@batalabs/virlow-mcp-core 3.18.0 → 3.68.0

package/dist/http/index.d.ts

@@ -0,0 +1,4 @@
+export { bearerFrom, defaultTokenPath, loadOrCreateToken, startHttpServer, tokenMatches, } from './server.js';
+export type { HttpServerOptions, RunningHttpServer } from './server.js';
+export { SECURITY_HEADERS, isAllowedOrigin, isLoopbackHost, rejectReason } from './local-origin.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/http/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/http/index.js

@@ -0,0 +1,3 @@
+export { bearerFrom, defaultTokenPath, loadOrCreateToken, startHttpServer, tokenMatches, } from './server.js';
+export { SECURITY_HEADERS, isAllowedOrigin, isLoopbackHost, rejectReason } from './local-origin.js';
+//# sourceMappingURL=index.js.map

package/dist/http/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/http/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,UAAU,EACV,gBAAgB,EAChB,iBAAiB,EACjB,eAAe,EACf,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/http/local-origin.d.ts

@@ -0,0 +1,61 @@
+/**
+ * DNS-rebinding defence for the two HTTP listeners this process runs.
+ *
+ * Both are bound to loopback and both sit in front of something worth taking:
+ * the unlock form accepts the master password, and the --http transport serves
+ * decrypted notes. Loopback is not the boundary people assume it is. A page in
+ * the user's browser can be made to send requests to 127.0.0.1 — the attacker
+ * points a hostname they control at their own server, the browser caches that,
+ * then the DNS record flips to 127.0.0.1 and the browser treats
+ * http://evil.example:PORT as same-origin with the attacker's page. Same-origin
+ * means no CORS, so the response is readable.
+ *
+ * The tell is the Host header: a rebound request carries the attacker's
+ * hostname, never `127.0.0.1` or `localhost`, because that is what the browser
+ * was asked to fetch. Requiring a loopback Host closes it, and the MCP
+ * specification asks local Streamable HTTP servers to do exactly this.
+ *
+ * Enforced only when the server is actually bound to loopback. `--http --host`
+ * is a deliberate act by an operator who was warned, and the documented way to
+ * reach it from elsewhere is a tunnel — which legitimately rewrites Host to its
+ * own name. Enforcing there would break the supported setup while protecting a
+ * listener the operator already chose to expose.
+ */
+/**
+ * True when a Host header addresses this machine by a loopback name.
+ * A missing Host fails: HTTP/1.1 requires one, and a request without it is not
+ * something a browser or a well-formed client sends.
+ */
+export declare function isLoopbackHost(hostHeader: string | undefined): boolean;
+/**
+ * True when an Origin header is absent or loopback.
+ *
+ * Absent is the normal case and must pass: an MCP client, curl, or any
+ * non-browser caller sends no Origin at all. Present-and-not-loopback is a
+ * browser telling us a page on another site initiated this, which no legitimate
+ * flow here does. `null` (a sandboxed iframe, a redirected cross-origin POST)
+ * is not loopback and is refused with everything else.
+ */
+export declare function isAllowedOrigin(originHeader: string | undefined): boolean;
+/**
+ * Both checks, for a server that knows whether it is on loopback.
+ * Returns null when the request is acceptable, or a short reason when it is
+ * not — the reason is for a comment, never for the response body, which stays
+ * uninformative on purpose.
+ */
+export declare function rejectReason(headers: {
+    host?: string;
+    origin?: string;
+}, enforce: boolean): string | null;
+/**
+ * Headers for every response from either local listener.
+ *
+ * The unlock page is a credential form, so it must not be framable and must not
+ * be cached: its URL carries the one-time nonce, and a cached copy of the page
+ * or its POST response outlives the server that issued it. `no-referrer` keeps
+ * that nonce out of a Referer header. The CSP allows the inline <style> the
+ * form uses and nothing else — no script of any kind, so a gap in the error
+ * escaping cannot become execution.
+ */
+export declare const SECURITY_HEADERS: Readonly<Record<string, string>>;
+//# sourceMappingURL=local-origin.d.ts.map

