@mnemom/mnemom 0.17.6-next.2 → 0.17.6

package/dist/commands/wrap.js

@@ -20,7 +20,9 @@ import { mergeAgentConfig } from "../lib/agent-config.js";
 import { askSelect, askInput, isInteractive } from "../lib/prompt.js";
 import { getGatewayUrl } from "../lib/config.js";
 import { fmt } from "../lib/format.js";
+import { NOOP_SESSION_CONFIG_B64, SESSION_CONFIG_HEADER } from "../lib/agent.js";
 const AGENT_HEADER = "x-mnemom-agent";
+const MNEMOM_KEY_HEADER = "x-mnemom-api-key";
 const PROVIDERS = {
     anthropic: {
         label: "Anthropic",
@@ -208,6 +210,10 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
         [prov.keyHeader]: authValue,
         [AGENT_HEADER]: agentName,
     };
+    if (opts.mnemomKey) {
+        headers[MNEMOM_KEY_HEADER] = opts.mnemomKey;
+        headers[SESSION_CONFIG_HEADER] = NOOP_SESSION_CONFIG_B64;
+    }
     if (provider === "anthropic") {
         headers["anthropic-version"] = "2023-06-01";
     }
@@ -235,13 +241,24 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
                 messages: [{ role: "user", content: "hello" }],
             });
     }
-    const response = await fetch(url, {
+    const post = (h) => fetch(url, {
         method: "POST",
-        headers,
+        headers: h,
         body,
         signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     });
-    const agentId = response.headers.get(AGENT_HEADER);
+    let response = await post(headers);
+    let agentId = response.headers.get(AGENT_HEADER);
+    // An agent an earlier plain call already birthed sits unclaimed in the sandbox org, and the
+    // gateway refuses agent traffic for it with 402 `agent_unclaimed` (and no agent id) — yet that
+    // is exactly the agent `mnemom agent setup` must claim. Ask once more as plain traffic (no
+    // session config): that serves it exactly as before and returns the id for the claim step.
+    if (!agentId && SESSION_CONFIG_HEADER in headers && (await isAgentUnclaimedRefusal(response))) {
+        const plain = { ...headers };
+        Reflect.deleteProperty(plain, SESSION_CONFIG_HEADER);
+        response = await post(plain);
+        agentId = response.headers.get(AGENT_HEADER);
+    }
     if (!response.ok && !agentId) {
         const text = await response.text().catch(() => "");
         throw new MnemomApiError(response.status, `Gateway returned ${response.status}: ${text.slice(0, 300)}`);
@@ -251,6 +268,22 @@ export async function birthThroughGateway(gatewayUrl, provider, agentName, provi
     }
     return agentId;
 }
+/**
+ * Is `response` the gateway's agent-traffic refusal for an agent still unclaimed in the sandbox
+ * org — 402 with `error.details.reason === "agent_unclaimed"`? Reads a clone, so the caller can
+ * still read the body. Anything unparseable is `false`.
+ */
+async function isAgentUnclaimedRefusal(response) {
+    if (response.status !== 402)
+        return false;
+    try {
+        const body = (await response.clone().json());
+        return body?.error?.details?.reason === "agent_unclaimed";
+    }
+    catch {
+        return false;
+    }
+}
 // ── Starter cards ─────────────────────────────────────────────────────────────
 function buildStarterAlignmentCard(agentId) {
     return {

