@astragenie/astramemory-local 0.7.2

package/dist/storage/db.js

@@ -0,0 +1,92 @@
+import { existsSync, statSync } from 'node:fs';
+import Database from 'better-sqlite3-multiple-ciphers';
+import * as sqliteVec from 'sqlite-vec';
+/**
+ * Thrown by `openDb` when the file on disk cannot be trusted as an intact
+ * datadir (FEAT-420 AC-3), and NO encryption key was in play. Distinct from
+ * a raw `SqliteError` so callers and operators get an actionable message
+ * instead of a low-level driver string.
+ */
+export class CorruptDatadirError extends Error {
+    constructor(path, reason) {
+        super(`Refusing to open ${path}: ${reason}. This looks like a corrupted or truncated ` +
+            `SQLite datadir, not a fresh install — a fresh install never pre-creates this file. ` +
+            `Restore from a backup ('astramem-local restore') or, if you are certain there is no ` +
+            `data to lose, delete the file (and any -wal/-shm siblings) and restart to create a fresh one.`);
+        this.name = 'CorruptDatadirError';
+    }
+}
+/**
+ * Thrown by `openDb` when a key WAS supplied but the file could not be read
+ * with it (FEAT-420 AC-3 review fix). SQLCipher cannot distinguish
+ * "wrong/missing key" from "corrupted file" at the driver level — both
+ * surface as the exact same `SqliteError: file is not a database`
+ * (SQLITE_NOTADB), which is also the documented stale-v0.3.4-global-install
+ * symptom (CLAUDE.md "Do NOT use bare astramem-local"). Reusing
+ * CorruptDatadirError's corruption-and-delete advice here would actively
+ * steer an operator with a recoverable key/config problem toward destroying
+ * a healthy encrypted database — so this is a distinct class with distinct,
+ * non-destructive advice and NO deletion suggestion.
+ */
+export class EncryptionKeyError extends Error {
+    constructor(path, reason) {
+        super(`Refusing to open ${path}: ${reason}. A key was supplied but could not decrypt this file — ` +
+            `this is the classic wrong-or-missing-encryption-key symptom, not necessarily corruption ` +
+            `(SQLCipher cannot tell the two apart at this layer). Before assuming data loss, check: ` +
+            `(1) the key material in secrets.env matches what encrypted this file; ` +
+            `(2) you are running the repo build ('node dist/cli/index.js ...'), not a stale globally-` +
+            `installed 'astramem-local' shadowing it with a different cipher driver; ` +
+            `(3) the key hasn't rotated without re-encrypting this file. Leave this file untouched until ` +
+            `one of those is resolved — it may still hold your data intact.`);
+        this.name = 'EncryptionKeyError';
+    }
+}
+export function openDb(path, opts = {}) {
+    // FEAT-420 AC-3: a pre-existing but EMPTY (0-byte) file is silently
+    // accepted by SQLite as a brand-new database — better-sqlite3 just
+    // initializes it, and migrate() then happily builds a pristine empty
+    // schema on top, masking what is actually a truncated/corrupted datadir
+    // as data loss with no error at all. A genuinely fresh install never has
+    // a pre-existing file at this path (the file doesn't exist until this
+    // call creates it), so "file exists AND is 0 bytes" is an unambiguous
+    // signal of truncation, not a legitimate first run.
+    if (path !== ':memory:' && existsSync(path) && statSync(path).size === 0) {
+        throw new CorruptDatadirError(path, 'file exists but is empty (0 bytes)');
+    }
+    try {
+        const db = new Database(path);
+        if (path !== ':memory:' && opts.key) {
+            db.pragma(`key='${opts.key.replace(/'/g, "''")}'`);
+        }
+        // Block-and-retry for up to 5s on a locked database instead of throwing
+        // SQLITE_BUSY immediately — covers concurrent writers (backup CLI's
+        // second connection, doctor probes) against the live daemon.
+        db.pragma('busy_timeout = 5000');
+        // better-sqlite3 opens the file handle lazily — "file is not a
+        // database" / "database disk image is malformed" (garbage bytes, a
+        // truncated real file) only surface on the FIRST pragma/exec that
+        // actually reads a page, not at `new Database()` itself. Everything
+        // through the vec extension load is wrapped so any of these still
+        // become the same actionable typed error as the 0-byte case above.
+        db.pragma('journal_mode = WAL');
+        db.pragma('foreign_keys = ON');
+        db.pragma('synchronous = NORMAL');
+        sqliteVec.load(db);
+        return db;
+    }
+    catch (err) {
+        const alreadyTyped = err instanceof CorruptDatadirError || err instanceof EncryptionKeyError;
+        if (path !== ':memory:' && err instanceof Error && !alreadyTyped) {
+            // A key was supplied (opts.key) -> the same raw driver error is the
+            // wrong/missing-key symptom, not necessarily corruption — see
+            // EncryptionKeyError's doc comment. Only diagnose corruption when no
+            // key was ever in play.
+            if (opts.key) {
+                throw new EncryptionKeyError(path, err.message);
+            }
+            throw new CorruptDatadirError(path, err.message);
+        }
+        throw err;
+    }
+}
+//# sourceMappingURL=db.js.map

