@astragenie/astramemory-local 0.7.2

package/dist/config/migrate-dirs.js

@@ -0,0 +1,132 @@
+/**
+ * migrate-dirs.ts
+ *
+ * One-shot, idempotent migration for daemon installs upgrading from <=0.2.2.
+ *
+ * Background: daemon <=0.2.2 used `%APPDATA%\AstraMemory` (config) and
+ * `%LOCALAPPDATA%\AstraMemory` (data) on Windows. The plugin has always used
+ * `%APPDATA%\Astramem`. This divergence caused a bearer mismatch (401 on every
+ * ingest) because each product's `init` wizard writes its own `secrets.env`
+ * to its own directory.
+ *
+ * Fix: daemon now uses `Astramem` as the canonical dir name (matching the
+ * plugin). This module renames the legacy dirs to canonical on first boot
+ * after the upgrade. It is safe to call on every boot.
+ *
+ * Windows-only. On macOS/Linux the legacy and canonical paths are identical
+ * (no migration needed) and this function returns immediately.
+ */
+import { existsSync, renameSync, copyFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { platform } from 'node:os';
+import { defaultConfigDir, defaultDataDir, legacyConfigDir, legacyDataDir } from './datadir.js';
+/**
+ * Migrate legacy Windows config/data dirs to canonical names if needed.
+ *
+ * Rules for each dir pair (legacy → canonical):
+ * - canonical exists → no-op (already migrated or user did fresh init)
+ * - only legacy exists → rename legacy to canonical (log migration)
+ * - both exist → no-op, emit warning (user must reconcile manually)
+ * - neither exists → no-op (fresh install, nothing to migrate)
+ *
+ * IMPORTANT: never overwrites canonical if it already contains data. This
+ * preserves any bearer the user wrote via `astramem-local init` after upgrading.
+ */
+export function migrateLegacyDirsIfPresent() {
+    const result = {
+        configMigrated: false,
+        dataMigrated: false,
+        warnings: [],
+    };
+    // Non-Windows: legacy and canonical paths are identical — nothing to do.
+    if (platform() !== 'win32') {
+        return result;
+    }
+    const pairs = [
+        {
+            label: 'config',
+            legacy: legacyConfigDir(),
+            canonical: defaultConfigDir(),
+            migratedKey: 'configMigrated',
+        },
+        {
+            label: 'data',
+            legacy: legacyDataDir(),
+            canonical: defaultDataDir(),
+            migratedKey: 'dataMigrated',
+        },
+    ];
+    for (const { label, legacy, canonical, migratedKey } of pairs) {
+        const legacyExists = existsSync(legacy);
+        const canonicalExists = existsSync(canonical);
+        if (!legacyExists) {
+            // Fresh install or already migrated (canonical may or may not exist). No-op.
+            continue;
+        }
+        if (canonicalExists) {
+            // Both exist. Reconcile per-file: copy (never move, never overwrite)
+            // any file the canonical dir LACKS that the legacy dir has. This
+            // rescues the stranded-data case — e.g. a fresh canonical dir created
+            // next to a legacy dir that still holds the real memory.sqlite —
+            // while never clobbering a valid canonical bearer or database.
+            const candidates = label === 'config'
+                ? ['secrets.env', 'config.yaml']
+                : ['memory.sqlite', 'memory.sqlite-wal', 'memory.sqlite-shm'];
+            // Data pair: the DB and its WAL/SHM are one consistency unit — only
+            // copy when the canonical dir has NONE of them (a mismatched WAL
+            // corrupts the database). Config pair: copy per-file.
+            let copyable;
+            if (label === 'data') {
+                const canonicalHasAny = candidates.some(f => existsSync(join(canonical, f)));
+                copyable = canonicalHasAny ? [] : candidates.filter(f => existsSync(join(legacy, f)));
+            }
+            else {
+                copyable = candidates.filter(f => existsSync(join(legacy, f)) && !existsSync(join(canonical, f)));
+            }
+            let copied = 0;
+            for (const f of copyable) {
+                try {
+                    // tmp + rename so a crash mid-copy never leaves a torn file at the
+                    // canonical path (same pattern as migrate-encrypt.ts).
+                    const tmp = join(canonical, `${f}.migrating-tmp`);
+                    copyFileSync(join(legacy, f), tmp);
+                    renameSync(tmp, join(canonical, f));
+                    copied++;
+                    console.log(`[astramem-local] reconciled ${label} file from legacy dir: ${f}`);
+                }
+                catch (err) {
+                    result.warnings.push(`Failed to copy legacy ${label} file "${f}": ${err}`);
+                }
+            }
+            if (copied > 0)
+                result[migratedKey] = true;
+            const bothHaveDb = label === 'data' &&
+                existsSync(join(legacy, 'memory.sqlite')) &&
+                existsSync(join(canonical, 'memory.sqlite'));
+            const warning = bothHaveDb
+                ? `Two ${label} dirs BOTH contain memory.sqlite: "${legacy}" and "${canonical}". ` +
+                    `Using canonical — verify it holds your real data (run 'astramem-local doctor'); ` +
+                    `the legacy copy was left untouched.`
+                : `Two ${label} dirs detected: "${legacy}" and "${canonical}". Using canonical` +
+                    (copied > 0 ? ` (${copied} missing file(s) copied from legacy).` : '.') +
+                    ` Legacy dir left untouched; delete manually after verifying.`;
+            result.warnings.push(warning);
+            console.warn(`[astramem-local] WARN: ${warning}`);
+            continue;
+        }
+        // Only legacy exists → rename to canonical.
+        try {
+            renameSync(legacy, canonical);
+            result[migratedKey] = true;
+            console.log(`[astramem-local] migrated legacy ${label} dir: "${legacy}" → "${canonical}"`);
+        }
+        catch (err) {
+            const warning = `Failed to migrate legacy ${label} dir from "${legacy}" to "${canonical}": ${err}. ` +
+                `Manual rename required to restore bearer compatibility with the plugin.`;
+            result.warnings.push(warning);
+            console.warn(`[astramem-local] WARN: ${warning}`);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=migrate-dirs.js.map

