@mysten-incubation/memwal-mcp 0.0.1-dev.0

package/dist/bridge.js

@@ -0,0 +1,330 @@
+import { credsPath } from "./auth.js";
+import { log, note } from "./logger.js";
+async function openSseStream(relayerUrl, creds) {
+    const url = `${relayerUrl.replace(/\/+$/, "")}/api/mcp/sse`;
+    const controller = new AbortController();
+    const resp = await fetch(url, {
+        method: "GET",
+        headers: {
+            authorization: `Bearer ${creds.delegatePrivateKey}`,
+            "x-memwal-account-id": creds.accountId,
+            accept: "text/event-stream",
+            "cache-control": "no-cache",
+        },
+        signal: controller.signal,
+    });
+    if (resp.status === 401) {
+        controller.abort();
+        log.warn("bridge.unauthorized", { url });
+        // DO NOT wipe creds here. A 401 from the relayer is *evidence* of
+        // a problem but not *proof* the saved seed is the cause. Possible
+        // sources: revoked delegate key (genuine), transient WAF / rate
+        // limit (false positive), http_proxy interposed somewhere on the
+        // path, or — on `--local` — local malware racing the relayer port.
+        // Auto-wiping the seed turns any one of those into a permanent
+        // outage that forces re-login. Force-fail loud instead; the user
+        // runs `memwal-mcp login` if they want to actually rotate.
+        throw new Error("MemWal relayer rejected credentials (HTTP 401). " +
+            "Delegate key may have been revoked, the relayer may be " +
+            "rate-limiting, or a proxy may be interposed. Saved " +
+            `credentials at ${credsPath()} were NOT modified. ` +
+            "Run `memwal-mcp login` if you need to rotate the key.");
+    }
+    if (!resp.ok || !resp.body) {
+        const body = resp.body ? await resp.text() : "";
+        controller.abort();
+        throw new Error(`MemWal relayer SSE handshake failed: HTTP ${resp.status} ${body.slice(0, 200)}`);
+    }
+    const ct = resp.headers.get("content-type") ?? "";
+    if (!ct.includes("event-stream")) {
+        controller.abort();
+        throw new Error(`MemWal relayer returned unexpected content-type "${ct}" for SSE endpoint`);
+    }
+    const reader = resp.body.getReader();
+    const decoder = new TextDecoder();
+    let buf = "";
+    let endpointResolved = false;
+    let endpointPath = "";
+    let streamEnded = false;
+    let streamError = null;
+    const events = [];
+    let queueResolver = null;
+    function wake() {
+        const r = queueResolver;
+        if (r) {
+            queueResolver = null;
+            r();
+        }
+    }
+    function pushEvent(ev) {
+        events.push(ev);
+        wake();
+    }
+    // Pump the SSE stream in the background.
+    const pump = (async () => {
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buf += decoder.decode(value, { stream: true });
+                let sep;
+                while ((sep = buf.indexOf("\n\n")) >= 0) {
+                    const chunk = buf.slice(0, sep);
+                    buf = buf.slice(sep + 2);
+                    const lines = chunk.split("\n");
+                    const event = lines
+                        .find((l) => l.startsWith("event:"))
+                        ?.slice("event:".length)
+                        .trim();
+                    const data = lines
+                        .filter((l) => l.startsWith("data:"))
+                        .map((l) => l.slice("data:".length).replace(/^\s/, ""))
+                        .join("\n");
+                    if (event === "endpoint" && !endpointResolved) {
+                        endpointPath = data.trim();
+                        endpointResolved = true;
+                        wake();
+                        continue;
+                    }
+                    if (event === "message" || (!event && data)) {
+                        try {
+                            const parsed = JSON.parse(data);
+                            pushEvent(parsed);
+                        }
+                        catch {
+                            log.warn("bridge.sse_parse_failed", { data: data.slice(0, 120) });
+                        }
+                    }
+                }
+            }
+        }
+        catch (err) {
+            if (!controller.signal.aborted) {
+                const msg = err instanceof Error ? err.message : String(err);
+                streamError = msg;
+                // `terminated` is undici's keep-alive idle drop — happens on
+                // long-idle SSE in manual tests. The MCP client wrapping us
+                // (Cursor / Claude Desktop) will re-spawn the process if it
+                // needs the bridge again, so a clean exit is fine.
+                if (msg === "terminated" || msg.includes("ECONNRESET")) {
+                    log.warn("bridge.sse_idle_closed", { reason: msg });
+                }
+                else {
+                    log.error("bridge.sse_pump_error", { err: msg });
+                }
+            }
+        }
+        finally {
+            streamEnded = true;
+            // Wake any waiter so they see EOF.