package/dist/storage/db.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.js","sourceRoot":"","sources":["../../src/storage/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,QAAQ,MAAM,iCAAiC,CAAC;AACvD,OAAO,KAAK,SAAS,MAAM,YAAY,CAAC;AAexC;;;;;GAKG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CACH,oBAAoB,IAAI,KAAK,MAAM,6CAA6C;YAChF,qFAAqF;YACrF,sFAAsF;YACtF,+FAA+F,CAChG,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF;AAED;;;;;;;;;;;GAWG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,IAAY,EAAE,MAAc;QACtC,KAAK,CACH,oBAAoB,IAAI,KAAK,MAAM,yDAAyD;YAC5F,0FAA0F;YAC1F,yFAAyF;YACzF,wEAAwE;YACxE,0FAA0F;YAC1F,0EAA0E;YAC1E,8FAA8F;YAC9F,gEAAgE,CACjE,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,OAAmB,EAAE;IACxD,oEAAoE;IACpE,mEAAmE;IACnE,qEAAqE;IACrE,wEAAwE;IACxE,yEAAyE;IACzE,sEAAsE;IACtE,sEAAsE;IACtE,oDAAoD;IACpD,IAAI,IAAI,KAAK,UAAU,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,oCAAoC,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,EAAE,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACrD,CAAC;QACD,wEAAwE;QACxE,oEAAoE;QACpE,6DAA6D;QAC7D,EAAE,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC;QACjC,+DAA+D;QAC/D,mEAAmE;QACnE,kEAAkE;QAClE,oEAAoE;QACpE,kEAAkE;QAClE,mEAAmE;QACnE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;QAChC,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAC/B,EAAE,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC;QAClC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnB,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,YAAY,GAAG,GAAG,YAAY,mBAAmB,IAAI,GAAG,YAAY,kBAAkB,CAAC;QAC7F,IAAI,IAAI,KAAK,UAAU,IAAI,GAAG,YAAY,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;YACjE,oEAAoE;YACpE,8DAA8D;YAC9D,qEAAqE;YACrE,wBAAwB;YACxB,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;YAClD,CAAC;YACD,MAAM,IAAI,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/storage/entities.d.ts

@@ -0,0 +1,71 @@
+/**
+ * entities + memory_entities repo (FEAT-402 slice 1, migration 012).
+ *
+ * `entities.name` is UNIQUE and always stores the NORMALIZED form
+ * (src/entity/normalize.ts normalizeEntityName — AC-9's single seam), so
+ * `upsert('Postgres', 'tech')` and `upsert('postgres', 'tech')` resolve to
+ * the same row. `memory_entities` is a plain link table written by both the
+ * distill-time embed-index stage (same LLM call as atom extraction) and the
+ * `entity-backfill` CLI command for the pre-existing corpus.
+ */
+import type { DB } from './db.js';
+export interface EntityRow {
+    id: string;
+    name: string;
+    kind: string;
+}
+export interface EntityInput {
+    name: string;
+    kind: string;
+}
+export declare class EntityRepo {
+    private db;
+    constructor(db: DB);
+    /**
+     * Resolve `name` (normalized) to an entities.id, creating the row if it
+     * doesn't exist yet. `kind` is only applied on first-create — a later call
+     * with a different kind for the same normalized name does NOT overwrite
+     * it (first-writer-wins avoids kind flip-flopping across distill runs).
+     */
+    upsert(name: string, kind: string): string;
+    /** Idempotent link — INSERT OR IGNORE on the (memory_id, entity_id) PK. */
+    link(memoryId: string, entityId: string): void;
+    /**
+     * Upsert + link every entity in one call — the shape both the distill-time
+     * embed-index stage and the backfill command consume. No-op for an empty
+     * or missing list.
+     */
+    linkEntitiesForMemory(memoryId: string, entities: EntityInput[] | undefined): void;
+    /** Remove every memory_entities row for one memory (AC-3 supersede cascade). */
+    unlinkMemory(memoryId: string): void;
+    /** All entities linked to a memory — used by tests and the (slice 2) query surface. */
+    listForMemory(memoryId: string): EntityRow[];
+    /** True when `name` (normalized) already resolves to an entities row. */
+    exists(name: string): boolean;
+    /** Single entity by id — GET /entities/:id/memories 404s when this returns undefined. */
+    getById(id: string): EntityRow | undefined;
+    /**
+     * Autocomplete (FEAT-402 slice 2 AC-5, `GET /entities?q=`) — substring
+     * match on the normalized name, case/whitespace-insensitive via the same
+     * AC-9 seam every other lookup goes through. Empty/whitespace `query`
+     * returns the first `limit` entities alphabetically rather than nothing,
+     * so an empty-q autocomplete call still has sane behavior.
+     */
+    search(query: string, limit?: number): EntityRow[];
+    /**
+     * Resolve a free-form entity query (e.g. the search `entity=` filter,
+     * FEAT-402 slice 2 AC-4) to entity ids via the AC-9 normalize seam: exact
+     * match on the normalized name first, falling back to a LIKE substring
+     * match only when no exact row exists. Returns [] when nothing matches —
+     * callers MUST treat that as "no entity-linked candidates" rather than
+     * falling back to an unfiltered search.
+     */
+    resolveIds(query: string): string[];
+    /**
+     * All distinct memory ids linked to any of `entityIds` — the join behind
+     * both the search `entity=` pre-fusion intersection (AC-4) and
+     * `GET /entities/:id/memories` (AC-5). Empty input returns an empty set
+     * rather than every memory (an empty entityIds list is never "no filter").
+     */
+    memoryIdsForEntities(entityIds: string[]): Set<string>;
+}

