@mysten-incubation/memwal 0.0.1 → 0.0.2-dev.1

package/dist/manual.d.ts

@@ -52,6 +52,11 @@ export declare class MemWalManual {
      * @param config.accountId - MemWalAccount object ID (for SEAL seal_approve)
      */
     static create(config: MemWalManualConfig): MemWalManual;
+    /**
+     * Securely wipe the delegate private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy(): void;
     /** Whether this client uses a connected wallet signer (vs raw keypair) */
     get isWalletMode(): boolean;
     private getSuiClient;
@@ -61,6 +66,8 @@ export declare class MemWalManual {
     /** Sign and execute a transaction — via wallet popup or programmatic keypair */
     private signAndExecuteTransaction;
     private getSealClient;
+    /** MED-10: SEAL threshold — must match sidecar SEAL_THRESHOLD (default 2). */
+    private get sealThreshold();
     private getWalrusClient;
     /**
      * Remember (hybrid flow):
@@ -80,10 +87,36 @@ export declare class MemWalManual {
     /** Create a signer adapter — either from wallet or keypair */
     private createSigner;
     private embed;
+    /**
+     * SEAL-encrypt a payload.
+     *
+     * LOW-24: The `id` passed to SEAL is the on-chain policy identifier used
+     * by `seal_approve` to gate decryption. Previously this was just the
+     * owner's Sui address, which meant every memory the owner ever encrypted
+     * shared one decryption scope — a delegate authorized for namespace "A"
+     * could obtain keys for namespace "B" ciphertext.
+     *
+     * We now include both the account id and the namespace:
+     *   id = hex(accountId) || ":" || hex(utf8(namespace))
+     *
+     * NOTE (breaking change): Ciphertext produced before this fix was scoped
+     * by ownerAddress only. Legacy blobs created with the old id will still
+     * decrypt against SEAL (the id travels inside the EncryptedObject), but
+     * any on-chain `seal_approve` policy that now expects namespace-scoped
+     * ids will need to be updated in lockstep.
+     */
     private sealEncrypt;
     private walrusUpload;
     private walrusDownload;
     private getDelegatePublicKey;
+    /**
+     * Make a signed request to the server.
+     *
+     * Signature format (LOW-1 + MED-1 + LOW-23):
+     *   "{timestamp}.{method}.{path_and_query}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers sent: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id.
+     */
     private signedRequest;
     /**
      * Restore a namespace — server downloads all blobs from Walrus,

package/dist/manual.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,kBAAkB,EAElB,oBAAoB,EACpB,kBAAkB,EAElB,aAAa,EAChB,MAAM,YAAY,CAAC;AAuBpB,qBAAa,YAAY;IACrB,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAa;IAE7B,OAAO;IAcP;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY;IAIvD,0EAA0E;IAC1E,IAAI,YAAY,IAAI,OAAO,CAE1B;YASa,YAAY;YA8BZ,UAAU;IAaxB,yEAAyE;YAC3D,eAAe;IAQ7B,gFAAgF;YAClE,yBAAyB;YAYzB,aAAa;YAyBb,eAAe;IAyB7B;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAqBrF;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA2HtG,8DAA8D;YAChD,YAAY;YAuBZ,KAAK;YAsCL,WAAW;YAkBX,YAAY;YAiCZ,cAAc;YAoBd,oBAAoB;YAQpB,aAAa;IAyC3B;;;;;;OAMG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;CAM/E"}
+{"version":3,"file":"manual.d.ts","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,kBAAkB,EAElB,oBAAoB,EACpB,kBAAkB,EAElB,aAAa,EAChB,MAAM,YAAY,CAAC;AAwBpB,qBAAa,YAAY;IACrB,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,iBAAiB,CAA2B;IACpD,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,YAAY,CAAsB;IAC1C,OAAO,CAAC,SAAS,CAAS;IAG1B,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAa;IAE7B,OAAO;IAgBP;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY;IAIvD;;;OAGG;IACH,OAAO,IAAI,IAAI;IASf,0EAA0E;IAC1E,IAAI,YAAY,IAAI,OAAO,CAE1B;YASa,YAAY;YA8BZ,UAAU;IAaxB,yEAAyE;YAC3D,eAAe;IAQ7B,gFAAgF;YAClE,yBAAyB;YAYzB,aAAa;IAyB3B,8EAA8E;IAC9E,OAAO,KAAK,aAAa,GAExB;YAEa,eAAe;IAyB7B;;;;;OAKG;IACG,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAuBrF;;;;;;OAMG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IA6HtG,8DAA8D;YAChD,YAAY;YAuBZ,KAAK;IAsCnB;;;;;;;;;;;;;;;;;OAiBG;YACW,WAAW;YAyBX,YAAY;YAiCZ,cAAc;YAoBd,oBAAoB;IAQlC;;;;;;;OAOG;YACW,aAAa;IA0D3B;;;;;;OAMG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;CAM/E"}

