@mnemom/mnemom 0.9.1 → 0.11.0

package/dist/commands/team.js

@@ -0,0 +1,507 @@
+/**
+ * `mnemom team ...` commands — Piece 2 of T1-3.1 (ADR-044 amended);
+ * extended in Piece 5 (ADR-046) with `team admin {grant,revoke,list}`.
+ *
+ *   mnemom team list                                     — list all teams across orgs
+ *   mnemom team show <team_id> [--json]                  — show one team's detail
+ *   mnemom team alignment-template <team_id>             — read alignment template
+ *   mnemom team alignment-template <team_id> --set <f>   — write from YAML/JSON file
+ *   mnemom team alignment-template <team_id> --clear     — clear template
+ *   mnemom team protection-template <team_id> [...]      — same shape (protection)
+ *   mnemom team preview-compose <team_id> [--protection] — dry-run from stdin/file
+ *   mnemom team admin grant   <team_id> --user <user_id> — grant team_admin
+ *   mnemom team admin revoke  <team_id> --user <user_id> — revoke team_admin
+ *   mnemom team admin list    <team_id> [--json]         — list active grants
+ *
+ * Per ADR-044 amended + Charter §I11: team membership is OPTIONAL. Teams
+ * are an agent grouping primitive within an org; users have no team
+ * concept. Backend RBAC for the template endpoints is purely org-level
+ * (requireOrgRole on team.org_id). The Team Admin role added in Piece 5
+ * (ADR-046) is the FIRST user-team association — a per-(org, team, user)
+ * grant managed via `mnemom team admin`.
+ */
+import { readFileSync } from "node:fs";
+import { listMyTeams, getTeam, getTeamTemplate, putTeamTemplate, deleteTeamTemplate, previewComposeTeamTemplate, grantTeamAdmin, revokeTeamAdmin, listTeamAdmins, } from "../lib/api.js";
+import { requireAuth } from "../lib/auth.js";
+import { fmt } from "../lib/format.js";
+// ─── mnemom team list ────────────────────────────────────────────────────
+export async function teamListCommand(opts) {
+    await requireAuth();
+    let teams;
+    try {
+        teams = await listMyTeams();
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to list teams: ${msg}`) + "\n");
+        process.exit(1);
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(teams, null, 2));
+        return;
+    }
+    console.log(fmt.header("Teams"));
+    console.log();
+    if (teams.length === 0) {
+        console.log("  No teams found.\n" +
+            "  Teams are an optional agent grouping primitive within an org.\n" +
+            "  Solo agents (zero teams) compose under Platform → Org → Agent.\n");
+        return;
+    }
+    const nameW = 28;
+    const idW = 38;
+    const orgW = 22;
+    const memberW = 8;
+    const header = "Name".padEnd(nameW) +
+        "Team ID".padEnd(idW) +
+        "Org".padEnd(orgW) +
+        "Members".padEnd(memberW);
+    console.log(`  ${header}`);
+    console.log(`  ${"─".repeat(nameW + idW + orgW + memberW)}`);
+    for (const team of teams) {
+        const name = team.name.slice(0, nameW - 2).padEnd(nameW);
+        const id = team.team_id.slice(0, idW - 2).padEnd(idW);
+        const org = (team.org_name ?? team.org_id).slice(0, orgW - 2).padEnd(orgW);
+        const members = String(team.member_count ?? 0).padEnd(memberW);
+        console.log(`  ${name}${id}${org}${members}`);
+    }
+    console.log(`\n  Total: ${teams.length} team(s)\n`);
+}
+// ─── mnemom team show <team_id> ──────────────────────────────────────────
+export async function teamShowCommand(teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error("Usage: mnemom team show <team_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    let team;
+    try {
+        team = await getTeam(teamId);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to fetch team: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(team, null, 2));
+        return;
+    }
+    console.log(fmt.header(team.name));
+    console.log();
+    console.log(`  Team ID:     ${team.team_id}`);
+    console.log(`  Org ID:      ${team.org_id}`);
+    if (team.description) {
+        console.log(`  Description: ${team.description}`);
+    }
+    console.log(`  Status:      ${team.status ?? "active"}`);
+    if (typeof team.member_count === "number") {
+        console.log(`  Members:     ${team.member_count}`);
+    }
+    if (team.visibility) {
+        console.log(`  Visibility:  ${team.visibility}`);
+    }
+    if (team.created_at) {
