@mysten-incubation/memwal-mcp 0.0.14-dev.0 → 0.0.14-dev.10

package/dist/auth-required.js

@@ -25,11 +25,24 @@ import { credsPath, loadCreds } from "./auth.js";
 import { rememberInitializeClientInfo } from "./client-info.js";
 import { loginFailureNotice, loginPrompt, loginSuccessNotification } from "./messages.js";
 import { log } from "./logger.js";
-import { startOrReuseLoginFlow, resolveLoginTimeoutMs } from "./login.js";
+import { startOrReuseLoginFlow, resolveLoginTimeoutMs, isLoginSuperseded } from "./login.js";
 import { AUTH_REQUIRED_INSTRUCTIONS } from "./instructions.js";
+import { SECRET_EXCLUSION_RULES, SECRET_EXCLUSION_SUMMARY, AUTO_SAVE_OPT_IN_RULE, } from "./memory-policy.js";
 import { MEMWAL_MCP_VERSION } from "./version.js";
-const SIGNED_OUT_REMEMBER = "Save a fact to the user's Walrus Memory personal memory. Call ONLY when the user explicitly asks to remember/save something. Pass the full, detailed text — never summarize.";
-const SIGNED_IN_REMEMBER = "Save a durable fact about the user or project to their Walrus Memory. Call this PROACTIVELY whenever the user states a preference, decision, constraint, correction, identity detail, or recurring workflow — even if they did not say 'remember this'. Skip one-off tasks, the current file or bug, and small talk. Pass the full statement; do not summarize. To save several facts at once, use memwal_remember_bulk instead. A Walrus write takes 30-60s and this call waits for it, so a success carries a blob_id and means the fact is stored. If it outruns that budget you get a job_id and the fact is NOT yet saved — say so rather than claiming it is stored, and resolve it with memwal_remember_status.";
+/**
+ * WALM-642: every write-tool description below ends with the shared policy
+ * block, the same text the `instructions` field and the plugin hooks carry, so
+ * an agent that only ever sees one of the three still gets the same rules.
+ * The signed-out variants get the one-line summary — they exist to keep a
+ * credential-less model from spamming writes, and the full block would be the
+ * longest thing in a list of tools that cannot run yet.
+ */
+const SIGNED_OUT_REMEMBER = "Save a fact to the user's Walrus Memory personal memory. Call ONLY when the user explicitly asks to remember/save something. Pass the full, detailed text — never summarize. " +
+    SECRET_EXCLUSION_SUMMARY;
+const SIGNED_IN_REMEMBER = "Save a durable fact about the user or project to their Walrus Memory. Call this PROACTIVELY whenever the user states a preference, decision, constraint, correction, identity detail, or recurring workflow — even if they did not say 'remember this' — provided they have turned automatic memory on. Skip one-off tasks, the current file or bug, and small talk. Pass the full statement; do not summarize. To save several facts at once, use memwal_remember_bulk instead. By default this returns in ~1s once the relayer has accepted the job (job_id) — the Walrus write is still in flight and the fact is NOT stored yet. Do not claim it is saved. Settle it with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means it already stored (optional wait budget). " +
+    AUTO_SAVE_OPT_IN_RULE +
+    " " +
+    SECRET_EXCLUSION_RULES;
 const SIGNED_OUT_RECALL = "Search the user's Walrus Memory for facts relevant to a query. Returns matching memories ranked by relevance.";
 const SIGNED_IN_RECALL = "Search the user's Walrus Memory for relevant facts before responding. Call this PROACTIVELY at the start of a task, or whenever the user references past work, prior decisions, their preferences, or anything you may have stored earlier — don't wait to be asked. A single focused query is usually enough — recall is a real retrieval over encrypted storage, so do NOT fire multiple redundant searches for the same question. Returns matching memories ranked by relevance.";
 /** Build the static memory-tool list. `proactive` is true for the signed-in
@@ -56,7 +69,8 @@ function buildToolDefinitions(proactive) {
             name: "memwal_remember_bulk",
             title: "Remember Multiple Facts",
             annotations: { readOnlyHint: false, destructiveHint: false },
-            description: "Save multiple durable facts in one call. Use when you learned several distinct facts at once (onboarding details, a list of preferences, decisions from a discussion). Pass an array of complete fact statements (max 20) — do not summarize. Prefer this over repeated memwal_remember calls. A Walrus write takes 30-60s and this call waits for them, so a success carries blob_ids and means the facts are stored. If they outrun that budget you get job_ids and the facts are NOT yet saved — say they are being saved rather than stored, and resolve them with memwal_remember_status.",
+            description: "Save multiple durable facts in one call. Use when you learned several distinct facts at once (onboarding details, a list of preferences, decisions from a discussion). Pass an array of complete fact statements (max 20) — do not summarize. Prefer this over repeated memwal_remember calls. By default this returns in ~1s once the relayer has accepted the batch (job_ids) — the Walrus writes are still in flight and the facts are NOT stored yet. Do not claim they are saved. Settle them with the job-status tool this server advertises (re-list tools if you do not see one). A blob_id in the same reply means that fact already stored (optional wait budget). " +
+                (proactive ? AUTO_SAVE_OPT_IN_RULE + " " + SECRET_EXCLUSION_RULES : SECRET_EXCLUSION_SUMMARY),
             inputSchema: {
                 type: "object",
                 properties: {
@@ -125,7 +139,8 @@ function buildToolDefinitions(proactive) {
             name: "memwal_analyze",
             title: "Analyze and Remember",
             annotations: { readOnlyHint: false, destructiveHint: true },
-            description: "Extract memorable facts from a longer passage of text (preferences, habits, biographical info, constraints) and save each as a separate Walrus Memory memory. Use this when you want MemWal's LLM to split the facts out of a transcript or notes for you; if you already know the exact facts, use memwal_remember or memwal_remember_bulk instead.",
+            description: "Extract memorable facts from a longer passage of text (preferences, habits, biographical info, constraints) and save each as a separate Walrus Memory memory. Use this when you want MemWal's LLM to split the facts out of a transcript or notes for you; if you already know the exact facts, use memwal_remember or memwal_remember_bulk instead. " +
+                (proactive ? AUTO_SAVE_OPT_IN_RULE + " " + SECRET_EXCLUSION_RULES : SECRET_EXCLUSION_SUMMARY),
             inputSchema: {
                 type: "object",
                 properties: {
@@ -169,20 +184,60 @@ function buildToolDefinitions(proactive) {
             description: "Sign this MCP client into your Walrus Memory account by opening a browser. Run once when the agent reports Walrus Memory is not signed in. Opens the dashboard in the default browser, waits for wallet approval, then writes credentials to ~/.memwal/credentials.json. Other memwal_* tools become usable on the next call after a successful login.",
             inputSchema: {
                 type: "object",
-                properties: {},
+                properties: {
+                    freshKey: {
+                        type: "boolean",
+                        default: false,
+                        description: "Mint a new delegate key instead of reusing the one a previous unfinished sign-in left pending. Leave false for an ordinary login. Set it only after a normal sign-in has already failed on the pending key — it abandons that key, which must then be removed from the dashboard if it was approved on-chain, and the new one needs its own add_delegate_key transaction.",
+                    },
+                },
                 additionalProperties: false,
             },
         },
     ];
 }
+/** Tool names the OLDEST relayer this bridge still talks to serves.
