@mnemom/mnemom 0.11.0 → 0.12.1

package/dist/lib/auth.js

@@ -311,11 +311,7 @@ async function startCallbackServer(expectedState) {
     };
 }
 function openBrowser(url) {
-    const cmd = process.platform === "darwin"
-        ? "open"
-        : process.platform === "win32"
-            ? "start"
-            : "xdg-open";
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
     exec(`${cmd} ${JSON.stringify(url)}`);
 }
 // ============================================================================

package/dist/lib/listen-stream.d.ts

@@ -0,0 +1,40 @@
+/**
+ * SSE event-stream consumer for `mnemom listen` (Track 2 W3.4b).
+ *
+ * Parses `text/event-stream` framing into `SseFrame` objects per the
+ * W3C EventSource spec subset we need:
+ *
+ *   - Events delimited by `\n\n`.
+ *   - Lines starting with `:` are comments (heartbeats).
+ *   - `event: <name>` sets the frame's event name (default "message").
+ *   - `data: <json>` accumulates into a multi-line payload.
+ *   - `id: <cursor>` sets the frame's last-event-id.
+ *
+ * Exposed as a generator so callers can iterate with `for await`.
+ */
+export interface SseFrame {
+    event: string;
+    /** Multi-line `data:` payload joined with `\n`. */
+    data: string;
+    /** The `id:` cursor (for Last-Event-ID reconnect). */
+    id?: string;
+}
+/**
+ * Consume a fetch Response body and yield SSE frames.
+ *
+ * Buffers across chunk boundaries — SSE delimiters can land mid-chunk.
+ */
+export declare function parseSseStream(body: ReadableStream<Uint8Array>): AsyncGenerator<SseFrame, void, void>;
+/**
+ * Re-sign a webhook event body with a local-only secret. Mirrors the
+ * platform's HMAC-SHA256 over `${ts}.${rawBody}` convention so the
+ * receiver verifies cleanly with the same scheme.
+ *
+ * Used by `mnemom listen --forward-to <url> --secret <hex>` to make
+ * the local receiver behave identically to a production webhook
+ * subscriber.
+ */
+export declare function reSignDelivery(rawBody: string, signingSecret: string, nowSeconds?: number): {
+    timestamp: string;
+    signature: string;
+};

package/dist/lib/listen-stream.js

@@ -0,0 +1,101 @@
+/**
+ * SSE event-stream consumer for `mnemom listen` (Track 2 W3.4b).
+ *
+ * Parses `text/event-stream` framing into `SseFrame` objects per the
+ * W3C EventSource spec subset we need:
+ *
+ *   - Events delimited by `\n\n`.
+ *   - Lines starting with `:` are comments (heartbeats).
+ *   - `event: <name>` sets the frame's event name (default "message").
+ *   - `data: <json>` accumulates into a multi-line payload.
+ *   - `id: <cursor>` sets the frame's last-event-id.
+ *
+ * Exposed as a generator so callers can iterate with `for await`.
+ */
+import { createHmac } from "node:crypto";
+/**
+ * Consume a fetch Response body and yield SSE frames.
+ *
+ * Buffers across chunk boundaries — SSE delimiters can land mid-chunk.
+ */
+export async function* parseSseStream(body) {
+    const reader = body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    try {
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buf += decoder.decode(value, { stream: true });
+            // Frames end at \n\n. Process all complete frames; keep the trailing partial.
+            let idx;
+            while ((idx = buf.indexOf("\n\n")) !== -1) {
+                const frameRaw = buf.slice(0, idx);
+                buf = buf.slice(idx + 2);
+                const frame = parseFrame(frameRaw);
+                if (frame)
+                    yield frame;
+            }
+        }
+        // Drain trailing partial — usually a comment line right before the
+        // server-side close. Process if it parses cleanly.
+        if (buf.length > 0) {
+            const frame = parseFrame(buf);
+            if (frame)
+                yield frame;
+        }
+    }
+    finally {
+        try {
+            await reader.cancel();
+        }
+        catch {
+            /* socket already torn down */
+        }
+    }
+}
+function parseFrame(raw) {
+    const lines = raw.split("\n");
+    let event = "message";
+    let id;
+    const dataLines = [];
+    let hadDataField = false;
+    for (const line of lines) {
+        if (line.length === 0)
+            continue;
+        if (line.startsWith(":"))
+            continue; // heartbeat comment
+        const colonIdx = line.indexOf(":");
+        if (colonIdx === -1)
+            continue;
+        const field = line.slice(0, colonIdx);
+        const value = line.slice(colonIdx + 1).replace(/^ /, ""); // strip optional leading space
+        if (field === "event")
+            event = value;
+        else if (field === "data") {
+            dataLines.push(value);
+            hadDataField = true;
+        }
+        else if (field === "id")
+            id = value;
+    }
+    if (!hadDataField)
+        return null;
+    return { event, data: dataLines.join("\n"), id };
+}
+// ─── HMAC re-signing for local forwarding ───────────────────────────────
+/**
+ * Re-sign a webhook event body with a local-only secret. Mirrors the
+ * platform's HMAC-SHA256 over `${ts}.${rawBody}` convention so the
+ * receiver verifies cleanly with the same scheme.
+ *
+ * Used by `mnemom listen --forward-to <url> --secret <hex>` to make
+ * the local receiver behave identically to a production webhook
+ * subscriber.
+ */
+export function reSignDelivery(rawBody, signingSecret, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const timestamp = String(nowSeconds);
+    const signature = "v1=" + createHmac("sha256", signingSecret).update(`${timestamp}.${rawBody}`).digest("hex");
+    return { timestamp, signature };
+}

