npm - @mysten-incubation/memwal - Versions diffs - 0.0.1 → 0.0.2-dev.0 - Mend

@mysten-incubation/memwal 0.0.1 → 0.0.2-dev.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/dist/manual.d.ts CHANGED Viewed

@@ -52,6 +52,11 @@ export declare class MemWalManual {
      * @param config.accountId - MemWalAccount object ID (for SEAL seal_approve)
      */
     static create(config: MemWalManualConfig): MemWalManual;
+    /**
+     * Securely wipe the delegate private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy(): void;
     /** Whether this client uses a connected wallet signer (vs raw keypair) */
     get isWalletMode(): boolean;
     private getSuiClient;
@@ -61,6 +66,8 @@ export declare class MemWalManual {
     /** Sign and execute a transaction — via wallet popup or programmatic keypair */
     private signAndExecuteTransaction;
     private getSealClient;
+    /** MED-10: SEAL threshold — must match sidecar SEAL_THRESHOLD (default 2). */
+    private get sealThreshold();
     private getWalrusClient;
     /**
      * Remember (hybrid flow):
@@ -80,10 +87,36 @@ export declare class MemWalManual {
     /** Create a signer adapter — either from wallet or keypair */
     private createSigner;
     private embed;
+    /**
+     * SEAL-encrypt a payload.
+     *
+     * LOW-24: The `id` passed to SEAL is the on-chain policy identifier used
+     * by `seal_approve` to gate decryption. Previously this was just the
+     * owner's Sui address, which meant every memory the owner ever encrypted
+     * shared one decryption scope — a delegate authorized for namespace "A"
+     * could obtain keys for namespace "B" ciphertext.
+     *
+     * We now include both the account id and the namespace:
+     *   id = hex(accountId) || ":" || hex(utf8(namespace))
+     *
+     * NOTE (breaking change): Ciphertext produced before this fix was scoped
+     * by ownerAddress only. Legacy blobs created with the old id will still
+     * decrypt against SEAL (the id travels inside the EncryptedObject), but
+     * any on-chain `seal_approve` policy that now expects namespace-scoped
+     * ids will need to be updated in lockstep.
+     */
     private sealEncrypt;
     private walrusUpload;
     private walrusDownload;
     private getDelegatePublicKey;
+    /**
+     * Make a signed request to the server.
+     *
+     * Signature format (LOW-1 + MED-1 + LOW-23):
+     *   "{timestamp}.{method}.{path_and_query}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers sent: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id.
+     */
     private signedRequest;
     /**
      * Restore a namespace — server downloads all blobs from Walrus,

package/dist/manual.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,kBAAkB,EAElB,oBAAoB,EACpB,kBAAkB,EAElB,aAAa,EAChB,MAAM,YAAY,CAAC;~~AAuBpB~~,qBAAa,YAAY;IACrB,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAa;IAE7B,OAAO;~~IAcP~~;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY;IAIvD,0EAA0E;IAC1E,IAAI,YAAY,IAAI,OAAO,CAE1B;YASa,YAAY;YA8BZ,UAAU;IAaxB,yEAAyE;YAC3D,eAAe;IAQ7B,gFAAgF;YAClE,yBAAyB;YAYzB,aAAa;~~YAyBb~~,eAAe;IAyB7B;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;~~IAqBrF~~;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~IA2HtG~~,8DAA8D;YAChD,YAAY;YAuBZ,KAAK;~~YAsCL~~,WAAW;~~YAkBX~~,YAAY;YAiCZ,cAAc;YAoBd,oBAAoB;~~YAQpB~~,aAAa;~~IAyC3B~~;;;;;;OAMG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;CAM/E"}
1	+ {"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,kBAAkB,EAElB,oBAAoB,EACpB,kBAAkB,EAElB,aAAa,EAChB,MAAM,YAAY,CAAC;AAwBpB,qBAAa,YAAY;IACrB,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAa;IAE7B,OAAO;IAgBP;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY;IAIvD;;;OAGG;IACH,OAAO,IAAI,IAAI;IASf,0EAA0E;IAC1E,IAAI,YAAY,IAAI,OAAO,CAE1B;YASa,YAAY;YA8BZ,UAAU;IAaxB,yEAAyE;YAC3D,eAAe;IAQ7B,gFAAgF;YAClE,yBAAyB;YAYzB,aAAa;IAyB3B,8EAA8E;IAC9E,OAAO,KAAK,aAAa,GAExB;YAEa,eAAe;IAyB7B;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuBrF;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6HtG,8DAA8D;YAChD,YAAY;YAuBZ,KAAK;IAsCnB;;;;;;;;;;;;;;;;;OAiBG;YACW,WAAW;YAyBX,YAAY;YAiCZ,cAAc;YAoBd,oBAAoB;IAQlC;;;;;;;OAOG;YACW,aAAa;IA0D3B;;;;;;OAMG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;CAM/E"}