package/dist/index.js

@@ -175,7 +175,7 @@ const agentCmd = program
     .addOption(new Option("--slack", "EXPERIMENTAL (`mnemom experimental enable slack`): attach the Slack channel — messages addressed to this session arrive in it, and it can reply (see `mnemom agent slack`)").hideHelp(hiddenUnless("slack")))
     .option("--context", "Force context folding ON for this launch even when launcher.toml (context = false) or MNEMOM_AGENT_CONTEXT turns it off")
     .option("--no-context", "Disable context folding for this launch (folding is on by default; tells the gateway to skip it for this session)")
-    .addOption(new Option("--context-profile <profile>", 'How the gateway folds this session\'s context. "balanced" (default) keeps more of the earlier work verbatim and folds later — for long sessions that revisit earlier files and decisions. "aggressive" folds earlier and keeps a tighter working set — for cost-sensitive sessions and short, focused tasks. "off" leaves compaction to the coding agent. Also: config key context_profile, env MNEMOM_AGENT_CONTEXT_PROFILE.').argParser((v) => {
+    .addOption(new Option("--context-profile <profile>", 'How the gateway folds this session\'s context. "balanced" (default) keeps more of the earlier work verbatim and folds later — for long sessions that revisit earlier files and decisions. "aggressive" folds earlier and keeps a tighter working set — for cost-sensitive sessions and short, focused tasks. "adaptive" sizes the fold to the conversation: no fold below 200k tokens, aggressive from 200k to 1M, balanced above. "off" leaves compaction to the coding agent. Also: config key context_profile, env MNEMOM_AGENT_CONTEXT_PROFILE.').argParser((v) => {
     // One validator for all three surfaces (flag, MNEMOM_AGENT_CONTEXT_PROFILE,
     // launcher.toml context_profile): trimmed, case-insensitive, same error wording.
     try {

