@mnemom/mnemom 0.17.35 → 0.17.36

package/dist/commands/agent-run.d.ts

@@ -24,6 +24,8 @@ export interface RunDeps {
     env: NodeJS.ProcessEnv;
     fetch: FetchFn;
     apiUrl: string;
+    /** The gateway the model proxy forwards to. */
+    gatewayUrl: string;
     /** stdout: one outcome line per job. */
     emit(line: string): void;
     /** stderr. */
@@ -36,6 +38,8 @@ export interface RunDeps {
 }
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export declare const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
+/** The refusal of a non-production API paired with the production gateway; a config error, exit 2. */
+export declare const RUNNER_GATEWAY_RING_MISMATCH = "runner_gateway_ring_mismatch";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export declare function agentRunCommand(flags: RunFlags, deps: RunDeps): Promise<number>;
 export declare const GITHUB_API: string;

package/dist/commands/agent-run.js

@@ -20,7 +20,7 @@ import { randomUUID } from "node:crypto";
 import { mkdtemp, readFile, rm } from "node:fs/promises";
 import { homedir, tmpdir } from "node:os";
 import { join } from "node:path";
-import { getApiUrl, getGatewayUrl } from "../lib/config.js";
+import { gatewayRingMismatch, getApiUrl, getGatewayUrl } from "../lib/config.js";
 import { runnerApi } from "../lib/runner/executor-client.js";
 import { resolveClaudeBin } from "../lib/claude-bin.js";
 import { executorIdFromState } from "../lib/runner/executor-state.js";
@@ -35,6 +35,8 @@ import { resolveGithubToken } from "./agent-fuel.js";
 import { executorStatePath } from "../vendor/durable-contract/index.js";
 /** The refusal of a runner with no ANTHROPIC_API_KEY (34.30.1); a config error, exit 2. */
 export const RUNNER_MODEL_KEY_MISSING = "runner_model_key_missing";
+/** The refusal of a non-production API paired with the production gateway; a config error, exit 2. */
+export const RUNNER_GATEWAY_RING_MISMATCH = "runner_gateway_ring_mismatch";
 /** Resolves the process exit code; never throws for a usage, config or Mnemom error. */
 export async function agentRunCommand(flags, deps) {
     const resolved = resolveRunPlan(flags, deps.env);
@@ -45,6 +47,11 @@ export async function agentRunCommand(flags, deps) {
     const plan = resolved.plan;
     for (const w of plan.warnings)
         deps.err(w);
+    if (gatewayRingMismatch(deps.apiUrl, deps.gatewayUrl)) {
+        deps.err(`mnemom agent run: refused (${RUNNER_GATEWAY_RING_MISMATCH}): the API is ${deps.apiUrl} but the gateway is the production one, ${deps.gatewayUrl}; nothing was claimed`);
+        deps.err("  fix: set MNEMOM_GATEWAY_URL to the same cell's gateway as MNEMOM_API_URL");
+        return USAGE_EXIT_CODE;
+    }
     const modelKey = deps.env.ANTHROPIC_API_KEY?.trim();
     if (!modelKey) {
         deps.err(`mnemom agent run: refused (${RUNNER_MODEL_KEY_MISSING}): this runner has no ANTHROPIC_API_KEY for its phases' model calls; nothing was claimed`);
@@ -247,6 +254,7 @@ export function runAgentRun(flags) {
         env: process.env,
         fetch,
         apiUrl: getApiUrl(),
+        gatewayUrl: getGatewayUrl(),
         emit: (line) => process.stdout.write(`${line}\n`),
         err: (line) => process.stderr.write(`${line}\n`),
         stop: stop.signal,

package/dist/commands/agent-share-render.js

@@ -20,7 +20,7 @@ async function loadVerifier(load) {
     catch (error) {
         const e = error;
         if (e.code === "ERR_MODULE_NOT_FOUND" || e.code === "MODULE_NOT_FOUND") {
-            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: run `npm install https://github.com/mnemom/aip/releases/download/aip-verifier-v0.6.0/mnemom-aip-verifier-0.6.0.tgz`", { cause: error });
+            throw new Error("the aip verifier (@mnemom/aip-verifier) is not installed: it ships bundled inside @mnemom/mnemom, so reinstall with `npm install -g @mnemom/mnemom`", { cause: error });
         }
         throw new Error(`the aip verifier (@mnemom/aip-verifier) failed to load: ${e.message ?? error}`, { cause: error });
     }

