@mysten-incubation/memwal-mcp 0.0.13 → 0.0.14-dev.1

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAuBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C;AAmCD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IACzB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;CACd;AAED;4DAC4D;AAC5D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAe5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAoBtD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}

package/dist/auth.js

@@ -13,6 +13,7 @@ import { homedir } from "node:os";
 import { randomUUID } from "node:crypto";
 import { join, dirname, basename } from "node:path";
 import { mkdirSync, readFileSync, writeFileSync, renameSync, unlinkSync, existsSync, } from "node:fs";
+import { log } from "./logger.js";
 const CREDS_FILE = "credentials.json";
 /** Global, per-machine location. Always the fallback, and the only location
  * before project-scoping existed — a machine with no project-local file keeps
@@ -334,4 +335,138 @@ function isValid(obj) {
         typeof c.createdAt === "string" &&
         c.version === 1);
 }
+/* ------------------------------------------------------------------------- *
+ * Pending login — write-ahead for the delegate keypair (WALM-332).
+ *
+ * The browser registers our delegate public key on-chain, which costs gas and
+ * cannot be undone, and only afterwards POSTs the callback that makes us save
+ * the matching private key. Losing this process in that window used to destroy
+ * the only copy of the key, stranding a paid registration nobody could use.
+ *
+ * So the keypair is written here BEFORE the browser is given the connect URL,
+ * and cleared once `saveCreds` has the key safely in `credentials.json`. A
+ * record that outlives its flow is recovered on next start.
+ * ------------------------------------------------------------------------- */
+const PENDING_FILE = "login-pending.json";
+/**
+ * How long a stranded record stays recoverable.
+ *
+ * Deliberately far longer than the 5-minute login timeout: the whole point is
+ * to survive a client restart, and a user who quits for the evening and comes
+ * back tomorrow is exactly the case worth covering. The cost of holding it is
+ * an unregistered key on disk, which grants nothing.
+ */
+export const PENDING_LOGIN_TTL_MS = 24 * 60 * 60_000;
+/** Sits beside whichever credentials file `credsPath()` resolves to, so a
+ * project-local sign-in recovers into that same project. */
+export function pendingLoginPath() {
+    return join(dirname(credsPath()), PENDING_FILE);
+}
+/**
+ * Persist the pending keypair. Throws if it cannot.
+ *
+ * Deliberately NOT best-effort. The invariant this record exists to hold is
+ * that the delegate private key is on disk before its public half can reach a
+ * browser that will pay gas to register it. Swallowing the error would publish
+ * the connect URL while claiming a durability that does not exist — the
+ * original WALM-332 loss, now silent.
+ *
+ * Failing the login costs the user nothing: this file sits beside
+ * `credentials.json`, so a directory that cannot take it cannot take the
+ * credentials either. The same login would have failed at the callback anyway,
+ * one on-chain `add_delegate_key` later.
+ */
+export function savePendingLogin(pending) {
+    const path = pendingLoginPath();
+    try {
+        // The record holds the same plaintext private key as `credentials.json`,
+        // so it gets the same fresh-inode write.
+        writeSecretFile(path, JSON.stringify(pending, null, 2));
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        log.error("login.pending.write_failed", { path, msg });
+        throw new Error(`Could not write the login write-ahead record at ${path}: ${msg}. ` +
+            `Refusing to start a sign-in that could register a delegate key on-chain ` +
+            `without being able to save it.`);
+    }
+}
+/**
+ * A pending record this login can adopt instead of minting a new keypair.
+ *
+ * `loginFlow` used to generate a fresh keypair every call and overwrite the
+ * record unconditionally. Recovery only runs at process start and is skipped
+ * for `--login` / `forceLogin`, so a timed-out login followed by `memwal_login`
+ * in the same process replaced the only copy of a key the browser may already
+ * have paid to register. Reusing the record keeps that key reclaimable.
+ *
+ * Scoped to the same relayer: a key registered against one relayer's account
+ * proves nothing to another, and `recovery` must never repoint. TTL and shape
+ * are already enforced by {@link loadPendingLogin}.
+ */
+export function reusablePendingLogin(relayerUrl) {
+    const pending = loadPendingLogin();
+    if (!pending)
+        return null;
+    if (pending.relayerUrl !== relayerUrl) {
+        log.warn("login.pending.relayer_changed", {
+            publicKey: pending.delegatePublicKeyHex,
+            from: pending.relayerUrl,
+            to: relayerUrl,
+        });
+        return null;
+    }
+    return pending;
+}
+/**
+ * Load a pending record, or null if there is none, it is malformed, or it has
+ * aged out. An expired record is deleted on read rather than left to linger.