package/dist/storage/entities.js

@@ -0,0 +1,141 @@
+/**
+ * entities + memory_entities repo (FEAT-402 slice 1, migration 012).
+ *
+ * `entities.name` is UNIQUE and always stores the NORMALIZED form
+ * (src/entity/normalize.ts normalizeEntityName — AC-9's single seam), so
+ * `upsert('Postgres', 'tech')` and `upsert('postgres', 'tech')` resolve to
+ * the same row. `memory_entities` is a plain link table written by both the
+ * distill-time embed-index stage (same LLM call as atom extraction) and the
+ * `entity-backfill` CLI command for the pre-existing corpus.
+ */
+import { randomUUID } from 'node:crypto';
+import { normalizeEntityName } from '../entity/normalize.js';
+export class EntityRepo {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    /**
+     * Resolve `name` (normalized) to an entities.id, creating the row if it
+     * doesn't exist yet. `kind` is only applied on first-create — a later call
+     * with a different kind for the same normalized name does NOT overwrite
+     * it (first-writer-wins avoids kind flip-flopping across distill runs).
+     */
+    upsert(name, kind) {
+        const normalized = normalizeEntityName(name);
+        const existing = this.db
+            .prepare('SELECT id FROM entities WHERE name = ?')
+            .get(normalized);
+        if (existing)
+            return existing.id;
+        const id = randomUUID();
+        this.db.prepare('INSERT INTO entities (id, name, kind) VALUES (?, ?, ?)').run(id, normalized, kind);
+        return id;
+    }
+    /** Idempotent link — INSERT OR IGNORE on the (memory_id, entity_id) PK. */
+    link(memoryId, entityId) {
+        this.db
+            .prepare('INSERT OR IGNORE INTO memory_entities (memory_id, entity_id) VALUES (?, ?)')
+            .run(memoryId, entityId);
+    }
+    /**
+     * Upsert + link every entity in one call — the shape both the distill-time
+     * embed-index stage and the backfill command consume. No-op for an empty
+     * or missing list.
+     */
+    linkEntitiesForMemory(memoryId, entities) {
+        if (!entities || entities.length === 0)
+            return;
+        for (const e of entities) {
+            const entityId = this.upsert(e.name, e.kind);
+            this.link(memoryId, entityId);
+        }
+    }
+    /** Remove every memory_entities row for one memory (AC-3 supersede cascade). */
+    unlinkMemory(memoryId) {
+        this.db.prepare('DELETE FROM memory_entities WHERE memory_id = ?').run(memoryId);
+    }
+    /** All entities linked to a memory — used by tests and the (slice 2) query surface. */
+    listForMemory(memoryId) {
+        return this.db
+            .prepare(`
+        SELECT e.id, e.name, e.kind
+        FROM entities e
+        JOIN memory_entities me ON me.entity_id = e.id
+        WHERE me.memory_id = ?
+        ORDER BY e.name ASC
+      `)
+            .all(memoryId);
+    }
+    /** True when `name` (normalized) already resolves to an entities row. */
+    exists(name) {
+        const normalized = normalizeEntityName(name);
+        const row = this.db.prepare('SELECT 1 AS x FROM entities WHERE name = ?').get(normalized);
+        return row !== undefined;
+    }
+    /** Single entity by id — GET /entities/:id/memories 404s when this returns undefined. */
+    getById(id) {
+        return this.db.prepare('SELECT id, name, kind FROM entities WHERE id = ?').get(id);
+    }
+    /**
+     * Autocomplete (FEAT-402 slice 2 AC-5, `GET /entities?q=`) — substring
+     * match on the normalized name, case/whitespace-insensitive via the same
+     * AC-9 seam every other lookup goes through. Empty/whitespace `query`
+     * returns the first `limit` entities alphabetically rather than nothing,
+     * so an empty-q autocomplete call still has sane behavior.
+     */
+    search(query, limit = 20) {
+        const normalized = normalizeEntityName(query);
+        if (!normalized) {
+            return this.db
+                .prepare('SELECT id, name, kind FROM entities ORDER BY name ASC LIMIT ?')
+                .all(limit);
+        }
+        const escaped = escapeLike(normalized);
+        return this.db
+            .prepare(`SELECT id, name, kind FROM entities WHERE name LIKE ? ESCAPE '\\' ORDER BY name ASC LIMIT ?`)
+            .all(`%${escaped}%`, limit);
+    }
+    /**
+     * Resolve a free-form entity query (e.g. the search `entity=` filter,
+     * FEAT-402 slice 2 AC-4) to entity ids via the AC-9 normalize seam: exact
+     * match on the normalized name first, falling back to a LIKE substring
+     * match only when no exact row exists. Returns [] when nothing matches —
+     * callers MUST treat that as "no entity-linked candidates" rather than
+     * falling back to an unfiltered search.
+     */
+    resolveIds(query) {
+        const normalized = normalizeEntityName(query);
+        if (!normalized)
+            return [];
+        const exact = this.db.prepare('SELECT id FROM entities WHERE name = ?').get(normalized);
+        if (exact)
+            return [exact.id];
+        const escaped = escapeLike(normalized);
+        const rows = this.db
+            .prepare(`SELECT id FROM entities WHERE name LIKE ? ESCAPE '\\'`)
+            .all(`%${escaped}%`);
+        return rows.map(r => r.id);
+    }
+    /**
+     * All distinct memory ids linked to any of `entityIds` — the join behind
+     * both the search `entity=` pre-fusion intersection (AC-4) and
+     * `GET /entities/:id/memories` (AC-5). Empty input returns an empty set
+     * rather than every memory (an empty entityIds list is never "no filter").
+     */
+    memoryIdsForEntities(entityIds) {
+        if (entityIds.length === 0)
+            return new Set();
+        const placeholders = entityIds.map(() => '?').join(',');
+        const rows = this.db
+            .prepare(`SELECT DISTINCT memory_id FROM memory_entities WHERE entity_id IN (${placeholders})`)
+            .all(...entityIds);
+        return new Set(rows.map(r => r.memory_id));
+    }
+}
+/** Escape SQL LIKE wildcards (`%`, `_`) in a substring pattern the caller
+ * did not intend as wildcard syntax — used with `ESCAPE '\\'` above. */
+function escapeLike(value) {
+    return value.replace(/[\\%_]/g, ch => `\\${ch}`);
+}
+//# sourceMappingURL=entities.js.map