+        console.log(`  Created:     ${new Date(team.created_at).toLocaleDateString()}`);
+    }
+    console.log();
+}
+export async function teamTemplateCommand(kind, teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error(`Usage: mnemom team ${kind}-template <team_id> [--set <file> | --clear] [--json]`) +
+            "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.set && opts.clear) {
+        console.log(fmt.error("Specify --set OR --clear, not both.") + "\n");
+        process.exit(1);
+        return;
+    }
+    // ── PUT (--set <file>) ─────────────────────────────────────────────
+    if (opts.set) {
+        let body;
+        try {
+            body = readFileSync(opts.set, "utf8");
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.log(fmt.error(`Failed to read '${opts.set}': ${msg}`) + "\n");
+            process.exit(1);
+            return;
+        }
+        let result;
+        try {
+            result = await putTeamTemplate(teamId, kind, body);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.log(fmt.error(`Failed to write team ${kind} template: ${msg}`) + "\n");
+            process.exit(1);
+            return;
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(fmt.header(`Team ${kind} template — saved`));
+        console.log();
+        console.log(`  Team ID:           ${result.team_id}`);
+        console.log(`  Org ID:            ${result.org_id}`);
+        console.log(`  Enabled:           ${result.enabled ? "yes" : "no"}`);
+        if (typeof result.agents_flagged_for_recompose === "number") {
+            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose} ` +
+                `(active members of this team only — not blanket fan-out)`);
+        }
+        console.log();
+        return;
+    }
+    // ── DELETE (--clear) ────────────────────────────────────────────────
+    if (opts.clear) {
+        let result;
+        try {
+            result = await deleteTeamTemplate(teamId, kind);
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.log(fmt.error(`Failed to clear team ${kind} template: ${msg}`) + "\n");
+            process.exit(1);
+            return;
+        }
+        if (opts.json) {
+            console.log(JSON.stringify(result, null, 2));
+            return;
+        }
+        console.log(fmt.header(`Team ${kind} template — cleared`));
+        console.log();
+        console.log(`  Team ID:           ${result.team_id}`);
+        console.log(`  Org ID:            ${result.org_id}`);
+        console.log(`  Deleted:           yes`);
+        if (typeof result.agents_flagged_for_recompose === "number") {
+            console.log(`  Agents recompose:  ${result.agents_flagged_for_recompose}`);
+        }
+        console.log();
+        return;
+    }
+    // ── GET (default) ──────────────────────────────────────────────────
+    let result;
+    try {
+        result = await getTeamTemplate(teamId, kind);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to read team ${kind} template: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(fmt.header(`Team ${kind} template`));
+    console.log();
+    console.log(`  Team ID:  ${result.team_id}`);
+    console.log(`  Org ID:   ${result.org_id}`);
+    console.log(`  Enabled:  ${result.enabled ? "yes" : "no"}`);
+    console.log();
+    if (result.template) {
+        console.log(`  Template:`);
+        console.log(JSON.stringify(result.template, null, 2));
+    }
+    else {
+        console.log(`  No template set. Use --set <file> to write a YAML or JSON template.`);
+    }
+    console.log();
+}
+// ─── mnemom team preview-compose <team_id> ───────────────────────────────
+export async function teamPreviewComposeCommand(teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error("Usage: mnemom team preview-compose <team_id> [--protection] [--from <file>] [--json]") + "\n");
+        process.exit(1);
+        return;
+    }
+    const kind = opts.protection ? "protection" : "alignment";
+    let body;
+    if (opts.from) {
+        try {
+            body = readFileSync(opts.from, "utf8");
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            console.log(fmt.error(`Failed to read '${opts.from}': ${msg}`) + "\n");
+            process.exit(1);
+            return;
+        }
+    }
+    else {
+        // Read from stdin if no file specified.