+ *
+ * The bridge ships on npm and updates itself; a relayer ships per environment
+ * and does not, so the bridge is routinely NEWER than the relayer it dials —
+ * 0.0.14-dev.0 against prod and staging on 0.0.13, which is GH #928. The
+ * cold-start list is served before any relayer capability is known, so every
+ * name in it that the dialled relayer does not serve is a tool the agent can
+ * be told about and then cannot call.
+ *
+ * Cold start is therefore a FLOOR, not a forecast: add a name here only once
+ * the tool has shipped to prod, never when it lands on dev. Newer tools reach
+ * the client a beat later anyway — the relayer's own `tools/list` replaces
+ * this one and `notifications/tools/list_changed` tells the client to re-read
+ * it. `memwal_remember_status` is the worked example: it exists on dev, not on
+ * prod/staging, and belongs here only after a prod release carries it. */
+export const BASELINE_RELAYER_TOOLS = new Set([
+    "memwal_remember",
+    "memwal_remember_bulk",
+    "memwal_recall",
+    "memwal_analyze",
+    "memwal_restore",
+    "memwal_health",
+]);
+/** Served by this process, so no relayer has to know about it. Advertising it
+ * at cold start is always safe. */
+const LOCALLY_SERVED_TOOLS = new Set(["memwal_login"]);
+/** Every tool this bridge can describe, baseline or not. Only the baseline
+ * subset is advertised at cold start; this is what the schema tests pin, so a
+ * newer tool's shape stays reviewed while it waits for a prod release. */
+export const ALL_TOOL_DEFINITIONS = buildToolDefinitions(true);
+/** Drop anything the oldest supported relayer would not serve. */
+function coldStartTools(proactive) {
+    return buildToolDefinitions(proactive).filter((t) => BASELINE_RELAYER_TOOLS.has(t.name) || LOCALLY_SERVED_TOOLS.has(t.name));
+}
 /** Signed-in cold-start list (bridge). Credentials exist; the relayer session
  * is not up yet. Proactive wording so clients that keep the first tools/list
  * still save/recall without being asked. */
-export const TOOL_DEFINITIONS = buildToolDefinitions(true);
+export const TOOL_DEFINITIONS = coldStartTools(true);
 /** Signed-out list (auth-required). No credentials, so every memory call
  * fails: keep conservative wording or the model will spam remember and get
  * a stream of auth errors. */
-export const SIGNED_OUT_TOOL_DEFINITIONS = buildToolDefinitions(false);
+export const SIGNED_OUT_TOOL_DEFINITIONS = coldStartTools(false);
 /** How long to wait for the local listener to bind + emit its URL before we
  * give up and return an error. Should be near-instant; 5s is paranoia. */
 const URL_READY_TIMEOUT_MS = 5_000;
@@ -205,13 +260,17 @@ const LOGIN_INSTRUCTION = [
 /** Replaces {@link LOGIN_INSTRUCTION} after a failed attempt, which
  * {@link loginFailureNotice} has just described. The generic copy promises "no
  * client restart" and leads with `memwal_login`; for a key the user already
- * approved, a restart is the only thing that recovers it and signing in again
- * cannot register it twice. So the retry is offered only for the case it
- * actually fixes. */
+ * approved, a restart is the only thing that recovers it and a plain retry
+ * reuses it rather than registering a second one. So the retry names
+ * `freshKey` for the case the plain one cannot fix. */
 const LOGIN_RETRY_INSTRUCTION = [
-    "If you did not approve the wallet step, start a new sign-in: call the `memwal_login`",
-    "tool from this client, or run `npx -y @mysten-incubation/memwal-mcp login`. Open the",
-    "new link straight away and leave this client running through the wallet prompt.",
+    "Start a new sign-in: call the `memwal_login` tool from this client, or run",
+    "`npx -y @mysten-incubation/memwal-mcp login`. Open the new link straight away and",
+    "leave this client running through the wallet prompt.",
+    "",
+    "If that keeps failing on the same key, call `memwal_login` with `freshKey: true` to",
+    "mint a new one. That abandons the pending key: if you already approved it on-chain,",
+    "remove it from the dashboard afterwards.",
 ].join("\n");
 /** Set when a background `memwal_login` ends without credentials. The tool call
  * already returned the URL by then, so this is the only place left to say so. */
@@ -252,7 +311,7 @@ function sendLogMessage(level, text) {
  * issues any other memwal_* tool to verify — which now succeeds because
  * the bridge picks up the saved creds on its next call.