package/dist/manual.js

@@ -26,7 +26,7 @@
  * const result = await memwal.recallManual("food allergies")
  * ```
  */
-import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
+import { sha256hex, hexToBytes, bytesToHex, normalizeServerUrl, sanitizeServerError } from "./utils.js";
 // ============================================================
 // Constants
 // ============================================================
@@ -34,7 +34,8 @@ import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
 // Users can override via SEAL_KEY_SERVERS in their environment
 const DEFAULT_KEY_SERVERS = {
     mainnet: [
-        "0x145540d931f182fef76467dd8074c9839aea126852d90d18e1556fcbbd1208b6", // Overclock (Open) 
+        "0x145540d931f182fef76467dd8074c9839aea126852d90d18e1556fcbbd1208b6", // Overclock (Open)
+        "0xe0eb52eba9261b96e895bbb4deca10dcd64fbc626a1133017adcd5131353fd10", // Studio Mirai (Open)
     ],
     testnet: [
         "0x73d05d62c18d9374e3ea529e8e0ed6161da1a141a94d3f76ae3fe4e99356db75",
@@ -63,8 +64,10 @@ export class MemWalManual {
         if (config.suiPrivateKey && config.walletSigner) {
             throw new Error("MemWalManual: provide suiPrivateKey OR walletSigner, not both");
         }
-        this.delegatePrivateKey = hexToBytes(config.key);
-        this.serverUrl = (config.serverUrl ?? "http://localhost:8000").replace(/\/$/, "");
+        this.delegatePrivateKey = typeof config.key === "string" ? hexToBytes(config.key) : config.key;
+        // LOW-22: default to HTTPS; warn (do not throw) on plaintext HTTP
+        // against non-localhost hosts.
+        this.serverUrl = normalizeServerUrl(config.serverUrl ?? "https://relayer.memwal.ai/");
         this.walletSigner = config.walletSigner ?? null;
         this.config = config;
         this.namespace = config.namespace ?? "default";
@@ -84,6 +87,18 @@ export class MemWalManual {
     static create(config) {
         return new MemWalManual(config);
     }
+    /**
+     * Securely wipe the delegate private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy() {
+        if (this.delegatePrivateKey) {
+            this.delegatePrivateKey.fill(0);
+        }
+        if (this.delegatePublicKey) {
+            this.delegatePublicKey.fill(0);
+        }
+    }
     /** Whether this client uses a connected wallet signer (vs raw keypair) */
     get isWalletMode() {
         return this.walletSigner !== null;
@@ -171,11 +186,15 @@ export class MemWalManual {
                     objectId: id,
                     weight: 1,
                 })),
-                verifyKeyServers: false,
+                verifyKeyServers: true,
             });
         }
         return this._sealClient;
     }
+    /** MED-10: SEAL threshold — must match sidecar SEAL_THRESHOLD (default 2). */
+    get sealThreshold() {
+        return this.config.sealThreshold ?? 2;
+    }
     async getWalrusClient() {
         if (!this._walrusClient) {
             // @ts-ignore — optional peer dependency
@@ -210,9 +229,11 @@ export class MemWalManual {
             throw new Error("Text cannot be empty");
         const ns = namespace ?? this.namespace;
         // Step 1 & 2: Embed + SEAL encrypt concurrently
+        // LOW-24: Scope SEAL encryption id by namespace so a delegate key
+        // authorized for one namespace cannot unwrap ciphertext for another.
         const [vector, encrypted] = await Promise.all([
             this.embed(text),
-            this.sealEncrypt(new TextEncoder().encode(text)),
+            this.sealEncrypt(new TextEncoder().encode(text), ns),
         ]);
         // Step 3: Send encrypted bytes (base64) + vector to server.
         // Server will upload to Walrus via upload-relay and return the blob_id.
@@ -278,11 +299,13 @@ export class MemWalManual {
         // Create signer (wallet adapter or keypair)
         const signer = await this.createSigner(callerAddress);
         // Create session key ONCE (triggers one wallet popup)
+        // HIGH-7 / LOW-13: Reduced from 30 to 5 minutes to limit the exposure
+        // window if a session token is compromised.
         try {
             sessionKey = await SessionKey.create({
                 address: callerAddress,
                 packageId: this.config.packageId,
-                ttlMin: 30,
+                ttlMin: 5,
                 signer,
                 suiClient,
             });
@@ -313,7 +336,7 @@ export class MemWalManual {
                     ids: [fullId],
                     txBytes,
                     sessionKey,
-                    threshold: 1,
+                    threshold: this.sealThreshold,
                 });
                 // Decrypt locally
                 const plaintext = await sealClient.decrypt({
@@ -385,13 +408,37 @@ export class MemWalManual {
     // ============================================================
     // Internal: SEAL Encrypt
     // ============================================================
-    async sealEncrypt(plaintext) {
+    /**
+     * SEAL-encrypt a payload.
+     *
+     * LOW-24: The `id` passed to SEAL is the on-chain policy identifier used
+     * by `seal_approve` to gate decryption. Previously this was just the
+     * owner's Sui address, which meant every memory the owner ever encrypted
+     * shared one decryption scope — a delegate authorized for namespace "A"
+     * could obtain keys for namespace "B" ciphertext.
+     *
+     * We now include both the account id and the namespace:
+     *   id = hex(accountId) || ":" || hex(utf8(namespace))
+     *
+     * NOTE (breaking change): Ciphertext produced before this fix was scoped
+     * by ownerAddress only. Legacy blobs created with the old id will still
+     * decrypt against SEAL (the id travels inside the EncryptedObject), but
+     * any on-chain `seal_approve` policy that now expects namespace-scoped
+     * ids will need to be updated in lockstep.
+     */
+    async sealEncrypt(plaintext, namespace) {
         const sealClient = await this.getSealClient();
-        const ownerAddress = await this.getOwnerAddress();
+        // Build a namespace-scoped SEAL id. Hex-encode both components so
+        // the id is a stable ASCII hex string (SEAL expects a hex id).
+        const accountHex = this.config.accountId.startsWith("0x")
+            ? this.config.accountId.slice(2)
+            : this.config.accountId;
+        const nsHex = bytesToHex(new TextEncoder().encode(namespace));
+        const scopedId = `${accountHex}${nsHex}`;
         const result = await sealClient.encrypt({
-            threshold: 1,
+            threshold: this.sealThreshold,
             packageId: this.config.packageId,
-            id: ownerAddress,
+            id: scopedId,
             data: plaintext,
         });
         return new Uint8Array(result.encryptedObject);
@@ -452,12 +499,24 @@ export class MemWalManual {
         }
         return this.delegatePublicKey;
     }
+    /**
+     * Make a signed request to the server.
+     *
+     * Signature format (LOW-1 + MED-1 + LOW-23):
+     *   "{timestamp}.{method}.{path_and_query}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers sent: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id.
+     */
     async signedRequest(method, path, body) {
         const ed = await import("@noble/ed25519");
         const timestamp = Math.floor(Date.now() / 1000).toString();
         const bodyStr = JSON.stringify(body);
         const bodySha256 = await sha256hex(bodyStr);
-        const message = `${timestamp}.${method}.${path}.${bodySha256}`;
+        // MED-1: per-request nonce for replay protection.
+        const nonce = crypto.randomUUID();
+        // LOW-23: include x-account-id in the canonical signed message so an
+        // intermediary cannot rebind a signed request to a different account.
+        const message = `${timestamp}.${method}.${path}.${bodySha256}.${nonce}.${this.config.accountId}`;
         const msgBytes = new TextEncoder().encode(message);
         const signature = await ed.signAsync(msgBytes, this.delegatePrivateKey);
         const publicKey = await this.getDelegatePublicKey();
@@ -469,12 +528,21 @@ export class MemWalManual {
                 "x-public-key": bytesToHex(publicKey),
                 "x-signature": bytesToHex(signature),
                 "x-timestamp": timestamp,
+                "x-nonce": nonce,
+                "x-account-id": this.config.accountId,
             },
             body: bodyStr,
         });
         if (!res.ok) {
-            const errText = await res.text();
-            throw new Error(`MemWal API error (${res.status}): ${errText}`);
+            // LOW-26: sanitize server error bodies before re-throwing.
+            const raw = await res.text();
+            const { message: sanitized, serverCode } = sanitizeServerError(res.status, raw);
+            const err = new Error(sanitized);
+            err.status = res.status;
+            if (serverCode)
+                err.serverCode = serverCode;
+            err.cause = raw;
+            throw err;
         }
         return res.json();
     }

package/dist/manual.js.map

@@ -1 +1 @@
-{"version":3,"file":"manual.js","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE/D,+DAA+D;AAC/D,YAAY;AACZ,+DAA+D;AAE/D,iDAAiD;AACjD,+DAA+D;AAC/D,MAAM,mBAAmB,GAA6B;IAClD,OAAO,EAAE;QACL,oEAAoE,EAAE,oBAAoB;KAC7F;IACD,OAAO,EAAE;QACL,oEAAoE;QACpE,oEAAoE;KACvE;CACJ,CAAC;AAEF,+DAA+D;AAC/D,sBAAsB;AACtB,+DAA+D;AAE/D,MAAM,OAAO,YAAY;IACb,kBAAkB,CAAa;IAC/B,iBAAiB,GAAsB,IAAI,CAAC;IAC5C,SAAS,CAAS;IAClB,MAAM,CAAqB;IAC3B,YAAY,CAAsB;IAClC,SAAS,CAAS;IAE1B,mFAAmF;IAC3E,UAAU,GAAQ,IAAI,CAAC;IACvB,WAAW,GAAQ,IAAI,CAAC;IACxB,aAAa,GAAQ,IAAI,CAAC;IAC1B,QAAQ,GAAQ,IAAI,CAAC;IAE7B,YAAoB,MAA0B;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAA0B;QACpC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,+DAA+D;IAC/D,6BAA6B;IAC7B,oEAAoE;IACpE,gEAAgE;IAChE,uCAAuC;IACvC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACJ,6CAA6C;gBAC7C,wCAAwC;gBACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAI,GAAW,CAAC,SAAS,CAAC;gBACzC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACX,6CAA6C;wBAC7C,oDAAoD;wBACpD,uCAAuC,CAC1C,CAAC;gBACN,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;gBACpD,MAAM,IAAI,GAA2B;oBACjC,OAAO,EAAE,qCAAqC;oBAC9C,OAAO,EAAE,qCAAqC;iBACjD,CAAC;gBACF,IAAI,CAAC,UAAU,GAAG,IAAI,SAAS,CAAC;oBAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;iBACrC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,eAAe;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,yBAAyB,CAAC,WAAgB;QACpD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,yBAAyB,CAAC;YACvC,MAAM,EAAE,OAAO;YACf,WAAW;SACd,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,wCAAwC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACX,6DAA6D,OAAO,KAAK;oBACzE,0EAA0E,CAC7E,CAAC;YACN,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;gBAC9B,SAAS;gBACT,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnC,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,gBAAgB,EAAE,KAAK;aAC1B,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,eAAe;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,wCAAwC;YACxC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS;gBACzC,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,2CAA2C,CAAC;YAClD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC;gBAClC,OAAO,EAAE,OAAc;gBACvB,SAAS;gBACT,WAAW,EAAE;oBACT,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;iBAC/B;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAkB;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,gDAAgD;QAChD,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;SACnD,CAAC,CAAC;QAEH,4DAA4D;QAC5D,wEAAwE;QACxE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,aAAa,CAAuB,MAAM,EAAE,sBAAsB,EAAE;YAC5E,cAAc,EAAE,eAAe;YAC/B,MAAM;YACN,SAAS,EAAE,EAAE;SAChB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAErD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvC,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CACzC,MAAM,EACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CACnC,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gEAAgE;QAChE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzD,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAgE,EAAE,CAAC,CAAC,KAAK,IAAI,CAClF,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gFAAgF;QAChF,IAAI,UAAe,CAAC;QACpB,IAAI,SAAc,CAAC;QACnB,IAAI,UAAe,CAAC;QACpB,IAAI,eAAoB,CAAC;QACzB,IAAI,WAAgB,CAAC;QACrB,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,wCAAwC;YACxC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEtD,sDAAsD;QACtD,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,EAAE;gBACV,MAAM;gBACN,SAAS;aACZ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;gBAEzB,yBAAyB;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAChF,CAAC;gBACF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC7B,EAAE,CAAC,QAAQ,CAAC;oBACR,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,yBAAyB;oBACzD,SAAS,EAAE;wBACP,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;wBAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnC;iBACJ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEjF,iDAAiD;gBACjD,MAAM,UAAU,CAAC,SAAS,CAAC;oBACvB,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,OAAO;oBACP,UAAU;oBACV,SAAS,EAAE,CAAC;iBACf,CAAC,CAAC;gBAEH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU;oBACV,OAAO;iBACV,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;IAC3B,+DAA+D;IAE/D,8DAA8D;IACtD,KAAK,CAAC,YAAY,CAAC,aAAqB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7B,OAAO;gBACH,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;gBAC3D,IAAI,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;gBACD,mBAAmB,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAEvD,KAAK,CAAC,KAAK,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,6CAA6C;gBAC7C,sDAAsD,CACzD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;aAC3D;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,yBAAyB;IACzB,+DAA+D;IAEvD,KAAK,CAAC,WAAW,CAAC,SAAqB;QAC3C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAElD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,CAAC;YACZ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,EAAE,EAAE,YAAY;YAChB,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,mCAAmC;IACnC,+DAA+D;IAEvD,KAAK,CAAC,YAAY,CAAC,IAAgB;QACvC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS;YAC1C,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,+CAA+C,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,oBAAoB,MAAM,iBAAiB,EAAE;YACjF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAA2B;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAS,CAAC;QACxC,+DAA+D;QAC/D,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM;eAC/C,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc;QACvC,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS;YAC3C,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,gDAAgD,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAEO,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;QAEZ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEpD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;gBACpC,aAAa,EAAE,SAAS;aAC3B;YACD,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;CACJ"}
