@astragenie/astramemory-local 0.7.2

package/dist/cli/serve.js

@@ -0,0 +1,364 @@
+import { join } from 'node:path';
+import { mkdirSync, statSync, unlinkSync } from 'node:fs';
+import { buildApp } from '../server/app.js';
+import { openDb } from '../storage/db.js';
+import { migrate, getVecSchemaDim } from '../storage/migrate.js';
+import { getOrCreateKey, readSyncToken } from '../storage/keystore.js';
+import { resolveBearerToken } from '../storage/bearer-keystore.js';
+import { startShipper, getOrCreateDeviceId } from '../sync/shipper.js';
+import { encryptIfPlaintext } from '../storage/migrate-encrypt.js';
+import { defaultConfigDir } from '../config/datadir.js';
+import { resolveRuntimeConfig } from '../config/resolve-runtime.js';
+import { acquireInstanceLock, AlreadyRunningError } from '../service/instance-lock.js';
+import { PKG_VERSION } from '../server/lib/wire-meta.js';
+import { createHealthState } from '../server/health-state.js';
+import { HandlerRegistry } from '../pipeline/registry.js';
+import { startWorker } from '../pipeline/worker.js';
+import { JobRepo } from '../pipeline/job-repo.js';
+import { distillHandler } from '../pipeline/handlers/distill.js';
+import { distillEventsHandler } from '../pipeline/handlers/distill-events.js';
+import { cleanupHandler } from '../pipeline/handlers/cleanup.js';
+import { consolidateHandler } from '../pipeline/handlers/consolidate.js';
+import { reembedHandler } from '../pipeline/handlers/reembed.js';
+import { makeMockProviders } from '../pipeline/mock-providers.js';
+import { MemoryRepo } from '../storage/memories.js';
+import { SqliteVecStore } from '../vector/sqlite-vec.js';
+export async function serve(opts) {
+    // Shared resolver: migrate-dirs + config.yaml + sync.json merge + the
+    // canonical precedence (CLI > ASTRA_MEMORY_DATADIR > config.yaml > default).
+    // doctor/backup/reinstall use the same resolver so diagnostics always look
+    // at the same files as the daemon.
+    const { cfg, port, dataDir } = resolveRuntimeConfig({ port: opts.port, dataDir: opts.dataDir });
+    // SEC-10: CLI flag > env var > OS credential store > secrets.env
+    // (canonical dir, then legacy dir) > 'devtok' default. A secrets.env-only
+    // bearer is opportunistically promoted into the credential store.
+    const { token } = resolveBearerToken({
+        cliToken: opts.token,
+        envToken: process.env.ASTRA_MEMORY_TOKEN,
+    });
+    const dbPath = dataDir === ':memory:' ? ':memory:' : join(dataDir, 'memory.sqlite');
+    if (dataDir !== ':memory:')
+        mkdirSync(dataDir, { recursive: true });
+    // Single-instance lock (D2): protects the data dir, not just the port —
+    // a second daemon on a different port would still race the job queue.
+    // A healthy holder → exit 0 so schtasks keepalive re-runs are cheap no-ops.
+    let lock = null;
+    if (dataDir !== ':memory:') {
+        try {
+            lock = await acquireInstanceLock(dataDir, port, PKG_VERSION);
+        }
+        catch (err) {
+            if (err instanceof AlreadyRunningError) {
+                console.log(`[astramem-local] ${err.message} — exiting (single-instance).`);
+                process.exit(0);
+            }
+            throw err;
+        }
+    }
+    // Global crash handlers (serve path only): a stray rejection must not kill
+    // the process silently — log, release the lock, close the DB, exit 1 so
+    // the abnormal exit is visible in task history. Restart comes from the
+    // scheduler's repetition trigger, not from exit-code semantics.
+    const crashExit = (kind) => (err) => {
+        console.error(`[astramem-local] FATAL ${kind}:`, err);
+        try {
+            lock?.release();
+        }
+        catch { /* best-effort */ }
+        try {
+            dbForCrash?.close();
+        }
+        catch { /* best-effort */ }
+        process.exit(1);
+    };
+    let dbForCrash = null;
+    process.on('uncaughtException', crashExit('uncaughtException'));
+    process.on('unhandledRejection', crashExit('unhandledRejection'));
+    // SEC-1/2/7/9: in-memory databases can never be encrypted (SQLCipher
+    // rejects PRAGMA key on :memory:, confirmed by the 1a spike) — the
+    // ASTRA_MEMORY_DATADIR=':memory:' test/dev path always stays plaintext
+    // and never touches the keystore.
+    let db;
+    if (dataDir === ':memory:') {
+        db = openDb(dbPath);
+    }
+    else if (cfg.security.encryption.enabled) {
+        const key = getOrCreateKey(defaultConfigDir()).key;
+        encryptIfPlaintext(dbPath, key);
+        db = openDb(dbPath, { key });
+    }
+    else {
+        // SEC-9: disabling encryption is a deliberate trust trade-off — make it loud.
+        console.warn('[astramem-local] WARNING: encryption at rest is DISABLED (security.encryption.enabled=false). ' +
+            `memory.sqlite at ${dbPath} will be stored in PLAINTEXT.`);
+        db = openDb(dbPath);
+    }
+    dbForCrash = db;
+    // FEAT-409: dim only matters for a genuinely fresh DB — migrate() skips
+    // already-applied migrations regardless, so this stays correct across
+    // upgrades and restarts of an existing (already at some dim) DB.
