@mnemom/mnemom 0.17.7-next.2 → 0.17.7

package/dist/lib/api.js

@@ -1385,65 +1385,6 @@ export async function createApiKey(name, scopes) {
     }
     return (await response.json());
 }
-/**
- * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
- * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
- * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
- * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
- */
-export async function createOrgApiKey(orgId, name, scopes) {
-    const url = validateUrl(`${API_BASE}/v1/orgs/${encodeURIComponent(sanitizeForHttp(orgId))}/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        method: "POST",
-        headers: { ...(await authHeaders()), "Content-Type": "application/json" },
-        body: JSON.stringify({ name, scopes }),
-    }));
-    if (!response.ok) {
-        if (response.status === 401)
-            throw new MnemomApiError(401, NOT_AUTHENTICATED_MSG);
-        throw await readApiError(response, "Failed to create org api key");
-    }
-    return (await response.json());
-}
-/**
- * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
- * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
- * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
- * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
- * caller reads that as "could not check".
- */
-export async function apiAcceptsMnemomKey(key, timeoutMs) {
-    const url = validateUrl(`${API_BASE}/v1/api-keys/whoami`);
-    const response = await mnemomFetch(url, {
-        headers: { "X-Mnemom-Api-Key": sanitizeForHttp(key), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (response.ok)
-        return true;
-    if (response.status === 401 || response.status === 403)
-        return false;
-    throw new MnemomApiError(response.status, `api-key whoami: HTTP ${response.status}`);
-}
-/**
- * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
- * revoked or rotated key is absent). null when there is no usable session (no credential, or
- * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
- */
-export async function listOwnApiKeysForCheck(timeoutMs) {
-    if ((await resolveAuth()).type === "none")
-        return null;
-    const url = validateUrl(`${API_BASE}/v1/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        headers: { ...(await authHeaders()), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    }));
-    if (response.status === 401 || response.status === 403)
-        return null;
-    if (!response.ok) {
-        throw new MnemomApiError(response.status, `list api keys: HTTP ${response.status}`);
-    }
-    return (await response.json()).keys ?? [];
-}
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1469,16 +1410,13 @@ export async function rotateApiKey(keyId) {
 }
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
- * a key the signed-in user created (an org key they minted included) is
- * found; anything else is a 404. `timeoutMs` bounds the call.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped.
  */
-export async function revokeApiKey(keyId, opts = {}) {
+export async function revokeApiKey(keyId) {
     const url = validateUrl(`${API_BASE}/v1/api-keys/${encodeURIComponent(keyId)}`);
     const response = await fetchWithAuthRetry(url, async () => ({
         method: "DELETE",
         headers: await authHeaders(),
-        signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     }));
     if (!response.ok) {
         if (response.status === 401) {

package/dist/lib/launcher-config.d.ts

@@ -56,11 +56,10 @@ export interface LauncherConfig {
      */
     compactionIntercept?: boolean;
     /**
-     * How the gateway folds each session's context (unset: nothing is sent, the gateway cell's
-     * own default decides): `off` leaves compaction to the coding agent, `balanced` keeps more
-     * earlier work verbatim, `aggressive` folds earlier with a tighter working set, `adaptive`
-     * sizes the fold to the conversation (none below 200k tokens, aggressive up to 1M, balanced
-     * above). `--context-profile` overrides it for one launch without saving anything.
+     * How the gateway folds each session's context (`balanced` when unset): `off` leaves
+     * compaction to the coding agent, `balanced` keeps more earlier work verbatim, `aggressive`
+     * folds earlier with a tighter working set, `adaptive` sizes the fold to the conversation
+     * (none below 200k tokens, aggressive up to 1M, balanced above). `--context-profile` overrides it per launch.
      */
     contextProfile?: ContextProfile;
     /**

package/dist/lib/launcher-config.js

@@ -215,7 +215,7 @@ export const CONFIG_KEYS = [
     },
     {
         key: "context_profile",
-        describe: `How the gateway folds each session's context (${CONTEXT_PROFILES.join("|")}; unset = the gateway cell's default)`,
+        describe: `How the gateway folds each session's context (${CONTEXT_PROFILES.join("|")}; balanced by default)`,
         get: (c) => c.contextProfile,
         set: (c, v) => {
             c.contextProfile = parseContextProfile(v, "context_profile");