package/dist/lib/agent.d.ts

@@ -293,6 +293,12 @@ export declare const CONTEXT_RUNTIME_KEY = "CONTEXT_RUNTIME_ENABLED";
 export declare const CONTEXT_TAIL_BUDGET_KEY = "CONTEXT_RUNTIME_TAIL_BUDGET_TOKENS";
 export declare const CONTEXT_READ_CACHE_KEY = "CONTEXT_RUNTIME_READ_CACHE_TOKENS";
 export declare const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT_RECLAIM";
+/**
+ * The gateway key the `adaptive` context profile sets (allow-listed per session): turns on the
+ * size-banded fold policy. Only the literal `banded` enables it; the band thresholds and budgets
+ * stay at the gateway's own defaults.
+ */
+export declare const CONTEXT_SIZE_POLICY_KEY = "CONTEXT_RUNTIME_SIZE_POLICY";
 /**
  * The named presets for how the gateway folds a session's context (`--context-profile`,
  * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`):
@@ -301,8 +307,11 @@ export declare const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT
  *   - `balanced`   → NO fold keys: the gateway's own defaults stand. The default.
  *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on: folds
  *                    earlier and keeps a tighter working set.
+ *   - `adaptive`   → `CONTEXT_RUNTIME_SIZE_POLICY: "banded"` — the gateway picks the fold by the
+ *                    conversation's original size: no fold below 200k tokens, the aggressive
+ *                    budgets from 200k to 1M, balanced above. Opt-in; never the default.
  */
-export declare const CONTEXT_PROFILES: readonly ["off", "balanced", "aggressive"];
+export declare const CONTEXT_PROFILES: readonly ["off", "balanced", "aggressive", "adaptive"];
 export type ContextProfile = (typeof CONTEXT_PROFILES)[number];
 /**
  * The gateway env key that gates the whole context-handoff capability (level lines +
@@ -462,8 +471,10 @@ export declare function launchPreferenceExplicit(opts: {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session/personal-org/balance round trips. The Mnemom Agent
- * entitlement (which also gates Remote Control, fail-closed) is still fetched.
+ * the per-launch session prompt and balance round trips. The launch org still
+ * resolves as on a normal launch (active org, else personal org — the launch's
+ * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
+ * gates Remote Control, fail-closed) is still fetched for it.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -512,7 +523,11 @@ export declare function resolveRemoteControlShape(args: {
 export declare function buildCustomHeaders(opts: {
     /** Absent on a subscription-login launch: Claude Code then sends its own claude.ai login. */
     anthropicKey?: string;
-    /** The governed-identity anchor on a subscription-login launch (lib/subscription-login.ts). */
+    /**
+     * The Mnemom key every `mnemom agent` launch sends (lib/subscription-login.ts
+     * resolveLaunchMnemomKey) — the gateway refuses the session without it, and on a subscription
+     * login it is also the governed-identity anchor.
+     */
     mnemomKey?: string;
     agent: string;
     conversationId: string;
@@ -543,7 +558,7 @@ export declare function parseContextProfile(raw: string, source: string): Contex
 /**
  * Which context profile this launch runs under. Precedence, highest wins:
  *   1. `--no-context` — always `off`. Combined with an explicit `--context-profile
- *      balanced|aggressive` it is a CONFLICT and the launch refuses (never a silent override);
+ *      balanced|aggressive|adaptive` it is a CONFLICT and the launch refuses (never a silent override);
  *      `--context-profile off` agrees with it.
  *   2. an explicit `--context-profile <profile>` flag (`--context` alongside it is fine — the
  *      profile wins);
@@ -561,8 +576,8 @@ export declare function resolveContextProfile(opts: {
 /**
  * The decoded per-session env overlay for this launch — the `config` object of the
  * `x-mnemom-session-config` payload, in wire order: the profile's keys first
- * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`; nothing
- * for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
+ * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`;
+ * `CONTEXT_RUNTIME_SIZE_POLICY` for `adaptive`; nothing for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
  * `GATEWAY_USAGE_REAL_SIZE: "on"` + `GATEWAY_COMPACTION_INTERCEPT: "on"` when EITHER the
  * `compaction_intercept` setting is ON OR `--compact-at` arms a target below 1M (the target
  * cannot be honored without the intercept), then `GATEWAY_COMPACTION_UPLOAD_TARGET_TOKENS: "<N>"`
@@ -597,7 +612,8 @@ export declare function buildSessionConfigPayload(opts: {
  * nothing to override (the gateway's own defaults stand — `balanced` with everything else off,
  * byte-identical to a launch before profiles existed). Independent overlays:
  *   - the context profile (`buildSessionConfig`): `off` → `CONTEXT_RUNTIME_ENABLED: "false"`,
- *     `aggressive` → the three fold-tuning keys, `balanced` → nothing;
+ *     `aggressive` → the three fold-tuning keys, `adaptive` → `CONTEXT_RUNTIME_SIZE_POLICY:
+ *     "banded"`, `balanced` → nothing;
  *   - `compactionIntercept: true` → `GATEWAY_USAGE_REAL_SIZE` + `GATEWAY_COMPACTION_INTERCEPT`
  *     `"on"` (the `compaction_intercept` setting);
  *   - `compactAt: <N>` (`--compact-at`, below 1M) → the SAME two intercept keys plus
@@ -616,6 +632,14 @@ export declare function buildSessionConfigB64(opts: {
     compactAt?: number | null;
     experimental?: readonly string[];
 }): string | undefined;
+/**
+ * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
+ * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
+ * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
+ * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
+ * launcher's birth probe (commands/wrap.ts birthThroughGateway).
+ */
+export declare const NOOP_SESSION_CONFIG_B64: string;
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -651,6 +675,12 @@ export declare const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export declare const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
+/**
+ * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
+ * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
+ * gateway requires on every `mnemom agent` request.
+ */
+export declare const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /**
  * How the `handoff` MCP server (cli/src/mcp/handoff-server.mjs) recovers the Anthropic key
  * WITHOUT it ever being written into the `--mcp-config` file on disk: `envName` is the NAME of a
@@ -682,6 +712,12 @@ export interface HandoffMcpParams {
     /** The gateway ORIGIN (e.g. https://gateway.mnemom.ai) — see `resolveHandoffGatewayHost`. */
     gatewayHost: string;
     anthropicKeySource: HandoffAnthropicKeySource;
+    /**
+     * Where the server reads the Mnemom key (`x-mnemom-api-key`) from — same contract as
+     * `anthropicKeySource`: `ANTHROPIC_CUSTOM_HEADERS` (its `x-mnemom-api-key:` line) on a terminal
+     * launch, `HANDOFF_RC_MNEMOM_KEY_ENV_NAME` under Remote Control. Absent ⇒ no Mnemom key header.
+     */
+    mnemomKeySource?: HandoffAnthropicKeySource;
     agent: string;
     conversationId: string;
     /** `buildSessionConfigB64` output — forwarded so the route resolves the SAME per-session flag. */

