@mnemom/mnemom 0.17.7-next.2 → 0.17.8-next.0

package/dist/lib/agent.d.ts

@@ -491,10 +491,8 @@ export declare function launchPreferenceExplicit(opts: {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session prompt and balance round trips. The launch org still
- * resolves as on a normal launch (active org, else personal org — the launch's
- * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
- * gates Remote Control, fail-closed) is still fetched for it.
+ * the per-launch session/personal-org/balance round trips. The Mnemom Agent
+ * entitlement (which also gates Remote Control, fail-closed) is still fetched.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -543,11 +541,7 @@ export declare function resolveRemoteControlShape(args: {
 export declare function buildCustomHeaders(opts: {
     /** Absent on a subscription-login launch: Claude Code then sends its own claude.ai login. */
     anthropicKey?: string;
-    /**
-     * The Mnemom key every `mnemom agent` launch sends (lib/subscription-login.ts
-     * resolveLaunchMnemomKey) — the gateway refuses the session without it, and on a subscription
-     * login it is also the governed-identity anchor.
-     */
+    /** The governed-identity anchor on a subscription-login launch (lib/subscription-login.ts). */
     mnemomKey?: string;
     agent: string;
     conversationId: string;
@@ -662,14 +656,6 @@ export declare function buildSessionConfigB64(opts: {
     compactAt?: number | null;
     experimental?: readonly string[];
 }): string | undefined;
-/**
- * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
- * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
- * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
- * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
- * launcher's birth probe (commands/wrap.ts birthThroughGateway).
- */
-export declare const NOOP_SESSION_CONFIG_B64: string;
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -705,12 +691,6 @@ export declare const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export declare const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
-/**
- * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
- * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
- * gateway requires on every `mnemom agent` request.
- */
-export declare const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /**
  * How the `handoff` MCP server (cli/src/mcp/handoff-server.mjs) recovers the Anthropic key
  * WITHOUT it ever being written into the `--mcp-config` file on disk: `envName` is the NAME of a
@@ -742,12 +722,6 @@ export interface HandoffMcpParams {
     /** The gateway ORIGIN (e.g. https://gateway.mnemom.ai) — see `resolveHandoffGatewayHost`. */
     gatewayHost: string;
     anthropicKeySource: HandoffAnthropicKeySource;
-    /**
-     * Where the server reads the Mnemom key (`x-mnemom-api-key`) from — same contract as
-     * `anthropicKeySource`: `ANTHROPIC_CUSTOM_HEADERS` (its `x-mnemom-api-key:` line) on a terminal
-     * launch, `HANDOFF_RC_MNEMOM_KEY_ENV_NAME` under Remote Control. Absent ⇒ no Mnemom key header.
-     */
-    mnemomKeySource?: HandoffAnthropicKeySource;
     agent: string;
     conversationId: string;
     /** `buildSessionConfigB64` output — forwarded so the route resolves the SAME per-session flag. */

package/dist/lib/agent.js

@@ -842,10 +842,8 @@ export function launchPreferenceExplicit(opts, env = process.env) {
  * Has an orchestrator already run the session + µ-balance preflight for this
  * launch? `MNEMOM_AGENT_PREFLIGHTED=1` is for orchestrators (the ADW fleet) that
  * checked sign-in and balance themselves before spawning many launches; it skips
- * the per-launch session prompt and balance round trips. The launch org still
- * resolves as on a normal launch (active org, else personal org — the launch's
- * Mnemom key is minted for it), and the Mnemom Agent entitlement (which also
- * gates Remote Control, fail-closed) is still fetched for it.
+ * the per-launch session/personal-org/balance round trips. The Mnemom Agent
+ * entitlement (which also gates Remote Control, fail-closed) is still fetched.
  * Only the exact value `1` counts — anything else, including `true` or ` 1`, is
  * a normal launch.