  */
-async function handleLoginToolCall(config, _progressToken) {
+async function handleLoginToolCall(config, _progressToken, freshKey) {
     // Fire login but DO NOT await the wallet callback — it runs in the
     // background. openBrowser: false because (a) child-process spawning a
     // browser is unreliable across MCP clients, and (b) macOS `open <url>`
@@ -263,12 +322,17 @@ async function handleLoginToolCall(config, _progressToken) {
     // Concurrent memwal_login calls join this in-flight flow instead of
     // opening a second listener (that race hung later recall/remember).
     lastLoginFailure = null;
+    let discardedKey;
     const session = startOrReuseLoginFlow({
         relayerUrl: config.relayerUrl,
         webUrl: config.webUrl,
         label: config.label,
         timeoutMs: resolveLoginTimeoutMs(),
         openBrowser: false,
+        freshKey,
+        onDiscarded: (key) => {
+            discardedKey = key;
+        },
         onUrl: (url) => {
             sendLogMessage("info", `Walrus Memory MCP login URL: ${url}`);
         },
@@ -302,6 +366,9 @@ async function handleLoginToolCall(config, _progressToken) {
         url = await Promise.race([session.url, timeoutPromise]);
     }
     catch (err) {
+        if (isLoginSuperseded(err)) {
+            return { isError: true, text: "This sign-in was replaced by a newer memwal_login. Open that result instead of starting another login." };
+        }
         const msg = err instanceof Error ? err.message : String(err);
         log.error("memwal_login.tool.url_not_ready", { msg });
         return {
@@ -326,6 +393,7 @@ async function handleLoginToolCall(config, _progressToken) {
             url,
             credentialsPath: credsPath(),
             signedIn: loadCreds() !== null,
+            discardedKey,
         }),
     };
 }
@@ -399,7 +467,7 @@ function handleAuthLine(line, config) {
             // Returns near-instantly with the click-able URL. The listener
             // stays alive in the background — see handleLoginToolCall for the
             // rationale on not blocking.
-            void handleLoginToolCall(config, progressToken).then((result) => {
+            void handleLoginToolCall(config, progressToken, params.arguments?.freshKey === true).then((result) => {
                 writeStdoutMessage({
                     jsonrpc: "2.0",
                     id,

package/dist/auth-required.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-required.js","sourceRoot":"","sources":["../src/auth-required.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAA0B,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAWlD,MAAM,mBAAmB,GACrB,8KAA8K,CAAC;AACnL,MAAM,kBAAkB,GACpB,wrBAAwrB,CAAC;AAC7rB,MAAM,iBAAiB,GACnB,+GAA+G,CAAC;AACpH,MAAM,gBAAgB,GAClB,qdAAqd,CAAC;AAE1d;;+EAE+E;AAC/E,SAAS,oBAAoB,CAAC,SAAkB;IAC5C,OAAO;QACP;YACI,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB;YACjE,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACtC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,gkBAAgkB;YACpkB,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,KAAK,EAAE;wBACH,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;wBACvC,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,EAAE;qBACf;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EACP,8eAA8e;YAClf,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACxC,4DAA4D;oBAC5D,8DAA8D;oBAC9D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,OAAO,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;wBACvC,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,EAAE;qBACf;oBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;iBAC1E;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,sDAAsD;gBACtD,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB;YAC7D,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACvC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;oBACjE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,WAAW,EAAE;wBACT,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,CAAC;wBACV,WAAW,EACP,6NAA6N;qBACpO;iBACJ;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;YAC3D,WAAW,EACP,sVAAsV;YAC1V,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACtC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,+rBAA+rB;YACnsB,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;iBACpE;gBACD,QAAQ,EAAE,CAAC,WAAW,CAAC;gBACvB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EACP,0RAA0R;YAC9R,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,wVAAwV;YAC5V,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,KAAK;aAC9B;SACJ;KACA,CAAC;AACN,CAAC;AAED;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAE3D;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,2BAA2B,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;AAEvE;0EAC0E;AAC1E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,EAAE;IACF,sFAAsF;IACtF,oFAAoF;IACpF,oEAAoE;IACpE,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,wFAAwF;IACxF,EAAE;IACF,yFAAyF;IACzF,mFAAmF;CACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;qBAKqB;AACrB,MAAM,uBAAuB,GAAG;IAC5B,sFAAsF;IACtF,sFAAsF;IACtF,iFAAiF;CACpF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;iFACiF;AACjF,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,SAAS,kBAAkB,CAAC,GAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAkBD;;;iDAGiD;AACjD,SAAS,cAAc,CAAC,KAAmC,EAAE,IAAY;IACrE,kBAAkB,CAAC;QACf,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE;YACJ,KAAK;YACL,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;SACb;KACJ,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,mBAAmB,CAC9B,MAA0B,EAC1B,cAAuB;IAEvB,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,gBAAgB,GAAG,IAAI,CAAC;IACxB,MAAM,OAAO,GAAG,qBAAqB,CACjC;QACI,