+            wake();
+        }
+    })();
+    // Wait for the `endpoint` event (or first message) before returning.
+    while (!endpointResolved) {
+        if (streamEnded) {
+            controller.abort();
+            throw new Error(`MemWal relayer SSE handshake ended before endpoint event${streamError ? `: ${streamError}` : ""}`);
+        }
+        await new Promise((r) => (queueResolver = r));
+    }
+    const iter = {
+        async next() {
+            while (events.length === 0) {
+                if (controller.signal.aborted)
+                    return { value: undefined, done: true };
+                await new Promise((r) => (queueResolver = r));
+            }
+            return { value: events.shift(), done: false };
+        },
+    };
+    // `endpointPath` may be relative (`/api/mcp/messages?sessionId=...`) or
+    // absolute. Make it absolute for `fetch()`.
+    const postUrl = endpointPath.startsWith("http")
+        ? endpointPath
+        : `${relayerUrl.replace(/\/+$/, "")}${endpointPath}`;
+    return {
+        postUrl,
+        iter,
+        abort: () => {
+            controller.abort();
+            void pump; // suppress unused warning
+        },
+    };
+}
+async function postMessage(postUrl, msg) {
+    const resp = await fetch(postUrl, {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(msg),
+    });
+    if (!resp.ok && resp.status !== 202) {
+        const body = await resp.text();
+        log.warn("bridge.post_non_ok", { status: resp.status, body: body.slice(0, 200) });
+    }
+    return resp.status;
+}
+function readStdinLines(onLine) {
+    return new Promise((resolve) => {
+        let buf = "";
+        process.stdin.setEncoding("utf8");
+        process.stdin.on("data", (chunk) => {
+            buf += chunk;
+            let nl;
+            while ((nl = buf.indexOf("\n")) >= 0) {
+                const line = buf.slice(0, nl).replace(/\r$/, "");
+                buf = buf.slice(nl + 1);
+                if (line.length > 0)
+                    onLine(line);
+            }
+        });
+        process.stdin.on("end", () => resolve());
+        process.stdin.on("close", () => resolve());
+    });
+}
+function writeStdoutMessage(msg) {
+    process.stdout.write(JSON.stringify(msg) + "\n");
+}
+/**
+ * Open the SSE bridge and forward stdio ↔ relayer until stdin closes.
+ *
+ * On SSE drop (idle timeout in the Rust proxy / undici keep-alive / network
+ * blip), we transparently reopen the stream — the relayer issues a fresh
+ * sessionId, we route subsequent POSTs there. stdin stays open the whole
+ * time, so the MCP client (Cursor / Claude Desktop / etc.) never sees the
+ * reconnection.
+ */
+export async function runBridge(creds) {
+    note(`Connecting to ${creds.relayerUrl}...`);
+    log.info("bridge.connecting", {
+        relayer: creds.relayerUrl,
+        accountId: creds.accountId,
+        delegate: creds.delegateAddress,
+    });
+    // Live handle to the current SSE stream — replaced whenever we reconnect.
+    let sse = await openSseStream(creds.relayerUrl, creds);
+    note(`Connected. Bridging stdio MCP ↔ ${creds.relayerUrl}`);
+    log.info("bridge.connected", { relayer: creds.relayerUrl });
+    let stdinClosed = false;
+    let reconnecting = false;
+    let reconnectAttempt = 0;
+    // In-flight requests pending a response. We replay them after a forced
+    // reconnect so a server-side session swap doesn't strand a tool call
+    // forever waiting for a reply that will never come. Notifications
+    // (no id) and responses (no method) are not tracked.
+    const inFlight = new Map();
+    async function reconnect(reason) {
+        if (stdinClosed || reconnecting)
+            return;
+        reconnecting = true;
+        try {
+            sse.abort();
+        }
+        catch {
+            /* already dead */
+        }
+        const backoff = Math.min(15_000, 500 * Math.pow(2, reconnectAttempt));
+        reconnectAttempt += 1;
+        log.warn("bridge.reconnecting", { reason, backoffMs: backoff, attempt: reconnectAttempt });
+        await new Promise((r) => setTimeout(r, backoff));
+        try {
+            sse = await openSseStream(creds.relayerUrl, creds);
+            reconnectAttempt = 0;
+            log.info("bridge.reconnected", {
+                relayer: creds.relayerUrl,
+                replayCount: inFlight.size,
+            });
+            // Replay any requests that haven't been answered yet against the
+            // fresh session. Iterate over a snapshot — postMessage is async
+            // and the SSE pump may delete entries concurrently as replies
+            // start arriving on the new session.
