@mysten-incubation/memwal-mcp 0.0.13-dev.4 → 0.0.13-dev.5

package/dist/auth.d.ts

@@ -51,6 +51,35 @@ export declare function loadCreds(): MemWalCredentials | null;
  * they are routine, and a backup per login would just churn the directory.
  */
 export declare function saveCreds(creds: MemWalCredentials): SaveCredsResult;
+/**
+ * Move `tmp` onto `path`, atomically where the platform can.
+ *
+ * POSIX `rename(2)` replaces a destination regardless of who has it open, so
+ * there is nothing to handle there and any error is a real one. Windows
+ * implements the same call as `MoveFileEx(MOVEFILE_REPLACE_EXISTING)`, which
+ * refuses with EPERM / EACCES / EBUSY while another handle holds the
+ * destination — an antivirus scan or a backup agent touching
+ * `credentials.json` is enough. Before this file wrote through a temp inode,
+ * `writeFileSync` to the final path survived that; `login.ts` turns a thrown
+ * `saveCreds` into an HTTP 500, so a lock that lasts a few milliseconds would
+ * otherwise become a failed sign-in.
+ *
+ * So on Windows: retry briefly, then write in place rather than fail. That
+ * fallback gives up the atomic swap, but not the property this function exists
+ * for — Windows does not enforce POSIX mode bits at all, so `0600` was never
+ * doing the work there; NTFS ACLs are, and they are inherited from the
+ * directory either way. On POSIX, where the mode IS the protection, there is no
+ * fallback and no retry.
+ *
+ * `deps` is a seam for tests. CI has no Windows runner, and the fallback is the
+ * one branch here that can leave a second plaintext copy of the delegate key on
+ * disk, so it must be exercisable off Windows.
+ */
+export declare function replaceWithTemp(tmp: string, path: string, contents: string, deps?: {
+    platform?: string;
+    rename?: (from: string, to: string) => void;
+    sleep?: (ms: number) => void;
+}): void;
 /** What `saveCreds` did, so the caller can tell the user precisely — naming
  * both accounts is the difference between a warning they can act on and the
  * silent swap reported in GH #628. */

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAanE;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AAwBD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C"}