  */
@@ -1056,14 +1054,6 @@ export function buildSessionConfigB64(opts) {
         return undefined;
     return Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
 }
-/**
- * A no-op `x-mnemom-session-config` value: `{ v: 1, config: {} }` overrides nothing (the gateway
- * applies an empty set, exactly its own defaults). buildSessionConfigB64 returns `undefined` for
- * the defaults — no header at all; this is for a call that must be Mnemom agent traffic (the
- * gateway's agent-traffic gate keys on the header's presence) without changing any setting: the
- * launcher's birth probe (commands/wrap.ts birthThroughGateway).
- */
-export const NOOP_SESSION_CONFIG_B64 = Buffer.from(JSON.stringify({ v: 1, config: {} }), "utf8").toString("base64url");
 /**
  * Is the `handoff` MCP tool + `CONTEXT_HANDOFF_ENABLED` session-config header ON for
  * this launch? OFF by default (operator directive, curation 2026-09-25): an absent flag
@@ -1107,12 +1097,6 @@ export const HANDOFF_MCP_SERVER_NAME = "mnemom-handoff";
  * it the same way it inherits `ANTHROPIC_CUSTOM_HEADERS` under the terminal shape.
  */
 export const HANDOFF_RC_KEY_ENV_NAME = "MNEMOM_HANDOFF_KEY";
-/**
- * Beside `HANDOFF_RC_KEY_ENV_NAME`: the non-`ANTHROPIC_*` var `spawnRcCli` sets to the launch's
- * Mnemom key when context handoff is on, so the handoff call carries the `x-mnemom-api-key` the
- * gateway requires on every `mnemom agent` request.
- */
-export const HANDOFF_RC_MNEMOM_KEY_ENV_NAME = "MNEMOM_HANDOFF_MNEMOM_KEY";
 /** The `--mcp-config` document registering exactly the `handoff` tool. Pure — no I/O. */
 export function buildHandoffMcpConfig(p) {
     const env = {
@@ -1121,8 +1105,6 @@ export function buildHandoffMcpConfig(p) {
         MNEMOM_HANDOFF_AGENT: p.agent,
         MNEMOM_HANDOFF_CONVERSATION_ID: p.conversationId,
     };
-    if (p.mnemomKeySource)
-        env.MNEMOM_HANDOFF_MNEMOM_KEY_ENV_NAME = p.mnemomKeySource.envName;
     if (p.sessionConfigB64)
         env.MNEMOM_HANDOFF_SESSION_CONFIG = p.sessionConfigB64;
     return {

package/dist/lib/api.d.ts

@@ -1069,27 +1069,6 @@ export declare function listApiKeys(): Promise<ApiKeyListItem[]>;
  * for non-staff, admin:org for users not in any org-admin role).
  */
 export declare function createApiKey(name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
-/**
- * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
- * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
- * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
- * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
- */
-export declare function createOrgApiKey(orgId: string, name: string, scopes: ApiKeyScope[]): Promise<ApiKeyCreated>;
-/**
- * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
- * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
- * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
- * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
- * caller reads that as "could not check".
- */
-export declare function apiAcceptsMnemomKey(key: string, timeoutMs: number): Promise<boolean>;
-/**
- * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
- * revoked or rotated key is absent). null when there is no usable session (no credential, or
- * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
- */
-export declare function listOwnApiKeysForCheck(timeoutMs: number): Promise<ApiKeyListItem[] | null>;
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1099,13 +1078,9 @@ export declare function listOwnApiKeysForCheck(timeoutMs: number): Promise<ApiKe
 export declare function rotateApiKey(keyId: string): Promise<ApiKeyCreated>;
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
- * a key the signed-in user created (an org key they minted included) is
- * found; anything else is a 404. `timeoutMs` bounds the call.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped.
  */
-export declare function revokeApiKey(keyId: string, opts?: {
-    timeoutMs?: number;
-}): Promise<void>;
+export declare function revokeApiKey(keyId: string): Promise<void>;
 export interface LicenseValidationResult {
     valid: boolean;
     license_id?: string;

package/dist/lib/api.js

@@ -1385,65 +1385,6 @@ export async function createApiKey(name, scopes) {
     }
     return (await response.json());
 }
-/**
- * POST /v1/orgs/{org_id}/api-keys — mint an ORG-owned key (its `org_id` is that org, so the
- * gateway births a new agent there). Owners and admins may mint any scopes; a member may mint a
- * key whose scopes are exactly ["gateway"]. A refusal (viewer/auditor, a non-member, or an API
- * that predates member org keys) is thrown as MnemomApiError with its status (403/404).
