@jaw.id/cli 0.0.2

package/dist/lib/session-store.js

@@ -0,0 +1,81 @@
+import * as fs2 from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+
+// src/lib/session-store.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  bridge: path.join(JAW_DIR, "bridge.json"),
+  daemonLog: path.join(JAW_DIR, "daemon.log")
+};
+
+// src/lib/validation.ts
+function isValidAddress(value) {
+  return /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.chmodSync(dir, 448);
+}
+
+// src/lib/session-store.ts
+var SESSION_TTL_MS = 24 * 60 * 60 * 1e3;
+function isValidSessionShape(session) {
+  if (!session || typeof session !== "object") return false;
+  const s = session;
+  return typeof s.address === "string" && isValidAddress(s.address) && typeof s.chainId === "number" && Number.isInteger(s.chainId) && s.chainId > 0 && typeof s.connectedAt === "string" && !Number.isNaN(Date.parse(s.connectedAt)) && typeof s.expiresAt === "string" && !Number.isNaN(Date.parse(s.expiresAt));
+}
+function loadSession() {
+  try {
+    if (!fs2.existsSync(PATHS.session)) return null;
+    const raw = fs2.readFileSync(PATHS.session, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!isValidSessionShape(parsed)) {
+      clearSession();
+      return null;
+    }
+    if (!isSessionValid(parsed)) {
+      clearSession();
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveSession(session) {
+  ensureDir(PATHS.root);
+  fs2.writeFileSync(PATHS.session, JSON.stringify(session, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function clearSession() {
+  try {
+    if (fs2.existsSync(PATHS.session)) {
+      fs2.unlinkSync(PATHS.session);
+    }
+  } catch {
+  }
+}
+function isSessionValid(session) {
+  return new Date(session.expiresAt).getTime() > Date.now();
+}
+function createSession(address, chainId) {
+  const now = /* @__PURE__ */ new Date();
+  return {
+    address,
+    chainId,
+    connectedAt: now.toISOString(),
+    expiresAt: new Date(now.getTime() + SESSION_TTL_MS).toISOString()
+  };
+}
+
+export { clearSession, createSession, isSessionValid, loadSession, saveSession };
+//# sourceMappingURL=session-store.js.map
+//# sourceMappingURL=session-store.js.map

