@iamem/amem 0.1.0

package/dist/it-pack.js

@@ -0,0 +1,84 @@
+/**
+ * Local IT pack: deny-default policy, MDM snippet, SBOM, offboard pointer.
+ * No cloud, no telemetry. IT tier recommended; generating the folder is allowed on any machine.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, copyFileSync } from "node:fs";
+import { join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createHash } from "node:crypto";
+import { amemHome } from "./paths.js";
+import { licenseStatus } from "./license.js";
+import { embedStatus } from "./embed.js";
+import { vaultStatus } from "./vault.js";
+function packageRoot() {
+    return join(fileURLToPath(new URL(".", import.meta.url)), "..");
+}
+export function buildSbom() {
+    const pkgPath = join(packageRoot(), "package.json");
+    const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+    const components = Object.entries(pkg.dependencies ?? {}).map(([name, version]) => ({
+        name,
+        version: String(version).replace(/^[\^~]/, ""),
+        type: "library",
+    }));
+    return {
+        bomFormat: "CycloneDX",
+        specVersion: "1.5",
+        serialNumber: `urn:uuid:${createHash("sha256").update(`${pkg.name}@${pkg.version}`).digest("hex").slice(0, 32)}`,
+        metadata: {
+            timestamp: new Date().toISOString(),
+            component: {
+                name: pkg.name || "amem",
+                version: pkg.version || "0.0.0",
+                type: "application",
+            },
+        },
+        components,
+    };
+}
+export function writeItPack(outDir) {
+    mkdirSync(outDir, { recursive: true, mode: 0o700 });
+    const files = [];
+    const root = packageRoot();
+    const denySrc = join(root, "templates", "policy.deny-default.toml");
+    const denyOut = join(outDir, "policy.toml");
+    copyFileSync(existsSync(denySrc) ? denySrc : join(root, "templates", "policy.example.toml"), denyOut);
+    files.push(denyOut);
+    const mdmSrc = join(root, "templates", "mdm", "co.amem.managed.plist");
+    if (existsSync(mdmSrc)) {
+        const mdmOut = join(outDir, "co.amem.managed.plist");
+        copyFileSync(mdmSrc, mdmOut);
+        files.push(mdmOut);
+    }
+    const offboardSrc = join(root, "scripts", "mdm-offboard.sh");
+    if (existsSync(offboardSrc)) {
+        const offOut = join(outDir, "mdm-offboard.sh");
+        copyFileSync(offboardSrc, offOut);
+        files.push(offOut);
+    }
+    const sbomOut = join(outDir, "sbom.json");
+    writeFileSync(sbomOut, `${JSON.stringify(buildSbom(), null, 2)}\n`, "utf8");
+    files.push(sbomOut);
+    const notes = `# amem IT pack (local)
+
+Memory stays on each laptop under ${amemHome()}.
+There is no license server and no cloud sync.
+
+1. Deploy policy.toml as /etc/amem/policy.toml (root-owned).
+2. Install a pinned amem build (internal npm or mirrored clone).
+3. Optional: wrap co.amem.managed.plist in your MDM profile.
+4. Offboard with mdm-offboard.sh (wipes ~/.amem on that machine).
+5. Attach sbom.json + \`amem doctor --attest --json\` to the security ticket.
+   IT tier adds a richer vault/host attest packet; the pack folder itself is available on Free.
+
+Signed macOS/Windows installers need your org’s code-signing cert — amem does not upload binaries.
+
+License: ${licenseStatus().tier}
+Embed: ${embedStatus().backend}
+Vault backups: ${vaultStatus().backup.dir}
+`;
+    const notesOut = join(outDir, "README.txt");
+    writeFileSync(notesOut, notes, "utf8");
+    files.push(notesOut);
+    return { dir: outDir, files };
+}