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,qBAAqB,EAAE;QAClC,WAAW,EAAE,KAAK;QAClB,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,cAAc,CAAC,MAAM,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;KACJ,EACD,CAAC,KAAK,EAAE,EAAE;QACN,gBAAgB,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,wBAAwB;QACxB,cAAc,CACV,MAAM,EACN,wBAAwB,CAAC;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,SAAS,EAAE;SAC/B,CAAC,CACL,CAAC;IACN,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACJ,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,gBAAgB,GAAG,GAAG,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,cAAc,CAAC,SAAS,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC,CACJ,CAAC;IAEF,mEAAmE;IACnE,mEAAmE;IACnE,gDAAgD;IAChD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACrD,UAAU,CACN,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EACjD,oBAAoB,CACvB,CAAC,KAAK,EAAE,EAAW,CACvB,CAAC;IAEF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO;YACH,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACF,0CAA0C,GAAG,EAAE;gBAC/C,EAAE;gBACF,uBAAuB;gBACvB,EAAE;gBACF,gDAAgD;aACnD,CAAC,IAAI,CAAC,IAAI,CAAC;SACf,CAAC;IACN,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO;QACH,OAAO,EAAE,KAAK;QACd,uEAAuE;QACvE,kEAAkE;QAClE,qEAAqE;QACrE,uBAAuB;QACvB,IAAI,EAAE,WAAW,CAAC;YACd,GAAG;YACH,eAAe,EAAE,SAAS,EAAE;YAC5B,QAAQ,EAAE,SAAS,EAAE,KAAK,IAAI;SACjC,CAAC;KACL,CAAC;AACN,CAAC;AAaD;;;;;;;GAOG;AACH,SAAS,cAAc,CACnB,IAAY,EACZ,MAA0B;IAE1B,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,uCAAuC;IACvC,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,aAAa,EAAE,UAAU,CAAC,OAAO;gBACjC,IAAI,EAAE,eAAe;aACxB,CAAC,CAAC;QACP,CAAC;QACD,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE;gBACJ,eAAe,EAAE,YAAY;gBAC7B,4DAA4D;gBAC5D,yDAAyD;gBACzD,wDAAwD;gBACxD,gEAAgE;gBAChE,8DAA8D;gBAC9D,qCAAqC;gBACrC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;gBAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;gBAC3D,YAAY,EAAE,0BAA0B;aAC3C;SACJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE;SACjD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAI/B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAElD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,kEAAkE;YAClE,6BAA6B;YAC7B,KAAK,mBAAmB,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBAC5D,kBAAkB,CAAC;oBACf,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;qBAC1B;iBACJ,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,6DAA6D;QAC7D,wEAAwE;QACxE,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACR,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE;gBACJ,OAAO,EAAE;oBACL;wBACI,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,gBAAgB;4BAClB,CAAC,CAAC,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,uBAAuB,EAAE;4BACrE,CAAC,CAAC,iBAAiB;qBAC1B;iBACJ;gBACD,OAAO,EAAE,IAAI;aAChB;SACJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,wDAAwD;IACxD,kBAAkB,CAAC;QACf,OAAO,EAAE,KAAK;QACd,EAAE;QACF,KAAK,EAAE;YACH,IAAI,EAAE,CAAC,KAAK;YACZ,OAAO,EAAE,qBAAqB,MAAM,IAAI,WAAW,EAAE;SACxD;KACJ,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,MAA0B;IAE1B,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAChC,CAAC,CAAC;IAEH,OAAO,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,GAAS,EAAE;YACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACnC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAEtB,MAAM,YAAY,GAAa,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,EAAU,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;wBAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBAC/C,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;oBAClC,YAAY,EAAE,YAAY,CAAC,MAAM;iBACpC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChD,OAAO;YACX,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,GAAS,EAAE;YACrB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}
+{"version":3,"file":"auth-required.js","sourceRoot":"","sources":["../src/auth-required.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,SAAS,EAAE,SAAS,EAA0B,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,4BAA4B,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,wBAAwB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACH,sBAAsB,EACtB,wBAAwB,EACxB,qBAAqB,GACxB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAWlD;;;;;;;GAOG;AACH,MAAM,mBAAmB,GACrB,+KAA+K;IAC/K,wBAAwB,CAAC;AAC7B,MAAM,kBAAkB,GACpB,8yBAA8yB;IAC9yB,qBAAqB;IACrB,GAAG;IACH,sBAAsB,CAAC;AAC3B,MAAM,iBAAiB,GACnB,+GAA+G,CAAC;AACpH,MAAM,gBAAgB,GAClB,qdAAqd,CAAC;AAE1d;;+EAE+E;AAC/E,SAAS,oBAAoB,CAAC,SAAkB;IAC5C,OAAO;QACP;YACI,IAAI,EAAE,iBAAiB;YACvB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,mBAAmB;YACjE,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACtC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,sBAAsB;YAC5B,KAAK,EAAE,yBAAyB;YAChC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,+oBAA+oB;gBAC/oB,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,GAAG,GAAG,GAAG,sBAAsB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACjG,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,KAAK,EAAE;wBACH,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;wBACvC,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,EAAE;qBACf;oBACD,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,wBAAwB;YAC9B,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EACP,8eAA8e;YAClf,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACxC,4DAA4D;oBAC5D,8DAA8D;oBAC9D,2DAA2D;oBAC3D,4DAA4D;oBAC5D,4DAA4D;oBAC5D,OAAO,EAAE;wBACL,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;wBACvC,QAAQ,EAAE,CAAC;wBACX,QAAQ,EAAE,EAAE;qBACf;oBACD,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE;iBAC1E;gBACD,mEAAmE;gBACnE,gEAAgE;gBAChE,sDAAsD;gBACtD,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,iBAAiB;YACxB,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