+            for (const [id, msg] of Array.from(inFlight.entries())) {
+                try {
+                    const status = await postMessage(sse.postUrl, msg);
+                    log.info("bridge.replayed", { id, status });
+                }
+                catch (err) {
+                    log.error("bridge.replay_failed", {
+                        id,
+                        err: err instanceof Error ? err.message : String(err),
+                    });
+                }
+            }
+        }
+        catch (err) {
+            log.error("bridge.reconnect_failed", {
+                err: err instanceof Error ? err.message : String(err),
+            });
+            // Try again on the next stdin message rather than spinning.
+        }
+        finally {
+            reconnecting = false;
+        }
+    }
+    // Server → client: stream SSE messages to stdout. Loop forever, restart
+    // pump on stream end (which means SSE got cut → we already reconnected).
+    const serverPump = (async () => {
+        while (!stdinClosed) {
+            try {
+                while (true) {
+                    const { value, done } = await sse.iter.next();
+                    if (done)
+                        break;
+                    // Clear in-flight tracking once the response lands.
+                    if (value &&
+                        (value.result !== undefined || value.error !== undefined) &&
+                        value.id !== undefined &&
+                        value.id !== null) {
+                        inFlight.delete(value.id);
+                    }
+                    writeStdoutMessage(value);
+                }
+            }
+            catch (err) {
+                log.error("bridge.server_pump_error", {
+                    err: err instanceof Error ? err.message : String(err),
+                });
+            }
+            if (stdinClosed)
+                break;
+            // Stream ended unexpectedly — reconnect and resume.
+            await reconnect("server-pump-eof");
+        }
+    })();
+    // Client → server: forward stdin lines as POST messages. On 404 (the
+    // relayer doesn't know our sessionId — happens right after a reconnect
+    // if the message races the new handshake), trigger another reconnect.
+    const clientPump = readStdinLines((line) => {
+        void (async () => {
+            try {
+                const msg = JSON.parse(line);
+                // Track requests (have both method and id) so we can replay
+                // them on reconnect. Notifications and responses are not
+                // tracked.
+                if (msg.method !== undefined &&
+                    msg.id !== undefined &&
+                    msg.id !== null) {
+                    inFlight.set(msg.id, msg);
+                }
+                const status = await postMessage(sse.postUrl, msg);
+                if (status === 404) {
+                    log.warn("bridge.session_stale", { sessionUrl: sse.postUrl });
+                    // reconnect() itself replays in-flight against the fresh
+                    // session, so no explicit per-message retry is needed.
+                    await reconnect("post-404");
+                }
+            }
+            catch {
+                log.warn("bridge.stdin_parse_failed", { line: line.slice(0, 120) });
+            }
+        })();
+    }).then(() => {
+        stdinClosed = true;
+        sse.abort();
+    });
+    await Promise.race([serverPump, clientPump]);
+    sse.abort();
+    log.info("bridge.closed", {});
+}
+//# sourceMappingURL=bridge.js.map

package/dist/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAoBxC,KAAK,UAAU,aAAa,CACxB,UAAkB,EAClB,KAAwB;IAExB,MAAM,GAAG,GAAG,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,cAAc,CAAC;IAC5D,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IAEzC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;QAC1B,MAAM,EAAE,KAAK;QACb,OAAO,EAAE;YACL,aAAa,EAAE,UAAU,KAAK,CAAC,kBAAkB,EAAE;YACnD,qBAAqB,EAAE,KAAK,CAAC,SAAS;YACtC,MAAM,EAAE,mBAAmB;YAC3B,eAAe,EAAE,UAAU;SAC9B;QACD,MAAM,EAAE,UAAU,CAAC,MAAM;KAC5B,CAAC,CAAC;IAEH,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QACtB,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACzC,kEAAkE;QAClE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,mEAAmE;QACnE,+DAA+D;QAC/D