package/dist/storage/entities.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entities.js","sourceRoot":"","sources":["../../src/storage/entities.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAa7D,MAAM,OAAO,UAAU;IACD;IAApB,YAAoB,EAAM;QAAN,OAAE,GAAF,EAAE,CAAI;IAAG,CAAC;IAE9B;;;;;OAKG;IACH,MAAM,CAAC,IAAY,EAAE,IAAY;QAC/B,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE;aACrB,OAAO,CAAC,wCAAwC,CAAC;aACjD,GAAG,CAAC,UAAU,CAA+B,CAAC;QACjD,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC,EAAE,CAAC;QAEjC,MAAM,EAAE,GAAG,UAAU,EAAE,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;QACpG,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC,QAAgB,EAAE,QAAgB;QACrC,IAAI,CAAC,EAAE;aACJ,OAAO,CAAC,4EAA4E,CAAC;aACrF,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAED;;;;OAIG;IACH,qBAAqB,CAAC,QAAgB,EAAE,QAAmC;QACzE,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7C,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,YAAY,CAAC,QAAgB;QAC3B,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnF,CAAC;IAED,uFAAuF;IACvF,aAAa,CAAC,QAAgB;QAC5B,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC;;;;;;OAMR,CAAC;aACD,GAAG,CAAC,QAAQ,CAAgB,CAAC;IAClC,CAAC;IAED,yEAAyE;IACzE,MAAM,CAAC,IAAY;QACjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,4CAA4C,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1F,OAAO,GAAG,KAAK,SAAS,CAAC;IAC3B,CAAC;IAED,yFAAyF;IACzF,OAAO,CAAC,EAAU;QAChB,OAAO,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,EAAE,CAA0B,CAAC;IAC9G,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAa,EAAE,KAAK,GAAG,EAAE;QAC9B,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,EAAE;iBACX,OAAO,CAAC,+DAA+D,CAAC;iBACxE,GAAG,CAAC,KAAK,CAAgB,CAAC;QAC/B,CAAC;QACD,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,EAAE;aACX,OAAO,CAAC,6FAA6F,CAAC;aACtG,GAAG,CAAC,IAAI,OAAO,GAAG,EAAE,KAAK,CAAgB,CAAC;IAC/C,CAAC;IAED;;;;;;;OAOG;IACH,UAAU,CAAC,KAAa;QACtB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,CAAC,UAAU;YAAE,OAAO,EAAE,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,UAAU,CAEzE,CAAC;QACd,IAAI,KAAK;YAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,OAAO,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,uDAAuD,CAAC;aAChE,GAAG,CAAC,IAAI,OAAO,GAAG,CAAqB,CAAC;QAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;;;;OAKG;IACH,oBAAoB,CAAC,SAAmB;QACtC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,GAAG,EAAE,CAAC;QAC7C,MAAM,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACxD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CAAC,sEAAsE,YAAY,GAAG,CAAC;aAC9F,GAAG,CAAC,GAAG,SAAS,CAA4B,CAAC;QAChD,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,CAAC;CACF;AAED;wEACwE;AACxE,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC"}