+ */
+export function loadPendingLogin() {
+    const path = pendingLoginPath();
+    if (!existsSync(path))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, "utf8"));
+    }
+    catch {
+        clearPendingLogin();
+        return null;
+    }
+    if (!isValidPending(parsed)) {
+        clearPendingLogin();
+        return null;
+    }
+    const age = Date.now() - Date.parse(parsed.createdAt);
+    if (!Number.isFinite(age) || age > PENDING_LOGIN_TTL_MS) {
+        clearPendingLogin();
+        return null;
+    }
+    return parsed;
+}
+/** Remove the pending record. Safe to call when there isn't one. */
+export function clearPendingLogin() {
+    try {
+        const path = pendingLoginPath();
+        if (existsSync(path))
+            unlinkSync(path);
+    }
+    catch {
+        /* best effort */
+    }
+}
+function isValidPending(obj) {
+    if (!obj || typeof obj !== "object")
+        return false;
+    const p = obj;
+    return (typeof p.delegatePrivateKey === "string" &&
+        /^[0-9a-fA-F]{64}$/.test(p.delegatePrivateKey) &&
+        typeof p.delegatePublicKeyHex === "string" &&
+        /^[0-9a-fA-F]{64}$/.test(p.delegatePublicKeyHex) &&
+        typeof p.delegateAddress === "string" &&
+        typeof p.relayerUrl === "string" &&
+        typeof p.createdAt === "string" &&
+        p.version === 1);
+}
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACH,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACb,MAAM,SAAS,CAAC;AAyBjB,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;iCAEiC;AACjC,SAAS,eAAe;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACrB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,SAAS,CAAC;QACN,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACnD,GAAG,GAAG,MAAM,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO,gBAAgB,EAAE,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS;IACrB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,MAA2B,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,0EAA0E;IAC1E,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,uEAAuE;QACvE,IAAI,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACL,oCAAoC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2EAA2E;AAC3E,SAAS,SAAS,CAAC,EAAU;IACzB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,eAAe,CAC3B,GAAW,EACX,IAAY,EACZ,QAAgB,EAChB,OAII,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEtC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClB,OAAO;IACX,CAAC;IACD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7C,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;gBAClC,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC,CAAC;gBACzC,SAAS;YACb,CAAC;YACD,iEAAiE;YACjE,4BAA4B;YAC5B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,6CAA6C;YAC7C,EAAE;YACF,mEAAmE;YACnE,2BAA2B;YAC3B,IAAI,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACL,iEAAiE;YACrE,CAAC;YACD,OAAO;QACX,CAAC;IACL,CAAC;AACL,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B;IACtC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CACH,8CAA8C,SAAS,EAAE,GAAG;QAC5D,sBAAsB,OAAO,CAAC,SAAS,KAAK;QAC5C,2EAA2E,CAC9E,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsB,EACtB,iBAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG;QACV,mDAAmD,KAAK,CAAC,IAAI,GAAG;QAChE,UAAU,KAAK,CAAC,iBAAiB,EAAE;QACnC,UAAU,iBAAiB,EAAE;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;gFACgF;AAChF,SAAS,+BAA+B,CACpC,IAAY,EACZ,iBAAyB;IAEzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACL,gEAAgE;QAChE,8DAA8D;QAC9D,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;QAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9C,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ;QAC1C,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAClB,CAAC;AACN,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EACH,SAAS,EACT,YAAY,EACZ,aAAa,EACb,UAAU,EACV,UAAU,EACV,UAAU,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAyBlC,MAAM,UAAU,GAAG,kBAAkB,CAAC;AAEtC;;iCAEiC;AACjC,SAAS,eAAe;IACpB,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,gBAAgB;IACrB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,MAAM,MAAM,GAAG,eAAe,EAAE,CAAC;IACjC,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,SAAS,CAAC;QACN,wEAAwE;QACxE,sEAAsE;QACtE,gCAAgC;QAChC,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAE9B,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACnD,IAAI,SAAS,KAAK,MAAM,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAEpE,wEAAwE;QACxE,sEAAsE;QACtE,oEAAoE;QACpE,oEAAoE;QACpE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE/C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC,CAAC,kBAAkB;QACnD,GAAG,GAAG,MAAM,CAAC;IACjB,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAC9C,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IAChD,OAAO,gBAAgB,EAAE,IAAI,eAAe,EAAE,CAAC;AACnD,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,SAAS;IACrB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QAClC,OAAO,MAA2B,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,SAAS,CAAC,KAAwB;IAC9C,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,MAAM,QAAQ,GAAG,+BAA+B,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACxE,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,GAAG,QAAQ,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,eAAe,CAAC,IAAY,EAAE,QAAgB;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjD,0EAA0E;IAC1E,sEAAsE;IACtE,gEAAgE;IAChE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,UAAU,EAAE,MAAM,CAAC,CAAC;IAC/E,IAAI,CAAC;QACD,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5E,eAAe,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,uEAAuE;QACvE,IAAI,CAAC;YACD,UAAU,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACL,oCAAoC;QACxC,CAAC;QACD,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC;AACjE,MAAM,qBAAqB,GAAG,CAAC,CAAC;AAChC,MAAM,uBAAuB,GAAG,EAAE,CAAC;AAEnC,2EAA2E;AAC3E,SAAS,SAAS,CAAC,EAAU;IACzB,OAAO,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,eAAe,CAC3B,GAAW,EACX,IAAY,EACZ,QAAgB,EAChB,OAII,EAAE;IAEN,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IAEtC,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClB,OAAO;IACX,CAAC;IACD,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAClB,OAAO;QACX,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,IAAI,EAAE,CAAC;YACvD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,GAAG,CAAC;YAC7C,IAAI,OAAO,GAAG,qBAAqB,EAAE,CAAC;gBAClC,KAAK,CAAC,uBAAuB,GAAG,OAAO,CAAC,CAAC;gBACzC,SAAS;YACb,CAAC;YACD,iEAAiE;YACjE,4BAA4B;YAC5B,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACjE,gEAAgE;YAChE,kEAAkE;YAClE,kEAAkE;YAClE,+DAA+D;YAC/D,6CAA6C;YAC7C,EAAE;YACF,mEAAmE;YACnE,2BAA2B;YAC3B,IAAI,CAAC;gBACD,UAAU,CAAC,GAAG,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACL,iEAAiE;YACrE,CAAC;YACD,OAAO;QACX,CAAC;IACL,CAAC;AACL,CAAC;AAgBD;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B;IACtC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,CACH,8CAA8C,SAAS,EAAE,GAAG;QAC5D,sBAAsB,OAAO,CAAC,SAAS,KAAK;QAC5C,2EAA2E,CAC9E,CAAC;AACN,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CACnC,KAAsB,EACtB,iBAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,iBAAiB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG;QACV,mDAAmD,KAAK,CAAC,IAAI,GAAG;QAChE,UAAU,KAAK,CAAC,iBAAiB,EAAE;QACnC,UAAU,iBAAiB,EAAE;KAChC,CAAC;IACF,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,gCAAgC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IACrF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5B,CAAC;AAED;gFACgF;AAChF,SAAS,+BAA+B,CACpC,IAAY,EACZ,iBAAyB;IAEzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,SAAS,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,KAAK,iBAAiB;QAAE,OAAO,EAAE,CAAC;IACnE,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,sBAAsB,KAAK,OAAO,CAAC,CAAC;IACvE,IAAI,CAAC;QACD,wEAAwE;QACxE,uEAAuE;QACvE,iEAAiE;QACjE,eAAe,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACpD,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACL,gEAAgE;QAChE,8DAA8D;QAC9D,OAAO,EAAE,iBAAiB,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;IACpD,CAAC;AACL,CAAC;AAaD;;;;;;;;;GASG;AACH,MAAM,UAAU,UAAU;IACtB,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACL,uEAAuE;QACvE,OAAO,EAAE,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,SAAS,EAAE,CAAC;IAC7B,OAAO,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,IAAI;QAC5C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE;QAC/C,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChC,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IACzB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9C,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ;QAC1C,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,aAAa,KAAK,QAAQ;QACnC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACvC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAClB,CAAC;AACN,CAAC;AAED;;;;;;;;;;;+EAW+E;AAE/E,MAAM,YAAY,GAAG,oBAAoB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAerD;4DAC4D;AAC5D,MAAM,UAAU,gBAAgB;IAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,EAAE,YAAY,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAqB;IAClD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC;QACD,yEAAyE;QACzE,yCAAyC;QACzC,eAAe,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,4BAA4B,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,IAAI,KAAK,CACX,mDAAmD,IAAI,KAAK,GAAG,IAAI;YAC/D,0EAA0E;YAC1E,gCAAgC,CACvC,CAAC;IACN,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,oBAAoB,CAAC,UAAkB;IACnD,MAAM,OAAO,GAAG,gBAAgB,EAAE,CAAC;IACnC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,IAAI,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