+        body = await readAllStdin();
+        if (!body.trim()) {
+            console.log(fmt.error("No template body supplied. Pass --from <file> or pipe YAML/JSON via stdin.") + "\n");
+            process.exit(1);
+            return;
+        }
+    }
+    let result;
+    try {
+        result = await previewComposeTeamTemplate(teamId, kind, body);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Preview failed: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(fmt.header(`Preview compose — team ${kind}`));
+    console.log();
+    console.log(`  Team ID:    ${teamId}`);
+    console.log();
+    console.log(`  Composed (org floor + draft team + platform ceiling):`);
+    console.log(JSON.stringify(result.composed, null, 2));
+    console.log();
+    if (Array.isArray(result.conflicts) && result.conflicts.length > 0) {
+        console.log(fmt.warn(`  Conflicts (${result.conflicts.length}):`));
+        console.log(JSON.stringify(result.conflicts, null, 2));
+    }
+    else {
+        console.log(`  No conflicts — draft does not weaken any floor.`);
+    }
+    console.log();
+}
+// ─── mnemom team admin {grant,revoke,list} — Piece 5 of T1-3.1 (ADR-046) ──
+export async function teamAdminGrantCommand(teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error("Usage: mnemom team admin grant <team_id> --user <user_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    if (!opts.user) {
+        console.log(fmt.error("Missing --user <user_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    let result;
+    try {
+        result = await grantTeamAdmin(teamId, opts.user);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to grant team_admin: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (result.idempotent_noop) {
+        console.log(fmt.header("Team admin grant — already active"));
+        console.log();
+        console.log(`  Team ID:    ${result.team_id}`);
+        console.log(`  User ID:    ${result.user_id}`);
+        console.log(`  Granted by: ${result.granted_by}`);
+        console.log(`  Granted at: ${new Date(result.granted_at).toLocaleString()}`);
+        console.log(`  (no change — grant was already active)`);
+        console.log();
+        return;
+    }
+    console.log(fmt.header("Team admin granted"));
+    console.log();
+    console.log(`  Team ID:    ${result.team_id}`);
+    console.log(`  User ID:    ${result.user_id}`);
+    console.log(`  Granted by: ${result.granted_by}`);
+    console.log(`  Granted at: ${new Date(result.granted_at).toLocaleString()}`);
+    console.log();
+}
+export async function teamAdminRevokeCommand(teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error("Usage: mnemom team admin revoke <team_id> --user <user_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    if (!opts.user) {
+        console.log(fmt.error("Missing --user <user_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    let result;
+    try {
+        result = await revokeTeamAdmin(teamId, opts.user);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to revoke team_admin: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    if (!result.revoked) {
+        console.log(fmt.header("Team admin revoke — no active grant"));
+        console.log();
+        console.log(`  Team ID: ${result.team_id}`);
+        console.log(`  User ID: ${result.user_id}`);
+        console.log(`  (no change — no active grant existed)`);
+        console.log();
+        return;
+    }
+    console.log(fmt.header("Team admin revoked"));
+    console.log();
+    console.log(`  Team ID:    ${result.team_id}`);
+    console.log(`  User ID:    ${result.user_id}`);
+    if (result.revoked_at) {
+        console.log(`  Revoked at: ${new Date(result.revoked_at).toLocaleString()}`);
+    }
+    if (result.revoked_by) {
+        console.log(`  Revoked by: ${result.revoked_by}`);
+    }
+    console.log();
+}
+export async function teamAdminListCommand(teamId, opts) {
+    await requireAuth();
+    if (!teamId) {
+        console.log(fmt.error("Usage: mnemom team admin list <team_id>") + "\n");
+        process.exit(1);
+        return;
+    }
+    let result;
+    try {
+        result = await listTeamAdmins(teamId);
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        console.log(fmt.error(`Failed to list team admins: ${msg}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(result, null, 2));
+        return;
+    }
+    console.log(fmt.header(`Team admins — ${result.team_id}`));
+    console.log();
+    console.log(`  Org ID: ${result.org_id}`);
+    console.log();