package/dist/lib/subscription-login.d.ts

@@ -1,40 +1,15 @@
 /**
- * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
- * Mnemom API key EVERY launch sends.
- *
- * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
- * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
- * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
- * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
- * stored key is replaced), and a launch that cannot resolve one refuses to start.
- *
- * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
- * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
- * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
- * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
- * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
- * refuse every governed turn with it. When the mint is refused (an API that predates member org
- * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
- * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
- * it was minted for; a launch in another org mints and saves a key for that org.
- *
- * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
- * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
- * replaced and never revoked.
- *
- * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
- * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
- * and births a new agent in the key's org. The launcher's claim step then records the claim in
- * that same org.
- *
- * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
- * the gateway checks the plan with Anthropic and refuses anything else
- * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
- * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
- * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
- * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
- * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
- * claim.
+ * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
+ * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
+ * else (gateway/src/subscription-auth.ts).
+ *
+ * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
+ * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
+ * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
+ * The gateway anchors the governed identity on a Mnemom API key instead
+ * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
+ * freshly minted gateway-only key — and the agent is created in that key's org on the
+ * first turn, so there is no CLI-side birth or claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -47,133 +22,26 @@ export type AgentAuth = "api-key" | "subscription" | "console";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key every launch sends. */
+/** Env override for the Mnemom key a subscription launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
- * stored per org. Read as the no-org slot; retired when that slot is written.
- */
+/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
-/**
- * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
- * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
- */
-export declare const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
-/** A key in the 0600 store: the secret, and its API key_id when this CLI minted it. */
-export interface StoredMnemomKey {
-    key: string;
-    /** Absent on a key saved before key ids were stored. */
-    keyId?: string;
-    /** The launch org this key was minted for. Absent on a key saved before orgs were stored. */
-    orgId?: string;
-}
-/**
- * Is a Mnemom key live? `invalid` only when it is PROVEN dead (checkMnemomKey); anything unproven
- * (offline, slow, no session, a gateway-only key the API cannot introspect) is `unknown` — a
- * launch then proceeds with the key, and the gateway refuses a dead one with a clear message.
- */
-export type MnemomKeyCheck = "valid" | "invalid" | "unknown";
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
-    /**
-     * The active org (`mnemom org use`), or null when none is set. The store holds one key per
-     * org: a minted key belongs to the org that was active when it was minted.
-     */
-    activeOrgId: string | null;
-    /**
-     * The org this launch runs in — the active org, else the caller's personal org (the org the
-     * launcher claims the agent into) — or null when unknown. Keys are minted for it; with none
-     * known, a launch that needs a new key refuses (it has no org to mint one for).
-     */
-    launchOrgId: string | null;
-    readStored(orgId: string | null): StoredMnemomKey | undefined;
-    /**
-     * Mint an org-owned key with scopes ["gateway"] for `orgId`. Throws when the API refuses (a