package/dist/lib/session-store.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/paths.ts","../../src/lib/validation.ts","../../src/lib/config.ts","../../src/lib/session-store.ts"],"names":["fs"],"mappings":";;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,SAAA,EAAgB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AAC5C,CAAA;;;ACXO,SAAS,eAAe,KAAA,EAAwB;AACrD,EAAA,OAAO,qBAAA,CAAsB,KAAK,KAAK,CAAA;AACzC;;;ACGO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAGA,cAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAGA,GAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;;;ACSA,IAAM,cAAA,GAAiB,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,GAAA;AAEtC,SAAS,oBAAoB,OAAA,EAAyC;AACpE,EAAA,IAAI,CAAC,OAAA,IAAW,OAAO,OAAA,KAAY,UAAU,OAAO,KAAA;AACpD,EAAA,MAAM,CAAA,GAAI,OAAA;AACV,EAAA,OACE,OAAO,EAAE,OAAA,KAAY,QAAA,IACrB,eAAe,CAAA,CAAE,OAAO,KACxB,OAAO,CAAA,CAAE,YAAY,QAAA,IACrB,MAAA,CAAO,UAAU,CAAA,CAAE,OAAO,KAC1B,CAAA,CAAE,OAAA,GAAU,KACZ,OAAO,CAAA,CAAE,gBAAgB,QAAA,IACzB,CAAC,OAAO,KAAA,CAAM,IAAA,CAAK,MAAM,CAAA,CAAE,WAAW,CAAC,CAAA,IACvC,OAAO,EAAE,SAAA,KAAc,QAAA,IACvB,CAAC,MAAA,CAAO,KAAA,CAAM,KAAK,KAAA,CAAM,CAAA,CAAE,SAAS,CAAC,CAAA;AAEzC;AAEO,SAAS,WAAA,GAAiC;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,OAAO,GAAG,OAAO,IAAA;AAC1C,IAAA,MAAM,GAAA,GAAS,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,OAAA,EAAS,OAAO,CAAA;AAClD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,IAAI,CAAC,mBAAA,CAAoB,MAAM,CAAA,EAAG;AAChC,MAAA,YAAA,EAAa;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,IAAI,CAAC,cAAA,CAAe,MAAM,CAAA,EAAG;AAC3B,MAAA,YAAA,EAAa;AACb,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEO,SAAS,YAAY,OAAA,EAA2B;AACrD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,GAAA,CAAA,aAAA,CAAc,MAAM,OAAA,EAAS,IAAA,CAAK,UAAU,OAAA,EAAS,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACvE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,YAAA,GAAqB;AACnC,EAAA,IAAI;AACF,IAAA,IAAO,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,OAAO,CAAA,EAAG;AAChC,MAAG,GAAA,CAAA,UAAA,CAAW,MAAM,OAAO,CAAA;AAAA,IAC7B;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEO,SAAS,eAAe,OAAA,EAA8B;AAC3D,EAAA,OAAO,IAAI,KAAK,OAAA,CAAQ,SAAS,EAAE,OAAA,EAAQ,GAAI,KAAK,GAAA,EAAI;AAC1D;AAEO,SAAS,aAAA,CAAc,SAAiB,OAAA,EAA6B;AAC1E,EAAA,MAAM,GAAA,uBAAU,IAAA,EAAK;AACrB,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,OAAA;AAAA,IACA,WAAA,EAAa,IAAI,WAAA,EAAY;AAAA,IAC7B,SAAA,EAAW,IAAI,IAAA,CAAK,GAAA,CAAI,SAAQ,GAAI,cAAc,EAAE,WAAA;AAAY,GAClE;AACF","file":"session-store.js","sourcesContent":["import * as path from \"node:path\";\nimport * as os from \"node:os\";\n\nconst JAW_DIR = path.join(os.homedir(), \".jaw\");\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, \"config.json\"),\n  session: path.join(JAW_DIR, \"session.json\"),\n  bridge: path.join(JAW_DIR, \"bridge.json\"),\n  daemonLog: path.join(JAW_DIR, \"daemon.log\"),\n} as const;\n","export function isValidAddress(value: string): boolean {\n  return /^0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nexport function isValidHex(value: string): boolean {\n  return /^0x[0-9a-fA-F]*$/.test(value);\n}\n\nexport function isValidChainId(value: string | number): boolean {\n  const num = typeof value === \"string\" ? parseInt(value, 10) : value;\n  return Number.isInteger(num) && num > 0;\n}\n\nexport function parseChainId(value: string): number {\n  const num = parseInt(value, 10);\n  if (!isValidChainId(num)) {\n    throw new Error(`Invalid chain ID: ${value}`);\n  }\n  return num;\n}\n\nexport function assertAddress(value: string, label = \"address\"): `0x${string}` {\n  if (!isValidAddress(value)) {\n    throw new Error(`Invalid ${label}: ${value}`);\n  }\n  return value as `0x${string}`;\n}\n\nexport function parseWei(raw: string, label = \"value\"): bigint {\n  try {\n    return BigInt(raw);\n  } catch {\n    throw new Error(`Invalid ${label}: \"${raw}\" is not a valid wei amount`);\n  }\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith(\".jaw.id\") ||\n      parsed.hostname === \"jaw.id\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isSecure =\n      parsed.protocol === \"https:\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from \"node:fs\";\nimport { PATHS } from \"./paths.js\";\nimport type { JawConfig } from \"./types.js\";\nimport { isValidKeysUrl } from \"./validation.js\";\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, \"utf-8\");\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`,\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(\n  key: keyof JawConfig,\n): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(\n  key: keyof JawConfig,\n  value: string | number,\n): void {\n  if (\n    key === \"keysUrl\" &&\n    typeof value === \"string\" &&\n    !isValidKeysUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`,\n    );\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","/**\n * Persists CLI session state to ~/.jaw/session.json\n * Avoids re-authenticating on every CLI invocation.\n */\n\nimport * as fs from \"node:fs\";\nimport { PATHS } from \"./paths.js\";\nimport { ensureDir } from \"./config.js\";\nimport { isValidAddress } from \"./validation.js\";\n\nexport interface CLISession {\n  readonly address: string;\n  readonly chainId: number;\n  readonly connectedAt: string;\n  readonly expiresAt: string;\n}\n\nconst SESSION_TTL_MS = 24 * 60 * 60 * 1000; // 24 hours\n\nfunction isValidSessionShape(session: unknown): session is CLISession {\n  if (!session || typeof session !== \"object\") return false;\n  const s = session as Record<string, unknown>;\n  return (\n    typeof s.address === \"string\" &&\n    isValidAddress(s.address) &&\n    typeof s.chainId === \"number\" &&\n    Number.isInteger(s.chainId) &&\n    s.chainId > 0 &&\n    typeof s.connectedAt === \"string\" &&\n    !Number.isNaN(Date.parse(s.connectedAt)) &&\n    typeof s.expiresAt === \"string\" &&\n    !Number.isNaN(Date.parse(s.expiresAt))\n  );\n}\n\nexport function loadSession(): CLISession | null {\n  try {\n    if (!fs.existsSync(PATHS.session)) return null;\n    const raw = fs.readFileSync(PATHS.session, \"utf-8\");\n    const parsed = JSON.parse(raw) as unknown;\n    if (!isValidSessionShape(parsed)) {\n      clearSession();\n      return null;\n    }\n    if (!isSessionValid(parsed)) {\n      clearSession();\n      return null;\n    }\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nexport function saveSession(session: CLISession): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.session, JSON.stringify(session, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nexport function clearSession(): void {\n  try {\n    if (fs.existsSync(PATHS.session)) {\n      fs.unlinkSync(PATHS.session);\n    }\n  } catch {\n    // ignore\n  }\n}\n\nexport function isSessionValid(session: CLISession): boolean {\n  return new Date(session.expiresAt).getTime() > Date.now();\n}\n\nexport function createSession(address: string, chainId: number): CLISession {\n  const now = new Date();\n  return {\n    address,\n    chainId,\n    connectedAt: now.toISOString(),\n    expiresAt: new Date(now.getTime() + SESSION_TTL_MS).toISOString(),\n  };\n}\n"]}