package/dist/lib/webhooks-api.d.ts

@@ -0,0 +1,80 @@
+export interface WebhookEndpoint {
+    endpoint_id: string;
+    billing_account_id: string;
+    url: string;
+    description: string;
+    signing_secret?: string;
+    event_types: string[];
+    is_active: boolean;
+    consecutive_failures: number;
+    disabled_at: string | null;
+    disabled_reason: string | null;
+    created_at: string;
+    updated_at: string;
+}
+export interface WebhookDelivery {
+    delivery_id: string;
+    event_id: string;
+    endpoint_id: string;
+    status: string;
+    attempt_count?: number;
+    last_attempt_at?: string | null;
+    next_attempt_at?: string | null;
+    last_status_code?: number | null;
+    last_error?: string | null;
+    created_at?: string;
+}
+export interface WebhookReplayResponse {
+    event_id: string;
+    event_type: string;
+    deliveries: Array<{
+        delivery_id: string;
+        endpoint_id: string;
+    }>;
+    failed_endpoints?: Array<{
+        endpoint_id: string;
+        error: string;
+    }>;
+    message?: string;
+}
+export interface TestDeliveryResult {
+    success: boolean;
+    status: number | null;
+    latency_ms: number | null;
+    error: string | null;
+}
+export declare function listWebhookEndpoints(orgId: string): Promise<WebhookEndpoint[]>;
+export declare function getWebhookEndpoint(orgId: string, endpointId: string): Promise<WebhookEndpoint>;
+export declare function createWebhookEndpoint(orgId: string, body: {
+    url: string;
+    description?: string;
+    event_types?: string[];
+}): Promise<WebhookEndpoint>;
+export declare function updateWebhookEndpoint(orgId: string, endpointId: string, body: {
+    url?: string;
+    description?: string;
+    event_types?: string[];
+    is_active?: boolean;
+}): Promise<WebhookEndpoint>;
+export declare function deleteWebhookEndpoint(orgId: string, endpointId: string): Promise<{
+    deleted: true;
+    endpoint_id: string;
+}>;
+export declare function rotateWebhookSecret(orgId: string, endpointId: string): Promise<{
+    endpoint_id: string;
+    signing_secret: string;
+}>;
+export declare function testWebhookEndpoint(orgId: string, endpointId: string): Promise<TestDeliveryResult>;
+export declare function listWebhookDeliveries(orgId: string, opts?: {
+    endpointId?: string;
+    limit?: number;
+    offset?: number;
+}): Promise<WebhookDelivery[]>;
+export declare function redeliverWebhookEvent(orgId: string, deliveryId: string): Promise<{
+    delivery_id: string;
+    event_id: string;
+    status: string;
+}>;
+export declare function replayWebhookEvent(orgId: string, eventId: string, opts?: {
+    endpointIds?: string[];
+}): Promise<WebhookReplayResponse>;