package/dist/http/local-origin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-origin.d.ts","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAUH;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAGtE;AAED;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,YAAY,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAQzE;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAC1B,OAAO,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,EAC3C,OAAO,EAAE,OAAO,GACf,MAAM,GAAG,IAAI,CAKf;AAED;;;;;;;;;GASG;AACH,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAO5D,CAAC"}

package/dist/http/local-origin.js

@@ -0,0 +1,92 @@
+/**
+ * DNS-rebinding defence for the two HTTP listeners this process runs.
+ *
+ * Both are bound to loopback and both sit in front of something worth taking:
+ * the unlock form accepts the master password, and the --http transport serves
+ * decrypted notes. Loopback is not the boundary people assume it is. A page in
+ * the user's browser can be made to send requests to 127.0.0.1 — the attacker
+ * points a hostname they control at their own server, the browser caches that,
+ * then the DNS record flips to 127.0.0.1 and the browser treats
+ * http://evil.example:PORT as same-origin with the attacker's page. Same-origin
+ * means no CORS, so the response is readable.
+ *
+ * The tell is the Host header: a rebound request carries the attacker's
+ * hostname, never `127.0.0.1` or `localhost`, because that is what the browser
+ * was asked to fetch. Requiring a loopback Host closes it, and the MCP
+ * specification asks local Streamable HTTP servers to do exactly this.
+ *
+ * Enforced only when the server is actually bound to loopback. `--http --host`
+ * is a deliberate act by an operator who was warned, and the documented way to
+ * reach it from elsewhere is a tunnel — which legitimately rewrites Host to its
+ * own name. Enforcing there would break the supported setup while protecting a
+ * listener the operator already chose to expose.
+ */
+/** Host values that mean "this machine", with any port stripped. */
+const LOOPBACK_HOSTS = new Set(['127.0.0.1', 'localhost', '[::1]', '::1']);
+/** Strip a trailing `:port`, leaving an IPv6 literal's own colons alone. */
+function withoutPort(host) {
+    return host.replace(/:\d+$/, '').toLowerCase();
+}
+/**
+ * True when a Host header addresses this machine by a loopback name.
+ * A missing Host fails: HTTP/1.1 requires one, and a request without it is not
+ * something a browser or a well-formed client sends.
+ */
+export function isLoopbackHost(hostHeader) {
+    if (hostHeader === undefined || hostHeader === '')
+        return false;
+    return LOOPBACK_HOSTS.has(withoutPort(hostHeader.trim()));
+}
+/**
+ * True when an Origin header is absent or loopback.
+ *
+ * Absent is the normal case and must pass: an MCP client, curl, or any
+ * non-browser caller sends no Origin at all. Present-and-not-loopback is a
+ * browser telling us a page on another site initiated this, which no legitimate
+ * flow here does. `null` (a sandboxed iframe, a redirected cross-origin POST)
+ * is not loopback and is refused with everything else.
+ */
+export function isAllowedOrigin(originHeader) {
+    if (originHeader === undefined || originHeader === '')
+        return true;
+    try {
+        return LOOPBACK_HOSTS.has(new URL(originHeader).hostname.toLowerCase());
+    }
+    catch {
+        // Unparseable, including the literal "null".
+        return false;
+    }
+}
+/**
+ * Both checks, for a server that knows whether it is on loopback.
+ * Returns null when the request is acceptable, or a short reason when it is
+ * not — the reason is for a comment, never for the response body, which stays
+ * uninformative on purpose.
+ */
+export function rejectReason(headers, enforce) {
+    if (!enforce)
+        return null;
+    if (!isLoopbackHost(headers.host))
+        return 'non-loopback Host';
+    if (!isAllowedOrigin(headers.origin))
+        return 'cross-site Origin';
+    return null;
+}
+/**
+ * Headers for every response from either local listener.
+ *
+ * The unlock page is a credential form, so it must not be framable and must not
+ * be cached: its URL carries the one-time nonce, and a cached copy of the page
+ * or its POST response outlives the server that issued it. `no-referrer` keeps
+ * that nonce out of a Referer header. The CSP allows the inline <style> the
+ * form uses and nothing else — no script of any kind, so a gap in the error
+ * escaping cannot become execution.
+ */
+export const SECURITY_HEADERS = Object.freeze({
+    'content-security-policy': "default-src 'none'; style-src 'unsafe-inline'; form-action 'self'; frame-ancestors 'none'; base-uri 'none'",
+    'x-frame-options': 'DENY',
+    'x-content-type-options': 'nosniff',
+    'referrer-policy': 'no-referrer',
+    'cache-control': 'no-store',
+});
+//# sourceMappingURL=local-origin.js.map