,iEAAiE;QACjE,2DAA2D;QAC3D,MAAM,IAAI,KAAK,CACX,kDAAkD;YAC9C,yDAAyD;YACzD,qDAAqD;YACrD,kBAAkB,SAAS,EAAE,sBAAsB;YACnD,uDAAuD,CAC9D,CAAC;IACN,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACX,6CAA6C,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CACnF,CAAC;IACN,CAAC;IAED,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC/B,UAAU,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CACX,oDAAoD,EAAE,oBAAoB,CAC7E,CAAC;IACN,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAC7B,IAAI,YAAY,GAAG,EAAE,CAAC;IACtB,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,WAAW,GAAkB,IAAI,CAAC;IACtC,MAAM,MAAM,GAAiB,EAAE,CAAC;IAEhC,IAAI,aAAa,GAAiB,IAAI,CAAC;IACvC,SAAS,IAAI;QACT,MAAM,CAAC,GAAG,aAAa,CAAC;QACxB,IAAI,CAAC,EAAE,CAAC;YACJ,aAAa,GAAG,IAAI,CAAC;YACrB,CAAC,EAAE,CAAC;QACR,CAAC;IACL,CAAC;IAED,SAAS,SAAS,CAAC,EAAc;QAC7B,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAChB,IAAI,EAAE,CAAC;IACX,CAAC;IAED,yCAAyC;IACzC,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;QACrB,IAAI,CAAC;YACD,OAAO,IAAI,EAAE,CAAC;gBACV,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,IAAI;oBAAE,MAAM;gBAChB,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,IAAI,GAAW,CAAC;gBAChB,OAAO,CAAC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACtC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;oBAChC,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAChC,MAAM,KAAK,GAAG,KAAK;yBACd,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;wBACpC,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;yBACvB,IAAI,EAAE,CAAC;oBACZ,MAAM,IAAI,GAAG,KAAK;yBACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;yBACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;yBACtD,IAAI,CAAC,IAAI,CAAC,CAAC;oBAChB,IAAI,KAAK,KAAK,UAAU,IAAI,CAAC,gBAAgB,EAAE,CAAC;wBAC5C,YAAY,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;wBAC3B,gBAAgB,GAAG,IAAI,CAAC;wBACxB,IAAI,EAAE,CAAC;wBACP,SAAS;oBACb,CAAC;oBACD,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC;wBAC1C,IAAI,CAAC;4BACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;4BAC9C,SAAS,CAAC,MAAM,CAAC,CAAC;wBACtB,CAAC;wBAAC,MAAM,CAAC;4BACL,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;wBACtE,CAAC;oBACL,CAAC;gBACL,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBAC7D,WAAW,GAAG,GAAG,CAAC;gBAClB,6DAA6D;gBAC7D,4DAA4D;gBAC5D,4DAA4D;gBAC5D,mDAAmD;gBACnD,IAAI,GAAG,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrD,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;gBACxD,CAAC;qBAAM,CAAC;oBACJ,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;gBACrD,CAAC;YACL,CAAC;QACL,CAAC;gBAAS,CAAC;YACP,WAAW,GAAG,IAAI,CAAC;YACnB,mCAAmC;YACnC,IAAI,EAAE,CAAC;QACX,CAAC;IACL,CAAC,CAAC,EAAE,CAAC;IAEL,qEAAqE;IACrE,OAAO,CAAC,gBAAgB,EAAE,CAAC;QACvB,IAAI,WAAW,EAAE,CAAC;YACd,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACX,2DAA2D,WAAW,CAAC,CAAC,CAAC,KAAK,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CACrG,CAAC;QACN,CAAC;QACD,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,IAAI,GAA8B;QACpC,KAAK,CAAC,IAAI;YACN,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;oBAAE,OAAO,EAAE,KAAK,EAAE,SAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;gBAChF,MAAM,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC;YACxD,CAAC;YACD,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACnD,CAAC;KACJ,CAAC;IAEF,wEAAwE;IACxE,4CAA4C;IAC5C,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,CAAC,MAAM,CAAC;QAC3C,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,YAAY,EAAE,CAAC;IAEzD,OAAO;QACH,OAAO;QACP,IAAI;QACJ,KAAK,EAAE,GAAG,EAAE;YACR,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,KAAK,IAAI,CAAC,CAAC,0BAA0B;QACzC,CAAC;KACJ,CAAC;AACN,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAe,EAAE,GAAe;IACvD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,OAAO,EAAE;QAC9B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC;KAC5B,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC/B,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,MAA8B;IAClD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC3B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YACvC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACjD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;oBAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACtC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;QACzC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/C,CAAC,CAAC,CAAC;AACP,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAAwB;IACpD,IAAI,CAAC,iBAAiB,KAAK,CAAC,UAAU,KAAK,CAAC,CAAC;IAC7C,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE;QAC1B,OAAO,EAAE,KAAK,CAAC,UAAU;QACzB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,eAAe;KAClC,CAAC,CAAC;IAEH,0EAA0E;IAC1E,IAAI,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC,mCAAmC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAE5D,IAAI,WAAW,GAAG,KAAK,CAAC;IACxB,IAAI,YAAY,GAAG,KAAK,CAAC;IACzB,IAAI,gBAAgB,GAAG,CAAC,CAAC;IAEzB,uEAAuE;IACvE,qEAAqE;IACrE,kEAAkE;IAClE,qDAAqD;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA+B,CAAC;IAExD,KAAK,UAAU,SAAS,CAAC,MAAc;QACnC,IAAI,WAAW,IAAI,YAAY;YAAE,OAAO;QACxC,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACD,GAAG,CAAC,KAAK,EAAE,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,kBAAkB;QACtB,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,CAAC;QACtE,gBAAgB,IAAI,CAAC,CAAC;QACtB,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3F,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QACjD,IAAI,CAAC;YACD,GAAG,GAAG,MAAM,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACnD,gBAAgB,GAAG,CAAC,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE;gBAC3B,OAAO,EAAE,KAAK,CAAC,UAAU;gBACzB,WAAW,EAAE,QAAQ,CAAC,IAAI;aAC7B,CAAC,CAAC;YACH,iEAAiE;YACjE,gEAAgE;YAChE,8DAA8D;YAC9D,qCAAqC;YACrC,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;gBACrD,IAAI,CAAC;oBACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACnD,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAChD,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACX,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE;wBAC9B,EAAE;wBACF,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;qBACxD,CAAC,CAAC;gBACP,CAAC;YACL,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,yBAAyB,EAAE;gBACjC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;YACH,4DAA4D;QAChE,CAAC;gBAAS,CAAC;YACP,YAAY,GAAG,KAAK,CAAC;QACzB,CAAC;IACL,CAAC;IAED,wEAAwE;IACxE,yEAAyE;IACzE,MAAM,UAAU,GAAG,CAAC,KAAK,IAAI,EAAE;QAC3B,OAAO,CAAC,WAAW,EAAE,CAAC;YAClB,IAAI,CAAC;gBACD,OAAO,IAAI,EAAE,CAAC;oBACV,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;oBAC9C,IAAI,IAAI;wBAAE,MAAM;oBAChB,oDAAoD;oBACpD,IACI,KAAK;wBACL,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC;wBACzD,KAAK,CAAC,EAAE,KAAK,SAAS;wBACtB,KAAK,CAAC,EAAE,KAAK,IAAI,EACnB,CAAC;wBACC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;oBAC9B,CAAC;oBACD,kBAAkB,CAAC,KAAK,CAAC,CAAC;gBAC9B,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,GAAG,CAAC,KAAK,CAAC,0BAA0B,EAAE;oBAClC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;iBACxD,CAAC,CAAC;YACP,CAAC;YACD,IAAI,WAAW;gBAAE,MAAM;YACvB,oDAAoD;YACpD,MAAM,SAAS,CAAC,iBAAiB,CAAC,CAAC;QACvC,CAAC;IACL,CAAC,CAAC,EAAE,CAAC;IAEL,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE;QACvC,KAAK,CAAC,KAAK,IAAI,EAAE;YACb,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;gBAC3C,4DAA4D;gBAC5D,yDAAyD;gBACzD,WAAW;gBACX,IACI,GAAG,CAAC,MAAM,KAAK,SAAS;oBACxB,GAAG,CAAC,EAAE,KAAK,SAAS;oBACpB,GAAG,CAAC,EAAE,KAAK,IAAI,EACjB,CAAC;oBACC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;gBAC9B,CAAC;gBACD,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;gBACnD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;oBACjB,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,EAAE,UAAU,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;oBAC9D,yDAAyD;oBACzD,uDAAuD;oBACvD,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;gBAChC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACL,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;YACxE,CAAC;QACL,CAAC,CAAC,EAAE,CAAC;IACT,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;QACT,WAAW,GAAG,IAAI,CAAC;QACnB,GAAG,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IAC7C,GAAG,CAAC,KAAK,EAAE,CAAC;IACZ,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;AAClC,CAAC"}

package/dist/crypto.d.ts

@@ -0,0 +1,16 @@
+declare function hex(bytes: Uint8Array): string;
+declare function fromHex(s: string): Uint8Array;
+export interface Keypair {
+    privateKeyHex: string;
+    publicKeyHex: string;
+    suiAddress: string;
+}
+/** Generate a fresh Ed25519 keypair and derive its Sui address. */
+export declare function generateKeypair(): Promise<Keypair>;
+/**
+ * Sui Ed25519 address: blake2b-256(0x00 || pubkey).
+ * The `0x00` is the Ed25519 scheme flag byte.