package/dist/config/migrate-dirs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate-dirs.js","sourceRoot":"","sources":["../../src/config/migrate-dirs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAQhG;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,0BAA0B;IACxC,MAAM,MAAM,GAAoB;QAC9B,cAAc,EAAE,KAAK;QACrB,YAAY,EAAE,KAAK;QACnB,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,yEAAyE;IACzE,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,KAAK,GAKN;QACH;YACE,KAAK,EAAE,QAAQ;YACf,MAAM,EAAE,eAAe,EAAE;YACzB,SAAS,EAAE,gBAAgB,EAAE;YAC7B,WAAW,EAAE,gBAAgB;SAC9B;QACD;YACE,KAAK,EAAE,MAAM;YACb,MAAM,EAAE,aAAa,EAAE;YACvB,SAAS,EAAE,cAAc,EAAE;YAC3B,WAAW,EAAE,cAAc;SAC5B;KACF,CAAC;IAEF,KAAK,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,KAAK,EAAE,CAAC;QAC9D,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACxC,MAAM,eAAe,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QAE9C,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,6EAA6E;YAC7E,SAAS;QACX,CAAC;QAED,IAAI,eAAe,EAAE,CAAC;YACpB,qEAAqE;YACrE,iEAAiE;YACjE,sEAAsE;YACtE,iEAAiE;YACjE,+DAA+D;YAC/D,MAAM,UAAU,GACd,KAAK,KAAK,QAAQ;gBAChB,CAAC,CAAC,CAAC,aAAa,EAAE,aAAa,CAAC;gBAChC,CAAC,CAAC,CAAC,eAAe,EAAE,mBAAmB,EAAE,mBAAmB,CAAC,CAAC;YAClE,oEAAoE;YACpE,iEAAiE;YACjE,sDAAsD;YACtD,IAAI,QAAkB,CAAC;YACvB,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;gBACrB,MAAM,eAAe,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC7E,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACxF,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,mEAAmE;oBACnE,uDAAuD;oBACvD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC;oBAClD,YAAY,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBACnC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;oBACpC,MAAM,EAAE,CAAC;oBACT,OAAO,CAAC,GAAG,CAAC,+BAA+B,KAAK,0BAA0B,CAAC,EAAE,CAAC,CAAC;gBACjF,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,yBAAyB,KAAK,UAAU,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;gBAC7E,CAAC;YACH,CAAC;YACD,IAAI,MAAM,GAAG,CAAC;gBAAE,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;YAE3C,MAAM,UAAU,GACd,KAAK,KAAK,MAAM;gBAChB,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;gBACzC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,UAAU;gBACxB,CAAC,CAAC,OAAO,KAAK,sCAAsC,MAAM,UAAU,SAAS,KAAK;oBAChF,kFAAkF;oBAClF,qCAAqC;gBACvC,CAAC,CAAC,OAAO,KAAK,oBAAoB,MAAM,UAAU,SAAS,oBAAoB;oBAC7E,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,uCAAuC,CAAC,CAAC,CAAC,GAAG,CAAC;oBACvE,8DAA8D,CAAC;YACnE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;YAClD,SAAS;QACX,CAAC;QAED,4CAA4C;QAC5C,IAAI,CAAC;YACH,UAAU,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC9B,MAAM,CAAC,WAAW,CAAC,GAAG,IAAI,CAAC;YAC3B,OAAO,CAAC,GAAG,CACT,oCAAoC,KAAK,UAAU,MAAM,QAAQ,SAAS,GAAG,CAC9E,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,OAAO,GACX,4BAA4B,KAAK,cAAc,MAAM,SAAS,SAAS,MAAM,GAAG,IAAI;gBACpF,yEAAyE,CAAC;YAC5E,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC9B,OAAO,CAAC,IAAI,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/config/persist-envs.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Cross-platform persistence of environment variables for the user's shell.
+ *
+ * Windows: SetEnvironmentVariable(key, value, "User") via spawned PowerShell.
+ *          Equivalent to `setx KEY VAL` but doesn't truncate at 1024 chars.
+ *
+ * Linux/macOS: append/replace an idempotent block to the user's shell rc:
+ *   - bash → ~/.bashrc
+ *   - zsh  → ~/.zshrc
+ *   - fish → ~/.config/fish/config.fish
+ *   Defaults to ~/.profile if shell can't be detected.
+ *
+ * The block is wrapped in begin/end markers so re-running init does not
+ * accumulate duplicate exports.
+ */
+export interface PersistResult {
+    ok: boolean;
+    target: string;
+    message: string;
+    /** True when the caller likely needs to open a new shell for envs to take effect. */
+    requiresNewShell: boolean;
+}
+export declare function persistEnvVars(vars: Record<string, string>): Promise<PersistResult>;

