@astragenie/astramemory-local 0.7.2

package/dist/log/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../../src/log/logger.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,MAAM,CAAC;AAEjD;;;;GAIG;AACH,MAAM,WAAW,GAAa;IAC5B,eAAe;IACf,SAAS;IACT,QAAQ;IACR,OAAO;IACP,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,eAAe;IACf,eAAe;IACf,iCAAiC;IACjC,2BAA2B;IAC3B,uBAAuB;IACvB,iBAAiB;IACjB,oBAAoB;CACrB,CAAC;AAEF;;;GAGG;AACH,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,OAAO;YACL,aAAa,EAAE,GAAG,CAAC,OAAO;YAC1B,UAAU,EAAE,GAAG,CAAC,IAAI,IAAI,OAAO;SAChC,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;AAC/D,CAAC;AAED,IAAI,SAAkD,CAAC;AAEvD,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,kDAAkD;AAClD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;AAC5C,IAAI,MAAM,EAAE,CAAC;IACX,SAAS,GAAG;QACV,MAAM,EAAE,WAAW;QACnB,OAAO,EAAE;YACP,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa;YACnD,IAAI,EAAE,KAAK;YACX,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;YACnB,KAAK,EAAE,IAAI;SACZ;KACF,CAAC;AACJ,CAAC;KAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,KAAK,GAAG,EAAE,CAAC;IAC7C,2EAA2E;IAC3E,IAAI,CAAC;QACH,SAAS,GAAG;YACV,MAAM,EAAE,aAAa;YACrB,OAAO,EAAE;gBACP,QAAQ,EAAE,IAAI;gBACd,aAAa,EAAE,cAAc;gBAC7B,MAAM,EAAE,cAAc;aACvB;SACF,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;IAClD,CAAC;AACH,CAAC;AAED,MAAM,QAAQ,GAAuB;IACnC,KAAK;IACL,MAAM,EAAE;QACN,KAAK,EAAE,WAAW;QAClB,MAAM,EAAE,YAAY;KACrB;IACD,WAAW,EAAE;QACX,GAAG,EAAE,cAAc;QACnB,KAAK,EAAE,cAAc;KACtB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB,SAAS;IAC1C,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AAEnB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,QAAiC;IAC3D,iEAAiE;IACjE,MAAM,IAAI,GAA4B,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAClD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC"}

package/dist/log/scrub.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Secret scrubber — redacts sensitive fields and strings before they reach log output.
+ *
+ * Apply to:
+ *   - Log line objects   : scrubObj(obj)
+ *   - Error message strings: scrubString(str)
+ *
+ * Redact patterns (case-insensitive):
+ *   - Bearer tokens:  Bearer\s+\S+  →  Bearer [REDACTED]
+ *   - Key fields matching /api[_-]?key/i, /token/i, /bearer/i, /password/i, /secret/i  → '[REDACTED]'
+ *   - Transcript content in error contexts: truncate to first 200 chars
+ */
+/**
+ * Returns true if this object key name matches any sensitive-field pattern.
+ */
+export declare function isSensitiveKey(key: string): boolean;
+/**
+ * Redact Bearer tokens and other sensitive patterns inside a plain string.
+ * Does NOT mutate; returns a new string.
+ */
+export declare function scrubString(value: string): string;
+/**
+ * Truncate a transcript string to TRANSCRIPT_TRUNCATE chars for error contexts.
+ */
+export declare function truncateTranscript(value: string): string;
+/**
+ * Deep-clone a log record, redacting sensitive fields.
+ * - String values for sensitive keys → '[REDACTED]'
+ * - String values for any key → Bearer tokens scrubbed
+ * - Nested objects are recursed
+ * - Non-object types are returned as-is
+ */
+export declare function scrubObj(obj: unknown): unknown;