+    if (result.count === 0) {
+        console.log("  No team admins on this team.\n" +
+            "  Org owners + admins act as implicit team admins for every team in the org\n" +
+            "  (per ADR-046). Grants are needed only for non-org-admin users.\n");
+        return;
+    }
+    const userW = 36;
+    const grantedByW = 36;
+    const grantedAtW = 22;
+    const header = "User ID".padEnd(userW) +
+        "Granted by".padEnd(grantedByW) +
+        "Granted at".padEnd(grantedAtW);
+    console.log(`  ${header}`);
+    console.log(`  ${"─".repeat(userW + grantedByW + grantedAtW)}`);
+    for (const grant of result.admins) {
+        const u = grant.user_id.slice(0, userW - 2).padEnd(userW);
+        const gb = grant.granted_by.slice(0, grantedByW - 2).padEnd(grantedByW);
+        const ga = new Date(grant.granted_at).toLocaleDateString().padEnd(grantedAtW);
+        console.log(`  ${u}${gb}${ga}`);
+    }
+    console.log(`\n  Total: ${result.count} active grant(s)\n`);
+}
+async function readAllStdin() {
+    return new Promise((resolve) => {
+        const chunks = [];
+        process.stdin.on("data", (chunk) => {
+            chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+        });
+        process.stdin.on("end", () => {
+            resolve(Buffer.concat(chunks).toString("utf8"));
+        });
+        process.stdin.on("error", () => {
+            resolve("");
+        });
+    });
+}
+// ─── mnemom team coverage <team_id> — Piece 6 of T1-3.1 ──────────────────
+//
+// Compliance-grade proof-of-coverage view: per-axis sweep summary for the
+// last 30 days + last-swept heartbeat. Surfaces the data SOC 2 / EU AI Act
+// control mappings need to answer "show evidence the detector ran during
+// the audit window" — answers it from a single endpoint.
+import { getTeamSidebandCoverage, } from "../lib/api.js";
+import chalk from "chalk";
+function freshnessColor(lastSweptAt) {
+    if (!lastSweptAt)
+        return chalk.dim;
+    const ageMs = Date.now() - Date.parse(lastSweptAt);
+    if (ageMs < 5 * 60_000)
+        return chalk.green; // <5 min — hot
+    if (ageMs < 60 * 60_000)
+        return chalk.yellow; // <1 hour — warm
+    return chalk.red; // ≥1 hour — stale
+}
+function formatSummary(s) {
+    const lastTxt = s.last_swept_at
+        ? freshnessColor(s.last_swept_at)(s.last_swept_at)
+        : chalk.red("never");
+    const fireRate = s.total_swept > 0 ? `${((s.total_fired / s.total_swept) * 100).toFixed(1)}%` : "—";
+    return [
+        chalk.bold(s.axis.padEnd(12)),
+        `swept=${String(s.total_swept).padStart(5)}`,
+        `fired=${String(s.total_fired).padStart(4)}`,
+        `skipped=${String(s.total_skipped).padStart(3)}`,
+        `fire_rate=${fireRate.padStart(7)}`,
+        `last_swept=${lastTxt}`,
+    ].join("  ");
+}
+export async function teamCoverageCommand(teamId, opts = {}) {
+    await requireAuth();
+    let result;
+    try {
+        result = await getTeamSidebandCoverage(teamId);
+    }
+    catch (err) {
+        console.error(fmt.error(err instanceof Error ? err.message : String(err)) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(fmt.json(result));
+        return;
+    }
+    console.log(fmt.header(`Sideband coverage — team ${result.team_id}`));
+    console.log(chalk.dim(`(last ${result.window_days} days)\n`));
+    for (const s of result.summary) {
+        console.log(`  ${formatSummary(s)}`);
+    }
+    if (opts.rows) {
+        console.log();
+        console.log(fmt.section("Daily rows"));
+        if (result.rows.length === 0) {
+            console.log(chalk.dim("  (no rows)"));
+        }
+        else {
+            console.log(chalk.dim("  DAY         AXIS         SWEPT  FIRED  SKIP  LAST_SWEPT_AT          OUTCOME"));
+            for (const r of result.rows) {
+                console.log([
+                    "  ",
+                    r.day.padEnd(12),
+                    r.axis.padEnd(12),
+                    String(r.swept_count).padStart(5),
+                    String(r.fired_count).padStart(6),
+                    String(r.skipped_count).padStart(5),
+                    "  " + r.last_swept_at.padEnd(22),
+                    r.last_outcome,
+                ].join(" "));
+            }
+        }
+    }
+}

package/dist/commands/validate.d.ts

@@ -0,0 +1,23 @@
+/**
+ * `mnemom validate ...` commands — Safe House Hardening T1-4 (CI gate
+ * integration). Surface for engineers to check whether staging is safe
+ * to promote to production based on the most recent harness run state.