package/dist/auth.js

@@ -10,8 +10,9 @@
  * documentation patterns transfer cleanly.
  */
 import { homedir } from "node:os";
-import { join, dirname } from "node:path";
-import { mkdirSync, readFileSync, writeFileSync, chmodSync, unlinkSync, existsSync, copyFileSync, } from "node:fs";
+import { randomUUID } from "node:crypto";
+import { join, dirname, basename } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, } from "node:fs";
 const CREDS_FILE = "credentials.json";
 /** Global, per-machine location. Always the fallback, and the only location
  * before project-scoping existed — a machine with no project-local file keeps
@@ -110,17 +111,124 @@ export function loadCreds() {
 export function saveCreds(creds) {
     const path = credsPath();
     const replaced = backupIfReplacingAnotherAccount(path, creds.accountId);
-    mkdirSync(dirname(path), { recursive: true, mode: 0o700 });
-    writeFileSync(path, JSON.stringify(creds, null, 2), { encoding: "utf8", mode: 0o600 });
-    // writeFileSync's `mode` argument is only honored on file creation; ensure
-    // the permission on an existing file matches.
+    writeSecretFile(path, JSON.stringify(creds, null, 2));
+    return { path, ...replaced };
+}
+/**
+ * Write a file whose bytes are only ever reachable through an inode this call
+ * created at `0600`.
+ *
+ * The obvious version — write to the final path, then `chmod` it — does not
+ * hold that property. `writeFileSync`'s `mode` follows POSIX `open()`: the
+ * kernel applies it when it creates the inode and ignores it for one that
+ * already exists. So a credentials file that anything outside this code left
+ * world-readable (a manual `chmod`, a restored backup, another tool) would
+ * receive the plaintext delegate key under the *old* mode, with a second,
+ * separate syscall to tighten it afterwards. Anyone reading the path in
+ * between gets the key.
+ *
+ * Writing a fresh file and renaming removes that window instead of shortening
+ * it. `rename(2)` repoints the name atomically, so a reader sees either the
+ * whole old file or the whole new one, never a permissive inode holding a new
+ * secret. `wx` (`O_EXCL`) makes a temp path that already exists — an
+ * interrupted earlier run, or a file planted by someone else — a hard failure
+ * rather than a write through a file this code did not create.
+ */
+function writeSecretFile(path, contents) {
+    const dir = dirname(path);
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
+    // Named off the target and randomised, so concurrent saves cannot collide
+    // on it and no one can guess it ahead of time. Dot-prefixed to keep a
+    // crashed run's leftovers out of the way of directory listings.
+    const tmp = join(dir, `.${basename(path)}.${process.pid}.${randomUUID()}.tmp`);
     try {
-        chmodSync(path, 0o600);
+        writeFileSync(tmp, contents, { encoding: "utf8", mode: 0o600, flag: "wx" });
+        replaceWithTemp(tmp, path, contents);
     }
-    catch {
-        /* Windows etc. — best effort */
+    catch (err) {
+        // Never leave a temp file holding the secret behind on a failed write.
+        try {
+            unlinkSync(tmp);
+        }
+        catch {
+            /* already gone, or never created */
+        }
+        throw err;
+    }
+}
+/** Windows errors for "someone else holds the destination open". */
+const WIN32_LOCKED_CODES = new Set(["EPERM", "EACCES", "EBUSY"]);
+const WIN32_RENAME_ATTEMPTS = 5;
+const WIN32_RENAME_BACKOFF_MS = 20;
+/** Block the calling thread. `saveCreds` is synchronous all the way up. */
+function sleepSync(ms) {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+/**
+ * Move `tmp` onto `path`, atomically where the platform can.
+ *
+ * POSIX `rename(2)` replaces a destination regardless of who has it open, so
+ * there is nothing to handle there and any error is a real one. Windows
+ * implements the same call as `MoveFileEx(MOVEFILE_REPLACE_EXISTING)`, which
+ * refuses with EPERM / EACCES / EBUSY while another handle holds the
+ * destination — an antivirus scan or a backup agent touching
+ * `credentials.json` is enough. Before this file wrote through a temp inode,
+ * `writeFileSync` to the final path survived that; `login.ts` turns a thrown
+ * `saveCreds` into an HTTP 500, so a lock that lasts a few milliseconds would
+ * otherwise become a failed sign-in.
+ *
+ * So on Windows: retry briefly, then write in place rather than fail. That
+ * fallback gives up the atomic swap, but not the property this function exists
+ * for — Windows does not enforce POSIX mode bits at all, so `0600` was never
+ * doing the work there; NTFS ACLs are, and they are inherited from the
+ * directory either way. On POSIX, where the mode IS the protection, there is no
+ * fallback and no retry.
+ *
+ * `deps` is a seam for tests. CI has no Windows runner, and the fallback is the
+ * one branch here that can leave a second plaintext copy of the delegate key on
+ * disk, so it must be exercisable off Windows.
+ */
+export function replaceWithTemp(tmp, path, contents, deps = {}) {
+    const platform = deps.platform ?? process.platform;
+    const rename = deps.rename ?? renameSync;
+    const sleep = deps.sleep ?? sleepSync;
+    if (platform !== "win32") {
+        rename(tmp, path);
+        return;
+    }
+    for (let attempt = 1;; attempt++) {
+        try {
+            rename(tmp, path);
+            return;
+        }
+        catch (err) {
+            const code = err.code ?? "";
+            if (!WIN32_LOCKED_CODES.has(code))
+                throw err;
+            if (attempt < WIN32_RENAME_ATTEMPTS) {
+                sleep(WIN32_RENAME_BACKOFF_MS * attempt);
+                continue;
+            }
+            // Still locked. Write through the existing handle's inode rather
+            // than failing the sign-in.
+            writeFileSync(path, contents, { encoding: "utf8", mode: 0o600 });
+            // This returns SUCCESSFULLY, so `writeSecretFile`'s catch never
+            // runs and nothing else will remove `tmp` — which still holds the
+            // plaintext delegate key. Every locked save would otherwise leave
+            // another copy of it beside the credentials file, which is the
+            // opposite of what this whole helper is for.
+            //
+            // Best-effort: a temp that cannot be unlinked must not fail a save
+            // that has already landed.
+            try {
+                unlinkSync(tmp);
+            }
+            catch {
+                /* nothing more to do; the destination write already succeeded */
+            }
+            return;
+        }
     }
-    return { path, ...replaced };
 }
 /**
  * The message shown *before* a sign-in that would overwrite existing
@@ -172,8 +280,10 @@ function backupIfReplacingAnotherAccount(path, incomingAccountId) {
     const stamp = new Date().toISOString().replace(/[:.]/g, "-");
     const backup = join(dirname(path), `credentials.backup-${stamp}.json`);
     try {
-        copyFileSync(path, backup);
-        chmodSync(backup, 0o600);
+        // Through the same writer as the credentials file itself: the backup is
+        // a second copy of the same plaintext delegate key, and `copyFileSync`
+        // would create it under the process umask before any tightening.
+        writeSecretFile(backup, readFileSync(path, "utf8"));
         return { replacedAccountId: current.accountId, backedUpTo: backup };
     }
     catch {