QACpC,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE;YACtC,SAAS,EAAE,OAAO,CAAC,oBAAoB;YACvC,IAAI,EAAE,OAAO,CAAC,UAAU;YACxB,EAAE,EAAE,UAAU;SACjB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB;IAC5B,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACD,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACL,iBAAiB,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1B,iBAAiB,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,oBAAoB,EAAE,CAAC;QACtD,iBAAiB,EAAE,CAAC;QACpB,OAAO,IAAI,CAAC;IAChB,CAAC;IACD,OAAO,MAAM,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,iBAAiB;IAC7B,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,gBAAgB,EAAE,CAAC;QAChC,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACL,iBAAiB;IACrB,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAY;IAChC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,OAAO,CACH,OAAO,CAAC,CAAC,kBAAkB,KAAK,QAAQ;QACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC;QAC9C,OAAO,CAAC,CAAC,oBAAoB,KAAK,QAAQ;QAC1C,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAChD,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ;QACrC,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;QAChC,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ;QAC/B,CAAC,CAAC,OAAO,KAAK,CAAC,CAClB,CAAC;AACN,CAAC"}

package/dist/bridge.d.ts

@@ -59,6 +59,10 @@ export declare function annotateHealthResult(result: {
     isError?: unknown;
 }, relayerUrl: string): void;
 export declare function applyDefaultNamespace(msg: RpcMessage, namespace?: string): RpcMessage;
+/** Reply for a `tools/call` naming a tool the connected relayer does not
+ * serve. Names what IS on offer, because the agent's next move is to pick one
+ * of those — "unknown tool" alone leaves it guessing or retrying. */
+export declare function unknownToolText(name: string, available: string[]): string;
 interface RpcMessage {
     jsonrpc: "2.0";
     id?: number | string | null;

package/dist/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAanD,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,eAAe,CAAC;AAGvB;;gFAEgF;AAChF,MAAM,WAAW,YAAY;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;8BAG0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAChC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAChD,UAAU,EAAE,MAAM,GACnB,IAAI,CAaN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAerF;AAyQD,UAAU,UAAU;IAChB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AA6gBD,oEAAoE;AACpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEpE;AA8BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAC3B,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,YAAY;AACpB;;;;yEAIyE;AACzE,YAAY,GAAE,MAAM,EAAO,GAC5B,OAAO,CAAC,IAAI,CAAC,CAmhDf"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../src/bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAanD,OAAO,EAIH,KAAK,gBAAgB,EACxB,MAAM,eAAe,CAAC;AAIvB;;gFAEgF;AAChF,MAAM,WAAW,YAAY;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd;;;8BAG0B;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAeD;;;;;;;;;;GAUG;AACH;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAChC,MAAM,EAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,EAChD,UAAU,EAAE,MAAM,GACnB,IAAI,CAaN;AAED,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,UAAU,CAerF;AA6FD;;qEAEqE;AACrE,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,MAAM,CAOzE;AAsOD,UAAU,UAAU;IAChB,OAAO,EAAE,KAAK,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACnB;AAokBD,oEAAoE;AACpE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,gBAAgB,GAAG,IAAI,CAEpE;AA8BD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,SAAS,CAC3B,YAAY,EAAE,iBAAiB,EAC/B,MAAM,EAAE,YAAY;AACpB;;;;yEAIyE;AACzE,YAAY,GAAE,MAAM,EAAO,GAC5B,OAAO,CAAC,IAAI,CAAC,CA4lDf"}

package/dist/bridge.js

@@ -1,4 +1,4 @@
-import { clearCreds, credsPath, loadCreds } from "./auth.js";
+import { clearCreds, clearPendingLogin, credsPath, loadCreds } from "./auth.js";
 import { TOOL_DEFINITIONS } from "./auth-required.js";
 import { clientInfoHeaders, lastClientInfoHeaders, rememberInitializeClientInfo, } from "./client-info.js";
 import { randomUUID } from "node:crypto";
@@ -7,6 +7,7 @@ import { PROACTIVE_INSTRUCTIONS } from "./instructions.js";
 import { startOrReuseLoginFlow, resolveLoginTimeoutMs } from "./login.js";
 import { log, note } from "./logger.js";
 import { loginPrompt, loginSuccessNotice, loginSuccessNotification, } from "./messages.js";
+import { openStreamableSession, resolveTransport } from "./streamable.js";
 import { MEMWAL_MCP_VERSION } from "./version.js";
 /** Memory tools that take a `namespace` argument. `memwal_remember`,
  * `memwal_remember_bulk`, `memwal_recall`, and `memwal_analyze` treat it as
@@ -151,6 +152,15 @@ const SIGNED_OUT_FAILURE = {