package/dist/commands/scan.d.ts

@@ -11,6 +11,7 @@ import { type AnthropicUsageDeps } from "../lib/scan/spend/anthropic-usage.js";
 import { type RecordDeps, type RecordOutcome } from "../lib/scan/record.js";
 import { type CostSpend } from "../lib/scan/cost-per-pr.js";
 import { type ReportEmailDeps } from "../lib/scan/report-email.js";
+import { type RepoListDeps } from "../lib/scan/repo-picker.js";
 import { type ReportRecipients } from "../lib/scan/share.js";
 export interface ScanCommandOptions {
     repos: string[];
@@ -42,12 +43,20 @@ export interface ScanCommandOptions {
     recordDeps?: RecordDeps;
     /** Test seam: the report-email POST. */
     emailDeps?: ReportEmailDeps;
+    /** Test seam: the org this login was authorized for (none of the stored tokens carry one today). */
+    authorizedOrg?: () => string | undefined;
+    /** Test seam: the `mnemom org use` default. */
+    activeOrg?: () => {
+        org_id: string;
+    } | undefined;
     /** Test seam: the signed-in user's orgs, used to infer --org when it is omitted. */
     listOrgs?: () => Promise<Array<{
         org_id: string;
         name?: string;
         is_personal?: boolean;
     }>>;
+    /** Test seam: the fetch behind the repo picker's list read. */
+    repoListDeps?: RepoListDeps;
     /** Test seams. */
     isTty?: boolean;
     env?: NodeJS.ProcessEnv;
@@ -93,9 +102,10 @@ export declare function resolveMeasuredUsage(o: ScanCommandOptions, period: {
 } | null>;
 /**
  * --org is optional only because it can be inferred: the report is emailed on every scan, so the scan
- * needs an org. Inference uses the signed-in user's own memberships (GET /v1/orgs, personal org
- * excluded): exactly one org is used; none, several, or a failed read stops the scan loudly BEFORE any
- * scan work, naming the fix. It never guesses between orgs and never skips the email.
+ * needs an org. Order: --org; the org the login was authorized for; the `mnemom org use` default; the
+ * signed-in user's single non-personal membership (GET /v1/orgs); a terminal picker over several; else it
+ * stops loudly BEFORE any scan work, naming each org beside its id. It never guesses between orgs and
+ * never skips the email.
  */
 export declare function resolveScanOrg(o: ScanCommandOptions): Promise<string>;
 export declare const INVALID_ORG_MSG = "--org must be an org id like org-1a2b3c4d.";