-     * refusal carries `status`/`effectiveStatus` 403). Any `orgId` on the result is ignored: the
-     * store records the org the key was minted FOR.
-     */
-    mint(orgId: string): Promise<StoredMnemomKey>;
-    store(orgId: string | null, key: StoredMnemomKey): void;
-    /** checkMnemomKey over the real API, with short timeouts. Never throws. */
-    check(key: string, keyId: string | undefined): Promise<MnemomKeyCheck>;
-    /** Revoke a key this CLI minted, by key_id (needs a session). May throw; callers ignore it. */
-    revoke(keyId: string): Promise<void>;
+    readStored(): string | undefined;
+    /** Mint a gateway-only personal key for this machine; returns the secret. */
+    mint(): Promise<string>;
+    store(key: string): void;
     say(line: string): void;
 }
-/** A Mnemom key that is already on this machine, and where it came from. */
-export interface LocalMnemomKey {
-    key: string;
-    source: "env" | "store";
-    /** The stored key's API key_id, when known. */
-    keyId?: string;
-    /** The org the stored key was minted for, when known. */
-    orgId?: string;
-}
-/**
- * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
- * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
- * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
- */
-export declare function readLocalMnemomKey(deps: Pick<MnemomKeyDeps, "env" | "readStored" | "activeOrgId">): LocalMnemomKey | null;
-/** The I/O behind checkMnemomKey (lib/api.ts apiAcceptsMnemomKey / listOwnApiKeysForCheck). */
-export interface MnemomKeyCheckIo {
-    /** true = the API accepted the key on its own (whoami 200); false = it refused it (401/403). */
-    apiAccepts(key: string): Promise<boolean>;
-    /** The signed-in account's active keys (incl. org keys it minted), or null with no session. */
-    listOwnKeys(): Promise<Array<{
-        key_id: string;
-    }> | null>;
-}
-/**
- * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
- * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
- *
- *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
- *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
- *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
- *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
- *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
- *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
- *     Key prefixes are never matched: an 8-character prefix collides across keys.
- *
- * Any error or timeout ⇒ `unknown`.
- */
-export declare function checkMnemomKey(key: string, keyId: string | undefined, io: MnemomKeyCheckIo): Promise<MnemomKeyCheck>;
-/**
- * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
- * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
- * store it. The key is never printed.
- *
- *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
- *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
- *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
- *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
- *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
- *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
- *
- * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
- * would refuse the session, so the launch must not start.
- */
-export declare function resolveLaunchMnemomKey(deps: MnemomKeyDeps): Promise<string>;
-/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
-export declare function isMintRefusal(err: unknown): boolean;
-/** Store slot for a key minted with no active org (for the caller's personal org). */
-export declare const NO_ORG_SLOT = "_none";
-/**
- * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
- * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
- * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
- */
-export declare function readStoredMnemomKey(data: Record<string, unknown>, orgId: string | null): StoredMnemomKey | undefined;
 /**
- * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
- * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
- * removes it), so a stale legacy key can never shadow the new one.
+ * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
+ * key, else mint one (gateway scope only) and store it. The key is never printed.
  */
-export declare function storePatchForMnemomKey(data: Record<string, unknown>, orgId: string | null, key: StoredMnemomKey): Record<string, unknown>;
+export declare function resolveSubscriptionMnemomKey(deps: MnemomKeyDeps): Promise<string>;
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
  * (internal Mnemom accounts): the RC proxy then forwards the user's own OAuth bearer to the

