mneme-ai 2.128.0 → 2.130.0

package/dist/commands/firewall.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `mneme firewall` (v2.130.0) — Structural Context Firewall against Indirect
+ * Prompt Injection (OWASP LLM01). Scan content an agent is about to read; detect
+ * + neutralize known injection patterns hidden in comments/strings, and wrap it
+ * in an untrusted-data boundary so the model treats it as DATA, never commands.
+ *
+ *   cat suspect.ts | mneme firewall scan                 # verdict + findings
+ *   cat external-dep.ts | mneme firewall fortify          # → safe-to-read content (neutralized + wrapped)
+ */
+import type { Command } from "commander";
+export declare function registerFirewallCommands(program: Command): void;
+//# sourceMappingURL=firewall.d.ts.map

package/dist/commands/firewall.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.d.ts","sourceRoot":"","sources":["../../src/commands/firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAmBzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+B/D"}

package/dist/commands/firewall.js

@@ -0,0 +1,80 @@
+/**
+ * `mneme firewall` (v2.130.0) — Structural Context Firewall against Indirect
+ * Prompt Injection (OWASP LLM01). Scan content an agent is about to read; detect
+ * + neutralize known injection patterns hidden in comments/strings, and wrap it
+ * in an untrusted-data boundary so the model treats it as DATA, never commands.
+ *
+ *   cat suspect.ts | mneme firewall scan                 # verdict + findings
+ *   cat external-dep.ts | mneme firewall fortify          # → safe-to-read content (neutralized + wrapped)
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { firewall } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+function readStdin() {
+    return new Promise((resolve) => {
+        if (process.stdin.isTTY)
+            return resolve("");
+        let d = "";
+        let done = false;
+        const fin = () => { if (!done) {
+            done = true;
+            resolve(d);
+        } };
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (c) => { d += c; if (d.length > 8_000_000)
+            fin(); });
+        process.stdin.on("end", fin);
+        process.stdin.on("error", fin);
+        setTimeout(fin, 4000);
+    });
+}
+async function getPayload(opts) {
+    if (typeof opts.text === "string")
+        return opts.text;
+    if (opts.file && existsSync(opts.file)) {
+        try {
+            return readFileSync(opts.file, "utf8");
+        }
+        catch { /* */ }
+    }
+    return readStdin();
+}
+export function registerFirewallCommands(program) {
+    const fw = program.command("firewall").description("🧱 STRUCTURAL CONTEXT FIREWALL — defend against Indirect Prompt Injection (OWASP LLM01): scan content for injection hidden in comments/strings + neutralize it, and wrap it as untrusted DATA so the model never obeys instructions buried in a file. Defense-in-depth, not a 100% guarantee against unknown attacks.");
+    fw.command("scan")
+        .description("Scan content (stdin/--file/--text). Verdict clean | flagged | blocked + findings (line, category). Exit 2 on blocked.")
+        .option("--text <t>", "inline content.")
+        .option("--file <p>", "read from a file.")
+        .option("--json", "JSON output.")
+        .action(async (opts) => {
+        const r = firewall.scanInjection(await getPayload(opts));
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+        }
+        else {
+            const icon = r.verdict === "blocked" ? "🛑" : r.verdict === "flagged" ? "⚠️" : "✓";
+            out(`${icon} FIREWALL ${r.verdict.toUpperCase()} — ${r.findings.length} finding(s), ${r.neutralizedCount} neutralized`);
+            for (const f of r.findings.slice(0, 12))
+                out(`   • L${f.line} [${f.severity}] ${f.category}: ${f.snippet}`);
+            if (r.verdict !== "clean")
+                out(`   → read the FORTIFIED form (mneme firewall fortify) instead of the raw file.`);
+        }
+        if (r.verdict === "blocked")
+            process.exitCode = 2;
+    });
+    fw.command("fortify")
+        .description("Emit the safe-to-read form: known injections neutralized + content wrapped in an untrusted-data boundary (the always-on, attack-agnostic separation). Read THIS instead of the raw file.")
+        .option("--text <t>", "inline content.")
+        .option("--file <p>", "read from a file.")
+        .option("--json", "JSON output (fortified + findings).")
+        .action(async (opts) => {
+        const r = firewall.fortify(await getPayload(opts), opts.file ? { path: opts.file } : undefined);
+        if (opts.json) {
+            process.stdout.write(JSON.stringify(r, null, 2) + "\n");
+            return;
+        }
+        process.stdout.write(r.fortified + "\n");
+        process.stderr.write(`🧱 firewall: ${r.verdict} · ${r.neutralizedCount} injection(s) neutralized · wrapped as untrusted data\n`);
+    });
+}
+//# sourceMappingURL=firewall.js.map

