@mnemom/mnemom 0.9.1 → 0.10.0

package/dist/index.js

@@ -3,12 +3,17 @@ import { program } from "commander";
 import { statusCommand } from "./commands/status.js";
 import { integrityCommand } from "./commands/integrity.js";
 import { logsCommand } from "./commands/logs.js";
-import { licenseActivateCommand, licenseStatusCommand, licenseDeactivateCommand } from "./commands/license.js";
-import { cardShowCommand, cardPublishCommand, cardValidateCommand, cardEditCommand, cardEvaluateCommand } from "./commands/card.js";
+import { licenseActivateCommand, licenseStatusCommand, licenseDeactivateCommand, } from "./commands/license.js";
+import { cardShowCommand, cardPublishCommand, cardValidateCommand, cardEditCommand, cardEvaluateCommand, } from "./commands/card.js";
 import { policyInitCommand, policyValidateCommand, policyPublishCommand, policyListCommand, policyTestCommand, policyEvaluateCommand, } from "./commands/policy.js";
-import { protectionShowCommand, protectionPublishCommand, protectionValidateCommand, protectionEditCommand } from "./commands/protection.js";
+import { protectionShowCommand, protectionPublishCommand, protectionValidateCommand, protectionEditCommand, } from "./commands/protection.js";
 import { agentsListCommand } from "./commands/agents.js";
+import { orgListCommand, orgShowCommand } from "./commands/org.js";
+import { teamListCommand, teamShowCommand, teamTemplateCommand, teamPreviewComposeCommand, teamAdminGrantCommand, teamAdminRevokeCommand, teamAdminListCommand, teamCoverageCommand, } from "./commands/team.js";
+import { advisoriesListCommand, advisoriesShowCommand, } from "./commands/advisories.js";
+import { postureListCommand, postureShowCommand, postureCreateCommand, postureUpdateCommand, postureCloneCommand, postureRevisionsCommand, postureDiffCommand, postureAssignCommand, postureUnassignCommand, posturePreviewComposeCommand, postureDeleteCommand, } from "./commands/posture.js";
 import { loginCommand, logoutCommand, whoamiCommand } from "./commands/auth.js";
+import { validateSafeHouseCommand } from "./commands/validate.js";
 program
     .name("mnemom")
     .description("Transparent AI agent tracing")
@@ -55,9 +60,7 @@ program
         process.exit(1);
     }
 });
-const license = program
-    .command("license")
-    .description("Enterprise license management");
+const license = program.command("license").description("Enterprise license management");
 license
     .command("activate <jwt>")
     .description("Activate an enterprise license")
@@ -97,9 +100,7 @@ license
 // ============================================================================
 // Card commands (alignment card)
 // ============================================================================
-const cardCmd = program
-    .command("card")
-    .description("Manage alignment card");
+const cardCmd = program.command("card").description("Manage alignment card");
 cardCmd
     .command("show")
     .description("Display alignment card (YAML)")
@@ -174,9 +175,7 @@ cardCmd
 // ============================================================================
 // Protection card commands
 // ============================================================================
-const protectionCmd = program
-    .command("protection")
-    .description("Manage protection card");
+const protectionCmd = program.command("protection").description("Manage protection card");
 protectionCmd
     .command("show")
     .description("Display protection card (YAML)")
@@ -241,12 +240,16 @@ const policyCmd = program
 policyCmd
     .command("init")
     .description("(removed) Use `mnemom card validate`")
-    .action(async () => { await policyInitCommand(); });
+    .action(async () => {
+    await policyInitCommand();
+});
 policyCmd
     .command("validate")
     .argument("<file>", "Path to policy file")
     .description("(removed) Use `mnemom card validate`")
-    .action(async (file) => { await policyValidateCommand(file); });
+    .action(async (file) => {
+    await policyValidateCommand(file);
+});
 policyCmd
     .command("publish")
     .argument("<file>", "Path to policy file")
@@ -297,6 +300,401 @@ program
     }
 });
 // ============================================================================
+// Organization management (ADR-044, Piece 1 of T1-3.1)
+// ============================================================================
+const orgCmd = program
+    .command("org")
+    .description("Manage your organizations (personal + multi-user)");
+orgCmd
+    .command("list")
+    .description("List every org you are a member of, including your personal org")
+    .option("--json", "Output JSON instead of a human-readable table")
+    .action(async (options) => {
+    try {
+        await orgListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+orgCmd
+    .command("show [org_id]")
+    .description("Show details of an org (default: your personal org if --personal, else single membership)")
+    .option("--personal", "Show your personal-org-of-one (per ADR-044)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (orgId, options) => {
+    try {
+        await orgShowCommand(orgId, { personal: options.personal, json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Team management (ADR-044 amended, Piece 2 of T1-3.1)
+//
+// Per ADR-044 + Charter §I11: team membership is OPTIONAL. Solo agents
+// (zero teams) compose under Platform → Org → Agent. Backend RBAC for
+// team-template endpoints is purely org-level (requireOrgRole on the
+// team's parent org); Team Admin role lands in Piece 5.