- */
-export async function createOrgApiKey(orgId, name, scopes) {
-    const url = validateUrl(`${API_BASE}/v1/orgs/${encodeURIComponent(sanitizeForHttp(orgId))}/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        method: "POST",
-        headers: { ...(await authHeaders()), "Content-Type": "application/json" },
-        body: JSON.stringify({ name, scopes }),
-    }));
-    if (!response.ok) {
-        if (response.status === 401)
-            throw new MnemomApiError(401, NOT_AUTHENTICATED_MSG);
-        throw await readApiError(response, "Failed to create org api key");
-    }
-    return (await response.json());
-}
-/**
- * GET /v1/api-keys/whoami authenticated by `key` ALONE (`X-Mnemom-Api-Key`, no session): does
- * the API accept this key? true = 200. false = 401/403 — revoked, rotated or unknown, OR a valid
- * `gateway`-only key: the API refuses every key without an `api:*` scope (ADR-049), so false
- * alone never proves a key dead. Throws on anything else (network, timeout, 429, 5xx): the
- * caller reads that as "could not check".
- */
-export async function apiAcceptsMnemomKey(key, timeoutMs) {
-    const url = validateUrl(`${API_BASE}/v1/api-keys/whoami`);
-    const response = await mnemomFetch(url, {
-        headers: { "X-Mnemom-Api-Key": sanitizeForHttp(key), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    });
-    if (response.ok)
-        return true;
-    if (response.status === 401 || response.status === 403)
-        return false;
-    throw new MnemomApiError(response.status, `api-key whoami: HTTP ${response.status}`);
-}
-/**
- * GET /v1/api-keys with a timeout, for checking a key: the signed-in caller's ACTIVE keys (a
- * revoked or rotated key is absent). null when there is no usable session (no credential, or
- * 401/403 after the refresh retry). Throws on anything else (network, timeout, 5xx).
- */
-export async function listOwnApiKeysForCheck(timeoutMs) {
-    if ((await resolveAuth()).type === "none")
-        return null;
-    const url = validateUrl(`${API_BASE}/v1/api-keys`);
-    const response = await fetchWithAuthRetry(url, async () => ({
-        headers: { ...(await authHeaders()), Accept: "application/json" },
-        signal: AbortSignal.timeout(timeoutMs),
-    }));
-    if (response.status === 401 || response.status === 403)
-        return null;
-    if (!response.ok) {
-        throw new MnemomApiError(response.status, `list api keys: HTTP ${response.status}`);
-    }
-    return (await response.json()).keys ?? [];
-}
 /**
  * POST /v1/api-keys/{key_id}/rotate — atomic mint-new + revoke-old.
  * Returns the full new secret only on this call. The new key inherits
@@ -1469,16 +1410,13 @@ export async function rotateApiKey(keyId) {
 }
 /**
  * DELETE /v1/api-keys/{key_id} — soft-revoke. The key row stays for
- * audit; `is_active` flips to false and `revoked_at` is timestamped. Only
- * a key the signed-in user created (an org key they minted included) is
- * found; anything else is a 404. `timeoutMs` bounds the call.
+ * audit; `is_active` flips to false and `revoked_at` is timestamped.
  */
-export async function revokeApiKey(keyId, opts = {}) {
+export async function revokeApiKey(keyId) {
     const url = validateUrl(`${API_BASE}/v1/api-keys/${encodeURIComponent(keyId)}`);
     const response = await fetchWithAuthRetry(url, async () => ({
         method: "DELETE",
         headers: await authHeaders(),
-        signal: opts.timeoutMs ? AbortSignal.timeout(opts.timeoutMs) : undefined,
     }));
     if (!response.ok) {
         if (response.status === 401) {

package/dist/lib/subscription-login.d.ts

@@ -1,40 +1,15 @@
 /**
- * `mnemom agent` launch auth: the `auth` setting (api-key | console | subscription) and the
- * Mnemom API key EVERY launch sends.
