@astragenie/astramemory-local 0.7.2

package/dist/cli/token.js

@@ -0,0 +1,77 @@
+/**
+ * token subcommand — `astramem-local token rotate`
+ *
+ * Generates a fresh 32-byte (64 hex char) random Bearer token, stores it in
+ * the OS credential store (SEC-10), and prints the `export MEMORY_BEARER=...`
+ * line so the user can paste it. secrets.env is written ONLY as a fallback
+ * when the credential store is unavailable (mode 0600 on Unix) — mirrors the
+ * db-key degradation pattern in storage/keystore.ts.
+ */
+import { randomBytes } from 'node:crypto';
+import { readFileSync, existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { writeSecrets } from '../config/secrets.js';
+import { defaultConfigDir } from '../config/datadir.js';
+import { storeBearer } from '../storage/keystore.js';
+/** Generate a cryptographically secure 32-byte hex token (64 chars). */
+export function generateToken() {
+    return randomBytes(32).toString('hex');
+}
+/**
+ * Rotate the Bearer token stored in secrets.env.
+ *
+ * Reads any existing secrets.env to preserve azure keys, then overwrites
+ * with a freshly generated MEMORY_BEARER.
+ *
+ * @param secretsPath - Absolute path to secrets.env. Defaults to
+ *   `defaultConfigDir()/secrets.env`.
+ * @returns The new Bearer token string (64 hex chars).
+ */
+export function rotateToken(secretsPath) {
+    const path = secretsPath ?? join(defaultConfigDir(), 'secrets.env');
+    const newToken = generateToken();
+    // Preserve any existing azure keys from the current secrets.env.
+    let azureKey;
+    let azureEndpoint;
+    let azureDeployment;
+    if (existsSync(path)) {
+        const content = readFileSync(path, 'utf8');
+        for (const rawLine of content.split('\n')) {
+            const trimmed = rawLine.trim();
+            if (trimmed.startsWith('AZURE_OPENAI_API_KEY=')) {
+                azureKey = trimmed.slice('AZURE_OPENAI_API_KEY='.length);
+            }
+            else if (trimmed.startsWith('AZURE_OPENAI_ENDPOINT=')) {
+                azureEndpoint = trimmed.slice('AZURE_OPENAI_ENDPOINT='.length);
+            }
+            else if (trimmed.startsWith('AZURE_OPENAI_DEPLOYMENT=')) {
+                azureDeployment = trimmed.slice('AZURE_OPENAI_DEPLOYMENT='.length);
+            }
+        }
+    }
+    // SEC-10: try the OS credential store first; only fall back to writing the
+    // bearer into secrets.env when the store is unavailable. Azure keys (if
+    // any) are unaffected — they still live in secrets.env regardless.
+    const { stored } = storeBearer(newToken);
+    writeSecrets({ bearer: stored ? undefined : newToken, azureKey, azureEndpoint, azureDeployment }, path);
+    return newToken;
+}
+/** CLI entry for `astramem-local token <subcommand>`. */
+export async function tokenCommand(args) {
+    const sub = args[0];
+    switch (sub) {
+        case 'rotate': {
+            const token = rotateToken();
+            console.log(`Token rotated. Add to your shell rc:\n`);
+            console.log(`  export MEMORY_BEARER=${token}`);
+            console.log('');
+            console.log('The old token is now invalid. Restart the daemon to pick up the new token.');
+            break;
+        }
+        default:
+            console.error(`token: unknown subcommand '${sub ?? ''}'`);
+            console.error('Usage: astramem-local token rotate');
+            process.exit(1);
+    }
+}
+//# sourceMappingURL=token.js.map