package/dist/commands/firewall.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall.js","sourceRoot":"","sources":["../../src/commands/firewall.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,SAAS,SAAS;IAChB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK;YAAE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;QAAC,IAAI,IAAI,GAAG,KAAK,CAAC;QAAC,MAAM,GAAG,GAAG,GAAG,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAAC,CAAC,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,SAAS;YAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACjH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACtF,CAAC,CAAC,CAAC;AACL,CAAC;AACD,KAAK,UAAU,UAAU,CAAC,IAAsC;IAC9D,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAC3G,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,uTAAuT,CAAC,CAAC;IAE5W,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,uHAAuH,CAAC;SACpI,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC;SACvC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;SAChC,MAAM,CAAC,KAAK,EAAE,IAAsD,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,QAAQ,CAAC,aAAa,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACzD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;aACtE,CAAC;YACJ,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;YACnF,GAAG,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,gBAAgB,CAAC,CAAC,gBAAgB,cAAc,CAAC,CAAC;YACxH,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBAAE,GAAG,CAAC,SAAS,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5G,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO;gBAAE,GAAG,CAAC,gFAAgF,CAAC,CAAC;QACnH,CAAC;QACD,IAAI,CAAC,CAAC,OAAO,KAAK,SAAS;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEL,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;SAClB,WAAW,CAAC,0LAA0L,CAAC;SACvM,MAAM,CAAC,YAAY,EAAE,iBAAiB,CAAC;SACvC,MAAM,CAAC,YAAY,EAAE,mBAAmB,CAAC;SACzC,MAAM,CAAC,QAAQ,EAAE,qCAAqC,CAAC;SACvD,MAAM,CAAC,KAAK,EAAE,IAAsD,EAAE,EAAE;QACvE,MAAM,CAAC,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAChG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QACzC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,MAAM,CAAC,CAAC,gBAAgB,yDAAyD,CAAC,CAAC;IACnI,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/commands/settlement.d.ts

@@ -0,0 +1,13 @@
+/**
+ * `mneme settlement` (v2.129.0) — the Context Transaction Settlement Ledger:
+ * a signed, hash-chained, offline-auditable record of every AI↔local context
+ * exchange (what was blinded, what changed, whether it passed local verify, the
+ * tokens metered). The honest "Stripe of AI Context / settlement layer".
+ *
+ *   mneme settlement record --tx '{"kind":"channel-op","namesHidden":3,"localVerified":"pass","tokensSent":40,"tokensSaved":600}'
+ *   mneme settlement verify
+ *   mneme settlement statement --price-per-1k 0.003 --fee-pct 0.10
+ */
+import type { Command } from "commander";
+export declare function registerSettlementCommands(program: Command): void;
+//# sourceMappingURL=settlement.d.ts.map

package/dist/commands/settlement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlement.d.ts","sourceRoot":"","sources":["../../src/commands/settlement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAYzC,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA8CjE"}