package/dist/manual.js CHANGED Viewed

@@ -26,7 +26,7 @@
  * const result = await memwal.recallManual("food allergies")
  * ```
  */
-import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
+import { sha256hex, hexToBytes, bytesToHex, normalizeServerUrl, sanitizeServerError } from "./utils.js";
 // ============================================================
 // Constants
 // ============================================================
@@ -34,7 +34,8 @@ import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
 // Users can override via SEAL_KEY_SERVERS in their environment
 const DEFAULT_KEY_SERVERS = {
     mainnet: [
-        "0x145540d931f182fef76467dd8074c9839aea126852d90d18e1556fcbbd1208b6", // Overclock (Open)
+        "0x145540d931f182fef76467dd8074c9839aea126852d90d18e1556fcbbd1208b6", // Overclock (Open)
+        "0xe0eb52eba9261b96e895bbb4deca10dcd64fbc626a1133017adcd5131353fd10", // Studio Mirai (Open)
     ],
     testnet: [
         "0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75",
@@ -63,8 +64,10 @@ export class MemWalManual {
         if (config.suiPrivateKey && config.walletSigner) {
             throw new Error("MemWalManual: provide suiPrivateKey OR walletSigner, not both");
         }
-        this.delegatePrivateKey = hexToBytes(config.key);
-        this.serverUrl = (config.serverUrl ?? "http://localhost:8000").replace(/\/$/, "");
+        this.delegatePrivateKey = typeof config.key === "string" ? hexToBytes(config.key) : config.key;
+        // LOW-22: default to HTTPS; warn (do not throw) on plaintext HTTP
+        // against non-localhost hosts.
+        this.serverUrl = normalizeServerUrl(config.serverUrl ?? "https://relayer.memwal.ai/");
         this.walletSigner = config.walletSigner ?? null;
         this.config = config;
         this.namespace = config.namespace ?? "default";
@@ -84,6 +87,18 @@ export class MemWalManual {
     static create(config) {
         return new MemWalManual(config);
     }
+    /**
+     * Securely wipe the delegate private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy() {
+        if (this.delegatePrivateKey) {
+            this.delegatePrivateKey.fill(0);
+        }
+        if (this.delegatePublicKey) {
+            this.delegatePublicKey.fill(0);
+        }
+    }
     /** Whether this client uses a connected wallet signer (vs raw keypair) */
     get isWalletMode() {
         return this.walletSigner !== null;
@@ -171,11 +186,15 @@ export class MemWalManual {
                     objectId: id,
                     weight: 1,
                 })),
-                verifyKeyServers: false,
+                verifyKeyServers: true,
             });
         }
         return this._sealClient;
     }
+    /** MED-10: SEAL threshold — must match sidecar SEAL_THRESHOLD (default 2). */
+    get sealThreshold() {
+        return this.config.sealThreshold ?? 2;
+    }
     async getWalrusClient() {
         if (!this._walrusClient) {
             // @ts-ignore — optional peer dependency
@@ -210,9 +229,11 @@ export class MemWalManual {
             throw new Error("Text cannot be empty");
         const ns = namespace ?? this.namespace;
         // Step 1 & 2: Embed + SEAL encrypt concurrently
+        // LOW-24: Scope SEAL encryption id by namespace so a delegate key
+        // authorized for one namespace cannot unwrap ciphertext for another.
         const [vector, encrypted] = await Promise.all([
             this.embed(text),
-            this.sealEncrypt(new TextEncoder().encode(text)),
+            this.sealEncrypt(new TextEncoder().encode(text), ns),
         ]);
         // Step 3: Send encrypted bytes (base64) + vector to server.
         // Server will upload to Walrus via upload-relay and return the blob_id.
@@ -278,11 +299,13 @@ export class MemWalManual {
         // Create signer (wallet adapter or keypair)
         const signer = await this.createSigner(callerAddress);
         // Create session key ONCE (triggers one wallet popup)
+        // HIGH-7 / LOW-13: Reduced from 30 to 5 minutes to limit the exposure
+        // window if a session token is compromised.
         try {
             sessionKey = await SessionKey.create({
                 address: callerAddress,
                 packageId: this.config.packageId,
-                ttlMin: 30,
+                ttlMin: 5,
                 signer,
                 suiClient,
             });
@@ -313,7 +336,7 @@ export class MemWalManual {
                     ids: [fullId],
                     txBytes,
                     sessionKey,
-                    threshold: 1,
+                    threshold: this.sealThreshold,
                 });
                 // Decrypt locally
                 const plaintext = await sealClient.decrypt({
@@ -385,13 +408,37 @@ export class MemWalManual {
     // ============================================================
     // Internal: SEAL Encrypt
     // ============================================================
-    async sealEncrypt(plaintext) {
+    /**
+     * SEAL-encrypt a payload.
+     *
+     * LOW-24: The `id` passed to SEAL is the on-chain policy identifier used
+     * by `seal_approve` to gate decryption. Previously this was just the
+     * owner's Sui address, which meant every memory the owner ever encrypted
+     * shared one decryption scope — a delegate authorized for namespace "A"
+     * could obtain keys for namespace "B" ciphertext.
+     *
+     * We now include both the account id and the namespace:
+     *   id = hex(accountId) || ":" || hex(utf8(namespace))
+     *
+     * NOTE (breaking change): Ciphertext produced before this fix was scoped
+     * by ownerAddress only. Legacy blobs created with the old id will still
+     * decrypt against SEAL (the id travels inside the EncryptedObject), but
+     * any on-chain `seal_approve` policy that now expects namespace-scoped
+     * ids will need to be updated in lockstep.
+     */
+    async sealEncrypt(plaintext, namespace) {
         const sealClient = await this.getSealClient();
-        const ownerAddress = await this.getOwnerAddress();
+        // Build a namespace-scoped SEAL id. Hex-encode both components so
+        // the id is a stable ASCII hex string (SEAL expects a hex id).
+        const accountHex = this.config.accountId.startsWith("0x")
+            ? this.config.accountId.slice(2)
+            : this.config.accountId;
+        const nsHex = bytesToHex(new TextEncoder().encode(namespace));
+        const scopedId = `${accountHex}${nsHex}`;
         const result = await sealClient.encrypt({
-            threshold: 1,
+            threshold: this.sealThreshold,
             packageId: this.config.packageId,
-            id: ownerAddress,
+            id: scopedId,
             data: plaintext,
         });
         return new Uint8Array(result.encryptedObject);
@@ -452,12 +499,24 @@ export class MemWalManual {
         }
         return this.delegatePublicKey;
     }
+    /**
+     * Make a signed request to the server.
+     *
+     * Signature format (LOW-1 + MED-1 + LOW-23):
+     *   "{timestamp}.{method}.{path_and_query}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers sent: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id.
+     */
     async signedRequest(method, path, body) {
         const ed = await import("@noble/ed25519");
         const timestamp = Math.floor(Date.now() / 1000).toString();
         const bodyStr = JSON.stringify(body);
         const bodySha256 = await sha256hex(bodyStr);
-        const message = `${timestamp}.${method}.${path}.${bodySha256}`;
+        // MED-1: per-request nonce for replay protection.
+        const nonce = crypto.randomUUID();
+        // LOW-23: include x-account-id in the canonical signed message so an
+        // intermediary cannot rebind a signed request to a different account.
+        const message = `${timestamp}.${method}.${path}.${bodySha256}.${nonce}.${this.config.accountId}`;
         const msgBytes = new TextEncoder().encode(message);
         const signature = await ed.signAsync(msgBytes, this.delegatePrivateKey);
         const publicKey = await this.getDelegatePublicKey();
@@ -469,12 +528,21 @@ export class MemWalManual {
                 "x-public-key": bytesToHex(publicKey),
                 "x-signature": bytesToHex(signature),
                 "x-timestamp": timestamp,
+                "x-nonce": nonce,
+                "x-account-id": this.config.accountId,
             },
             body: bodyStr,
         });
         if (!res.ok) {
-            const errText = await res.text();
-            throw new Error(`MemWal API error (${res.status}): ${errText}`);
+            // LOW-26: sanitize server error bodies before re-throwing.
+            const raw = await res.text();
+            const { message: sanitized, serverCode } = sanitizeServerError(res.status, raw);
+            const err = new Error(sanitized);
+            err.status = res.status;
+            if (serverCode)
+                err.serverCode = serverCode;
+            err.cause = raw;
+            throw err;
         }
         return res.json();
     }

package/dist/manual.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"manual.js","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE/D,+DAA+D;AAC/D,YAAY;AACZ,+DAA+D;AAE/D,iDAAiD;AACjD,+DAA+D;AAC/D,MAAM,mBAAmB,GAA6B;IAClD,OAAO,EAAE;QACL,oEAAoE,EAAE,oBAAoB;KAC7F;IACD,OAAO,EAAE;QACL,oEAAoE;QACpE,oEAAoE;KACvE;CACJ,CAAC;AAEF,+DAA+D;AAC/D,sBAAsB;AACtB,+DAA+D;AAE/D,MAAM,OAAO,YAAY;IACb,kBAAkB,CAAa;IAC/B,iBAAiB,GAAsB,IAAI,CAAC;IAC5C,SAAS,CAAS;IAClB,MAAM,CAAqB;IAC3B,YAAY,CAAsB;IAClC,SAAS,CAAS;IAE1B,mFAAmF;IAC3E,UAAU,GAAQ,IAAI,CAAC;IACvB,WAAW,GAAQ,IAAI,CAAC;IACxB,aAAa,GAAQ,IAAI,CAAC;IAC1B,QAAQ,GAAQ,IAAI,CAAC;IAE7B,YAAoB,MAA0B;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAA0B;QACpC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,+DAA+D;IAC/D,6BAA6B;IAC7B,oEAAoE;IACpE,gEAAgE;IAChE,uCAAuC;IACvC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACJ,6CAA6C;gBAC7C,wCAAwC;gBACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAI,GAAW,CAAC,SAAS,CAAC;gBACzC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACX,6CAA6C;wBAC7C,oDAAoD;wBACpD,uCAAuC,CAC1C,CAAC;gBACN,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;gBACpD,MAAM,IAAI,GAA2B;oBACjC,OAAO,EAAE,qCAAqC;oBAC9C,OAAO,EAAE,qCAAqC;iBACjD,CAAC;gBACF,IAAI,CAAC,UAAU,GAAG,IAAI,SAAS,CAAC;oBAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;iBACrC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,eAAe;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,yBAAyB,CAAC,WAAgB;QACpD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,yBAAyB,CAAC;YACvC,MAAM,EAAE,OAAO;YACf,WAAW;SACd,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,wCAAwC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACX,6DAA6D,OAAO,KAAK;oBACzE,0EAA0E,CAC7E,CAAC;YACN,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;gBAC9B,SAAS;gBACT,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnC,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,gBAAgB,EAAE,KAAK;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,eAAe;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,wCAAwC;YACxC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS;gBACzC,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,2CAA2C,CAAC;YAClD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC;gBAClC,OAAO,EAAE,OAAc;gBACvB,SAAS;gBACT,WAAW,EAAE;oBACT,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;iBAC/B;