package/dist/lib/agent.js

@@ -451,6 +451,12 @@ export const CONTEXT_RUNTIME_KEY = "CONTEXT_RUNTIME_ENABLED";
 export const CONTEXT_TAIL_BUDGET_KEY = "CONTEXT_RUNTIME_TAIL_BUDGET_TOKENS";
 export const CONTEXT_READ_CACHE_KEY = "CONTEXT_RUNTIME_READ_CACHE_TOKENS";
 export const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT_RECLAIM";
+/**
+ * The gateway key the `adaptive` context profile sets (allow-listed per session): turns on the
+ * size-banded fold policy. Only the literal `banded` enables it; the band thresholds and budgets
+ * stay at the gateway's own defaults.
+ */
+export const CONTEXT_SIZE_POLICY_KEY = "CONTEXT_RUNTIME_SIZE_POLICY";
 /**
  * The named presets for how the gateway folds a session's context (`--context-profile`,
  * launcher.toml `context_profile`, `MNEMOM_AGENT_CONTEXT_PROFILE`):
@@ -459,8 +465,11 @@ export const CONTEXT_HEAD_RECLAIM_KEY = "CONTEXT_RUNTIME_HEAD_BREAKPOINT_RECLAIM
  *   - `balanced`   → NO fold keys: the gateway's own defaults stand. The default.
  *   - `aggressive` → a smaller tail budget + read cache and head-breakpoint reclaim on: folds
  *                    earlier and keeps a tighter working set.
+ *   - `adaptive`   → `CONTEXT_RUNTIME_SIZE_POLICY: "banded"` — the gateway picks the fold by the
+ *                    conversation's original size: no fold below 200k tokens, the aggressive
+ *                    budgets from 200k to 1M, balanced above. Opt-in; never the default.
  */
-export const CONTEXT_PROFILES = ["off", "balanced", "aggressive"];
+export const CONTEXT_PROFILES = ["off", "balanced", "aggressive", "adaptive"];
 /** The per-session env overlay each profile expands to (key order is the wire order). */
 const CONTEXT_PROFILE_CONFIG = {
     off: [[CONTEXT_RUNTIME_KEY, "false"]],
@@ -470,6 +479,7 @@ const CONTEXT_PROFILE_CONFIG = {
         [CONTEXT_READ_CACHE_KEY, "8000"],
         [CONTEXT_HEAD_RECLAIM_KEY, "true"],
     ],
+    adaptive: [[CONTEXT_SIZE_POLICY_KEY, "banded"]],
 };
 /**
  * The gateway env key that gates the whole context-handoff capability (level lines +
@@ -798,8 +808,10 @@ export function launchPreferenceExplicit(opts, env = process.env) {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session/personal-org/balance round trips. The Mnemom Agent
- * entitlement (which also gates Remote Control, fail-closed) is still fetched.
+ * the per-launch session prompt and balance round trips. The launch org still
+ * resolves as on a normal launch (active org, else personal org — the launch's
+ * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
+ * gates Remote Control, fail-closed) is still fetched for it.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -902,7 +914,7 @@ export function parseContextProfile(raw, source) {
 /**
  * Which context profile this launch runs under. Precedence, highest wins:
  *   1. `--no-context` — always `off`. Combined with an explicit `--context-profile
- *      balanced|aggressive` it is a CONFLICT and the launch refuses (never a silent override);
+ *      balanced|aggressive|adaptive` it is a CONFLICT and the launch refuses (never a silent override);
  *      `--context-profile off` agrees with it.
  *   2. an explicit `--context-profile <profile>` flag (`--context` alongside it is fine — the
  *      profile wins);
@@ -931,8 +943,8 @@ export function resolveContextProfile(opts) {
 /**
  * The decoded per-session env overlay for this launch — the `config` object of the
  * `x-mnemom-session-config` payload, in wire order: the profile's keys first
- * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`; nothing
- * for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
+ * (`CONTEXT_RUNTIME_ENABLED` for `off`; the three fold-tuning keys for `aggressive`;
+ * `CONTEXT_RUNTIME_SIZE_POLICY` for `adaptive`; nothing for `balanced`), then `CONTEXT_HANDOFF_ENABLED: "true"` when context handoff is ON, then
  * `GATEWAY_USAGE_REAL_SIZE: "on"` + `GATEWAY_COMPACTION_INTERCEPT: "on"` when EITHER the
  * `compaction_intercept` setting is ON OR `--compact-at` arms a target below 1M (the target
  * cannot be honored without the intercept), then `GATEWAY_COMPACTION_UPLOAD_TARGET_TOKENS: "<N>"`
@@ -977,7 +989,8 @@ export function buildSessionConfigPayload(opts) {
  * nothing to override (the gateway's own defaults stand — `balanced` with everything else off,
  * byte-identical to a launch before profiles existed). Independent overlays:
  *   - the context profile (`buildSessionConfig`): `off` → `CONTEXT_RUNTIME_ENABLED: "false"`,
- *     `aggressive` → the three fold-tuning keys, `balanced` → nothing;
+ *     `aggressive` → the three fold-tuning keys, `adaptive` → `CONTEXT_RUNTIME_SIZE_POLICY:
+ *     "banded"`, `balanced` → nothing;
  *   - `compactionIntercept: true` → `GATEWAY_USAGE_REAL_SIZE` + `GATEWAY_COMPACTION_INTERCEPT`
  *     `"on"` (the `compaction_intercept` setting);
  *   - `compactAt: <N>` (`--compact-at`, below 1M) → the SAME two intercept keys plus
@@ -995,6 +1008,14 @@ export function buildSessionConfigB64(opts) {
         return undefined;
     return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
 }
+/**
+ * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
+ * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
+ * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
+ * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
+ * launcher's birth probe (commands/wrap.ts birthThroughGateway).
+ */
+export const NOOP_SESSION_CONFIG_B64 = Buffer.from(JSON.stringify({ v: 1, config: {} }), "utf8").toString("base64url");
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -1038,6 +1059,12 @@ export const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
+/**
+ * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
+ * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
+ * gateway requires on every `mnemom agent` request.
+ */
+export const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /** The `--mcp-config` document registering exactly the `handoff` tool. Pure — no I/O. */
 export function buildHandoffMcpConfig(p) {
     const env = {
@@ -1046,6 +1073,8 @@ export function buildHandoffMcpConfig(p) {
         MNEMOM_HANDOFF_AGENT: p.agent,
         MNEMOM_HANDOFF_CONVERSATION_ID: p.conversationId,
     };
+    if (p.mnemomKeySource)
+        env.MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME = p.mnemomKeySource.envName;
     if (p.sessionConfigB64)
         env.MNEMOM_HANDOFF_SESSION_CONFIG = p.sessionConfigB64;
     return {

