@mysten-incubation/memwal-mcp 0.0.1-dev.0

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAgBxC;8EAC8E;AAC9E,MAAM,WAAW,GAAqD;IAClE,IAAI,EAAE,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,EAAE,mBAAmB,EAAE;IACxE,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,GAAG,EAAE,uBAAuB,EAAE;IAC/E,OAAO,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,GAAG,EAAE,2BAA2B,EAAE;IAC3F,KAAK,EAAE,EAAE,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,uBAAuB,EAAE;CAC5E,CAAC;AAEF,SAAS,SAAS,CAAC,IAAc;IAC7B,MAAM,GAAG,GAAe,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;IAC1E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACnC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7B,QAAQ,CAAC,EAAE,CAAC;YACR,KAAK,QAAQ,CAAC;YACd,KAAK,IAAI;gBACL,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;gBAChB,MAAM;YACV,KAAK,UAAU;gBACX,GAAG,CAAC,MAAM,GAAG,IAAI,CAAC;gBAClB,MAAM;YACV,KAAK,SAAS,CAAC;YACf,KAAK,OAAO;gBACR,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;gBACtB,MAAM;YACV,KAAK,QAAQ,CAAC;YACd,KAAK,OAAO,CAAC;YACb,KAAK,WAAW,CAAC;YACjB,KAAK,SAAS,CAAC,CAAC,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACvC,IAAI,MAAM,EAAE,CAAC;oBACT,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,OAAO,CAAC;oBAClC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC,GAAG,CAAC;gBAC9B,CAAC;gBACD,MAAM;YACV,CAAC;YACD,KAAK,WAAW,CAAC;YACjB,KAAK,eAAe;gBAChB,GAAG,CAAC,UAAU,GAAG,IAAI,EAAE,CAAC;gBACxB,MAAM;YACV,KAAK,WAAW,CAAC;YACjB,KAAK,OAAO;gBACR,GAAG,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;gBACpB,MAAM;YACV,KAAK,SAAS;gBACV,GAAG,CAAC,KAAK,GAAG,IAAI,EAAE,CAAC;gBACnB,MAAM;YACV;gBACI,uDAAuD;gBACvD,IAAI,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC;oBAAE,GAAG,CAAC,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;qBAChE,IAAI,CAAC,EAAE,UAAU,CAAC,YAAY,CAAC;oBAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;qBACjE,IAAI,CAAC,EAAE,UAAU,CAAC,UAAU,CAAC;oBAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACnE,iCAAiC;gBACjC,MAAM;QACd,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,OAAiB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE7B,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,SAAS,EAAE,CAAC;QACZ,OAAO;IACX,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACd,UAAU,EAAE,CAAC;QACb,IAAI,CAAC,wBAAwB,SAAS,EAAE,IAAI,CAAC,CAAC;QAC9C,OAAO;IACX,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAClB,UAAU,EAAE,CAAC;IACjB,CAAC;IAED,qCAAqC;IACrC,MAAM,UAAU,GACZ,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B,CAAC;IACpF,MAAM,MAAM,GACR,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,mBAAmB,CAAC;IACrE,qEAAqE;IACrE,uEAAuE;IACvE,mEAAmE;IACnE,qEAAqE;IACrE,yCAAyC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY,CAAC;IAE5E,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;IACxB,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;QACnE,qEAAqE;QACrE,iEAAiE;QACjE,kEAAkE;QAClE,kEAAkE;QAClE,6DAA6D;QAC7D,EAAE;QACF,kEAAkE;QAClE,iEAAiE;QACjE,GAAG,CAAC,IAAI,CAAC,uCAAuC,EAAE;YAC9C,KAAK,EAAE,KAAK,CAAC,UAAU;YACvB,QAAQ,EAAE,IAAI,CAAC,UAAU;SAC5B,CAAC,CAAC;QACH,IAAI,CACA,mBAAmB,IAAI,CAAC,UAAU,4BAA4B;YAC1D,IAAI,KAAK,CAAC,UAAU,0CAA0C;YAC9D,oDAAoD;YACpD,mDAAmD,CAC1D,CAAC;QACF,KAAK,GAAG,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACvB,6DAA6D;YAC7D,iEAAiE