package/dist/config/persist-envs.js

@@ -0,0 +1,119 @@
+/**
+ * Cross-platform persistence of environment variables for the user's shell.
+ *
+ * Windows: SetEnvironmentVariable(key, value, "User") via spawned PowerShell.
+ *          Equivalent to `setx KEY VAL` but doesn't truncate at 1024 chars.
+ *
+ * Linux/macOS: append/replace an idempotent block to the user's shell rc:
+ *   - bash → ~/.bashrc
+ *   - zsh  → ~/.zshrc
+ *   - fish → ~/.config/fish/config.fish
+ *   Defaults to ~/.profile if shell can't be detected.
+ *
+ * The block is wrapped in begin/end markers so re-running init does not
+ * accumulate duplicate exports.
+ */
+import { existsSync, readFileSync, writeFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { homedir, platform } from 'node:os';
+import { execSync } from 'node:child_process';
+import { mkdirSync } from 'node:fs';
+const MARKER_BEGIN = '# >>> astra-memory env >>>';
+const MARKER_END = '# <<< astra-memory env <<<';
+export async function persistEnvVars(vars) {
+    if (platform() === 'win32')
+        return persistWindows(vars);
+    return persistUnix(vars);
+}
+// ─── Windows ─────────────────────────────────────────────────────────────────
+function persistWindows(vars) {
+    // Use [Environment]::SetEnvironmentVariable so values longer than 1024 chars
+    // are accepted (setx truncates).
+    //
+    // PowerShell quoting strategy: build the script with SINGLE-quoted string
+    // literals so embedded double-quotes do not collide with the outer
+    // `powershell -Command "..."` shell quoting. Single-quoted PS strings do
+    // not expand $vars or backticks — values pass through literally. Escape
+    // embedded single quotes by doubling them (PS rule).
+    const ps = Object.entries(vars)
+        .map(([k, v]) => {
+        const esc = v.replace(/'/g, "''");
+        return `[Environment]::SetEnvironmentVariable('${k}', '${esc}', 'User')`;
+    })
+        .join('; ');
+    try {
+        execSync(`powershell -NoProfile -Command "${ps}"`, { stdio: 'pipe', timeout: 10_000 });
+        return {
+            ok: true,
+            target: 'Windows User environment',
+            message: `Wrote ${Object.keys(vars).length} env var(s) to User scope`,
+            requiresNewShell: true,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            target: 'Windows User environment',
+            message: `Failed: ${msg.slice(0, 200)}`,
+            requiresNewShell: false,
+        };
+    }
+}
+// ─── Unix (Linux + macOS) ────────────────────────────────────────────────────
+function detectRcPath() {
+    const shell = process.env['SHELL'] ?? '';
+    const home = homedir();
+    if (shell.includes('zsh'))
+        return { path: join(home, '.zshrc'), shell: 'zsh' };
+    if (shell.includes('fish'))
+        return { path: join(home, '.config', 'fish', 'config.fish'), shell: 'fish' };
+    if (shell.includes('bash'))
+        return { path: join(home, '.bashrc'), shell: 'bash' };
+    return { path: join(home, '.profile'), shell: 'sh' };
+}
+function buildExportBlock(vars, shell) {
+    const lines = [MARKER_BEGIN];
+    for (const [k, v] of Object.entries(vars)) {
+        if (shell === 'fish') {
+            // single-quoted on fish too — fish doesn't expand inside single quotes
+            lines.push(`set -gx ${k} '${v.replace(/'/g, "'\\''")}'`);
+        }
+        else {
+            // POSIX shells — single-quote to avoid expansion of $ etc.
+            lines.push(`export ${k}='${v.replace(/'/g, "'\\''")}'`);
+        }
+    }
+    lines.push(MARKER_END);
+    return lines.join('\n');
+}
+function persistUnix(vars) {
