mneme-ai 3.119.0 → 3.121.0

package/dist/commands/vericert.d.ts

@@ -0,0 +1,12 @@
+/**
+ * `mneme certify` (v3.120.0) — VERICERT: stamp an AI-worker deliverable with a
+ * signed, offline-verifiable "Verified-by-Mneme" certificate (CERTIFIED /
+ * CONDITIONAL / REJECTED) — the trust layer for the AI-worker economy.
+ *
+ *   mneme certify "the build always works and never fails"
+ *   cat report.md | mneme certify -            # certify a file/stdin
+ *   mneme certify verify --cert cert.json [--deliverable report.md]
+ */
+import type { Command } from "commander";
+export declare function registerVericertCommands(program: Command): void;
+//# sourceMappingURL=vericert.d.ts.map

package/dist/commands/vericert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vericert.d.ts","sourceRoot":"","sources":["../../src/commands/vericert.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAMzC,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CA+C/D"}

package/dist/commands/vericert.js

@@ -0,0 +1,109 @@
+/**
+ * `mneme certify` (v3.120.0) — VERICERT: stamp an AI-worker deliverable with a
+ * signed, offline-verifiable "Verified-by-Mneme" certificate (CERTIFIED /
+ * CONDITIONAL / REJECTED) — the trust layer for the AI-worker economy.
+ *
+ *   mneme certify "the build always works and never fails"
+ *   cat report.md | mneme certify -            # certify a file/stdin
+ *   mneme certify verify --cert cert.json [--deliverable report.md]
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+import { vericert, notary } from "@mneme-ai/core";
+function out(s) { process.stdout.write(s + "\n"); }
+export function registerVericertCommands(program) {
+    const c = program
+        .command("certify")
+        .alias("vericert")
+        .argument("[deliverable...]", "the AI-produced deliverable ('-' = stdin)")
+        .description("🎗️ VERICERT — stamp an AI-worker deliverable (report / code / answer) with a signed, offline-verifiable certificate: CERTIFIED / CONDITIONAL / REJECTED. Runs every claim through the HPE verification stack; CERTIFIED only if NO known fault (CERTIFIED-precision 1.0 — never certifies a hallucinated deliverable). The trust layer the AI-worker gold rush is missing.")
+        .option("--json", "JSON output (the full signed certificate)")
+        .option("--badge <file>", "also write a shareable 'Verified by Mneme' SVG badge ('-' = stdout)")
+        .action((deliverable, opts) => {
+        let d = Array.isArray(deliverable) ? deliverable.join(" ") : String(deliverable ?? "");
+        if (d === "-") {
+            try {
+                d = readFileSync(0, "utf8");
+            }
+            catch { /* */ }
+        }
+        if (!d.trim()) {
+            out("usage: mneme certify \"<deliverable>\"  (or pipe a file: cat report.md | mneme certify -)");
+            process.exitCode = 2;
+            return;
+        }
+        const cert = vericert.certify(d, { ts: Date.now() });
+        let receipt = null;
+        try {
+            receipt = notary.issueReceipt(process.cwd(), { kind: "claim-verdict", subject: `vericert:${cert.verdict}:${cert.certId.slice(0, 12)}`, payload: { certId: cert.certId }, includePayload: true });
+        }
+        catch { /* */ }
+        const signed = { ...cert, signed: receipt };
+        if (opts.badge) {
+            const svg = vericert.badgeSVG(cert);
+            if (opts.badge === "-")
+                out(svg);
+            else {
+                try {
+                    writeFileSync(opts.badge, svg);
+                    out(`   🎗 badge → ${opts.badge}`);
+                }
+                catch { /* */ }
+            }
+        }
+        if (opts.json) {
+            out(JSON.stringify(signed, null, 2));
+            process.exitCode = cert.verdict === "REJECTED" ? 2 : 0;
+            return;
+        }
+        const icon = cert.verdict === "CERTIFIED" ? "🎗️ ✓" : cert.verdict === "CONDITIONAL" ? "🎗️ ❔" : "🎗️ 🛑";
+        out(`${icon} ${cert.verdict}  (score ${(cert.score * 100).toFixed(0)}% · ${cert.trusted}/${cert.claimsChecked} claims clean)`);
+        out(`   certId: ${cert.certId.slice(0, 24)}…  ${receipt ? "· Ed25519-signed (verify offline)" : ""}`);
+        for (const f of cert.faults)
+            out(`   ${f.verdict === "BLOCK" ? "🛑" : "❔"} ${f.nerves.join(",")}: ${f.claim.slice(0, 70)}`);
+        if (cert.verdict === "CERTIFIED")
+            out(`   ✓ no known fault — safe to relay (CERTIFIED = no KNOWN fault, not a proof of truth).`);
+        process.exitCode = cert.verdict === "REJECTED" ? 2 : 0;
+    });
+    c.command("verify")
+        .description("verify a VERICERT certificate OFFLINE: tamper-evidence + (optionally) that it matches the deliverable + the Ed25519 signature.")
+        .requiredOption("--cert <file>", "the certificate JSON ('-' for stdin)")
+        .option("--deliverable <file>", "the original deliverable to re-check against")
+        .option("--json", "JSON output")
+        .action((o) => {
+        let cert;
+        try {
+            cert = JSON.parse(o.cert === "-" ? readFileSync(0, "utf8") : readFileSync(o.cert, "utf8"));
+        }
+        catch {
+            out("✗ could not read/parse cert");
+            process.exitCode = 2;
+            return;
+        }
+        let deliverable;
+        if (o.deliverable) {
+            try {
+                deliverable = readFileSync(o.deliverable, "utf8");
+            }
+            catch { /* */ }
+        }
+        const body = vericert.verifyCertBody(cert, deliverable);
+        let sigOk = null;
+        try {
+            if (cert.signed)
+                sigOk = notary.verifyReceipt(cert.signed).valid;
+        }
+        catch {
+            sigOk = false;
+        }
+        if (o.json) {
+            out(JSON.stringify({ ...body, signatureValid: sigOk }, null, 2));
+            process.exitCode = body.ok ? 0 : 2;
+            return;
+        }
+        out(`${body.ok ? "✓ VALID" : "🛑 INVALID"} — ${body.reason}`);
+        if (sigOk !== null)
+            out(`   Ed25519 signature: ${sigOk ? "✓ valid (offline)" : "🛑 invalid"}`);
+        process.exitCode = body.ok ? 0 : 2;
+    });
+}
+//# sourceMappingURL=vericert.js.map