+{"version":3,"file":"manual.js","sourceRoot":"","sources":["../src/manual.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAUH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExG,+DAA+D;AAC/D,YAAY;AACZ,+DAA+D;AAE/D,iDAAiD;AACjD,+DAA+D;AAC/D,MAAM,mBAAmB,GAA6B;IAClD,OAAO,EAAE;QACL,oEAAoE,EAAE,mBAAmB;QACzF,oEAAoE,EAAE,sBAAsB;KAC/F;IACD,OAAO,EAAE;QACL,oEAAoE;QACpE,oEAAoE;KACvE;CACJ,CAAC;AAEF,+DAA+D;AAC/D,sBAAsB;AACtB,+DAA+D;AAE/D,MAAM,OAAO,YAAY;IACb,kBAAkB,CAAa;IAC/B,iBAAiB,GAAsB,IAAI,CAAC;IAC5C,SAAS,CAAS;IAClB,MAAM,CAAqB;IAC3B,YAAY,CAAsB;IAClC,SAAS,CAAS;IAE1B,mFAAmF;IAC3E,UAAU,GAAQ,IAAI,CAAC;IACvB,WAAW,GAAQ,IAAI,CAAC;IACxB,aAAa,GAAQ,IAAI,CAAC;IAC1B,QAAQ,GAAQ,IAAI,CAAC;IAE7B,YAAoB,MAA0B;QAC1C,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAClF,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC9C,MAAM,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC;QACrF,CAAC;QACD,IAAI,CAAC,kBAAkB,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QAC/F,kEAAkE;QAClE,+BAA+B;QAC/B,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACtF,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,YAAY,IAAI,IAAI,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;;;;;;;OAWG;IACH,MAAM,CAAC,MAAM,CAAC,MAA0B;QACpC,OAAO,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED;;;OAGG;IACH,OAAO;QACH,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC1B,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpC,CAAC;QACD,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;YACzB,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACnC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,IAAI,YAAY;QACZ,OAAO,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;IACtC,CAAC;IAED,+DAA+D;IAC/D,6BAA6B;IAC7B,oEAAoE;IACpE,gEAAgE;IAChE,uCAAuC;IACvC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC;YACnB,0EAA0E;YAC1E,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YAC5C,CAAC;iBAAM,CAAC;gBACJ,6CAA6C;gBAC7C,wCAAwC;gBACxC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;gBAC/C,MAAM,SAAS,GAAI,GAAW,CAAC,SAAS,CAAC;gBACzC,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CACX,6CAA6C;wBAC7C,oDAAoD;wBACpD,uCAAuC,CAC1C,CAAC;gBACN,CAAC;gBACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;gBACpD,MAAM,IAAI,GAA2B;oBACjC,OAAO,EAAE,qCAAqC;oBAC9C,OAAO,EAAE,qCAAqC;iBACjD,CAAC;gBACF,IAAI,CAAC,UAAU,GAAG,IAAI,SAAS,CAAC;oBAC5B,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,OAAO;iBACrC,CAAC,CAAC;YACP,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,UAAU;QACpB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACjB,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAC;YACxE,MAAM,EAAE,SAAS,EAAE,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAc,CAAC,CAAC;YACtE,IAAI,CAAC,QAAQ,GAAG,cAAc,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,QAAQ,CAAC;IACzB,CAAC;IAED,yEAAyE;IACjE,KAAK,CAAC,eAAe;QACzB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;QACrC,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,CAAC;IACjD,CAAC;IAED,gFAAgF;IACxE,KAAK,CAAC,yBAAyB,CAAC,WAAgB;QACpD,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,OAAO,IAAI,CAAC,YAAY,CAAC,yBAAyB,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAC5C,OAAO,SAAS,CAAC,yBAAyB,CAAC;YACvC,MAAM,EAAE,OAAO;YACf,WAAW;SACd,CAAC,CAAC;IACP,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACpB,wCAAwC;YACxC,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YACpF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACX,6DAA6D,OAAO,KAAK;oBACzE,0EAA0E,CAC7E,CAAC;YACN,CAAC;YACD,IAAI,CAAC,WAAW,GAAG,IAAI,UAAU,CAAC;gBAC9B,SAAS;gBACT,aAAa,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACnC,QAAQ,EAAE,EAAE;oBACZ,MAAM,EAAE,CAAC;iBACZ,CAAC,CAAC;gBACH,gBAAgB,EAAE,IAAI;aACzB,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC5B,CAAC;IAED,8EAA8E;IAC9E,IAAY,aAAa;QACrB,OAAO,IAAI,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;IAC1C,CAAC;IAEO,KAAK,CAAC,eAAe;QACzB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACtB,wCAAwC;YACxC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;YACpD,MAAM,eAAe,GAAG,OAAO,KAAK,SAAS;gBACzC,CAAC,CAAC,2CAA2C;gBAC7C,CAAC,CAAC,2CAA2C,CAAC;YAClD,IAAI,CAAC,aAAa,GAAG,IAAI,YAAY,CAAC;gBAClC,OAAO,EAAE,OAAc;gBACvB,SAAS;gBACT,WAAW,EAAE;oBACT,IAAI,EAAE,eAAe;oBACrB,OAAO,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE;iBAC/B;aACJ,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,kBAAkB;IAClB,+DAA+D;IAE/D;;;;;OAKG;IACH,KAAK,CAAC,cAAc,CAAC,IAAY,EAAE,SAAkB;QACjD,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAEnD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,gDAAgD;QAChD,kEAAkE;QAClE,qEAAqE;QACrE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YAC1C,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAChB,IAAI,CAAC,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;SACvD,CAAC,CAAC;QAEH,4DAA4D;QAC5D,wEAAwE;QACxE,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,aAAa,CAAuB,MAAM,EAAE,sBAAsB,EAAE;YAC5E,cAAc,EAAE,eAAe;YAC/B,MAAM;YACN,SAAS,EAAE,EAAE;SAChB,CAAC,CAAC;IACP,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QACpE,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAErD,MAAM,EAAE,GAAG,SAAS,IAAI,IAAI,CAAC,SAAS,CAAC;QAEvC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEvC,wBAAwB;QACxB,MAAM,YAAY,GAAG,MAAM,IAAI,CAAC,aAAa,CACzC,MAAM,EACN,oBAAoB,EACpB,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CACnC,CAAC;QAEF,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gEAAgE;QAChE,MAAM,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;YACzD,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;YAClE,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,6CAA6C,GAAG,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;gBAChF,OAAO,IAAI,CAAC;YAChB,CAAC;QACL,CAAC,CAAC,CAAC;QACH,MAAM,eAAe,GAAG,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAC7D,CAAC,CAAC,EAAgE,EAAE,CAAC,CAAC,KAAK,IAAI,CAClF,CAAC;QAEF,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,gFAAgF;QAChF,IAAI,UAAe,CAAC;QACpB,IAAI,SAAc,CAAC;QACnB,IAAI,UAAe,CAAC;QACpB,IAAI,eAAoB,CAAC;QACzB,IAAI,WAAgB,CAAC;QACrB,IAAI,UAAe,CAAC;QACpB,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;YACxC,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;YACtC,wCAAwC;YACxC,CAAC,EAAE,UAAU,EAAE,eAAe,EAAE,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC;YACjE,CAAC,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC;YAC5E,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAEnD,4CAA4C;QAC5C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,aAAa,CAAC,CAAC;QAEtD,sDAAsD;QACtD,sEAAsE;QACtE,4CAA4C;QAC5C,IAAI,CAAC;YACD,UAAU,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;gBACjC,OAAO,EAAE,aAAa;gBACtB,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;gBAChC,MAAM,EAAE,CAAC;gBACT,MAAM;gBACN,SAAS;aACZ,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,EAAE,GAAG,CAAC,CAAC;YAC/D,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACrC,CAAC;QAED,8DAA8D;QAC9D,MAAM,OAAO,GAAyB,EAAE,CAAC;QACzC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;YACjC,IAAI,CAAC;gBACD,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAChD,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC;gBAEzB,yBAAyB;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CACtB,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAE,CAAC,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAChF,CAAC;gBACF,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC7B,EAAE,CAAC,QAAQ,CAAC;oBACR,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,yBAAyB;oBACzD,SAAS,EAAE;wBACP,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC;wBAC9B,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;qBACnC;iBACJ,CAAC,CAAC;gBACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;gBAEjF,iDAAiD;gBACjD,MAAM,UAAU,CAAC,SAAS,CAAC;oBACvB,GAAG,EAAE,CAAC,MAAM,CAAC;oBACb,OAAO;oBACP,UAAU;oBACV,SAAS,EAAE,IAAI,CAAC,aAAa;iBAChC,CAAC,CAAC;gBAEH,kBAAkB;gBAClB,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;oBACvC,IAAI,EAAE,IAAI,CAAC,IAAI;oBACf,UAAU;oBACV,OAAO;iBACV,CAAC,CAAC;gBACH,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACjD,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC3E,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,OAAO,CAAC,KAAK,CAAC,0CAA0C,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,CAAC,CAAC;YAClF,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9C,CAAC;IAED,+DAA+D;IAC/D,2BAA2B;IAC3B,+DAA+D;IAE/D,8DAA8D;IACtD,KAAK,CAAC,YAAY,CAAC,aAAqB;QAC5C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACpB,MAAM,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC;YAC7B,OAAO;gBACH,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;gBACjC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC;gBAC3D,IAAI,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC7B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;gBACD,mBAAmB,EAAE,KAAK,EAAE,IAAgB,EAAE,EAAE;oBAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,mBAAmB,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC/D,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC;gBAC3C,CAAC;aACJ,CAAC;QACN,CAAC;QACD,OAAO,IAAI,CAAC,UAAU,EAAE,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,sBAAsB;IACtB,+DAA+D;IAEvD,KAAK,CAAC,KAAK,CAAC,IAAY;QAC5B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACX,6CAA6C;gBAC7C,sDAAsD,CACzD,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,2BAA2B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACjG,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,YAAY,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,wBAAwB,CAAC;QAC/F,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,YAAY,CAAC;QAEzD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE;aAC3D;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;SAC/C,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyC,CAAC;QACtE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;YAC7B,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,yBAAyB;IACzB,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,WAAW,CAAC,SAAqB,EAAE,SAAiB;QAC9D,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAE9C,kEAAkE;QAClE,+DAA+D;QAC/D,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC;YACrD,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAChC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;QAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,GAAG,UAAU,GAAG,KAAK,EAAE,CAAC;QAEzC,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC;YACpC,SAAS,EAAE,IAAI,CAAC,aAAa;YAC7B,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;YAChC,EAAE,EAAE,QAAQ;YACZ,IAAI,EAAE,SAAS;SAClB,CAAC,CAAC;QAEH,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAClD,CAAC;IAED,+DAA+D;IAC/D,mCAAmC;IACnC,+DAA+D;IAEvD,KAAK,CAAC,YAAY,CAAC,IAAgB;QACvC,0EAA0E;QAC1E,kEAAkE;QAClE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,gBAAgB,GAAG,OAAO,KAAK,SAAS;YAC1C,CAAC,CAAC,+CAA+C;YACjD,CAAC,CAAC,+CAA+C,CAAC;QACtD,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,kBAAkB,IAAI,gBAAgB,CAAC;QACxE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,IAAI,EAAE,CAAC;QAE9C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,YAAY,oBAAoB,MAAM,iBAAiB,EAAE;YACjF,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE;YACvD,IAAI,EAAE,IAA2B;SACpC,CAAC,CAAC;QAEH,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CAAC,yBAAyB,IAAI,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAS,CAAC;QACxC,+DAA+D;QAC/D,sCAAsC;QACtC,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,MAAM;eAC/C,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC;QAEvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,uCAAuC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,MAAc;QACvC,6EAA6E;QAC7E,yDAAyD;QACzD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,UAAU,IAAI,SAAS,CAAC;QACpD,MAAM,iBAAiB,GAAG,OAAO,KAAK,SAAS;YAC3C,CAAC,CAAC,gDAAgD;YAClD,CAAC,CAAC,gDAAgD,CAAC;QACvD,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,mBAAmB,IAAI,iBAAiB,CAAC;QAC3E,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,aAAa,aAAa,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,MAAM,MAAM,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED,+DAA+D;IAC/D,gEAAgE;IAChE,+DAA+D;IAEvD,KAAK,CAAC,oBAAoB;QAC9B,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,CAAC;YAC1B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;YAC1C,IAAI,CAAC,iBAAiB,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;QAEZ,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,kDAAkD;QAClD,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,qEAAqE;QACrE,sEAAsE;QACtE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;QACjG,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACxE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,oBAAoB,EAAE,CAAC;QAEpD,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;gBACpC,aAAa,EAAE,SAAS;gBACxB,SAAS,EAAE,KAAK;gBAChB,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;aACxC;YACD,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,2DAA2D;YAC3D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YAChF,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,SAAS,CAI9B,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5C,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;YAChB,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;IAED,+DAA+D;IAC/D,UAAU;IACV,+DAA+D;IAE/D;;;;;;OAMG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;CACJ"}