+ *
+ *   mnemom validate safe-house [--against=staging] [--max-age=24h]
+ *                              [--lane=full|fast] [--strict] [--json]
+ *
+ * Wraps `GET /v1/admin/safe-house/harness-state` (mnemom-staff only).
+ * Returns the most-recent run per lane and renders a promotion-ready
+ * summary. With `--strict`, exits non-zero when a lane is stale OR not
+ * green — useful for shell scripts and the `mnemom/deploy` gate-guard
+ * workflow which can call the CLI rather than parse the JSON itself.
+ */
+interface ValidateSafeHouseOptions {
+    against?: string;
+    maxAge?: string;
+    lane?: "full" | "fast" | "both";
+    strict?: boolean;
+    json?: boolean;
+}
+export declare function validateSafeHouseCommand(opts: ValidateSafeHouseOptions): Promise<void>;
+export {};

package/dist/commands/validate.js

@@ -0,0 +1,150 @@
+/**
+ * `mnemom validate ...` commands — Safe House Hardening T1-4 (CI gate
+ * integration). Surface for engineers to check whether staging is safe
+ * to promote to production based on the most recent harness run state.
+ *
+ *   mnemom validate safe-house [--against=staging] [--max-age=24h]
+ *                              [--lane=full|fast] [--strict] [--json]
+ *
+ * Wraps `GET /v1/admin/safe-house/harness-state` (mnemom-staff only).
+ * Returns the most-recent run per lane and renders a promotion-ready
+ * summary. With `--strict`, exits non-zero when a lane is stale OR not
+ * green — useful for shell scripts and the `mnemom/deploy` gate-guard
+ * workflow which can call the CLI rather than parse the JSON itself.
+ */
+import { fmt } from "../lib/format.js";
+import { requireAuth } from "../lib/auth.js";
+import { getSafeHouseHarnessState, } from "../lib/api.js";
+/**
+ * Parse `--max-age=...` strings: 30m, 2h, 24h, 1d, etc.
+ * Returns milliseconds. Defaults to 24h.
+ */
+function parseMaxAge(input) {
+    const fallback = 24 * 60 * 60 * 1000;
+    if (!input)
+        return fallback;
+    const match = input.trim().match(/^(\d+)\s*(s|m|h|d)$/i);
+    if (!match) {
+        throw new Error(`Invalid --max-age value '${input}' (expected e.g. 30m, 2h, 24h, 1d).`);
+    }
+    const n = parseInt(match[1], 10);
+    const unit = match[2].toLowerCase();
+    const ms = n * { s: 1000, m: 60_000, h: 3_600_000, d: 86_400_000 }[unit];
+    return ms;
+}
+function formatRelativeAge(startedAt) {
+    const ageMs = Date.now() - Date.parse(startedAt);
+    if (ageMs < 0)
+        return "in the future?";
+    const m = Math.floor(ageMs / 60_000);
+    if (m < 1)
+        return "<1m ago";
+    if (m < 60)
+        return `${m}m ago`;
+    const h = Math.floor(m / 60);
+    if (h < 24)
+        return `${h}h ${m % 60}m ago`;
+    const d = Math.floor(h / 24);
+    return `${d}d ${h % 24}h ago`;
+}
+function evaluateLane(lane, run, maxAgeMs) {
+    if (!run) {
+        return {
+            lane,
+            ok: false,
+            reason: "no run on record",
+            run: null,
+        };
+    }
+    const ageMs = Date.now() - Date.parse(run.started_at);
+    if (ageMs > maxAgeMs) {
+        return { lane, ok: false, reason: "stale (older than --max-age)", run };
+    }
+    if (!run.is_complete) {
+        return { lane, ok: false, reason: "did not complete", run };
+    }
+    if (run.failed > 0) {
+        return { lane, ok: false, reason: `${run.failed} failed pair(s)`, run };
+    }