+    migrate(db, cfg.embedding.dim);
+    // FEAT-409 AC-3: the dim the embed preflight checks against is the
+    // PERSISTED schema dim (what memories_vec was actually created with),
+    // not just cfg.embedding.dim — a config/provider dim that drifted from
+    // the real schema (edited config.yaml without running `reembed-dim`)
+    // must fail loud here, not deep inside the first ingest's sqlite-vec
+    // dimension mismatch. Falls back to cfg.embedding.dim on a genuinely
+    // fresh DB (memories_vec doesn't exist yet — migrate() just created it
+    // at that dim, so they agree by construction).
+    const schemaDim = getVecSchemaDim(db) ?? cfg.embedding.dim;
+    // Boot job recovery (P1.1): requeue jobs orphaned by a non-graceful death
+    // ('running' from a mid-handle kill; 'failed' whose in-memory retry timer
+    // died with the process). Purge old completed/poison bookkeeping (P1.2).
+    const bootRepo = new JobRepo(db);
+    const recovered = bootRepo.recoverOrphans();
+    if (recovered.requeuedRunning + recovered.requeuedFailed > 0) {
+        console.log(`[astramem-local] job recovery: requeued ${recovered.requeuedRunning} orphaned running, ` +
+            `${recovered.requeuedFailed} interrupted retries`);
+    }
+    const purged = bootRepo.purgeOld();
+    if (purged.completed + purged.poison > 0) {
+        console.log(`[astramem-local] job retention: purged ${purged.completed} completed, ${purged.poison} poison`);
+    }
+    // Encryption-migration backup cleanup (P1.5): once the encrypted DB has
+    // been opening successfully for 7+ days, the plaintext copy is pure
+    // data-at-rest exposure — delete it. Doctor surfaces it during the window.
+    if (dataDir !== ':memory:' && cfg.security.encryption.enabled) {
+        cleanupPreEncryptionBak(dbPath);
+    }
+    // SEC-9: disabling redaction is a deliberate trust trade-off — make it loud.
+    if (!cfg.security.redaction.enabled) {
+        console.warn('[astramem-local] WARNING: secret redaction is DISABLED (security.redaction.enabled=false). ' +
+            'Transcripts and memories will be persisted WITHOUT stage-0 secret scrubbing.');
+    }
+    // Resolve providers: mock mode (CI/test) or real providers
+    const healthState = createHealthState();
+    if (dataDir !== ':memory:')
+        healthState.dataDir = dataDir;
+    let providers;
+    const useMock = process.env.ASTRA_MEMORY_MOCK_PROVIDERS === '1';
+    if (useMock) {
+        providers = makeMockProviders(cfg.embedding.dim);
+        healthState.embed.ok = true; // mock embed is always available
+        healthState.embed.lastOkAt = Date.now();
+    }
+    else {
+        // Real providers from config — only imported when not in mock mode
+        const { getProviders } = await import('../providers/index.js');
+        providers = getProviders(cfg);
+        if (opts.strictPreflight) {
+            // Legacy fail-fast behavior (CI / scripted checks): probe once with the
+            // historical 5s timeout and exit 1 before accepting traffic.
+            const { embedProbe } = await import('../doctor/probes/embed-probe.js');
+            const preflightResult = await embedProbe(providers.embed, 5000, schemaDim);
+            if (!preflightResult.ok) {
+                const model = providers.embed.model;
+                console.error(`[astramem-local] embed preflight FAILED: ${preflightResult.message}`);
+                console.error(`  Model    : ${model}`);
+                console.error(`  Fix      : ${preflightResult.fix ?? 'Check embed provider config'}`);
+                console.error(`  Install  : ollama pull ${model}`);
+                console.error(`  Docs     : https://ollama.com/library/mxbai-embed-large`);
+                process.exit(1);
+            }
+            healthState.embed.ok = true;
+            healthState.embed.lastOkAt = Date.now();
+        }
+        // Degraded-start (D3): the non-strict preflight runs in the BACKGROUND
+        // after app.listen — see startEmbedPreflight below. A daemon that can
+        // serve recall-from-cache and queue ingest beats a dead one; cold Ollama
+        // model loads at logon no longer kill the boot.
+    }
+    const app = await buildApp({ db, token, embed: providers.embed, config: cfg, healthState });
+    // Wire up the worker with extended context so distillation runs
+    const registry = new HandlerRegistry();
+    registry.register(distillHandler);
+    registry.register(distillEventsHandler);
+    registry.register(cleanupHandler);
+    registry.register(consolidateHandler);
+    registry.register(reembedHandler);
+    const extCtx = {
+        db,
+        config: cfg,
+        providers,
+        memoryRepo: new MemoryRepo(db),
+        vecStore: new SqliteVecStore(db, cfg.embedding.dim),
+    };
+    // startWorker takes HandlerCtx but we pass ExtendedHandlerCtx (structural subtype)
+    const worker = startWorker({
+        pollMs: 500,
+        registry,
+        db,
+        config: cfg,
+        ctx: extCtx,
+        healthState,
+    });
+    // Sync shipper (ADR-003): one-way log shipping to the cloud ledger.