  * "connection dropped, please retry", which is advice that cannot work. Name
  * the cause and the way back in instead (GH #365 / WALM-602). */
 const UNAUTHORIZED_TEXT = "❌ Walrus Memory rejected the saved credentials (HTTP 401). The delegate key may have been revoked or is no longer registered on this account. Call `memwal_login` to sign in again — saved credentials were NOT modified.";
+/** Reply for a `tools/call` naming a tool the connected relayer does not
+ * serve. Names what IS on offer, because the agent's next move is to pick one
+ * of those — "unknown tool" alone leaves it guessing or retrying. */
+export function unknownToolText(name, available) {
+    return (`❌ \`${name}\` is not a tool this Walrus Memory server offers. ` +
+        `Available: ${available.join(", ")}. ` +
+        `Your tool list is stale — re-read \`tools/list\` and use one of those instead. ` +
+        `Nothing ran, so nothing was saved or changed.`);
+}
 /** `failRequest` options for every credentials-rejected refusal, so one refused
  * at handshake time and one refused on arrival afterwards read identically. */
 const UNAUTHORIZED_FAILURE = {
@@ -174,6 +184,10 @@ const LOCAL_TOOLS_LIST = {
         ...LOCAL_TOOL_DEFINITIONS,
     ],
 };
+/** Names advertised at cold start (baseline relayer + locally-served). A
+ * `tools/call` for anything else is refused until an upstream `tools/list`
+ * has been seen — fail-closed, not fail-open. */
+const COLD_START_TOOL_NAMES = new Set(LOCAL_TOOLS_LIST.tools.map((t) => t.name));
 const URL_READY_TIMEOUT_MS = 5_000;
 /** Maximum silence we tolerate on the SSE stream before assuming the
  * relayer-side session has gone dead. The relayer sends keepalive events
@@ -202,6 +216,56 @@ const SLOWEST_SERVER_TOOL_MS = 180_000;
 const DEFAULT_CALL_TIMEOUT_MS = SLOWEST_SERVER_TOOL_MS + 60_000;
 /** An override below this is a mistake, not an intent. */
 const MIN_CALL_TIMEOUT_MS = 1_000;
+/** Longest a given tool can legitimately take server-side, keyed by tool name.
+ *
+ * `DEFAULT_CALL_TIMEOUT_MS` is sized for `memwal_analyze`, the slowest tool
+ * there is. Applying that one number to every call means a request whose reply
+ * is lost — the relayer answered, the stream dropped before it arrived — keeps
+ * the agent blocked for 240s even when the tool could not still be working.
+ * Users read that as a hang and reload the client.
+ *
+ * Each entry is the ceiling the matching tool enforces on itself in
+ * `services/server/scripts/mcp/tools/`: `MAX_REMEMBER_WAIT_MS` for
+ * `memwal_remember` (its default wait is 0 — it returns at accept — but an
+ * operator can raise `MEMWAL_MCP_REMEMBER_WAIT_MS` up to that cap),
+ * `MAX_STATUS_WAIT_MS` for `memwal_remember_status`, and the fixed `timeoutMs`
+ * the bulk and analyze tools pass to the SDK. Keep them in lockstep: a value
+ * below a tool's real ceiling abandons healthy work. Unlisted tools keep the
+ * default. */
+const TOOL_DEADLINE_MS = {
+    memwal_remember: 90_000,
+    memwal_remember_status: 60_000,
+    memwal_remember_bulk: 120_000,
+    memwal_analyze: SLOWEST_SERVER_TOOL_MS,
+};
+/** Absorbs relayer + transport overhead on top of a tool's own ceiling. The
+ * sidecar answers at its deadline with a result or an error envelope rather
+ * than going quiet, so the reply is one network hop behind it; 30s is many
+ * times that. Cutting a merely-late reply off early is the expensive mistake —
+ * the agent would retry a write that actually landed. */
+const ORPHAN_HEADROOM_MS = 30_000;
+/** Tool name for a `tools/call`, or null for any other JSON-RPC method. */
+function toolNameOf(msg) {
+    if (msg.method !== "tools/call")
+        return null;
+    const params = msg.params;
+    if (params == null || typeof params !== "object")
+        return null;
+    const name = params.name;
+    return typeof name === "string" ? name : null;
+}
+/** Deadline for one tracked request. A tool with a known ceiling gets that
+ * plus headroom; everything else keeps the global default. An explicit
+ * `MEMWAL_MCP_CALL_TIMEOUT_MS` pins every call, so tests still drive expiry
+ * from one knob. */
+function resolveDeadlineMs(msg) {
+    const fallback = resolveCallTimeoutMs();
+    if (process.env.MEMWAL_MCP_CALL_TIMEOUT_MS)
+        return fallback;
+    const tool = toolNameOf(msg);
+    const ceiling = tool === null ? undefined : TOOL_DEADLINE_MS[tool];
+    return ceiling === undefined ? fallback : ceiling + ORPHAN_HEADROOM_MS;
+}
 /** Without a cap, a long deadline drifts by a third of itself. */
 const MAX_ORPHAN_SWEEP_MS = 5_000;
 /** How long one request might sit unanswered. The idle watchdog above only sees
@@ -329,6 +393,23 @@ function mcpAuthHeaders(creds, extra = {}) {
         ...extra,
     };
 }
+/**
+ * Open a relayer session on the configured transport.
