status
+    // Overall status
     const hasErrors = checks.some((c) => c.status === "error");
     const hasWarnings = checks.some((c) => c.status === "warning");
     if (hasErrors) {
@@ -94,8 +51,6 @@ export async function statusCommand(agentName) {
         console.log("\n" + fmt.header("Status: ALL SYSTEMS GO"));
         console.log();
     }
-    // Refresh model cache in background (non-blocking)
-    refreshModelCache().catch(() => { });
 }
 async function checkAuthStatus() {
     const loggedIn = await isLoggedIn();
@@ -122,124 +77,6 @@ async function checkAuthStatus() {
         message: "Authenticated via API key",
     };
 }
-function checkOpenClawConfig() {
-    const detection = detectOpenClaw();
-    if (!detection.installed) {
-        return {
-            name: "OpenClaw",
-            status: "error",
-            message: "Not installed",
-            details: "Install from https://openclaw.ai",
-        };
-    }
-    if (!detection.hasApiKey) {
-        if (detection.isOAuth) {
-            return {
-                name: "OpenClaw",
-                status: "error",
-                message: "OAuth auth (not supported)",
-                details: "mnemom requires API key authentication",
-            };
-        }
-        // Check if any provider has a key (not just Anthropic)
-        const providerDetection = detectProviders();
-        const anyKey = Object.values(providerDetection.providers).some((p) => p.hasApiKey);
-        if (anyKey) {
-            return {
-                name: "OpenClaw",
-                status: "ok",
-                message: "API key(s) found",
-            };
-        }
-        return {
-            name: "OpenClaw",
-            status: "error",
-            message: "No API keys configured",
-            details: "Run `openclaw auth` to add your API key",
-        };
-    }
-    if (!detection.smoltbotAlreadyConfigured) {
-        return {
-            name: "OpenClaw",
-            status: "warning",
-            message: "mnemom provider not configured",
-            details: "Run `mnemom register <name>` to configure",
-        };
-    }
-    return {
-        name: "OpenClaw",
-        status: "ok",
-        message: "mnemom provider configured",
-    };
-}
-function checkConfiguredProviders() {
-    const results = [];
-    const providerDetection = detectProviders();
-    if (!providerDetection.installed)
-        return results;
-    const configuredProviders = getSmoltbotConfiguredProviders();
-    for (const provider of ["anthropic", "openai", "gemini"]) {
-        const info = providerDetection.providers[provider];
-        const isConfigured = configuredProviders.includes(provider);
-        if (info.hasApiKey && isConfigured) {
-            results.push({
-                name: `${PROVIDER_LABELS[provider]}`,
-                status: "ok",
-                message: `Configured (AIP: ${AIP_SUPPORT[provider]})`,
-            });
-        }
-        else if (info.hasApiKey && !isConfigured) {
-            results.push({
-                name: `${PROVIDER_LABELS[provider]}`,
-                status: "warning",
-                message: "API key found but not configured",
-                details: "Run `mnemom register <name>` to configure",
-            });
-        }
-        // Don't show providers without keys (too noisy)
-    }
-    return results;
-}
-function checkCurrentModel() {
-    const { fullPath, provider, modelId } = getCurrentModel();
-    if (!fullPath) {
-        return {
-            name: "Current Model",
-            status: "warning",
-            message: "No default model set",
-            details: "Run `openclaw models set mnemom/<model>`",
-        };
-    }
-    if (provider && (provider === "smoltbot" || provider.startsWith("smoltbot"))) {
-        return {
-            name: "Current Model",
-            status: "ok",
-            message: `${modelId} (traced)`,
-        };
-    }
-    return {
-        name: "Current Model",
-        status: "warning",
-        message: `${fullPath} (not traced)`,
-        details: `Switch with: openclaw models set mnemom/${modelId}`,
-    };
-}
-function showProviderSummary() {
-    const providerDetection = detectProviders();
-    if (!providerDetection.installed)
-        return;
-    const configuredProviders = getSmoltbotConfiguredProviders();
-    if (configuredProviders.length === 0)
-        return;
-    console.log(fmt.section("Configured Providers"));
-    console.log();
-    for (const provider of configuredProviders) {
-        const label = PROVIDER_LABELS[provider];
-        const aip = AIP_SUPPORT[provider];
-        const configKey = PROVIDER_CONFIG_KEYS[provider];
-        console.log(`  ${label}: ${configKey}/* (AIP: ${aip})`);
-    }
-}
 async function checkGatewayConnectivity(gatewayUrl) {
     try {
         const response = await fetch(`${gatewayUrl}/health`, {