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAkB;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,gDAAgD;QAChD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACnD,CAAC,CAAC;QAEH,4DAA4D;QAC5D,wEAAwE;QACxE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,aAAa,CAAuB,MAAM,EAAE,sBAAsB,EAAE;YAC5E,cAAc,EAAE,eAAe;YAC/B,MAAM;YACN,SAAS,EAAE,EAAE;SAChB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAErD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvC,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CACzC,MAAM,EACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CACnC,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gEAAgE;QAChE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzD,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAgE,EAAE,CAAC,CAAC,KAAK,IAAI,CAClF,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gFAAgF;QAChF,IAAI,UAAe,CAAC;QACpB,IAAI,SAAc,CAAC;QACnB,IAAI,UAAe,CAAC;QACpB,IAAI,eAAoB,CAAC;QACzB,IAAI,WAAgB,CAAC;QACrB,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,wCAAwC;YACxC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEtD,sDAAsD;QACtD,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,EAAE;gBACV,MAAM;gBACN,SAAS;aACZ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;gBAEzB,yBAAyB;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAChF,CAAC;gBACF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC7B,EAAE,CAAC,QAAQ,CAAC;oBACR,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,yBAAyB;oBACzD,SAAS,EAAE;wBACP,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;wBAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnC;iBACJ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEjF,iDAAiD;gBACjD,MAAM,UAAU,CAAC,SAAS,CAAC;oBACvB,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,OAAO;oBACP,UAAU;oBACV,SAAS,EAAE,CAAC;iBACf,CAAC,CAAC;gBAEH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU;oBACV,OAAO;iBACV,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;IAC3B,+DAA+D;IAE/D,8DAA8D;IACtD,KAAK,CAAC,YAAY,CAAC,aAAqB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7B,OAAO;gBACH,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;gBAC3D,IAAI,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;gBACD,mBAAmB,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAEvD,KAAK,CAAC,KAAK,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,6CAA6C;gBAC7C,sDAAsD,CACzD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;aAC3D;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,yBAAyB;IACzB,+DAA+D;IAEvD,KAAK,CAAC,WAAW,CAAC,SAAqB;QAC3C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,mCAAmC;IACnC,+DAA+D;IAEvD,KAAK,CAAC,YAAY,CAAC,IAAgB;QACvC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS;YAC1C,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,+CAA+C,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,oBAAoB,MAAM,iBAAiB,EAAE;YACjF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAA2B;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAS,CAAC;QACxC,+DAA+D;QAC/D,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM;eAC/C,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc;QACvC,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS;YAC3C,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,gDAAgD,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;QAEZ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEpD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;gBACpC,aAAa,EAAE,SAAS;aAC3B;YACD,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;CACJ"}
1	+ {"version":3,"file":"manual.js","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExG,+DAA+D;AAC/D,YAAY;AACZ,+DAA+D;AAE/D,iDAAiD;AACjD,+DAA+D;AAC/D,MAAM,mBAAmB,GAA6B;IAClD,OAAO,EAAE;QACL,oEAAoE,EAAE,mBAAmB;QACzF,oEAAoE,EAAE,sBAAsB;KAC/F;IACD,OAAO,EAAE;QACL,oEAAoE;QACpE,oEAAoE;KACvE;CACJ,CAAC;AAEF,+DAA+D;AAC/D,sBAAsB;AACtB,+DAA+D;AAE/D,MAAM,OAAO,YAAY;IACb,kBAAkB,CAAa;IAC/B,iBAAiB,GAAsB,IAAI,CAAC;IAC5C,SAAS,CAAS;IAClB,MAAM,CAAqB;IAC3B,YAAY,CAAsB;IAClC,SAAS,CAAS;IAE1B,mFAAmF;IAC3E,UAAU,GAAQ,IAAI,CAAC;IACvB,WAAW,GAAQ,IAAI,CAAC;IACxB,aAAa,GAAQ,IAAI,CAAC;IAC1B,QAAQ,GAAQ,IAAI,CAAC;IAE7B,YAAoB,MAA0B;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/F,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACtF,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAA0B;QACpC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,OAAO;QACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,+DAA+D;IAC/D,6BAA6B;IAC7B,oEAAoE;IACpE,gEAAgE;IAChE,uCAAuC;IACvC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACJ,6CAA6C;gBAC7C,wCAAwC;gBACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAI,GAAW,CAAC,SAAS,CAAC;gBACzC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACX,6CAA6C;wBAC7C,oDAAoD;wBACpD,uCAAuC,CAC1C,CAAC;gBACN,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;gBACpD,MAAM,IAAI,GAA2B;oBACjC,OAAO,EAAE,qCAAqC;oBAC9C,OAAO,EAAE,qCAAqC;iBACjD,CAAC;gBACF,IAAI,CAAC,UAAU,GAAG,IAAI,SAAS,CAAC;oBAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;iBACrC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,eAAe;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,yBAAyB,CAAC,WAAgB;QACpD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,yBAAyB,CAAC;YACvC,MAAM,EAAE,OAAO;YACf,WAAW;SACd,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,wCAAwC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACX,6DAA6D,OAAO,KAAK;oBACzE,0EAA0E,CAC7E,CAAC;YACN,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;gBAC9B,SAAS;gBACT,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnC,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,gBAAgB,EAAE,IAAI;aACzB,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,IAAY,aAAa;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,eAAe;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,wCAAwC;YACxC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS;gBACzC,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,2CAA2C,CAAC;YAClD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC;gBAClC,OAAO,EAAE,OAAc;gBACvB,SAAS;gBACT,WAAW,EAAE;oBACT,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;iBAC/B;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAkB;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,gDAAgD;QAChD,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QAEH,4DAA4D;QAC5D,wEAAwE;QACxE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,aAAa,CAAuB,MAAM,EAAE,sBAAsB,EAAE;YAC5E,cAAc,EAAE,eAAe;YAC/B,MAAM;YACN,SAAS,EAAE,EAAE;SAChB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAErD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvC,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CACzC,MAAM,EACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CACnC,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gEAAgE;QAChE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzD,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAgE,EAAE,CAAC,CAAC,KAAK,IAAI,CAClF,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gFAAgF;QAChF,IAAI,UAAe,CAAC;QACpB,IAAI,SAAc,CAAC;QACnB,IAAI,UAAe,CAAC;QACpB,IAAI,eAAoB,CAAC;QACzB,IAAI,WAAgB,CAAC;QACrB,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,wCAAwC;YACxC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEtD,sDAAsD;QACtD,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,CAAC;gBACT,MAAM;gBACN,SAAS;aACZ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;gBAEzB,yBAAyB;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAChF,CAAC;gBACF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC7B,EAAE,CAAC,QAAQ,CAAC;oBACR,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,yBAAyB;oBACzD,SAAS,EAAE;wBACP,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;wBAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnC;iBACJ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEjF,iDAAiD;gBACjD,MAAM,UAAU,CAAC,SAAS,CAAC;oBACvB,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,OAAO;oBACP,UAAU;oBACV,SAAS,EAAE,IAAI,CAAC,aAAa;iBAChC,CAAC,CAAC;gBAEH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU;oBACV,OAAO;iBACV,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;IAC3B,+DAA+D;IAE/D,8DAA8D;IACtD,KAAK,CAAC,YAAY,CAAC,aAAqB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7B,OAAO;gBACH,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;gBAC3D,IAAI,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;gBACD,mBAAmB,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAEvD,KAAK,CAAC,KAAK,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,6CAA6C;gBAC7C,sDAAsD,CACzD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;aAC3D;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,yBAAyB;IACzB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,WAAW,CAAC,SAAqB,EAAE,SAAiB;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE9C,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YACrD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,UAAU,GAAG,KAAK,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,aAAa;YAC7B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,mCAAmC;IACnC,+DAA+D;IAEvD,KAAK,CAAC,YAAY,CAAC,IAAgB;QACvC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS;YAC1C,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,+CAA+C,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,oBAAoB,MAAM,iBAAiB,EAAE;YACjF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAA2B;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAS,CAAC;QACxC,+DAA+D;QAC/D,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM;eAC/C,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc;QACvC,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS;YAC3C,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,gDAAgD,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;QAEZ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEpD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;gBACpC,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACxC;YACD,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,2DAA2D;YAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAI9B,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5C,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;YAChB,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/memwal.d.ts CHANGED Viewed

@@ -33,14 +33,23 @@ export declare class MemWal {
     private serverUrl;
     private namespace;
     private accountId;
+    private sessionCache;
+    private serverConfig;
+    /** Single-flight guard so concurrent requests share one SessionKey build. */
+    private sessionBuildPromise;
     private constructor();
     /**
      * Create a new MemWal client instance.
      *
      * @param config.key - Ed25519 private key (hex string) — the delegate key
-     * @param config.serverUrl - Server URL (default: http://localhost:8000)
+     * @param config.serverUrl - Server URL (default: https://relayer.memwal.ai/)
      */
     static create(config: MemWalConfig): MemWal;
+    /**
+     * Securely wipe the private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy(): void;
     /**
      * Remember something — server handles: verify → embed → encrypt → Walrus upload → store
      *
@@ -75,6 +84,10 @@ export declare class MemWal {
      * Remember (manual mode) — user handles SEAL encrypt, embedding,
      * and Walrus upload externally. Server only stores the vector ↔ blobId mapping.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Manual-mode handlers on the server never invoke SEAL
+     * decrypt, so the key stays client-side as the name implies.
+     *
      * @param opts.blobId - Walrus blob ID (user already uploaded encrypted data)