package/dist/commands/scan.js

@@ -12,10 +12,12 @@ import { isSpendTiersEnabled, NOT_ENABLED_MSG, parseMonthlySpendUsd, selectSpend
 import { ADMIN_KEY_ENV, AnthropicUsageError, fetchMeasuredUsage, isAdminKeyShape, usageFailureText, } from "../lib/scan/spend/anthropic-usage.js";
 import { getAuthInfo } from "../lib/auth.js";
 import { listMyOrgs } from "../lib/api.js";
+import { getActiveOrg } from "../lib/cli-config.js";
 import { fetchRecordTotals, isOrgId, } from "../lib/scan/record.js";
 import { modelledSpend } from "../lib/scan/cost-per-pr.js";
 import { RECORD_NO_ORG_NOTE, renderRecordSection } from "../lib/scan/report.js";
 import { buildEmailBody, buildEmailReport, DRY_RUN_MSG, UNAVAILABLE_MSG, failureMessage, ReportEmailError, sendReportEmail, } from "../lib/scan/report-email.js";
+import { pickRepos, REPO_PICKER_NO_TERMINAL_HINT, } from "../lib/scan/repo-picker.js";
 import { buildSharePayload, parseShareLevel, promptShareLevel, } from "../lib/scan/share.js";
 /** Parses repeated/comma-separated `--repo owner/name`. Returns null on any invalid slug. */
 export function parseRepoFlags(raw) {
@@ -126,9 +128,10 @@ export async function resolveMeasuredUsage(o, period) {
 }
 /**
  * --org is optional only because it can be inferred: the report is emailed on every scan, so the scan
- * needs an org. Inference uses the signed-in user's own memberships (GET /v1/orgs, personal org
- * excluded): exactly one org is used; none, several, or a failed read stops the scan loudly BEFORE any
- * scan work, naming the fix. It never guesses between orgs and never skips the email.
+ * needs an org. Order: --org; the org the login was authorized for; the `mnemom org use` default; the
+ * signed-in user's single non-personal membership (GET /v1/orgs); a terminal picker over several; else it
+ * stops loudly BEFORE any scan work, naming each org beside its id. It never guesses between orgs and
+ * never skips the email.
  */
 export async function resolveScanOrg(o) {
     if (o.org !== undefined) {
@@ -136,6 +139,18 @@ export async function resolveScanOrg(o) {
             throw new Error(INVALID_ORG_MSG);
         return o.org;
     }
+    // 2. The org this login was authorized for, when the token or session carries one.
+    const authorized = o.authorizedOrg?.();
+    if (authorized !== undefined) {
+        if (!isOrgId(authorized))
+            throw new Error(INVALID_ORG_MSG);
+        return authorized;
+    }
+    // 3. The default set with `mnemom org use <slug>` (a malformed stored id is ignored, not trusted).
+    const active = (o.activeOrg ?? getActiveOrg)()?.org_id;
+    if (active !== undefined && isOrgId(active))
+        return active;
+    // 4-6. Memberships: a single one, else a terminal picker, else fail closed.
     let orgs;
     try {
         orgs = (await (o.listOrgs ?? listMyOrgs)()).filter((x) => !x.is_personal);
@@ -147,8 +162,20 @@ export async function resolveScanOrg(o) {
         return orgs[0].org_id;
     if (orgs.length === 0)
         throw new Error("You belong to no organization, so the report has nowhere to be emailed from. Pass --org <org_id>.");
-    throw new Error(`You belong to ${orgs.length} organizations; pass --org <org_id> (${orgs.map((x) => x.org_id).join(", ")}).`);
+    // Several orgs: ids alone mean nothing, so show each name beside its id. A terminal picks one; anything
+    // else fails closed (never a guess) with the same labels in the message.
+    const labels = orgs.map(orgLabel);
+    if (o.isTty ?? process.stdin.isTTY) {
+        const chosen = await askSelect("Which organization should the report be emailed for?", labels);
+        const hit = orgs.find((x, i) => labels[i] === chosen);
+        if (hit && isOrgId(hit.org_id))
+            return hit.org_id;
+        throw new Error("No organization selected. Pass --org <org_id>.");
+    }
+    throw new Error(`You belong to ${orgs.length} organizations; pass --org <org_id> (${labels.join(", ")}).`);
 }
+/** "Name (org-id)", or just the id when the org has no usable name. */
+const orgLabel = (x) => typeof x.name === "string" && x.name.trim() !== "" ? `${x.name.trim()} (${x.org_id})` : x.org_id;
 export const INVALID_ORG_MSG = "--org must be an org id like org-1a2b3c4d.";
 /**
  * The Record read for the preview: null when the flag gate is off (no read, no output, as before).
@@ -168,23 +195,34 @@ export async function scanCommand(o) {
     if (o.share !== undefined && parseShareLevel(o.share) === null) {
         throw new Error("--share must be one of: summary, full, none");
     }
-    if (o.repos.length === 0)
-        throw new Error("--repo owner/name is required (repeatable)");
+    const noRepoFlag = o.repos.length === 0;
+    // No --repo: on a terminal pick from the repos this GitHub login can read; otherwise the error stays, with a hint.
+    if (noRepoFlag && !(o.isTty ?? process.stdin.isTTY))
+        throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
     // The report is emailed on every scan, so resolve the org before any scan work; failure is loud.
     const emailOrg = await resolveScanOrg(o);
     if (o.ctoEmail !== undefined && !isEmail(o.ctoEmail))
         throw new Error("--cto-email must be a valid email address");
+    const getCredential = async () => {
+        const c = o.credential ?? (await resolveCredential().catch(() => null));
+        if (!c)
+            throw new Error(failureText("credential"));
+        return c;
+    };
+    // Asked before the spend prompts so the repo comes first; the credential is reused for the scan.
+    const pickedCredential = noRepoFlag ? await getCredential() : null;
+    const repos = pickedCredential
+        ? await pickRepos(pickedCredential, { isTty: true, deps: o.repoListDeps })
+        : o.repos;
     const selfReported = await resolveSelfReportedSpend(o);
     const now = o.now ?? Date.now;
     const end = new Date(now()).toISOString().slice(0, 10);
     const period = o.period ?? { start: end, end };
     const measured = await resolveMeasuredUsage(o, period);
-    const credential = o.credential ?? (await resolveCredential().catch(() => null));
-    if (!credential)
-        throw new Error(failureText("credential"));
+    const credential = pickedCredential ?? (await getCredential());
     // Before the local scan: a refused credential fails closed without spending the GitHub reads.
     const record = await resolveRecordOutcome(o);
-    const outcome = await runLocalScan({ credential, now, ...o.deps }, { repos: o.repos, period });
+    const outcome = await runLocalScan({ credential, now, ...o.deps }, { repos, period });
     if (outcome.status === "withheld")
         throw new Error(`Scan withheld: ${failureText(outcome.reason)}`);
     const { result } = outcome;