+    const { path, shell } = detectRcPath();
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        const existing = existsSync(path) ? readFileSync(path, 'utf8') : '';
+        const block = buildExportBlock(vars, shell);
+        // Replace if the markers exist; otherwise append.
+        const re = new RegExp(`${MARKER_BEGIN}[\\s\\S]*?${MARKER_END}`, 'm');
+        const next = re.test(existing)
+            ? existing.replace(re, block)
+            : (existing.endsWith('\n') || existing === '' ? existing : existing + '\n') + '\n' + block + '\n';
+        writeFileSync(path, next, 'utf8');
+        return {
+            ok: true,
+            target: path,
+            message: `Wrote ${Object.keys(vars).length} env var(s) to ${shell} rc`,
+            requiresNewShell: true,
+        };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        return {
+            ok: false,
+            target: path,
+            message: `Failed: ${msg.slice(0, 200)}`,
+            requiresNewShell: false,
+        };
+    }
+}
+//# sourceMappingURL=persist-envs.js.map

package/dist/config/persist-envs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist-envs.js","sourceRoot":"","sources":["../../src/config/persist-envs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAClE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAEpC,MAAM,YAAY,GAAG,4BAA4B,CAAC;AAClD,MAAM,UAAU,GAAG,4BAA4B,CAAC;AAUhD,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA4B;IAC/D,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,gFAAgF;AAEhF,SAAS,cAAc,CAAC,IAA4B;IAClD,6EAA6E;IAC7E,iCAAiC;IACjC,EAAE;IACF,0EAA0E;IAC1E,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,qDAAqD;IACrD,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;SAC5B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE;QACd,MAAM,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,OAAO,0CAA0C,CAAC,OAAO,GAAG,YAAY,CAAC;IAC3E,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,IAAI,CAAC;QACH,QAAQ,CAAC,mCAAmC,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,2BAA2B;YACrE,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,0BAA0B;YAClC,OAAO,EAAE,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACvC,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;AACH,CAAC;AAED,gFAAgF;AAEhF,SAAS,YAAY;IACnB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC/E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACzG,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAClF,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,SAAS,gBAAgB,CAAC,IAA4B,EAAE,KAAa;IACnE,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,uEAAuE;YACvE,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC3D,CAAC;aAAM,CAAC;YACN,2DAA2D;YAC3D,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvB,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,IAA4B;IAC/C,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,YAAY,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAE5C,kDAAkD;QAClD,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,YAAY,aAAa,UAAU,EAAE,EAAE,GAAG,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC5B,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,CAAC;YAC7B,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAC;QAEpG,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,SAAS,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,kBAAkB,KAAK,KAAK;YACtE,gBAAgB,EAAE,IAAI;SACvB,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI;YACZ,OAAO,EAAE,WAAW,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE;YACvC,gBAAgB,EAAE,KAAK;SACxB,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/config/resolve-runtime.d.ts