      * @param opts.vector - Embedding vector (user already generated, e.g. 1536-dim)
      * @returns RememberManualResult with id, blob_id, owner
@@ -95,6 +108,10 @@ export declare class MemWal {
      * Server returns matching blobIds + distances.
      * User then downloads from Walrus + SEAL decrypts on their own.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Server returns blob IDs only; decryption happens entirely
+     * on the client.
+     *
      * @param opts.vector - Pre-computed query embedding vector
      * @param opts.limit - Max results (default: 10)
      * @returns RecallManualResult with blob_id + distance pairs (no decrypted text)
@@ -153,6 +170,13 @@ export declare class MemWal {
     restore(namespace: string, limit?: number): Promise<RestoreResult>;
     /**
      * Check server health.
+     *
+     * INFO-7: The health endpoint is currently public/unsigned server-side,
+     * but we send the same signed-request envelope as every other call so
+     * that (a) the channel is authenticated whenever the server opts in, and
+     * (b) a MitM cannot trivially forge a "healthy" response for a client
+     * that has no way to tell. If the server ignores the signature headers
+     * on `/health`, this is still a harmless no-op.
      */
     health(): Promise<HealthResult>;
     /**
@@ -160,14 +184,34 @@ export declare class MemWal {
      */
     getPublicKeyHex(): Promise<string>;
     private getPublicKey;
+    private fetchServerConfig;
+    private buildSealSessionInner;
+    private buildSealSession;
     /**
      * Make a signed request to the server.
      *
-     * Signature format: "{timestamp}.{method}.{path}.{body_sha256}"
-     * Headers: x-public-key, x-signature, x-timestamp
+     * Signature format (LOW-23 updated):
+     *   "{timestamp}.{method}.{path}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id
+     *
+     * The nonce is a UUID v4 generated per-request and tracked server-side
+     * in Redis (TTL=600s) to prevent replay attacks.
+     *
+     * LOW-23: x-account-id is now included in the signed canonical message so
+     * an intermediary cannot swap the account hint without invalidating the
+     * signature. Server-side verification in services/server/src/auth.rs must
+     * use the matching message format.
+     *
+     * ENG-1696: Callers set `includeDelegateKey: false` on Manual-mode routes
+     * so the delegate private key is not transmitted. Manual-mode docstrings
+     * promise the key stays client-side; the server does not need it on those
+     * routes because Manual-mode handlers never invoke SEAL decrypt.
      *
-     * The server uses x-public-key to look up the owner via onchain
-     * MemWalAccount.delegate_keys — no need to send owner in the body.
+     * ENG-1697: On Relayer-mode routes the SDK builds a SEAL SessionKey
+     * client-side (emitted via `x-seal-session`). The SessionKey is ephemeral
+     * (5-min TTL, scoped to the server's `packageId`) so a wire capture has
+     * a bounded blast radius. Requires `@mysten/seal` and `@mysten/sui`.
      */
     private signedRequest;
 }

package/dist/memwal.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"memwal.d.ts","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,YAAY,EACZ,cAAc,EACd,YAAY,EAEZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EAChB,MAAM,YAAY,CAAC;~~AAmBpB~~,qBAAa,MAAM;IACf,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;~~IAE1B~~,OAAO;~~IAOP~~;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM;~~IAQ3C~~;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;~~IAY1F;;;;;;;;;;;;;;;;;OAiBG~~;IACG,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;~~IAQhF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG~~;IACG,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~IAQ1E~~;;;;;OAKG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI/C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOvE;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAO5E~~;;OAEG~~;IACG,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;~~IAQrC~~;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;YAS1B,YAAY;~~IAQ1B;;;;;;;;OAQG~~;YACW,aAAa;~~CAyC9B~~"}
1	+ {"version":3,"file":"memwal.d.ts","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,YAAY,EACZ,cAAc,EACd,YAAY,EAEZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EAChB,MAAM,YAAY,CAAC;AAyCpB,qBAAa,MAAM;IACf,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAI1B,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,YAAY,CAA6B;IACjD,6EAA6E;IAC7E,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM;IAI3C;;;OAGG;IACH,OAAO,IAAI,IAAI;IAiBf;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB1F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAahF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E;;;;;OAKG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI/C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOvE;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAO5E;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAerC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;YAS1B,YAAY;YA8BZ,iBAAiB;YAkBjB,qBAAqB;YAsFrB,gBAAgB;IAc9B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,aAAa;CAiE9B"}

package/dist/memwal.js CHANGED Viewed

@@ -26,7 +26,7 @@
  * console.log(result.results[0].text) // "I'm allergic to peanuts"
  * ```
  */
-import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
+import { sha256hex, hexToBytes, bytesToHex, normalizeServerUrl, sanitizeServerError } from "./utils.js";
 // ============================================================
 // Ed25519 Signing (lazy-loaded)
 // ============================================================
@@ -37,30 +37,57 @@ async function getEd() {
     }
     return _ed;
 }
-// ============================================================
-// MemWal Client
-// ============================================================
+const SEAL_SESSION_TTL_MIN = 5;
+// Refresh 30 seconds before SEAL's 5-minute TTL to avoid the window where
+// the client thinks the session is valid but a just-received request hits
+// a key server that sees it as expired.
+const SEAL_SESSION_SAFETY_MARGIN_MS = 30_000;
 export class MemWal {
     privateKey;
     publicKey = null;
     serverUrl;
     namespace;
     accountId;
+    // ENG-1697 state — all internal, never surfaced to user code.
+    // The public API (`MemWal.create({ key, accountId })`) is unchanged.
+    sessionCache = null;
+    serverConfig = null;
+    /** Single-flight guard so concurrent requests share one SessionKey build. */
+    sessionBuildPromise = null;
     constructor(config) {
-        this.privateKey = hexToBytes(config.key);
+        this.privateKey = typeof config.key === "string" ? hexToBytes(config.key) : config.key;
         this.accountId = config.accountId;
-        this.serverUrl = (config.serverUrl ?? "http://localhost:8000").replace(/\/$/, "");
+        // LOW-22: default to HTTPS for production usage; normalizeServerUrl
+        // warns (does not throw) if a user passes plain http:// for a
+        // non-localhost host.
+        this.serverUrl = normalizeServerUrl(config.serverUrl ?? "https://relayer.memwal.ai/");
         this.namespace = config.namespace ?? "default";
     }
     /**
      * Create a new MemWal client instance.
      *
      * @param config.key - Ed25519 private key (hex string) — the delegate key
-     * @param config.serverUrl - Server URL (default: http://localhost:8000)
+     * @param config.serverUrl - Server URL (default: https://relayer.memwal.ai/)
      */
     static create(config) {
         return new MemWal(config);
     }
+    /**
+     * Securely wipe the private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy() {
+        if (this.privateKey) {
+            this.privateKey.fill(0);
+        }
+        if (this.publicKey) {
+            this.publicKey.fill(0);
+        }
+        // ENG-1697: drop cached session material too — once destroyed the
+        // instance must not leak authorization tokens either.
+        this.sessionCache = null;
+        this.serverConfig = null;
+    }
     // ============================================================
     // Core API
     // ============================================================
@@ -99,11 +126,18 @@ export class MemWal {
      * ```
      */
     async recall(query, limit = 10, namespace) {
-        return this.signedRequest("POST", "/api/recall", {
-            query,
-            limit,
-            namespace: namespace ?? this.namespace,
-        });
+        const ac = new AbortController();
+        const tid = setTimeout(() => ac.abort(), 15000);
+        try {
+            return await this.signedRequest("POST", "/api/recall", {
+                query,
+                limit,
+                namespace: namespace ?? this.namespace,
+            }, { signal: ac.signal });
+        }
+        finally {
+            clearTimeout(tid);
+        }
     }
     // ============================================================
     // Manual API (user handles SEAL + embedding + Walrus)
@@ -112,6 +146,10 @@ export class MemWal {
      * Remember (manual mode) — user handles SEAL encrypt, embedding,
      * and Walrus upload externally. Server only stores the vector ↔ blobId mapping.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Manual-mode handlers on the server never invoke SEAL
+     * decrypt, so the key stays client-side as the name implies.
+     *
      * @param opts.blobId - Walrus blob ID (user already uploaded encrypted data)
      * @param opts.vector - Embedding vector (user already generated, e.g. 1536-dim)
      * @returns RememberManualResult with id, blob_id, owner
@@ -131,13 +169,17 @@ export class MemWal {
             blob_id: opts.blobId,
             vector: opts.vector,
             namespace: opts.namespace ?? this.namespace,
-        });
+        }, { includeDelegateKey: false });
     }
     /**
      * Recall (manual mode) — user provides a pre-computed query vector.
      * Server returns matching blobIds + distances.
      * User then downloads from Walrus + SEAL decrypts on their own.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Server returns blob IDs only; decryption happens entirely
+     * on the client.
+     *
      * @param opts.vector - Pre-computed query embedding vector
      * @param opts.limit - Max results (default: 10)
      * @returns RecallManualResult with blob_id + distance pairs (no decrypted text)
@@ -163,7 +205,7 @@ export class MemWal {
             vector: opts.vector,
             limit: opts.limit ?? 10,
             namespace: opts.namespace ?? this.namespace,
-        });
+        }, { includeDelegateKey: false });
     }
     /**
      * Generate an embedding vector for text (no storage).
@@ -214,13 +256,28 @@ export class MemWal {
     }
     /**
      * Check server health.
+     *
+     * INFO-7: The health endpoint is currently public/unsigned server-side,
+     * but we send the same signed-request envelope as every other call so
+     * that (a) the channel is authenticated whenever the server opts in, and
+     * (b) a MitM cannot trivially forge a "healthy" response for a client
+     * that has no way to tell. If the server ignores the signature headers
+     * on `/health`, this is still a harmless no-op.
      */
     async health() {
-        const res = await fetch(`${this.serverUrl}/health`);
-        if (!res.ok) {