package/dist/log/scrub.js

@@ -0,0 +1,91 @@
+/**
+ * Secret scrubber — redacts sensitive fields and strings before they reach log output.
+ *
+ * Apply to:
+ *   - Log line objects   : scrubObj(obj)
+ *   - Error message strings: scrubString(str)
+ *
+ * Redact patterns (case-insensitive):
+ *   - Bearer tokens:  Bearer\s+\S+  →  Bearer [REDACTED]
+ *   - Key fields matching /api[_-]?key/i, /token/i, /bearer/i, /password/i, /secret/i  → '[REDACTED]'
+ *   - Transcript content in error contexts: truncate to first 200 chars
+ */
+/**
+ * Regex that matches a Bearer token value in a string.
+ * Group 1 captures the keyword (preserving original case).
+ * Token characters: alphanumeric, ., -, _, +, /, = (covers base64, hex, JWT segments).
+ * Does NOT consume trailing punctuation (commas, semicolons, quotes).
+ */
+const BEARER_PATTERN = /(Bearer)\s+[A-Za-z0-9._\-+/=]+/gi;
+/**
+ * Field-name patterns whose string values should be fully redacted.
+ * Checked against the JSON key (case-insensitive).
+ */
+const SENSITIVE_KEY_PATTERNS = [
+    /api[_-]?key/i,
+    /token/i,
+    /bearer/i,
+    /password/i,
+    /secret/i,
+    /authorization/i,
+];
+/** Maximum length of transcript content in error strings before truncation. */
+const TRANSCRIPT_TRUNCATE = 200;
+/**
+ * Returns true if this object key name matches any sensitive-field pattern.
+ */
+export function isSensitiveKey(key) {
+    return SENSITIVE_KEY_PATTERNS.some(p => p.test(key));
+}
+/**
+ * Redact Bearer tokens and other sensitive patterns inside a plain string.
+ * Does NOT mutate; returns a new string.
+ */
+export function scrubString(value) {
+    // $1 preserves the original case of the keyword (e.g. "bearer", "BEARER", "Bearer")
+    return value.replace(BEARER_PATTERN, '$1 [REDACTED]');
+}
+/**
+ * Truncate a transcript string to TRANSCRIPT_TRUNCATE chars for error contexts.
+ */
+export function truncateTranscript(value) {
+    if (value.length <= TRANSCRIPT_TRUNCATE)
+        return value;
+    const remaining = value.length - TRANSCRIPT_TRUNCATE;
+    return `${value.slice(0, TRANSCRIPT_TRUNCATE)}... [${remaining} more chars]`;
+}
+/**
+ * Deep-clone a log record, redacting sensitive fields.
+ * - String values for sensitive keys → '[REDACTED]'
+ * - String values for any key → Bearer tokens scrubbed
+ * - Nested objects are recursed
+ * - Non-object types are returned as-is
+ */
+export function scrubObj(obj) {
+    if (obj === null || obj === undefined)
+        return obj;
+    if (Array.isArray(obj)) {
+        return obj.map(item => scrubObj(item));
+    }
+    if (typeof obj === 'object') {
+        const result = {};
+        for (const [key, val] of Object.entries(obj)) {
+            if (isSensitiveKey(key)) {
+                // Redact the value entirely regardless of type
+                result[key] = '[REDACTED]';
+            }
+            else if (typeof val === 'string') {
+                result[key] = scrubString(val);
+            }
+            else {
+                result[key] = scrubObj(val);
+            }
+        }
+        return result;
+    }
+    if (typeof obj === 'string') {
+        return scrubString(obj);
+    }
+    return obj;
+}
+//# sourceMappingURL=scrub.js.map

package/dist/log/scrub.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scrub.js","sourceRoot":"","sources":["../../src/log/scrub.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH;;;;;GAKG;AACH,MAAM,cAAc,GAAG,kCAAkC,CAAC;AAE1D;;;GAGG;AACH,MAAM,sBAAsB,GAAa;IACvC,cAAc;IACd,QAAQ;IACR,SAAS;IACT,WAAW;IACX,SAAS;IACT,gBAAgB;CACjB,CAAC;AAEF,+EAA+E;AAC/E,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC;;GAEG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,oFAAoF;IACpF,OAAO,KAAK,CAAC,OAAO,CAAC,cAAc,EAAE,eAAe,CAAC,CAAC;AACxD,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,KAAK,CAAC,MAAM,IAAI,mBAAmB;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,GAAG,mBAAmB,CAAC;IACrD,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,QAAQ,SAAS,cAAc,CAAC;AAC/E,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,GAAY;IACnC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IAElD,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAA8B,CAAC,EAAE,CAAC;YACxE,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;gBACxB,+CAA+C;gBAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,YAAY,CAAC;YAC7B,CAAC;iBAAM,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACnC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/mcp/server.d.ts

@@ -0,0 +1,36 @@
+/**
+ * MCP server instance for astramemory-local.
+ *
+ * Exposes 15 tools over the Streamable HTTP transport (POST /mcp):
+ *   - search_memory      — hybrid FTS + vector search
+ *   - recall_memory      — top-K semantic recall (alias of search with k default 5)
+ *   - remember           — direct memory insert
+ *   - get_health         — daemon health probe
+ *   - why_memory         — provenance receipt (evidence, session, transcript ref)
+ *   - session_digest     — per-session "what I learned" summary (derived at read time)
+ *   - invalidate_memory  — lifecycle: mark a memory invalid (ADR-002 memory_events log)
+ *   - supersede_memory   — lifecycle: replace one memory with another
+ *   - promote_memory     — lifecycle: upward-only scope promotion (ADR-009)
+ *   - restore_memory     — lifecycle: un-archive a memory archived by the W4.4 TTL policy (FEAT-416)
+ *   - memory_history     — lifecycle: full event log for a memory (supersession chain)
+ *   - mark_memory_used   — ADR-010 explicit recall-used signal for a served memory
+ *   - erase_memory       — erasure v1 (ADR-006): hard-delete + tombstone
+ *   - list_consolidation_proposals / resolve_consolidation_proposal — stage-9 propose-only queue (ADR-004)
+ *
+ * No HTTP self-calls: all tools call the internal service layer directly.
+ * Auth is enforced at the Fastify route level via the existing preHandler.
+ */
+import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+import type { DB } from '../storage/db.js';
+import type { EmbedProvider } from '../contracts/index.js';
+import { type Config } from '../config/config.js';
+export interface McpServerDeps {
+    db: DB;
+    embed: EmbedProvider;
+    config?: Config;
+}
+/**
+ * Build and return a configured McpServer instance.
+ * Caller is responsible for connecting it to a transport.
+ */
+export declare function buildMcpServer(deps: McpServerDeps): McpServer;