package/dist/memwal.d.ts

@@ -33,14 +33,23 @@ export declare class MemWal {
     private serverUrl;
     private namespace;
     private accountId;
+    private sessionCache;
+    private serverConfig;
+    /** Single-flight guard so concurrent requests share one SessionKey build. */
+    private sessionBuildPromise;
     private constructor();
     /**
      * Create a new MemWal client instance.
      *
      * @param config.key - Ed25519 private key (hex string) — the delegate key
-     * @param config.serverUrl - Server URL (default: http://localhost:8000)
+     * @param config.serverUrl - Server URL (default: https://relayer.memwal.ai/)
      */
     static create(config: MemWalConfig): MemWal;
+    /**
+     * Securely wipe the private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy(): void;
     /**
      * Remember something — server handles: verify → embed → encrypt → Walrus upload → store
      *
@@ -75,6 +84,10 @@ export declare class MemWal {
      * Remember (manual mode) — user handles SEAL encrypt, embedding,
      * and Walrus upload externally. Server only stores the vector ↔ blobId mapping.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Manual-mode handlers on the server never invoke SEAL
+     * decrypt, so the key stays client-side as the name implies.
+     *
      * @param opts.blobId - Walrus blob ID (user already uploaded encrypted data)
      * @param opts.vector - Embedding vector (user already generated, e.g. 1536-dim)
      * @returns RememberManualResult with id, blob_id, owner
@@ -95,6 +108,10 @@ export declare class MemWal {
      * Server returns matching blobIds + distances.
      * User then downloads from Walrus + SEAL decrypts on their own.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Server returns blob IDs only; decryption happens entirely
+     * on the client.
+     *
      * @param opts.vector - Pre-computed query embedding vector
      * @param opts.limit - Max results (default: 10)
      * @returns RecallManualResult with blob_id + distance pairs (no decrypted text)
@@ -153,6 +170,13 @@ export declare class MemWal {
     restore(namespace: string, limit?: number): Promise<RestoreResult>;
     /**
      * Check server health.
+     *
+     * INFO-7: The health endpoint is currently public/unsigned server-side,
+     * but we send the same signed-request envelope as every other call so
+     * that (a) the channel is authenticated whenever the server opts in, and
+     * (b) a MitM cannot trivially forge a "healthy" response for a client
+     * that has no way to tell. If the server ignores the signature headers
+     * on `/health`, this is still a harmless no-op.
      */
     health(): Promise<HealthResult>;
     /**
@@ -160,14 +184,34 @@ export declare class MemWal {
      */
     getPublicKeyHex(): Promise<string>;
     private getPublicKey;
+    private fetchServerConfig;
+    private buildSealSessionInner;
+    private buildSealSession;
     /**
      * Make a signed request to the server.
      *
-     * Signature format: "{timestamp}.{method}.{path}.{body_sha256}"
-     * Headers: x-public-key, x-signature, x-timestamp
+     * Signature format (LOW-23 updated):
+     *   "{timestamp}.{method}.{path}.{body_sha256}.{nonce}.{account_id}"
+     *
+     * Headers: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id
+     *
+     * The nonce is a UUID v4 generated per-request and tracked server-side
+     * in Redis (TTL=600s) to prevent replay attacks.
+     *
+     * LOW-23: x-account-id is now included in the signed canonical message so
+     * an intermediary cannot swap the account hint without invalidating the
+     * signature. Server-side verification in services/server/src/auth.rs must
+     * use the matching message format.
+     *
+     * ENG-1696: Callers set `includeDelegateKey: false` on Manual-mode routes
+     * so the delegate private key is not transmitted. Manual-mode docstrings
+     * promise the key stays client-side; the server does not need it on those
+     * routes because Manual-mode handlers never invoke SEAL decrypt.
      *
-     * The server uses x-public-key to look up the owner via onchain
-     * MemWalAccount.delegate_keys — no need to send owner in the body.
+     * ENG-1697: On Relayer-mode routes the SDK builds a SEAL SessionKey
+     * client-side (emitted via `x-seal-session`). The SessionKey is ephemeral
+     * (5-min TTL, scoped to the server's `packageId`) so a wire capture has
+     * a bounded blast radius. Requires `@mysten/seal` and `@mysten/sui`.
      */
     private signedRequest;
 }

package/dist/memwal.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"memwal.d.ts","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,YAAY,EACZ,cAAc,EACd,YAAY,EAEZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EAChB,MAAM,YAAY,CAAC;AAmBpB,qBAAa,MAAM;IACf,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAE1B,OAAO;IAOP;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM;IAQ3C;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAY1F;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAQhF;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACG,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAQ1E;;;;;OAKG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI/C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOvE;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAO5E;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAQrC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;YAS1B,YAAY;IAQ1B;;;;;;;;OAQG;YACW,aAAa;CAyC9B"}
+{"version":3,"file":"memwal.d.ts","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EACR,YAAY,EACZ,cAAc,EACd,YAAY,EAEZ,WAAW,EACX,aAAa,EACb,YAAY,EACZ,qBAAqB,EACrB,oBAAoB,EACpB,mBAAmB,EACnB,kBAAkB,EAClB,aAAa,EAChB,MAAM,YAAY,CAAC;AAyCpB,qBAAa,MAAM;IACf,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,SAAS,CAA2B;IAC5C,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,SAAS,CAAS;IAI1B,OAAO,CAAC,YAAY,CAAkC;IACtD,OAAO,CAAC,YAAY,CAA6B;IACjD,6EAA6E;IAC7E,OAAO,CAAC,mBAAmB,CAAgC;IAE3D,OAAO;IAUP;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM;IAI3C;;;OAGG;IACH,OAAO,IAAI,IAAI;IAiBf;;;;;;;;;;;OAWG;IACG,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOzE;;;;;;;;;;;;;;;OAeG;IACG,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAkB1F;;;;;;;;;;;;;;;;;;;;;OAqBG;IACG,cAAc,CAAC,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAahF;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACG,YAAY,CAAC,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAa1E;;;;;OAKG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAI/C;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAOvE;;;;;;;;;;;;OAYG;IACG,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,GAAE,MAAW,GAAG,OAAO,CAAC,aAAa,CAAC;IAO5E;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,YAAY,CAAC;IAerC;;OAEG;IACG,eAAe,IAAI,OAAO,CAAC,MAAM,CAAC;YAS1B,YAAY;YA8BZ,iBAAiB;YAkBjB,qBAAqB;YAsFrB,gBAAgB;IAc9B;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;YACW,aAAa;CAiE9B"}

package/dist/memwal.js

@@ -26,7 +26,7 @@
  * console.log(result.results[0].text) // "I'm allergic to peanuts"
  * ```
  */
-import { sha256hex, hexToBytes, bytesToHex } from "./utils.js";
+import { sha256hex, hexToBytes, bytesToHex, normalizeServerUrl, sanitizeServerError } from "./utils.js";
 // ============================================================
 // Ed25519 Signing (lazy-loaded)
 // ============================================================
@@ -37,30 +37,57 @@ async function getEd() {
     }
     return _ed;
 }
-// ============================================================
-// MemWal Client
-// ============================================================
+const SEAL_SESSION_TTL_MIN = 5;
+// Refresh 30 seconds before SEAL's 5-minute TTL to avoid the window where
+// the client thinks the session is valid but a just-received request hits
+// a key server that sees it as expired.
+const SEAL_SESSION_SAFETY_MARGIN_MS = 30_000;
 export class MemWal {
     privateKey;
     publicKey = null;
     serverUrl;
     namespace;
     accountId;
+    // ENG-1697 state — all internal, never surfaced to user code.
+    // The public API (`MemWal.create({ key, accountId })`) is unchanged.
+    sessionCache = null;
+    serverConfig = null;
+    /** Single-flight guard so concurrent requests share one SessionKey build. */
+    sessionBuildPromise = null;
     constructor(config) {
-        this.privateKey = hexToBytes(config.key);
+        this.privateKey = typeof config.key === "string" ? hexToBytes(config.key) : config.key;
         this.accountId = config.accountId;
-        this.serverUrl = (config.serverUrl ?? "http://localhost:8000").replace(/\/$/, "");
+        // LOW-22: default to HTTPS for production usage; normalizeServerUrl
+        // warns (does not throw) if a user passes plain http:// for a
+        // non-localhost host.
+        this.serverUrl = normalizeServerUrl(config.serverUrl ?? "https://relayer.memwal.ai/");
         this.namespace = config.namespace ?? "default";
     }
     /**
      * Create a new MemWal client instance.
      *
      * @param config.key - Ed25519 private key (hex string) — the delegate key
-     * @param config.serverUrl - Server URL (default: http://localhost:8000)
+     * @param config.serverUrl - Server URL (default: https://relayer.memwal.ai/)
      */
     static create(config) {
         return new MemWal(config);
     }
+    /**
+     * Securely wipe the private and public keys from memory.
+     * Prevents key extraction from V8 heap dumps.
+     */
+    destroy() {
+        if (this.privateKey) {
+            this.privateKey.fill(0);
+        }
+        if (this.publicKey) {
+            this.publicKey.fill(0);
+        }
+        // ENG-1697: drop cached session material too — once destroyed the
+        // instance must not leak authorization tokens either.
+        this.sessionCache = null;
+        this.serverConfig = null;
+    }
     // ============================================================
     // Core API
     // ============================================================
@@ -99,11 +126,18 @@ export class MemWal {
      * ```
      */
     async recall(query, limit = 10, namespace) {
-        return this.signedRequest("POST", "/api/recall", {
-            query,
-            limit,
-            namespace: namespace ?? this.namespace,
-        });
+        const ac = new AbortController();
+        const tid = setTimeout(() => ac.abort(), 15000);
+        try {
+            return await this.signedRequest("POST", "/api/recall", {
+                query,
+                limit,
+                namespace: namespace ?? this.namespace,
+            }, { signal: ac.signal });
+        }
+        finally {
+            clearTimeout(tid);
+        }
     }
     // ============================================================
     // Manual API (user handles SEAL + embedding + Walrus)
@@ -112,6 +146,10 @@ export class MemWal {
      * Remember (manual mode) — user handles SEAL encrypt, embedding,
      * and Walrus upload externally. Server only stores the vector ↔ blobId mapping.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Manual-mode handlers on the server never invoke SEAL
+     * decrypt, so the key stays client-side as the name implies.
+     *
      * @param opts.blobId - Walrus blob ID (user already uploaded encrypted data)
      * @param opts.vector - Embedding vector (user already generated, e.g. 1536-dim)
      * @returns RememberManualResult with id, blob_id, owner