@@ -0,0 +1,19 @@
+import type { Config } from './config.js';
+export type ValueSource = 'cli' | 'env' | 'config.yaml' | 'default';
+export interface RuntimeConfig {
+    cfg: Config;
+    port: number;
+    dataDir: string;
+    configDir: string;
+    /** Where each resolved value came from — surfaced by `reinstall` so users
+     *  can see WHY the daemon is using a given directory/port. */
+    sources: {
+        port: ValueSource;
+        dataDir: ValueSource;
+    };
+}
+export interface RuntimeOverrides {
+    port?: number;
+    dataDir?: string;
+}
+export declare function resolveRuntimeConfig(overrides?: RuntimeOverrides): RuntimeConfig;

package/dist/config/resolve-runtime.js

@@ -0,0 +1,53 @@
+/**
+ * resolve-runtime.ts — single source of truth for runtime config resolution.
+ *
+ * Extracted from serve.ts so that serve, doctor, backup, and reinstall all
+ * resolve port/dataDir from the SAME inputs with the SAME precedence:
+ *
+ *   port   : CLI flag > config.yaml > default
+ *   dataDir: CLI flag > ASTRA_MEMORY_DATADIR env > config.yaml > default
+ *
+ * Historically doctor and backup used `defaultConfig()` (never reading
+ * config.yaml), so when config.yaml carried a non-default `dataDir` they
+ * probed/backed-up a DIFFERENT directory than the daemon was serving from —
+ * producing false "file is not a database" doctor failures and backups of
+ * the wrong database.
+ */
+import { loadConfigFromDisk } from './loader.js';
+import { defaultConfigDir, defaultDataDir } from './datadir.js';
+import { readSyncSettings } from './sync-settings.js';
+import { migrateLegacyDirsIfPresent } from './migrate-dirs.js';
+export function resolveRuntimeConfig(overrides = {}) {
+    // Legacy Windows dir rename (AstraMemory → Astramem) must run before any
+    // config read so the canonical config.yaml is the one we load. Idempotent.
+    migrateLegacyDirsIfPresent();
+    const configDir = defaultConfigDir();
+    const cfg = loadConfigFromDisk(configDir);
+    // `astramem-local pair` persists sync settings to sync.json — merge them
+    // over config.yaml so pairing survives restarts.
+    const pairedSync = readSyncSettings(configDir);
+    if (pairedSync) {
+        cfg.sync = { ...cfg.sync, enabled: pairedSync.enabled, url: pairedSync.url, workspaceId: pairedSync.workspaceId };
+    }
+    // ASTRA_MEMORY_PORT sits between the CLI flag and config.yaml — the
+    // systemd unit has always set it (it was a dead env until W1.4).
+    const envPort = process.env.ASTRA_MEMORY_PORT ? Number(process.env.ASTRA_MEMORY_PORT) : undefined;
+    const port = overrides.port ?? (Number.isInteger(envPort) ? envPort : undefined) ?? cfg.port;
+    const portSource = overrides.port !== undefined ? 'cli' : Number.isInteger(envPort) ? 'env' : 'config.yaml';
+    let dataDir;
+    let dataDirSource;
+    if (overrides.dataDir !== undefined) {
+        dataDir = overrides.dataDir;
+        dataDirSource = 'cli';
+    }
+    else if (process.env.ASTRA_MEMORY_DATADIR) {
+        dataDir = process.env.ASTRA_MEMORY_DATADIR;
+        dataDirSource = 'env';
+    }
+    else {
+        dataDir = cfg.dataDir;
+        dataDirSource = cfg.dataDir === defaultDataDir() ? 'default' : 'config.yaml';
+    }
+    return { cfg, port, dataDir, configDir, sources: { port: portSource, dataDir: dataDirSource } };
+}
+//# sourceMappingURL=resolve-runtime.js.map