EAAE,SAAS,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB;YAC7D,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACvC,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;oBACjE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;oBAC7B,WAAW,EAAE;wBACT,IAAI,EAAE,QAAQ;wBACd,OAAO,EAAE,CAAC;wBACV,WAAW,EACP,6NAA6N;qBACpO;iBACJ;gBACD,QAAQ,EAAE,CAAC,OAAO,CAAC;gBACnB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,IAAI,EAAE;YAC3D,WAAW,EACP,uVAAuV;gBACvV,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,GAAG,GAAG,GAAG,sBAAsB,CAAC,CAAC,CAAC,wBAAwB,CAAC;YACjG,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBACtC,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;iBAChC;gBACD,QAAQ,EAAE,CAAC,MAAM,CAAC;gBAClB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,gBAAgB;YACtB,KAAK,EAAE,sBAAsB;YAC7B,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,+rBAA+rB;YACnsB,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,EAAE;oBAC3C,KAAK,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;iBACpE;gBACD,QAAQ,EAAE,CAAC,WAAW,CAAC;gBACvB,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,eAAe;YACrB,KAAK,EAAE,4BAA4B;YACnC,WAAW,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,EAAE,KAAK,EAAE;YAC3D,WAAW,EACP,0RAA0R;YAC9R,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE,EAAE;gBACd,oBAAoB,EAAE,KAAK;aAC9B;SACJ;QACD;YACI,IAAI,EAAE,cAAc;YACpB,KAAK,EAAE,0BAA0B;YACjC,WAAW,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE;YAC5D,WAAW,EACP,wVAAwV;YAC5V,WAAW,EAAE;gBACT,IAAI,EAAE,QAAQ;gBACd,UAAU,EAAE;oBACR,QAAQ,EAAE;wBACN,IAAI,EAAE,SAAS;wBACf,OAAO,EAAE,KAAK;wBACd,WAAW,EACP,2WAA2W;qBAClX;iBACJ;gBACD,oBAAoB,EAAE,KAAK;aAC9B;SACJ;KACA,CAAC;AACN,CAAC;AAED;;;;;;;;;;;;;;0EAc0E;AAC1E,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IAC/D,iBAAiB;IACjB,sBAAsB;IACtB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,eAAe;CAClB,CAAC,CAAC;AAEH;mCACmC;AACnC,MAAM,oBAAoB,GAAwB,IAAI,GAAG,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAE5E;;0EAE0E;AAC1E,MAAM,CAAC,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,IAAI,CAAC,CAAC;AAE/D,kEAAkE;AAClE,SAAS,cAAc,CAAC,SAAkB;IACtC,OAAO,oBAAoB,CAAC,SAAS,CAAC,CAAC,MAAM,CACzC,CAAC,CAAC,EAAE,EAAE,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAChF,CAAC;AACN,CAAC;AAED;;4CAE4C;AAC5C,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;AAErD;;8BAE8B;AAC9B,MAAM,CAAC,MAAM,2BAA2B,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;AAEjE;0EAC0E;AAC1E,MAAM,oBAAoB,GAAG,KAAK,CAAC;AAEnC,MAAM,iBAAiB,GAAG;IACtB,sCAAsC;IACtC,EAAE;IACF,sFAAsF;IACtF,oFAAoF;IACpF,oEAAoE;IACpE,EAAE;IACF,4EAA4E;IAC5E,EAAE;IACF,gDAAgD;IAChD,EAAE;IACF,wFAAwF;IACxF,EAAE;IACF,yFAAyF;IACzF,mFAAmF;CACtF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;;;;;uDAKuD;AACvD,MAAM,uBAAuB,GAAG;IAC5B,4EAA4E;IAC5E,mFAAmF;IACnF,sDAAsD;IACtD,EAAE;IACF,qFAAqF;IACrF,qFAAqF;IACrF,0CAA0C;CAC7C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAEb;iFACiF;AACjF,IAAI,gBAAgB,GAAkB,IAAI,CAAC;AAE3C,SAAS,kBAAkB,CAAC,GAAe;IACvC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC;AACrD,CAAC;AAkBD;;;iDAGiD;AACjD,SAAS,cAAc,CAAC,KAAmC,EAAE,IAAY;IACrE,kBAAkB,CAAC;QACf,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,uBAAuB;QAC/B,MAAM,EAAE;YACJ,KAAK;YACL,MAAM,EAAE,YAAY;YACpB,IAAI,EAAE,IAAI;SACb;KACJ,CAAC,CAAC;AACP,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,KAAK,UAAU,mBAAmB,CAC9B,MAA0B,EAC1B,cAAuB,EACvB,QAAiB;IAEjB,mEAAmE;IACnE,sEAAsE;IACtE,uEAAuE;IACvE,iEAAiE;IACjE,sEAAsE;IACtE,8CAA8C;IAC9C,EAAE;IACF,oEAAoE;IACpE,oEAAoE;IACpE,gBAAgB,GAAG,IAAI,CAAC;IACxB,IAAI,YAAgE,CAAC;IACrE,MAAM,OAAO,GAAG,qBAAqB,CACjC;QACI,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,SAAS,EAAE,qBAAqB,EAAE;QAClC,WAAW,EAAE,KAAK;QAClB,QAAQ;QACR,WAAW,EAAE,CAAC,GAAG,EAAE,EAAE;YACjB,YAAY,GAAG,GAAG,CAAC;QACvB,CAAC;QACD,KAAK,EAAE,CAAC,GAAG,EAAE,EAAE;YACX,cAAc,CAAC,MAAM,EAAE,gCAAgC,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;KACJ,EACD,CAAC,KAAK,EAAE,EAAE;QACN,gBAAgB,GAAG,IAAI,CAAC;QACxB,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;SACzC,CAAC,CAAC;QACH,kEAAkE;QAClE,+DAA+D;QAC/D,mEAAmE;QACnE,wBAAwB;QACxB,cAAc,CACV,MAAM,EACN,wBAAwB,CAAC;YACrB,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,eAAe,EAAE,KAAK,CAAC,eAAe;YACtC,eAAe,EAAE,SAAS,EAAE;SAC/B,CAAC,CACL,CAAC;IACN,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;QACJ,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,gBAAgB,GAAG,GAAG,CAAC;QACvB,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5C,cAAc,CAAC,SAAS,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;IAChF,CAAC,CACJ,CAAC;IAEF,mEAAmE;IACnE,mEAAmE;IACnE,gDAAgD;IAChD,MAAM,cAAc,GAAG,IAAI,OAAO,CAAS,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,CACrD,UAAU,CACN,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,EACjD,oBAAoB,CACvB,CAAC,KAAK,EAAE,EAAW,CACvB,CAAC;IAEF,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACD,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,wGAAwG,EAAE,CAAC;QAC7I,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC7D,GAAG,CAAC,KAAK,CAAC,iCAAiC,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,OAAO;YACH,OAAO,EAAE,IAAI;YACb,IAAI,EAAE;gBACF,0CAA0C,GAAG,EAAE;gBAC/C,EAAE;gBACF,uBAAuB;gBACvB,EAAE;gBACF,gDAAgD;aACnD,CAAC,IAAI,CAAC,IAAI,CAAC;SACf,CAAC;IACN,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IACjD,OAAO;QACH,OAAO,EAAE,KAAK;QACd,uEAAuE;QACvE,kEAAkE;QAClE,qEAAqE;QACrE,uBAAuB;QACvB,IAAI,EAAE,WAAW,CAAC;YACd,GAAG;YACH,eAAe,EAAE,SAAS,EAAE;YAC5B,QAAQ,EAAE,SAAS,EAAE,KAAK,IAAI;YAC9B,YAAY;SACf,CAAC;KACL,CAAC;AACN,CAAC;AAaD;;;;;;;GAOG;AACH,SAAS,cAAc,CACnB,IAAY,EACZ,MAA0B;IAE1B,IAAI,GAAe,CAAC;IACpB,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAe,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,uCAAuC;IACvC,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QACnD,