@@ -131,13 +169,17 @@ export class MemWal {
             blob_id: opts.blobId,
             vector: opts.vector,
             namespace: opts.namespace ?? this.namespace,
-        });
+        }, { includeDelegateKey: false });
     }
     /**
      * Recall (manual mode) — user provides a pre-computed query vector.
      * Server returns matching blobIds + distances.
      * User then downloads from Walrus + SEAL decrypts on their own.
      *
+     * Trust boundary (ENG-1696): the delegate private key is NOT transmitted on
+     * this request. Server returns blob IDs only; decryption happens entirely
+     * on the client.
+     *
      * @param opts.vector - Pre-computed query embedding vector
      * @param opts.limit - Max results (default: 10)
      * @returns RecallManualResult with blob_id + distance pairs (no decrypted text)
@@ -163,7 +205,7 @@ export class MemWal {
             vector: opts.vector,
             limit: opts.limit ?? 10,
             namespace: opts.namespace ?? this.namespace,
-        });
+        }, { includeDelegateKey: false });
     }
     /**
      * Generate an embedding vector for text (no storage).
@@ -214,13 +256,28 @@ export class MemWal {
     }
     /**
      * Check server health.
+     *
+     * INFO-7: The health endpoint is currently public/unsigned server-side,
+     * but we send the same signed-request envelope as every other call so
+     * that (a) the channel is authenticated whenever the server opts in, and
+     * (b) a MitM cannot trivially forge a "healthy" response for a client
+     * that has no way to tell. If the server ignores the signature headers
+     * on `/health`, this is still a harmless no-op.
      */
     async health() {
-        const res = await fetch(`${this.serverUrl}/health`);
-        if (!res.ok) {
-            throw new Error(`Health check failed: ${res.status}`);
+        try {
+            return await this.signedRequest("GET", "/health", {});
+        }
+        catch (err) {
+            // Fall back to a plain GET for servers that reject bodies on GET /health.
+            const res = await fetch(`${this.serverUrl}/health`);
+            if (!res.ok) {
+                throw err instanceof Error
+                    ? err
+                    : new Error(`Health check failed: ${res.status}`);
+            }
+            return res.json();
         }
-        return res.json();
     }
     /**
      * Get the public key (hex string).
@@ -239,43 +296,208 @@ export class MemWal {
         }
         return this.publicKey;
     }
+    // ============================================================
+    // ENG-1697: SEAL SessionKey discovery & build
+    //
+    // The SDK used to transmit the raw delegate private key in
+    // `x-delegate-key` on every request. That credential, once captured,
+    // lets an attacker retroactively decrypt every ciphertext the account
+    // ever produced (until the user rotates on-chain) and sign arbitrary
+    // Sui transactions from the delegate address.
+    //
+    // We now build a SEAL `SessionKey` on the client (ephemeral, scoped to
+    // a single `packageId`, 5-minute TTL, signed by the delegate key) and
+    // ship only the exported session bytes via `x-seal-session`. The raw
+    // private key never leaves the client.
+    //
+    // `packageId` is fetched from the server's public `/config` endpoint
+    // the first time it's needed so the user API (`new MemWal({ key,
+    // accountId })`) stays unchanged — past users upgrading to v0.4 do not
+    // have to touch their config.
+    //
+    // Requires `@mysten/seal` and `@mysten/sui` peer dependencies.
+    // ============================================================
+    async fetchServerConfig() {
+        if (this.serverConfig)
+            return this.serverConfig;
+        const res = await fetch(`${this.serverUrl}/config`, { method: "GET" });
+        if (!res.ok) {
+            throw new Error(`GET /config returned ${res.status}`);
+        }
+        const body = (await res.json());
+        if (!body.packageId || !body.network || !body.suiRpcUrl) {
+            throw new Error("GET /config response missing packageId / network / suiRpcUrl");
+        }
+        this.serverConfig = {
+            packageId: body.packageId,
+            network: body.network,
+            suiRpcUrl: body.suiRpcUrl,
+        };
+        return this.serverConfig;
+    }
+    async buildSealSessionInner() {
+        const cfg = await this.fetchServerConfig();
+        // @mysten/sui renamed/moved `SuiClient` between minor versions:
+        //   - pre-2.6:  `SuiClient` in `@mysten/sui/client`
+        //   - 2.6+:     `SuiJsonRpcClient` in `@mysten/sui/jsonRpc`
+        // Probe both paths so the SDK works across the supported range.
+        const sealMod = (await import("@mysten/seal"));
+        const ed25519Mod = (await import("@mysten/sui/keypairs/ed25519"));
+        const SessionKey = sealMod.SessionKey;
+        const Ed25519Keypair = ed25519Mod.Ed25519Keypair;
+        let SuiClient = undefined;
+        try {
+            const mod = (await import("@mysten/sui/client"));
+            SuiClient = mod.SuiClient;
+        }
+        catch {
+            /* not present on this version */
+        }
+        if (typeof SuiClient !== "function") {
+            try {
+                const mod = (await import("@mysten/sui/jsonRpc"));
+                SuiClient = mod.SuiJsonRpcClient ?? mod.SuiClient;
+            }
+            catch {
+                /* not present on this version either */
+            }
+        }
+        if (typeof SuiClient !== "function" || typeof Ed25519Keypair !== "function") {
+            throw new Error("SuiClient/SuiJsonRpcClient or Ed25519Keypair not found in @mysten/sui. " +
+                "Ensure @mysten/sui >=2.5.0 and @mysten/seal >=1.1.0 are installed.");
+        }
+        const keypair = Ed25519Keypair.fromSecretKey(this.privateKey);
+        const suiClient = new SuiClient({ url: cfg.suiRpcUrl });
+        const session = await SessionKey.create({
+            address: keypair.getPublicKey().toSuiAddress(),
+            packageId: cfg.packageId,
+            ttlMin: SEAL_SESSION_TTL_MIN,
+            signer: keypair,
+            suiClient: suiClient,
+        });
+        // Eagerly sign the personal message so the exported envelope is
+        // fully self-contained. `SessionKey.create()` defers this signing
+        // until first use, which would break the migration: the sidecar
+        // imports without a signer and must be able to get a certificate
+        // from the exported state alone. Calling
+        // setPersonalMessageSignature() here populates the
+        // `personalMessageSignature` field in the subsequent export().
+        const personalMessage = session.getPersonalMessage();
+        const signResult = await keypair.signPersonalMessage(personalMessage);
+        await session.setPersonalMessageSignature(signResult.signature);
+        const exported = session.export();
+        // SEAL intentionally installs a throwing `toJSON` on the
+        // exported object to catch accidental serialization. The
+        // migration to `x-seal-session` IS the intended on-wire
+        // format, so we project the primitive fields into a fresh
+        // object before stringifying. The sidecar's
+        // `SessionKey.import()` expects this exact shape.
+        const jsonStr = JSON.stringify({
+            address: exported.address,
+            packageId: exported.packageId,
+            mvrName: exported.mvrName,
+            creationTimeMs: exported.creationTimeMs,
+            ttlMin: exported.ttlMin,
+            personalMessageSignature: exported.personalMessageSignature,
+            sessionKey: exported.sessionKey,
+        });
+        const bytes = typeof btoa === "function"
+            ? btoa(jsonStr)
+            : Buffer.from(jsonStr, "utf8").toString("base64");
+        this.sessionCache = {
+            bytes,
+            expiresAt: Date.now() +
+                SEAL_SESSION_TTL_MIN * 60_000 -
+                SEAL_SESSION_SAFETY_MARGIN_MS,
+        };
+        return bytes;
+    }
+    async buildSealSession() {
+        // Fast path: cached session still fresh.
+        if (this.sessionCache && Date.now() < this.sessionCache.expiresAt) {
+            return this.sessionCache.bytes;
+        }
+        // Single-flight: concurrent requests share one build.
+        if (this.sessionBuildPromise)
+            return this.sessionBuildPromise;
+        this.sessionBuildPromise = this.buildSealSessionInner().finally(() => {
+            this.sessionBuildPromise = null;
+        });
+        return this.sessionBuildPromise;
+    }
     /**
      * Make a signed request to the server.
      *
-     * Signature format: "{timestamp}.{method}.{path}.{body_sha256}"
-     * Headers: x-public-key, x-signature, x-timestamp
+     * Signature format (LOW-23 updated):
+     *   "{timestamp}.{method}.{path}.{body_sha256}.{nonce}.{account_id}"
      *
-     * The server uses x-public-key to look up the owner via onchain
-     * MemWalAccount.delegate_keys — no need to send owner in the body.
+     * Headers: x-public-key, x-signature, x-timestamp, x-nonce, x-account-id
+     *
+     * The nonce is a UUID v4 generated per-request and tracked server-side
+     * in Redis (TTL=600s) to prevent replay attacks.
+     *
+     * LOW-23: x-account-id is now included in the signed canonical message so
+     * an intermediary cannot swap the account hint without invalidating the
+     * signature. Server-side verification in services/server/src/auth.rs must
+     * use the matching message format.
+     *
+     * ENG-1696: Callers set `includeDelegateKey: false` on Manual-mode routes
+     * so the delegate private key is not transmitted. Manual-mode docstrings
+     * promise the key stays client-side; the server does not need it on those
+     * routes because Manual-mode handlers never invoke SEAL decrypt.
+     *
+     * ENG-1697: On Relayer-mode routes the SDK builds a SEAL SessionKey
+     * client-side (emitted via `x-seal-session`). The SessionKey is ephemeral
+     * (5-min TTL, scoped to the server's `packageId`) so a wire capture has
+     * a bounded blast radius. Requires `@mysten/seal` and `@mysten/sui`.
      */
-    async signedRequest(method, path, body) {
+    async signedRequest(method, path, body, options = {}) {
         const ed = await getEd();
         const timestamp = Math.floor(Date.now() / 1000).toString();
         const bodyStr = JSON.stringify(body);
         const bodySha256 = await sha256hex(bodyStr);
-        // Build message to sign
-        const message = `${timestamp}.${method}.${path}.${bodySha256}`;
+        // MED-1 fix: Generate per-request nonce (UUID v4) for replay protection
+        const nonce = crypto.randomUUID();
+        // LOW-23: Build message to sign — now includes nonce AND account id
+        const message = `${timestamp}.${method}.${path}.${bodySha256}.${nonce}.${this.accountId}`;
         const msgBytes = new TextEncoder().encode(message);
         // Sign with Ed25519
         const signature = await ed.signAsync(msgBytes, this.privateKey);
         const publicKey = await this.getPublicKey();
         // Make HTTP request
         const url = `${this.serverUrl}${path}`;
+        const headers = {
+            "Content-Type": "application/json",
+            "x-public-key": bytesToHex(publicKey),
+            "x-signature": bytesToHex(signature),
+            "x-timestamp": timestamp,
+            "x-nonce": nonce, // MED-1: replay protection
+            "x-account-id": this.accountId,
+        };
+        // ENG-1696 / ENG-1697: attach a SEAL credential only on Relayer-
+        // mode routes where the server needs it for server-side SEAL
+        // decrypt. Manual-mode methods (rememberManual, recallManual) opt
+        // out and transmit no decrypt credential at all.
+        if (options.includeDelegateKey !== false) {
+            headers["x-seal-session"] = await this.buildSealSession();
+        }
         const res = await fetch(url, {
             method,
-            headers: {
-                "Content-Type": "application/json",
-                "x-public-key": bytesToHex(publicKey),
-                "x-signature": bytesToHex(signature),
-                "x-timestamp": timestamp,
-                "x-delegate-key": bytesToHex(this.privateKey),
-                "x-account-id": this.accountId,
-            },
+            headers,
             body: bodyStr,
+            signal: options.signal,
         });
         if (!res.ok) {
-            const errText = await res.text();
-            throw new Error(`MemWal API error (${res.status}): ${errText}`);
+            // LOW-26: sanitize server error bodies before surfacing to callers.
+            const raw = await res.text();
+            const { message, serverCode } = sanitizeServerError(res.status, raw);
+            const err = new Error(message);
+            err.status = res.status;
+            if (serverCode)
+                err.serverCode = serverCode;
+            // Preserve raw body on `cause` for in-process debugging only.
+            err.cause = raw;
+            throw err;
         }
         return res.json();
     }