+ */
+export declare function deriveSuiAddress(pubKey: Uint8Array): string;
+export { hex as bytesToHex, fromHex as hexToBytes };
+//# sourceMappingURL=crypto.d.ts.map

package/dist/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAMA,iBAAS,GAAG,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAItC;AAED,iBAAS,OAAO,CAAC,CAAC,EAAE,MAAM,GAAG,UAAU,CAOtC;AAED,MAAM,WAAW,OAAO;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,mEAAmE;AACnE,wBAAsB,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC,CAQxD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAM3D;AAED,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,IAAI,UAAU,EAAE,CAAC"}

package/dist/crypto.js

@@ -0,0 +1,41 @@
+/**
+ * Ed25519 helpers — pure-JS via @noble/ed25519.
+ */
+import { getPublicKeyAsync, utils } from "@noble/ed25519";
+import { blake2b } from "@noble/hashes/blake2.js";
+function hex(bytes) {
+    return Array.from(bytes)
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+}
+function fromHex(s) {
+    const clean = s.startsWith("0x") ? s.slice(2) : s;
+    const out = new Uint8Array(clean.length / 2);
+    for (let i = 0; i < out.length; i++) {
+        out[i] = parseInt(clean.slice(i * 2, i * 2 + 2), 16);
+    }
+    return out;
+}
+/** Generate a fresh Ed25519 keypair and derive its Sui address. */
+export async function generateKeypair() {
+    const seed = utils.randomPrivateKey(); // 32 bytes
+    const pub = await getPublicKeyAsync(seed);
+    return {
+        privateKeyHex: hex(seed),
+        publicKeyHex: hex(pub),
+        suiAddress: deriveSuiAddress(pub),
+    };
+}
+/**
+ * Sui Ed25519 address: blake2b-256(0x00 || pubkey).
+ * The `0x00` is the Ed25519 scheme flag byte.
+ */
+export function deriveSuiAddress(pubKey) {
+    const buf = new Uint8Array(1 + pubKey.length);
+    buf[0] = 0x00;
+    buf.set(pubKey, 1);
+    const digest = blake2b.create({ dkLen: 32 }).update(buf).digest();
+    return "0x" + hex(digest);
+}
+export { hex as bytesToHex, fromHex as hexToBytes };
+//# sourceMappingURL=crypto.js.map

package/dist/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","sourceRoot":"","sources":["../src/crypto.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC1D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAElD,SAAS,GAAG,CAAC,KAAiB;IAC1B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,CAAS;IACtB,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAClD,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAQD,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,WAAW;IAClD,MAAM,GAAG,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAC1C,OAAO;QACH,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC;QACxB,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC;QACtB,UAAU,EAAE,gBAAgB,CAAC,GAAG,CAAC;KACpC,CAAC;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAkB;IAC/C,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IACd,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC;IAClE,OAAO,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;AAC9B,CAAC;AAED,OAAO,EAAE,GAAG,IAAI,UAAU,EAAE,OAAO,IAAI,UAAU,EAAE,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,6 @@
+export declare function main(argv?: string[]): Promise<void>;
+export { loadCreds, saveCreds, clearCreds, credsPath } from "./auth.js";
+export { loginFlow } from "./login.js";
+export { runBridge } from "./bridge.js";
+export type { MemWalCredentials } from "./auth.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA2FA,wBAAsB,IAAI,CAAC,IAAI,GAAE,MAAM,EAA0B,GAAG,OAAO,CAAC,IAAI,CAAC,CA2GhF;AA+DD,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -0,0 +1,240 @@
+/**
+ * MemWal MCP — orchestrator.
+ *
+ * Boot sequence:
+ *   1. If `--logout` flag → wipe credentials.json and exit.
+ *   2. Load credentials from `~/.memwal/credentials.json`.
+ *   3. If missing → run `loginFlow()` (browser-based wallet sign-in).
+ *   4. Bridge stdio MCP ↔ remote SSE relayer using the loaded credentials.
+ *   5. On 401 (revoked key), the bridge wipes credentials before throwing
+ *      — the next process spawn will re-trigger login.