package/dist/lib/webhooks-api.js

@@ -0,0 +1,172 @@
+/**
+ * Webhook lifecycle API client for the Mnemom CLI.
+ *
+ * Wraps `/v1/orgs/:org_id/webhooks*` endpoints. Every mutation includes
+ * a fresh `Idempotency-Key` per the post-W2.x server contract — see
+ * `mnemom-api/src/webhooks/handlers.ts` for the requirement.
+ */
+import { getApiUrl } from "./config.js";
+import { newIdempotencyKey } from "./api.js";
+import { resolveAuth, forceRefreshAccessToken } from "./auth.js";
+const API_BASE = getApiUrl();
+function validateUrl(url) {
+    const parsed = new URL(url);
+    if (parsed.protocol !== "https:" && parsed.protocol !== "http:") {
+        throw new Error(`Invalid URL protocol: ${parsed.protocol}`);
+    }
+    return parsed.href;
+}
+async function authHeaders() {
+    const cred = await resolveAuth();
+    switch (cred.type) {
+        case "jwt":
+            return { Authorization: `Bearer ${cred.token}` };
+        case "api-key":
+            return { "X-Mnemom-Api-Key": cred.key };
+        case "none":
+            return {};
+    }
+}
+async function fetchWithAuthRetry(url, buildInit) {
+    const first = await fetch(url, await buildInit());
+    if (first.status !== 401)
+        return first;
+    const refreshed = await forceRefreshAccessToken();
+    if (!refreshed)
+        return first;
+    return fetch(url, await buildInit());
+}
+async function unwrap(response, action) {
+    if (!response.ok) {
+        if (response.status === 401) {
+            throw new Error("Not authenticated. Run `mnemom login` or set MNEMOM_API_KEY.");
+        }
+        const err = (await response.json().catch(() => ({})));
+        const msg = err.message || err.error || `${action} failed: HTTP ${response.status}`;
+        throw new Error(`${response.status}: ${msg}`);
+    }
+    return (await response.json());
+}
+// ─── List + get ──────────────────────────────────────────────────────────
+export async function listWebhookEndpoints(orgId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: { ...(await authHeaders()), Accept: "application/json" },
+    }));
+    return unwrap(response, "List webhook endpoints");
+}
+export async function getWebhookEndpoint(orgId, endpointId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/${endpointId}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: { ...(await authHeaders()), Accept: "application/json" },
+    }));
+    return unwrap(response, `Get webhook endpoint '${endpointId}'`);
+}
+// ─── Create / update / delete ────────────────────────────────────────────
+export async function createWebhookEndpoint(orgId, body) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+        body: JSON.stringify(body),
+    }));
+    return unwrap(response, "Create webhook endpoint");
+}
+export async function updateWebhookEndpoint(orgId, endpointId, body) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/${endpointId}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "PATCH",
+        headers: {
+            ...(await authHeaders()),
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+        body: JSON.stringify(body),
+    }));
+    return unwrap(response, `Update webhook endpoint '${endpointId}'`);
+}
+export async function deleteWebhookEndpoint(orgId, endpointId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/${endpointId}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "DELETE",
+        headers: {
+            ...(await authHeaders()),
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+    }));
+    return unwrap(response, `Delete webhook endpoint '${endpointId}'`);
+}
+// ─── Operate ─────────────────────────────────────────────────────────────
+export async function rotateWebhookSecret(orgId, endpointId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/${endpointId}/rotate-secret`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+    }));
+    return unwrap(response, `Rotate signing secret for '${endpointId}'`);
+}
+export async function testWebhookEndpoint(orgId, endpointId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/${endpointId}/test`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+    }));
+    return unwrap(response, `Test webhook endpoint '${endpointId}'`);
+}
+export async function listWebhookDeliveries(orgId, opts = {}) {
+    const params = new URLSearchParams();
+    if (opts.endpointId)
+        params.set("endpoint_id", opts.endpointId);
+    if (opts.limit !== undefined)
+        params.set("limit", String(opts.limit));
+    if (opts.offset !== undefined)
+        params.set("offset", String(opts.offset));
+    const qs = params.toString();
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/deliveries${qs ? `?${qs}` : ""}`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: { ...(await authHeaders()), Accept: "application/json" },
+    }));
+    return unwrap(response, "List webhook deliveries");
+}
+export async function redeliverWebhookEvent(orgId, deliveryId) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/deliveries/${deliveryId}/redeliver`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+    }));
+    return unwrap(response, `Redeliver webhook event '${deliveryId}'`);
+}
+export async function replayWebhookEvent(orgId, eventId, opts = {}) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${orgId}/webhooks/events/${eventId}/replay`);
+    const body = opts.endpointIds && opts.endpointIds.length > 0 ? { endpoint_ids: opts.endpointIds } : {};
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: {
+            ...(await authHeaders()),
+            "Content-Type": "application/json",
+            Accept: "application/json",
+            "Idempotency-Key": newIdempotencyKey(),
+        },
+        body: JSON.stringify(body),
+    }));
+    return unwrap(response, `Replay event '${eventId}'`);
+}