+ *
+ * `MEMWAL_MCP_TRANSPORT=http` dials the Streamable HTTP endpoint, which
+ * answers a call on the same request instead of splitting POST from reply.
+ * Default stays SSE until the new path has production mileage.
+ */
+async function openRelaySession(relayerUrl, creds, extraHeaders = {}) {
+    if (resolveTransport(process.env.MEMWAL_MCP_TRANSPORT) === "http") {
+        // `postUrl` is logging-only on this path; the session owns its
+        // endpoint. A plain cast, not `as unknown as` — the two shapes must
+        // stay structurally compatible, and a widening cast would hide it if
+        // they ever stopped being.
+        return (await openStreamableSession(relayerUrl, creds, extraHeaders));
+    }
+    return openSseStream(relayerUrl, creds, extraHeaders);
+}
 async function openSseStream(relayerUrl, creds, extraHeaders = {}) {
     const connectTimeoutMs = resolveConnectTimeoutMs();
     // One shared budget for the WHOLE attempt: the compatibility check (GET
@@ -576,6 +657,7 @@ async function openSseStream(relayerUrl, creds, extraHeaders = {}) {
         : `${relayerUrl.replace(/\/+$/, "")}${endpointPath}`;
     return {
         postUrl,
+        send: (msg, sendCreds, extra) => postMessage(postUrl, msg, sendCreds, extra),
         iter,
         abort: () => {
             controller.abort();
@@ -660,7 +742,13 @@ async function handleLocalLogin(config, onCredentials) {
                 }),
             },
         });
-    }, (err) => {
+    }, 
+    // This tool call has already returned "here is your URL, go sign in",
+    // so a later failure has no response left to ride home on. Without an
+    // out-of-band notification the agent sits waiting on a flow that is
+    // already dead. MCP logging notifications are fire-and-forget and safe
+    // to emit at any point in the session.
+    (err) => {
         const msg = err instanceof Error ? err.message : String(err);
         log.warn("memwal_login.bridge.failed", { msg });
         writeStdoutMessage({
@@ -669,7 +757,14 @@ async function handleLocalLogin(config, onCredentials) {
             params: {
                 level: "warning",
                 logger: "memwal-mcp",
-                data: `Walrus Memory sign-in did not complete: ${msg}. Existing credentials are unchanged; call memwal_login again to retry.`,
+                // The reclaim is only possible because of the write-ahead
+                // record (WALM-332): a key the browser already paid to
+                // register is no longer lost with the process. A retry
+                // cannot help that key, since it reuses it and the
+                // dashboard cannot register it twice.
+                data: `Walrus Memory sign-in did not complete: ${msg}. Existing credentials are ` +
+                    `unchanged. If you approved the wallet step, the next start reclaims that ` +
+                    `key; otherwise call memwal_login again to retry.`,
             },
         });
     });
@@ -702,6 +797,15 @@ async function handleLocalLogin(config, onCredentials) {
 function handleLocalLogout() {
     try {
         const cleared = clearCreds();
+        // Explicit sign-out discards the write-ahead record too. Without this
+        // an interrupted re-login leaves `login-pending.json` behind, and the
+        // next start's `recoverPendingLogin` signs the user straight back in.
+        //
+        // Kept out of `clearCreds()` so only a deliberate sign-out discards a
+        // key that may still be reclaimable. `clearCreds` is exported, and a
+        // 401 deliberately does NOT wipe credentials (see the relayer-401
+        // handling above), so the two are not the same decision.
+        clearPendingLogin();
         log.info("memwal_logout.bridge.success", {
             removedPath: cleared.removedPath ?? null,
             fallbackPath: cleared.fallbackPath ?? null,
@@ -917,7 +1021,7 @@ pendingLines = []) {
         postChain = run.then(() => undefined, () => undefined);
         return run;
     }
-    function postIfCurrent(epoch, postUrl, msg, postCreds) {
+    function postIfCurrent(epoch, send, msg, postCreds) {
         if (epoch !== sessionEpoch)
             return Promise.resolve(0);
         // Marked before the await, not after. Once the POST is issued we can
@@ -929,7 +1033,7 @@ pendingLines = []) {
             if (tracked)
                 tracked.sent = true;
         }
-        return postMessage(postUrl, msg, postCreds, extraHeaders).then((status) => {
+        return send(msg, postCreds, extraHeaders).then((status) => {
             // 404 is the relayer saying that session does not exist, so the
             // message was discarded rather than routed: it provably did not
             // run, and the request goes back to being never-sent.