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;IAE1B,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,UAAU,GAAG,4BAA4B,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,UAAU,EAAE,CAAC;YACb,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE;gBAC5B,UAAU,EAAE,UAAU,CAAC,IAAI;gBAC3B,aAAa,EAAE,UAAU,CAAC,OAAO;gBACjC,IAAI,EAAE,eAAe;aACxB,CAAC,CAAC;QACP,CAAC;QACD,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE;gBACJ,eAAe,EAAE,YAAY;gBAC7B,4DAA4D;gBAC5D,yDAAyD;gBACzD,wDAAwD;gBACxD,gEAAgE;gBAChE,8DAA8D;gBAC9D,qCAAqC;gBACrC,YAAY,EAAE,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE;gBAC9C,UAAU,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,kBAAkB,EAAE;gBAC3D,YAAY,EAAE,0BAA0B;aAC3C;SACJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,uEAAuE;QACvE,0EAA0E;QAC1E,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC5B,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE,EAAE,KAAK,EAAE,2BAA2B,EAAE;SACjD,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAI/B,CAAC;QACF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC;QAC7B,MAAM,aAAa,GAAG,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC;QAElD,IAAI,QAAQ,KAAK,cAAc,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,kEAAkE;YAClE,6BAA6B;YAC7B,KAAK,mBAAmB,CACpB,MAAM,EACN,aAAa,EACb,MAAM,CAAC,SAAS,EAAE,QAAQ,KAAK,IAAI,CACtC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;gBACd,kBAAkB,CAAC;oBACf,OAAO,EAAE,KAAK;oBACd,EAAE;oBACF,MAAM,EAAE;wBACJ,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;wBAC9C,OAAO,EAAE,MAAM,CAAC,OAAO;qBAC1B;iBACJ,CAAC,CAAC;YACP,CAAC,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QAChB,CAAC;QAED,6DAA6D;QAC7D,wEAAwE;QACxE,sEAAsE;QACtE,8BAA8B;QAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,IAAI,KAAK,EAAE,CAAC;YACR,gBAAgB,GAAG,IAAI,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,CAAC;QACrB,CAAC;QAED,kBAAkB,CAAC;YACf,OAAO,EAAE,KAAK;YACd,EAAE;YACF,MAAM,EAAE;gBACJ,OAAO,EAAE;oBACL;wBACI,IAAI,EAAE,MAAM;wBACZ,IAAI,EAAE,gBAAgB;4BAClB,CAAC,CAAC,GAAG,kBAAkB,CAAC,gBAAgB,CAAC,GAAG,uBAAuB,EAAE;4BACrE,CAAC,CAAC,iBAAiB;qBAC1B;iBACJ;gBACD,OAAO,EAAE,IAAI;aAChB;SACJ,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,wDAAwD;IACxD,kBAAkB,CAAC;QACf,OAAO,EAAE,KAAK;QACd,EAAE;QACF,KAAK,EAAE;YACH,IAAI,EAAE,CAAC,KAAK;YACZ,OAAO,EAAE,qBAAqB,MAAM,IAAI,WAAW,EAAE;SACxD;KACJ,CAAC,CAAC;IACH,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACvC,MAA0B;IAE1B,GAAG,CAAC,IAAI,CAAC,8BAA8B,EAAE;QACrC,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;KAChC,CAAC,CAAC;IAEH,OAAO,MAAM,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;QACrD,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,GAAS,EAAE;YACtB,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC7C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC3C,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,CAAC,KAAa,EAAQ,EAAE;YACnC,GAAG,IAAI,KAAK,CAAC;YACb,IAAI,EAAU,CAAC;YACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACnC,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBACpD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBACxB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;oBAAE,SAAS;gBAEnC,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;gBAChD,IAAI,CAAC,OAAO;oBAAE,SAAS;gBAEvB,+DAA+D;gBAC/D,+DAA+D;gBAC/D,+DAA+D;gBAC/D,OAAO,GAAG,IAAI,CAAC;gBACf,MAAM,EAAE,CAAC;gBACT,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;gBAEtB,MAAM,YAAY,GAAa,CAAC,OAAO,CAAC,CAAC;gBACzC,IAAI,EAAU,CAAC;gBACf,OAAO,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;oBACnC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAC9C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;oBACxB,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC;wBAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC3C,CAAC;gBAED,GAAG,CAAC,IAAI,CAAC,wCAAwC,EAAE;oBAC/C,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,SAAS;oBAClC,YAAY,EAAE,YAAY,CAAC,MAAM;iBACpC,CAAC,CAAC;gBACH,OAAO,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC;gBAChD,OAAO;YACX,CAAC;QACL,CAAC,CAAC;QAEF,MAAM,KAAK,GAAG,GAAS,EAAE;YACrB,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,IAAI,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,CAAC,SAAS,CAAC,CAAC;QACvB,CAAC,CAAC;QAEF,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAClC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/auth.d.ts

@@ -21,25 +21,163 @@ export interface MemWalCredentials {
     version: 1;
 }
 /**
- * Which credentials file this process should read and write.
+ * Refusal of a `MEMWAL_CREDS_DIR` that cannot be trusted to sit outside a
+ * repository. Thrown, never swallowed — see {@link credsDirOverride}.
+ */
+export declare class UntrustedCredsDirError extends Error {
+    constructor(message: string);
+}
+/** The approval store. Outside every repository, on purpose. */
+export declare function projectApprovalsPath(): string;
+/**
+ * What approval is granted against: the destination, not the file's bytes.
  *
- * The nearest project-local `.memwal/credentials.json` at or above the working
- * directory wins over the global one, the way `.npmrc` and `.git/config`
- * resolve. Signing in from one project otherwise repoints every other project
- * on the machine at a different account and delegate key, silently — memories
- * then land on the wrong account, on immutable storage, with no delete path
- * (GH #628).
+ * Account, delegate and relayer are the three fields that decide WHERE a
+ * memory ends up and WHO signs for it. Hashing them means a project file may
+ * be re-saved, relabelled or reformatted freely, while any edit that moves the
+ * destination invalidates the approval and has to be approved again. The
+ * delegate private key is deliberately NOT part of it — it must never be read
+ * into a record that gets written back out.
