@mnemom/mnemom 0.17.31 → 0.17.32-next.1

package/dist/lib/conduct-receipt.d.ts

@@ -0,0 +1,81 @@
+/**
+ * The conduct receipt (experimental `record`, Doors W1.2 / W1.3): the engineer's private view of
+ * one session, printed when `mnemom agent` exits and when a durable session parks.
+ *
+ *   Conduct receipt
+ *     model cost  $0.42
+ *     μ           12.5
+ *
+ * Every figure is measured, never estimated (decision 14): model cost and μ are the session
+ * lineage's `record_accumulator` totals, read from `GET /v1/orgs/{org}/record/totals`. μ reads
+ * "μ pending" until billing has committed a charge for the lineage (the route's null), and the
+ * receipt then gives a link instead of a number.
+ *
+ * NEVER BLOCKS EXIT. The whole read, auth refresh included, races a hard deadline
+ * (RECEIPT_DEADLINE_MS): with the API or the record builder down, exit takes at most that much
+ * longer, and the receipt falls back to the link. The caller keeps its exit code; nothing here
+ * throws.
+ *
+ * The lineage key is the gateway's (x-mnemom-lineage-key, set on every response), captured by the
+ * local base-URL proxy into a state file: the CLI never derives one itself.
+ */
+/** The hard ceiling on what the receipt adds to exit (W1.3: at most 2 s). */
+export declare const RECEIPT_DEADLINE_MS = 1800;
+/** Pause between totals reads while μ is still pending. */
+export declare const RECEIPT_POLL_MS = 400;
+/** What the local proxy saw on the session's responses (base-url-proxy.mjs, record state). */
+export interface RecordState {
+    lineageKey?: string;
+    recordUrl?: string;
+}
+/** A totals read: the route's two amounts, or why there are none. */
+export type TotalsRead = {
+    kind: "ok";
+    modelCostMmu: bigint;
+    muChargedMmu: bigint | null;
+} | {
+    kind: "unavailable";
+};
+export interface ReceiptDeps {
+    /** One totals read for the lineage; may throw or hang (both are "unavailable"). */
+    readTotals: (lineageKey: string, signal: AbortSignal) => Promise<TotalsRead>;
+    /** The page the receipt links to when no record URL was captured (the agent dashboard). */
+    fallbackUrl: string;
+    now?: () => number;
+    sleep?: (ms: number) => Promise<void>;
+    deadlineMs?: number;
+    pollMs?: number;
+}
+/** Read the proxy's record-state file; a missing or malformed file is an empty state. */
+export declare function readRecordState(path: string | undefined): RecordState;
+/** Keep only a well-formed lineage key and an https record URL. */
+export declare function sanitizeRecordState(raw: Record<string, unknown>): RecordState;
+/** Parse the totals route body; anything off-contract is "unavailable", never a guessed figure. */
+export declare function parseTotals(body: unknown): TotalsRead;
+/** `$0.42`; a non-zero cost under a cent reads `< $0.01`, never `$0.00`. */
+export declare function formatUsd(mmu: bigint): string;
+/** μ to at most three decimals, trailing zeros dropped: 12500 mmu → `12.5`. */
+export declare function formatMu(mmu: bigint): string;
+/** The receipt lines for what was read (pure). */
+export declare function receiptLines(read: TotalsRead | null, link: string, trigger?: "exit" | "park"): string[];
+/**
+ * Read the lineage's totals until μ is final or the deadline passes, then return the receipt.
+ * Never throws and never waits past `deadlineMs`.
+ */
+export declare function buildConductReceipt(state: RecordState, deps: ReceiptDeps, trigger?: "exit" | "park"): Promise<string[]>;
+/** Where the receipt's launch facts come from (the launcher at exit; Durable at park). */
+export interface ReceiptLaunch {
+    orgId: string;
+    /** The served agent id: the fallback link is its dashboard page. */
+    agentId: string;
+    /** The proxy's record-state file (absent: no lineage was captured). */
+    statePath?: string;
+}
+/**
+ * The receipt for a launch, against the real API (the exit and park call sites).
+ *
+ * The deadline bounds what the caller waits for, not every network call: on a 401 the auth
+ * refresh (fetchWithAuthRetry) takes no signal and may outlive the receipt. The exit path
+ * process.exit()s right after; a long-lived caller (a durable park) may see it finish later.
+ */
+export declare function conductReceiptFor(launch: ReceiptLaunch, trigger?: "exit" | "park", deps?: Partial<ReceiptDeps>): Promise<string[]>;