-            throw new Error(`Health check failed: ${res.status}`);
+        try {
+            return await this.signedRequest("GET", "/health", {});
+        }
+        catch (err) {
+            // Fall back to a plain GET for servers that reject bodies on GET /health.
+            const res = await fetch(`${this.serverUrl}/health`);
+            if (!res.ok) {
+                throw err instanceof Error
+                    ? err
+                    : new Error(`Health check failed: ${res.status}`);
+            }
+            return res.json();
         }
-        return res.json();
     }
     /**
      * Get the public key (hex string).
@@ -239,43 +296,208 @@ export class MemWal {
         }
         return this.publicKey;
     }
+    // ============================================================
+    // ENG-1697: SEAL SessionKey discovery & build
+    //
+    // The SDK used to transmit the raw delegate private key in
+    // `x-delegate-key` on every request. That credential, once captured,
+    // lets an attacker retroactively decrypt every ciphertext the account
+    // ever produced (until the user rotates on-chain) and sign arbitrary
+    // Sui transactions from the delegate address.
+    //
+    // We now build a SEAL `SessionKey` on the client (ephemeral, scoped to
+    // a single `packageId`, 5-minute TTL, signed by the delegate key) and
+    // ship only the exported session bytes via `x-seal-session`. The raw
+    // private key never leaves the client.
+    //
+    // `packageId` is fetched from the server's public `/config` endpoint
+    // the first time it's needed so the user API (`new MemWal({ key,
+    // accountId })`) stays unchanged — past users upgrading to v0.4 do not
+    // have to touch their config.
+    //
+    // Requires `@mysten/seal` and `@mysten/sui` peer dependencies.
+    // ============================================================
+    async fetchServerConfig() {
+        if (this.serverConfig)
+            return this.serverConfig;
+        const res = await fetch(`${this.serverUrl}/config`, { method: "GET" });
+        if (!res.ok) {
+            throw new Error(`GET /config returned ${res.status}`);
+        }
+        const body = (await res.json());
+        if (!body.packageId || !body.network || !body.suiRpcUrl) {
+            throw new Error("GET /config response missing packageId / network / suiRpcUrl");
+        }
+        this.serverConfig = {
+            packageId: body.packageId,
+            network: body.network,
+            suiRpcUrl: body.suiRpcUrl,
+        };
+        return this.serverConfig;
+    }
+    async buildSealSessionInner() {
+        const cfg = await this.fetchServerConfig();
+        // @mysten/sui renamed/moved `SuiClient` between minor versions:
+        //   - pre-2.6:  `SuiClient` in `@mysten/sui/client`
+        //   - 2.6+:     `SuiJsonRpcClient` in `@mysten/sui/jsonRpc`
+        // Probe both paths so the SDK works across the supported range.
+        const sealMod = (await import("@mysten/seal"));
+        const ed25519Mod = (await import("@mysten/sui/keypairs/ed25519"));
+        const SessionKey = sealMod.SessionKey;
+        const Ed25519Keypair = ed25519Mod.Ed25519Keypair;
+        let SuiClient = undefined;
+        try {
+            const mod = (await import("@mysten/sui/client"));
+            SuiClient = mod.SuiClient;
+        }
+        catch {
+            /* not present on this version */
+        }
+        if (typeof SuiClient !== "function") {
+            try {
+                const mod = (await import("@mysten/sui/jsonRpc"));
+                SuiClient = mod.SuiJsonRpcClient ?? mod.SuiClient;
+            }
+            catch {
+                /* not present on this version either */
+            }
+        }
+        if (typeof SuiClient !== "function" || typeof Ed25519Keypair !== "function") {
+            throw new Error("SuiClient/SuiJsonRpcClient or Ed25519Keypair not found in @mysten/sui. " +
+                "Ensure @mysten/sui >=2.5.0 and @mysten/seal >=1.1.0 are installed.");
+        }
+        const keypair = Ed25519Keypair.fromSecretKey(this.privateKey);
+        const suiClient = new SuiClient({ url: cfg.suiRpcUrl });
+        const session = await SessionKey.create({
+            address: keypair.getPublicKey().toSuiAddress(),
+            packageId: cfg.packageId,
+            ttlMin: SEAL_SESSION_TTL_MIN,
+            signer: keypair,
+            suiClient: suiClient,
+        });
+        // Eagerly sign the personal message so the exported envelope is
+        // fully self-contained. `SessionKey.create()` defers this signing
+        // until first use, which would break the migration: the sidecar
+        // imports without a signer and must be able to get a certificate
+        // from the exported state alone. Calling
+        // setPersonalMessageSignature() here populates the
+        // `personalMessageSignature` field in the subsequent export().
+        const personalMessage = session.getPersonalMessage();
+        const signResult = await keypair.signPersonalMessage(personalMessage);
+        await session.setPersonalMessageSignature(signResult.signature);
+        const exported = session.export();
+        // SEAL intentionally installs a throwing `toJSON` on the
+        // exported object to catch accidental serialization. The
+        // migration to `x-seal-session` IS the intended on-wire
+        // format, so we project the primitive fields into a fresh
+        // object before stringifying. The sidecar's
+        // `SessionKey.import()` expects this exact shape.
+        const jsonStr = JSON.stringify({
+            address: exported.address,
+            packageId: exported.packageId,
+            mvrName: exported.mvrName,
+            creationTimeMs: exported.creationTimeMs,
+            ttlMin: exported.ttlMin,
+            personalMessageSignature: exported.personalMessageSignature,
+            sessionKey: exported.sessionKey,
+        });
+        const bytes = typeof btoa === "function"
+            ? btoa(jsonStr)
+            : Buffer.from(jsonStr, "utf8").toString("base64");
+        this.sessionCache = {
+            bytes,
+            expiresAt: Date.now() +
+                SEAL_SESSION_TTL_MIN * 60_000 -
+                SEAL_SESSION_SAFETY_MARGIN_MS,
+        };
+        return bytes;
+    }
+    async buildSealSession() {
+        // Fast path: cached session still fresh.
+        if (this.sessionCache && Date.now() < this.sessionCache.expiresAt) {
+            return this.sessionCache.bytes;
+        }
+        // Single-flight: concurrent requests share one build.
+        if (this.sessionBuildPromise)
+            return this.sessionBuildPromise;
+        this.sessionBuildPromise = this.buildSealSessionInner().finally(() => {
+            this.sessionBuildPromise = null;
+        });
+        return this.sessionBuildPromise;
+    }
     /**
      * Make a signed request to the server.
      *
-     * Signature format: "{timestamp}.{method}.{path}.{body_sha256}"
-     * Headers: x-public-key, x-signature, x-timestamp
+     * Signature format (LOW-23 updated):
+     *   "{timestamp}.{method}.{path}.{body_sha256}.{nonce}.{account_id}"
      *
-     * The server uses x-public-key to look up the owner via onchain
-     * MemWalAccount.delegate_keys — no need to send owner in the body.
+     * Headers: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id
+     *
+     * The nonce is a UUID v4 generated per-request and tracked server-side
+     * in Redis (TTL=600s) to prevent replay attacks.
+     *
+     * LOW-23: x-account-id is now included in the signed canonical message so
+     * an intermediary cannot swap the account hint without invalidating the
+     * signature. Server-side verification in services/server/src/auth.rs must
+     * use the matching message format.
+     *
+     * ENG-1696: Callers set `includeDelegateKey: false` on Manual-mode routes
+     * so the delegate private key is not transmitted. Manual-mode docstrings
+     * promise the key stays client-side; the server does not need it on those
+     * routes because Manual-mode handlers never invoke SEAL decrypt.
+     *
+     * ENG-1697: On Relayer-mode routes the SDK builds a SEAL SessionKey
+     * client-side (emitted via `x-seal-session`). The SessionKey is ephemeral
+     * (5-min TTL, scoped to the server's `packageId`) so a wire capture has
+     * a bounded blast radius. Requires `@mysten/seal` and `@mysten/sui`.
      */
-    async signedRequest(method, path, body) {
+    async signedRequest(method, path, body, options = {}) {
         const ed = await getEd();
         const timestamp = Math.floor(Date.now() / 1000).toString();
         const bodyStr = JSON.stringify(body);
         const bodySha256 = await sha256hex(bodyStr);
-        // Build message to sign
-        const message = `${timestamp}.${method}.${path}.${bodySha256}`;
+        // MED-1 fix: Generate per-request nonce (UUID v4) for replay protection
+        const nonce = crypto.randomUUID();
+        // LOW-23: Build message to sign — now includes nonce AND account id
+        const message = `${timestamp}.${method}.${path}.${bodySha256}.${nonce}.${this.accountId}`;
         const msgBytes = new TextEncoder().encode(message);
         // Sign with Ed25519
         const signature = await ed.signAsync(msgBytes, this.privateKey);
         const publicKey = await this.getPublicKey();
         // Make HTTP request
         const url = `${this.serverUrl}${path}`;
+        const headers = {
+            "Content-Type": "application/json",
+            "x-public-key": bytesToHex(publicKey),
+            "x-signature": bytesToHex(signature),
+            "x-timestamp": timestamp,
+            "x-nonce": nonce, // MED-1: replay protection
+            "x-account-id": this.accountId,
+        };
+        // ENG-1696 / ENG-1697: attach a SEAL credential only on Relayer-
+        // mode routes where the server needs it for server-side SEAL
+        // decrypt. Manual-mode methods (rememberManual, recallManual) opt
+        // out and transmit no decrypt credential at all.
+        if (options.includeDelegateKey !== false) {
+            headers["x-seal-session"] = await this.buildSealSession();
+        }
         const res = await fetch(url, {
             method,
-            headers: {
-                "Content-Type": "application/json",
-                "x-public-key": bytesToHex(publicKey),
-                "x-signature": bytesToHex(signature),
-                "x-timestamp": timestamp,
-                "x-delegate-key": bytesToHex(this.privateKey),
-                "x-account-id": this.accountId,
-            },
+            headers,
             body: bodyStr,
+            signal: options.signal,
         });
         if (!res.ok) {
-            const errText = await res.text();
-            throw new Error(`MemWal API error (${res.status}): ${errText}`);
+            // LOW-26: sanitize server error bodies before surfacing to callers.
+            const raw = await res.text();
+            const { message, serverCode } = sanitizeServerError(res.status, raw);
+            const err = new Error(message);
+            err.status = res.status;
+            if (serverCode)
+                err.serverCode = serverCode;
+            // Preserve raw body on `cause` for in-process debugging only.
+            err.cause = raw;
+            throw err;
         }
         return res.json();
     }