package/dist/memwal.js.map

@@ -1 +1 @@
-{"version":3,"file":"memwal.js","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgBH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE/D,+DAA+D;AAC/D,gCAAgC;AAChC,+DAA+D;AAE/D,IAAI,GAAG,GAA2C,IAAI,CAAC;AACvD,KAAK,UAAU,KAAK;IAChB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAED,+DAA+D;AAC/D,gBAAgB;AAChB,+DAA+D;AAE/D,MAAM,OAAO,MAAM;IACP,UAAU,CAAa;IACvB,SAAS,GAAsB,IAAI,CAAC;IACpC,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAE1B,YAAoB,MAAoB;QACpC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,IAAI,CAAC,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,uBAAuB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoB;QAC9B,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,+DAA+D;IAC/D,WAAW;IACX,+DAA+D;IAE/D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAkB;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAiB,MAAM,EAAE,eAAe,EAAE;YAC/D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QAC9D,OAAO,IAAI,CAAC,aAAa,CAAe,MAAM,EAAE,aAAa,EAAE;YAC3D,KAAK;YACL,KAAK;YACL,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED,+DAA+D;IAC/D,sDAAsD;IACtD,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAAC,IAA2B;QAC5C,OAAO,IAAI,CAAC,aAAa,CAAuB,MAAM,EAAE,sBAAsB,EAAE;YAC5E,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACH,KAAK,CAAC,YAAY,CAAC,IAAyB;QACxC,OAAO,IAAI,CAAC,aAAa,CAAqB,MAAM,EAAE,oBAAoB,EAAE;YACxE,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,CAAC,CAAC;IACP,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,aAAa,CAAc,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAAkB;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM;QACR,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;QACpD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACjB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,iCAAiC;IACjC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY;QAEZ,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,wBAAwB;QACxB,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;QAC/D,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,oBAAoB;QACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,oBAAoB;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO,EAAE;gBACL,cAAc,EAAE,kBAAkB;gBAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;gBACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;gBACpC,aAAa,EAAE,SAAS;gBACxB,gBAAgB,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;gBAC7C,cAAc,EAAE,IAAI,CAAC,SAAS;aACjC;YACD,IAAI,EAAE,OAAO;SAChB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CAAC,qBAAqB,GAAG,CAAC,MAAM,MAAM,OAAO,EAAE,CAAC,CAAC;QACpE,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;CACJ"}
+{"version":3,"file":"memwal.js","sourceRoot":"","sources":["../src/memwal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAgBH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAExG,+DAA+D;AAC/D,gCAAgC;AAChC,+DAA+D;AAE/D,IAAI,GAAG,GAA2C,IAAI,CAAC;AACvD,KAAK,UAAU,KAAK;IAChB,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,GAAG,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC;AAsBD,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,0EAA0E;AAC1E,0EAA0E;AAC1E,wCAAwC;AACxC,MAAM,6BAA6B,GAAG,MAAM,CAAC;AAE7C,MAAM,OAAO,MAAM;IACP,UAAU,CAAa;IACvB,SAAS,GAAsB,IAAI,CAAC;IACpC,SAAS,CAAS;IAClB,SAAS,CAAS;IAClB,SAAS,CAAS;IAE1B,8DAA8D;IAC9D,qEAAqE;IAC7D,YAAY,GAA6B,IAAI,CAAC;IAC9C,YAAY,GAAwB,IAAI,CAAC;IACjD,6EAA6E;IACrE,mBAAmB,GAA2B,IAAI,CAAC;IAE3D,YAAoB,MAAoB;QACpC,IAAI,CAAC,UAAU,GAAG,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;QACvF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;QAClC,oEAAoE;QACpE,8DAA8D;QAC9D,sBAAsB;QACtB,IAAI,CAAC,SAAS,GAAG,kBAAkB,CAAC,MAAM,CAAC,SAAS,IAAI,4BAA4B,CAAC,CAAC;QACtF,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,SAAS,CAAC;IACnD,CAAC;IAED;;;;;OAKG;IACH,MAAM,CAAC,MAAM,CAAC,MAAoB;QAC9B,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,OAAO;QACH,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YAClB,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACjB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,CAAC;QACD,kEAAkE;QAClE,sDAAsD;QACtD,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QACzB,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;IAC7B,CAAC;IAED,+DAA+D;IAC/D,WAAW;IACX,+DAA+D;IAE/D;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAY,EAAE,SAAkB;QAC3C,OAAO,IAAI,CAAC,aAAa,CAAiB,MAAM,EAAE,eAAe,EAAE;YAC/D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;;;;OAeG;IACH,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,QAAgB,EAAE,EAAE,SAAkB;QAC9D,MAAM,EAAE,GAAG,IAAI,eAAe,EAAE,CAAC;QACjC,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAe,MAAM,EAAE,aAAa,EAAE;gBACjE,KAAK;gBACL,KAAK;gBACL,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;aACzC,EAAE,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9B,CAAC;gBAAS,CAAC;YACP,YAAY,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,sDAAsD;IACtD,+DAA+D;IAE/D;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,KAAK,CAAC,cAAc,CAAC,IAA2B;QAC5C,OAAO,IAAI,CAAC,aAAa,CACrB,MAAM,EACN,sBAAsB,EACtB;YACI,OAAO,EAAE,IAAI,CAAC,MAAM;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,EACD,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAChC,CAAC;IACN,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;IACH,KAAK,CAAC,YAAY,CAAC,IAAyB;QACxC,OAAO,IAAI,CAAC,aAAa,CACrB,MAAM,EACN,oBAAoB,EACpB;YACI,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE;YACvB,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,SAAS;SAC9C,EACD,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAChC,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY;QACpB,OAAO,IAAI,CAAC,aAAa,CAAc,MAAM,EAAE,YAAY,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3E,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAAkB;QAC1C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,IAAI;YACJ,SAAS,EAAE,SAAS,IAAI,IAAI,CAAC,SAAS;SACzC,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,QAAgB,EAAE;QAC/C,OAAO,IAAI,CAAC,aAAa,CAAgB,MAAM,EAAE,cAAc,EAAE;YAC7D,SAAS;YACT,KAAK;SACR,CAAC,CAAC;IACP,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACR,IAAI,CAAC;YACD,OAAO,MAAM,IAAI,CAAC,aAAa,CAAe,KAAK,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,0EAA0E;YAC1E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;YACpD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,GAAG,YAAY,KAAK;oBACtB,CAAC,CAAC,GAAG;oBACL,CAAC,CAAC,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YAC1D,CAAC;YACD,OAAO,GAAG,CAAC,IAAI,EAA2B,CAAC;QAC/C,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe;QACjB,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QACrC,OAAO,UAAU,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,iCAAiC;IACjC,+DAA+D;IAEvD,KAAK,CAAC,YAAY;QACtB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAClB,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACjE,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED,+DAA+D;IAC/D,8CAA8C;IAC9C,EAAE;IACF,2DAA2D;IAC3D,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,8CAA8C;IAC9C,EAAE;IACF,uEAAuE;IACvE,sEAAsE;IACtE,qEAAqE;IACrE,uCAAuC;IACvC,EAAE;IACF,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,8BAA8B;IAC9B,EAAE;IACF,+DAA+D;IAC/D,+DAA+D;IAEvD,KAAK,CAAC,iBAAiB;QAC3B,IAAI,IAAI,CAAC,YAAY;YAAE,OAAO,IAAI,CAAC,YAAY,CAAC;QAChD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,SAAS,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,wBAAwB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACtD,MAAM,IAAI,KAAK,CAAC,8DAA8D,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,CAAC,YAAY,GAAG;YAChB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,SAAS,EAAE,IAAI,CAAC,SAAS;SAC5B,CAAC;QACF,OAAO,IAAI,CAAC,YAAY,CAAC;IAC7B,CAAC;IAEO,KAAK,CAAC,qBAAqB;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,gEAAgE;QAChE,oDAAoD;QACpD,4DAA4D;QAC5D,gEAAgE;QAChE,MAAM,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,cAAc,CAAC,CAAQ,CAAC;QACtD,MAAM,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,8BAA8B,CAAC,CAAQ,CAAC;QACzE,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;QACtC,MAAM,cAAc,GAAG,UAAU,CAAC,cAAc,CAAC;QAEjD,IAAI,SAAS,GAAQ,SAAS,CAAC;QAC/B,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAQ,CAAC;YACxD,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC9B,CAAC;QAAC,MAAM,CAAC;YACL,iCAAiC;QACrC,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,UAAU,EAAE,CAAC;YAClC,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,qBAAqB,CAAC,CAAQ,CAAC;gBACzD,SAAS,GAAG,GAAG,CAAC,gBAAgB,IAAI,GAAG,CAAC,SAAS,CAAC;YACtD,CAAC;YAAC,MAAM,CAAC;gBACL,wCAAwC;YAC5C,CAAC;QACL,CAAC;QACD,IAAI,OAAO,SAAS,KAAK,UAAU,IAAI,OAAO,cAAc,KAAK,UAAU,EAAE,CAAC;YAC1E,MAAM,IAAI,KAAK,CACX,yEAAyE;gBACzE,oEAAoE,CACvE,CAAC;QACN,CAAC;QAED,MAAM,OAAO,GAAG,cAAc,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC9D,MAAM,SAAS,GAAG,IAAI,SAAS,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC;QAExD,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC;YACpC,OAAO,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE;YAC9C,SAAS,EAAE,GAAG,CAAC,SAAS;YACxB,MAAM,EAAE,oBAAoB;YAC5B,MAAM,EAAE,OAAO;YACf,SAAS,EAAE,SAAgB;SAC9B,CAAC,CAAC;QAEH,gEAAgE;QAChE,kEAAkE;QAClE,gEAAgE;QAChE,iEAAiE;QACjE,yCAAyC;QACzC,mDAAmD;QACnD,+DAA+D;QAC/D,MAAM,eAAe,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QACrD,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,mBAAmB,CAAC,eAAe,CAAC,CAAC;QACtE,MAAM,OAAO,CAAC,2BAA2B,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QAEhE,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;QAClC,yDAAyD;QACzD,yDAAyD;QACzD,wDAAwD;QACxD,0DAA0D;QAC1D,4CAA4C;QAC5C,kDAAkD;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,wBAAwB,EAAE,QAAQ,CAAC,wBAAwB;YAC3D,UAAU,EAAE,QAAQ,CAAC,UAAU;SAClC,CAAC,CAAC;QACH,MAAM,KAAK,GACP,OAAO,IAAI,KAAK,UAAU;YACtB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC;YACf,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAE1D,IAAI,CAAC,YAAY,GAAG;YAChB,KAAK;YACL,SAAS,EACL,IAAI,CAAC,GAAG,EAAE;gBACV,oBAAoB,GAAG,MAAM;gBAC7B,6BAA6B;SACpC,CAAC;QACF,OAAO,KAAK,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC1B,yCAAyC;QACzC,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,YAAY,CAAC,SAAS,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC;QACnC,CAAC;QACD,sDAAsD;QACtD,IAAI,IAAI,CAAC,mBAAmB;YAAE,OAAO,IAAI,CAAC,mBAAmB,CAAC;QAE9D,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC,qBAAqB,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;YACjE,IAAI,CAAC,mBAAmB,GAAG,IAAI,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,mBAAmB,CAAC;IACpC,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;;;;;OAyBG;IACK,KAAK,CAAC,aAAa,CACvB,MAAc,EACd,IAAY,EACZ,IAAY,EACZ,UAAkE,EAAE;QAEpE,MAAM,EAAE,GAAG,MAAM,KAAK,EAAE,CAAC;QAEzB,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;QAE5C,wEAAwE;QACxE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAElC,oEAAoE;QACpE,MAAM,OAAO,GAAG,GAAG,SAAS,IAAI,MAAM,IAAI,IAAI,IAAI,UAAU,IAAI,KAAK,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;QAC1F,MAAM,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAEnD,oBAAoB;QACpB,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,CAAC;QAE5C,oBAAoB;QACpB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,EAAE,CAAC;QACvC,MAAM,OAAO,GAA2B;YACpC,cAAc,EAAE,kBAAkB;YAClC,cAAc,EAAE,UAAU,CAAC,SAAS,CAAC;YACrC,aAAa,EAAE,UAAU,CAAC,SAAS,CAAC;YACpC,aAAa,EAAE,SAAS;YACxB,SAAS,EAAE,KAAK,EAAY,2BAA2B;YACvD,cAAc,EAAE,IAAI,CAAC,SAAS;SACjC,CAAC;QACF,iEAAiE;QACjE,6DAA6D;QAC7D,kEAAkE;QAClE,iDAAiD;QACjD,IAAI,OAAO,CAAC,kBAAkB,KAAK,KAAK,EAAE,CAAC;YACvC,OAAO,CAAC,gBAAgB,CAAC,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC9D,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACzB,MAAM;YACN,OAAO;YACP,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,OAAO,CAAC,MAAM;SACzB,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACV,oEAAoE;YACpE,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;YACrE,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,OAAO,CAI5B,CAAC;YACF,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;YACxB,IAAI,UAAU;gBAAE,GAAG,CAAC,UAAU,GAAG,UAAU,CAAC;YAC5C,8DAA8D;YAC9D,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC;YAChB,MAAM,GAAG,CAAC;QACd,CAAC;QAED,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IACpC,CAAC;CACJ"}