+ */
+export declare function credentialsFingerprint(creds: {
+    accountId: string;
+    delegateAddress: string;
+    relayerUrl: string;
+}): string;
+/** One approved project credentials file. Contains no secret. */
+export interface ProjectApproval {
+    /** Canonical path of the approved `.memwal/credentials.json`. */
+    path: string;
+    fingerprint: string;
+    accountId: string;
+    delegateAddress: string;
+    relayerUrl: string;
+    approvedAt: string;
+}
+/** Why a project credentials file was, or was not, used. */
+export type ProjectCredsDecision = 
+/** Approved for exactly this account + delegate + relayer: in use. */
+"approved"
+/** Never approved on this machine. Ignored. */
+ | "unapproved"
+/** Approved once, but the destination has since changed. Ignored. */
+ | "changed"
+/** Present but not valid credentials, so there is nothing to approve. */
+ | "unreadable";
+export interface ProjectCredsInfo {
+    /** The project-local file that was found. */
+    path: string;
+    decision: ProjectCredsDecision;
+    /** Destination it points at. Absent when the file could not be read — and
+     * never the delegate private key, which no caller of this ever needs. */
+    accountId?: string;
+    relayerUrl?: string;
+}
+/** Which file won, and what happened to any project-local file that did not. */
+export interface CredsResolution {
+    /** The file this process reads and writes. */
+    path: string;
+    source: "override" | "project" | "global";
+    /** The project-local file found by the walk, if any — present whether or
+     * not it was used, so callers can report one they ignored. */
+    project?: ProjectCredsInfo;
+}
+/**
+ * Which credentials file this process should read and write, and why.
  *
- * Presence-based on purpose: creating the local file is the opt-in, so this is
- * purely additive. Resolved per call rather than at module load, because the
- * working directory is not knowable at import time.
+ * `MEMWAL_CREDS_DIR` wins outright, and skips the approval gate — but only a
+ * value {@link credsDirOverride} accepts, i.e. a non-empty ABSOLUTE path
+ * outside the current project. It is "trusted" exactly as far as whoever set
+ * the environment is, and an MCP client will hand this process an `env` block
+ * it read out of the checkout, so a value that could have been committed is
+ * refused rather than obeyed. Otherwise the nearest project-local
+ * `.memwal/credentials.json` at or above the working directory is used IF the
+ * user has approved that exact destination on this machine (WALM-639), and the
+ * global file is used in every other case — including an unapproved, altered
+ * or malformed project file. Falling back rather than failing keeps a machine
+ * that has never seen a project file behaving exactly as it always did.
  *
- * `MEMWAL_CREDS_DIR` overrides both project and global resolution when set,
- * and is re-read on every call.
+ * Resolved per call rather than at module load, because neither the working
+ * directory nor the approval store is knowable at import time.
  */
+export declare function resolveCreds(): CredsResolution;
+/** The credentials file in use. Thin wrapper over {@link resolveCreds} so the
+ * many callers that only need a path are unchanged. */
 export declare function credsPath(): string;
 /** Load credentials from disk. Returns null if missing or malformed. */
 export declare function loadCreds(): MemWalCredentials | null;
+/** What {@link approveProjectCreds} did. */
+export interface ApproveProjectResult {
+    outcome: 
+    /** Newly approved. */
+    "approved"
+    /** Approved again after the destination changed. */
+     | "reapproved"
+    /** Already approved for this exact destination; nothing written. */
+     | "already-approved"
+    /** No project-local credentials file at or above the working directory. */
+     | "none"
+    /** A project file exists but is not valid credentials. */
+     | "unreadable"
+    /** `MEMWAL_CREDS_DIR` is set, so project resolution never runs. */
+     | "overridden";
+    projectPath?: string;
+    accountId?: string;
+    relayerUrl?: string;
+    /** Destination the previous approval covered, when this replaced one. */
+    previousAccountId?: string;
+    previousRelayerUrl?: string;
+    approvalsPath: string;
+}
+/**
+ * Approve the project-local credentials found from the working directory.
+ *
+ * Deliberately takes no arguments: it approves what resolution would otherwise
+ * ignore, from the same directory, so "what am I approving" and "what will be
+ * used" cannot drift apart.
+ */
+export declare function approveProjectCreds(): ApproveProjectResult;
+/** What {@link revokeProjectCredsApproval} did. */
+export interface RevokeProjectResult {
+    outcome: "revoked" | "none";
+    projectPath?: string;
+    approvalsPath: string;
+}
+/**
+ * Withdraw the approval for the project-local credentials here.
+ *
+ * Keyed on the path rather than on the file's current contents, so an approval
+ * can be withdrawn even after the file it covered was edited or deleted — a
+ * revoke that only worked while the destination still matched would be
+ * useless exactly when it is wanted.
+ */
+export declare function revokeProjectCredsApproval(): RevokeProjectResult;
+/**
+ * The warning for a project credentials file that was found and NOT used, or
+ * null when there is nothing to report.
+ *
+ * Says which file was ignored, where memory is going instead, and the exact
+ * command that approves it — a silent fallback would be the mirror image of
+ * the silent redirect this gate exists to stop. Never contains a key: the only
+ * fields it reads are the account id and the relayer URL.
+ */
+export declare function formatProjectCredsNotice(resolution?: CredsResolution): string | null;
+/**
+ * What approving a project credentials file costs, beyond redirecting reads.
+ *
+ * Approval does not just decide which file is READ — it decides which file is
+ * WRITTEN. `saveCreds` writes to `credsPath()`, so from here on every sign-in
+ * from this project puts a fresh 64-hex Ed25519 delegate seed, in plaintext,
+ * into a directory that is inside the repository. An attacker who planted the
+ * file planted the directory too, so it is already tracked rather than ignored,
+ * and `git add -A` stages the key. The user cannot weigh that if nobody says
+ * it, and "you approved a destination" is not the same sentence as "you
+ * approved storing a private key in your repo".
+ *
+ * Separate from {@link formatProjectCredsNotice} on purpose: that one is about
+ * a file that was IGNORED, this one is about a file that is about to be used.
+ */
+export declare function formatProjectCredsStorageWarning(projectPath: string): string;
 /**
  * Write credentials with secure (`0600`) permission, to whichever file
  * `credsPath()` resolves to.
@@ -102,6 +240,11 @@ export interface SaveCredsResult {
  * callback arrives, by which point a delegate key has already been registered
  * on-chain — so a warning that waits for both ids is a warning that arrives
  * too late to act on.
+ *
+ * When the file being replaced is an approved project one, that is also the
+ * last moment before a new private key lands inside a repository, so the
+ * storage warning is repeated here rather than left behind at approval time —
+ * approval may have been months ago, or done by someone else on the machine.