+// ============================================================================
+const teamCmd = program
+    .command("team")
+    .description("Manage teams and their scope-cascade templates");
+teamCmd
+    .command("list")
+    .description("List every team across all orgs you are a member of")
+    .option("--json", "Output JSON instead of a human-readable table")
+    .action(async (options) => {
+    try {
+        await teamListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("show <team_id>")
+    .description("Show details of a single team")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamShowCommand(teamId, { json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("alignment-template <team_id>")
+    .description("Read or write the team's alignment template")
+    .option("--set <file>", "Write the template from a YAML or JSON file")
+    .option("--clear", "Clear the template")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamTemplateCommand("alignment", teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("protection-template <team_id>")
+    .description("Read or write the team's protection template")
+    .option("--set <file>", "Write the template from a YAML or JSON file")
+    .option("--clear", "Clear the template")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamTemplateCommand("protection", teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("preview-compose <team_id>")
+    .description("Dry-run the composer with a draft template (alignment by default)")
+    .option("--protection", "Preview protection template (default: alignment)")
+    .option("--from <file>", "Read draft template from a file (default: stdin)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamPreviewComposeCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// `mnemom team admin {grant,revoke,list}` — Piece 5 of T1-3.1 (ADR-046).
+const teamAdminCmd = teamCmd
+    .command("admin")
+    .description("Manage team_admin grants (Piece 5 of T1-3.1, ADR-046)");
+teamAdminCmd
+    .command("grant <team_id>")
+    .description("Grant team_admin role to a user on this team")
+    .requiredOption("--user <user_id>", "User ID to grant team_admin to")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminGrantCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamAdminCmd
+    .command("revoke <team_id>")
+    .description("Revoke a team_admin grant (admin or self)")
+    .requiredOption("--user <user_id>", "User ID to revoke (use your own ID for self-revoke)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminRevokeCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamAdminCmd
+    .command("list <team_id>")
+    .description("List active team_admin grants on a team")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminListCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// `mnemom team coverage <team_id>` — Piece 6 of T1-3.1 (ADR-040 + ADR-045 +
+// ADR-047). Compliance-grade proof-of-coverage for a team's sideband
+// detector sweeps; per-axis 30-day summary + per-day rows.
+teamCmd
+    .command("coverage <team_id>")
+    .description("Show last-30-day sideband sweep coverage for a team")
+    .option("--rows", "Include per-day rows in addition to per-axis summary")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamCoverageCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Sideband advisories (Piece 6 of T1-3.1, ADR-040 + ADR-045 + ADR-047)
+//
+// Surface the `pending_advisories` rows where source LIKE 'sideband.%' as a
+// CLI-readable cross-turn carryover view. Detector firings (coherence,
+// fault-line, fleet, drift) land here; the gateway injects them on the
+// agent's next turn.
+// ============================================================================
+const advisoriesCmd = program
+    .command("advisories")
+    .description("List + inspect sideband advisories (pending_advisories rows)");
+advisoriesCmd
+    .command("list")
+    .description("List recent sideband advisories scoped to one agent or one team")
+    .option("--agent <id>", "Scope to a single agent")
+    .option("--team <id>", "Scope to all agents in a team")
+    .option("--source <source>", "Filter to one source (e.g. sideband.coherence)")
+    .option("--limit <n>", "Page size (default 50 for agent, 100 for team)")
+    .option("--since <iso>", "Only advisories created at or after this ISO timestamp")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await advisoriesListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+advisoriesCmd
+    .command("show <advisory_id>")
+    .description("Show one advisory's full content (nudge_content + source_ref)")
+    .option("--agent <id>", "Scope lookup to this agent")
+    .option("--team <id>", "Scope lookup to this team")
+    .option("--json", "Output JSON")
+    .action(async (advisoryId, options) => {
+    try {
+        await advisoriesShowCommand(advisoryId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Trust Posture (Piece 3 of T1-3.1, ADR-045)
+//
+// Postures are team-scoped policy input that drives the observer's sideband
+// sweep. Cards remain agent-scoped runtime output; postures are a parallel
+// artifact type. Mnemom ships three default postures (Standard / High-
+// Compliance / Low-Latency) seeded via migration; orgs use them as-is or
+// clone-and-customize.