package/dist/cli/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../../src/cli/token.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAErD,wEAAwE;AACxE,MAAM,UAAU,aAAa;IAC3B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,WAAoB;IAC9C,MAAM,IAAI,GAAG,WAAW,IAAI,IAAI,CAAC,gBAAgB,EAAE,EAAE,aAAa,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,aAAa,EAAE,CAAC;IAEjC,iEAAiE;IACjE,IAAI,QAA4B,CAAC;IACjC,IAAI,aAAiC,CAAC;IACtC,IAAI,eAAmC,CAAC;IAExC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;YAC/B,IAAI,OAAO,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,CAAC;gBAChD,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAC3D,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,CAAC,wBAAwB,CAAC,EAAE,CAAC;gBACxD,aAAa,GAAG,OAAO,CAAC,KAAK,CAAC,wBAAwB,CAAC,MAAM,CAAC,CAAC;YACjE,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;gBAC1D,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,mEAAmE;IACnE,MAAM,EAAE,MAAM,EAAE,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACzC,YAAY,CACV,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,EAAE,eAAe,EAAE,EACnF,IAAI,CACL,CAAC;IACF,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,yDAAyD;AACzD,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,IAAc;IAC/C,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,wCAAwC,CAAC,CAAC;YACtD,OAAO,CAAC,GAAG,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,4EAA4E,CAAC,CAAC;YAC1F,MAAM;QACR,CAAC;QACD;YACE,OAAO,CAAC,KAAK,CAAC,8BAA8B,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;YAC1D,OAAO,CAAC,KAAK,CAAC,oCAAoC,CAAC,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/cli/wait-health.d.ts

@@ -0,0 +1,4 @@
+/**
+ * Poll the daemon's /health endpoint until it returns 200 or timeout.
+ */
+export declare function waitForHealth(port: number, timeoutMs: number): Promise<boolean>;

package/dist/cli/wait-health.js

@@ -0,0 +1,23 @@
+/**
+ * Poll the daemon's /health endpoint until it returns 200 or timeout.
+ */
+export async function waitForHealth(port, timeoutMs) {
+    const url = `http://127.0.0.1:${port}/health`;
+    const deadline = Date.now() + timeoutMs;
+    while (Date.now() < deadline) {
+        try {
+            const ctrl = new AbortController();
+            const t = setTimeout(() => ctrl.abort(), 1500);
+            const res = await fetch(url, { signal: ctrl.signal });
+            clearTimeout(t);
+            if (res.ok)
+                return true;
+        }
+        catch {
+            // keep polling
+        }
+        await new Promise(r => setTimeout(r, 250));
+    }
+    return false;
+}
+//# sourceMappingURL=wait-health.js.map

package/dist/cli/wait-health.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"wait-health.js","sourceRoot":"","sources":["../../src/cli/wait-health.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,SAAiB;IACjE,MAAM,GAAG,GAAG,oBAAoB,IAAI,SAAS,CAAC;IAC9C,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,CAAC;YAC/C,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YACtD,YAAY,CAAC,CAAC,CAAC,CAAC;YAChB,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;QACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/config/config.d.ts