package/dist/smoltbot-shim.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 // smoltbot is deprecated — this shim prints a warning then hands off to mnemom
-process.stderr.write('\n⚠️  The smoltbot command is deprecated. Use mnemom instead.\n' +
-    '   Install: npm install -g @mnemom/mnemom\n\n');
+process.stderr.write("\n⚠️  The smoltbot command is deprecated. Use mnemom instead.\n" +
+    "   Install: npm install -g @mnemom/mnemom\n\n");
 // Dynamic import runs index.ts which calls program.parse(process.argv) automatically
-await import('./index.js');
+await import("./index.js");
 export {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mnemom/mnemom",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "Transparent AI agent tracing",
   "type": "module",
   "bin": {

package/dist/lib/model-cache.d.ts

@@ -1,16 +0,0 @@
-import type { ModelDefinition, Provider } from "./openclaw.js";
-/**
- * Refresh the model cache in the background.
- * Fetches from the gateway and saves to disk.
- * Fails silently — never blocks the caller.
- */
-export declare function refreshModelCache(): Promise<void>;
-/**
- * Get a model definition, checking: static registry -> cache -> inference fallback.
- * This is the primary entry point for looking up model definitions.
- */
-export declare function getCachedModelDefinition(modelId: string): ModelDefinition;
-/**
- * Get all known models from both static registry and cache.
- */
-export declare function getAllCachedModels(): Record<Provider, Record<string, ModelDefinition>>;