package/dist/commands/settlement.js

@@ -0,0 +1,104 @@
+/**
+ * `mneme settlement` (v2.129.0) — the Context Transaction Settlement Ledger:
+ * a signed, hash-chained, offline-auditable record of every AI↔local context
+ * exchange (what was blinded, what changed, whether it passed local verify, the
+ * tokens metered). The honest "Stripe of AI Context / settlement layer".
+ *
+ *   mneme settlement record --tx '{"kind":"channel-op","namesHidden":3,"localVerified":"pass","tokensSent":40,"tokensSaved":600}'
+ *   mneme settlement verify
+ *   mneme settlement statement --price-per-1k 0.003 --fee-pct 0.10
+ */
+import { existsSync, readFileSync, appendFileSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { settlement, notary } from "@mneme-ai/core";
+const LEDGER = ".mneme/settlement/ledger.jsonl";
+function out(s) { process.stdout.write(s + "\n"); }
+function outJson(o) { process.stdout.write(JSON.stringify(o, null, 2) + "\n"); }
+function loadRecords(cwd) {
+    try {
+        const p = join(cwd, LEDGER);
+        if (!existsSync(p))
+            return [];
+        return readFileSync(p, "utf8").split(/\r?\n/).filter(Boolean).map((l) => JSON.parse(l));
+    }
+    catch {
+        return [];
+    }
+}
+export function registerSettlementCommands(program) {
+    const s = program.command("settlement").description("💳 CONTEXT TRANSACTION SETTLEMENT LEDGER — a signed, hash-chained, offline-auditable record of every AI↔local context exchange (blinded-proof + local-verify-proof + token metering). The honest 'Stripe of AI Context' settlement/audit layer.");
+    s.command("record")
+        .description("Append one context transaction to the chained ledger (links to the previous record's hash).")
+        .requiredOption("--tx <json>", "the transaction: {kind, sentHash?, namesHidden?, secretsRemoved?, localVerified?, tokensSent?, tokensSaved?, note?}")
+        .option("--json", "JSON output.")
+        .action((opts) => {
+        const cwd = process.cwd();
+        let txIn;
+        try {
+            txIn = JSON.parse(opts.tx);
+        }
+        catch (e) {
+            out(`✗ invalid --tx JSON: ${e.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        const records = loadRecords(cwd);
+        const prev = records.length ? records[records.length - 1].chainHash : "0".repeat(64);
+        const rec = settlement.recordTx(prev, txIn, records.length + 1);
+        let receipt = null;
+        try {
+            receipt = notary.issueReceipt(cwd, { kind: "protocol-hop", subject: `settlement:${rec.tx.seq}`, payload: { chainHash: rec.chainHash, seq: rec.tx.seq }, includePayload: true });
+        }
+        catch { /* */ }
+        try {
+            const p = join(cwd, LEDGER);
+            if (!existsSync(dirname(p)))
+                mkdirSync(dirname(p), { recursive: true });
+            appendFileSync(p, JSON.stringify(rec) + "\n");
+        }
+        catch (e) {
+            out(`✗ append failed: ${e.message}`);
+            process.exitCode = 1;
+            return;
+        }
+        if (opts.json) {
+            outJson({ record: rec, signed: receipt });
+            return;
+        }
+        out(`💳 tx#${rec.tx.seq} ${rec.tx.kind} recorded · chain ${rec.chainHash.slice(0, 12)}… · sent ~${rec.tx.tokensSent} tok, saved ~${rec.tx.tokensSaved} tok${receipt ? " · signed" : ""}`);
+    });
+    s.command("verify")
+        .description("Recompute the chain offline + report tamper (returns the first broken seq). Exit 2 if broken.")
+        .option("--json", "JSON output.")
+        .action((opts) => {
+        const cwd = process.cwd();
+        const v = settlement.verifyChain(loadRecords(cwd));
+        if (opts.json) {
+            outJson(v);
+            return;
+        }
+        out(v.ok ? `✓ chain intact — ${v.length} transaction(s) verify offline` : `🛑 chain BROKEN at seq ${v.firstBrokenSeq}: ${v.note}`);
+        if (!v.ok)
+            process.exitCode = 2;
+    });
+    s.command("statement")
+        .description("A Visa-style settlement statement: tokens sent vs saved, % blinded, % locally-verified, chain integrity. --price-per-1k + --fee-pct (your numbers) add USD + the value-based fee.")
+        .option("--price-per-1k <usd>", "your vendor's price per 1k tokens (USD).", (v) => parseFloat(v))
+        .option("--fee-pct <f>", "value-based fee as a fraction of savings, e.g. 0.10 = 10%.", (v) => parseFloat(v))
+        .option("--json", "JSON output.")
+        .action((opts) => {
+        const cwd = process.cwd();
+        const st = settlement.settlementStatement(loadRecords(cwd), { pricePer1kUSD: opts.pricePer1k, feePct: opts.feePct });
+        if (opts.json) {
+            outJson(st);
+            return;
+        }
+        out(`💳 SETTLEMENT STATEMENT — ${st.txCount} context transaction(s)`);
+        out(`   tokens: ~${st.totalTokensSent.toLocaleString()} sent · ~${st.totalTokensSaved.toLocaleString()} saved`);
+        if (typeof st.usdSaved === "number")
+            out(`   value: $${st.usdSaved.toLocaleString()} saved${typeof st.feeUSD === "number" ? ` · fee @${(opts.feePct * 100)}% = $${st.feeUSD.toLocaleString()}` : ""} (at your rate)`);
+        out(`   security: ${st.pctBlinded}% blinded · ${st.pctLocallyVerified}% locally-verified`);
+        out(`   integrity: ${st.integrity.ok ? "✓ chain intact" : "🛑 BROKEN @seq " + st.integrity.firstBrokenSeq}`);
+    });
+}
+//# sourceMappingURL=settlement.js.map