package/dist/commands/team.js

@@ -21,7 +21,7 @@
  * grant managed via `mnemom team admin`.
  */
 import { readFileSync } from "node:fs";
-import { listMyTeams, getTeam, getTeamTemplate, putTeamTemplate, deleteTeamTemplate, previewComposeTeamTemplate, grantTeamAdmin, revokeTeamAdmin, listTeamAdmins, } from "../lib/api.js";
+import { listMyTeams, getTeam, getTeamTemplate, putTeamTemplate, deleteTeamTemplate, previewComposeTeamTemplate, grantTeamAdmin, revokeTeamAdmin, listTeamAdmins, getTeamSidebandCoverage, } from "../lib/api.js";
 import { requireAuth } from "../lib/auth.js";
 import { fmt } from "../lib/format.js";
 // ─── mnemom team list ────────────────────────────────────────────────────
@@ -52,10 +52,7 @@ export async function teamListCommand(opts) {
     const idW = 38;
     const orgW = 22;
     const memberW = 8;
-    const header = "Name".padEnd(nameW) +
-        "Team ID".padEnd(idW) +
-        "Org".padEnd(orgW) +
-        "Members".padEnd(memberW);
+    const header = "Name".padEnd(nameW) + "Team ID".padEnd(idW) + "Org".padEnd(orgW) + "Members".padEnd(memberW);
     console.log(`  ${header}`);
     console.log(`  ${"─".repeat(nameW + idW + orgW + memberW)}`);
     for (const team of teams) {
@@ -241,7 +238,8 @@ export async function teamPreviewComposeCommand(teamId, opts) {
         // Read from stdin if no file specified.
         body = await readAllStdin();
         if (!body.trim()) {
-            console.log(fmt.error("No template body supplied. Pass --from <file> or pipe YAML/JSON via stdin.") + "\n");
+            console.log(fmt.error("No template body supplied. Pass --from <file> or pipe YAML/JSON via stdin.") +
+                "\n");
             process.exit(1);
             return;
         }
@@ -403,9 +401,7 @@ export async function teamAdminListCommand(teamId, opts) {
     const userW = 36;
     const grantedByW = 36;
     const grantedAtW = 22;
-    const header = "User ID".padEnd(userW) +
-        "Granted by".padEnd(grantedByW) +
-        "Granted at".padEnd(grantedAtW);
+    const header = "User ID".padEnd(userW) + "Granted by".padEnd(grantedByW) + "Granted at".padEnd(grantedAtW);
     console.log(`  ${header}`);
     console.log(`  ${"─".repeat(userW + grantedByW + grantedAtW)}`);
     for (const grant of result.admins) {
@@ -436,7 +432,6 @@ async function readAllStdin() {
 // last 30 days + last-swept heartbeat. Surfaces the data SOC 2 / EU AI Act
 // control mappings need to answer "show evidence the detector ran during
 // the audit window" — answers it from a single endpoint.
-import { getTeamSidebandCoverage, } from "../lib/api.js";
 import chalk from "chalk";
 function freshnessColor(lastSweptAt) {
     if (!lastSweptAt)