package/dist/http/local-origin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"local-origin.js","sourceRoot":"","sources":["../../src/http/local-origin.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,oEAAoE;AACpE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAE3E,4EAA4E;AAC5E,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,UAA8B;IAC3D,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IAChE,OAAO,cAAc,CAAC,GAAG,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,YAAgC;IAC9D,IAAI,YAAY,KAAK,SAAS,IAAI,YAAY,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,CAAC;QACH,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAC1B,OAA2C,EAC3C,OAAgB;IAEhB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAC9D,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC9E,yBAAyB,EACvB,4GAA4G;IAC9G,iBAAiB,EAAE,MAAM;IACzB,wBAAwB,EAAE,SAAS;IACnC,iBAAiB,EAAE,aAAa;IAChC,eAAe,EAAE,UAAU;CAC5B,CAAC,CAAC"}

package/dist/http/server.d.ts

@@ -0,0 +1,39 @@
+import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';
+/** Where the bearer token lives when the caller does not supply one. */
+export declare function defaultTokenPath(homeDir: string): string;
+/**
+ * Read the bearer token, generating and persisting one on first run.
+ *
+ * The token is the only thing standing between a reachable port and the
+ * user's decrypted notes, so it is 32 random bytes and the file is 0600.
+ */
+export declare function loadOrCreateToken(tokenPath: string): Promise<string>;
+/** Constant-time compare that does not leak the expected length. */
+export declare function tokenMatches(provided: string, expected: string): boolean;
+export declare function bearerFrom(header: string | undefined): string | null;
+export interface HttpServerOptions {
+    /** Builds a fresh McpServer bound to the process's shared services. The SDK
+     * binds one server to one transport, so each request gets its own pair while
+     * the vault behind them stays the same. */
+    makeServer: () => McpServer;
+    /**
+     * Decide who a bearer token belongs to. Return null to refuse. The CLI has
+     * one token; the desktop app has one per connected AI client and uses the
+     * returned id to record last use. Compare in constant time (tokenMatches).
+     */
+    authorize: (bearer: string) => {
+        clientId: string;
+    } | null;
+    port?: number;
+    /** Defaults to loopback. Binding elsewhere exposes decrypted notes to the
+     * network and must be a deliberate act by the operator. */
+    host?: string;
+    path?: string;
+}
+export interface RunningHttpServer {
+    port: number;
+    host: string;
+    close(): Promise<void>;
+}
+export declare function startHttpServer(opts: HttpServerOptions): Promise<RunningHttpServer>;
+//# sourceMappingURL=server.d.ts.map

package/dist/http/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAGzE,wEAAwE;AACxE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAExD;AAED;;;;;GAKG;AACH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1E;AAED,oEAAoE;AACpE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASxE;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAIpE;AAED,MAAM,WAAW,iBAAiB;IAChC;;+CAE2C;IAC3C,UAAU,EAAE,MAAM,SAAS,CAAC;IAC5B;;;;OAIG;IACH,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;+DAC2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AA4BD,wBAAsB,eAAe,CACnC,IAAI,EAAE,iBAAiB,GACtB,OAAO,CAAC,iBAAiB,CAAC,CAwE5B"}