package/dist/lib/subscription-login.js

@@ -1,40 +1,15 @@
 /**
- * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
- * Mnemom API key EVERY launch sends.
+ * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
+ * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
+ * else (gateway/src/subscription-auth.ts).
  *
- * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
- * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
- * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
- * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
- * stored key is replaced), and a launch that cannot resolve one refuses to start.
- *
- * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
- * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
- * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
- * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
- * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
- * refuse every governed turn with it. When the mint is refused (an API that predates member org
- * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
- * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
- * it was minted for; a launch in another org mints and saves a key for that org.
- *
- * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
- * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
- * replaced and never revoked.
- *
- * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
- * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
- * and births a new agent in the key's org. The launcher's claim step then records the claim in
- * that same org.
- *
- * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
- * the gateway checks the plan with Anthropic and refuses anything else
- * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
- * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
- * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
- * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
- * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
- * claim.
+ * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
+ * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
+ * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
+ * The gateway anchors the governed identity on a Mnemom API key instead
+ * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
+ * freshly minted gateway-only key — and the agent is created in that key's org on the
+ * first turn, so there is no CLI-side birth or claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -44,18 +19,10 @@
 export const AGENT_AUTHS = ["api-key", "subscription", "console"];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key every launch sends. */
+/** Env override for the Mnemom key a subscription launch sends. */
 export const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
- * stored per org. Read as the no-org slot; retired when that slot is written.
- */
+/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
-/**
- * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
- * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
- */
-export const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 /**
  * The key is spliced into the newline-joined ANTHROPIC_CUSTOM_HEADERS block, so an embedded
  * CR/LF (a multi-line paste, a bad env value) would inject extra header lines.
@@ -77,188 +44,35 @@ export function resolveAgentAuth(flag, env) {
     return fromEnv ? coerceAgentAuth(fromEnv) : "api-key";
 }
 /**
- * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
- * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
- * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
+ * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
+ * key, else mint one (gateway scope only) and store it. The key is never printed.
  */
-export function readLocalMnemomKey(deps) {
+export async function resolveSubscriptionMnemomKey(deps) {
     const fromEnv = headerSafe(deps.env[MNEMOM_KEY_ENV] ?? "");
     if (fromEnv)
-        return { key: fromEnv, source: "env" };
-    const stored = deps.readStored(deps.activeOrgId);
-    const key = headerSafe(stored?.key ?? "");
-    if (!key)
-        return null;
-    const local = { key, source: "store" };
-    if (stored?.keyId)
-        local.keyId = stored.keyId;
-    if (stored?.orgId)
-        local.orgId = stored.orgId;
-    return local;
-}
-/**
- * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
- * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
- *
- *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
- *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
- *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
- *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
- *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
- *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
- *     Key prefixes are never matched: an 8-character prefix collides across keys.
- *
- * Any error or timeout ⇒ `unknown`.
- */
-export async function checkMnemomKey(key, keyId, io) {
-    try {
-        if (!keyId)
-            return (await io.apiAccepts(key)) ? "valid" : "unknown";
-        const own = await io.listOwnKeys();
-        if (own === null)
-            return "unknown";
-        return own.some((k) => k.key_id === keyId) ? "valid" : "invalid";
-    }
-    catch {
-        return "unknown";
-    }
-}
-/**
- * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
- * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
- * store it. The key is never printed.
- *
- *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
- *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
- *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
- *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
- *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
- *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
- *
- * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
- * would refuse the session, so the launch must not start.
- */
-export async function resolveLaunchMnemomKey(deps) {
-    const local = readLocalMnemomKey(deps);
-    if (!local)
-        return mintAndStore(deps, null);
-    if (local.source === "env")
-        return local.key;
-    if (deps.launchOrgId && local.orgId !== deps.launchOrgId) {