package/dist/memwal.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"memwal.js","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgBH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;~~AAE/D~~,+DAA+D;AAC/D,gCAAgC;AAChC,+DAA+D;AAE/D,IAAI,GAAG,GAA2C,IAAI,CAAC;AACvD,KAAK,UAAU,KAAK;IAChB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;~~AAED,+DAA+D~~;AAC/D,~~gBAAgB~~;~~AAChB,+DAA+D~~;~~AAE/D~~,MAAM,OAAO,MAAM;IACP,UAAU,CAAa;IACvB,SAAS,GAAsB,IAAI,CAAC;IACpC,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAE1B,YAAoB,MAAoB;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;~~QACzC~~,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,~~uBAAuB~~,CAAC,CAAC~~,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC~~;~~QAClF~~,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoB;QAC9B,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,WAAW;IACX,+DAA+D;IAE/D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAkB;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAiB,MAAM,EAAE,eAAe,EAAE;YAC/D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QAC9D,OAAO,IAAI,CAAC,aAAa,CAAe,MAAM,EAAE,aAAa,EAAE;~~YAC3D~~,KAAK;~~YACL~~,KAAK;~~YACL~~,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;~~SACzC~~,CAAC,CAAC;~~IACP~~,CAAC;IAED,+DAA+D;IAC/D,sDAAsD;IACtD,+DAA+D;IAE/D~~;;;;;;;;;;;;;;;;;OAiBG~~;IACH,KAAK,CAAC,cAAc,CAAC,IAA2B;QAC5C,OAAO,IAAI,CAAC,aAAa,~~CAAuB~~,MAAM,~~EAAE~~,sBAAsB,~~EAAE~~;~~YAC5E~~,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,~~CAAC~~,CAAC;~~IACP~~,CAAC;IAED~~;;;;;;;;;;;;;;;;;;;;;;;;OAwBG~~;IACH,KAAK,CAAC,YAAY,CAAC,IAAyB;QACxC,OAAO,IAAI,CAAC,aAAa,~~CAAqB~~,MAAM,~~EAAE~~,oBAAoB,~~EAAE~~;~~YACxE~~,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,~~CAAC~~,CAAC;~~IACP~~,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,aAAa,CAAc,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAAkB;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAED~~;;OAEG~~;IACH,KAAK,CAAC,MAAM;QACR,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;~~QACpD~~,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;~~YACV~~,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;~~QAC1D~~,CAAC;~~QACD~~,OAAO,GAAG,CAAC,IAAI,~~EAAE~~,CAAC;~~IACtB~~,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACjB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,iCAAiC;IACjC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED~~;;;;;;;;OAQG~~;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;~~QAEZ~~,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,~~wBAAwB~~;~~QACxB~~,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;~~QAC/D~~,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,oBAAoB;QACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,oBAAoB;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,~~GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,~~OAAO,~~EAAE~~;~~gBACL~~,cAAc,EAAE,kBAAkB;~~gBAClC~~,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;~~gBACrC~~,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;~~gBACpC~~,aAAa,EAAE,SAAS;~~gBACxB~~,~~gBAAgB~~,EAAE,~~UAAU~~,~~CAAC~~,IAAI,CAAC,~~UAAU~~,CAAC;~~gBAC7C~~,~~cAAc~~,EAAE,IAAI,CAAC,~~SAAS~~;~~aACjC~~;~~YACD~~,IAAI,EAAE,OAAO;~~SAChB~~,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,~~OAAO~~,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;~~YACjC~~,MAAM,IAAI,KAAK,CAAC,~~qBAAqB~~,GAAG,CAAC,MAAM,MAAM,~~OAAO~~,~~EAAE~~,CAAC,CAAC;~~QACpE~~,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;CACJ"}
1	+ {"version":3,"file":"memwal.js","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgBH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExG,+DAA+D;AAC/D,gCAAgC;AAChC,+DAA+D;AAE/D,IAAI,GAAG,GAA2C,IAAI,CAAC;AACvD,KAAK,UAAU,KAAK;IAChB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAsBD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,0EAA0E;AAC1E,0EAA0E;AAC1E,wCAAwC;AACxC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,MAAM,OAAO,MAAM;IACP,UAAU,CAAa;IACvB,SAAS,GAAsB,IAAI,CAAC;IACpC,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAE1B,8DAA8D;IAC9D,qEAAqE;IAC7D,YAAY,GAA6B,IAAI,CAAC;IAC9C,YAAY,GAAwB,IAAI,CAAC;IACjD,6EAA6E;IACrE,mBAAmB,GAA2B,IAAI,CAAC;IAE3D,YAAoB,MAAoB;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,oEAAoE;QACpE,8DAA8D;QAC9D,sBAAsB;QACtB,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoB;QAC9B,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,OAAO;QACH,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,WAAW;IACX,+DAA+D;IAE/D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAkB;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAiB,MAAM,EAAE,eAAe,EAAE;YAC/D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QAC9D,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAe,MAAM,EAAE,aAAa,EAAE;gBACjE,KAAK;gBACL,KAAK;gBACL,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;aACzC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,sDAAsD;IACtD,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,cAAc,CAAC,IAA2B;QAC5C,OAAO,IAAI,CAAC,aAAa,CACrB,MAAM,EACN,sBAAsB,EACtB;YACI,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,EACD,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAChC,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,YAAY,CAAC,IAAyB;QACxC,OAAO,IAAI,CAAC,aAAa,CACrB,MAAM,EACN,oBAAoB,EACpB;YACI,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,EACD,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAChC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,aAAa,CAAc,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAAkB;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACR,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAe,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,0EAA0E;YAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,GAAG,YAAY,KAAK;oBACtB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAA2B,CAAC;QAC/C,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACjB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,iCAAiC;IACjC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,8CAA8C;IAC9C,EAAE;IACF,2DAA2D;IAC3D,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,uCAAuC;IACvC,EAAE;IACF,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,8BAA8B;IAC9B,EAAE;IACF,+DAA+D;IAC/D,+DAA+D;IAEvD,KAAK,CAAC,iBAAiB;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,YAAY,GAAG;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC5B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,qBAAqB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,gEAAgE;QAChE,oDAAoD;QACpD,4DAA4D;QAC5D,gEAAgE;QAChE,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAQ,CAAC;QACtD,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAQ,CAAC;QACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAEjD,IAAI,SAAS,GAAQ,SAAS,CAAC;QAC/B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAQ,CAAC;YACxD,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACL,iCAAiC;QACrC,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAQ,CAAC;gBACzD,SAAS,GAAG,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,SAAS,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACL,wCAAwC;YAC5C,CAAC;QACL,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,UAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACX,yEAAyE;gBACzE,oEAAoE,CACvE,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,SAAgB;SAC9B,CAAC,CAAC;QAEH,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,yCAAyC;QACzC,mDAAmD;QACnD,+DAA+D;QAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,yDAAyD;QACzD,yDAAyD;QACzD,wDAAwD;QACxD,0DAA0D;QAC1D,4CAA4C;QAC5C,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;YAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,GACP,OAAO,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,YAAY,GAAG;YAChB,KAAK;YACL,SAAS,EACL,IAAI,CAAC,GAAG,EAAE;gBACV,oBAAoB,GAAG,MAAM;gBAC7B,6BAA6B;SACpC,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC1B,yCAAyC;QACzC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,sDAAsD;QACtD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAE9D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,UAAkE,EAAE;QAEpE,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,oEAAoE;QACpE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,oBAAoB;QACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,oBAAoB;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,kBAAkB;YAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;YACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YACpC,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,KAAK,EAAY,2BAA2B;YACvD,cAAc,EAAE,IAAI,CAAC,SAAS;SACjC,CAAC;QACF,iEAAiE;QACjE,6DAA6D;QAC7D,kEAAkE;QAClE,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,OAAO,CAAC,MAAM;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAI5B,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5C,8DAA8D;YAC9D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;YAChB,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;CACJ"}