@@ -0,0 +1,127 @@
+export interface Config {
+    port: number;
+    dataDir: string;
+    /** FEAT-406: HTTP bind + the derived auth boundary for /health + /version.
+     * Default host is loopback-only — changing it is a deliberate opt-in, not
+     * a two-flag combination that can drift out of sync (see
+     * `isLoopbackHost` in server/lib/network.ts, the single predicate that
+     * decides both bind exposure and whether /health + /version require a
+     * Bearer token). */
+    network: {
+        host: string;
+    };
+    llm: {
+        compaction: {
+            provider: 'ollama' | 'azure-openai';
+            model: string;
+        };
+        extraction: {
+            provider: 'ollama' | 'azure-openai';
+            model: string;
+        };
+    };
+    embedding: {
+        provider: 'ollama' | 'azure-openai';
+        model: string;
+        /** FEAT-409: parameterized — single source of truth is
+         * DEFAULT_EMBED_DIM (src/contracts/embed.ts). Changing this for a
+         * fresh DB is a plain config edit; changing it against an existing DB
+         * with live data requires `astramem-local reembed-dim`
+         * (docs/embed-dim-migration.md). */
+        dim: number;
+    };
+    vector: {
+        store: 'sqlite-vec' | 'lancedb';
+    };
+    budget: {
+        daily_usd: number;
+    };
+    ollama: {
+        baseUrl: string;
+    };
+    azure: {
+        endpoint?: string;
+        deployment?: string;
+        apiVersion: string;
+    };
+    /** Fusion weights — α bm25, β cosine, γ importance, δ freshness,
+     * ε usefulness (ADR-010 v1.x: recall_used/memory_corrected events feed
+     * ranking; atoms with no signal score a neutral 0.5, so ε never reshuffles
+     * an unsignaled corpus), ζ entity-relevance bonus (FEAT-402 AC-6: DEFAULT
+     * 0 = OFF; a candidate entity-linked to an entity mentioned in the query
+     * text gets +ζ. At zeta=0 ranking is byte-identical to no-entity ranking —
+     * see the AC-6 snapshot test in tests/eval/retrieval-eval.test.ts). */
+    search: {
+        alpha: number;
+        beta: number;
+        gamma: number;
+        delta: number;
+        epsilon: number;
+        zeta: number;
+    };
+    recallPack: {
+        enabled: boolean;
+        budgetTokens: number;
+        /** Injection-policy v1 (ADR-005 when-to-recall, Wave 4d). */
+        policy: {
+            enabled: boolean;
+            /** Minimum selection score a memory needs to be injected. */
+            minScore: number;
+            /** Prompts shorter than this get no injection (unless they reference memory). */
+            minPromptChars: number;
+        };
+    };
+    /** One-way log shipping to the cloud ledger (ADR-003). Off by default;
+     * requires url + workspaceId + a device token in the keystore
+     * (or ASTRA_SYNC_TOKEN). personal-scoped atoms never ship (ADR-009). */
+    sync: {
+        enabled: boolean;
+        url: string;
+        workspaceId: string | null;
+        batchSize: number;
+        intervalMs: number;
+    };
+    security: {
+        redaction: {
+            enabled: boolean;
+            /** Shannon-entropy threshold in bits/char for the fallback secret detector. */
+            entropyThreshold: number;
+            /** Org-specific regex sources applied as detector type 'custom'. */
+            customPatterns: string[];
+        };
+        /** Encryption at rest (SEC-1/2/7/9). Disabling is a deliberate trust
+         * trade-off — the daemon logs a prominent WARN at startup (AC-6). */
+        encryption: {
+            enabled: boolean;
+        };
+    };
+    /** Repo/project tag-hygiene backfill (FEAT-403, W4.3). */
+    tagHygiene: {
+        /** Tier-2 prompt-assisted inference is opt-in — a data-mutating heuristic
+         * pass over legacy rows carries real mis-tag risk (PM pre-mortem), so it
+         * never runs silently. Enable via config or the CLI's `--tier2` flag. */
+        tier2Enabled: boolean;
+        /** Minimum tier-2 confidence required to apply an inferred tag; below
+         * this the memory is left untagged rather than risk a mis-tag (AC-4). */
+        tier2ConfidenceThreshold: number;
+    };
+    /** Memory TTL / archival tiers (FEAT-404, W4.4). Both conditions are
+     * required to archive an atom: older than ageThresholdDays AND its
+     * trailing-7-day usefulness rate at/below usefulnessFloor. Off by default
+     * — the PM pre-mortem risk is silently archiving a rarely-used-but-
+     * critical memory, so enabling is a deliberate opt-in. Runs on the
+     * cleanup job's cadence (src/pipeline/handlers/cleanup.ts). */
+    archival: {
+        enabled: boolean;
+        /** Age is measured from created_at (how old the atom itself is), not
+         * valid_from (which supersede() can advance). Default 183 days (~6
+         * months), per the FEAT-404 AC-6 proposal. */
+        ageThresholdDays: number;
+        /** rate_7d <= this floor makes an atom archival-eligible (combined
+         * with the age check). Default 0.0 — no explicit recall_used signal
+         * in the trailing 7 days. */
+        usefulnessFloor: number;
+    };
+}
+export declare function defaultConfig(): Config;
+export declare function loadConfig(overrides: Partial<Config> | undefined): Config;