+    // Requires explicit opt-in + url + workspace + device token; personal
+    // atoms never ship regardless (scope filter inside the shipper).
+    let shipper = null;
+    if (cfg.sync.enabled && dataDir !== ':memory:') {
+        const syncToken = process.env.ASTRA_SYNC_TOKEN ?? readSyncToken();
+        if (!cfg.sync.url || !cfg.sync.workspaceId || !syncToken) {
+            console.warn('[astramem-local] sync.enabled=true but url/workspaceId/device-token incomplete — shipper NOT started.');
+        }
+        else {
+            shipper = startShipper({
+                db,
+                url: cfg.sync.url,
+                workspaceId: cfg.sync.workspaceId,
+                deviceId: getOrCreateDeviceId(defaultConfigDir()),
+                token: syncToken,
+                batchSize: cfg.sync.batchSize,
+                intervalMs: cfg.sync.intervalMs,
+            });
+            console.log(`astramem-local sync shipper active -> ${cfg.sync.url}`);
+        }
+    }
+    // FEAT-406: host is config-driven (default '127.0.0.1'). buildApp derives
+    // the /health + /version auth boundary from the SAME cfg.network.host, so
+    // a non-local bind here always implies Bearer-gated health/version there.
+    const host = cfg.network.host;
+    await app.listen({ port, host });
+    console.log(`astramem-local serving on ${host}:${port}`);
+    // Degraded-start (D3): probe the embed provider in the background with
+    // backoff. /health reports status starting -> ok | degraded meanwhile.
+    let stopPreflight = null;
+    if (!useMock && !opts.strictPreflight) {
+        stopPreflight = startEmbedPreflight(providers.embed, healthState, schemaDim);
+    }
+    // Consolidation cadence: the `consolidate` handler existed since Wave 4b
+    // but nothing ever enqueued it — near-duplicate memories accumulated until
+    // someone called POST /consolidation/run by hand. The pass is deterministic
+    // and ~60ms at a few hundred memories, so run it at boot and every 6h.
+    // Enqueued through the jobs table (not called inline) so it serializes with
+    // distills and shows up in `queue` forensics like every other stage.
+    let consolidateTimer = null;
+    if (dataDir !== ':memory:') {
+        const CONSOLIDATE_INTERVAL_MS = 6 * 60 * 60 * 1000;
+        const enqueueConsolidate = () => {
+            try {
+                bootRepo.enqueue('consolidate', {});
+            }
+            catch (err) {
+                console.warn(`[astramem-local] consolidate enqueue failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        };
+        enqueueConsolidate(); // boot pass — catches anything a downtime window skipped
+        consolidateTimer = setInterval(enqueueConsolidate, CONSOLIDATE_INTERVAL_MS);
+        consolidateTimer.unref();
+    }
+    // WAL discipline (W1.5): with synchronous=NORMAL a hard crash loses the
+    // un-checkpointed WAL tail. Truncate hourly so the at-risk window stays
+    // small, and once more on graceful shutdown. Timer unref'd — never holds
+    // the process open.
+    let walTimer = null;
+    if (dataDir !== ':memory:') {
+        const WAL_CHECKPOINT_MS = 60 * 60 * 1000;
+        walTimer = setInterval(() => {
+            try {
+                db.pragma('wal_checkpoint(TRUNCATE)');
+            }
+            catch (err) {
+                console.warn(`[astramem-local] periodic WAL checkpoint failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }, WAL_CHECKPOINT_MS);
+        walTimer.unref();
+    }
+    const shutdown = async () => {
+        try {
+            stopPreflight?.();
+            if (walTimer)
+                clearInterval(walTimer);
+            if (consolidateTimer)
+                clearInterval(consolidateTimer);
+            if (shipper)
+                await shipper.stop();
+            await worker.stop(); // drain in-flight tick before closing DB
+            try {
+                if (dataDir !== ':memory:')
+                    db.pragma('wal_checkpoint(TRUNCATE)');
+            }
+            catch { /* close() below still checkpoints on last connection */ }
+            await app.close();
+        }
+        finally {
+            db.close();
+            lock?.release();
+        }
+        process.exit(0);
+    };
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+}
+/**
+ * Background embed preflight with backoff (5s → 10s → 30s → 60s cap) and a
+ * 30s per-probe timeout (cold Ollama model loads routinely exceed the old 5s
+ * limit). Never hard-exits: persistent failure shows up as status=degraded
+ * in /health and doctor, and embedding jobs retry through the queue anyway.
+ * Returns a canceller; the retry timer is unref'd so it never holds the
+ * process open during shutdown.
+ */
+/**
+ * Delete the plaintext `.pre-encryption.bak` left by the one-shot encryption
+ * migration once it is older than 7 days — by then the encrypted DB has
+ * proven itself across restarts, and a lingering plaintext copy of the whole
+ * database is pure data-at-rest exposure. Doctor reports it during the
+ * grace window so the user knows it exists.