package/dist/kinds.d.ts

@@ -0,0 +1,18 @@
+/** Claim kind helpers: inference + retrieval priority. */
+export declare function kindRankBoost(kind: string | null | undefined): number;
+/**
+ * Infer a durable kind from prompt/answer text.
+ * Prefers constraint/gotcha when the language looks like a lasting rule.
+ */
+export declare function inferClaimKind(prompt: string, answer?: string): string;
+/** Compact durable claim text from a Q/A turn (prefer outcome over raw chat). */
+export declare function compactClaimText(prompt: string, answer?: string): string;
+/** Multi-turn: fold several notes into one compact fact string. */
+export declare function compactFromNotes(notes: Array<{
+    role: string;
+    text: string;
+}>): {
+    prompt: string;
+    answer: string;
+} | null;
+export declare function isDurableCapture(prompt: string, answer: string | undefined, anchorCount: number): boolean;

package/dist/kinds.js

@@ -0,0 +1,106 @@
+/** Claim kind helpers: inference + retrieval priority. */
+const KIND_WEIGHT = {
+    constraint: 12,
+    gotcha: 12,
+    owner: 8,
+    howto: 6,
+    structure: 5,
+    flow: 4,
+    session: 1,
+};
+export function kindRankBoost(kind) {
+    if (!kind)
+        return 3;
+    return KIND_WEIGHT[kind.toLowerCase()] ?? 3;
+}
+/**
+ * Infer a durable kind from prompt/answer text.
+ * Prefers constraint/gotcha when the language looks like a lasting rule.
+ */
+export function inferClaimKind(prompt, answer = "") {
+    const hay = `${prompt}\n${answer}`.toLowerCase();
+    if (/\b(gotcha|pitfall|trap|don'?t|never|always|must not|broken if|fails if|watch out)\b/.test(hay)) {
+        return "gotcha";
+    }
+    if (/\b(must|should|required|constraint|invariant|idempotent|only after)\b/.test(hay)) {
+        return "constraint";
+    }
+    if (/\b(owned by|owner|maintained by|responsible)\b/.test(hay)) {
+        return "owner";
+    }
+    if (/\b(how to|steps? to|run this|workflow)\b/.test(hay)) {
+        return "howto";
+    }
+    if (/\b(lives in|entrypoint|located in|module|component)\b/.test(hay)) {
+        return "structure";
+    }
+    return "session";
+}
+/** Compact durable claim text from a Q/A turn (prefer outcome over raw chat). */
+export function compactClaimText(prompt, answer) {
+    const takeaway = scrubCodeNoise((answer ?? "").replace(/\s+/g, " ").trim());
+    if (takeaway.length >= 40) {
+        const preferred = pickFactSentences(takeaway);
+        if (preferred)
+            return preferred.slice(0, 400);
+        const sentences = takeaway.split(/(?<=[.!?])\s+/).filter(Boolean);
+        const head = sentences.slice(0, 2).join(" ").slice(0, 400);
+        return head || takeaway.slice(0, 400);
+    }
+    const q = prompt.replace(/\s+/g, " ").trim().slice(0, 280);
+    return takeaway ? `${q}\n\nPrior outcome: ${takeaway.slice(0, 200)}` : q.slice(0, 400);
+}
+/** Multi-turn: fold several notes into one compact fact string. */
+export function compactFromNotes(notes) {
+    const users = notes.filter((n) => n.role === "user").map((n) => n.text.trim());
+    const assistants = notes.filter((n) => n.role === "assistant").map((n) => n.text.trim());
+    if (users.length === 0 && assistants.length === 0)
+        return null;
+    const prompt = users.slice(0, 2).join(" — ").slice(0, 400) || "Session takeaways";
+    // Prefer assistant sentences that mention paths or durable language
+    const pool = assistants.join(" ");
+    const answer = pickFactSentences(scrubCodeNoise(pool)) ||
+        assistants[0]?.replace(/\s+/g, " ").trim().slice(0, 400) ||
+        "";
+    if (!answer && !isUsefulish(prompt))
+        return null;
+    return { prompt, answer };
+}
+function isUsefulish(text) {
+    return text.trim().length >= 16;
+}
+function scrubCodeNoise(text) {
+    return text
+        .replace(/```[\s\S]*?```/g, " ")
+        .replace(/`[^`]+`/g, " ")
+        .replace(/\s+/g, " ")
+        .trim();
+}
+function pickFactSentences(text) {
+    const sentences = text.split(/(?<=[.!?])\s+/).filter((s) => s.length > 25);
+    const scored = sentences.map((s) => {
+        let score = 0;
+        if (/\b(src\/|[\w.-]+\.(ts|tsx|js|py|go|rs))\b/i.test(s))
+            score += 3;
+        if (/\b(must|should|never|always|gotcha|idempotent|before|after)\b/i.test(s))
+            score += 2;
+        if (/\b(lives in|entrypoint|owned by|constraint)\b/i.test(s))
+            score += 2;
+        if (/^[A-Z]/.test(s))
+            score += 1;
+        return { s, score };
+    });
+    scored.sort((a, b) => b.score - a.score);
+    const top = scored.filter((x) => x.score > 0).slice(0, 2).map((x) => x.s);
+    if (top.length === 0)
+        return null;
+    return top.join(" ");
+}
+export function isDurableCapture(prompt, answer, anchorCount) {
+    if (anchorCount <= 0)
+        return false;
+    const kind = inferClaimKind(prompt, answer ?? "");
+    if (kind === "session" && (answer ?? "").trim().length < 80)
+        return false;
+    return true;
+}