@@ -1062,6 +1166,13 @@ pendingLines = []) {
      * locally-served `memwal_login` + `memwal_logout` tools so the MCP
      * client surfaces them in its tool palette. */
     const pendingListIds = new Set();
+    /** Tool names the CONNECTED relayer advertised on its last `tools/list`,
+     * minus the ones we serve locally. Empty until the client has listed tools
+     * at least once over the *current* session. `reconnect()` clears it: a
+     * stale allow would re-forward a tool the new relayer does not serve
+     * (GH #928), and a stale deny would refuse a tool it does. Until the
+     * next upstream list, the gate allows only the cold-start floor. */
+    const upstreamToolNames = new Set();
     /** IDs of forwarded `memwal_health` calls, each against the relayer URL the
      * call went out on. Captured at send time rather than read at reply time so
      * a reconnect that swapped credentials mid-flight cannot label the answer
@@ -1152,7 +1263,7 @@ pendingLines = []) {
                     // with. Belt-and-braces against `loggedOut` alone.
                     if (!openingCreds)
                         break;
-                    const candidate = await openSseStream(openingCreds.relayerUrl, openingCreds, connectHeaders());
+                    const candidate = await openRelaySession(openingCreds.relayerUrl, openingCreds, connectHeaders());
                     // Logout can also land mid-handshake. Same reasoning as the
                     // stale-credentials case below, except there is no new key
                     // to reconnect with — drop the session and stop.
@@ -1182,6 +1293,15 @@ pendingLines = []) {
                     throttleNoticed = false;
                     clearHandshakeFailure();
                     endConnectEpisode();
+                    // This session has not advertised anything yet. Keep the
+                    // previous set and a login that swapped relayerUrl would
+                    // re-forward a tool the new one does not serve, or refuse
+                    // one it does, until the client happened to re-list.
+                    upstreamToolNames.clear();
+                    writeStdoutMessage({
+                        jsonrpc: "2.0",
+                        method: "notifications/tools/list_changed",
+                    });
                     // An accepted handshake retires any earlier rejection —
                     // `memwal_login` re-registers a key and lands here, not on
                     // the background connect's publish path, so clearing only
@@ -1236,8 +1356,8 @@ pendingLines = []) {
                                 expectSuppressedReply(msg.id);
                             }
                             const epoch = sessionEpoch;
-                            const postUrl = sse.postUrl;
-                            const status = await enqueuePost(() => postIfCurrent(epoch, postUrl, msg, openingCreds));
+                            const send = sse.send;
+                            const status = await enqueuePost(() => postIfCurrent(epoch, send, msg, openingCreds));
                             log.info("bridge.replayed", { id, status });
                         }
                         catch (err) {
@@ -1550,6 +1670,16 @@ pendingLines = []) {
                             // duplicate tool name. Mirrors LOCAL_TOOLS_LIST.
                             const upstream = result.tools.filter((t) => !LOCAL_TOOL_NAMES.has(t.name ?? ""));
                             result.tools = [...upstream, ...LOCAL_TOOL_DEFINITIONS];
+                            // Record what this relayer actually serves. A
+                            // later call for a name absent here is answered
+                            // locally instead of being forwarded into a wait
+                            // no reply will ever end.
+                            upstreamToolNames.clear();
+                            for (const t of upstream) {
+                                if (typeof t.name === "string" && t.name !== "") {
+                                    upstreamToolNames.add(t.name);
+                                }
+                            }
                         }
                     }
                     if (value &&
@@ -1720,6 +1850,45 @@ pendingLines = []) {
                     failRequest(msg, "credentials rejected", UNAUTHORIZED_FAILURE);
                     return;
                 }
+                // Version skew: this bridge ships on npm and updates itself,
+                // while a relayer ships per environment and does not, so the
+                // bridge is routinely newer than the server it dials. A tool
+                // named in initialize instructions or a cached list can be
+                // missing from the session that actually came up —
+                // `memwal_remember_status` against a prod relayer, which is
+                // GH #928. Forwarding that call parks it in `inFlight` until
+                // the orphan sweeper's deadline (60s + 30s headroom for that
+                // tool), and the user reads the 90s as a hang.
+                //
+                // Fail closed. Before any upstream `tools/list`, only the
+                // cold-start floor is callable. After one, only what that
+                // relayer advertised (plus locally-served tools). A stale
+                // tool list is not a transport fault: say so now, while the
+                // agent can still act on it.