+ */
+function cleanupPreEncryptionBak(dbPath) {
+    const bakPath = `${dbPath}.pre-encryption.bak`;
+    try {
+        const st = statSync(bakPath);
+        const ageDays = (Date.now() - st.mtimeMs) / (24 * 60 * 60 * 1000);
+        if (ageDays > 7) {
+            unlinkSync(bakPath);
+            console.log(`[astramem-local] removed plaintext pre-encryption backup (${Math.floor(ageDays)}d old): ${bakPath}`);
+        }
+        else {
+            console.warn(`[astramem-local] plaintext pre-encryption backup still present (${ageDays.toFixed(1)}d old, ` +
+                `auto-removed after 7d): ${bakPath}`);
+        }
+    }
+    catch {
+        /* absent — nothing to do */
+    }
+}
+function startEmbedPreflight(embed, healthState, expectedDim = embed.dim) {
+    const BACKOFF_MS = [5_000, 10_000, 30_000, 60_000];
+    const PROBE_TIMEOUT_MS = 30_000;
+    let cancelled = false;
+    let timer = null;
+    const attempt = async () => {
+        if (cancelled)
+            return;
+        const { embedProbe } = await import('../doctor/probes/embed-probe.js');
+        const result = await embedProbe(embed, PROBE_TIMEOUT_MS, expectedDim);
+        if (cancelled)
+            return;
+        healthState.embed.attempts++;
+        if (result.ok) {
+            healthState.embed.ok = true;
+            healthState.embed.lastOkAt = Date.now();
+            healthState.embed.lastError = null;
+            console.log(`[astramem-local] embed preflight ok (attempt ${healthState.embed.attempts}): ${result.message}`);
+            return;
+        }
+        healthState.embed.ok = false;
+        healthState.embed.lastError = result.message;
+        if (healthState.embed.attempts === 1) {
+            console.warn(`[astramem-local] embed preflight failing — serving DEGRADED while retrying: ${result.message}`);
+            console.warn(`  Fix      : ${result.fix ?? 'Check embed provider config'}`);
+            console.warn(`  Install  : ollama pull ${embed.model}`);
+        }
+        const delay = BACKOFF_MS[Math.min(healthState.embed.attempts - 1, BACKOFF_MS.length - 1)];
+        timer = setTimeout(() => { void attempt(); }, delay);
+        timer.unref();
+    };
+    void attempt();
+    return () => {
+        cancelled = true;
+        if (timer)
+            clearTimeout(timer);
+    };
+}
+//# sourceMappingURL=serve.js.map

package/dist/cli/serve.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serve.js","sourceRoot":"","sources":["../../src/cli/serve.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAC1D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAsB,MAAM,oBAAoB,CAAC;AAC3F,OAAO,EAAE,kBAAkB,EAAE,MAAM,+BAA+B,CAAC;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAqB,MAAM,6BAA6B,CAAC;AAC1G,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAoB,MAAM,2BAA2B,CAAC;AAEhF,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAqB,MAAM,uBAAuB,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,wCAAwC,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qCAAqC,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,iCAAiC,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAwB,MAAM,+BAA+B,CAAC;AAGxF,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAWzD,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,IAAe;IACzC,sEAAsE;IACtE,6EAA6E;IAC7E,2EAA2E;IAC3E,mCAAmC;IACnC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChG,iEAAiE;IACjE,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC;QACnC,QAAQ,EAAE,IAAI,CAAC,KAAK;QACpB,QAAQ,EAAE,OAAO,CAAC,GAAG,CAAC,kBAAkB;KACzC,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,OAAO,KAAK,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACpF,IAAI,OAAO,KAAK,UAAU;QAAE,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpE,wEAAwE;IACxE,sEAAsE;IACtE,4EAA4E;IAC5E,IAAI,IAAI,GAAwB,IAAI,CAAC;IACrC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,mBAAmB,CAAC,OAAO,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;gBACvC,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,CAAC,OAAO,+BAA+B,CAAC,CAAC;gBAC5E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,uEAAuE;IACvE,gEAAgE;IAChE,MAAM,SAAS,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,CAAC,GAAY,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,0BAA0B,IAAI,GAAG,EAAE,GAAG,CAAC,CAAC;QACtD,IAAI,CAAC;YAAC,IAAI,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACpD,IAAI,CAAC;YAAC,UAAU,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACxD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,IAAI,UAAU,GAAqC,IAAI,CAAC;IACxD,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,CAAC;IAChE,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,SAAS,CAAC,oBAAoB,CAAC,CAAC,CAAC;IAElE,qEAAqE;IACrE,mEAAmE;IACnE,uEAAuE;IACvE,kCAAkC;IAClC,IAAI,EAA6B,CAAC;IAClC,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,cAAc,CAAC,gBAAgB,EAAE,CAAC,CAAC,GAAG,CAAC;QACnD,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,8EAA8E;QAC9E,OAAO,CAAC,IAAI,CACV,gGAAgG;YAChG,oBAAoB,MAAM,+BAA+B,CAC1D,CAAC;QACF,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IACD,UAAU,GAAG,EAAE,CAAC;IAChB,wEAAwE;IACxE,sEAAsE;IACtE,iEAAiE;IACjE,OAAO,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IAE/B,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,qEAAqE;IACrE,qEAAqE;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,+CAA+C;IAC/C,MAAM,SAAS,GAAG,eAAe,CAAC,EAAE,CAAC,IAAI,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;IAE3D,0EAA0E;IAC1E,0EAA0E;IAC1E,yEAAyE;IACzE,MAAM,QAAQ,GAAG,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,QAAQ,CAAC,cAAc,EAAE,CAAC;IAC5C,IAAI,SAAS,CAAC,eAAe,GAAG,SAAS,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,GAAG,CACT,2CAA2C,SAAS,CAAC,eAAe,qBAAqB;YACzF,GAAG,SAAS,CAAC,cAAc,sBAAsB,CAClD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IACnC,IAAI,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,OAAO,CAAC,GAAG,CAAC,0CAA0C,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC;IAC/G,CAAC;IAED,wEAAwE;IACxE,oEAAoE;IACpE,2EAA2E;IAC3E,IAAI,OAAO,KAAK,UAAU,IAAI,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC;QAC9D,uBAAuB,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,6EAA6E;IAC7E,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACpC,OAAO,CAAC,IAAI,CACV,6FAA6F;YAC7F,8EAA8E,CAC/E,CAAC;IACJ,CAAC;IAED,2DAA2D;IAC3D,MAAM,WAAW,GAAG,iBAAiB,EAAE,CAAC;IACxC,IAAI,OAAO,KAAK,UAAU;QAAE,WAAW,CAAC,OAAO,GAAG,OAAO,CAAC;IAC1D,IAAI,SAAwC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,2BAA2B,KAAK,GAAG,CAAC;IAChE,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,GAAG,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACjD,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC,CAAC,iCAAiC;QAC9D,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC1C,CAAC;SAAM,CAAC;QACN,mEAAmE;QACnE,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QAC/D,SAAS,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAE9B,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,wEAAwE;YACxE,6DAA6D;YAC7D,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;YACvE,MAAM,eAAe,GAAG,MAAM,UAAU,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;YAC3E,IAAI,CAAC,eAAe,CAAC,EAAE,EAAE,CAAC;gBACxB,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC;gBACpC,OAAO,CAAC,KAAK,CAAC,4CAA4C,eAAe,CAAC,OAAO,EAAE,CAAC,CAAC;gBACrF,OAAO,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC,CAAC;gBACvC,OAAO,CAAC,KAAK,CAAC,gBAAgB,eAAe,CAAC,GAAG,IAAI,6BAA6B,EAAE,CAAC,CAAC;gBACtF,OAAO,CAAC,KAAK,CAAC,4BAA4B,KAAK,EAAE,CAAC,CAAC;gBACnD,OAAO,CAAC,KAAK,CAAC,2DAA2D,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;YAC5B,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC1C,CAAC;QACD,uEAAuE;QACvE,sEAAsE;QACtE,yEAAyE;QACzE,gDAAgD;IAClD,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC,CAAC;IAE5F,gEAAgE;IAChE,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACxC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC;IACtC,QAAQ,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAElC,MAAM,MAAM,GAAuB;QACjC,EAAE;QACF,MAAM,EAAE,GAAG;QACX,SAAS;QACT,UAAU,EAAE,IAAI,UAAU,CAAC,EAAE,CAAC;QAC9B,QAAQ,EAAE,IAAI,cAAc,CAAC,EAAE,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC;KACpD,CAAC;IAEF,mFAAmF;IACnF,MAAM,MAAM,GAAiB,WAAW,CAAC;QACvC,MAAM,EAAE,GAAG;QACX,QAAQ;QACR,EAAE;QACF,MAAM,EAAE,GAAG;QACX,GAAG,EAAE,MAAM;QACX,WAAW;KACZ,CAAC,CAAC;IAEH,oEAAoE;IACpE,sEAAsE;IACtE,iEAAiE;IACjE,IAAI,OAAO,GAAyB,IAAI,CAAC;IACzC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC/C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;QAClE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,OAAO,CAAC,IAAI,CACV,uGAAuG,CACxG,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,GAAG,YAAY,CAAC;gBACrB,EAAE;gBACF,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG;gBACjB,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW;gBACjC,QAAQ,EAAE,mBAAmB,CAAC,gBAAgB,EAAE,CAAC;gBACjD,KAAK,EAAE,SAAS;gBAChB,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS;gBAC7B,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU;aAChC,CAAC,CAAC;YACH,OAAO,CAAC,GAAG,CAAC,yCAAyC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC;IAC9B,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACjC,OAAO,CAAC,GAAG,CAAC,6BAA6B,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC;IAEzD,uEAAuE;IACvE,uEAAuE;IACvE,IAAI,aAAa,GAAwB,IAAI,CAAC;IAC9C,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,aAAa,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAsB,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;IAChG,CAAC;IAED,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,uEAAuE;IACvE,4EAA4E;IAC5E,qEAAqE;IACrE,IAAI,gBAAgB,GAA0B,IAAI,CAAC;IACnD,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACnD,MAAM,kBAAkB,GAAG,GAAG,EAAE;YAC9B,IAAI,CAAC;gBACH,QAAQ,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;YACtC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,gDAAgD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACnH,CAAC;QACH,CAAC,CAAC;QACF,kBAAkB,EAAE,CAAC,CAAC,yDAAyD;QAC/E,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,EAAE,uBAAuB,CAAC,CAAC;QAC5E,gBAAgB,CAAC,KAAK,EAAE,CAAC;IAC3B,CAAC;IAED,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,oBAAoB;IACpB,IAAI,QAAQ,GAA0B,IAAI,CAAC;IAC3C,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QACzC,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC;gBACH,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACxC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CAAC,oDAAoD,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACvH,CAAC;QACH,CAAC,EAAE,iBAAiB,CAAC,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC1B,IAAI,CAAC;YACH,aAAa,EAAE,EAAE,CAAC;YAClB,IAAI,QAAQ;gBAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,gBAAgB;gBAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACtD,IAAI,OAAO;gBAAE,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAS,yCAAyC;YACtE,IAAI,CAAC;gBACH,IAAI,OAAO,KAAK,UAAU;oBAAE,EAAE,CAAC,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACpE,CAAC;YAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;YACpE,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC;QACpB,CAAC;gBAAS,CAAC;YACT,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,EAAE,OAAO,EAAE,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAChC,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;GAOG;AACH;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,MAAc;IAC7C,MAAM,OAAO,GAAG,GAAG,MAAM,qBAAqB,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAClE,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;YAChB,UAAU,CAAC,OAAO,CAAC,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,6DAA6D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;QACpH,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,IAAI,CACV,mEAAmE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBAC9F,2BAA2B,OAAO,EAAE,CACrC,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,4BAA4B;IAC9B,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,KAAoB,EACpB,WAAwB,EACxB,cAAsB,KAAK,CAAC,GAAG;IAE/B,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,MAAM,gBAAgB,GAAG,MAAM,CAAC;IAChC,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,KAAK,GAA0B,IAAI,CAAC;IAExC,MAAM,OAAO,GAAG,KAAK,IAAmB,EAAE;QACxC,IAAI,SAAS;YAAE,OAAO;QACtB,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,iCAAiC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,gBAAgB,EAAE,WAAW,CAAC,CAAC;QACtE,IAAI,SAAS;YAAE,OAAO;QACtB,WAAW,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,IAAI,CAAC;YAC5B,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxC,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,gDAAgD,WAAW,CAAC,KAAK,CAAC,QAAQ,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9G,OAAO;QACT,CAAC;QACD,WAAW,CAAC,KAAK,CAAC,EAAE,GAAG,KAAK,CAAC;QAC7B,WAAW,CAAC,KAAK,CAAC,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC;QAC7C,IAAI,WAAW,CAAC,KAAK,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,IAAI,CAAC,+EAA+E,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,gBAAgB,MAAM,CAAC,GAAG,IAAI,6BAA6B,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,IAAI,CAAC,4BAA4B,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,EAAE,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QAC1F,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACrD,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC;IAEF,KAAK,OAAO,EAAE,CAAC;IACf,OAAO,GAAG,EAAE;QACV,SAAS,GAAG,IAAI,CAAC;QACjB,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC;AACJ,CAAC"}

package/dist/cli/service.d.ts

@@ -0,0 +1 @@
+export declare function serviceCommand(args: string[]): Promise<void>;

package/dist/cli/service.js

@@ -0,0 +1,121 @@
+import { getServiceAdapter } from '../service/index.js';
+import { installServiceFlow } from '../service/install-flow.js';
+import { resolveRuntimeConfig } from '../config/resolve-runtime.js';
+import { reinstallCommand } from './reinstall.js';
+function parseArg(args, flag) {
+    const i = args.indexOf(flag);
+    return i >= 0 ? args[i + 1] : undefined;
+}
+export async function serviceCommand(args) {
+    const [subCmd, ...rest] = args;
+    const adapter = getServiceAdapter();
+    switch (subCmd) {
+        case 'install': {
+            const portArg = parseArg(rest, '--port');
+            const keepArg = parseArg(rest, '--keep');
+            const withBackupTimer = rest.includes('--with-backup-timer');
+            const { port: cfgPort } = resolveRuntimeConfig({
+                port: portArg ? Number(portArg) : undefined,
+            });
+            const port = cfgPort;
+            const keep = keepArg ? Number(keepArg) : 7;
+            console.log(`Installing AstraMemory service for ${adapter.platform}...`);
+            // Single shared install path (shim + XML task on Windows) — same code
+            // that `init` and `reinstall` use.
+            const { result, build } = await installServiceFlow(port);
+            if (result.kind === 'task') {
+                console.log("Service installed. Run 'astramem-local service start' to start it.");
+            }
+            else {
+                // Startup-shortcut fallback — be honest about limitations.
+                console.log(`Startup shortcut installed at ${result.path}.`);
+                console.log('It will run the daemon at next logon.');
+                console.log(`To start now: astramem-local serve --port ${port}`);
+                console.log("NOTE: 'astramem-local service start' will NOT work — no scheduled task exists.\n" +
+                    "      Re-run 'astramem-local service install' from an elevated shell to install a proper task.");
+            }
+            if (withBackupTimer) {
+                console.log('Installing nightly backup timer (03:00)...');
+                // The backup timer runs `backup --keep N` — it needs the direct
+                // node+entry command, NOT the daemon shim.
+                await adapter.installBackupTimer(build.rawExecPath, keep);
+                console.log(`Backup timer installed (keep=${keep} snapshots).`);
+            }
+            break;
+        }
+        case 'repair': {
+            // Alias for the full reinstall ceremony.