;YACjE,iEAAiE;YACjE,4DAA4D;YAC5D,iEAAiE;YACjE,0DAA0D;YAC1D,mDAAmD;YACnD,EAAE;YACF,8DAA8D;YAC9D,4DAA4D;YAC5D,qDAAqD;YACrD,8CAA8C;YAC9C,GAAG,CAAC,IAAI,CAAC,8CAA8C,EAAE;gBACrD,SAAS,EAAE,SAAS,EAAE;aACzB,CAAC,CAAC;YACH,MAAM,qBAAqB,EAAE,CAAC;YAC9B,OAAO;QACX,CAAC;QACD,gEAAgE;QAChE,IAAI,CACA,gFAAgF,CACnF,CAAC;QACF,KAAK,GAAG,MAAM,SAAS,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,IAAI,CAAC,iBAAiB,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;SAAM,CAAC;QACJ,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,UAAU,EAAE,KAAK,CAAC,UAAU;SAC/B,CAAC,CAAC;IACP,CAAC;IAED,iEAAiE;IACjE,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,qDAAqD;IACrD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YACd,IAAI,CAAC,2BAA2B,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACvG,IAAI,CAAC,gBAAgB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YACxC,IAAI,CAAC,gBAAgB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACJ,IAAI,CAAC,0CAA0C,SAAS,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,EAAE,CAAC,CAAC;QACT,IAAI,CAAC,mFAAmF,CAAC,CAAC;QAC1F,IAAI,CAAC,wDAAwD,CAAC,CAAC;QAC/D,OAAO;IACX,CAAC;IAED,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,SAAS;IACd,MAAM,IAAI,GAAG;QACT,mDAAmD;QACnD,EAAE;QACF,QAAQ;QACR,wEAAwE;QACxE,sEAAsE;QACtE,qEAAqE;QACrE,6CAA6C;QAC7C,mEAAmE;QACnE,mEAAmE;QACnE,8CAA8C;QAC9C,qEAAqE;QACrE,sDAAsD;QACtD,oDAAoD;QACpD,EAAE;QACF,UAAU;QACV,mEAAmE;QACnE,uEAAuE;QACvE,uEAAuE;QACvE,mEAAmE;QACnE,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,kEAAkE;QAClE,iDAAiD;QACjD,EAAE;QACF,sCAAsC;QACtC,sDAAsD;QACtD,sDAAsD;QACtD,oDAAoD;QACpD,4DAA4D;QAC5D,EAAE;QACF,2DAA2D;QAC3D,KAAK;QACL,qBAAqB;QACrB,mBAAmB;QACnB,2BAA2B;QAC3B,yDAAyD;QACzD,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;QACF,wDAAwD;QACxD,KAAK;QACL,qBAAqB;QACrB,mBAAmB;QACnB,2BAA2B;QAC3B,mBAAmB;QACnB,kDAAkD;QAClD,wDAAwD;QACxD,WAAW;QACX,SAAS;QACT,OAAO;QACP,KAAK;QACL,EAAE;KACL,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACb,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,qEAAqE;AACrE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACxE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Tiny stderr logger — one JSON line per event. stdout is reserved for MCP
+ * stdio messages, so logs MUST never go there.
+ */
+export declare const log: {
+    info: (event: string, fields?: Record<string, unknown>) => void;
+    warn: (event: string, fields?: Record<string, unknown>) => void;
+    error: (event: string, fields?: Record<string, unknown>) => void;
+    debug: (event: string, fields?: Record<string, unknown>) => void;
+};
+/** Print a friendly human-readable line to stderr (not JSON). */
+export declare function note(msg: string): void;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAiBH,eAAO,MAAM,GAAG;kBACE,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;kBACxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;mBACvC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;mBACxC,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1D,CAAC;AAEF,iEAAiE;AACjE,wBAAgB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEtC"}

package/dist/logger.js

@@ -0,0 +1,28 @@
+/**
+ * Tiny stderr logger — one JSON line per event. stdout is reserved for MCP
+ * stdio messages, so logs MUST never go there.