+                if (msg.method === "tools/call" && msg.id != null) {
+                    const called = msg.params?.name;
+                    if (typeof called === "string" && !LOCAL_TOOL_NAMES.has(called)) {
+                        const known = upstreamToolNames.size > 0
+                            ? upstreamToolNames
+                            : COLD_START_TOOL_NAMES;
+                        if (!known.has(called)) {
+                            const available = [
+                                ...(upstreamToolNames.size > 0
+                                    ? [...upstreamToolNames, ...LOCAL_TOOL_NAMES]
+                                    : COLD_START_TOOL_NAMES),
+                            ].sort();
+                            log.warn("bridge.tool_not_served", {
+                                tool: called,
+                                window: upstreamToolNames.size > 0 ? "upstream" : "cold-start",
+                            });
+                            failRequest(msg, "tool not served", {
+                                toolText: unknownToolText(called, available),
+                                errorMessage: `${called} is not served by this Walrus Memory relayer`,
+                            });
+                            return;
+                        }
+                    }
+                }
                 // Fill in the configured default namespace for memory tool
                 // calls that didn't pass one. Mutates msg in place so the
                 // forwarded — and any replayed-on-reconnect — copy carries it.
@@ -1742,7 +1911,11 @@ pendingLines = []) {
                 if (msg.method !== undefined &&
                     msg.id !== undefined &&
                     msg.id !== null) {
-                    inFlight.set(msg.id, { msg, startedAt: Date.now() });
+                    inFlight.set(msg.id, {
+                        msg,
+                        startedAt: Date.now(),
+                        deadlineMs: resolveDeadlineMs(msg),
+                    });
                 }
                 // Relayer session not up yet, OR the post-connect flush is still
                 // draining — buffer so this request stays behind everything that
@@ -1782,9 +1955,9 @@ pendingLines = []) {
                     return;
                 }
                 const epoch = sessionEpoch;
-                const postUrl = sse.postUrl;
+                const send = sse.send;
                 const postCreds = creds;
-                const status = await enqueuePost(() => postIfCurrent(epoch, postUrl, msg, postCreds));
+                const status = await enqueuePost(() => postIfCurrent(epoch, send, msg, postCreds));
                 if (status === 404) {
                     log.warn("bridge.session_stale", { sessionUrl: sse.postUrl });
                     // reconnect() itself replays in-flight against the fresh
@@ -1822,9 +1995,9 @@ pendingLines = []) {
                 const msg = pendingForward.shift();
                 try {
                     const epoch = sessionEpoch;
-                    const postUrl = sse.postUrl;
+                    const send = sse.send;
                     const postCreds = creds;
-                    const status = await enqueuePost(() => postIfCurrent(epoch, postUrl, msg, postCreds));
+                    const status = await enqueuePost(() => postIfCurrent(epoch, send, msg, postCreds));
                     if (status === 404) {
                         // Stale session right after connect. EVERY id-bearing
                         // request is in `inFlight`, and ANY reconnect — this
@@ -1984,13 +2157,6 @@ pendingLines = []) {
         "memwal_remember_bulk",
         "memwal_analyze",
     ]);
-    /** Name of the tool a tracked request was calling, when it was one. */
-    function toolNameOf(msg) {
-        if (msg.method !== "tools/call")
-            return null;
-        const params = msg.params;
-        return typeof params?.name === "string" ? params.name : null;
-    }
     function expiredRequestReport(neverSent, now, tool) {
         if (!neverSent) {
             // The request reached the relayer. What is missing is the reply,
@@ -2074,7 +2240,14 @@ pendingLines = []) {
             // keeps the full deadline, because there a premature failure
             // invites a duplicate write.
             const handshakeIsStalled = handshakeStalledMs !== null && handshakeStalledMs > stalledHandshakeMs;
-            const deadlineMs = neverSent && handshakeIsStalled ? stalledHandshakeMs : callTimeoutMs;
+            // `entry.deadlineMs` is this tool's own ceiling plus headroom, not
+            // the global one sized for the slowest tool — so a `memwal_remember`
+            // whose reply is lost is answered at 120s instead of 240s. The
+            // stalled-handshake shortcut still wins when it is tighter, but can
+            // never extend a tool past its own deadline.
+            const deadlineMs = neverSent && handshakeIsStalled
+                ? Math.min(stalledHandshakeMs, entry.deadlineMs)
+                : entry.deadlineMs;
             if (elapsedMs <= deadlineMs)
                 continue;
             // Built only for what actually expired: this walks `pendingForward`
@@ -2148,7 +2321,7 @@ pendingLines = []) {
             }
             const openingGeneration = credentialGeneration;
             try {
-                const candidate = await openSseStream(creds.relayerUrl, creds, connectHeaders());
+                const candidate = await openRelaySession(creds.relayerUrl, creds, connectHeaders());
                 if (stdinClosed) {
                     candidate.abort();
                     break;