package/dist/types.d.ts CHANGED Viewed

@@ -5,8 +5,8 @@
  * the MemWal Rust server (TEE).
  */
 export interface MemWalConfig {
-    /** Ed25519 private key (hex string). This is the delegate key from app.memwal.com */
-    key: string;
+    /** Ed25519 private key (hex string or Uint8Array). This is the delegate key from app.memwal.com */
+    key: string | Uint8Array;
     /** MemWalAccount object ID on Sui (ensures correct account when delegate key exists in multiple accounts) */
     accountId: string;
     /** Server URL (default: http://localhost:8000) */
@@ -93,8 +93,8 @@ export interface RestoreResult {
 }
 /** Config for MemWalManual (full client-side: SEAL + Walrus + embedding) */
 export interface MemWalManualConfig {
-    /** Ed25519 delegate private key (hex) for server auth */
-    key: string;
+    /** Ed25519 delegate private key (hex or Uint8Array) for server auth */
+    key: string | Uint8Array;
     /** Server URL (default: http://localhost:8000) */
     serverUrl?: string;
     /**
@@ -132,6 +132,12 @@ export interface MemWalManualConfig {
      * If omitted, uses built-in defaults for the selected suiNetwork.
      */
     sealKeyServers?: string[];
+    /**
+     * SEAL threshold — number of key server shares required for encrypt/decrypt.
+     * Must be ≤ number of entries in sealKeyServers.
+     * Default: 2 (matches sidecar SEAL_THRESHOLD default).
+     */
+    sealThreshold?: number;
     /** Walrus storage epochs (default: 50) */
     walrusEpochs?: number;
     /** Walrus aggregator URL for direct blob downloads (default: mainnet aggregator) */

package/dist/types.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,YAAY;IACzB,~~qFAAqF~~;~~IACrF~~,GAAG,EAAE,MAAM,CAAC;~~IACZ~~,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACnB;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IAClC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAChC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAC/B,~~yDAAyD~~;~~IACzD~~,GAAG,EAAE,MAAM,CAAC;~~IACZ~~,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IACzB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC/B,WAAW,EAAE,GAAG,CAAC;KACpB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,oDAAoD;IACpD,mBAAmB,EAAE,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,UAAU,CAAC;KACvB,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,qDAAqD;AACrD,UAAU,aAAa;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACpD,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IACxD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;CAClC"}
1	+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,YAAY;IACzB,mGAAmG;IACnG,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IACzB,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACnB;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IAClC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAChC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAC/B,uEAAuE;IACvE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IACzB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IACzB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC/B,WAAW,EAAE,GAAG,CAAC;KACpB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,oDAAoD;IACpD,mBAAmB,EAAE,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,UAAU,CAAC;KACvB,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,qDAAqD;AACrD,UAAU,aAAa;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACpD,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IACxD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;CAClC"}