+ */
+const DEBUG = !!process.env.MEMWAL_MCP_DEBUG;
+function emit(level, event, fields = {}) {
+    if (level === "debug" && !DEBUG)
+        return;
+    const line = JSON.stringify({
+        ts: new Date().toISOString(),
+        level,
+        scope: "memwal-mcp",
+        event,
+        ...fields,
+    });
+    process.stderr.write(line + "\n");
+}
+export const log = {
+    info: (event, fields) => emit("info", event, fields),
+    warn: (event, fields) => emit("warn", event, fields),
+    error: (event, fields) => emit("error", event, fields),
+    debug: (event, fields) => emit("debug", event, fields),
+};
+/** Print a friendly human-readable line to stderr (not JSON). */
+export function note(msg) {
+    process.stderr.write(`[memwal-mcp] ${msg}\n`);
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAE7C,SAAS,IAAI,CAAC,KAAY,EAAE,KAAa,EAAE,SAAkC,EAAE;IAC3E,IAAI,KAAK,KAAK,OAAO,IAAI,CAAC,KAAK;QAAE,OAAO;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QACxB,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,KAAK;QACL,KAAK,EAAE,YAAY;QACnB,KAAK;QACL,GAAG,MAAM;KACZ,CAAC,CAAC;IACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,MAAM,GAAG,GAAG;IACf,IAAI,EAAE,CAAC,KAAa,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACtF,IAAI,EAAE,CAAC,KAAa,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC;IACtF,KAAK,EAAE,CAAC,KAAa,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;IACxF,KAAK,EAAE,CAAC,KAAa,EAAE,MAAgC,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC;CAC3F,CAAC;AAEF,iEAAiE;AACjE,MAAM,UAAU,IAAI,CAAC,GAAW;IAC5B,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;AAClD,CAAC"}

package/dist/login.d.ts

@@ -0,0 +1,19 @@
+import type { MemWalCredentials } from "./auth.js";
+export interface LoginOptions {
+    /** Base URL of the dashboard's connect page (must accept `?port=&publicKey=`). */
+    webUrl?: string;
+    /** Relayer URL the credentials should be configured for. */
+    relayerUrl?: string;
+    /** Friendly label saved on-chain + in credentials.json — e.g. "Cursor MCP". */
+    label?: string;
+    /** Abort the flow if no callback received within this many ms. */
+    timeoutMs?: number;
+    /** Open the URL ourselves vs print it (`false` is useful in headless CI). */
+    openBrowser?: boolean;
+}
+/**
+ * Run the login flow. Resolves with saved credentials. Caller is expected
+ * to call this only when no valid credentials exist on disk.
+ */
+export declare function loginFlow(opts?: LoginOptions): Promise<MemWalCredentials>;
+//# sourceMappingURL=login.d.ts.map

package/dist/login.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.d.ts","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAKnD,MAAM,WAAW,YAAY;IACzB,kFAAkF;IAClF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6EAA6E;IAC7E,WAAW,CAAC,EAAE,OAAO,CAAC;CACzB;AAgHD;;;GAGG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAyKnF"}

package/dist/login.js

@@ -0,0 +1,272 @@
+/**
+ * Browser-based login flow — port of Walcraft's CLI login pattern.
+ *
+ *   1. Generate Ed25519 keypair locally.
+ *   2. Start an HTTP listener on a random localhost port.
+ *   3. Open the user's browser at the configured web URL with the public
+ *      key + callback port in the query string.
+ *   4. Web page asks user to connect Sui wallet → signs `add_delegate_key`
+ *      on-chain → POSTs the resulting {accountId, walletAddress, packageId,
+ *      txDigest, ...} to `http://localhost:<port>/callback`.