package/dist/lib/api.d.ts

@@ -1069,6 +1069,27 @@ export declare function listApiKeys(): Promise<ApiKeyListItem[]>;
  * for non-staff, admin:org for users not in any org-admin role).
  */
 export declare function createApiKey(name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
+/**
+ * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
+ * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
+ * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
+ * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
+ */
+export declare function createOrgApiKey(orgId: string, name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
+/**
+ * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
+ * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
+ * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
+ * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
+ * caller reads that as "could not check".
+ */
+export declare function apiAcceptsMnemomKey(key: string, timeoutMs: number): Promise<boolean>;
+/**
+ * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
+ * revoked or rotated key is absent). null when there is no usable session (no credential, or
+ * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
+ */
+export declare function listOwnApiKeysForCheck(timeoutMs: number): Promise<ApiKeyListItem[] | null>;
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1078,9 +1099,13 @@ export declare function createApiKey(name: string, scopes: ApiKeyScope[]): Promi
 export declare function rotateApiKey(keyId: string): Promise<ApiKeyCreated>;
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
+ * a key the signed-in user created (an org key they minted included) is
+ * found; anything else is a 404. `timeoutMs` bounds the call.
  */
-export declare function revokeApiKey(keyId: string): Promise<void>;
+export declare function revokeApiKey(keyId: string, opts?: {
+    timeoutMs?: number;
+}): Promise<void>;
 export interface LicenseValidationResult {
     valid: boolean;
     license_id?: string;

