@mnemom/mnemom 0.9.1 → 0.11.0

package/dist/index.js

@@ -3,12 +3,18 @@ import { program } from "commander";
 import { statusCommand } from "./commands/status.js";
 import { integrityCommand } from "./commands/integrity.js";
 import { logsCommand } from "./commands/logs.js";
-import { licenseActivateCommand, licenseStatusCommand, licenseDeactivateCommand } from "./commands/license.js";
-import { cardShowCommand, cardPublishCommand, cardValidateCommand, cardEditCommand, cardEvaluateCommand } from "./commands/card.js";
+import { licenseActivateCommand, licenseStatusCommand, licenseDeactivateCommand, } from "./commands/license.js";
+import { cardShowCommand, cardPublishCommand, cardValidateCommand, cardEditCommand, cardEvaluateCommand, } from "./commands/card.js";
 import { policyInitCommand, policyValidateCommand, policyPublishCommand, policyListCommand, policyTestCommand, policyEvaluateCommand, } from "./commands/policy.js";
-import { protectionShowCommand, protectionPublishCommand, protectionValidateCommand, protectionEditCommand } from "./commands/protection.js";
+import { protectionShowCommand, protectionPublishCommand, protectionValidateCommand, protectionEditCommand, } from "./commands/protection.js";
 import { agentsListCommand } from "./commands/agents.js";
+import { orgListCommand, orgShowCommand } from "./commands/org.js";
+import { teamListCommand, teamShowCommand, teamTemplateCommand, teamPreviewComposeCommand, teamAdminGrantCommand, teamAdminRevokeCommand, teamAdminListCommand, teamCoverageCommand, } from "./commands/team.js";
+import { advisoriesListCommand, advisoriesShowCommand, } from "./commands/advisories.js";
+import { postureListCommand, postureShowCommand, postureCreateCommand, postureUpdateCommand, postureCloneCommand, postureRevisionsCommand, postureDiffCommand, postureAssignCommand, postureUnassignCommand, posturePreviewComposeCommand, postureDeleteCommand, } from "./commands/posture.js";
 import { loginCommand, logoutCommand, whoamiCommand } from "./commands/auth.js";
+import { validateSafeHouseCommand } from "./commands/validate.js";
+import { apiKeyListCommand, apiKeyCreateCommand, apiKeyRotateCommand, apiKeyRevokeCommand, } from "./commands/api-key.js";
 program
     .name("mnemom")
     .description("Transparent AI agent tracing")
@@ -55,9 +61,7 @@ program
         process.exit(1);
     }
 });
-const license = program
-    .command("license")
-    .description("Enterprise license management");
+const license = program.command("license").description("Enterprise license management");
 license
     .command("activate <jwt>")
     .description("Activate an enterprise license")
@@ -97,9 +101,7 @@ license
 // ============================================================================
 // Card commands (alignment card)
 // ============================================================================
-const cardCmd = program
-    .command("card")
-    .description("Manage alignment card");
+const cardCmd = program.command("card").description("Manage alignment card");
 cardCmd
     .command("show")
     .description("Display alignment card (YAML)")
@@ -174,9 +176,7 @@ cardCmd
 // ============================================================================
 // Protection card commands
 // ============================================================================
-const protectionCmd = program
-    .command("protection")
-    .description("Manage protection card");
+const protectionCmd = program.command("protection").description("Manage protection card");
 protectionCmd
     .command("show")
     .description("Display protection card (YAML)")
@@ -241,12 +241,16 @@ const policyCmd = program
 policyCmd
     .command("init")
     .description("(removed) Use `mnemom card validate`")
-    .action(async () => { await policyInitCommand(); });
+    .action(async () => {
+    await policyInitCommand();
+});
 policyCmd
     .command("validate")
     .argument("<file>", "Path to policy file")
     .description("(removed) Use `mnemom card validate`")
-    .action(async (file) => { await policyValidateCommand(file); });
+    .action(async (file) => {
+    await policyValidateCommand(file);
+});
 policyCmd
     .command("publish")
     .argument("<file>", "Path to policy file")
@@ -297,6 +301,607 @@ program
     }
 });
 // ============================================================================
+// Organization management (ADR-044, Piece 1 of T1-3.1)
+// ============================================================================
+const orgCmd = program
+    .command("org")
+    .description("Manage your organizations (personal + multi-user)");
+orgCmd
+    .command("list")
+    .description("List every org you are a member of, including your personal org")
+    .option("--json", "Output JSON instead of a human-readable table")
+    .action(async (options) => {
+    try {
+        await orgListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+orgCmd
+    .command("show [org_id]")
+    .description("Show details of an org (default: your personal org if --personal, else single membership)")
+    .option("--personal", "Show your personal-org-of-one (per ADR-044)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (orgId, options) => {
+    try {
+        await orgShowCommand(orgId, { personal: options.personal, json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Team management (ADR-044 amended, Piece 2 of T1-3.1)
+//
+// Per ADR-044 + Charter §I11: team membership is OPTIONAL. Solo agents
+// (zero teams) compose under Platform → Org → Agent. Backend RBAC for
+// team-template endpoints is purely org-level (requireOrgRole on the
+// team's parent org); Team Admin role lands in Piece 5.