+ *   5. Listener receives the callback, returns 200 + a friendly success
+ *      page, then shuts down. We resolve with `MemWalCredentials`.
+ *
+ * Timeout default is 5 minutes — long enough for a slow wallet popup but
+ * short enough that a forgotten flow doesn't keep an open port forever.
+ */
+import { createServer } from "node:http";
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import open from "open";
+import { saveCreds } from "./auth.js";
+import { generateKeypair } from "./crypto.js";
+import { log, note } from "./logger.js";
+const DEFAULTS = {
+    webUrl: process.env.MEMWAL_WEB_URL ?? "https://memwal.ai",
+    relayerUrl: process.env.MEMWAL_SERVER_URL ?? "https://relayer.memwal.ai",
+    label: process.env.MEMWAL_CLIENT_LABEL ?? "MemWal MCP",
+    timeoutMs: 5 * 60_000,
+    openBrowser: true,
+};
+function isHexAddress(s) {
+    return typeof s === "string" && /^0x[0-9a-fA-F]{64}$/.test(s);
+}
+function isCallback(obj) {
+    if (!obj || typeof obj !== "object")
+        return false;
+    const o = obj;
+    return (isHexAddress(o.accountId) &&
+        isHexAddress(o.walletAddress) &&
+        isHexAddress(o.packageId) &&
+        typeof o.state === "string" &&
+        // 32 random bytes → 64 hex chars. Constant width — anything else is wrong.
+        /^[0-9a-f]{64}$/.test(o.state));
+}
+/**
+ * Constant-time comparison for the state token. `===` would still leak the
+ * common-prefix length via timing in theory; not a realistic remote attack
+ * on a localhost listener, but cheap defense in depth.
+ */
+function stateEquals(a, b) {
+    if (a.length !== b.length)
+        return false;
+    try {
+        return timingSafeEqual(Buffer.from(a, "hex"), Buffer.from(b, "hex"));
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Strip trailing slashes so `https://memwal.ai/` and `https://memwal.ai`
+ * compare equal. The `Origin` request header never carries a trailing slash.
+ */
+function normalizeOrigin(url) {
+    return url.replace(/\/+$/, "");
+}
+const SUCCESS_HTML = `<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8" />
+  <title>MemWal MCP — Connected</title>
+  <style>
+    body { font: 16px/1.5 system-ui, sans-serif; max-width: 480px; margin: 80px auto; padding: 0 24px; color: #1a1a1a; }
+    h1 { font-size: 24px; }
+    .check { display: inline-block; width: 32px; height: 32px; line-height: 32px; text-align: center; border-radius: 50%; background: #22c55e; color: white; font-weight: 700; margin-right: 12px; vertical-align: middle; }
+    p { color: #525252; }
+  </style>
+</head>
+<body>
+  <h1><span class="check">✓</span> MemWal MCP connected</h1>
+  <p>Credentials saved to <code>~/.memwal/credentials.json</code>.</p>
+  <p>You can close this tab — your MCP client will pick up the new credentials automatically.</p>
+</body>
+</html>`;
+const FAIL_HTML_TEMPLATE = (msg) => `<!doctype html>
+<html lang="en">
+<head><meta charset="utf-8" /><title>MemWal MCP — Failed</title>
+<style>body{font:16px/1.5 system-ui,sans-serif;max-width:480px;margin:80px auto;padding:0 24px;color:#1a1a1a}h1{font-size:24px}.x{display:inline-block;width:32px;height:32px;line-height:32px;text-align:center;border-radius:50%;background:#ef4444;color:white;font-weight:700;margin-right:12px;vertical-align:middle}p{color:#525252}</style>
+</head>
+<body>
+  <h1><span class="x">×</span> MemWal MCP login failed</h1>
+  <p>${msg}</p>
+  <p>Close this tab and retry from your MCP client.</p>
+</body></html>`;
+function readBody(req, maxBytes = 16 * 1024) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let len = 0;
+        req.on("data", (c) => {
+            len += c.length;
+            if (len > maxBytes) {
+                reject(new Error("body too large"));
+                req.destroy();
+                return;
+            }
+            chunks.push(c);
+        });
+        req.on("end", () => resolve(Buffer.concat(chunks).toString("utf8")));
+        req.on("error", reject);
+    });
+}
+/**
+ * Run the login flow. Resolves with saved credentials. Caller is expected
+ * to call this only when no valid credentials exist on disk.