package/dist/http/server.js

@@ -0,0 +1,131 @@
+import { createServer } from 'node:http';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
+import path from 'node:path';
+import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js';
+import { SECURITY_HEADERS, rejectReason } from './local-origin.js';
+/** Where the bearer token lives when the caller does not supply one. */
+export function defaultTokenPath(homeDir) {
+    return path.join(homeDir, '.virlow-mcp', 'http-token');
+}
+/**
+ * Read the bearer token, generating and persisting one on first run.
+ *
+ * The token is the only thing standing between a reachable port and the
+ * user's decrypted notes, so it is 32 random bytes and the file is 0600.
+ */
+export async function loadOrCreateToken(tokenPath) {
+    try {
+        const existing = (await readFile(tokenPath, 'utf8')).trim();
+        if (existing.length > 0)
+            return existing;
+    }
+    catch {
+        // Missing or unreadable — fall through and mint a new one.
+    }
+    const token = randomBytes(32).toString('base64url');
+    await mkdir(path.dirname(tokenPath), { recursive: true, mode: 0o700 });
+    await writeFile(tokenPath, `${token}\n`, { mode: 0o600 });
+    return token;
+}
+/** Constant-time compare that does not leak the expected length. */
+export function tokenMatches(provided, expected) {
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    if (a.length !== b.length) {
+        // Still burn a comparison so a length mismatch is not measurably faster.
+        timingSafeEqual(b, b);
+        return false;
+    }
+    return timingSafeEqual(a, b);
+}
+export function bearerFrom(header) {
+    if (!header)
+        return null;
+    const match = /^Bearer[ ]+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : null;
+}
+/**
+ * Serve the MCP server over Streamable HTTP so a client that cannot spawn a
+ * child process — a cloud session, another machine — can reach this vault.
+ *
+ * The vault still lives in THIS process on the user's own machine: `unlock`
+ * opens its browser form here, and the master key never crosses the wire.
+ * What does cross the wire is decrypted note and memory text, which is why the
+ * listener is loopback-only unless the operator says otherwise and why every
+ * request must carry the bearer token.
+ */
+async function handleWithFreshTransport(server, req, res) {
+    const transport = new StreamableHTTPServerTransport({
+        sessionIdGenerator: undefined,
+    });
+    res.on('close', () => {
+        void transport.close();
+        void server.close();
+    });
+    await server.connect(transport);
+    await transport.handleRequest(req, res);
+}
+export async function startHttpServer(opts) {
+    const host = opts.host ?? '127.0.0.1';
+    const mcpPath = opts.path ?? '/mcp';
+    // Only a loopback bind gets the Host check: a tunnel in front of a --host
+    // listener rewrites Host to its own name, and that is the documented way to
+    // reach this from another machine. See local-origin.ts.
+    const enforceLocal = host === '127.0.0.1' || host === '::1' || host === 'localhost';
+    const httpServer = createServer((req, res) => {
+        const url = new URL(req.url ?? '/', `http://${host}`);
+        // Before anything else, including /health: a rebound page must not even be
+        // able to confirm something is listening on this port.
+        if (rejectReason(req.headers, enforceLocal) !== null) {
+            res.writeHead(403, { ...SECURITY_HEADERS, 'content-type': 'application/json' });
+            res.end(JSON.stringify({ error: 'forbidden' }));
+            return;
+        }
+        if (url.pathname === '/health') {
+            res.writeHead(200, { ...SECURITY_HEADERS, 'content-type': 'application/json' });
+            res.end(JSON.stringify({ ok: true }));
+            return;
+        }
+        if (url.pathname !== mcpPath) {
+            res.writeHead(404, SECURITY_HEADERS).end();
+            return;
+        }
+        const provided = bearerFrom(req.headers.authorization);
+        if (provided === null || opts.authorize(provided) === null) {
+            // No detail about why: a caller without the token learns nothing beyond
+            // "something is listening here".
+            res.writeHead(401, {
+                ...SECURITY_HEADERS,
+                'content-type': 'application/json',
+                'www-authenticate': 'Bearer',
+            });
+            res.end(JSON.stringify({ error: 'unauthorized' }));
+            return;
+        }
+        // A transport instance serves exactly one exchange: a stateful one answers
+        // every later `initialize` with "Server already initialized", and a reused
+        // stateless one 500s on its second request. So each request gets its own
+        // server+transport pair, both discarded when the response closes. The
+        // vault they share is the process's, so a reconnecting client — a cloud
+        // session that dropped — still finds it unlocked.
+        void handleWithFreshTransport(opts.makeServer(), req, res);
+    });
+    await new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(opts.port ?? 0, host, () => {
+            httpServer.removeListener('error', reject);
+            resolve();
+        });
+    });
+    const address = httpServer.address();
+    const port = typeof address === 'object' && address !== null ? address.port : 0;
+    return {
+        port,
+        host,
+        close: () => new Promise((resolve) => {
+            httpServer.close(() => resolve());
+        }),
+    };
+}
+//# sourceMappingURL=server.js.map