  */
 export declare function formatPendingSignInWarning(): string | null;
 /**
@@ -156,8 +299,26 @@ export interface PendingLogin {
     createdAt: string;
     version: 1;
 }
-/** Sits beside whichever credentials file `credsPath()` resolves to, so a
- * project-local sign-in recovers into that same project. */
+/**
+ * Where the write-ahead record lives — never inside a repository.
+ *
+ * It used to sit beside whichever credentials file `credsPath()` resolved to,
+ * which reads as "recover into the project you signed in from" and is the right
+ * intent. But for an approved project that path is `<repo>/.memwal/`, so every
+ * sign-in dropped a plaintext 64-hex delegate seed into the working tree —
+ * under a directory an attacker who planted the credentials file had already
+ * created, so tracked rather than ignored, and staged by `git add -A`.
+ *
+ * Nothing about this record needs to be in the repo. It is short-lived
+ * handshake state, nobody edits it by hand, and the only property that matters
+ * is that the project which started a sign-in is the one that can reclaim it.
+ * So it moves to the trusted state directory, keyed by a hash of the
+ * credentials path: same per-project scoping, no key material in the checkout.
+ *
+ * The non-project cases are byte-for-byte where they always were —
+ * `dirname(credsPath())` IS `trustedStateDir()` for both the override and the
+ * global file — so a machine that has never approved a project sees no change.
+ */
 export declare function pendingLoginPath(): string;
 /**
  * Persist the pending keypair. Throws if it cannot.
@@ -168,10 +329,10 @@ export declare function pendingLoginPath(): string;
  * the connect URL while claiming a durability that does not exist — the
  * original WALM-332 loss, now silent.
  *
- * Failing the login costs the user nothing: this file sits beside
- * `credentials.json`, so a directory that cannot take it cannot take the
- * credentials either. The same login would have failed at the callback anyway,
- * one on-chain `add_delegate_key` later.
+ * Failing the login costs the user nothing: this file lives in the same
+ * trusted state directory the approval record does, so a directory that cannot
+ * take it is one this process cannot keep state in at all. The same login would
+ * have failed at the callback anyway, one on-chain `add_delegate_key` later.
  */
 export declare function savePendingLogin(pending: PendingLogin): void;
 /**

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAkDD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAWpD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;GASG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAQ1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C;AAmCD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IACzB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;CACd;AAED;4DAC4D;AAC5D,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAe5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAoBtD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,iBAAiB;IAC9B,kEAAkE;IAClE,kBAAkB,EAAE,MAAM,CAAC;IAC3B,wEAAwE;IACxE,oBAAoB,EAAE,MAAM,CAAC;IAC7B,2EAA2E;IAC3E,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,aAAa,EAAE,MAAM,CAAC;IACtB,uFAAuF;IACvF,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,SAAS,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,OAAO,EAAE,CAAC,CAAC;CACd;AAoED;;;GAGG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;gBACjC,OAAO,EAAE,MAAM;CAI9B;AAsID,gEAAgE;AAChE,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE;IAC1C,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;CACtB,GAAG,MAAM,CAIT;AAED,iEAAiE;AACjE,MAAM,WAAW,eAAe;IAC5B,iEAAiE;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACtB;AAwDD,4DAA4D;AAC5D,MAAM,MAAM,oBAAoB;AAC5B,sEAAsE;AACpE,UAAU;AACZ,+CAA+C;GAC7C,YAAY;AACd,qEAAqE;GACnE,SAAS;AACX,yEAAyE;GACvE,YAAY,CAAC;AAEnB,MAAM,WAAW,gBAAgB;IAC7B,6CAA6C;IAC7C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,oBAAoB,CAAC;IAC/B;6EACyE;IACzE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,gFAAgF;AAChF,MAAM,WAAW,eAAe;IAC5B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,CAAC;IAC1C;kEAC8D;IAC9D,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,YAAY,IAAI,eAAe,CAgC9C;AAED;uDACuD;AACvD,wBAAgB,SAAS,IAAI,MAAM,CAElC;AAeD,wEAAwE;AACxE,wBAAgB,SAAS,IAAI,iBAAiB,GAAG,IAAI,CAEpD;AAED,4CAA4C;AAC5C,MAAM,WAAW,oBAAoB;IACjC,OAAO;IACH,sBAAsB;IACpB,UAAU;IACZ,oDAAoD;OAClD,YAAY;IACd,oEAAoE;OAClE,kBAAkB;IACpB,2EAA2E;OACzE,MAAM;IACR,0DAA0D;OACxD,YAAY;IACd,mEAAmE;OACjE,YAAY,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yEAAyE;IACzE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,IAAI,oBAAoB,CA2C1D;AAED,mDAAmD;AACnD,MAAM,WAAW,mBAAmB;IAChC,OAAO,EAAE,SAAS,GAAG,MAAM,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAgB,0BAA0B,IAAI,mBAAmB,CAShE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CACpC,UAAU,GAAE,eAAgC,GAC7C,MAAM,GAAG,IAAI,CAgCf;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gCAAgC,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAW5E;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,eAAe,CAKnE;AAqDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,eAAe,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IACF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5C,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,IAAI,CAAC;CAC3B,GACP,IAAI,CAuCN;AAED;;sCAEsC;AACtC,MAAM,WAAW,eAAe;IAC5B,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb;iCAC6B;IAC7B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;kCAC8B;IAC9B,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAa1D;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACnC,KAAK,EAAE,eAAe,EACtB,iBAAiB,EAAE,MAAM,GAC1B,MAAM,GAAG,IAAI,CASf;AA0BD;yEACyE;AACzE,MAAM,WAAW,gBAAgB;IAC7B;wBACoB;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;2EACuE;IACvE,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;;;;GASG;AACH,wBAAgB,UAAU,IAAI,gBAAgB,CAa7C;AAuCD;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,QAAmB,CAAC;AAErD,MAAM,WAAW,YAAY;IACzB,uDAAuD;IACvD,kBAAkB,EAAE,MAAM,CAAC;IAC3B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,eAAe,EAAE,MAAM,CAAC;IACxB,wEAAwE;IACxE,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,CAAC,CAAC;CACd;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAKzC;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,CAe5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAY5E;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,YAAY,GAAG,IAAI,CAoBtD;AAED,oEAAoE;AACpE,wBAAgB,iBAAiB,IAAI,IAAI,CAOxC"}