package/dist/lib/api.js

@@ -1385,6 +1385,65 @@ export async function createApiKey(name, scopes) {
     }
     return (await response.json());
 }
+/**
+ * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
+ * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
+ * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
+ * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
+ */
+export async function createOrgApiKey(orgId, name, scopes) {
+    const url = validateUrl(`${API_BASE}/v1/orgs/${encodeURIComponent(sanitizeForHttp(orgId))}/api-keys`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        method: "POST",
+        headers: { ...(await authHeaders()), "Content-Type": "application/json" },
+        body: JSON.stringify({ name, scopes }),
+    }));
+    if (!response.ok) {
+        if (response.status === 401)
+            throw new MnemomApiError(401, NOT_AUTHENTICATED_MSG);
+        throw await readApiError(response, "Failed to create org api key");
+    }
+    return (await response.json());
+}
+/**
+ * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
+ * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
+ * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
+ * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
+ * caller reads that as "could not check".
+ */
+export async function apiAcceptsMnemomKey(key, timeoutMs) {
+    const url = validateUrl(`${API_BASE}/v1/api-keys/whoami`);
+    const response = await mnemomFetch(url, {
+        headers: { "X-Mnemom-Api-Key": sanitizeForHttp(key), Accept: "application/json" },
+        signal: AbortSignal.timeout(timeoutMs),
+    });
+    if (response.ok)
+        return true;
+    if (response.status === 401 || response.status === 403)
+        return false;
+    throw new MnemomApiError(response.status, `api-key whoami: HTTP ${response.status}`);
+}
+/**
+ * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
+ * revoked or rotated key is absent). null when there is no usable session (no credential, or
+ * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
+ */
+export async function listOwnApiKeysForCheck(timeoutMs) {
+    if ((await resolveAuth()).type === "none")
+        return null;
+    const url = validateUrl(`${API_BASE}/v1/api-keys`);
+    const response = await fetchWithAuthRetry(url, async () => ({
+        headers: { ...(await authHeaders()), Accept: "application/json" },
+        signal: AbortSignal.timeout(timeoutMs),
+    }));
+    if (response.status === 401 || response.status === 403)
+        return null;
+    if (!response.ok) {
+        throw new MnemomApiError(response.status, `list api keys: HTTP ${response.status}`);
+    }
+    return (await response.json()).keys ?? [];
+}
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1410,13 +1469,16 @@ export async function rotateApiKey(keyId) {
 }
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
+ * a key the signed-in user created (an org key they minted included) is
+ * found; anything else is a 404. `timeoutMs` bounds the call.
  */
-export async function revokeApiKey(keyId) {
+export async function revokeApiKey(keyId, opts = {}) {
     const url = validateUrl(`${API_BASE}/v1/api-keys/${encodeURIComponent(keyId)}`);
     const response = await fetchWithAuthRetry(url, async () => ({
         method: "DELETE",
         headers: await authHeaders(),
+        signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     }));
     if (!response.ok) {
         if (response.status === 401) {

package/dist/lib/launcher-config.d.ts

@@ -58,7 +58,8 @@ export interface LauncherConfig {
     /**
      * How the gateway folds each session's context (`balanced` when unset): `off` leaves
      * compaction to the coding agent, `balanced` keeps more earlier work verbatim, `aggressive`
-     * folds earlier with a tighter working set. `--context-profile` overrides it per launch.
+     * folds earlier with a tighter working set, `adaptive` sizes the fold to the conversation
+     * (none below 200k tokens, aggressive up to 1M, balanced above). `--context-profile` overrides it per launch.
      */
     contextProfile?: ContextProfile;
     /**