package/dist/lib/model-cache.js

@@ -1,137 +0,0 @@
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { MODEL_REGISTRY, getModelDefinition as getStaticModelDefinition } from "./models.js";
-import { MNEMOM_DIR } from "./config.js";
-const CACHE_FILE = path.join(MNEMOM_DIR, "models-cache.json");
-const MODELS_URL = "https://gateway.mnemom.ai/models.json";
-const CACHE_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours
-/**
- * Load the cached model registry from disk.
- * Returns null if cache doesn't exist or is expired.
- */
-function loadCache() {
-    if (!fs.existsSync(CACHE_FILE)) {
-        return null;
-    }
-    try {
-        const content = fs.readFileSync(CACHE_FILE, "utf-8");
-        const cache = JSON.parse(content);
-        // Check TTL
-        const fetchedAt = new Date(cache.fetchedAt).getTime();
-        if (Date.now() - fetchedAt > CACHE_TTL_MS) {
-            return null; // Expired
-        }
-        return cache;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Save model registry to disk cache.
- */
-function saveCache(models) {
-    if (!models || typeof models !== "object") {
-        return;
-    }
-    // Ensure directory exists
-    if (!fs.existsSync(MNEMOM_DIR)) {
-        fs.mkdirSync(MNEMOM_DIR, { recursive: true });
-    }
-    // Validate write path stays within expected directory
-    const resolvedCachePath = path.resolve(CACHE_FILE);
-    if (!resolvedCachePath.startsWith(path.resolve(MNEMOM_DIR))) {
-        throw new Error("Cache file path escapes expected directory");
-    }
-    // Re-serialize HTTP-sourced data to sanitize before writing to disk
-    const sanitizedModels = JSON.parse(JSON.stringify(models));
-    const cache = {
-        fetchedAt: new Date().toISOString(),
-        models: sanitizedModels,
-    };
-    // Atomic write: temp file + rename to prevent corruption
-    const tmpFile = `${resolvedCachePath}.${process.pid}.tmp`;
-    fs.writeFileSync(tmpFile, JSON.stringify(cache, null, 2));
-    fs.renameSync(tmpFile, resolvedCachePath);
-}
-/**
- * Fetch fresh model registry from the gateway.
- * Fails silently on network errors — returns null.
- */
-async function fetchRemoteModels() {
-    try {
-        const response = await fetch(MODELS_URL, {
-            signal: AbortSignal.timeout(5000),
-        });
-        if (!response.ok) {
-            return null;
-        }
-        const data = (await response.json());
-        // Basic validation
-        if (!data.anthropic && !data.openai && !data.gemini) {
-            return null;
-        }
-        return data;
-    }
-    catch {
-        return null;
-    }
-}
-/**
- * Refresh the model cache in the background.
- * Fetches from the gateway and saves to disk.
- * Fails silently — never blocks the caller.
- */
-export async function refreshModelCache() {
-    const remote = await fetchRemoteModels();
-    if (remote) {
-        saveCache(remote);
-    }
-}
-/**
- * Get a model definition, checking: static registry -> cache -> inference fallback.
- * This is the primary entry point for looking up model definitions.
- */
-export function getCachedModelDefinition(modelId) {
-    // 1. Check static registry first (always up to date with code)
-    for (const provider of Object.values(MODEL_REGISTRY)) {
-        const known = provider[modelId];
-        if (known)
-            return known;
-    }
-    // 2. Check disk cache
-    const cache = loadCache();
-    if (cache) {
-        for (const provider of Object.values(cache.models)) {
-            const cached = provider[modelId];
-            if (cached)
-                return cached;
-        }
-    }
-    // 3. Fall back to inference (same as static getModelDefinition)
-    return getStaticModelDefinition(modelId);
-}
-/**
- * Get all known models from both static registry and cache.
- */
-export function getAllCachedModels() {
-    const result = {
-        anthropic: { ...MODEL_REGISTRY.anthropic },
-        openai: { ...MODEL_REGISTRY.openai },
-        gemini: { ...MODEL_REGISTRY.gemini },
-    };
-    // Merge cache (cache entries don't override static entries)
-    const cache = loadCache();
-    if (cache) {
-        for (const [provider, models] of Object.entries(cache.models)) {
-            if (!result[provider])
-                continue;
-            for (const [id, model] of Object.entries(models)) {
-                if (!(id in result[provider])) {
-                    result[provider][id] = model;
-                }
-            }
-        }
-    }
-    return result;
-}

package/dist/lib/models.d.ts

@@ -1,41 +0,0 @@
-import type { ModelDefinition, Provider } from "./openclaw.js";
-/**
- * Multi-provider model registry.
- * Focuses on top-tier reasoning models that OpenClaws use as substrates.
- */
-export declare const MODEL_REGISTRY: Record<Provider, Record<string, ModelDefinition>>;
-/**
- * Backward-compatible re-export of Anthropic models.
- */
-export declare const ANTHROPIC_MODELS: Record<string, ModelDefinition>;
-/**
- * Detect provider from a model ID string.
- */
-export declare function detectProvider(modelId: string): Provider | null;
-/**
- * Get model definition by ID — searches all providers.
- * Returns the definition if known, or creates a basic one if unknown.
- */
-export declare function getModelDefinition(modelId: string): ModelDefinition;
-/**
- * Check if a model ID is a known model (any provider).
- */
-export declare function isKnownModel(modelId: string): boolean;
-/**
- * Check if a model ID looks like an Anthropic model.
- */
-export declare function isAnthropicModel(modelId: string): boolean;
-/**
- * Format a model ID into a human-readable name.
- * Handles Anthropic, OpenAI, and Gemini model ID formats.
- */
-export declare function formatModelName(modelId: string): string;
-/**
- * Get all known model IDs across all providers.
- */
-export declare function getAllKnownModelIds(): string[];
-/**
- * Get the latest models per provider.
- * Returns { anthropic: [...], openai: [...], gemini: [...] }
- */
-export declare function getLatestModels(): Record<Provider, ModelDefinition[]>;