package/dist/storage/ingest-idempotency.d.ts

@@ -0,0 +1,26 @@
+/**
+ * D-DEF2 fix — `summary_memory_id` backfill.
+ *
+ * `POST /ingest/transcript` (server/routes/ingest.ts) writes the transcript
+ * row's own id into `ingest_idempotency.summary_memory_id` at insert time —
+ * distillation is async (queued as a `distill` job), so there is no real
+ * memory id yet when the HTTP response is built. That placeholder value was
+ * never updated afterwards, so idempotent replays kept returning the
+ * transcript id forever, even after distillation produced real memories
+ * (CHANGELOG 0.2.0 "Known issues" — D-DEF2: "Wave-3 distillation will
+ * produce a real summary memory... semantic meaning will change when
+ * distillation is wired end-to-end").
+ *
+ * This backfills the row once the distill job actually produces a memory.
+ * No schema change: `summary_memory_id` already accepts an arbitrary TEXT
+ * id (it has never had a FK constraint tying it to `transcripts.id`), so
+ * repointing it at a `memories.id` is a value change, not a shape change.
+ */
+import type { DB } from './db.js';
+/**
+ * Repoint any `ingest_idempotency` row still holding `transcriptId` as its
+ * placeholder `summary_memory_id` to the real `memoryId` produced by
+ * distillation. No-op if no such row exists (e.g. the original POST carried
+ * no `Idempotency-Key`, so no row was ever created).
+ */
+export declare function backfillSummaryMemoryId(db: DB, transcriptId: string, memoryId: string): void;

package/dist/storage/ingest-idempotency.js

@@ -0,0 +1,29 @@
+/**
+ * D-DEF2 fix — `summary_memory_id` backfill.
+ *
+ * `POST /ingest/transcript` (server/routes/ingest.ts) writes the transcript
+ * row's own id into `ingest_idempotency.summary_memory_id` at insert time —
+ * distillation is async (queued as a `distill` job), so there is no real
+ * memory id yet when the HTTP response is built. That placeholder value was
+ * never updated afterwards, so idempotent replays kept returning the
+ * transcript id forever, even after distillation produced real memories
+ * (CHANGELOG 0.2.0 "Known issues" — D-DEF2: "Wave-3 distillation will
+ * produce a real summary memory... semantic meaning will change when
+ * distillation is wired end-to-end").
+ *
+ * This backfills the row once the distill job actually produces a memory.
+ * No schema change: `summary_memory_id` already accepts an arbitrary TEXT
+ * id (it has never had a FK constraint tying it to `transcripts.id`), so
+ * repointing it at a `memories.id` is a value change, not a shape change.
+ */
+/**
+ * Repoint any `ingest_idempotency` row still holding `transcriptId` as its
+ * placeholder `summary_memory_id` to the real `memoryId` produced by
+ * distillation. No-op if no such row exists (e.g. the original POST carried
+ * no `Idempotency-Key`, so no row was ever created).
+ */
+export function backfillSummaryMemoryId(db, transcriptId, memoryId) {
+    db.prepare('UPDATE ingest_idempotency SET summary_memory_id = ? WHERE summary_memory_id = ?')
+        .run(memoryId, transcriptId);
+}
+//# sourceMappingURL=ingest-idempotency.js.map

package/dist/storage/ingest-idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ingest-idempotency.js","sourceRoot":"","sources":["../../src/storage/ingest-idempotency.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAIH;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,EAAM,EAAE,YAAoB,EAAE,QAAgB;IACpF,EAAE,CAAC,OAAO,CAAC,iFAAiF,CAAC;SAC1F,GAAG,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;AACjC,CAAC"}