+            await reinstallCommand(rest);
+            break;
+        }
+        case 'uninstall': {
+            console.log('Uninstalling AstraMemory service...');
+            await adapter.uninstall();
+            try {
+                await adapter.uninstallBackupTimer();
+            }
+            catch { /* timer may not be installed */ }
+            console.log('Service uninstalled.');
+            break;
+        }
+        case 'start': {
+            console.log('Starting AstraMemory service...');
+            try {
+                await adapter.start();
+                console.log('Service started.');
+            }
+            catch (err) {
+                console.error(err.message);
+                process.exit(1);
+            }
+            break;
+        }
+        case 'stop': {
+            console.log('Stopping AstraMemory service...');
+            try {
+                await adapter.stop();
+                console.log('Service stopped.');
+            }
+            catch (err) {
+                console.error(err.message);
+                process.exit(1);
+            }
+            break;
+        }
+        case 'status': {
+            const status = await adapter.status();
+            if (status.installed) {
+                const state = status.running ? 'running' : 'stopped';
+                console.log(`Service: installed, ${state}${status.pid ? ` (pid ${status.pid})` : ''}`);
+                if (status.detail)
+                    console.log(`  Detail: ${status.detail}`);
+            }
+            else {
+                console.log('Service: not installed');
+                if (status.detail)
+                    console.log(`  ${status.detail}`);
+                console.log("  Run 'astramem-local service install' to install.");
+            }
+            break;
+        }
+        case undefined:
+        case '--help':
+        case '-h':
+            console.log(`astramem-local service <subcommand>
+
+Subcommands:
+  install [--port N] [--with-backup-timer] [--keep N]
+                       Install OS service (systemd/launchd/schtasks)
+                       --with-backup-timer  also install nightly 03:00 backup timer
+                       --keep N             retain N snapshots (default: 7)
+  uninstall            Remove OS service (also removes backup timer if present)
+  start                Start service via OS init
+  stop                 Stop service via OS init
+  status               Show service status`);
+            break;
+        default:
+            console.error(`unknown service subcommand: ${subCmd}`);
+            process.exit(1);
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/cli/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/cli/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,SAAS,QAAQ,CAAC,IAAc,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAAc;IACjD,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC/B,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IAEpC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,eAAe,GAAG,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;YAC7D,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,oBAAoB,CAAC;gBAC7C,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS;aAC5C,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,OAAO,CAAC;YACrB,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,sCAAsC,OAAO,CAAC,QAAQ,KAAK,CAAC,CAAC;YACzE,sEAAsE;YACtE,mCAAmC;YACnC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,CAAC;YACzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,oEAAoE,CAAC,CAAC;YACpF,CAAC;iBAAM,CAAC;gBACN,2DAA2D;gBAC3D,OAAO,CAAC,GAAG,CAAC,iCAAiC,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC;gBAC7D,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,EAAE,CAAC,CAAC;gBACjE,OAAO,CAAC,GAAG,CACT,kFAAkF;oBAClF,gGAAgG,CACjG,CAAC;YACJ,CAAC;YACD,IAAI,eAAe,EAAE,CAAC;gBACpB,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;gBAC1D,gEAAgE;gBAChE,2CAA2C;gBAC3C,MAAM,OAAO,CAAC,kBAAkB,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;gBAC1D,OAAO,CAAC,GAAG,CAAC,gCAAgC,IAAI,cAAc,CAAC,CAAC;YAClE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,yCAAyC;YACzC,MAAM,gBAAgB,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,OAAO,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;YACnD,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC;YAC1B,IAAI,CAAC;gBAAC,MAAM,OAAO,CAAC,oBAAoB,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,gCAAgC,CAAC,CAAC;YACxF,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC;YACpC,MAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;gBACtB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;YAC/C,IAAI,CAAC;gBACH,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC;gBACrB,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;gBACtC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,MAAM,EAAE,CAAC;YACtC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;gBACrB,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvF,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;YAC/D,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;gBACtC,IAAI,MAAM,CAAC,MAAM;oBAAE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;YACpE,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,SAAS,CAAC;QACf,KAAK,QAAQ,CAAC;QACd,KAAK,IAAI;YACP,OAAO,CAAC,GAAG,CAAC;;;;;;;;;;2CAUyB,CAAC,CAAC;YACvC,MAAM;QAER;YACE,OAAO,CAAC,KAAK,CAAC,+BAA+B,MAAM,EAAE,CAAC,CAAC;YACvD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/cli/sync.d.ts

@@ -0,0 +1,15 @@
+/**
+ * `astramem-local sync pull [--json] [--batch-size N]` — FEAT-407, one-shot
+ * cloud -> local pull. Opens the runtime DB directly (same pattern as
+ * queue/budget/rebuild — see open-runtime-db.ts), unlike consolidate.ts
+ * which proxies over HTTP to a running daemon: pull is a merge operation
+ * against the local event log/watermark, not a daemon-only in-memory
+ * concern, so a one-shot CLI invocation (daemon running or not) is the
+ * right shape, mirroring how `backup`/`restore` work directly against the
+ * DB file.
+ *
+ * Requires the same sync config the shipper uses (cfg.sync.url/workspaceId
+ * + a device token) — pull piggybacks on the existing pairing flow
+ * (`astramem-local pair`), no separate credential story.
+ */
+export declare function syncCommand(args: string[]): Promise<void>;

package/dist/cli/sync.js

@@ -0,0 +1,61 @@
+/**
+ * `astramem-local sync pull [--json] [--batch-size N]` — FEAT-407, one-shot
+ * cloud -> local pull. Opens the runtime DB directly (same pattern as
+ * queue/budget/rebuild — see open-runtime-db.ts), unlike consolidate.ts
+ * which proxies over HTTP to a running daemon: pull is a merge operation
+ * against the local event log/watermark, not a daemon-only in-memory
+ * concern, so a one-shot CLI invocation (daemon running or not) is the
+ * right shape, mirroring how `backup`/`restore` work directly against the
+ * DB file.