package/dist/license.d.ts

@@ -0,0 +1,48 @@
+export type LicenseTier = "free" | "pro" | "it";
+export type LicenseKind = "none" | "signed";
+export type LicensePayload = {
+    tier: LicenseTier;
+    subject?: string;
+    issued_at: string;
+    expires_at?: string;
+    features?: string[];
+};
+export type LicenseFile = {
+    kind: "signed";
+    payload: LicensePayload;
+    signature: string;
+};
+export type LicenseStatus = {
+    tier: LicenseTier;
+    kind: LicenseKind;
+    subject?: string;
+    expires_at?: string;
+    features: string[];
+    valid: boolean;
+    transferable: boolean;
+    path: string;
+    issues: string[];
+};
+export declare const FEATURE_LOCAL_EMBED = "local_embed_model";
+export declare const FEATURE_ATTEST_SKU = "attest_sku";
+export declare const FEATURE_HYGIENE = "hygiene";
+export declare const FEATURE_RULES_SYNC = "rules_sync";
+/** Vendor verify key (SPKI DER hex). Issue signed files with AMEM_LICENSE_PRIVKEY. */
+export declare const DEFAULT_LICENSE_PUBKEY_HEX = "302a300506032b6570032100b1e01cdb2d1ec60b372bb4307fa48ed743caba09a67633e4689aaa22221080fa";
+export declare function licensePath(): string;
+export declare function featuresForTier(tier: LicenseTier): string[];
+export declare function generateLicenseKeys(): {
+    publicKeyHex: string;
+    privateKeyHex: string;
+};
+export declare function signLicense(privateKeyHex: string, payload: LicensePayload): LicenseFile;
+export declare function verifySignedLicense(file: LicenseFile, publicKeyHex?: string): string[];
+export declare function parseLicenseFile(raw: unknown): LicenseFile;
+export declare function readLicenseFile(path?: string): LicenseFile | null;
+export declare function licenseStatus(now?: Date): LicenseStatus;
+export declare function hasFeature(feature: string): boolean;
+export declare function writeLicense(file: LicenseFile, path?: string): string;
+export declare function applyLicenseJson(raw: unknown): LicenseStatus;
+export declare function applyLicenseFile(sourcePath: string): LicenseStatus;
+export declare function clearLicense(): void;
+export declare function requireFeature(feature: string, label?: string): void;