package/dist/config/config.js

@@ -0,0 +1,38 @@
+import { defaultDataDir } from './datadir.js';
+import { DEFAULT_EMBED_DIM } from '../contracts/embed.js';
+export function defaultConfig() {
+    return {
+        port: 7777,
+        dataDir: defaultDataDir(),
+        network: { host: '127.0.0.1' },
+        llm: {
+            compaction: { provider: 'ollama', model: 'qwen2.5-coder:7b' },
+            extraction: { provider: 'ollama', model: 'qwen2.5-coder:7b' }
+        },
+        embedding: { provider: 'ollama', model: 'mxbai-embed-large', dim: DEFAULT_EMBED_DIM },
+        vector: { store: 'sqlite-vec' },
+        budget: { daily_usd: 10 },
+        ollama: { baseUrl: 'http://127.0.0.1:11434' },
+        azure: { apiVersion: '2024-10-21' },
+        search: { alpha: 0.4, beta: 0.4, gamma: 0.1, delta: 0.1, epsilon: 0.1, zeta: 0 },
+        recallPack: {
+            enabled: false,
+            budgetTokens: 1500,
+            policy: { enabled: true, minScore: 0.15, minPromptChars: 12 },
+        },
+        sync: { enabled: false, url: '', workspaceId: null, batchSize: 200, intervalMs: 30_000 },
+        security: {
+            redaction: { enabled: true, entropyThreshold: 4.0, customPatterns: [] },
+            encryption: { enabled: true }
+        },
+        tagHygiene: { tier2Enabled: false, tier2ConfidenceThreshold: 0.7 },
+        archival: { enabled: false, ageThresholdDays: 183, usefulnessFloor: 0.0 }
+    };
+}
+export function loadConfig(overrides) {
+    const base = defaultConfig();
+    if (!overrides)
+        return base;
+    return { ...base, ...overrides };
+}
+//# sourceMappingURL=config.js.map

package/dist/config/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/config/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAuG1D,MAAM,UAAU,aAAa;IAC3B,OAAO;QACL,IAAI,EAAE,IAAI;QACV,OAAO,EAAE,cAAc,EAAE;QACzB,OAAO,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE;QAC9B,GAAG,EAAE;YACH,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;YAC7D,UAAU,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,kBAAkB,EAAE;SAC9D;QACD,SAAS,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,mBAAmB,EAAE,GAAG,EAAE,iBAAiB,EAAE;QACrF,MAAM,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE;QAC/B,MAAM,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE;QACzB,MAAM,EAAE,EAAE,OAAO,EAAE,wBAAwB,EAAE;QAC7C,KAAK,EAAE,EAAE,UAAU,EAAE,YAAY,EAAE;QACnC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE;QAChF,UAAU,EAAE;YACV,OAAO,EAAE,KAAK;YACd,YAAY,EAAE,IAAI;YAClB,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,EAAE;SAC9D;QACD,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE;QACxF,QAAQ,EAAE;YACR,SAAS,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,GAAG,EAAE,cAAc,EAAE,EAAE,EAAE;YACvE,UAAU,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC9B;QACD,UAAU,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,wBAAwB,EAAE,GAAG,EAAE;QAClE,QAAQ,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,eAAe,EAAE,GAAG,EAAE;KAC1E,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAsC;IAC/D,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,EAAE,GAAG,IAAI,EAAE,GAAG,SAAS,EAAE,CAAC;AACnC,CAAC"}

package/dist/config/datadir.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Returns the canonical data directory for astramemory-local.
+ *
+ * Windows: %LOCALAPPDATA%\Astramem  (matches plugin convention; was AstraMemory in <=0.2.2)
+ * macOS  : ~/Library/Application Support/astra-memory
+ * Linux  : $XDG_DATA_HOME/astra-memory  (default ~/.local/share/astra-memory)
+ */
+export declare function defaultDataDir(): string;
+/**
+ * Returns the canonical config directory for astramemory-local.
+ *
+ * Windows: %APPDATA%\Astramem  (matches plugin convention; was AstraMemory in <=0.2.2)
+ * macOS  : ~/Library/Application Support/astra-memory
+ * Linux  : $XDG_CONFIG_HOME/astra-memory  (default ~/.config/astra-memory)
+ */
+export declare function defaultConfigDir(): string;
+/**
+ * Returns the LEGACY config directory used by daemon <=0.2.2 on Windows.
+ * Non-Windows returns the same value as defaultConfigDir() (no legacy split).
+ *
+ * Used exclusively by migration and fallback bearer-reader code.
+ */
+export declare function legacyConfigDir(): string;
+/**
+ * Returns the LEGACY data directory used by daemon <=0.2.2 on Windows.
+ * Non-Windows returns the same value as defaultDataDir() (no legacy split).
+ *
+ * Used exclusively by migration and fallback bearer-reader code.
+ */
+export declare function legacyDataDir(): string;