- *
- * The Mnemom key (`x-mnemom-api-key`) rides on every governed request a launch makes, for every
- * auth mode and launch shape: the gateway refuses `mnemom agent` traffic that carries no
- * verified Mnemom key. This module resolves it — env, then the key stored for the active org in
- * the 0600 store, then a freshly minted gateway-only key — checks it once (a revoked or rotated
- * stored key is replaced), and a launch that cannot resolve one refuses to start.
- *
- * Which org a key belongs to: the key is minted FOR the launch's org — the active org, else the
- * caller's personal org, i.e. the org the launcher claims the agent into — as an org-owned key
- * with scopes exactly ["gateway"] (POST /v1/orgs/:id/api-keys; any owner/admin/member may mint
- * one), so the gateway's agent-traffic org check (#2289: the agent's org must be the key's org)
- * passes. There is no personal-key fallback: a personal key has no org, so the gateway would
- * refuse every governed turn with it. When the mint is refused (an API that predates member org
- * keys, or a viewer/auditor role) the launch stops with guidance — ask an org owner/admin for a
- * gateway-scoped org key, or set MNEMOM_AGENT_MNEMOM_KEY to one. Each saved key records the org
- * it was minted for; a launch in another org mints and saves a key for that org.
- *
- * When the launcher replaces a key it minted and saved (proven dead, minted for another org, or
- * the legacy single-field key), it revokes the old one best-effort. An env-provided key is never
- * replaced and never revoked.
- *
- * Birth org: the launcher's gateway probe/birth call carries the key AND a no-op
- * `x-mnemom-session-config`, which makes it Mnemom agent traffic: the gateway verifies the key
- * and births a new agent in the key's org. The launcher's claim step then records the claim in
- * that same org.
- *
- * With a Claude subscription login (`auth = subscription`) — Team and Enterprise plans only;
- * the gateway checks the plan with Anthropic and refuses anything else
- * (gateway/src/subscription-auth.ts) — Claude Code authenticates to the gateway with its own
- * claude.ai OAuth login: the launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY /
- * ANTHROPIC_AUTH_TOKEN unset, so Claude Code sends `Authorization: Bearer <its login>`. No
- * Anthropic key is involved; the gateway anchors the governed identity on the Mnemom key and
- * creates the agent in that key's org on the first turn, so there is no CLI-side birth or
- * claim.
+ * `mnemom agent` with a Claude subscription login (`auth = subscription`) — Team and
+ * Enterprise plans only; the gateway checks the plan with Anthropic and refuses anything
+ * else (gateway/src/subscription-auth.ts).
+ *
+ * Claude Code then authenticates to the gateway with its own claude.ai OAuth login: the
+ * launch sets ANTHROPIC_BASE_URL and leaves ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN unset,
+ * so Claude Code sends `Authorization: Bearer <its login>`. No Anthropic key is involved.
+ * The gateway anchors the governed identity on a Mnemom API key instead
+ * (`x-mnemom-api-key`), which this module resolves — env, then the 0600 store, then a
+ * freshly minted gateway-only key — and the agent is created in that key's org on the
+ * first turn, so there is no CLI-side birth or claim.
  *
  * Remote Control is internal-only (see subscriptionShape); the context-handoff tool
  * authenticates with an Anthropic key, so it is off on a subscription launch.
@@ -47,133 +22,26 @@ export type AgentAuth = "api-key" | "subscription" | "console";
 export declare const AGENT_AUTHS: readonly AgentAuth[];
 /** Env override for the setting (the launcher.toml `auth` key folds into it). */
 export declare const AGENT_AUTH_ENV = "MNEMOM_AGENT_AUTH";
-/** Env override for the Mnemom key every launch sends. */
+/** Env override for the Mnemom key a subscription launch sends. */
 export declare const MNEMOM_KEY_ENV = "MNEMOM_AGENT_MNEMOM_KEY";
-/**
- * Legacy field in ~/.mnemom/launcher.json (0600): the single minted key, from before keys were
- * stored per org. Read as the no-org slot; retired when that slot is written.