package/dist/config/resolve-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resolve-runtime.js","sourceRoot":"","sources":["../../src/config/resolve-runtime.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAoB/D,MAAM,UAAU,oBAAoB,CAAC,YAA8B,EAAE;IACnE,yEAAyE;IACzE,2EAA2E;IAC3E,0BAA0B,EAAE,CAAC;IAE7B,MAAM,SAAS,GAAG,gBAAgB,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAC;IAE1C,yEAAyE;IACzE,iDAAiD;IACjD,MAAM,UAAU,GAAG,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,CAAC,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,UAAU,CAAC,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;IACpH,CAAC;IAED,oEAAoE;IACpE,iEAAiE;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAE,OAAkB,CAAC,CAAC,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;IACzG,MAAM,UAAU,GACd,SAAS,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,aAAa,CAAC;IAE3F,IAAI,OAAe,CAAC;IACpB,IAAI,aAA0B,CAAC;IAC/B,IAAI,SAAS,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACpC,OAAO,GAAG,SAAS,CAAC,OAAO,CAAC;QAC5B,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;SAAM,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,EAAE,CAAC;QAC5C,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC3C,aAAa,GAAG,KAAK,CAAC;IACxB,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;QACtB,aAAa,GAAG,GAAG,CAAC,OAAO,KAAK,cAAc,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC;IAC/E,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,CAAC;AAClG,CAAC"}

package/dist/config/secrets.d.ts

@@ -0,0 +1,28 @@
+/**
+ * writeSecrets — write secrets.env to disk with mode 0600 (Unix).
+ *
+ * Format is shell-sourceable: KEY=value lines.
+ * On Windows, chmod is a no-op (NTFS uses ACLs; warn user instead).
+ */
+export interface SecretsPayload {
+    /**
+     * 64-character hex Bearer token (32 random bytes). Optional as of SEC-10:
+     * callers omit this when the bearer was already stored in the OS
+     * credential store — secrets.env is a fallback persistence layer, not the
+     * bearer's primary home. See storage/keystore.ts storeBearer().
+     */
+    bearer?: string;
+    /** Azure OpenAI API key, if azure provider selected. */
+    azureKey?: string;
+    /** Azure endpoint URL, if azure provider selected. */
+    azureEndpoint?: string;
+    /** Azure deployment name, if azure provider selected. */
+    azureDeployment?: string;
+}
+/**
+ * Write secrets.env to `path`.
+ *
+ * Sets mode 0600 on Unix. On Windows the file is created with default ACL
+ * (current user only) — a warning is printed if stdout is TTY.
+ */
+export declare function writeSecrets(payload: SecretsPayload, path: string): void;

package/dist/config/secrets.js

@@ -0,0 +1,38 @@
+/**
+ * writeSecrets — write secrets.env to disk with mode 0600 (Unix).
+ *
+ * Format is shell-sourceable: KEY=value lines.
+ * On Windows, chmod is a no-op (NTFS uses ACLs; warn user instead).
+ */
+import { writeFileSync, chmodSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+import { platform } from 'node:os';
+/**
+ * Write secrets.env to `path`.
+ *
+ * Sets mode 0600 on Unix. On Windows the file is created with default ACL
+ * (current user only) — a warning is printed if stdout is TTY.
+ */
+export function writeSecrets(payload, path) {
+    mkdirSync(dirname(path), { recursive: true });
+    const lines = [];
+    if (payload.bearer)
+        lines.push(`MEMORY_BEARER=${payload.bearer}`);
+    if (payload.azureKey)
+        lines.push(`AZURE_OPENAI_API_KEY=${payload.azureKey}`);
+    if (payload.azureEndpoint)
+        lines.push(`AZURE_OPENAI_ENDPOINT=${payload.azureEndpoint}`);
+    if (payload.azureDeployment)
+        lines.push(`AZURE_OPENAI_DEPLOYMENT=${payload.azureDeployment}`);
+    lines.push(''); // trailing newline
+    writeFileSync(path, lines.join('\n'), { encoding: 'utf8' });
+    if (platform() !== 'win32') {
+        try {
+            chmodSync(path, 0o600);
+        }
+        catch {
+            // Rare on normal FS; ignore — caller should warn.
+        }
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/config/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/config/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAC9D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAkBnC;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAAuB,EAAE,IAAY;IAChE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE9C,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAClE,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,wBAAwB,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7E,IAAI,OAAO,CAAC,aAAa;QAAE,KAAK,CAAC,IAAI,CAAC,yBAAyB,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;IACxF,IAAI,OAAO,CAAC,eAAe;QAAE,KAAK,CAAC,IAAI,CAAC,2BAA2B,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;IAC9F,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB;IAEnC,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAE5D,IAAI,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,kDAAkD;QACpD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/config/sync-settings.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Persisted sync settings — written by `astramem-local pair`, merged into
+ * Config.sync at daemon boot (Wave 3e). Kept as a small JSON file beside
+ * config.yaml because pairing happens after init and must survive restarts;
+ * the device token itself never lands here — it lives in the OS credential
+ * store (keystore.ts storeSyncToken) or ASTRA_SYNC_TOKEN.
+ */
+export interface SyncSettings {
+    enabled: boolean;
+    url: string;
+    workspaceId: string;
+    tenantId?: string;
+}
+export declare function syncSettingsPath(configDir: string): string;
+export declare function readSyncSettings(configDir: string): SyncSettings | null;
+export declare function writeSyncSettings(configDir: string, settings: SyncSettings): void;