package/dist/lib/conduct-receipt.js

@@ -0,0 +1,177 @@
+/**
+ * The conduct receipt (experimental `record`, Doors W1.2 / W1.3): the engineer's private view of
+ * one session, printed when `mnemom agent` exits and when a durable session parks.
+ *
+ *   Conduct receipt
+ *     model cost  $0.42
+ *     μ           12.5
+ *
+ * Every figure is measured, never estimated (decision 14): model cost and μ are the session
+ * lineage's `record_accumulator` totals, read from `GET /v1/orgs/{org}/record/totals`. μ reads
+ * "μ pending" until billing has committed a charge for the lineage (the route's null), and the
+ * receipt then gives a link instead of a number.
+ *
+ * NEVER BLOCKS EXIT. The whole read, auth refresh included, races a hard deadline
+ * (RECEIPT_DEADLINE_MS): with the API or the record builder down, exit takes at most that much
+ * longer, and the receipt falls back to the link. The caller keeps its exit code; nothing here
+ * throws.
+ *
+ * The lineage key is the gateway's (x-mnemom-lineage-key, set on every response), captured by the
+ * local base-URL proxy into a state file: the CLI never derives one itself.
+ */
+import { readFileSync } from "node:fs";
+import { getRecordTotals } from "./api.js";
+import { getWebsiteUrl } from "./config.js";
+/** The hard ceiling on what the receipt adds to exit (W1.3: at most 2 s). */
+export const RECEIPT_DEADLINE_MS = 1800;
+/** Pause between totals reads while μ is still pending. */
+export const RECEIPT_POLL_MS = 400;
+/** 1 MU = 1000 mmu; 1 USD = 100 000 mmu (mnemom-api src/billing/pricing.ts MMU_PER_USD). */
+const MMU_PER_MU = 1000n;
+const MMU_PER_USD = 100000n;
+const LINEAGE_KEY_RE = /^[A-Za-z0-9:._-]{1,256}$/;
+const MMU_RE = /^(0|[1-9][0-9]{0,18})$/;
+/** Read the proxy's record-state file; a missing or malformed file is an empty state. */
+export function readRecordState(path) {
+    if (!path)
+        return {};
+    try {
+        const raw = JSON.parse(readFileSync(path, "utf8"));
+        return sanitizeRecordState(raw);
+    }
+    catch {
+        return {};
+    }
+}
+/** Keep only a well-formed lineage key and an https record URL. */
+export function sanitizeRecordState(raw) {
+    const out = {};
+    if (typeof raw.lineage_key === "string" && LINEAGE_KEY_RE.test(raw.lineage_key)) {
+        out.lineageKey = raw.lineage_key;
+    }
+    if (typeof raw.record_url === "string" && isHttpsUrl(raw.record_url)) {
+        out.recordUrl = raw.record_url;
+    }
+    return out;
+}
+/** Printable ASCII only: the URL is printed to the user's terminal, so no escape bytes. */
+const PRINTABLE_URL_RE = /^https:\/\/[\x21-\x7e]+$/;
+function isHttpsUrl(s) {
+    if (s.length > 2048 || !PRINTABLE_URL_RE.test(s))
+        return false;
+    try {
+        return new URL(s).protocol === "https:";
+    }
+    catch {
+        return false;
+    }
+}
+/** Parse the totals route body; anything off-contract is "unavailable", never a guessed figure. */
+export function parseTotals(body) {
+    if (!body || typeof body !== "object")
+        return { kind: "unavailable" };
+    const b = body;
+    if (typeof b.model_cost_mmu !== "string" || !MMU_RE.test(b.model_cost_mmu)) {
+        return { kind: "unavailable" };
+    }
+    let mu = null;
+    if (b.mu_charged_mmu !== null) {
+        if (typeof b.mu_charged_mmu !== "string" || !MMU_RE.test(b.mu_charged_mmu)) {
+            return { kind: "unavailable" };
+        }
+        mu = BigInt(b.mu_charged_mmu);
+    }
+    return { kind: "ok", modelCostMmu: BigInt(b.model_cost_mmu), muChargedMmu: mu };
+}
+/** `$0.42`; a non-zero cost under a cent reads `< $0.01`, never `$0.00`. */