package/dist/index.js

@@ -2384,7 +2384,7 @@ program
 program
     .command("scan")
     .description("Read-only local scan of GitHub PR metadata; the report is emailed to you every time (counts only, no repo names) and Mnemom keeps nothing at share level none")
-    .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated)")
+    .option("--repo <owner/name...>", "Repo to scan (repeatable or comma-separated; omit on a terminal to pick from your repos)")
     .option("--start <YYYY-MM-DD>", "Period start (default: today)")
     .option("--end <YYYY-MM-DD>", "Period end (default: today)")
     .option("--share <level>", "summary | full | none (default: full when asked; none when not interactive)")
@@ -2395,7 +2395,8 @@ program
     .option("--org <org_id>", "Your org id; the report is emailed to you for this org (default: your only organization, else the scan stops and asks). Also selects the Record totals preview (needs MNEMOM_ORG_SCAN_MODE=true)")
     .action(async (options) => {
     try {
-        const repos = parseRepoFlags(options.repo);
+        // Omitted --repo is allowed here: scanCommand picks from your repos on a terminal, else stops with a hint.
+        const repos = options.repo === undefined ? [] : parseRepoFlags(options.repo);
         if (!repos)
             throw new Error("--repo owner/name is required (repeatable)");
         const today = new Date().toISOString().slice(0, 10);

package/dist/lib/config.d.ts

@@ -42,6 +42,13 @@ export declare function setRing(ring: CellRing | undefined): void;
 export declare function getRing(): CellRing | undefined;
 /** Override the active API base for this process (clears on undefined/empty). */
 export declare function setApiUrlOverride(url: string | undefined): void;
+/**
+ * True when the API is not production but the gateway is the production one. A lease key minted
+ * by a non-production cell's API means nothing to the production gateway, which answers every
+ * model call 401 and still receives the key (door2-path run 41783208169), so `agent run` refuses
+ * this pairing. A base that does not parse decides nothing. Pure.
+ */
+export declare function gatewayRingMismatch(apiUrl: string, gatewayUrl: string): boolean;
 export declare function getApiUrl(): string;
 export declare function getGatewayUrl(): string;
 export declare function getWebsiteUrl(): string;