package/dist/config/datadir.js

@@ -0,0 +1,65 @@
+import { homedir, platform } from 'node:os';
+import { join } from 'node:path';
+/**
+ * Returns the canonical data directory for astramemory-local.
+ *
+ * Windows: %LOCALAPPDATA%\Astramem  (matches plugin convention; was AstraMemory in <=0.2.2)
+ * macOS  : ~/Library/Application Support/astra-memory
+ * Linux  : $XDG_DATA_HOME/astra-memory  (default ~/.local/share/astra-memory)
+ */
+export function defaultDataDir() {
+    const home = homedir();
+    switch (platform()) {
+        case 'win32':
+            return join(process.env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), 'Astramem');
+        case 'darwin':
+            return join(home, 'Library', 'Application Support', 'astra-memory');
+        default:
+            return join(process.env.XDG_DATA_HOME ?? join(home, '.local', 'share'), 'astra-memory');
+    }
+}
+/**
+ * Returns the canonical config directory for astramemory-local.
+ *
+ * Windows: %APPDATA%\Astramem  (matches plugin convention; was AstraMemory in <=0.2.2)
+ * macOS  : ~/Library/Application Support/astra-memory
+ * Linux  : $XDG_CONFIG_HOME/astra-memory  (default ~/.config/astra-memory)
+ */
+export function defaultConfigDir() {
+    const home = homedir();
+    switch (platform()) {
+        case 'win32':
+            return join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'Astramem');
+        case 'darwin':
+            return join(home, 'Library', 'Application Support', 'astra-memory');
+        default:
+            return join(process.env.XDG_CONFIG_HOME ?? join(home, '.config'), 'astra-memory');
+    }
+}
+/**
+ * Returns the LEGACY config directory used by daemon <=0.2.2 on Windows.
+ * Non-Windows returns the same value as defaultConfigDir() (no legacy split).
+ *
+ * Used exclusively by migration and fallback bearer-reader code.
+ */
+export function legacyConfigDir() {
+    const home = homedir();
+    if (platform() === 'win32') {
+        return join(process.env.APPDATA ?? join(home, 'AppData', 'Roaming'), 'AstraMemory');
+    }
+    return defaultConfigDir();
+}
+/**
+ * Returns the LEGACY data directory used by daemon <=0.2.2 on Windows.
+ * Non-Windows returns the same value as defaultDataDir() (no legacy split).
+ *
+ * Used exclusively by migration and fallback bearer-reader code.
+ */
+export function legacyDataDir() {
+    const home = homedir();
+    if (platform() === 'win32') {
+        return join(process.env.LOCALAPPDATA ?? join(home, 'AppData', 'Local'), 'AstraMemory');
+    }
+    return defaultDataDir();
+}
+//# sourceMappingURL=datadir.js.map