+export function formatUsd(mmu) {
+    if (mmu > 0n && mmu * 100n < MMU_PER_USD)
+        return "< $0.01";
+    const cents = (mmu * 100n + MMU_PER_USD / 2n) / MMU_PER_USD;
+    return `$${cents / 100n}.${String(cents % 100n).padStart(2, "0")}`;
+}
+/** μ to at most three decimals, trailing zeros dropped: 12500 mmu → `12.5`. */
+export function formatMu(mmu) {
+    const whole = mmu / MMU_PER_MU;
+    const frac = String(mmu % MMU_PER_MU)
+        .padStart(3, "0")
+        .replace(/0+$/, "");
+    return frac ? `${whole}.${frac}` : `${whole}`;
+}
+/** The receipt lines for what was read (pure). */
+export function receiptLines(read, link, trigger = "exit") {
+    const head = trigger === "park" ? "Conduct receipt (parked)" : "Conduct receipt";
+    if (!read || read.kind === "unavailable") {
+        return [head, `  record not available yet: ${link}`];
+    }
+    const lines = [head, `  model cost  ${formatUsd(read.modelCostMmu)}`];
+    if (read.muChargedMmu === null)
+        lines.push(`  μ pending   ${link}`);
+    else
+        lines.push(`  μ           ${formatMu(read.muChargedMmu)}`);
+    return lines;
+}
+/**
+ * Read the lineage's totals until μ is final or the deadline passes, then return the receipt.
+ * Never throws and never waits past `deadlineMs`.
+ */
+export async function buildConductReceipt(state, deps, trigger = "exit") {
+    const link = state.recordUrl ?? deps.fallbackUrl;
+    if (!state.lineageKey)
+        return receiptLines(null, link, trigger);
+    const now = deps.now ?? Date.now;
+    const sleep = deps.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const deadline = now() + (deps.deadlineMs ?? RECEIPT_DEADLINE_MS);
+    const pollMs = deps.pollMs ?? RECEIPT_POLL_MS;
+    const lineageKey = state.lineageKey;
+    let last = null;
+    for (;;) {
+        const left = deadline - now();
+        if (left <= 0)
+            break;
+        const read = await readWithin(deps.readTotals, lineageKey, left);
+        // A later failure never hides an earlier good read.
+        if (read.kind === "ok" || !last)
+            last = read;
+        if (read.kind === "ok" && read.muChargedMmu !== null)
+            break;
+        if (deadline - now() <= pollMs)
+            break;
+        await sleep(pollMs);
+    }
+    return receiptLines(last, link, trigger);
+}
+async function readWithin(readTotals, lineageKey, ms) {
+    const ac = new AbortController();
+    let timer;
+    const timeout = new Promise((resolve) => {
+        timer = setTimeout(() => {
+            ac.abort();
+            resolve({ kind: "unavailable" });
+        }, ms);
+    });
+    try {
+        return await Promise.race([
+            readTotals(lineageKey, ac.signal).catch(() => ({ kind: "unavailable" })),
+            timeout,
+        ]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * The receipt for a launch, against the real API (the exit and park call sites).
+ *
+ * The deadline bounds what the caller waits for, not every network call: on a 401 the auth
+ * refresh (fetchWithAuthRetry) takes no signal and may outlive the receipt. The exit path
+ * process.exit()s right after; a long-lived caller (a durable park) may see it finish later.
+ */
+export async function conductReceiptFor(launch, trigger = "exit", deps = {}) {
+    return buildConductReceipt(readRecordState(launch.statePath), {
+        ...deps,
+        readTotals: deps.readTotals ??
+            (async (lineageKey, signal) => parseTotals(await getRecordTotals(launch.orgId, lineageKey, signal))),
+        fallbackUrl: deps.fallbackUrl ?? `${getWebsiteUrl()}/agents/${encodeURIComponent(launch.agentId)}`,
+    }, trigger);
+}