-        deps.say("mnemom agent: the saved Mnemom API key was minted for another org — minting one for this launch's org.");
-        return mintAndStore(deps, local);
-    }
-    if ((await deps.check(local.key, local.keyId)) !== "invalid")
-        return local.key;
-    deps.say("mnemom agent: the saved Mnemom API key is no longer active (revoked or rotated) — minting a new one.");
-    return mintAndStore(deps, local);
-}
-/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
-export function isMintRefusal(err) {
-    if (!err || typeof err !== "object")
-        return false;
-    const { status, effectiveStatus } = err;
-    return (effectiveStatus ?? status) === 403;
-}
-const ORG_KEY_GUIDANCE = `  Ask an org owner or admin for an org API key with the \`gateway\` scope for this org, and set ${MNEMOM_KEY_ENV} to it.`;
-/**
- * Mint and save a key for the launch's org, then revoke `replaced` — the saved key it supersedes
- * — best-effort: only once the new key is saved (the store never points at a revoked key) and
- * only when its key_id is known (a legacy saved key has none; it is left as is).
- */
-async function mintAndStore(deps, replaced) {
-    const orgId = deps.launchOrgId;
-    if (!orgId) {
-        throw new Error("mnemom agent: every launch needs a Mnemom API key for the org it runs in, and this launch's org is unknown.\n" +
-            `  Pick one with \`mnemom org use <org>\`, or:\n${ORG_KEY_GUIDANCE}`);
-    }
+        return fromEnv;
+    const stored = headerSafe(deps.readStored() ?? "");
+    if (stored)
+        return stored;
     let minted;
     try {
-        minted = await deps.mint(orgId);
+        minted = headerSafe(await deps.mint());
     }
     catch (err) {
         const msg = err instanceof Error ? err.message : String(err);
-        const why = isMintRefusal(err)
-            ? `the Mnemom API refused to mint one for this org (${msg}) — your org role may not allow it (viewer or auditor), or the API predates member org keys`
-            : `minting one for this org failed (${msg})`;
-        throw new Error(`mnemom agent: every launch needs a Mnemom API key (the gateway refuses governed traffic without one) and ${why}.\n${ORG_KEY_GUIDANCE}`, { cause: err });
+        throw new Error(`mnemom agent: subscription login needs a Mnemom API key and minting one failed (${msg}).\n` +
+            `  Create one with \`mnemom api-key create --name mnemom-agent --scopes gateway\` and set ${MNEMOM_KEY_ENV}.`, { cause: err });
     }
-    const key = headerSafe(minted.key ?? "");
-    if (!key)
+    if (!minted)
         throw new Error("mnemom agent: the API returned an empty Mnemom key.");
-    const saved = { key, orgId };
-    if (minted.keyId)
-        saved.keyId = minted.keyId;
     try {
-        deps.store(deps.activeOrgId, saved);
+        deps.store(minted);
+        deps.say("mnemom agent: minted a gateway-only Mnemom API key for subscription login (saved to ~/.mnemom/launcher.json, 0600).");
     }
     catch {
         deps.say("mnemom agent: minted a gateway-only Mnemom API key for this launch but could not save it — the next launch mints another.");
-        return key;
-    }
-    deps.say("mnemom agent: minted a gateway-only Mnemom API key for this org (saved to ~/.mnemom/launcher.json, 0600).");
-    if (replaced?.keyId) {
-        try {
-            await deps.revoke(replaced.keyId);
-        }
-        catch {
-            // Best-effort: the old key may already be revoked, or not this account's to revoke.
-        }
     }
-    return key;
-}
-// ── The 0600 store's shape (~/.mnemom/launcher.json) ─────────────────────────
-/** Store slot for a key minted with no active org (for the caller's personal org). */
-export const NO_ORG_SLOT = "_none";
-function slotOf(orgId) {
-    return orgId || NO_ORG_SLOT;
-}
-/**
- * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
- * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
- * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
- */
-export function readStoredMnemomKey(data, orgId) {
-    const byOrg = data[MNEMOM_KEYS_BY_ORG_FIELD];
-    const entry = byOrg && typeof byOrg === "object" && !Array.isArray(byOrg)
-        ? byOrg[slotOf(orgId)]
-        : undefined;
-    if (entry && typeof entry === "object") {
-        const { key, key_id, org_id } = entry;
-        if (typeof key !== "string")
-            return undefined;
-        const stored = { key: headerSafe(key) };
-        if (typeof key_id === "string" && key_id)
-            stored.keyId = key_id;
-        if (typeof org_id === "string" && org_id)
-            stored.orgId = org_id;
-        return stored;
-    }
-    const legacy = data[MNEMOM_KEY_STORE_FIELD];
-    if (orgId === null && typeof legacy === "string")
-        return { key: headerSafe(legacy) };
-    return undefined;
-}
-/**
- * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
- * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
- * removes it), so a stale legacy key can never shadow the new one.
- */
-export function storePatchForMnemomKey(data, orgId, key) {
-    const prev = data[MNEMOM_KEYS_BY_ORG_FIELD];
-    const byOrg = prev && typeof prev === "object" && !Array.isArray(prev)
-        ? { ...prev }
-        : {};
-    const entry = { key: key.key };
-    if (key.keyId)
-        entry.key_id = key.keyId;
-    if (key.orgId)
-        entry.org_id = key.orgId;
-    byOrg[slotOf(orgId)] = entry;
-    const patch = { [MNEMOM_KEYS_BY_ORG_FIELD]: byOrg };
-    if (orgId === null)
-        patch[MNEMOM_KEY_STORE_FIELD] = null;
-    return patch;
+    return minted;
 }
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
@@ -285,9 +99,8 @@ export function subscriptionChildEnv(base, door, headers) {
     const env = { ...base };
     delete env.ANTHROPIC_API_KEY;
     delete env.ANTHROPIC_AUTH_TOKEN;
-    // The key already rides in the headers; the child process has no other use for it. Same
-    // strip, same constant, as the api-key/console arm of launchTerminal and the RC child.
-    Reflect.deleteProperty(env, MNEMOM_KEY_ENV);
+    // The key already rides in the headers; the child process has no other use for it.
+    delete env.MNEMOM_AGENT_MNEMOM_KEY;
     env.ANTHROPIC_BASE_URL = door;
     env.ANTHROPIC_CUSTOM_HEADERS = headers;
     return env;