package/dist/config/datadir.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"datadir.js","sourceRoot":"","sources":["../../src/config/datadir.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC;;;;;;GAMG;AACH,MAAM,UAAU,cAAc;IAC5B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC;QACtF,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC;QACtE;YACE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,cAAc,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB;IAC9B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,QAAQ,QAAQ,EAAE,EAAE,CAAC;QACnB,KAAK,OAAO;YACV,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QACnF,KAAK,QAAQ;YACX,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC;QACtE;YACE,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,cAAc,CAAC,CAAC;IACtF,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,aAAa,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,gBAAgB,EAAE,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa;IAC3B,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,aAAa,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,cAAc,EAAE,CAAC;AAC1B,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,23 @@
+/**
+ * loadConfigFromDisk — read <configDir>/config.yaml (written by `init` /
+ * writer.ts) and merge it over defaultConfig(). Until now the file was
+ * write-only: init produced it but the daemon booted from defaults, so user
+ * edits were silently ignored.
+ *
+ * The parser handles exactly the subset writer.ts emits — nested maps of
+ * scalars (string/number/boolean, single-quoted strings), '#' comments,
+ * blank lines. No lists, no multi-line strings, no anchors; if the file
+ * grows past that, swap in a real YAML package (see writer.ts header).
+ * Unknown keys are ignored; a malformed file logs a warning and falls back
+ * to defaults rather than blocking daemon boot.
+ */
+import { type Config } from './config.js';
+type PlainObject = Record<string, unknown>;
+/** Parse the writer.ts YAML subset into a nested plain object. */
+export declare function parseConfigYaml(text: string): PlainObject;
+/**
+ * defaultConfig() with config.yaml (if present and well-formed) merged over
+ * it. Never throws — daemon boot must not be blocked by a bad config file.
+ */
+export declare function loadConfigFromDisk(configDir: string): Config;
+export {};

package/dist/config/loader.js

@@ -0,0 +1,102 @@
+/**
+ * loadConfigFromDisk — read <configDir>/config.yaml (written by `init` /
+ * writer.ts) and merge it over defaultConfig(). Until now the file was
+ * write-only: init produced it but the daemon booted from defaults, so user
+ * edits were silently ignored.
+ *
+ * The parser handles exactly the subset writer.ts emits — nested maps of
+ * scalars (string/number/boolean, single-quoted strings), '#' comments,
+ * blank lines. No lists, no multi-line strings, no anchors; if the file
+ * grows past that, swap in a real YAML package (see writer.ts header).
+ * Unknown keys are ignored; a malformed file logs a warning and falls back
+ * to defaults rather than blocking daemon boot.
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { defaultConfig } from './config.js';
+function parseScalar(raw) {
+    const v = raw.trim();
+    if (v === '')
+        return undefined;
+    if (v.startsWith("'") && v.endsWith("'"))
+        return v.slice(1, -1).replace(/''/g, "'");
+    if (v === 'true')
+        return true;
+    if (v === 'false')
+        return false;
+    if (v === 'null' || v === '~')
+        return null;
+    if (/^-?\d+(\.\d+)?$/.test(v))
+        return Number(v);
+    return v;
+}
+/** Parse the writer.ts YAML subset into a nested plain object. */
+export function parseConfigYaml(text) {
+    const root = {};
+    // Stack of (indent level → object) for nesting; root is indent -1.
+    const stack = [{ indent: -1, obj: root }];
+    for (const rawLine of text.split('\n')) {
+        const withoutComment = rawLine.replace(/(^|\s)#.*$/, '');
+        if (!withoutComment.trim())
+            continue;
+        const indent = withoutComment.length - withoutComment.trimStart().length;
+        const line = withoutComment.trim();
+        const colon = line.indexOf(':');
+        if (colon <= 0)
+            continue; // not a key line — ignore rather than throw
+        const key = line.slice(0, colon).trim();
+        const rest = line.slice(colon + 1);
+        while (stack.length > 1 && indent <= stack[stack.length - 1].indent) {
+            stack.pop();
+        }
+        const parent = stack[stack.length - 1].obj;
+        if (rest.trim() === '') {
+            const child = {};
+            parent[key] = child;
+            stack.push({ indent, obj: child });
+        }
+        else {
+            const value = parseScalar(rest);
+            if (value !== undefined)
+                parent[key] = value;
+        }
+    }
+    return root;
+}
+/** Deep-merge `overrides` into `base`, only following keys base already has structure for. */
+function deepMerge(base, overrides) {
+    const out = { ...base };
+    for (const [key, value] of Object.entries(overrides)) {
+        const existing = out[key];
+        if (value !== null && typeof value === 'object' && !Array.isArray(value) &&
+            existing !== null && typeof existing === 'object' && !Array.isArray(existing)) {
+            out[key] = deepMerge(existing, value);
+        }
+        else if (value !== undefined) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+/**
+ * defaultConfig() with config.yaml (if present and well-formed) merged over
+ * it. Never throws — daemon boot must not be blocked by a bad config file.
+ */
+export function loadConfigFromDisk(configDir) {
+    const base = defaultConfig();
+    let text;
+    try {
+        text = readFileSync(join(configDir, 'config.yaml'), 'utf8');
+    }
+    catch {
+        return base; // no file — defaults
+    }
+    try {
+        return deepMerge(base, parseConfigYaml(text));
+    }
+    catch (err) {
+        console.warn(`[astramem-local] WARNING: config.yaml could not be parsed (${String(err)}) — using defaults.`);
+        return base;
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/config/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAe,aAAa,EAAE,MAAM,aAAa,CAAC;AAIzD,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,CAAC,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACrB,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC/B,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;IAChD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,IAAI,GAAgB,EAAE,CAAC;IAC7B,mEAAmE;IACnE,MAAM,KAAK,GAAgD,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;IAEvF,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE;YAAE,SAAS;QAErC,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,GAAG,cAAc,CAAC,SAAS,EAAE,CAAC,MAAM,CAAC;QACzE,MAAM,IAAI,GAAG,cAAc,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,CAAC;YAAE,SAAS,CAAC,4CAA4C;QAEtE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QAEnC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,IAAK,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAwB,CAAC,MAAM,EAAE,CAAC;YAC5F,KAAK,CAAC,GAAG,EAAE,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAA0B,CAAC,GAAG,CAAC;QAErE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACvB,MAAM,KAAK,GAAgB,EAAE,CAAC;YAC9B,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACpB,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QACrC,CAAC;aAAM,CAAC;YACN,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8FAA8F;AAC9F,SAAS,SAAS,CAAI,IAAO,EAAE,SAAsB;IACnD,MAAM,GAAG,GAAG,EAAE,GAAI,IAAoB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IACE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACpE,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAC7E,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,QAAQ,EAAE,KAAoB,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAQ,CAAC;AAClB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB;IAClD,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,qBAAqB;IACpC,CAAC;IACD,IAAI,CAAC;QACH,OAAO,SAAS,CAAC,IAAI,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CAAC,8DAA8D,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;QAC7G,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/config/migrate-dirs.d.ts