package/dist/lib/config.js

@@ -113,6 +113,27 @@ function ringUrls() {
     const ring = getRing();
     return ring ? RING_URLS[ring] : undefined;
 }
+function originOf(url) {
+    try {
+        return new URL(url).origin.toLowerCase();
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the API is not production but the gateway is the production one. A lease key minted
+ * by a non-production cell's API means nothing to the production gateway, which answers every
+ * model call 401 and still receives the key (door2-path run 41783208169), so `agent run` refuses
+ * this pairing. A base that does not parse decides nothing. Pure.
+ */
+export function gatewayRingMismatch(apiUrl, gatewayUrl) {
+    const api = originOf(apiUrl);
+    const gateway = originOf(gatewayUrl);
+    if (api === null || gateway === null)
+        return false;
+    return api !== originOf(API_URLS.production) && gateway === originOf(GATEWAY_URLS.production);
+}
 export function getApiUrl() {
     return (apiUrlOverride ?? envBase("MNEMOM_API_URL") ?? ringUrls()?.api ?? API_URLS[getEnvironment()]);
 }

package/dist/lib/scan/pr-source.js

@@ -31,6 +31,8 @@ const ALLOWED_PATHS = [
     new RegExp(`^/repos/${SLUG}/pulls\\?state=closed&sort=updated&direction=desc&per_page=\\d{1,3}&page=\\d{1,4}$`),
     new RegExp(`^/repos/${SLUG}/pulls/\\d{1,9}$`),
     new RegExp(`^/repos/${SLUG}/commits/[0-9a-f]{40}/check-runs\\?per_page=100$`),
+    // The repo picker's one list read (MNE-9643): the repos this login can read, newest push first.
+    /^\/user\/repos\?sort=pushed&direction=desc&per_page=\d{1,3}$/,
 ];
 export function isAllowedScanPath(path) {
     return ALLOWED_PATHS.some((re) => re.test(path));

package/dist/lib/scan/repo-picker.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Repo picker for `mnemom scan` when --repo is omitted on a terminal (MNE-9643). Read-only: one GET of
+ * the repos the signed-in GitHub account can read, through the same credential seam the scan uses.
+ * Only `full_name` is kept; descriptions, owners' logins beyond the slug, URLs and the token never leave
+ * this module. Failures throw fixed text (never a GitHub body, header or URL). Prompt style and fail-closed
+ * handling follow promptShareLevel in ./share.ts: no terminal, no answer, or a bad answer selects nothing.
+ */
+import { askMultiSelect } from "../prompt.js";
+import { type GitHubCredential } from "./credential.js";
+/** Most repos listed: the most recently pushed, so the list stays pickable. `--repo` names any other. */
+export declare const REPO_PICKER_LIMIT = 30;
+/** The only path the picker may read. */
+export declare const REPO_LIST_PATH = "/user/repos?sort=pushed&direction=desc&per_page=30";
+export declare const REPO_PICKER_NO_TERMINAL_HINT = "Pass --repo owner/name (repeatable), or run in a terminal to pick from your repos.";
+export declare const REPO_LIST_FAILED_MSG = "Could not list your GitHub repos. Pass --repo owner/name, or check `gh auth status`.";
+export declare const NO_REPOS_MSG = "No GitHub repos are readable by this account. Pass --repo owner/name.";
+export declare const NO_REPO_SELECTED_MSG = "No repo selected. Pass --repo owner/name, or choose at least one number from the list.";
+export interface RepoListDeps {
+    fetchImpl?: typeof fetch;
+    timeoutMs?: number;
+}
+/** GET-only read of the repos the credential can see. Returns valid slugs only, newest push first. */
+export declare function listReadableRepos(credential: GitHubCredential, deps?: RepoListDeps): Promise<string[]>;
+/**
+ * Lists the readable repos and asks which to scan (comma-separated numbers, as the other multi-select
+ * prompts do). Throws fixed text when there is no terminal, nothing is listed, or nothing valid is chosen.
+ */
+export declare function pickRepos(credential: GitHubCredential, o: {
+    isTty: boolean;
+    deps?: RepoListDeps;
+    ask?: typeof askMultiSelect;
+}): Promise<string[]>;