package/dist/storage/keystore.d.ts

@@ -0,0 +1,64 @@
+/**
+ * keystore.ts — encryption-at-rest key management (SEC-1/2, Wave 1 task 1b).
+ *
+ * Provider chain (per spec §4.1 / OQ-1):
+ *   (a) OS credential store — Windows Credential Manager / macOS Keychain /
+ *       Linux libsecret, via `@napi-rs/keyring` (prebuilt N-API binding,
+ *       verified to install cleanly with prebuilds for win32-x64-msvc,
+ *       darwin-x64/arm64, and linux-x64-gnu — the repo's 3 CI targets).
+ *   (b) key-file fallback (`<configDir>/db.key`, mode 0600) with a WARN log —
+ *       used when the credential store throws (e.g. headless Linux with no
+ *       secret-service/dbus session). Spec OQ-1 explicitly allows this
+ *       fallback for v0.4.
+ *
+ * Key lookup identity is fixed: service `'astramem-local'`, account `'db-key'`.
+ * The key is a 32-byte cryptographically random value, hex-encoded (64 chars),
+ * used as the SQLCipher passphrase via `PRAGMA key='<hex>'` — the exact
+ * PRAGMA form validated end-to-end (open/reopen/wrong-key) by the 1a spike
+ * (tests/security/cipher-spike.test.ts).
+ *
+ * getOrCreateKey() is idempotent: a second call against the same configDir
+ * (and, for the credential-store path, the same machine/user) returns the
+ * same key rather than minting a new one.
+ */
+import { Entry } from '@napi-rs/keyring';
+export type KeySource = 'credential-store' | 'key-file';
+export interface KeyResult {
+    key: string;
+    source: KeySource;
+}
+/** Test-only hook: override (or restore) the credential-store Entry constructor. */
+export declare function __setEntryCtorForTests(ctor: typeof Entry | undefined): void;
+/**
+ * Returns the encryption key for this machine/user, creating one on first
+ * use. Tries the OS credential store first; falls back to a 0600 key file
+ * under `configDir` (with a WARN log) when the credential store throws.
+ *
+ * NOTE: deviates slightly from the originally-sketched `(configDir) => string`
+ * signature — returns `{ key, source }` instead of a bare string so callers
+ * (doctor, /health) can report key location (SEC-8/AC-5) without a second,
+ * duplicate resolution pass. `.key` is what openDb()/migrate-encrypt need.
+ */
+export declare function getOrCreateKey(configDir: string): KeyResult;
+export declare function keyFilePath(configDir: string): string;
+export interface BearerStoreResult {
+    stored: boolean;
+    source: 'credential-store' | 'secrets-env-fallback';
+}
+/**
+ * Store `token` in the OS credential store. On failure (no credential store
+ * / no secret-service session), WARNs and returns a fallback marker so the
+ * caller persists the bearer into secrets.env instead (SEC-10).
+ */
+export declare function storeBearer(token: string): BearerStoreResult;
+/**
+ * Read the bearer token from the OS credential store, if present.
+ * Returns null on any error (store unavailable, or no entry yet) — same
+ * "throw and getPassword()->null are both just 'no key yet'" tolerance as
+ * getOrCreateCredentialStoreKey above. Callers fall back to secrets.env.
+ */
+export declare function readBearer(): string | null;
+/** Store the cloud sync device token (ADR-003 auth) in the credential store. */
+export declare function storeSyncToken(token: string): BearerStoreResult;
+/** Read the cloud sync device token; null when absent/unavailable. */
+export declare function readSyncToken(): string | null;