package/dist/types.d.ts

@@ -5,8 +5,8 @@
  * the MemWal Rust server (TEE).
  */
 export interface MemWalConfig {
-    /** Ed25519 private key (hex string). This is the delegate key from app.memwal.com */
-    key: string;
+    /** Ed25519 private key (hex string or Uint8Array). This is the delegate key from app.memwal.com */
+    key: string | Uint8Array;
     /** MemWalAccount object ID on Sui (ensures correct account when delegate key exists in multiple accounts) */
     accountId: string;
     /** Server URL (default: http://localhost:8000) */
@@ -93,8 +93,8 @@ export interface RestoreResult {
 }
 /** Config for MemWalManual (full client-side: SEAL + Walrus + embedding) */
 export interface MemWalManualConfig {
-    /** Ed25519 delegate private key (hex) for server auth */
-    key: string;
+    /** Ed25519 delegate private key (hex or Uint8Array) for server auth */
+    key: string | Uint8Array;
     /** Server URL (default: http://localhost:8000) */
     serverUrl?: string;
     /**
@@ -132,6 +132,12 @@ export interface MemWalManualConfig {
      * If omitted, uses built-in defaults for the selected suiNetwork.
      */
     sealKeyServers?: string[];
+    /**
+     * SEAL threshold — number of key server shares required for encrypt/decrypt.
+     * Must be ≤ number of entries in sealKeyServers.
+     * Default: 2 (matches sidecar SEAL_THRESHOLD default).
+     */
+    sealThreshold?: number;
     /** Walrus storage epochs (default: 50) */
     walrusEpochs?: number;
     /** Walrus aggregator URL for direct blob downloads (default: mainnet aggregator) */

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,YAAY;IACzB,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACnB;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IAClC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAChC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAC/B,yDAAyD;IACzD,GAAG,EAAE,MAAM,CAAC;IACZ,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IACzB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC/B,WAAW,EAAE,GAAG,CAAC;KACpB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,oDAAoD;IACpD,mBAAmB,EAAE,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,UAAU,CAAC;KACvB,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,qDAAqD;AACrD,UAAU,aAAa;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACpD,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IACxD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;CAClC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,MAAM,WAAW,YAAY;IACzB,mGAAmG;IACnG,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IACzB,6GAA6G;IAC7G,SAAS,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAMD,6BAA6B;AAC7B,MAAM,WAAW,cAAc;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,+BAA+B;AAC/B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,2BAA2B;AAC3B,MAAM,WAAW,YAAY;IACzB,OAAO,EAAE,YAAY,EAAE,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,0BAA0B;AAC1B,MAAM,WAAW,WAAW;IACxB,MAAM,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,8BAA8B;AAC9B,MAAM,WAAW,YAAY;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACnB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,KAAK,EAAE,YAAY,EAAE,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;CACnB;AAMD,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IAClC,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,gDAAgD;IAChD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACrB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAChC,0CAA0C;IAC1C,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yDAAyD;IACzD,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,sEAAsE;AACtE,MAAM,WAAW,eAAe;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,4BAA4B;AAC5B,MAAM,WAAW,aAAa;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,4EAA4E;AAC5E,MAAM,WAAW,kBAAkB;IAC/B,uEAAuE;IACvE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAC;IACzB,kDAAkD;IAClD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;OAIG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;;OAIG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,oFAAoF;IACpF,eAAe,EAAE,MAAM,CAAC;IACxB,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IACnC;;;;OAIG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oFAAoF;IACpF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,gFAAgF;IAChF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB;AAED;;;GAGG;AACH,MAAM,WAAW,YAAY;IACzB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAC;IAChB,yDAAyD;IACzD,yBAAyB,EAAE,CAAC,KAAK,EAAE;QAC/B,WAAW,EAAE,GAAG,CAAC;KACpB,KAAK,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAClC,oDAAoD;IACpD,mBAAmB,EAAE,CAAC,KAAK,EAAE;QACzB,OAAO,EAAE,UAAU,CAAC;KACvB,KAAK,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACxC;AAED,6EAA6E;AAC7E,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;CACpB;AAED,gFAAgF;AAChF,MAAM,WAAW,kBAAkB;IAC/B,OAAO,EAAE,CAAC,eAAe,GAAG,kBAAkB,CAAC,EAAE,CAAC;IAClD,KAAK,EAAE,MAAM,CAAC;CACjB;AAMD,qDAAqD;AACrD,UAAU,aAAa;IACnB,wCAAwC;IACxC,SAAS,EAAE,MAAM,CAAC;IAClB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B;;;OAGG;IACH,SAAS,CAAC,EAAE,GAAG,CAAC;IAChB,qCAAqC;IACrC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;CACtC;AAED,kCAAkC;AAClC,MAAM,WAAW,iBAAkB,SAAQ,aAAa;IACpD,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,kCAAkC;AAClC,MAAM,WAAW,mBAAmB;IAChC,sCAAsC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,wBAAwB;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;CAClB;AAED,mCAAmC;AACnC,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACrD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,6DAA6D;IAC7D,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;IAC/B,qEAAqE;IACrE,KAAK,EAAE,MAAM,CAAC;CACjB;AAED,mCAAmC;AACnC,MAAM,WAAW,oBAAoB;IACjC,yBAAyB;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB;IACrB,SAAS,EAAE,MAAM,CAAC;IAClB,gDAAgD;IAChD,UAAU,EAAE,MAAM,CAAC;CACtB;AAED,sCAAsC;AACtC,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IACxD,8BAA8B;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,SAAS,EAAE,UAAU,GAAG,MAAM,CAAC;CAClC"}