+ *
+ * Requires the same sync config the shipper uses (cfg.sync.url/workspaceId
+ * + a device token) — pull piggybacks on the existing pairing flow
+ * (`astramem-local pair`), no separate credential story.
+ */
+import { openRuntimeDb } from './open-runtime-db.js';
+import { readSyncToken } from '../storage/keystore.js';
+import { drainPull, httpPullFetcher, getPullWatermark } from '../sync/puller.js';
+export async function syncCommand(args) {
+    const [sub, ...rest] = args;
+    const jsonMode = rest.includes('--json') || args.includes('--json');
+    switch (sub) {
+        case 'pull': {
+            const { db, cfg } = openRuntimeDb();
+            const token = process.env.ASTRA_SYNC_TOKEN ?? readSyncToken();
+            if (!cfg.sync.url || !cfg.sync.workspaceId || !token) {
+                console.error('sync pull: sync.enabled url/workspaceId/device-token incomplete — run `astramem-local pair` first.');
+                process.exit(1);
+            }
+            const fetcher = httpPullFetcher(cfg.sync.url, token);
+            const result = await drainPull({ db, fetcher, batchSize: cfg.sync.batchSize });
+            if (jsonMode) {
+                console.log(JSON.stringify(result));
+            }
+            else {
+                console.log(`Pull complete: ${result.rounds} round(s), ${result.totalFetched} event(s) fetched, ${result.totalInserted} new.`);
+                console.log(`Watermark: ${result.cursor ?? '(none)'}`);
+            }
+            break;
+        }
+        case 'watermark': {
+            const { db } = openRuntimeDb();
+            const watermark = getPullWatermark(db);
+            console.log(jsonMode ? JSON.stringify({ watermark }) : `Pull watermark: ${watermark ?? '(none — pull has never run)'}`);
+            break;
+        }
+        default:
+            console.log(`astramem-local sync <subcommand>
+
+Subcommands:
+  pull [--json]        Pull events from the cloud since the last watermark,
+                        merge (dedup by event_id, ADR-011 conflict resolve),
+                        advance + persist the watermark.
+  watermark [--json]   Show the current persisted pull watermark.
+
+Push (local -> cloud) runs automatically inside the daemon when
+sync.enabled=true (see \`astramem-local pair\`) — it has no CLI subcommand.`);
+            if (sub !== undefined && sub !== '--help' && sub !== '-h')
+                process.exit(1);
+    }
+}
+//# sourceMappingURL=sync.js.map

package/dist/cli/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/cli/sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAEjF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAc;IAC9C,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEpE,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,aAAa,EAAE,CAAC;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,aAAa,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,EAAE,CAAC;gBACrD,OAAO,CAAC,KAAK,CAAC,oGAAoG,CAAC,CAAC;gBACpH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,KAAe,CAAC,CAAC;YAC/D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;YAC/E,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACtC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,kBAAkB,MAAM,CAAC,MAAM,cAAc,MAAM,CAAC,YAAY,sBAAsB,MAAM,CAAC,aAAa,OAAO,CAAC,CAAC;gBAC/H,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;YACzD,CAAC;YACD,MAAM;QACR,CAAC;QAED,KAAK,WAAW,CAAC,CAAC,CAAC;YACjB,MAAM,EAAE,EAAE,EAAE,GAAG,aAAa,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,EAAE,CAAC,CAAC;YACvC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,mBAAmB,SAAS,IAAI,6BAA6B,EAAE,CAAC,CAAC;YACxH,MAAM;QACR,CAAC;QAED;YACE,OAAO,CAAC,GAAG,CAAC;;;;;;;;;4EAS0D,CAAC,CAAC;YACxE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/E,CAAC;AACH,CAAC"}

package/dist/cli/token.d.ts

@@ -0,0 +1,24 @@
+/**
+ * token subcommand — `astramem-local token rotate`
+ *
+ * Generates a fresh 32-byte (64 hex char) random Bearer token, stores it in
+ * the OS credential store (SEC-10), and prints the `export MEMORY_BEARER=...`
+ * line so the user can paste it. secrets.env is written ONLY as a fallback
+ * when the credential store is unavailable (mode 0600 on Unix) — mirrors the
+ * db-key degradation pattern in storage/keystore.ts.
+ */
+/** Generate a cryptographically secure 32-byte hex token (64 chars). */
+export declare function generateToken(): string;
+/**
+ * Rotate the Bearer token stored in secrets.env.
+ *
+ * Reads any existing secrets.env to preserve azure keys, then overwrites
+ * with a freshly generated MEMORY_BEARER.
+ *
+ * @param secretsPath - Absolute path to secrets.env. Defaults to
+ *   `defaultConfigDir()/secrets.env`.
+ * @returns The new Bearer token string (64 hex chars).
+ */
+export declare function rotateToken(secretsPath?: string): string;
+/** CLI entry for `astramem-local token <subcommand>`. */
+export declare function tokenCommand(args: string[]): Promise<void>;