package/dist/commands/settlement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settlement.js","sourceRoot":"","sources":["../../src/commands/settlement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9E,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEpD,MAAM,MAAM,GAAG,gCAAgC,CAAC;AAChD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AACjE,SAAS,OAAO,CAAC,CAAU,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAC/F,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;YAAE,OAAO,EAAE,CAAC;QAAC,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAA4B,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;AAC9M,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,OAAgB;IACzD,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,WAAW,CAAC,iPAAiP,CAAC,CAAC;IAEvS,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;SAChB,WAAW,CAAC,6FAA6F,CAAC;SAC1G,cAAc,CAAC,aAAa,EAAE,qHAAqH,CAAC;SACpJ,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;SAChC,MAAM,CAAC,CAAC,IAAoC,EAAE,EAAE;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,IAAI,IAA6B,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,wBAAyB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvK,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAqC,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjG,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACxM,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;gBAAE,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,cAAc,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,oBAAqB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACzP,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACrE,GAAG,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,IAAI,qBAAqB,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC,UAAU,gBAAgB,GAAG,CAAC,EAAE,CAAC,WAAW,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC5L,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;SAChB,WAAW,CAAC,+FAA+F,CAAC;SAC5G,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;SAChC,MAAM,CAAC,CAAC,IAAwB,EAAE,EAAE;QACnC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,UAAU,CAAC,WAAW,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACtC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,MAAM,gCAAgC,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,cAAc,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACnI,IAAI,CAAC,CAAC,CAAC,EAAE;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;SACnB,WAAW,CAAC,mLAAmL,CAAC;SAChM,MAAM,CAAC,sBAAsB,EAAE,0CAA0C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SAChG,MAAM,CAAC,eAAe,EAAE,4DAA4D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;SAC3G,MAAM,CAAC,QAAQ,EAAE,cAAc,CAAC;SAChC,MAAM,CAAC,CAAC,IAA8D,EAAE,EAAE;QACzE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1B,MAAM,EAAE,GAAG,UAAU,CAAC,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACrH,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACvC,GAAG,CAAC,6BAA6B,EAAE,CAAC,OAAO,yBAAyB,CAAC,CAAC;QACtE,GAAG,CAAC,eAAe,EAAE,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;QAChH,IAAI,OAAO,EAAE,CAAC,QAAQ,KAAK,QAAQ;YAAE,GAAG,CAAC,cAAc,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,SAAS,OAAO,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,MAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACvN,GAAG,CAAC,gBAAgB,EAAE,CAAC,UAAU,eAAe,EAAE,CAAC,kBAAkB,oBAAoB,CAAC,CAAC;QAC3F,GAAG,CAAC,iBAAiB,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,GAAG,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;IAC/G,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyJA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2gNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA2JA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA6gNvD"}

package/dist/index.js

@@ -86,6 +86,8 @@ import { registerOutlineCommands } from "./commands/outline.js";
 import { registerScaffoldCommands } from "./commands/scaffold.js";
 import { registerBlindCommands } from "./commands/blind.js";
 import { registerChannelCommands } from "./commands/channel.js";
+import { registerSettlementCommands } from "./commands/settlement.js";
+import { registerFirewallCommands } from "./commands/firewall.js";
 import { registerTrustCommands } from "./commands/trust.js";
 import { registerNuclearCommands } from "./commands/nuclear-cli.js";
 import { registerOvernightCommand } from "./commands/overnight.js";
@@ -4717,6 +4719,8 @@ export async function run(argv) {
     registerScaffoldCommands(program);
     registerBlindCommands(program);
     registerChannelCommands(program);
+    registerSettlementCommands(program);
+    registerFirewallCommands(program);
     // ─── Trust calibrator (v1.31.0) -- per-subsystem precision/recall/band
     registerTrustCommands(program);
     // ─── Wisdom reactor (v1.33.0) -- five nuclear-physics formulas as Mneme metrics