+// ============================================================================
+const teamCmd = program
+    .command("team")
+    .description("Manage teams and their scope-cascade templates");
+teamCmd
+    .command("list")
+    .description("List every team across all orgs you are a member of")
+    .option("--json", "Output JSON instead of a human-readable table")
+    .action(async (options) => {
+    try {
+        await teamListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("show <team_id>")
+    .description("Show details of a single team")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamShowCommand(teamId, { json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("alignment-template <team_id>")
+    .description("Read or write the team's alignment template")
+    .option("--set <file>", "Write the template from a YAML or JSON file")
+    .option("--clear", "Clear the template")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamTemplateCommand("alignment", teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("protection-template <team_id>")
+    .description("Read or write the team's protection template")
+    .option("--set <file>", "Write the template from a YAML or JSON file")
+    .option("--clear", "Clear the template")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamTemplateCommand("protection", teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamCmd
+    .command("preview-compose <team_id>")
+    .description("Dry-run the composer with a draft template (alignment by default)")
+    .option("--protection", "Preview protection template (default: alignment)")
+    .option("--from <file>", "Read draft template from a file (default: stdin)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamPreviewComposeCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// `mnemom team admin {grant,revoke,list}` — Piece 5 of T1-3.1 (ADR-046).
+const teamAdminCmd = teamCmd
+    .command("admin")
+    .description("Manage team_admin grants (Piece 5 of T1-3.1, ADR-046)");
+teamAdminCmd
+    .command("grant <team_id>")
+    .description("Grant team_admin role to a user on this team")
+    .requiredOption("--user <user_id>", "User ID to grant team_admin to")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminGrantCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamAdminCmd
+    .command("revoke <team_id>")
+    .description("Revoke a team_admin grant (admin or self)")
+    .requiredOption("--user <user_id>", "User ID to revoke (use your own ID for self-revoke)")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminRevokeCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+teamAdminCmd
+    .command("list <team_id>")
+    .description("List active team_admin grants on a team")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamAdminListCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// `mnemom team coverage <team_id>` — Piece 6 of T1-3.1 (ADR-040 + ADR-045 +
+// ADR-047). Compliance-grade proof-of-coverage for a team's sideband
+// detector sweeps; per-axis 30-day summary + per-day rows.
+teamCmd
+    .command("coverage <team_id>")
+    .description("Show last-30-day sideband sweep coverage for a team")
+    .option("--rows", "Include per-day rows in addition to per-axis summary")
+    .option("--json", "Output JSON instead of human-readable text")
+    .action(async (teamId, options) => {
+    try {
+        await teamCoverageCommand(teamId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Sideband advisories (Piece 6 of T1-3.1, ADR-040 + ADR-045 + ADR-047)
+//
+// Surface the `pending_advisories` rows where source LIKE 'sideband.%' as a
+// CLI-readable cross-turn carryover view. Detector firings (coherence,
+// fault-line, fleet, drift) land here; the gateway injects them on the
+// agent's next turn.