- */
+/** Field in ~/.mnemom/launcher.json (0600) holding the minted key. */
 export declare const MNEMOM_KEY_STORE_FIELD = "mnemom_api_key";
-/**
- * Field in ~/.mnemom/launcher.json (0600): `{ <active org id | "_none">: { key, key_id, org_id } }`
- * — one slot per `mnemom org use` setting; `org_id` is the org the key was minted for.
- */
-export declare const MNEMOM_KEYS_BY_ORG_FIELD = "mnemom_api_keys";
 export declare function coerceAgentAuth(raw: string): AgentAuth;
 /** `--auth` flag > MNEMOM_AGENT_AUTH (launcher.toml folds in here) > api-key. */
 export declare function resolveAgentAuth(flag: string | undefined, env: Record<string, string | undefined>): AgentAuth;
-/** A key in the 0600 store: the secret, and its API key_id when this CLI minted it. */
-export interface StoredMnemomKey {
-    key: string;
-    /** Absent on a key saved before key ids were stored. */
-    keyId?: string;
-    /** The launch org this key was minted for. Absent on a key saved before orgs were stored. */
-    orgId?: string;
-}
-/**
- * Is a Mnemom key live? `invalid` only when it is PROVEN dead (checkMnemomKey); anything unproven
- * (offline, slow, no session, a gateway-only key the API cannot introspect) is `unknown` — a
- * launch then proceeds with the key, and the gateway refuses a dead one with a clear message.
- */
-export type MnemomKeyCheck = "valid" | "invalid" | "unknown";
 export interface MnemomKeyDeps {
     env: Record<string, string | undefined>;
-    /**
-     * The active org (`mnemom org use`), or null when none is set. The store holds one key per
-     * org: a minted key belongs to the org that was active when it was minted.
-     */
-    activeOrgId: string | null;
-    /**
-     * The org this launch runs in — the active org, else the caller's personal org (the org the
-     * launcher claims the agent into) — or null when unknown. Keys are minted for it; with none
-     * known, a launch that needs a new key refuses (it has no org to mint one for).
-     */
-    launchOrgId: string | null;
-    readStored(orgId: string | null): StoredMnemomKey | undefined;
-    /**
-     * Mint an org-owned key with scopes ["gateway"] for `orgId`. Throws when the API refuses (a
-     * refusal carries `status`/`effectiveStatus` 403). Any `orgId` on the result is ignored: the
-     * store records the org the key was minted FOR.
-     */
-    mint(orgId: string): Promise<StoredMnemomKey>;
-    store(orgId: string | null, key: StoredMnemomKey): void;
-    /** checkMnemomKey over the real API, with short timeouts. Never throws. */
-    check(key: string, keyId: string | undefined): Promise<MnemomKeyCheck>;
-    /** Revoke a key this CLI minted, by key_id (needs a session). May throw; callers ignore it. */
-    revoke(keyId: string): Promise<void>;
+    readStored(): string | undefined;
+    /** Mint a gateway-only personal key for this machine; returns the secret. */
+    mint(): Promise<string>;
+    store(key: string): void;
     say(line: string): void;
 }
-/** A Mnemom key that is already on this machine, and where it came from. */
-export interface LocalMnemomKey {
-    key: string;
-    source: "env" | "store";
-    /** The stored key's API key_id, when known. */
-    keyId?: string;
-    /** The org the stored key was minted for, when known. */
-    orgId?: string;
-}
-/**
- * The Mnemom key already on this machine — MNEMOM_AGENT_MNEMOM_KEY, else the key stored for the
- * active org — or null. Never mints. Shared by the launch (which mints on null), `mnemom agent
- * doctor` (which reports the source) and the goal commands (which send the key the launch sent).
- */
-export declare function readLocalMnemomKey(deps: Pick<MnemomKeyDeps, "env" | "readStored" | "activeOrgId">): LocalMnemomKey | null;
-/** The I/O behind checkMnemomKey (lib/api.ts apiAcceptsMnemomKey / listOwnApiKeysForCheck). */
-export interface MnemomKeyCheckIo {
-    /** true = the API accepted the key on its own (whoami 200); false = it refused it (401/403). */
-    apiAccepts(key: string): Promise<boolean>;
-    /** The signed-in account's active keys (incl. org keys it minted), or null with no session. */
-    listOwnKeys(): Promise<Array<{
-        key_id: string;
-    }> | null>;
-}
-/**
- * Is `key` a live Mnemom key? A key counts as dead (`invalid`) only when that is PROVEN;
- * anything unproven proceeds, and the gateway refuses a dead key with a clear message.
- *
- *   - A key whose key_id we know (this CLI minted and saved it): the signed-in account's active
- *     keys — which include the org keys it minted — either list that key_id (`valid`) or do not:
- *     the key was revoked or rotated (`invalid`). No usable session ⇒ `unknown`.
- *   - Any other key (MNEMOM_AGENT_MNEMOM_KEY, a legacy saved key): whoami with the key itself.
- *     200 ⇒ `valid`. A refusal proves nothing — the API refuses every key without an `api:*`
- *     scope (ADR-049), so a live gateway-only key is refused exactly like a dead one ⇒ `unknown`.
- *     Key prefixes are never matched: an 8-character prefix collides across keys.
- *
- * Any error or timeout ⇒ `unknown`.
- */
-export declare function checkMnemomKey(key: string, keyId: string | undefined, io: MnemomKeyCheckIo): Promise<MnemomKeyCheck>;
-/**
- * The Mnemom key every launch sends — api-key, console and subscription alike: the local key
- * (readLocalMnemomKey); else mint one (scopes ["gateway"], org-owned, for the launch's org) and
- * store it. The key is never printed.
- *
- *   - MNEMOM_AGENT_MNEMOM_KEY is used as given: not checked here (nothing could prove it dead —
- *     see checkMnemomKey), never replaced, never revoked. The gateway refuses a dead one.
- *   - A saved key minted for another org than the launch's (or saved before orgs were recorded,
- *     e.g. the legacy single-field key) is replaced by one for the launch's org, unchecked.
- *   - A saved key checked once (`deps.check`) and proven dead is replaced by a fresh one.
- *   - Replacing a saved key this CLI minted revokes the old one, best-effort.
- *
- * THROWS when no key can be had (no launch org, or the mint is refused or fails): the gateway
- * would refuse the session, so the launch must not start.
- */
-export declare function resolveLaunchMnemomKey(deps: MnemomKeyDeps): Promise<string>;
-/** Did the API refuse the mint (403: an API that predates member org keys, or a viewer/auditor)? */
-export declare function isMintRefusal(err: unknown): boolean;
-/** Store slot for a key minted with no active org (for the caller's personal org). */
-export declare const NO_ORG_SLOT = "_none";
-/**
- * The key stored for `orgId` in the store document: `mnemom_api_keys[<org id | _none>]`. The
- * pre-per-org field `mnemom_api_key` (a bare string, minted personal) still serves the no-org
- * slot until that slot is written. CR/LF stripped; anything malformed reads as no key.
- */
-export declare function readStoredMnemomKey(data: Record<string, unknown>, orgId: string | null): StoredMnemomKey | undefined;
 /**
- * The mergeStore patch that saves `key` for `orgId` — replacing that org's key, keeping every
- * other org's. Writing the no-org slot retires the legacy `mnemom_api_key` field (a null value
- * removes it), so a stale legacy key can never shadow the new one.
+ * The Mnemom key a subscription launch sends: MNEMOM_AGENT_MNEMOM_KEY, else the stored
+ * key, else mint one (gateway scope only) and store it. The key is never printed.
  */
-export declare function storePatchForMnemomKey(data: Record<string, unknown>, orgId: string | null, key: StoredMnemomKey): Record<string, unknown>;
+export declare function resolveSubscriptionMnemomKey(deps: MnemomKeyDeps): Promise<string>;
 /**
  * Remote Control on a subscription login is open to accounts entitled to Remote Control
  * (internal Mnemom accounts): the RC proxy then forwards the user's own OAuth bearer to the