+ */
+export async function loginFlow(opts = {}) {
+    const cfg = { ...DEFAULTS, ...opts };
+    const keypair = await generateKeypair();
+    // Cryptographic single-use state token. Round-trip through the browser:
+    // we put it in `connectUrl`, the page echoes it back in the callback
+    // payload, and we constant-time-compare on receipt. Defeats cross-origin
+    // CSRF / DNS-rebinding attacks where a malicious tab races the legitimate
+    // browser to POST forged credentials at our localhost listener.
+    const stateToken = randomBytes(32).toString("hex");
+    // Expected `Origin` header value. The dashboard page that legitimately
+    // POSTs to `/callback` runs on `cfg.webUrl`. Any other Origin is rejected.
+    const expectedOrigin = normalizeOrigin(cfg.webUrl);
+    // 0 → OS picks a free port. Bind 127.0.0.1 only — NOT 0.0.0.0 — so the
+    // listener is unreachable from the LAN.
+    const server = createServer();
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    const port = server.address().port;
+    // Allow `127.0.0.1:PORT` and `localhost:PORT` as the Host header (defeats
+    // DNS rebinding to an attacker-controlled name that resolves to 127.0.0.1).
+    const allowedHosts = new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+    // Build the dashboard URL. `webUrl` may or may not include a path
+    // already — join carefully.
+    const base = cfg.webUrl.replace(/\/+$/, "");
+    const connectUrl = `${base}/connect/mcp` +
+        `?port=${port}` +
+        `&publicKey=${encodeURIComponent(keypair.publicKeyHex)}` +
+        `&delegateAddress=${encodeURIComponent(keypair.suiAddress)}` +
+        `&label=${encodeURIComponent(cfg.label)}` +
+        `&relayer=${encodeURIComponent(cfg.relayerUrl)}` +
+        `&state=${stateToken}`;
+    note(`Opening browser to authorize this MCP client...`);
+    note(`If your browser doesn't open, visit: ${connectUrl}`);
+    log.info("login.start", { port, publicKey: keypair.publicKeyHex, label: cfg.label });
+    let creds = null;
+    let error = null;
+    const done = new Promise((resolve) => {
+        const timer = setTimeout(() => {
+            if (!creds) {
+                error = new Error(`Login timed out after ${cfg.timeoutMs}ms`);
+                server.close();
+                resolve();
+            }
+        }, cfg.timeoutMs).unref?.();
+        void timer;
+        server.on("request", async (req, res) => {
+            // CORS — only the dashboard origin we control may POST. `*` would
+            // let any web page on the internet talk to this localhost port.
+            res.setHeader("access-control-allow-origin", expectedOrigin);
+            res.setHeader("access-control-allow-methods", "POST, OPTIONS");
+            res.setHeader("access-control-allow-headers", "content-type");
+            res.setHeader("vary", "origin");
+            if (req.method === "OPTIONS") {
+                res.writeHead(204);
+                res.end();
+                return;
+            }
+            // DNS-rebinding defense. A browser tricked into resolving
+            // `evil.example` → 127.0.0.1 would still send `Host: evil.example`
+            // — anything that isn't our literal loopback host is a forgery.