@@ -0,0 +1,36 @@
+/**
+ * migrate-dirs.ts
+ *
+ * One-shot, idempotent migration for daemon installs upgrading from <=0.2.2.
+ *
+ * Background: daemon <=0.2.2 used `%APPDATA%\AstraMemory` (config) and
+ * `%LOCALAPPDATA%\AstraMemory` (data) on Windows. The plugin has always used
+ * `%APPDATA%\Astramem`. This divergence caused a bearer mismatch (401 on every
+ * ingest) because each product's `init` wizard writes its own `secrets.env`
+ * to its own directory.
+ *
+ * Fix: daemon now uses `Astramem` as the canonical dir name (matching the
+ * plugin). This module renames the legacy dirs to canonical on first boot
+ * after the upgrade. It is safe to call on every boot.
+ *
+ * Windows-only. On macOS/Linux the legacy and canonical paths are identical
+ * (no migration needed) and this function returns immediately.
+ */
+export interface MigrationResult {
+    configMigrated: boolean;
+    dataMigrated: boolean;
+    warnings: string[];
+}
+/**
+ * Migrate legacy Windows config/data dirs to canonical names if needed.
+ *
+ * Rules for each dir pair (legacy → canonical):
+ * - canonical exists → no-op (already migrated or user did fresh init)
+ * - only legacy exists → rename legacy to canonical (log migration)
+ * - both exist → no-op, emit warning (user must reconcile manually)
+ * - neither exists → no-op (fresh install, nothing to migrate)
+ *
+ * IMPORTANT: never overwrites canonical if it already contains data. This
+ * preserves any bearer the user wrote via `astramem-local init` after upgrading.
+ */
+export declare function migrateLegacyDirsIfPresent(): MigrationResult;