package/dist/commands/vericert.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"vericert.js","sourceRoot":"","sources":["../../src/commands/vericert.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAElD,SAAS,GAAG,CAAC,CAAS,IAAU,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,CAAC,GAAG,OAAO;SACd,OAAO,CAAC,SAAS,CAAC;SAClB,KAAK,CAAC,UAAU,CAAC;SACjB,QAAQ,CAAC,kBAAkB,EAAE,2CAA2C,CAAC;SACzE,WAAW,CAAC,6WAA6W,CAAC;SAC1X,MAAM,CAAC,QAAQ,EAAE,2CAA2C,CAAC;SAC7D,MAAM,CAAC,gBAAgB,EAAE,qEAAqE,CAAC;SAC/F,MAAM,CAAC,CAAC,WAAiC,EAAE,IAAwC,EAAE,EAAE;QACtF,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,CAAC,GAAG,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACvE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAAC,GAAG,CAAC,2FAA2F,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAClJ,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACrD,IAAI,OAAO,GAAY,IAAI,CAAC;QAC5B,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QACzN,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;QAC5C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,KAAK,KAAK,GAAG;gBAAE,GAAG,CAAC,GAAG,CAAC,CAAC;iBAAM,CAAC;gBAAC,IAAI,CAAC;oBAAC,aAAa,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;oBAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YAAC,CAAC;QACxI,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACxH,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,KAAK,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1G,GAAG,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,aAAa,gBAAgB,CAAC,CAAC;QAC/H,GAAG,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,mCAAmC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACtG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM;YAAE,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5H,IAAI,IAAI,CAAC,OAAO,KAAK,WAAW;YAAE,GAAG,CAAC,yFAAyF,CAAC,CAAC;QACjI,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEL,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;SAChB,WAAW,CAAC,gIAAgI,CAAC;SAC7I,cAAc,CAAC,eAAe,EAAE,sCAAsC,CAAC;SACvE,MAAM,CAAC,sBAAsB,EAAE,8CAA8C,CAAC;SAC9E,MAAM,CAAC,QAAQ,EAAE,aAAa,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAyD,EAAE,EAAE;QACpE,IAAI,IAAiD,CAAC;QACtD,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC/K,IAAI,WAA+B,CAAC;QACpC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,WAAW,GAAG,YAAY,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,IAAI,GAAG,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,KAAK,GAAmB,IAAI,CAAC;QACjC,IAAI,CAAC;YAAC,IAAI,IAAI,CAAC,MAAM;gBAAE,KAAK,GAAG,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,KAAK,GAAG,KAAK,CAAC;QAAC,CAAC;QAClG,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QAC7H,GAAG,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,MAAM,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9D,IAAI,KAAK,KAAK,IAAI;YAAE,GAAG,CAAC,yBAAyB,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC/F,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwMA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA2mNvD"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAyMA,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CA4mNvD"}

package/dist/index.js

@@ -131,6 +131,7 @@ import { registerCanonCommands } from "./commands/canon.js";
 import { registerSdcCommands } from "./commands/sdc.js";
 import { registerStatguardCommands } from "./commands/statguard.js";
 import { registerHpeCommands } from "./commands/hpe.js";
+import { registerVericertCommands } from "./commands/vericert.js";
 import { registerMoatCommands } from "./commands/moat.js";
 import { attachRegretOracle } from "./commands/regret.js";
 import { registerTrustCommands } from "./commands/trust.js";
@@ -4819,6 +4820,7 @@ export async function run(argv) {
     registerSdcCommands(program);
     registerStatguardCommands(program);
     registerHpeCommands(program);
+    registerVericertCommands(program);
     registerMoatCommands(program);
     // ─── Trust calibrator (v1.31.0) -- per-subsystem precision/recall/band
     registerTrustCommands(program);