+// ============================================================================
+const advisoriesCmd = program
+    .command("advisories")
+    .description("List + inspect sideband advisories (pending_advisories rows)");
+advisoriesCmd
+    .command("list")
+    .description("List recent sideband advisories scoped to one agent or one team")
+    .option("--agent <id>", "Scope to a single agent")
+    .option("--team <id>", "Scope to all agents in a team")
+    .option("--source <source>", "Filter to one source (e.g. sideband.coherence)")
+    .option("--limit <n>", "Page size (default 50 for agent, 100 for team)")
+    .option("--since <iso>", "Only advisories created at or after this ISO timestamp")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await advisoriesListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+advisoriesCmd
+    .command("show <advisory_id>")
+    .description("Show one advisory's full content (nudge_content + source_ref)")
+    .option("--agent <id>", "Scope lookup to this agent")
+    .option("--team <id>", "Scope lookup to this team")
+    .option("--json", "Output JSON")
+    .action(async (advisoryId, options) => {
+    try {
+        await advisoriesShowCommand(advisoryId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Governance signals (ADR-048) — operator-actionable observation surface
+//
+// Distinct from `mnemom advisories list` (which now narrows to runtime.* /
+// manual.* per ADR-048 §1). Surfaces sideband.* + future protection.* /
+// posture.* signals from governance_signals: ack/resolve/dismiss workflow,
+// notification destinations (slack/email/pagerduty/webhook), escalation
+// rules.
+// ============================================================================
+import { governanceSignalsListCommand, governanceSignalsShowCommand, governanceSignalsAckCommand, governanceSignalsResolveCommand, governanceSignalsDismissCommand, governanceDestinationsListCommand, governanceDestinationsAddCommand, governanceDestinationsRemoveCommand, governanceDestinationsTestCommand, governanceRulesListCommand, governanceRulesAddCommand, governanceRulesRemoveCommand, } from "./commands/governance.js";
+const governanceCmd = program
+    .command("governance")
+    .description("Operator workflow for governance_signals (ADR-048)");
+const govSignalsCmd = governanceCmd
+    .command("signals")
+    .description("List, inspect, and transition governance_signals");
+govSignalsCmd
+    .command("list")
+    .description("List governance signals at platform/org/team/agent scope")
+    .option("--org <id>", "Org scope")
+    .option("--team <id>", "Team scope")
+    .option("--agent <id>", "Per-agent slice (signals affecting this agent)")
+    .option("--source <s>", "Filter by source (sideband.{drift,coherence,fault_line,fleet})")
+    .option("--severity <s>", "Filter by severity (info|warn|high|critical)")
+    .option("--status <s>", "Filter by status (open|acknowledged|resolved|dismissed|expired)")
+    .option("--scope <s>", "Filter by scope (platform|org|team|agent)")
+    .option("--pattern-type <s>", "Filter by pattern_type")
+    .option("--since <iso>", "Detected since (ISO timestamp)")
+    .option("--limit <n>", "Max rows (default 100, max 500)")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceSignalsListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("show <signal_id>")
+    .description("Show one signal in detail")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsShowCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("ack <signal_id>")
+    .description("Acknowledge an open signal (org_admin / org_owner)")
+    .option("--action <text>", "Operator-authored action note")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsAckCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("resolve <signal_id>")
+    .description("Resolve a signal with a resolution status")
+    .requiredOption("--status <s>", "Resolution status (action_taken|wont_fix|duplicate|false_positive|self_resolved)")
+    .option("--action <text>", "Operator-authored action note")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsResolveCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govSignalsCmd
+    .command("dismiss <signal_id>")
+    .description("Dismiss a signal as not actionable")
+    .option("--reason <text>", "Operator-authored dismissal reason")
+    .option("--json", "Output JSON")
+    .action(async (signalId, options) => {
+    try {
+        await governanceSignalsDismissCommand(signalId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+const govDestCmd = governanceCmd
+    .command("destinations")
+    .description("Manage notification destinations (slack/email/pagerduty/webhook)");
+govDestCmd
+    .command("list")
+    .description("List destinations for an org")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceDestinationsListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("add")
+    .description("Add a destination (channel + JSON config)")
+    .requiredOption("--org <id>", "Org ID")
+    .requiredOption("--channel <c>", "webhook|slack|email|pagerduty")