package/dist/lib/contract-hash.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The contract's full sha256 and seal-time check, as the gateway computes them (Doors W3.5).
+ *
+ * Callers that hash contracts outside the gateway (the fuel step's CLI verb and the thin runner,
+ * each in its own change) use this module. It computes a contract's hash, its committed file's
+ * bytes and its repo path; writing the file is the caller's job. It ports the gateway's
+ * `normaliseContractObject` / `checkContractObject` / `canonicalHash` (gateway/src/goal-contract.ts). The full sha256 is the digest whose first 16
+ * hex characters are the gateway's `x-mnemom-contract-hash`: sha256 of the canonical JSON of the
+ * normalised contract, with a default `"nudge"` mode dropped and `"enforce"` kept. The 8 KB
+ * limit is measured, like the gateway's, on the canonical JSON with the mode still present.
+ *
+ * `gateway/test/fixtures/contract-sha256-parity.json` pins the gateway's own outputs; the CLI's
+ * parity suite and mnemom-api's (`src/contract-step/hash.ts`) read the same cases.
+ */
+/** The gateway's `CONTRACT_JSON_MAX`: bytes of canonical JSON of the normalised contract. */
+export declare const CONTRACT_JSON_MAX = 8192;
+/** The gateway's `STATEMENT_MAX` (its `USER_CLIP`), in characters. */
+export declare const STATEMENT_MAX = 4000;
+export type ContractMode = "nudge" | "enforce";
+/** pv2 SealedContract, the shape the gateway seals from `x-mnemom-contract`. */
+export interface Contract {
+    goal_id?: string;
+    statement: string;
+    requirements: string[];
+    allowed_paths: string[];
+    forbidden_paths: string[];
+    max_turns?: number;
+    budget_usd?: number;
+    stall_turns?: number;
+    time_limit_s?: number;
+    mode?: ContractMode;
+}
+export type ContractRejectReason = "unparseable" | "statement_missing" | "statement_too_long" | "contract_too_large" | "mode_invalid";
+export type ContractCheck = {
+    ok: true;
+    contract: Contract;
+} | {
+    ok: false;
+    reason: ContractRejectReason;
+    message: string;
+};
+/** The gateway's `normaliseContractObject`: null without a non-empty statement. Mode defaults to "nudge". */
+export declare function normaliseContract(obj: Record<string, unknown>): Contract | null;
+/** The gateway's seal-time gate (`checkContractObject`), with the same reasons. */
+export declare function checkContract(value: unknown, label?: string): ContractCheck;
+/** Bytes the 8 KB limit measures: canonical JSON of the normalised contract, mode included. */
+export declare function contractSizeBytes(contract: Contract): number;
+/** The hash form: a default "nudge" mode dropped, "enforce" kept (the gateway's `canonicalHash`). */
+export declare function hashForm(contract: Contract): Contract;
+/**
+ * The committed contract file's exact bytes: canonical JSON of the hash form, no trailing newline,
+ * so sha256 of the file equals `contractSha256`.
+ */
+export declare function contractFileText(contract: Contract): string;
+/** Full lowercase-hex sha256. Its first 16 characters are the gateway's `x-mnemom-contract-hash`. */
+export declare function contractSha256(contract: Contract): string;
+/**
+ * Where a sealed contract is committed in the repo: content-addressed by its full sha256. Throws
+ * on anything but 64 lowercase hex characters, so the path can never leave `.mnemom/contracts/`.
+ */
+export declare function contractRepoPath(sha256: string): string;