+ */
+import { clearCreds, credsPath, loadCreds } from "./auth.js";
+import { runAuthRequiredServer } from "./auth-required.js";
+import { runBridge } from "./bridge.js";
+import { loginFlow } from "./login.js";
+import { log, note } from "./logger.js";
+/** Per-environment URL shortcuts. `--dev`/`--staging`/`--local` set both
+ *  relayer + web in one flag. Explicit `--relayer` / `--web-url` override. */
+const ENV_PRESETS = {
+    prod: { relayer: "https://relayer.memwal.ai", web: "https://memwal.ai" },
+    dev: { relayer: "https://relayer.dev.memwal.ai", web: "https://dev.memwal.ai" },
+    staging: { relayer: "https://relayer.staging.memwal.ai", web: "https://staging.memwal.ai" },
+    local: { relayer: "http://127.0.0.1:8000", web: "http://localhost:5173" },
+};
+function parseArgs(argv) {
+    const out = { help: false, logout: false, forceLogin: false };
+    for (let i = 0; i < argv.length; i++) {
+        const a = argv[i];
+        const next = () => argv[++i];
+        switch (a) {
+            case "--help":
+            case "-h":
+                out.help = true;
+                break;
+            case "--logout":
+                out.logout = true;
+                break;
+            case "--login":
+            case "login":
+                out.forceLogin = true;
+                break;
+            case "--prod":
+            case "--dev":
+            case "--staging":
+            case "--local": {
+                const preset = ENV_PRESETS[a.slice(2)];
+                if (preset) {
+                    out.relayerUrl ??= preset.relayer;
+                    out.webUrl ??= preset.web;
+                }
+                break;
+            }
+            case "--relayer":
+            case "--relayer-url":
+                out.relayerUrl = next();
+                break;
+            case "--web-url":
+            case "--web":
+                out.webUrl = next();
+                break;
+            case "--label":
+                out.label = next();
+                break;
+            default:
+                // Allow `--relayer=URL` and `--web-url=URL` forms too.
+                if (a?.startsWith("--relayer="))
+                    out.relayerUrl = a.split("=", 2)[1];
+                else if (a?.startsWith("--web-url="))
+                    out.webUrl = a.split("=", 2)[1];
+                else if (a?.startsWith("--label="))
+                    out.label = a.split("=", 2)[1];
+                // Unknown flag: ignore silently.
+                break;
+        }
+    }
+    return out;
+}
+export async function main(argv = process.argv.slice(2)) {
+    const args = parseArgs(argv);
+    if (args.help) {
+        printHelp();
+        return;
+    }
+    if (args.logout) {
+        clearCreds();
+        note(`Credentials removed (${credsPath()}).`);
+        return;
+    }
+    if (args.forceLogin) {
+        clearCreds();
+    }
+    // Resolve URLs: CLI > env > default.
+    const relayerUrl = args.relayerUrl ?? process.env.MEMWAL_SERVER_URL ?? "https://relayer.memwal.ai";
+    const webUrl = args.webUrl ?? process.env.MEMWAL_WEB_URL ?? "https://memwal.ai";
+    // Label is the on-chain delegate-key name shown in the dashboard. We
+    // default to a generic value at registration time — the bridge updates
+    // it to the actual client's `clientInfo.name` ("Cursor", "Claude",
+    // "Antigravity", ...) after the first MCP `initialize` request. User
+    // can rename anytime from the dashboard.
+    const label = args.label ?? process.env.MEMWAL_CLIENT_LABEL ?? "MCP Client";
+    let creds = loadCreds();
+    if (creds && args.relayerUrl && creds.relayerUrl !== args.relayerUrl) {
+        // Caller wants a different relayer than what's saved. NEVER silently
+        // mutate the saved relayerUrl — a malicious config snippet (e.g.
+        // copy-pasted from a forum) carrying `--relayer https://attacker`
+        // would otherwise rewrite the saved creds so even subsequent runs
+        // without the flag ship the seed to the attacker (audit H4).
+        //
+        // In-memory override is fine for THIS process — the saved file is
+        // left untouched, so the next spawn falls back to the saved URL.
+        log.warn("creds.relayer_override.transient_only", {
+            saved: creds.relayerUrl,
+            override: args.relayerUrl,
+        });
+        note(`--relayer flag (${args.relayerUrl}) overrides saved relayer ` +
+            `(${creds.relayerUrl}) for THIS process only. The saved file ` +
+            `is not modified. To rotate the saved relayer, run ` +
+            `\`memwal-mcp login --logout\` then a fresh login.`);
+        creds = { ...creds, relayerUrl: args.relayerUrl };
+    }
+    const wasLoggedIn = !!creds;
+    if (!creds) {
+        if (!process.stdin.isTTY) {
+            // Spawned by an MCP client (Cursor / Claude Desktop / etc.).
+            // Instead of exiting — which makes the client UI show "Failed to
+            // start" with no actionable next step — boot a minimal stdio MCP
+            // server that responds to `initialize` and `tools/list` but
+            // returns an `isError: true` envelope on every `tools/call` with
+            // a friendly login instruction. The user sees the message
+            // INLINE in their chat, not buried in stderr logs.