package/dist/storage/keystore.js

@@ -0,0 +1,194 @@
+/**
+ * keystore.ts — encryption-at-rest key management (SEC-1/2, Wave 1 task 1b).
+ *
+ * Provider chain (per spec §4.1 / OQ-1):
+ *   (a) OS credential store — Windows Credential Manager / macOS Keychain /
+ *       Linux libsecret, via `@napi-rs/keyring` (prebuilt N-API binding,
+ *       verified to install cleanly with prebuilds for win32-x64-msvc,
+ *       darwin-x64/arm64, and linux-x64-gnu — the repo's 3 CI targets).
+ *   (b) key-file fallback (`<configDir>/db.key`, mode 0600) with a WARN log —
+ *       used when the credential store throws (e.g. headless Linux with no
+ *       secret-service/dbus session). Spec OQ-1 explicitly allows this
+ *       fallback for v0.4.
+ *
+ * Key lookup identity is fixed: service `'astramem-local'`, account `'db-key'`.
+ * The key is a 32-byte cryptographically random value, hex-encoded (64 chars),
+ * used as the SQLCipher passphrase via `PRAGMA key='<hex>'` — the exact
+ * PRAGMA form validated end-to-end (open/reopen/wrong-key) by the 1a spike
+ * (tests/security/cipher-spike.test.ts).
+ *
+ * getOrCreateKey() is idempotent: a second call against the same configDir
+ * (and, for the credential-store path, the same machine/user) returns the
+ * same key rather than minting a new one.
+ */
+import { Entry } from '@napi-rs/keyring';
+import { randomBytes } from 'node:crypto';
+import { existsSync, readFileSync, writeFileSync, chmodSync, mkdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { execFileSync } from 'node:child_process';
+const SERVICE = 'astramem-local';
+const ACCOUNT = 'db-key';
+const BEARER_ACCOUNT = 'bearer';
+// Test-only indirection so tests can simulate a credential-store outage
+// (e.g. headless-Linux fallback) without needing an actual broken OS
+// keychain, and so keystore tests don't have to mutate the developer's
+// real OS credential store as a side effect of `npm test`.
+let EntryCtor = Entry;
+/** Test-only hook: override (or restore) the credential-store Entry constructor. */
+export function __setEntryCtorForTests(ctor) {
+    EntryCtor = ctor ?? Entry;
+}
+/**
+ * Returns the encryption key for this machine/user, creating one on first
+ * use. Tries the OS credential store first; falls back to a 0600 key file
+ * under `configDir` (with a WARN log) when the credential store throws.
+ *
+ * NOTE: deviates slightly from the originally-sketched `(configDir) => string`
+ * signature — returns `{ key, source }` instead of a bare string so callers
+ * (doctor, /health) can report key location (SEC-8/AC-5) without a second,
+ * duplicate resolution pass. `.key` is what openDb()/migrate-encrypt need.
+ */
+export function getOrCreateKey(configDir) {
+    try {
+        return getOrCreateCredentialStoreKey();
+    }
+    catch (err) {
+        console.warn(`[astramem-local] WARNING: OS credential store unavailable (${errMessage(err)}); ` +
+            `falling back to a key file with 0600 permissions. This is a weaker guarantee than ` +
+            `an OS credential store — see docs/specs/2026-07-02-encryption-and-secret-redaction.md OQ-1.`);
+        return getOrCreateKeyFile(configDir);
+    }
+}
+function errMessage(err) {
+    return err instanceof Error ? err.message : String(err);
+}
+function generateKeyHex() {
+    return randomBytes(32).toString('hex');
+}
+// ─── Provider (a): OS credential store ────────────────────────────────────
+function getOrCreateCredentialStoreKey() {
+    const entry = new EntryCtor(SERVICE, ACCOUNT);
+    // getPassword() returns null when absent on some platforms but throws a
+    // NoEntry error on others (per @napi-rs/keyring docs) — treat both as
+    // "no key yet", not as "credential store broken". Only the constructor
+    // and setPassword() throwing should trigger the key-file fallback.
+    let existing;
+    try {
+        existing = entry.getPassword();
+    }
+    catch {
+        existing = null;
+    }
+    if (existing) {
+        return { key: existing, source: 'credential-store' };
+    }
+    const key = generateKeyHex();
+    entry.setPassword(key);
+    return { key, source: 'credential-store' };
+}
+// ─── Provider (b): key-file fallback ──────────────────────────────────────
+function getOrCreateKeyFile(configDir) {
+    mkdirSync(configDir, { recursive: true });
+    const keyPath = join(configDir, 'db.key');
+    if (existsSync(keyPath)) {
+        const key = readFileSync(keyPath, 'utf8').trim();
+        restrictKeyFileAcl(keyPath); // heal ACLs on files created by older builds
+        return { key, source: 'key-file' };
+    }
+    const key = generateKeyHex();
+    writeFileSync(keyPath, key, { mode: 0o600 });
+    try {
+        // Belt-and-braces: writeFileSync's mode option is honored on creation on
+        // POSIX; chmodSync is a no-op on Windows (no POSIX bits) — Windows gets a
+        // real ACL below via icacls instead.
+        chmodSync(keyPath, 0o600);
+    }
+    catch {
+        /* best-effort on platforms without POSIX permission bits */
+    }
+    restrictKeyFileAcl(keyPath);
+    return { key, source: 'key-file' };
+}
+/**
+ * Windows: apply a real ACL to the key file — strip inheritance, grant only
+ * the current user. Without this, chmod is a no-op and the DB encryption key
+ * sits world-readable next to the database it protects (SEC OQ-1).
+ * Best-effort but LOUD on failure: a key file without an ACL is a real
+ * security downgrade the user must know about.
+ */
+function restrictKeyFileAcl(keyPath) {
+    if (process.platform !== 'win32')
+        return;
+    const user = process.env['USERNAME'];
+    if (!user)
+        return;
+    try {
+        execFileSync('icacls', [keyPath, '/inheritance:r', '/grant:r', `${user}:F`], { stdio: 'pipe', timeout: 10_000 });
+    }
+    catch (err) {
+        console.warn(`[astramem-local] WARNING: could not restrict ACL on key file ${keyPath} ` +
+            `(icacls failed: ${errMessage(err)}). The DB encryption key is readable by other ` +
+            `local accounts — fix manually: icacls "${keyPath}" /inheritance:r /grant:r ${user}:F`);
+    }
+}
+export function keyFilePath(configDir) {
+    return join(configDir, 'db.key');
+}
+/**
+ * Store `token` in the OS credential store. On failure (no credential store
+ * / no secret-service session), WARNs and returns a fallback marker so the
+ * caller persists the bearer into secrets.env instead (SEC-10).
+ */
+export function storeBearer(token) {
+    try {
+        const entry = new EntryCtor(SERVICE, BEARER_ACCOUNT);
+        entry.setPassword(token);
+        return { stored: true, source: 'credential-store' };
+    }
+    catch (err) {
+        console.warn(`[astramem-local] WARNING: OS credential store unavailable (${errMessage(err)}); ` +
+            `falling back to writing the bearer token into secrets.env. This is a weaker guarantee ` +
+            `than an OS credential store — see docs/specs/2026-07-02-encryption-and-secret-redaction.md SEC-10.`);
+        return { stored: false, source: 'secrets-env-fallback' };
+    }
+}
+/**
+ * Read the bearer token from the OS credential store, if present.
+ * Returns null on any error (store unavailable, or no entry yet) — same
+ * "throw and getPassword()->null are both just 'no key yet'" tolerance as
+ * getOrCreateCredentialStoreKey above. Callers fall back to secrets.env.
+ */
+export function readBearer() {
+    try {
+        const entry = new EntryCtor(SERVICE, BEARER_ACCOUNT);
+        return entry.getPassword();
+    }
+    catch {
+        return null;
+    }
+}
+const SYNC_TOKEN_ACCOUNT = 'sync-device-token';
+/** Store the cloud sync device token (ADR-003 auth) in the credential store. */
+export function storeSyncToken(token) {
+    try {
+        const entry = new EntryCtor(SERVICE, SYNC_TOKEN_ACCOUNT);
+        entry.setPassword(token);
+        return { stored: true, source: 'credential-store' };
+    }
+    catch (err) {
+        console.warn(`[astramem-local] WARNING: OS credential store unavailable (${errMessage(err)}); ` +
+            `sync device token was NOT stored. Set ASTRA_SYNC_TOKEN in the environment instead.`);
+        return { stored: false, source: 'secrets-env-fallback' };
+    }
+}
+/** Read the cloud sync device token; null when absent/unavailable. */
+export function readSyncToken() {
+    try {
+        const entry = new EntryCtor(SERVICE, SYNC_TOKEN_ACCOUNT);
+        return entry.getPassword();
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=keystore.js.map