package/dist/config/sync-settings.js

@@ -0,0 +1,34 @@
+/**
+ * Persisted sync settings — written by `astramem-local pair`, merged into
+ * Config.sync at daemon boot (Wave 3e). Kept as a small JSON file beside
+ * config.yaml because pairing happens after init and must survive restarts;
+ * the device token itself never lands here — it lives in the OS credential
+ * store (keystore.ts storeSyncToken) or ASTRA_SYNC_TOKEN.
+ */
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+const FILE = 'sync.json';
+export function syncSettingsPath(configDir) {
+    return join(configDir, FILE);
+}
+export function readSyncSettings(configDir) {
+    try {
+        const raw = JSON.parse(readFileSync(syncSettingsPath(configDir), 'utf8'));
+        if (typeof raw.url !== 'string' || typeof raw.workspaceId !== 'string')
+            return null;
+        return {
+            enabled: raw.enabled === true,
+            url: raw.url,
+            workspaceId: raw.workspaceId,
+            ...(typeof raw.tenantId === 'string' ? { tenantId: raw.tenantId } : {}),
+        };
+    }
+    catch {
+        return null; // missing or corrupt — daemon falls back to config defaults
+    }
+}
+export function writeSyncSettings(configDir, settings) {
+    mkdirSync(configDir, { recursive: true });
+    writeFileSync(syncSettingsPath(configDir), JSON.stringify(settings, null, 2), 'utf8');
+}
+//# sourceMappingURL=sync-settings.js.map

package/dist/config/sync-settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync-settings.js","sourceRoot":"","sources":["../../src/config/sync-settings.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AASjC,MAAM,IAAI,GAAG,WAAW,CAAC;AAEzB,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,OAAO,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,SAAiB;IAChD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAA0B,CAAC;QACnG,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpF,OAAO;YACL,OAAO,EAAE,GAAG,CAAC,OAAO,KAAK,IAAI;YAC7B,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,GAAG,CAAC,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,4DAA4D;IAC3E,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,SAAiB,EAAE,QAAsB;IACzE,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,gBAAgB,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;AACxF,CAAC"}

package/dist/config/writer.d.ts

@@ -0,0 +1,19 @@
+/**
+ * writeConfig — serialise a Config object to YAML and write it to disk.
+ *
+ * No external yaml package required. The Config shape is flat enough that
+ * a purpose-built emitter is both simpler and faster to load than a full
+ * YAML library. Add the `yaml` package when Config grows nested lists.
+ */
+import type { Config } from './config.js';
+/**
+ * Serialise Config to a YAML string.
+ *
+ * The emitted YAML is intentionally hand-readable and round-trippable by
+ * `js-yaml` / `yaml` if the user installs one later.
+ */
+export declare function configToYaml(cfg: Config): string;
+/**
+ * Write config.yaml to `path`, creating parent directories as needed.
+ */
+export declare function writeConfig(cfg: Config, path: string): void;