package/dist/http/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../src/http/server.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC9D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,6BAA6B,EAAE,MAAM,oDAAoD,CAAC;AAEnG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEnE,wEAAwE;AACxE,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,aAAa,EAAE,YAAY,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvE,MAAM,SAAS,CAAC,SAAS,EAAE,GAAG,KAAK,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAgB;IAC7D,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC;QAC1B,yEAAyE;QACzE,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QACtB,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,MAA0B;IACnD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACtD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACzC,CAAC;AA0BD;;;;;;;;;GASG;AACH,KAAK,UAAU,wBAAwB,CACrC,MAAiB,EACjB,GAAoB,EACpB,GAAmB;IAEnB,MAAM,SAAS,GAAG,IAAI,6BAA6B,CAAC;QAClD,kBAAkB,EAAE,SAAS;KAC9B,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACnB,KAAK,SAAS,CAAC,KAAK,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,MAAM,SAAS,CAAC,aAAa,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,IAAuB;IAEvB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,WAAW,CAAC;IACtC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC;IAEpC,0EAA0E;IAC1E,4EAA4E;IAC5E,wDAAwD;IACxD,MAAM,YAAY,GAAG,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,WAAW,CAAC;IAEpF,MAAM,UAAU,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;QAC5E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,IAAI,EAAE,CAAC,CAAC;QAEtD,2EAA2E;QAC3E,uDAAuD;QACvD,IAAI,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;YAChD,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,GAAG,gBAAgB,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC,CAAC;YAChF,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO;QACT,CAAC;QAED,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC7B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC,GAAG,EAAE,CAAC;YAC3C,OAAO;QACT,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QACvD,IAAI,QAAQ,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YAC3D,wEAAwE;YACxE,iCAAiC;YACjC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE;gBACjB,GAAG,gBAAgB;gBACnB,cAAc,EAAE,kBAAkB;gBAClC,kBAAkB,EAAE,QAAQ;aAC7B,CAAC,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO;QACT,CAAC;QAED,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,sEAAsE;QACtE,wEAAwE;QACxE,kDAAkD;QAClD,KAAK,wBAAwB,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC1C,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACjC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE;YAC3C,UAAU,CAAC,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC3C,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAEhF,OAAO;QACL,IAAI;QACJ,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE,CACV,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;YAC5B,UAAU,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC,CAAC;KACL,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 export { ApiError, VirlowApi } from './api.js';
-export type { ApiFolder, ApiNote, AuthTokens, LoginResult, NoteWrite } from './api.js';
+export type { ApiFolder, ApiNote, AuthTokens, LoginResult, NoteWrite, RefreshBody } from './api.js';
 export { LockedError, Vault } from './vault.js';
 export type { UnlockedSession } from './vault.js';
 export { NotesService, SEARCH_SCAN_CAP } from './notes.js';
@@ -14,6 +14,10 @@ export type { Exposure } from './exposure.js';
 export { EmbeddingCache } from './embedding-cache.js';
 export type { EmbeddingCacheLike } from './embedding-cache.js';
 export { MEMORIES_DISABLED_MESSAGE, memoriesAllowed } from './memories-enabled.js';
+export { ATTRS_MAX_BYTES, TAGS_PROP, decodeAttrs, decodeSchema, defineProp, emptyAttrs, emptySchema, encodeAttrs, encodeSchema, newPropId, removeProp, reorderProps, sortedProps, tagsFromAttrs, updateProp, withTags, } from './attrs.js';
+export type { FolderSchemaV1, NoteAttrsV1, PropDefinition, PropOption, PropType, PropValue, TagsValue } from './attrs.js';
+export { buildTitleMatcher, extractLinkIds, htmlToText } from './attrs-extract.js';
+export type { TitleEntry, TitleMatcher } from './attrs-extract.js';
 /**
  * The MCP tool surface is NOT exported here. It lives at the `/tools` subpath,
  * which is ESM-only, because it depends on @modelcontextprotocol/sdk — an