+    if (run.cac_violations > 0) {
+        return { lane, ok: false, reason: `${run.cac_violations} CAC violation(s)`, run };
+    }
+    if (run.i10_violations > 0) {
+        return { lane, ok: false, reason: `${run.i10_violations} I10 violation(s)`, run };
+    }
+    return { lane, ok: true, reason: "green within window", run };
+}
+function renderRun(run) {
+    const lines = [];
+    lines.push(fmt.label("run_id:", run.run_id));
+    lines.push(fmt.label("started:", `${run.started_at} (${formatRelativeAge(run.started_at)})`));
+    lines.push(fmt.label("status:", run.is_complete ? "complete" : "in-progress / cancelled"));
+    lines.push(fmt.label("tally:", `${run.passed}/${run.total_pairs} pass · ${run.failed} fail · ${run.warned} warn · ${run.cac_violations} CAC · ${run.i10_violations} I10`));
+    lines.push(fmt.label("trigger:", `${run.trigger}${run.git_sha ? ` (sha=${run.git_sha.slice(0, 8)})` : ""}`));
+    if (run.duration_ms !== null) {
+        const sec = Math.round(run.duration_ms / 1000);
+        lines.push(fmt.label("duration:", `${sec}s`));
+    }
+    return lines.map((l) => `    ${l}`).join("\n");
+}
+export async function validateSafeHouseCommand(opts) {
+    await requireAuth();
+    // `--against` is informational only today (validation is always against
+    // the api root the user is authenticated to). Keep the flag for forward-
+    // compat: production gains a separate harness corpus per T1.
+    const against = opts.against ?? "staging";
+    if (against !== "staging" && against !== "production") {
+        console.log(fmt.error(`--against must be 'staging' or 'production' (got '${against}')`) + "\n");
+        process.exit(1);
+        return;
+    }
+    let maxAgeMs;
+    try {
+        maxAgeMs = parseMaxAge(opts.maxAge);
+    }
+    catch (err) {
+        console.log(fmt.error(err instanceof Error ? err.message : String(err)) + "\n");
+        process.exit(1);
+        return;
+    }
+    let state;
+    try {
+        state = await getSafeHouseHarnessState();
+    }
+    catch (err) {
+        console.log(fmt.error(`Failed to fetch harness state: ${err instanceof Error ? err.message : err}`) + "\n");
+        process.exit(1);
+        return;
+    }
+    if (opts.json) {
+        console.log(JSON.stringify(state, null, 2));
+        return;
+    }
+    const fullVerdict = evaluateLane("full", state.full, maxAgeMs);
+    const fastVerdict = evaluateLane("fast", state.fast, maxAgeMs);
+    const wantedLane = opts.lane ?? "both";
+    const verdicts = wantedLane === "full" ? [fullVerdict]
+        : wantedLane === "fast" ? [fastVerdict]
+            : [fullVerdict, fastVerdict];
+    console.log(fmt.header(`Safe House harness — ${against}`));
+    console.log("");
+    for (const v of verdicts) {
+        const heading = v.lane === "full" ? "Full lane (nightly)" : "Fast lane (deploy gate)";
+        console.log(`  ${heading}`);
+        if (v.run) {
+            console.log(renderRun(v.run));
+        }
+        else {
+            console.log("    (no run on record)");
+        }
+        const verdict = v.ok ? fmt.success(`gate: ${v.reason}`) : fmt.error(`gate: ${v.reason}`);
+        console.log(`    ${verdict}\n`);
+    }
+    if (opts.strict) {
+        const allOk = verdicts.every((v) => v.ok);
+        if (!allOk) {
+            process.exit(1);
+            return;
+        }
+    }
+}