package/dist/license.js

@@ -0,0 +1,172 @@
+/**
+ * Local license SKU. No license server, no telemetry.
+ * Paid tiers require a vendor-signed file (Ed25519). No self-serve unlock from source.
+ */
+import { generateKeyPairSync, sign as signBytes, verify as verifyBytes } from "node:crypto";
+import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { amemHome } from "./paths.js";
+export const FEATURE_LOCAL_EMBED = "local_embed_model";
+export const FEATURE_ATTEST_SKU = "attest_sku";
+export const FEATURE_HYGIENE = "hygiene";
+export const FEATURE_RULES_SYNC = "rules_sync";
+/** Vendor verify key (SPKI DER hex). Issue signed files with AMEM_LICENSE_PRIVKEY. */
+export const DEFAULT_LICENSE_PUBKEY_HEX = "302a300506032b6570032100b1e01cdb2d1ec60b372bb4307fa48ed743caba09a67633e4689aaa22221080fa";
+const BUY_HINT = "Buy at https://getamem.com then: amem license apply --file ~/Downloads/amem-license.json";
+const TIER_FEATURES = {
+    free: [],
+    pro: [FEATURE_LOCAL_EMBED, FEATURE_HYGIENE, FEATURE_RULES_SYNC],
+    it: [FEATURE_LOCAL_EMBED, FEATURE_HYGIENE, FEATURE_RULES_SYNC, FEATURE_ATTEST_SKU],
+};
+export function licensePath() {
+    return join(amemHome(), "license.json");
+}
+export function featuresForTier(tier) {
+    return [...TIER_FEATURES[tier]];
+}
+export function generateLicenseKeys() {
+    const pair = generateKeyPairSync("ed25519");
+    return {
+        publicKeyHex: pair.publicKey.export({ type: "spki", format: "der" }).toString("hex"),
+        privateKeyHex: pair.privateKey.export({ type: "pkcs8", format: "der" }).toString("hex"),
+    };
+}
+function canonical(payload) {
+    return Buffer.from(JSON.stringify({
+        expires_at: payload.expires_at ?? "",
+        features: [...(payload.features ?? [])].sort(),
+        issued_at: payload.issued_at,
+        subject: payload.subject ?? "",
+        tier: payload.tier,
+    }));
+}
+export function signLicense(privateKeyHex, payload) {
+    const key = Buffer.from(privateKeyHex, "hex");
+    const signature = signBytes(null, canonical(payload), {
+        key,
+        format: "der",
+        type: "pkcs8",
+    }).toString("hex");
+    return { kind: "signed", payload, signature };
+}
+export function verifySignedLicense(file, publicKeyHex = process.env.AMEM_LICENSE_PUBKEY || DEFAULT_LICENSE_PUBKEY_HEX) {
+    const issues = [];
+    if (file.kind !== "signed" || !file.signature) {
+        issues.push("not a signed license");
+        return issues;
+    }
+    try {
+        const ok = verifyBytes(null, canonical(file.payload), { key: Buffer.from(publicKeyHex, "hex"), format: "der", type: "spki" }, Buffer.from(file.signature, "hex"));
+        if (!ok)
+            issues.push("license signature is invalid");
+    }
+    catch (error) {
+        issues.push(error instanceof Error ? error.message : String(error));
+    }
+    return issues;
+}
+export function parseLicenseFile(raw) {
+    if (!raw || typeof raw !== "object")
+        throw new Error("License must be a JSON object");
+    const rec = raw;
+    if (rec.kind === "dev") {
+        throw new Error(`Self-issued /dev licenses are not accepted. ${BUY_HINT}`);
+    }
+    if (rec.kind !== "signed")
+        throw new Error("License kind must be signed");
+    if (!rec.signature || typeof rec.signature !== "string") {
+        throw new Error("Signed license requires a signature");
+    }
+    if (!rec.payload || !["free", "pro", "it"].includes(rec.payload.tier)) {
+        throw new Error("License payload.tier must be free, pro, or it");
+    }
+    return { kind: "signed", payload: rec.payload, signature: rec.signature };
+}
+function expired(payload, now = new Date()) {
+    if (!payload.expires_at)
+        return false;
+    const exp = new Date(payload.expires_at);
+    return Number.isFinite(exp.getTime()) && exp.getTime() < now.getTime();
+}
+export function readLicenseFile(path = licensePath()) {
+    if (!existsSync(path))
+        return null;
+    return parseLicenseFile(JSON.parse(readFileSync(path, "utf8")));
+}
+export function licenseStatus(now = new Date()) {
+    const path = licensePath();
+    const issues = [];
+    try {
+        const file = readLicenseFile(path);
+        if (!file) {
+            return {
+                tier: "free",
+                kind: "none",
+                features: [],
+                valid: true,
+                transferable: false,
+                path,
+                issues: [],
+            };
+        }
+        if (expired(file.payload, now))
+            issues.push("license expired");
+        issues.push(...verifySignedLicense(file));
+        const tier = issues.length ? "free" : file.payload.tier;
+        const features = [...new Set([...(file.payload.features ?? []), ...featuresForTier(tier)])];
+        return {
+            tier,
+            kind: "signed",
+            subject: file.payload.subject,
+            expires_at: file.payload.expires_at,
+            features,
+            valid: issues.length === 0,
+            transferable: true,
+            path,
+            issues,
+        };
+    }
+    catch (error) {
+        issues.push(error instanceof Error ? error.message : String(error));
+        return {
+            tier: "free",
+            kind: "none",
+            features: [],
+            valid: false,
+            transferable: false,
+            path,
+            issues,
+        };
+    }
+}
+export function hasFeature(feature) {
+    const status = licenseStatus();
+    return status.valid && status.features.includes(feature);
+}
+export function writeLicense(file, path = licensePath()) {
+    mkdirSync(amemHome(), { recursive: true, mode: 0o700 });
+    writeFileSync(path, `${JSON.stringify(file, null, 2)}\n`, { mode: 0o600 });
+    return path;
+}
+export function applyLicenseJson(raw) {
+    const parsed = typeof raw === "string" ? JSON.parse(raw) : raw;
+    const file = parseLicenseFile(parsed);
+    const bad = verifySignedLicense(file);
+    if (bad.length)
+        throw new Error(bad.join("; "));
+    writeLicense(file);
+    return licenseStatus();
+}
+export function applyLicenseFile(sourcePath) {
+    return applyLicenseJson(JSON.parse(readFileSync(sourcePath, "utf8")));
+}
+export function clearLicense() {
+    const path = licensePath();
+    if (existsSync(path))
+        unlinkSync(path);
+}
+export function requireFeature(feature, label = feature) {
+    if (hasFeature(feature))
+        return;
+    throw new Error(`${label} needs an amem Pro or IT license. ${BUY_HINT}`);
+}