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AACvF,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAChE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF;;;;;;;;;;GAUG"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAC/C,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACpG,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAChE,YAAY,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,cAAc,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAC1H,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACnF,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEnE;;;;;;;;;;GAUG"}

package/dist/index.js

@@ -7,6 +7,8 @@ export { MEMORIES_ROOT_NAME, ensureNamespace, resolveMemoryTree, } from './memor
 export { computeExposure, filteredNotice } from './exposure.js';
 export { EmbeddingCache } from './embedding-cache.js';
 export { MEMORIES_DISABLED_MESSAGE, memoriesAllowed } from './memories-enabled.js';
+export { ATTRS_MAX_BYTES, TAGS_PROP, decodeAttrs, decodeSchema, defineProp, emptyAttrs, emptySchema, encodeAttrs, encodeSchema, newPropId, removeProp, reorderProps, sortedProps, tagsFromAttrs, updateProp, withTags, } from './attrs.js';
+export { buildTitleMatcher, extractLinkIds, htmlToText } from './attrs-extract.js';
 /**
  * The MCP tool surface is NOT exported here. It lives at the `/tools` subpath,
  * which is ESM-only, because it depends on @modelcontextprotocol/sdk — an

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAEnF;;;;;;;;;;GAUG"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAE/C,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAE7D,OAAO,EACL,gBAAgB,EAChB,SAAS,EACT,eAAe,EACf,mBAAmB,EACnB,cAAc,GACf,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAEhE,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAEtD,OAAO,EAAE,yBAAyB,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,eAAe,EACf,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,WAAW,EACX,YAAY,EACZ,SAAS,EACT,UAAU,EACV,YAAY,EACZ,WAAW,EACX,aAAa,EACb,UAAU,EACV,QAAQ,GACT,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,iBAAiB,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAGnF;;;;;;;;;;GAUG"}