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACH,SAAS,EACT,YAAY,EACZ,aAAa,EACb,SAAS,EACT,UAAU,EACV,UAAU,EACV,YAAY,GACf,MAAM,SAAS,CAAC;AAyBjB,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;iCAEiC;AACjC,SAAS,eAAe;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACrB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,SAAS,CAAC;QACN,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACnD,GAAG,GAAG,MAAM,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO,gBAAgB,EAAE,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS;IACrB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,MAA2B,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvF,2EAA2E;IAC3E,8CAA8C;IAC9C,IAAI,CAAC;QACD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,gCAAgC;IACpC,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B;IACtC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CACH,8CAA8C,SAAS,EAAE,GAAG;QAC5D,sBAAsB,OAAO,CAAC,SAAS,KAAK;QAC5C,2EAA2E,CAC9E,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsB,EACtB,iBAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG;QACV,mDAAmD,KAAK,CAAC,IAAI,GAAG;QAChE,UAAU,KAAK,CAAC,iBAAiB,EAAE;QACnC,UAAU,iBAAiB,EAAE;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;gFACgF;AAChF,SAAS,+BAA+B,CACpC,IAAY,EACZ,iBAAyB;IAEzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACD,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3B,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACL,gEAAgE;QAChE,8DAA8D;QAC9D,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;QAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9C,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ;QAC1C,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAClB,CAAC;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACH,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACb,MAAM,SAAS,CAAC;AAyBjB,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;iCAEiC;AACjC,SAAS,eAAe;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACrB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,SAAS,CAAC;QACN,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACnD,GAAG,GAAG,MAAM,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO,gBAAgB,EAAE,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS;IACrB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,MAA2B,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,0EAA0E;IAC1E,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,uEAAuE;QACvE,IAAI,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACL,oCAAoC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2EAA2E;AAC3E,SAAS,SAAS,CAAC,EAAU;IACzB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,eAAe,CAC3B,GAAW,EACX,IAAY,EACZ,QAAgB,EAChB,OAII,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEtC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClB,OAAO;IACX,CAAC;IACD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7C,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;gBAClC,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC,CAAC;gBACzC,SAAS;YACb,CAAC;YACD,iEAAiE;YACjE,4BAA4B;YAC5B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,6CAA6C;YAC7C,EAAE;YACF,mEAAmE;YACnE,2BAA2B;YAC3B,IAAI,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACL,iEAAiE;YACrE,CAAC;YACD,OAAO;QACX,CAAC;IACL,CAAC;AACL,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B;IACtC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CACH,8CAA8C,SAAS,EAAE,GAAG;QAC5D,sBAAsB,OAAO,CAAC,SAAS,KAAK;QAC5C,2EAA2E,CAC9E,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsB,EACtB,iBAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG;QACV,mDAAmD,KAAK,CAAC,IAAI,GAAG;QAChE,UAAU,KAAK,CAAC,iBAAiB,EAAE;QACnC,UAAU,iBAAiB,EAAE;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;gFACgF;AAChF,SAAS,+BAA+B,CACpC,IAAY,EACZ,iBAAyB;IAEzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACL,gEAAgE;QAChE,8DAA8D;QAC9D,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;QAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9C,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ;QAC1C,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAClB,CAAC;AACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mysten-incubation/memwal-mcp",
-  "version": "0.0.13-dev.4",
+  "version": "0.0.13-dev.5",
   "description": "Walrus Memory MCP client — single-binary stdio MCP server that bridges Cursor / Claude Desktop / Antigravity / Claude Code to the Walrus Memory relayer. Handles browser-based wallet login on first run.",
   "type": "module",
   "engines": {