package/dist/lib/contract-hash.js

@@ -0,0 +1,126 @@
+/**
+ * The contract's full sha256 and seal-time check, as the gateway computes them (Doors W3.5).
+ *
+ * Callers that hash contracts outside the gateway (the fuel step's CLI verb and the thin runner,
+ * each in its own change) use this module. It computes a contract's hash, its committed file's
+ * bytes and its repo path; writing the file is the caller's job. It ports the gateway's
+ * `normaliseContractObject` / `checkContractObject` / `canonicalHash` (gateway/src/goal-contract.ts). The full sha256 is the digest whose first 16
+ * hex characters are the gateway's `x-mnemom-contract-hash`: sha256 of the canonical JSON of the
+ * normalised contract, with a default `"nudge"` mode dropped and `"enforce"` kept. The 8 KB
+ * limit is measured, like the gateway's, on the canonical JSON with the mode still present.
+ *
+ * `gateway/test/fixtures/contract-sha256-parity.json` pins the gateway's own outputs; the CLI's
+ * parity suite and mnemom-api's (`src/contract-step/hash.ts`) read the same cases.
+ */
+import { createHash } from "node:crypto";
+import { canonicalJson } from "./canonical-json.js";
+/** The gateway's `CONTRACT_JSON_MAX`: bytes of canonical JSON of the normalised contract. */
+export const CONTRACT_JSON_MAX = 8_192;
+/** The gateway's `STATEMENT_MAX` (its `USER_CLIP`), in characters. */
+export const STATEMENT_MAX = 4_000;
+const MODES = new Set(["nudge", "enforce"]);
+function stringArray(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value.filter((v) => typeof v === "string" && v.trim().length > 0);
+}
+function positiveFinite(value) {
+    return typeof value === "number" && Number.isFinite(value) && value > 0 ? value : undefined;
+}
+/** The gateway's `normaliseContractObject`: null without a non-empty statement. Mode defaults to "nudge". */
+export function normaliseContract(obj) {
+    const statement = typeof obj.statement === "string" ? obj.statement.trim() : "";
+    if (!statement)
+        return null;
+    const contract = {
+        statement,
+        requirements: stringArray(obj.requirements),
+        allowed_paths: stringArray(obj.allowed_paths),
+        forbidden_paths: stringArray(obj.forbidden_paths),
+    };
+    if (typeof obj.goal_id === "string" && obj.goal_id.trim())
+        contract.goal_id = obj.goal_id.trim();
+    const maxTurns = positiveFinite(obj.max_turns);
+    if (maxTurns !== undefined)
+        contract.max_turns = maxTurns;
+    const budgetUsd = positiveFinite(obj.budget_usd);
+    if (budgetUsd !== undefined)
+        contract.budget_usd = budgetUsd;
+    const stallTurns = positiveFinite(obj.stall_turns);
+    if (stallTurns !== undefined)
+        contract.stall_turns = stallTurns;
+    const timeLimitS = positiveFinite(obj.time_limit_s);
+    if (timeLimitS !== undefined)
+        contract.time_limit_s = timeLimitS;
+    contract.mode = MODES.has(obj.mode) ? obj.mode : "nudge";
+    return contract;
+}
+/** The gateway's seal-time gate (`checkContractObject`), with the same reasons. */
+export function checkContract(value, label = "contract") {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return { ok: false, reason: "unparseable", message: `${label} must be a JSON object` };
+    }
+    const obj = value;
+    const contract = normaliseContract(obj);
+    if (!contract) {
+        return {
+            ok: false,
+            reason: "statement_missing",
+            message: `${label} needs a non-empty "statement"`,
+        };
+    }
+    if (contract.statement.length > STATEMENT_MAX) {
+        return {
+            ok: false,
+            reason: "statement_too_long",
+            message: `"statement" is ${contract.statement.length} characters; the maximum is ${STATEMENT_MAX}`,
+        };
+    }
+    if (obj.mode !== undefined && !MODES.has(obj.mode)) {
+        return {
+            ok: false,
+            reason: "mode_invalid",
+            message: `"mode" must be "nudge" or "enforce" (got ${JSON.stringify(obj.mode)})`,
+        };
+    }
+    const bytes = contractSizeBytes(contract);
+    if (bytes > CONTRACT_JSON_MAX) {
+        return {
+            ok: false,
+            reason: "contract_too_large",
+            message: `the contract is ${bytes} bytes of canonical JSON; the maximum is ${CONTRACT_JSON_MAX}`,
+        };
+    }
+    return { ok: true, contract };
+}
+/** Bytes the 8 KB limit measures: canonical JSON of the normalised contract, mode included. */
+export function contractSizeBytes(contract) {
+    return Buffer.byteLength(canonicalJson(contract), "utf8");
+}
+/** The hash form: a default "nudge" mode dropped, "enforce" kept (the gateway's `canonicalHash`). */
+export function hashForm(contract) {
+    const form = { ...contract };
+    if ((contract.mode ?? "nudge") === "nudge")
+        delete form.mode;
+    return form;
+}
+/**
+ * The committed contract file's exact bytes: canonical JSON of the hash form, no trailing newline,
+ * so sha256 of the file equals `contractSha256`.
+ */
+export function contractFileText(contract) {
+    return canonicalJson(hashForm(contract));
+}
+/** Full lowercase-hex sha256. Its first 16 characters are the gateway's `x-mnemom-contract-hash`. */
+export function contractSha256(contract) {
+    return createHash("sha256").update(contractFileText(contract), "utf8").digest("hex");
+}
+/**
+ * Where a sealed contract is committed in the repo: content-addressed by its full sha256. Throws
+ * on anything but 64 lowercase hex characters, so the path can never leave `.mnemom/contracts/`.
+ */
+export function contractRepoPath(sha256) {
+    if (!/^[0-9a-f]{64}$/.test(sha256))
+        throw new Error("contract sha256 must be 64 lowercase hex characters");
+    return `.mnemom/contracts/${sha256}.json`;
+}