package/dist/memories.d.ts

@@ -2,6 +2,8 @@ import { type Embedder } from '@batalabs/virlow-memory';
 import { type VirlowApi } from './api.js';
 import type { EmbeddingCacheLike } from './embedding-cache.js';
 import { type MemoryMeta } from './memory-note.js';
+import { type MemoryGraph } from './memory-graph.js';
+import type { MemoryRelation } from './memory-note.js';
 import type { Vault } from './vault.js';
 /**
  * Page size for the sync walk over each memory folder.
@@ -33,6 +35,13 @@ export interface SimilarMemory {
     text: string;
     similarity: number;
 }
+/** A fact the new memory ended: it said something single-valued (who leads
+ *  a project, where someone works) that the new one replaces. */
+export interface ClosedFact {
+    id: string;
+    label: string;
+    relation: MemoryRelation;
+}
 export type SyncResult = {
     added: number;
     updated: number;
@@ -66,10 +75,79 @@ export declare class MemoryStore {
         action: 'stored' | 'updated';
         id: string;
         similar: SimilarMemory[];
+        closed: ClosedFact[];
     }>;
-    search(query: string, namespace?: string, limit?: number): Promise<Array<Omit<CachedMemory, 'embedding' | 'folderId' | 'updatedAt'> & {
+    /**
+     * Ends the facts a new memory replaces. Each superseded relation gets a
+     * `to` date (the new fact's start); a memory whose relations have all
+     * ended gets `valid_to` and `superseded_by`. Nothing is deleted, so "who
+     * led Atlas before Sam?" stays answerable.
+     */
+    private closeSuperseded;
+    /** The graph over what is cached now. Cheap: rebuilt from the notes on
+     *  demand, never stored. */
+    graph(namespace?: string): MemoryGraph;
+    /** New names spelled the way existing memories already spell them, and
+     *  predicates in snake_case, so one entity does not split in two. */
+    private canonicalize;
+    /**
+     * Hybrid recall: similarity, then the graph (memories about an entity the
+     * query names, and one relation out from it) and recency. Current facts
+     * only, unless `includeHistory`, or as they stood on `asOf`.
+     */
+    search(query: string, namespace?: string, limit?: number, opts?: {
+        asOf?: string;
+        includeHistory?: boolean;
+    }): Promise<Array<Omit<CachedMemory, 'embedding' | 'folderId' | 'updatedAt'> & {
         similarity: number;
     }>>;
+    /** Everything known about one entity: its current and past relations and
+     *  the facts behind them. Null when no memory names it. */
+    recallEntity(name: string, namespace?: string): Promise<{
+        name: string;
+        current: CachedMemory[];
+        past: CachedMemory[];
+        relations: {
+            memoryId: string;
+            s: string;
+            p: string;
+            o: string;
+            from?: string;
+            to?: string;
+        }[];
+    } | null>;
+    /** Adds entities and relations to an existing memory: how a memory saved
+     *  before the graph existed gets linked. Also ends what it replaces. */
+    link(id: string, add: {
+        about?: string[];
+        relations?: MemoryRelation[];
+    }): Promise<ClosedFact[]>;
+    /** One entity spelled two ways becomes one: every memory naming `from`
+     *  is rewritten to name `into`. Returns how many memories changed. */
+    mergeEntities(from: string, into: string): Promise<number>;
+    /**
+     * What to load at the start of a session: the entities this namespace
+     * talks about most, and its most recent current facts, within `limit`
+     * facts. Global memories are included alongside a project's.
+     */
+    context(namespace?: string, limit?: number): Promise<{
+        entities: {
+            name: string;
+            facts: number;
+        }[];
+        facts: CachedMemory[];
+    }>;
+    /** Findings for a tidy pass: unlinked memories, likely duplicate names and
+     *  single-valued facts holding two values at once. */
+    health(namespace?: string): Promise<{
+        unlinked: string[];
+        possibleDuplicates: [string, string][];
+        contradictions: {
+            subject: string;
+            predicate: string;
+            objects: string[];
+        }[];
+    }>;
     /** Requires a prior sync() in the same unlock to have populated the cache. */
     list(namespace?: string): CachedMemory[];
     update(id: string, changes: {