package/dist/storage/keystore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"keystore.js","sourceRoot":"","sources":["../../src/storage/keystore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAElD,MAAM,OAAO,GAAG,gBAAgB,CAAC;AACjC,MAAM,OAAO,GAAG,QAAQ,CAAC;AACzB,MAAM,cAAc,GAAG,QAAQ,CAAC;AAShC,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,2DAA2D;AAC3D,IAAI,SAAS,GAAiB,KAAK,CAAC;AAEpC,oFAAoF;AACpF,MAAM,UAAU,sBAAsB,CAAC,IAA8B;IACnE,SAAS,GAAG,IAAI,IAAI,KAAK,CAAC;AAC5B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB;IAC9C,IAAI,CAAC;QACH,OAAO,6BAA6B,EAAE,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8DAA8D,UAAU,CAAC,GAAG,CAAC,KAAK;YAClF,oFAAoF;YACpF,6FAA6F,CAC9F,CAAC;QACF,OAAO,kBAAkB,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC9B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,cAAc;IACrB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,6EAA6E;AAE7E,SAAS,6BAA6B;IACpC,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAE9C,wEAAwE;IACxE,sEAAsE;IACtE,uEAAuE;IACvE,mEAAmE;IACnE,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;AAC7C,CAAC;AAED,6EAA6E;AAE7E,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAE1C,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,6CAA6C;QAC1E,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACrC,CAAC;IAED,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC;QACH,yEAAyE;QACzE,0EAA0E;QAC1E,qCAAqC;QACrC,SAAS,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,4DAA4D;IAC9D,CAAC;IACD,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAE5B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO;IACzC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,CAAC,IAAI;QAAE,OAAO;IAClB,IAAI,CAAC;QACH,YAAY,CACV,QAAQ,EACR,CAAC,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI,CAAC,EACpD,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CACnC,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,gEAAgE,OAAO,GAAG;YAC1E,mBAAmB,UAAU,CAAC,GAAG,CAAC,gDAAgD;YAClF,0CAA0C,OAAO,6BAA6B,IAAI,IAAI,CACvF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAiB;IAC3C,OAAO,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AAiBD;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACrD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8DAA8D,UAAU,CAAC,GAAG,CAAC,KAAK;YAClF,wFAAwF;YACxF,oGAAoG,CACrG,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU;IACxB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACrD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAE/C,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACzD,KAAK,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,IAAI,CACV,8DAA8D,UAAU,CAAC,GAAG,CAAC,KAAK;YAClF,oFAAoF,CACrF,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAC3D,CAAC;AACH,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,aAAa;IAC3B,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,SAAS,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QACzD,OAAO,KAAK,CAAC,WAAW,EAAE,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}