package/dist/lib/experimental.d.ts

@@ -12,7 +12,7 @@
  * Everything here is pure or dependency-injected; index.ts and the command
  * modules are the thin drivers.
  */
-export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings";
+export type ExperimentalId = "context-handoff" | "slack" | "implicit" | "measured-savings" | "record" | "fuel";
 /**
  * Features that used to be experimental and are now on by default for everyone. Their ids are
  * no longer in the registry, but `mnemom experimental enable|disable <id>` still accepts them
@@ -63,6 +63,15 @@ export declare function resolveExperimental(opts: {
     stored: ExperimentalPrefs | undefined;
     env: Record<string, string | undefined>;
 }): ExperimentalState;
+/**
+ * Features a prerelease (`-next.N`) build makes available without `mnemom experimental
+ * enable`: door one's T16 turns implicit goals on by default on `next` (decisions 12 and
+ * 22), so its flag, its launcher.toml value and `mnemom agent goal` are not refused there.
+ * Stable is unchanged.
+ */
+export declare const PRERELEASE_AVAILABLE: readonly ExperimentalId[];
+/** The features whose flags, keys and commands are usable: the enabled ones, plus PRERELEASE_AVAILABLE on a prerelease. */
+export declare function availableFeatures(enabled: readonly ExperimentalId[], prerelease: boolean): ExperimentalId[];
 /** The one-line stderr notice for a launch with experimental features on; null when none are. */
 export declare function experimentalNotice(enabled: readonly ExperimentalId[]): string | null;
 /** The error for using an experimental flag or command while its feature is off. */

package/dist/lib/experimental.js

@@ -75,7 +75,7 @@ export const EXPERIMENTAL_FEATURES = [
     {
         // No flag, launcher.toml key or env of its own: `mnemom experimental enable` is the switch.
         id: "measured-savings",
-        summary: "The status bar shows the saving the gateway measured on this session instead of the benchmark estimate",
+        summary: "The gateway measures each request's saving into the response usage (the status bar never shows it)",
         since: "0.17.16",
         gates: {
             flags: [],
@@ -84,6 +84,29 @@ export const EXPERIMENTAL_FEATURES = [
             env: [],
         },
     },
+    {
+        // No flag, launcher.toml key or env of its own: `mnemom experimental enable` is the switch.
+        id: "record",
+        summary: "Print the conduct receipt at exit: the session's measured model cost and μ, or the record link",
+        since: "0.17.32",
+        gates: {
+            flags: [],
+            configKeys: [],
+            commands: [],
+            env: [],
+        },
+    },
+    {
+        id: "fuel",
+        summary: "The fuel step: `mnemom agent fuel <file>` seals a batch of job contracts with one confirmation and commits them to the repo",
+        since: "0.17.32",
+        gates: {
+            flags: [],
+            configKeys: [],
+            commands: ["mnemom agent fuel"],
+            env: [],
+        },
+    },
 ];
 export const EXPERIMENTAL_IDS = EXPERIMENTAL_FEATURES.map((f) => f.id);
 export const EXPERIMENTAL_ENV = "MNEMOM_EXPERIMENTAL";
@@ -126,6 +149,17 @@ export function resolveExperimental(opts) {
         unknown: stored.filter((t) => !isExperimentalId(t)),
     };
 }
+/**
+ * Features a prerelease (`-next.N`) build makes available without `mnemom experimental
+ * enable`: door one's T16 turns implicit goals on by default on `next` (decisions 12 and
+ * 22), so its flag, its launcher.toml value and `mnemom agent goal` are not refused there.
+ * Stable is unchanged.
+ */
+export const PRERELEASE_AVAILABLE = ["implicit"];
+/** The features whose flags, keys and commands are usable: the enabled ones, plus PRERELEASE_AVAILABLE on a prerelease. */
+export function availableFeatures(enabled, prerelease) {
+    return normalize(prerelease ? [...enabled, ...PRERELEASE_AVAILABLE] : enabled);
+}
 /** The one-line stderr notice for a launch with experimental features on; null when none are. */
 export function experimentalNotice(enabled) {
     if (enabled.length === 0)