+            const hostHeader = (req.headers.host ?? "").toLowerCase();
+            if (!allowedHosts.has(hostHeader)) {
+                log.warn("login.callback_bad_host", { host: hostHeader });
+                res.writeHead(403, { "content-type": "text/plain" });
+                res.end("Forbidden");
+                return;
+            }
+            const url = new URL(req.url ?? "/", `http://127.0.0.1:${port}`);
+            if (url.pathname !== "/callback" || req.method !== "POST") {
+                res.writeHead(404, { "content-type": "text/plain" });
+                res.end("Not found");
+                return;
+            }
+            // Origin check — only the dashboard page may submit the callback.
+            // `null` or missing Origin (e.g. curl, non-browser) is rejected
+            // because the entire flow is initiated by a browser tab.
+            const origin = req.headers.origin;
+            if (typeof origin !== "string" || normalizeOrigin(origin) !== expectedOrigin) {
+                log.warn("login.callback_bad_origin", { origin });
+                res.writeHead(403, { "content-type": "text/plain" });
+                res.end("Forbidden");
+                return;
+            }
+            // Content-Type assertion blocks simple-request smuggling: a CSRF
+            // attacker can POST `text/plain` cross-origin without preflight,
+            // but `application/json` triggers preflight which our restricted
+            // CORS allow-origin will reject.
+            const ct = (req.headers["content-type"] ?? "").toLowerCase();
+            if (!ct.startsWith("application/json")) {
+                res.writeHead(415, { "content-type": "text/plain" });
+                res.end("Content-Type must be application/json");
+                return;
+            }
+            try {
+                const body = await readBody(req);
+                const parsed = JSON.parse(body);
+                if (!isCallback(parsed)) {
+                    res.writeHead(400, { "content-type": "text/html" });
+                    res.end(FAIL_HTML_TEMPLATE("Callback payload missing required fields."));
+                    return;
+                }
+                if (!stateEquals(parsed.state, stateToken)) {
+                    log.warn("login.callback_bad_state", {});
+                    res.writeHead(403, { "content-type": "text/html" });
+                    res.end(FAIL_HTML_TEMPLATE("Callback state mismatch — refusing to save."));
+                    return;
+                }
+                creds = {
+                    delegatePrivateKey: keypair.privateKeyHex,
+                    delegatePublicKeyHex: keypair.publicKeyHex,
+                    delegateAddress: keypair.suiAddress,
+                    walletAddress: parsed.walletAddress,
+                    accountId: parsed.accountId,
+                    packageId: parsed.packageId,
+                    relayerUrl: cfg.relayerUrl,
+                    label: parsed.label ?? cfg.label,
+                    createdAt: new Date().toISOString(),
+                    version: 1,
+                };
+                saveCreds(creds);
+                log.info("login.success", {
+                    accountId: creds.accountId,
+                    delegateAddress: creds.delegateAddress,
+                    label: creds.label,
+                });
+                res.writeHead(200, { "content-type": "text/html" });
+                res.end(SUCCESS_HTML);
+                resolve();
+                // Let the response flush before closing the server.