package/dist/commands/validate.js

@@ -14,7 +14,7 @@
  */
 import { fmt } from "../lib/format.js";
 import { requireAuth } from "../lib/auth.js";
-import { getSafeHouseHarnessState, } from "../lib/api.js";
+import { getSafeHouseHarnessState } from "../lib/api.js";
 /**
  * Parse `--max-age=...` strings: 30m, 2h, 24h, 1d, etc.
  * Returns milliseconds. Defaults to 24h.
@@ -112,7 +112,8 @@ export async function validateSafeHouseCommand(opts) {
         state = await getSafeHouseHarnessState();
     }
     catch (err) {
-        console.log(fmt.error(`Failed to fetch harness state: ${err instanceof Error ? err.message : err}`) + "\n");
+        console.log(fmt.error(`Failed to fetch harness state: ${err instanceof Error ? err.message : err}`) +
+            "\n");
         process.exit(1);
         return;
     }
@@ -123,8 +124,10 @@ export async function validateSafeHouseCommand(opts) {
     const fullVerdict = evaluateLane("full", state.full, maxAgeMs);
     const fastVerdict = evaluateLane("fast", state.fast, maxAgeMs);
     const wantedLane = opts.lane ?? "both";
-    const verdicts = wantedLane === "full" ? [fullVerdict]
-        : wantedLane === "fast" ? [fastVerdict]
+    const verdicts = wantedLane === "full"
+        ? [fullVerdict]
+        : wantedLane === "fast"
+            ? [fastVerdict]
             : [fullVerdict, fastVerdict];
     console.log(fmt.header(`Safe House harness — ${against}`));
     console.log("");

package/dist/commands/webhooks.d.ts

@@ -0,0 +1,61 @@
+/**
+ * `mnemom webhooks ...` commands — Track 2 W3.5.
+ *
+ *   mnemom webhooks list <org_id>                              — list endpoints
+ *   mnemom webhooks get <org_id> <endpoint_id>                 — show one
+ *   mnemom webhooks create <org_id> --url <u> [--events <list>]
+ *                                              [--description <d>]
+ *   mnemom webhooks update <org_id> <endpoint_id> [--url <u>]
+ *                                                  [--events <list>]
+ *                                                  [--active <bool>]
+ *   mnemom webhooks delete <org_id> <endpoint_id>              — remove endpoint
+ *   mnemom webhooks rotate-secret <org_id> <endpoint_id>       — mint new secret
+ *   mnemom webhooks list-deliveries <org_id> [--endpoint <id>] [--limit <n>]
+ *   mnemom webhooks redeliver <org_id> <delivery_id>           — retry one delivery
+ *   mnemom webhooks replay <org_id> <event_id> [--endpoint <id>...]
+ *   mnemom webhooks trigger <org_id> <endpoint_id>             — fire a test event
+ *
+ * Every mutation auto-generates a fresh `Idempotency-Key`. Re-running the
+ * same command does NOT replay the cache (you'd need to keep the key
+ * around for that — the curl/programmatic clients do); for the typical
+ * CLI ergonomic path, each invocation is its own logical mutation.
+ */
+export declare function webhooksListCommand(orgId: string, opts?: {
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksGetCommand(orgId: string, endpointId: string, opts?: {
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksCreateCommand(orgId: string, opts?: {
+    url?: string;
+    events?: string;
+    description?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksUpdateCommand(orgId: string, endpointId: string, opts?: {
+    url?: string;
+    events?: string;
+    description?: string;
+    active?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksDeleteCommand(orgId: string, endpointId: string): Promise<void>;
+export declare function webhooksRotateSecretCommand(orgId: string, endpointId: string, opts?: {
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksTriggerCommand(orgId: string, endpointId: string, opts?: {
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksListDeliveriesCommand(orgId: string, opts?: {
+    endpoint?: string;
+    limit?: string;
+    offset?: string;
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksRedeliverCommand(orgId: string, deliveryId: string, opts?: {
+    json?: boolean;
+}): Promise<void>;
+export declare function webhooksReplayCommand(orgId: string, eventId: string, opts?: {
+    endpoint?: string[];
+    json?: boolean;
+}): Promise<void>;