package/dist/utils.d.ts

@@ -7,8 +7,39 @@
  * Isomorphic SHA-256 hash — uses Web Crypto API (browser) or Node.js crypto (server).
  */
 export declare function sha256hex(data: string): Promise<string>;
+/**
+ * Decode a hex string into bytes.
+ *
+ * LOW-25: Strict validation — rejects non-hex characters, odd-length input,
+ * and empty strings. Previously, `parseInt("zz", 16)` silently produced `NaN`
+ * which was coerced to `0`, yielding a wrong-but-valid-looking key.
+ */
 export declare function hexToBytes(hex: string): Uint8Array;
 export declare function bytesToHex(bytes: Uint8Array): string;
+/**
+ * LOW-22: Normalize a user-supplied server URL.
+ *
+ * - Strips trailing slash.
+ * - Emits a console.warn when a non-HTTPS URL is used against a
+ *   non-localhost host (plaintext HTTP on the open internet exposes
+ *   signed requests and any server-side secrets to passive interception).
+ * - Localhost / 127.0.0.1 / ::1 are exempt from the warning (common in dev).
+ * - Does NOT throw — explicit user-supplied `http://` is honored.
+ */
+export declare function normalizeServerUrl(url: string): string;
+/**
+ * LOW-26: Sanitize a raw server error body before surfacing it to callers.
+ *
+ * - Strips ASCII control characters.
+ * - Truncates to at most 200 chars so stack traces / dumps don't leak.
+ * - Leaves the untrimmed payload accessible via the returned `raw`
+ *   field for debug logging (never included in the thrown message).
+ */
+export declare function sanitizeServerError(status: number, rawBody: string): {
+    message: string;
+    raw: string;
+    serverCode?: string;
+};
 /**
  * Derive the Sui address from an Ed25519 delegate key (private key hex).
  *

package/dist/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY7D;AAMD,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAOlD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvF"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAMH;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY7D;AAMD;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAqBlD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIpD;AAMD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsBtD;AAMD;;;;;;;GAOG;AACH,wBAAgB,mBAAmB,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,GAChB;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,CAwBvD;AAMD;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAcpF;AAED;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAGvF"}

package/dist/utils.js

@@ -25,8 +25,27 @@ export async function sha256hex(data) {
 // ============================================================
 // Hex Encoding
 // ============================================================
+/**
+ * Decode a hex string into bytes.
+ *
+ * LOW-25: Strict validation — rejects non-hex characters, odd-length input,
+ * and empty strings. Previously, `parseInt("zz", 16)` silently produced `NaN`
+ * which was coerced to `0`, yielding a wrong-but-valid-looking key.
+ */
 export function hexToBytes(hex) {
-    const clean = hex.startsWith("0x") ? hex.slice(2) : hex;
+    if (typeof hex !== "string") {
+        throw new TypeError("hexToBytes: expected string input");
+    }
+    const clean = hex.startsWith("0x") || hex.startsWith("0X") ? hex.slice(2) : hex;
+    if (clean.length === 0) {
+        throw new Error("hexToBytes: empty hex string");
+    }
+    if (clean.length % 2 !== 0) {
+        throw new Error(`hexToBytes: odd-length hex string (length=${clean.length}); hex must have an even number of digits`);
+    }
+    if (!/^[0-9a-fA-F]+$/.test(clean)) {
+        throw new Error("hexToBytes: input contains non-hex characters");
+    }
     const bytes = new Uint8Array(clean.length / 2);
     for (let i = 0; i < bytes.length; i++) {
         bytes[i] = parseInt(clean.substring(i * 2, i * 2 + 2), 16);
@@ -39,6 +58,77 @@ export function bytesToHex(bytes) {
         .join("");
 }
 // ============================================================
+// Transport Security Helpers
+// ============================================================
+/**
+ * LOW-22: Normalize a user-supplied server URL.
+ *
+ * - Strips trailing slash.
+ * - Emits a console.warn when a non-HTTPS URL is used against a
+ *   non-localhost host (plaintext HTTP on the open internet exposes
+ *   signed requests and any server-side secrets to passive interception).
+ * - Localhost / 127.0.0.1 / ::1 are exempt from the warning (common in dev).
+ * - Does NOT throw — explicit user-supplied `http://` is honored.
+ */
+export function normalizeServerUrl(url) {
+    const trimmed = url.replace(/\/$/, "");
+    try {
+        const parsed = new URL(trimmed);
+        const host = parsed.hostname.toLowerCase();
+        const isLocal = host === "localhost" ||
+            host === "127.0.0.1" ||
+            host === "::1" ||
+            host.endsWith(".localhost");
+        if (parsed.protocol === "http:" && !isLocal) {
+            // eslint-disable-next-line no-console
+            console.warn(`[memwal] serverUrl "${trimmed}" uses plaintext HTTP on a non-localhost host. ` +
+                `Signed requests and any bearer material will be visible to the network. ` +
+                `Use https:// in production.`);
+        }
+    }
+    catch {
+        // invalid URL — let the fetch call surface the error at request time
+    }
+    return trimmed;
+}
+// ============================================================
+// Error Sanitization (LOW-26)
+// ============================================================
+/**
+ * LOW-26: Sanitize a raw server error body before surfacing it to callers.
+ *
+ * - Strips ASCII control characters.
+ * - Truncates to at most 200 chars so stack traces / dumps don't leak.
+ * - Leaves the untrimmed payload accessible via the returned `raw`
+ *   field for debug logging (never included in the thrown message).
+ */
+export function sanitizeServerError(status, rawBody) {
+    const MAX = 200;
+    let serverCode;
+    let text = rawBody;
+    // Try to parse JSON error bodies and extract a known code field.
+    try {
+        const parsed = JSON.parse(rawBody);
+        if (parsed && typeof parsed === "object") {
+            if (typeof parsed.code === "string")
+                serverCode = parsed.code;
+            else if (typeof parsed.error === "string")
+                serverCode = parsed.error;
+            if (typeof parsed.message === "string")
+                text = parsed.message;
+        }
+    }
+    catch {
+        // not JSON — keep rawBody
+    }
+    // Strip ASCII control chars (0x00-0x1F, 0x7F) that could corrupt logs.
+    // eslint-disable-next-line no-control-regex
+    const stripped = text.replace(/[\u0000-\u001F\u007F]/g, " ").trim();
+    const truncated = stripped.length > MAX ? `${stripped.slice(0, MAX)}...` : stripped;
+    const message = `MemWal server error (${status}): ${truncated || "<no message>"}`;
+    return { message, raw: rawBody, serverCode };
+}
+// ============================================================
 // Delegate Key → Sui Address Derivation
 // ============================================================
 /**

package/dist/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,uBAAuB;AACvB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,sDAAsD;IACtD,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D,MAAM,UAAU,UAAU,CAAC,GAAW;IAClC,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACxD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,wCAAwC;AACxC,+DAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEzD,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB;IACvC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3D,CAAC"}
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../src/utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,+DAA+D;AAC/D,uBAAuB;AACvB,+DAA+D;AAE/D;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAY;IACxC,MAAM,KAAK,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC7C,sDAAsD;IACtD,IAAI,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,UAAU,EAAE,CAAC;QAC1D,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QACxE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;aACrC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;aAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IACD,6BAA6B;IAC7B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED,+DAA+D;AAC/D,eAAe;AACf,+DAA+D;AAE/D;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,GAAW;IAClC,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,KAAK,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChF,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACX,6CAA6C,KAAK,CAAC,MAAM,2CAA2C,CACvG,CAAC;IACN,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC/C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,KAAK,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAiB;IACxC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;SACnB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SAC3C,IAAI,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED,+DAA+D;AAC/D,6BAA6B;AAC7B,+DAA+D;AAE/D;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC1C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC3C,MAAM,OAAO,GACT,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,WAAW;YACpB,IAAI,KAAK,KAAK;YACd,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;QAChC,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACR,uBAAuB,OAAO,iDAAiD;gBAC/E,0EAA0E;gBAC1E,6BAA6B,CAChC,CAAC;QACN,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,qEAAqE;IACzE,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,+DAA+D;AAC/D,8BAA8B;AAC9B,+DAA+D;AAE/D;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAC/B,MAAc,EACd,OAAe;IAEf,MAAM,GAAG,GAAG,GAAG,CAAC;IAChB,IAAI,UAA8B,CAAC;IACnC,IAAI,IAAI,GAAG,OAAO,CAAC;IAEnB,iEAAiE;IACjE,IAAI,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACvC,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;gBAAE,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC;iBACzD,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;gBAAE,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC;YACrE,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ;gBAAE,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC;QAClE,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACL,0BAA0B;IAC9B,CAAC;IAED,uEAAuE;IACvE,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,wBAAwB,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACpE,MAAM,SAAS,GACX,QAAQ,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IACtE,MAAM,OAAO,GAAG,wBAAwB,MAAM,MAAM,SAAS,IAAI,cAAc,EAAE,CAAC;IAClF,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC;AACjD,CAAC;AAED,+DAA+D;AAC/D,wCAAwC;AACxC,+DAA+D;AAE/D;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,aAAqB;IAC/D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;IAE5D,MAAM,UAAU,GAAG,UAAU,CAAC,aAAa,CAAC,CAAC;IAC7C,MAAM,SAAS,GAAG,MAAM,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAEzD,uDAAuD;IACvD,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,KAAK,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,sBAAsB;IACvC,KAAK,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IAExB,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;IACnD,OAAO,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,aAAqB;IAC9D,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,gBAAgB,CAAC,CAAC;IAC1C,OAAO,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@mysten-incubation/memwal",
-    "version": "0.0.1",
+    "version": "0.0.2-dev.1",
     "description": "MemWal — Privacy-first AI memory SDK with Ed25519 delegate key auth",
     "type": "module",
     "main": "./dist/index.js",
@@ -51,12 +51,6 @@
         "zod": {
             "optional": true
         },
-        "@mysten/sui": {
-            "optional": true
-        },
-        "@mysten/seal": {
-            "optional": true
-        },
         "@mysten/walrus": {
             "optional": true
         }
@@ -78,10 +72,11 @@
     "license": "Apache-2.0",
     "repository": {
         "type": "git",
-        "url": "https://github.com/MystenLabs/MemWal.git",
+        "url": "git+https://github.com/MystenLabs/MemWal.git",
         "directory": "packages/sdk"
     },
     "publishConfig": {
         "access": "public",
         "registry": "https://registry.npmjs.org/"
-    }}
+    }
+}