+                setTimeout(() => server.close(), 100);
+            }
+            catch (err) {
+                error = err instanceof Error ? err : new Error(String(err));
+                res.writeHead(500, { "content-type": "text/html" });
+                res.end(FAIL_HTML_TEMPLATE("Internal error parsing callback."));
+                log.error("login.callback_error", { msg: error.message });
+                setTimeout(() => server.close(), 100);
+                resolve();
+            }
+        });
+    });
+    if (cfg.openBrowser) {
+        try {
+            await open(connectUrl);
+        }
+        catch (err) {
+            log.warn("login.browser_open_failed", {
+                err: err instanceof Error ? err.message : String(err),
+            });
+        }
+    }
+    await done;
+    if (error)
+        throw error;
+    if (!creds)
+        throw new Error("Login flow completed without credentials");
+    return creds;
+}
+//# sourceMappingURL=login.js.map

package/dist/login.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../src/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AAEpF,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,IAAI,MAAM,MAAM,CAAC;AAGxB,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAexC,MAAM,QAAQ,GAA8D;IACxE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,mBAAmB;IACzD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,2BAA2B;IACxE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,YAAY;IACtD,SAAS,EAAE,CAAC,GAAG,MAAM;IACrB,WAAW,EAAE,IAAI;CACpB,CAAC;AAiBF,SAAS,YAAY,CAAC,CAAU;IAC5B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,UAAU,CAAC,GAAY;IAC5B,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACzB,YAAY,CAAC,CAAC,CAAC,aAAa,CAAC;QAC7B,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACzB,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;QAC3B,2EAA2E;QAC3E,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CACjC,CAAC;AACN,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACrC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,CAAC;QACD,OAAO,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,KAAK,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAW;IAChC,OAAO,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACnC,CAAC;AAED,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;QAiBb,CAAC;AAET,MAAM,kBAAkB,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC;;;;;;;OAOrC,GAAG;;eAEK,CAAC;AAEhB,SAAS,QAAQ,CAAC,GAAoB,EAAE,QAAQ,GAAG,EAAE,GAAG,IAAI;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACnC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,GAAG,GAAG,CAAC,CAAC;QACZ,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YACzB,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;YAChB,IAAI,GAAG,GAAG,QAAQ,EAAE,CAAC;gBACjB,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;gBACpC,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO;YACX,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACrE,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACP,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAAqB,EAAE;IACnD,MAAM,GAAG,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,MAAM,eAAe,EAAE,CAAC;IACxC,wEAAwE;IACxE,qEAAqE;IACrE,yEAAyE;IACzE,0EAA0E;IAC1E,gEAAgE;IAChE,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACnD,uEAAuE;IACvE,2EAA2E;IAC3E,MAAM,cAAc,GAAG,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAEnD,uEAAuE;IACvE,wCAAwC;IACxC,MAAM,MAAM,GAAG,YAAY,EAAE,CAAC;IAC9B,MAAM,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;IACpD,0EAA0E;IAC1E,4EAA4E;IAC5E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;IAEzE,kEAAkE;IAClE,4BAA4B;IAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,UAAU,GACZ,GAAG,IAAI,cAAc;QACrB,SAAS,IAAI,EAAE;QACf,cAAc,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE;QACxD,oBAAoB,kBAAkB,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE;QAC5D,UAAU,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;QACzC,YAAY,kBAAkB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE;QAChD,UAAU,UAAU,EAAE,CAAC;IAE3B,IAAI,CAAC,iDAAiD,CAAC,CAAC;IACxD,IAAI,CAAC,wCAAwC,UAAU,EAAE,CAAC,CAAC;IAC3D,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,YAAY,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;IAErF,IAAI,KAAK,GAA6B,IAAI,CAAC;IAC3C,IAAI,KAAK,GAAiB,IAAI,CAAC;IAE/B,MAAM,IAAI,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC1B,IAAI,CAAC,KAAK,EAAE,CAAC;gBACT,KAAK,GAAG,IAAI,KAAK,CAAC,yBAAyB,GAAG,CAAC,SAAS,IAAI,CAAC,CAAC;gBAC9D,MAAM,CAAC,KAAK,EAAE,CAAC;gBACf,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;QAC5B,KAAK,KAAK,CAAC;QAEX,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACrE,kEAAkE;YAClE,gEAAgE;YAChE,GAAG,CAAC,SAAS,CAAC,6BAA6B,EAAE,cAAc,CAAC,CAAC;YAC7D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;YAC/D,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAChC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;gBACV,OAAO;YACX,CAAC;YAED,0DAA0D;YAC1D,mEAAmE;YACnE,gEAAgE;YAChE,MAAM,UAAU,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC1D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;gBAChC,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;gBAC1D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YAED,kEAAkE;YAClE,gEAAgE;YAChE,yDAAyD;YACzD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;YAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,eAAe,CAAC,MAAM,CAAC,KAAK,cAAc,EAAE,CAAC;gBAC3E,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;gBAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACX,CAAC;YAED,iEAAiE;YACjE,iEAAiE;YACjE,iEAAiE;YACjE,iCAAiC;YACjC,MAAM,EAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC7D,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;gBACjD,OAAO;YACX,CAAC;YAED,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACjC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBACtB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,2CAA2C,CAAC,CAAC,CAAC;oBACzE,OAAO;gBACX,CAAC;gBACD,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,EAAE,CAAC;oBACzC,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,EAAE,CAAC,CAAC;oBACzC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,6CAA6C,CAAC,CAAC,CAAC;oBAC3E,OAAO;gBACX,CAAC;gBAED,KAAK,GAAG;oBACJ,kBAAkB,EAAE,OAAO,CAAC,aAAa;oBACzC,oBAAoB,EAAE,OAAO,CAAC,YAAY;oBAC1C,eAAe,EAAE,OAAO,CAAC,UAAU;oBACnC,aAAa,EAAE,MAAM,CAAC,aAAa;oBACnC,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,UAAU,EAAE,GAAG,CAAC,UAAU;oBAC1B,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK;oBAChC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;oBACnC,OAAO,EAAE,CAAC;iBACb,CAAC;gBACF,SAAS,CAAC,KAAK,CAAC,CAAC;gBACjB,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;oBACtC,KAAK,EAAE,KAAK,CAAC,KAAK;iBACrB,CAAC,CAAC;gBAEH,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACtB,OAAO,EAAE,CAAC;gBACV,oDAAoD;gBACpD,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;YAC1C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAC5D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,kCAAkC,CAAC,CAAC,CAAC;gBAChE,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,GAAG,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;gBAC1D,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;gBACtC,OAAO,EAAE,CAAC;YACd,CAAC;QACL,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAI,GAAG,CAAC,WAAW,EAAE,CAAC;QAClB,IAAI,CAAC;YACD,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QAC3B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE;gBAClC,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aACxD,CAAC,CAAC;QACP,CAAC;IACL,CAAC;IAED,MAAM,IAAI,CAAC;IAEX,IAAI,KAAK;QAAE,MAAM,KAAK,CAAC;IACvB,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IACxE,OAAO,KAAK,CAAC;AACjB,CAAC"}

package/package.json

@@ -0,0 +1,56 @@
+{
+    "name": "@mysten-incubation/memwal-mcp",
+    "version": "0.0.1-dev.0",
+    "description": "MemWal MCP client — single-binary stdio MCP server that bridges Cursor / Claude Desktop / Antigravity / Claude Code to the MemWal relayer. Handles browser-based wallet login on first run.",
+    "type": "module",
+    "main": "./dist/index.js",
+    "types": "./dist/index.d.ts",
+    "bin": {
+        "memwal-mcp": "dist/bin/memwal-mcp.js"
+    },
+    "exports": {
+        ".": {
+            "import": "./dist/index.js",
+            "types": "./dist/index.d.ts"
+        }
+    },
+    "scripts": {
+        "build": "tsc",
+        "dev": "tsc --watch",
+        "typecheck": "tsc --noEmit",
+        "start": "node ./dist/bin/memwal-mcp.js"
+    },
+    "dependencies": {
+        "@modelcontextprotocol/sdk": "^1.29.0",
+        "@noble/ed25519": "^2.3.0",
+        "@noble/hashes": "^2.0.0",
+        "open": "^10.1.0"
+    },
+    "devDependencies": {
+        "@types/node": "^20.0.0",
+        "typescript": "^5.5.0"
+    },
+    "files": [
+        "dist",
+        "README.md"
+    ],
+    "keywords": [
+        "ai",
+        "mcp",
+        "model-context-protocol",
+        "memwal",
+        "memory",
+        "claude",
+        "cursor"
+    ],
+    "license": "Apache-2.0",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/MystenLabs/MemWal.git",
+        "directory": "packages/mcp"
+    },
+    "publishConfig": {
+        "access": "public",
+        "registry": "https://registry.npmjs.org/"
+    }
+}