package/dist/lib/oauth.d.ts

@@ -42,7 +42,8 @@ export interface AuthServerMetadata {
 }
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
- * the active API base URL so staging/local point at their own AS.
+ * the active API base URL so local (and any non-default `Environment`) points
+ * at its own AS.
  */
 export declare function discover(): Promise<AuthServerMetadata>;
 /** Reset the process-level discovery cache (used by tests). */

package/dist/lib/oauth.js

@@ -117,7 +117,8 @@ async function oauthFetch(what, url, init = {}) {
 let cachedMetadata = null;
 /**
  * Fetch (and process-cache) the AS metadata document. We resolve it relative to
- * the active API base URL so staging/local point at their own AS.
+ * the active API base URL so local (and any non-default `Environment`) points
+ * at its own AS.
  */
 export async function discover() {
     if (cachedMetadata)

package/dist/lib/statusline-bin.d.ts

@@ -1,5 +1,5 @@
 /**
- * Entry for the `mnemom agent` status-bar counter (lib/statusline.ts). Claude Code runs it
- * on every status update, so it imports only the counter — not the whole CLI.
+ * Entry for the `mnemom agent` status-bar segment (lib/statusline.ts). Claude Code runs it
+ * on every status update, so it imports only the segment — not the whole CLI.
  */
 export {};

package/dist/lib/statusline-bin.js

@@ -1,17 +1,14 @@
 /**
- * Entry for the `mnemom agent` status-bar counter (lib/statusline.ts). Claude Code runs it
- * on every status update, so it imports only the counter — not the whole CLI.
+ * Entry for the `mnemom agent` status-bar segment (lib/statusline.ts). Claude Code runs it
+ * on every status update, so it imports only the segment — not the whole CLI.
  */
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { INNER_ENV, measuredMode, render } from "./statusline.js";
+import { FEED_ENV, INNER_ENV, render } from "./statusline.js";
 const chunks = [];
 process.stdin.on("data", (c) => chunks.push(c));
 process.stdin.on("end", () => {
     const line = render(Buffer.concat(chunks).toString("utf8"), {
-        stateDir: join(homedir(), ".mnemom", "statusline"),
         inner: process.env[INNER_ENV] || undefined,
-        measured: measuredMode(process.env),
+        feed: process.env[FEED_ENV] || undefined,
     });
     process.stdout.write(`${line}\n`);
 });

package/dist/lib/statusline-feed.d.ts

@@ -0,0 +1,33 @@
+/**
+ * The launcher side of the fed status line (W1.4, decision 14), prerelease only.
+ *
+ * The local base-URL proxy records the gateway's `x-mnemom-lineage-key` for this session in
+ * its record-state file (the one the conduct receipt reads). While Claude Code runs, the launcher reads Record's accumulator totals for that
+ * lineage every few seconds and writes them to the feed file the status-line bin reads
+ * (lib/statusline.ts). The bin never touches the network.
+ *
+ * Fail open everywhere: no lineage yet, a dark route (404), a non-billing role (403) or any
+ * error leaves the feed as it was, so the status line stays "mnemom" until fed.
+ */
+import { type RecordTotals } from "./api.js";
+/** How often the launcher re-reads the totals. */
+export declare const FEED_INTERVAL_MS = 10000;
+export interface FeedOptions {
+    /** The proxy's record-state JSON (MNEMOM_AGENT_BU_RECORD_STATE), carrying `lineage_key`. */
+    recordStateFile: string;
+    /** Read by the status-line bin (MNEMOM_STATUSLINE_FEED). */
+    feedFile: string;
+    orgId: string;
+    intervalMs?: number;
+    /** Test seam; the real read is getRecordTotals (throws on any non-200). */
+    fetchTotals?: (orgId: string, lineageKey: string) => Promise<RecordTotals | null>;
+}
+/**
+ * The lineage key the proxy recorded, or null when there is none (yet) or it is not the
+ * gateway's `cid:`/`cr:` shape (the proxy's own check is looser; this read is exact).
+ */
+export declare function readLineage(path: string): string | null;
+/** One poll: read the lineage, fetch its totals, write the feed. Never throws. */
+export declare function feedOnce(o: FeedOptions): Promise<boolean>;
+/** Poll until stopped. The timer is unref'd, so it never holds the launcher open. */
+export declare function startFeed(o: FeedOptions): () => void;