package/dist/utils.d.ts CHANGED Viewed

@@ -7,8 +7,39 @@
  * Isomorphic SHA-256 hash — uses Web Crypto API (browser) or Node.js crypto (server).
  */
 export declare function sha256hex(data: string): Promise<string>;
+/**
+ * Decode a hex string into bytes.
+ *
+ * LOW-25: Strict validation — rejects non-hex characters, odd-length input,
+ * and empty strings. Previously, `parseInt("zz", 16)` silently produced `NaN`
+ * which was coerced to `0`, yielding a wrong-but-valid-looking key.
+ */
 export declare function hexToBytes(hex: string): Uint8Array;
 export declare function bytesToHex(bytes: Uint8Array): string;
+/**
+ * LOW-22: Normalize a user-supplied server URL.
+ *
+ * - Strips trailing slash.
+ * - Emits a console.warn when a non-HTTPS URL is used against a
+ *   non-localhost host (plaintext HTTP on the open internet exposes
+ *   signed requests and any server-side secrets to passive interception).
+ * - Localhost / 127.0.0.1 / ::1 are exempt from the warning (common in dev).
+ * - Does NOT throw — explicit user-supplied `http://` is honored.
+ */
+export declare function normalizeServerUrl(url: string): string;
+/**
+ * LOW-26: Sanitize a raw server error body before surfacing it to callers.
+ *
+ * - Strips ASCII control characters.
+ * - Truncates to at most 200 chars so stack traces / dumps don't leak.
+ * - Leaves the untrimmed payload accessible via the returned `raw`
+ *   field for debug logging (never included in the thrown message).
+ */
+export declare function sanitizeServerError(status: number, rawBody: string): {
+    message: string;
+    raw: string;
+    serverCode?: string;
+};
 /**
  * Derive the Sui address from an Ed25519 delegate key (private key hex).
  *

package/dist/utils.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY7D;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,~~CAOlD~~;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvF"}
1	+ {"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY7D;AAMD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBlD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsBtD;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBvD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvF"}

package/dist/utils.js CHANGED Viewed

@@ -25,8 +25,27 @@ export async function sha256hex(data) {
 // ============================================================
 // Hex Encoding
 // ============================================================
+/**
+ * Decode a hex string into bytes.
+ *
+ * LOW-25: Strict validation — rejects non-hex characters, odd-length input,
+ * and empty strings. Previously, `parseInt("zz", 16)` silently produced `NaN`
+ * which was coerced to `0`, yielding a wrong-but-valid-looking key.
+ */
 export function hexToBytes(hex) {
-    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+    if (typeof hex !== "string") {
+        throw new TypeError("hexToBytes: expected string input");
+    }
+    const clean = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+    if (clean.length === 0) {
+        throw new Error("hexToBytes: empty hex string");
+    }
+    if (clean.length % 2 !== 0) {
+        throw new Error(`hexToBytes: odd-length hex string (length=${clean.length}); hex must have an even number of digits`);
+    }
+    if (!/^[0-9a-fA-F]+$/.test(clean)) {
+        throw new Error("hexToBytes: input contains non-hex characters");
+    }
     const bytes = new Uint8Array(clean.length / 2);
     for (let i = 0; i < bytes.length; i++) {
         bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
@@ -39,6 +58,77 @@ export function bytesToHex(bytes) {
         .join("");
 }
 // ============================================================
+// Transport Security Helpers
+// ============================================================
+/**
+ * LOW-22: Normalize a user-supplied server URL.
+ *
+ * - Strips trailing slash.
+ * - Emits a console.warn when a non-HTTPS URL is used against a
+ *   non-localhost host (plaintext HTTP on the open internet exposes
+ *   signed requests and any server-side secrets to passive interception).
+ * - Localhost / 127.0.0.1 / ::1 are exempt from the warning (common in dev).
+ * - Does NOT throw — explicit user-supplied `http://` is honored.
+ */
+export function normalizeServerUrl(url) {
+    const trimmed = url.replace(/\/$/, "");
+    try {
+        const parsed = new URL(trimmed);
+        const host = parsed.hostname.toLowerCase();
+        const isLocal = host === "localhost" ||
+            host === "127.0.0.1" ||
+            host === "::1" ||
+            host.endsWith(".localhost");
+        if (parsed.protocol === "http:" && !isLocal) {
+            // eslint-disable-next-line no-console
+            console.warn(`[memwal] serverUrl "${trimmed}" uses plaintext HTTP on a non-localhost host. ` +
+                `Signed requests and any bearer material will be visible to the network. ` +
+                `Use https:// in production.`);
+        }
+    }
+    catch {
+        // invalid URL — let the fetch call surface the error at request time
+    }
+    return trimmed;
+}
+// ============================================================
+// Error Sanitization (LOW-26)
+// ============================================================
+/**
+ * LOW-26: Sanitize a raw server error body before surfacing it to callers.
+ *
+ * - Strips ASCII control characters.
+ * - Truncates to at most 200 chars so stack traces / dumps don't leak.
+ * - Leaves the untrimmed payload accessible via the returned `raw`
+ *   field for debug logging (never included in the thrown message).
+ */
+export function sanitizeServerError(status, rawBody) {
+    const MAX = 200;
+    let serverCode;
+    let text = rawBody;
+    // Try to parse JSON error bodies and extract a known code field.
+    try {
+        const parsed = JSON.parse(rawBody);
+        if (parsed && typeof parsed === "object") {
+            if (typeof parsed.code === "string")
+                serverCode = parsed.code;
+            else if (typeof parsed.error === "string")
+                serverCode = parsed.error;
+            if (typeof parsed.message === "string")
+                text = parsed.message;
+        }
+    }
+    catch {
+        // not JSON — keep rawBody
+    }
+    // Strip ASCII control chars (0x00-0x1F, 0x7F) that could corrupt logs.
+    // eslint-disable-next-line no-control-regex
+    const stripped = text.replace(/[\u0000-\u001F\u007F]/g, " ").trim();
+    const truncated = stripped.length > MAX ? `${stripped.slice(0, MAX)}...` : stripped;
+    const message = `MemWal server error (${status}): ${truncated || "<no message>"}`;
+    return { message, raw: rawBody, serverCode };
+}
+// ============================================================
 // Delegate Key → Sui Address Derivation
 // ============================================================
 /**

package/dist/utils.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,uBAAuB;AACvB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,sDAAsD;IACtD,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,MAAM,UAAU,UAAU,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;~~IACxD~~,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,wCAAwC;AACxC,+DAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEzD,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB;IACvC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3D,CAAC"}
1	+ {"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,uBAAuB;AACvB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,sDAAsD;IACtD,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,6CAA6C,KAAK,CAAC,MAAM,2CAA2C,CACvG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,6BAA6B;AAC7B,+DAA+D;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GACT,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,KAAK;YACd,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACR,uBAAuB,OAAO,iDAAiD;gBAC/E,0EAA0E;gBAC1E,6BAA6B,CAChC,CAAC;QACN,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,qEAAqE;IACzE,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,+DAA+D;AAC/D,8BAA8B;AAC9B,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,GAAG,OAAO,CAAC;IAEnB,iEAAiE;IACjE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;iBACzD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;YACrE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,0BAA0B;IAC9B,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,SAAS,GACX,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,MAAM,OAAO,GAAG,wBAAwB,MAAM,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,+DAA+D;AAC/D,wCAAwC;AACxC,+DAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEzD,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB;IACvC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
     "name": "@mysten-incubation/memwal",
-    "version": "0.0.1",
+    "version": "0.0.2-dev.0",
     "description": "MemWal — Privacy-first AI memory SDK with Ed25519 delegate key auth",
     "type": "module",
     "main": "./dist/index.js",
@@ -51,12 +51,6 @@
         "zod": {
             "optional": true
         },
-        "@mysten/sui": {
-            "optional": true
-        },
-        "@mysten/seal": {
-            "optional": true
-        },
         "@mysten/walrus": {
             "optional": true
         }
@@ -78,10 +72,11 @@
     "license": "Apache-2.0",
     "repository": {
         "type": "git",
-        "url": "https://github.com/MystenLabs/MemWal.git",
+        "url": "git+https://github.com/MystenLabs/MemWal.git",
         "directory": "packages/sdk"
     },
     "publishConfig": {
         "access": "public",
         "registry": "https://registry.npmjs.org/"
-    }}
+    }
+}