package/dist/memories.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memories.d.ts","sourceRoot":"","sources":["../src/memories.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,qBAAa,WAAW;IAepB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAjB/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,OAAO,CAAC,IAAI,CAA2B;IACvC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,aAAa,CAAuC;IAE5D;;;sEAGkE;IAClE,OAAO,CAAC,KAAK,CAAK;gBAGC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,kBAAkB;IAKvE,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;uEACmE;IACnE,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;YAOb,MAAM;IA+FpB,GAAG,CACD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC;QAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAwE5E,MAAM,CACV,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAK,GACT,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAkBtG,8EAA8E;IAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE;IAOxC,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,CAAC;IAyBhB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjC,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAYrB;6CACyC;YAC3B,SAAS;YAoCT,UAAU;YAWV,WAAW;YAKX,iBAAiB;IAS/B,yEAAyE;YAC3D,cAAc;IAK5B,OAAO,CAAC,cAAc;IAMtB;;;oDAGgD;IAChD,OAAO,CAAC,OAAO;CAKhB"}
+{"version":3,"file":"memories.d.ts","sourceRoot":"","sources":["../src/memories.ts"],"names":[],"mappings":"AAKA,OAAO,EAIL,KAAK,QAAQ,EACd,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAA0C,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAClF,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC/D,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAQL,KAAK,WAAW,EACjB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAExC;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe,KAAK,CAAC;AAElC,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,UAAU,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,YAAY,CAAC;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED;iEACiE;AACjE,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,cAAc,CAAC;CAC1B;AAsBD,MAAM,MAAM,UAAU,GAAG;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAIF,qBAAa,WAAW;IAepB,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,YAAY;IAjB/B,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAmC;IACzD,OAAO,CAAC,IAAI,CAA2B;IACvC,OAAO,CAAC,UAAU,CAAmC;IACrD,OAAO,CAAC,gBAAgB,CAAS;IACjC,OAAO,CAAC,YAAY,CAAoC;IACxD,OAAO,CAAC,aAAa,CAAuC;IAE5D;;;sEAGkE;IAClE,OAAO,CAAC,KAAK,CAAK;gBAGC,GAAG,EAAE,SAAS,EACd,KAAK,EAAE,KAAK,EACZ,QAAQ,EAAE,QAAQ,EAClB,YAAY,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,kBAAkB;IAKvE,KAAK,IAAI,IAAI;IAQb,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED;uEACmE;IACnE,IAAI,IAAI,OAAO,CAAC,UAAU,CAAC;YAOb,MAAM;IA+FpB,GAAG,CACD,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,SAAS,CAAC,EAAE,MAAM,EAClB,IAAI,GAAE,UAAe,GACpB,OAAO,CAAC;QAAE,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,aAAa,EAAE,CAAC;QAAC,MAAM,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IA2FxG;;;;;OAKG;YACW,eAAe;IA+C7B;gCAC4B;IAC5B,KAAK,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,WAAW;IAQtC;yEACqE;IACrE,OAAO,CAAC,YAAY;IAsBpB;;;;OAIG;IACG,MAAM,CACV,KAAK,EAAE,MAAM,EACb,SAAS,CAAC,EAAE,MAAM,EAClB,KAAK,SAAK,EACV,IAAI,GAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,cAAc,CAAC,EAAE,OAAO,CAAA;KAAO,GACrD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAwBtG;+DAC2D;IACrD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM;;;;;;;;;;;;;IAmBnD;4EACwE;IACxE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,SAAS,CAAC,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;IA4BhG;0EACsE;IACtE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IA4B1D;;;;OAIG;IACG,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,KAAK,SAAK;;;;;;;IAgB5C;0DACsD;IAChD,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM;;;;;;;;;IAO/B,8EAA8E;IAC9E,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,YAAY,EAAE;IAOxC,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,OAAO,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,UAAU,CAAA;KAAE,GAC5D,OAAO,CAAC,IAAI,CAAC;IA0BhB,+EAA+E;IAC/E,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAYjC,8EAA8E;IAC9E,OAAO,CAAC,aAAa;IAYrB;6CACyC;YAC3B,SAAS;YAoCT,UAAU;YAWV,WAAW;YAKX,iBAAiB;IAS/B,yEAAyE;YAC3D,cAAc;IAK5B,OAAO,CAAC,cAAc;IAMtB;;;oDAGgD;IAChD,OAAO,CAAC,OAAO;CAKhB"}