package/dist/config/writer.js

@@ -0,0 +1,121 @@
+/**
+ * writeConfig — serialise a Config object to YAML and write it to disk.
+ *
+ * No external yaml package required. The Config shape is flat enough that
+ * a purpose-built emitter is both simpler and faster to load than a full
+ * YAML library. Add the `yaml` package when Config grows nested lists.
+ */
+import { writeFileSync, mkdirSync } from 'node:fs';
+import { dirname } from 'node:path';
+/** Emit a scalar value as a YAML-safe string (no quoting for safe values). */
+function yamlScalar(v) {
+    if (typeof v === 'boolean')
+        return v ? 'true' : 'false';
+    if (typeof v === 'number')
+        return String(v);
+    if (typeof v === 'string') {
+        // Quote strings that contain special YAML chars or are booleans/numbers.
+        if (v === '' ||
+            /[:#{}\[\],&*?|<>=!%@`]/.test(v) ||
+            /^(true|false|null|~)$/i.test(v) ||
+            /^\d/.test(v)) {
+            return `'${v.replace(/'/g, "''")}'`;
+        }
+        return v;
+    }
+    return String(v);
+}
+/** Emit one YAML line with optional indent. */
+function line(indent, key, value) {
+    const pad = '  '.repeat(indent);
+    if (value === undefined)
+        return `${pad}${key}:`;
+    return `${pad}${key}: ${yamlScalar(value)}`;
+}
+/**
+ * Serialise Config to a YAML string.
+ *
+ * The emitted YAML is intentionally hand-readable and round-trippable by
+ * `js-yaml` / `yaml` if the user installs one later.
+ */
+export function configToYaml(cfg) {
+    const lines = [
+        '# AstraMemory Local — config.yaml',
+        '# Generated by `astramem-local init`. Edit manually or re-run init.',
+        '',
+        line(0, 'port', cfg.port),
+        line(0, 'dataDir', cfg.dataDir),
+        '',
+        // FEAT-406: leave at 127.0.0.1 unless you intend remote /health scraping.
+        // Any other value requires Bearer auth on /health + /version too — see
+        // docs/security/remote-health-threat-model.md before changing this.
+        line(0, 'network'),
+        line(1, 'host', cfg.network.host),
+        '',
+        line(0, 'llm'),
+        line(1, 'compaction'),
+        line(2, 'provider', cfg.llm.compaction.provider),
+        line(2, 'model', cfg.llm.compaction.model),
+        line(1, 'extraction'),
+        line(2, 'provider', cfg.llm.extraction.provider),
+        line(2, 'model', cfg.llm.extraction.model),
+        '',
+        line(0, 'embedding'),
+        line(1, 'provider', cfg.embedding.provider),
+        line(1, 'model', cfg.embedding.model),
+        line(1, 'dim', cfg.embedding.dim),
+        '',
+        line(0, 'vector'),
+        line(1, 'store', cfg.vector.store),
+        '',
+        line(0, 'budget'),
+        line(1, 'daily_usd', cfg.budget.daily_usd),
+        '',
+        line(0, 'ollama'),
+        line(1, 'baseUrl', cfg.ollama.baseUrl),
+        '',
+        line(0, 'azure'),
+        line(1, 'apiVersion', cfg.azure.apiVersion),
+        ...(cfg.azure.endpoint ? [line(1, 'endpoint', cfg.azure.endpoint)] : []),
+        ...(cfg.azure.deployment ? [line(1, 'deployment', cfg.azure.deployment)] : []),
+        '',
+        line(0, 'search'),
+        line(1, 'alpha', cfg.search.alpha),
+        line(1, 'beta', cfg.search.beta),
+        line(1, 'gamma', cfg.search.gamma),
+        line(1, 'delta', cfg.search.delta),
+        line(1, 'epsilon', cfg.search.epsilon),
+        line(1, 'zeta', cfg.search.zeta),
+        '',
+        line(0, 'recallPack'),
+        line(1, 'enabled', cfg.recallPack.enabled),
+        line(1, 'budgetTokens', cfg.recallPack.budgetTokens),
+        line(1, 'policy'),
+        line(2, 'enabled', cfg.recallPack.policy.enabled),
+        line(2, 'minScore', cfg.recallPack.policy.minScore),
+        line(2, 'minPromptChars', cfg.recallPack.policy.minPromptChars),
+        '',
+        // sync is deliberately NOT emitted here — `astramem-local pair` owns it
+        // via sync.json (single source of truth, merged at serve boot).
+        line(0, 'security'),
+        line(1, 'redaction'),
+        line(2, 'enabled', cfg.security.redaction.enabled),
+        line(2, 'entropyThreshold', cfg.security.redaction.entropyThreshold),
+        line(1, 'encryption'),
+        line(2, 'enabled', cfg.security.encryption.enabled),
+        '',
+        line(0, 'tagHygiene'),
+        line(1, 'tier2Enabled', cfg.tagHygiene.tier2Enabled),
+        line(1, 'tier2ConfidenceThreshold', cfg.tagHygiene.tier2ConfidenceThreshold),
+        '',
+    ];
+    return lines.join('\n');
+}
+/**
+ * Write config.yaml to `path`, creating parent directories as needed.
+ */
+export function writeConfig(cfg, path) {
+    mkdirSync(dirname(path), { recursive: true });
+    writeFileSync(path, configToYaml(cfg), 'utf8');
+}
+//# sourceMappingURL=writer.js.map