+    .requiredOption("--config <json>", "Channel config (e.g., '{\"url\":\"...\",\"signing_secret\":\"...\"}')")
+    .option("--name <n>", "Display name")
+    .option("--filter <json>", "Filter narrowing (sources/severities/etc)")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceDestinationsAddCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("remove <destination_id>")
+    .description("Remove a destination")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceDestinationsRemoveCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govDestCmd
+    .command("test <destination_id>")
+    .description("Send a synthetic test signal through this destination")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceDestinationsTestCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+const govRulesCmd = governanceCmd
+    .command("rules")
+    .description("Manage escalation rules (predicate → destinations)");
+govRulesCmd
+    .command("list")
+    .description("List escalation rules for an org")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceRulesListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govRulesCmd
+    .command("add")
+    .description("Add an escalation rule (predicate JSON + destination IDs)")
+    .requiredOption("--org <id>", "Org ID")
+    .requiredOption("--name <n>", "Rule name")
+    .requiredOption("--predicate <json>", "Predicate JSON (e.g., '{\"source\":\"sideband.fleet\",\"severity_min\":\"high\"}')")
+    .requiredOption("--destinations <ids>", "Comma-separated destination IDs")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await governanceRulesAddCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+govRulesCmd
+    .command("remove <rule_id>")
+    .description("Remove an escalation rule")
+    .requiredOption("--org <id>", "Org ID")
+    .option("--json", "Output JSON")
+    .action(async (id, options) => {
+    try {
+        await governanceRulesRemoveCommand(id, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
+// Trust Posture (Piece 3 of T1-3.1, ADR-045)
+//
+// Postures are team-scoped policy input that drives the observer's sideband
+// sweep. Cards remain agent-scoped runtime output; postures are a parallel
+// artifact type. Mnemom ships three default postures (Standard / High-
+// Compliance / Low-Latency) seeded via migration; orgs use them as-is or
+// clone-and-customize.
+// ============================================================================
+const postureCmd = program
+    .command("posture")
+    .description("Manage Trust Postures (team-scoped oversight policy)");
+postureCmd
+    .command("list")
+    .description("List visible postures (Mnemom defaults + org-owned)")
+    .option("--org <id>", "Filter to postures owned by this org")
+    .option("--no-include-platform", "Hide Mnemom-shipped platform defaults")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await postureListCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("show <posture_id>")
+    .description("Show one posture's metadata + body summary")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureShowCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("create")
+    .description("Create a new org-scope posture (body from a JSON file)")
+    .requiredOption("--org <id>", "Target org ID")
+    .requiredOption("--slug <slug>", "Kebab-case slug, unique within the org")
+    .requiredOption("--name <name>", "Display name")
+    .requiredOption("--from <file>", "Path to a JSON file with the posture body")
+    .option("--description <text>", "Optional description")
+    .option("--summary <text>", "Change summary for the initial revision")
+    .option("--json", "Output JSON")
+    .action(async (options) => {
+    try {
+        await postureCreateCommand(options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("update <posture_id>")
+    .description("Write a new revision (forward-only — old revisions stay queryable)")
+    .requiredOption("--from <file>", "Path to a JSON file with the new posture body")
+    .option("--summary <text>", "Change summary for this revision")
+    .option("--name <text>", "Update the posture's display name")
+    .option("--description <text>", "Update the description")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureUpdateCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("clone <posture_id>")
+    .description("Clone any visible posture into an org as the customization starting point")
+    .requiredOption("--org <id>", "Target org ID")
+    .option("--slug <slug>", "Slug for the new posture (default: <source-slug>-clone)")
+    .option("--name <name>", "Display name for the new posture")
+    .option("--description <text>", "Description override")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureCloneCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("revisions <posture_id>")
+    .description("List the posture's revision history (newest first)")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureRevisionsCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("diff <posture_id>")