+            //
+            // Phase B.5 (see plans/memwal-mcp-package-with-login.md) will
+            // replace this with the MCP OAuth flow so the client's host
+            // drives the browser dance and retries the tool call
+            // automatically — no client restart required.
+            log.warn("creds.missing_at_spawn.serving_auth_required", {
+                credsPath: credsPath(),
+            });
+            await runAuthRequiredServer();
+            return;
+        }
+        // TTY = manual invocation. Block on the browser flow as before.
+        note("MemWal MCP is not authorized yet — opening browser to connect your Sui wallet.");
+        creds = await loginFlow({ relayerUrl, webUrl, label });
+        note(`Authorized as ${creds.walletAddress.slice(0, 10)}...`);
+    }
+    else {
+        log.info("creds.loaded", {
+            accountId: creds.accountId,
+            delegateAddress: creds.delegateAddress,
+            label: creds.label,
+            relayerUrl: creds.relayerUrl,
+        });
+    }
+    // Manual invocation from a real terminal: print status and exit.
+    // Bridge mode only makes sense when an MCP client is attached on the
+    // other end of stdin (Cursor / Claude Desktop / ...). A TTY means the
+    // user is the one looking at stdout — there's no MCP client to bridge
+    // with, so hanging the process is the wrong default.
+    if (process.stdin.isTTY) {
+        note(``);
+        if (wasLoggedIn) {
+            note(`✅ Already authorized as ${creds.walletAddress.slice(0, 10)}...${creds.walletAddress.slice(-6)}`);
+            note(`   Account:  ${creds.accountId}`);
+            note(`   Relayer:  ${creds.relayerUrl}`);
+        }
+        else {
+            note(`✅ Login complete. Credentials saved to ${credsPath()}`);
+        }
+        note(``);
+        note(`Next: add this package to your MCP client config (Cursor / Claude Desktop / etc).`);
+        note(`See \`memwal-mcp --help\` for ready-to-paste snippets.`);
+        return;
+    }
+    await runBridge(creds);
+}
+function printHelp() {
+    const help = [
+        "memwal-mcp — MemWal Model Context Protocol client",
+        "",
+        "Usage:",
+        "  memwal-mcp                       Run the MCP stdio server (default).",
+        "                                   Triggers a one-time browser login",
+        "                                   if ~/.memwal/credentials.json is",
+        "                                   missing.",
+        "  memwal-mcp login                 Force re-authentication (wipes",
+        "                                   existing credentials and opens",
+        "                                   browser).",
+        "  memwal-mcp --logout              Delete saved credentials without",
+        "                                   re-running login.",
+        "  memwal-mcp --help                Show this help.",
+        "",
+        "Options:",
+        "  --relayer <url>                  Override the relayer base URL.",
+        "                                   Default: https://relayer.memwal.ai",
+        "                                   (or saved value from credentials).",
+        "  --web-url <url>                  Override the dashboard URL the",
+        "                                   browser opens during login.",
+        "                                   Default: https://memwal.ai",
+        "  --label <text>                   Friendly delegate-key label",
+        "                                   registered on-chain. Default:",
+        '                                   "MemWal MCP"',
+        "",
+        "Environment (equivalent to options):",
+        "  MEMWAL_SERVER_URL                same as --relayer",
+        "  MEMWAL_WEB_URL                   same as --web-url",
+        "  MEMWAL_CLIENT_LABEL              same as --label",
+        "  MEMWAL_MCP_DEBUG=1               Verbose stderr logging.",
+        "",
+        "Minimal MCP client config (Cursor, Claude Desktop, etc.):",
+        "  {",
+        '    "mcpServers": {',
+        '      "memwal": {',
+        '        "command": "npx",',
+        '        "args": ["-y", "@mysten-incubation/memwal-mcp"]',
+        "      }",
+        "    }",
+        "  }",
+        "",
+        "With explicit relayer override (e.g. dev environment):",
+        "  {",
+        '    "mcpServers": {',
+        '      "memwal": {',
+        '        "command": "npx",',
+        '        "args": [',
+        '          "-y", "@mysten-incubation/memwal-mcp",',
+        '          "--relayer", "https://relayer.dev.memwal.ai"',
+        "        ]",
+        "      }",
+        "    }",
+        "  }",
+        "",
+    ].join("\n");
+    process.stderr.write(help + "\n");
+}
+// Re-exports — handy if someone wants to embed this in another tool.
+export { loadCreds, saveCreds, clearCreds, credsPath } from "./auth.js";
+export { loginFlow } from "./login.js";
+export { runBridge } from "./bridge.js";
+//# sourceMappingURL=index.js.map