package/dist/lib/scan/repo-picker.js

@@ -0,0 +1,80 @@
+/**
+ * Repo picker for `mnemom scan` when --repo is omitted on a terminal (MNE-9643). Read-only: one GET of
+ * the repos the signed-in GitHub account can read, through the same credential seam the scan uses.
+ * Only `full_name` is kept; descriptions, owners' logins beyond the slug, URLs and the token never leave
+ * this module. Failures throw fixed text (never a GitHub body, header or URL). Prompt style and fail-closed
+ * handling follow promptShareLevel in ./share.ts: no terminal, no answer, or a bad answer selects nothing.
+ */
+import { askMultiSelect } from "../prompt.js";
+import { GITHUB_API, isAllowedScanPath } from "./pr-source.js";
+import { assertReadOnlyCredential, isValidRepoSlug } from "./credential.js";
+/** Most repos listed: the most recently pushed, so the list stays pickable. `--repo` names any other. */
+export const REPO_PICKER_LIMIT = 30;
+/** The only path the picker may read. */
+export const REPO_LIST_PATH = `/user/repos?sort=pushed&direction=desc&per_page=${REPO_PICKER_LIMIT}`;
+export const REPO_PICKER_NO_TERMINAL_HINT = "Pass --repo owner/name (repeatable), or run in a terminal to pick from your repos.";
+export const REPO_LIST_FAILED_MSG = "Could not list your GitHub repos. Pass --repo owner/name, or check `gh auth status`.";
+export const NO_REPOS_MSG = "No GitHub repos are readable by this account. Pass --repo owner/name.";
+export const NO_REPO_SELECTED_MSG = "No repo selected. Pass --repo owner/name, or choose at least one number from the list.";
+/** GET-only read of the repos the credential can see. Returns valid slugs only, newest push first. */
+export async function listReadableRepos(credential, deps = {}) {
+    if (!isAllowedScanPath(REPO_LIST_PATH))
+        throw new Error(REPO_LIST_FAILED_MSG);
+    // Same order as runLocalScan: a credential GitHub granted more than read is refused before any read.
+    await assertReadOnlyCredential(credential).catch(() => {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    });
+    const doFetch = deps.fetchImpl ?? fetch;
+    let res;
+    try {
+        // User-level read: there is no single repo to scope to (the gh-login credential ignores the argument).
+        const bearer = await credential.tokenFor("");
+        res = await doFetch(`${GITHUB_API}${REPO_LIST_PATH}`, {
+            method: "GET",
+            headers: {
+                accept: "application/vnd.github+json",
+                "x-github-api-version": "2022-11-28",
+                "user-agent": "mnemom-cli-scan/1",
+                authorization: `Bearer ${bearer}`,
+            },
+            redirect: "error",
+            signal: AbortSignal.timeout(deps.timeoutMs ?? 10_000),
+        });
+    }
+    catch {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    if (!res.ok) {
+        await res.body?.cancel().catch(() => { });
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    let json;
+    try {
+        json = await res.json();
+    }
+    catch {
+        throw new Error(REPO_LIST_FAILED_MSG);
+    }
+    if (!Array.isArray(json))
+        throw new Error(REPO_LIST_FAILED_MSG);
+    const slugs = json
+        .map((r) => (r && typeof r === "object" ? r.full_name : undefined))
+        .filter(isValidRepoSlug);
+    return [...new Set(slugs)].slice(0, REPO_PICKER_LIMIT);
+}
+/**
+ * Lists the readable repos and asks which to scan (comma-separated numbers, as the other multi-select
+ * prompts do). Throws fixed text when there is no terminal, nothing is listed, or nothing valid is chosen.
+ */
+export async function pickRepos(credential, o) {
+    if (!o.isTty)
+        throw new Error(`--repo owner/name is required (repeatable). ${REPO_PICKER_NO_TERMINAL_HINT}`);
+    const repos = await listReadableRepos(credential, o.deps);
+    if (repos.length === 0)
+        throw new Error(NO_REPOS_MSG);
+    const chosen = await (o.ask ?? askMultiSelect)("Which repos should be scanned (read-only)?", repos);
+    const picked = chosen.filter((c) => repos.includes(c));
+    if (picked.length === 0)
+        throw new Error(NO_REPO_SELECTED_MSG);
+    return picked;
+}

package/node_modules/@mnemom/aip-verifier/LICENSE

@@ -0,0 +1,190 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to the Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by the Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding any notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright 2026 Mnemon
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.