+// ============================================================================
+const postureCmd = program
+    .command("posture")
+    .description("Manage Trust Postures (team-scoped oversight policy)");
+postureCmd
+    .command("list")
+    .description("List visible postures (Mnemom defaults + org-owned)")
+    .option("--org <id>", "Filter to postures owned by this org")
+    .option("--no-include-platform", "Hide Mnemom-shipped platform defaults")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await postureListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("show <posture_id>")
+    .description("Show one posture's metadata + body summary")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureShowCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("create")
+    .description("Create a new org-scope posture (body from a JSON file)")
+    .requiredOption("--org <id>", "Target org ID")
+    .requiredOption("--slug <slug>", "Kebab-case slug, unique within the org")
+    .requiredOption("--name <name>", "Display name")
+    .requiredOption("--from <file>", "Path to a JSON file with the posture body")
+    .option("--description <text>", "Optional description")
+    .option("--summary <text>", "Change summary for the initial revision")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await postureCreateCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("update <posture_id>")
+    .description("Write a new revision (forward-only — old revisions stay queryable)")
+    .requiredOption("--from <file>", "Path to a JSON file with the new posture body")
+    .option("--summary <text>", "Change summary for this revision")
+    .option("--name <text>", "Update the posture's display name")
+    .option("--description <text>", "Update the description")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureUpdateCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("clone <posture_id>")
+    .description("Clone any visible posture into an org as the customization starting point")
+    .requiredOption("--org <id>", "Target org ID")
+    .option("--slug <slug>", "Slug for the new posture (default: <source-slug>-clone)")
+    .option("--name <name>", "Display name for the new posture")
+    .option("--description <text>", "Description override")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureCloneCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("revisions <posture_id>")
+    .description("List the posture's revision history (newest first)")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureRevisionsCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("diff <posture_id>")
+    .description("Structural diff between two revisions of a posture")
+    .requiredOption("--from <N>", "Revision number to diff from")
+    .requiredOption("--to <M>", "Revision number to diff to")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureDiffCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("assign <posture_id>")
+    .description("Assign a posture to a team (replaces any prior assignment for that team)")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .option("--pin-revision <N>", "Pin to a specific revision number (default: float against current)")
+    .action(async (postureId, options) => {
+    try {
+        await postureAssignCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("unassign <posture_id>")
+    .description("Remove a posture's assignment from a team")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .action(async (postureId, options) => {
+    try {
+        await postureUnassignCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("preview-compose <posture_id>")
+    .description("Preview the effective composed posture for a team if assigned")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await posturePreviewComposeCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("delete <posture_id>")
+    .description("Soft-delete an org-scope posture (refuses if currently assigned to any team)")
+    .action(async (postureId) => {
+    try {
+        await postureDeleteCommand(postureId);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
 // Auth
 // ============================================================================
 program
@@ -336,4 +734,34 @@ program
         process.exit(1);
     }
 });
+// ── validate (Safe House Hardening T1-4) ─────────────────────────────────
+const validateCmd = program
+    .command("validate")
+    .description("Validate platform state against quality gates");
+validateCmd
+    .command("safe-house")
+    .description("Render Safe House harness state per lane (full/fast) — promotion-readiness signal")
+    .option("--against <env>", "Target environment ('staging' or 'production'; informational)", "staging")
+    .option("--max-age <duration>", "Reject runs older than this (e.g. 30m, 2h, 24h, 1d)", "24h")
+    .option("--lane <lane>", "Show only one lane ('full', 'fast', or 'both')", "both")
+    .option("--strict", "Exit non-zero if any selected lane is stale or red")
+    .option("--json", "Emit raw JSON state instead of rendered output")
+    .action(async (opts) => {
+    try {
+        const lane = opts.lane === "full" || opts.lane === "fast" || opts.lane === "both"
+            ? opts.lane
+            : "both";
+        await validateSafeHouseCommand({
+            against: opts.against,
+            maxAge: opts.maxAge,
+            lane,
+            strict: opts.strict,
+            json: opts.json,
+        });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
 program.parse();