package/dist/mcp.d.ts

@@ -0,0 +1,40 @@
+export type JsonRpc = {
+    jsonrpc?: string;
+    id?: number | string | null;
+    method?: string;
+    params?: Record<string, unknown>;
+};
+export type JsonRpcResponse = {
+    jsonrpc: "2.0";
+    id: number | string;
+    result?: unknown;
+    error?: {
+        code: number;
+        message: string;
+    };
+};
+export declare function isJsonRpcMessage(body: unknown): body is JsonRpc;
+/** Handle one JSON-RPC message. Notifications (no id) return null. */
+export declare function dispatchMcp(msg: JsonRpc, fallbackWorkspace?: string): JsonRpcResponse | null;
+export declare function handleMcpHttpBody(body: unknown, fallbackWorkspace?: string): {
+    status: number;
+    body: unknown;
+};
+export declare function stdioMcpLaunch(workspace?: string): {
+    command: string;
+    args: string[];
+    env: Record<string, string>;
+};
+export declare function mcpClientConfig(workspace?: string, port?: number): {
+    mcpServers: {
+        amem: {
+            command: string;
+            args: string[];
+            env: Record<string, string>;
+        };
+    };
+    http: {
+        url: string;
+    };
+};
+export declare function runMcpServer(): Promise<void>;