+    .description("Structural diff between two revisions of a posture")
+    .requiredOption("--from <N>", "Revision number to diff from")
+    .requiredOption("--to <M>", "Revision number to diff to")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await postureDiffCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("assign <posture_id>")
+    .description("Assign a posture to a team (replaces any prior assignment for that team)")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .option("--pin-revision <N>", "Pin to a specific revision number (default: float against current)")
+    .action(async (postureId, options) => {
+    try {
+        await postureAssignCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("unassign <posture_id>")
+    .description("Remove a posture's assignment from a team")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .action(async (postureId, options) => {
+    try {
+        await postureUnassignCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("preview-compose <posture_id>")
+    .description("Preview the effective composed posture for a team if assigned")
+    .requiredOption("--team <team_id>", "Team UUID")
+    .option("--json", "Output JSON")
+    .action(async (postureId, options) => {
+    try {
+        await posturePreviewComposeCommand(postureId, options);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+postureCmd
+    .command("delete <posture_id>")
+    .description("Soft-delete an org-scope posture (refuses if currently assigned to any team)")
+    .action(async (postureId) => {
+    try {
+        await postureDeleteCommand(postureId);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ============================================================================
 // Auth
 // ============================================================================
 program
@@ -336,4 +941,98 @@ program
         process.exit(1);
     }
 });
+// ── validate (Safe House Hardening T1-4) ─────────────────────────────────
+const validateCmd = program
+    .command("validate")
+    .description("Validate platform state against quality gates");
+validateCmd
+    .command("safe-house")
+    .description("Render Safe House harness state per lane (full/fast) — promotion-readiness signal")
+    .option("--against <env>", "Target environment ('staging' or 'production'; informational)", "staging")
+    .option("--max-age <duration>", "Reject runs older than this (e.g. 30m, 2h, 24h, 1d)", "24h")
+    .option("--lane <lane>", "Show only one lane ('full', 'fast', or 'both')", "both")
+    .option("--strict", "Exit non-zero if any selected lane is stale or red")
+    .option("--json", "Emit raw JSON state instead of rendered output")
+    .action(async (opts) => {
+    try {
+        const lane = opts.lane === "full" || opts.lane === "fast" || opts.lane === "both"
+            ? opts.lane
+            : "both";
+        await validateSafeHouseCommand({
+            against: opts.against,
+            maxAge: opts.maxAge,
+            lane,
+            strict: opts.strict,
+            json: opts.json,
+        });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+// ── api-key (ADR-049 capability-based scopes) ────────────────────────────
+const apiKeyCmd = program
+    .command("api-key")
+    .description("Manage personal API keys (capability-based scopes — ADR-049)");
+apiKeyCmd
+    .command("list")
+    .description("List your active personal API keys with their scope sets")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (options) => {
+    try {
+        await apiKeyListCommand({ json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("create")
+    .description("Mint a new personal API key. Default scopes: gateway, api:read, api:write. " +
+    "Admin scopes (admin:org, admin:platform) are role-gated at mint time.")
+    .requiredOption("--name <name>", "Friendly name for the key (e.g. 'ci-prod')")
+    .option("--scopes <list>", "Comma-separated capability scopes. Valid: " +
+    "gateway, api:read, api:write, admin:org, admin:platform. " +
+    "Default: gateway,api:read,api:write")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (options) => {
+    try {
+        await apiKeyCreateCommand({
+            name: options.name,
+            scopes: options.scopes,
+            json: options.json,
+        });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("rotate <key_id>")
+    .description("Atomic mint-new + revoke-old. Returns the new cleartext once.")
+    .option("--json", "Emit raw JSON instead of rendered output")
+    .action(async (keyId, options) => {
+    try {
+        await apiKeyRotateCommand(keyId, { json: options.json });
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
+apiKeyCmd
+    .command("revoke <key_id>")
+    .description("Soft-revoke an active key. Action is immediate and irreversible.")
+    .action(async (keyId) => {
+    try {
+        await apiKeyRevokeCommand(keyId);
+    }
+    catch (error) {
+        console.error("Error:", error instanceof Error ? error.message : error);
+        process.exit(1);
+    }
+});
 program.parse();