package/dist/lib/types.js

@@ -0,0 +1,3 @@
+
+//# sourceMappingURL=types.js.map
+//# sourceMappingURL=types.js.map

package/dist/lib/types.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"names":[],"mappings":"","file":"types.js"}

package/dist/lib/validation.js

@@ -0,0 +1,45 @@
+// src/lib/validation.ts
+function isValidAddress(value) {
+  return /^0x[0-9a-fA-F]{40}$/.test(value);
+}
+function isValidHex(value) {
+  return /^0x[0-9a-fA-F]*$/.test(value);
+}
+function isValidChainId(value) {
+  const num = typeof value === "string" ? parseInt(value, 10) : value;
+  return Number.isInteger(num) && num > 0;
+}
+function parseChainId(value) {
+  const num = parseInt(value, 10);
+  if (!isValidChainId(num)) {
+    throw new Error(`Invalid chain ID: ${value}`);
+  }
+  return num;
+}
+function assertAddress(value, label = "address") {
+  if (!isValidAddress(value)) {
+    throw new Error(`Invalid ${label}: ${value}`);
+  }
+  return value;
+}
+function parseWei(raw, label = "value") {
+  try {
+    return BigInt(raw);
+  } catch {
+    throw new Error(`Invalid ${label}: "${raw}" is not a valid wei amount`);
+  }
+}
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+
+export { assertAddress, isValidAddress, isValidChainId, isValidHex, isValidKeysUrl, parseChainId, parseWei };
+//# sourceMappingURL=validation.js.map
+//# sourceMappingURL=validation.js.map

package/dist/lib/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/validation.ts"],"names":[],"mappings":";AAAO,SAAS,eAAe,KAAA,EAAwB;AACrD,EAAA,OAAO,qBAAA,CAAsB,KAAK,KAAK,CAAA;AACzC;AAEO,SAAS,WAAW,KAAA,EAAwB;AACjD,EAAA,OAAO,kBAAA,CAAmB,KAAK,KAAK,CAAA;AACtC;AAEO,SAAS,eAAe,KAAA,EAAiC;AAC9D,EAAA,MAAM,MAAM,OAAO,KAAA,KAAU,WAAW,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA,GAAI,KAAA;AAC9D,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,GAAG,CAAA,IAAK,GAAA,GAAM,CAAA;AACxC;AAEO,SAAS,aAAa,KAAA,EAAuB;AAClD,EAAA,MAAM,GAAA,GAAM,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA;AAC9B,EAAA,IAAI,CAAC,cAAA,CAAe,GAAG,CAAA,EAAG;AACxB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,aAAA,CAAc,KAAA,EAAe,KAAA,GAAQ,SAAA,EAA0B;AAC7E,EAAA,IAAI,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC1B,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,KAAK,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,QAAA,CAAS,GAAA,EAAa,KAAA,GAAQ,OAAA,EAAiB;AAC7D,EAAA,IAAI;AACF,IAAA,OAAO,OAAO,GAAG,CAAA;AAAA,EACnB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,KAAK,CAAA,GAAA,EAAM,GAAG,CAAA,2BAAA,CAA6B,CAAA;AAAA,EACxE;AACF;AAEO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,QAAA,KAAa,QAAA,IACpB,OAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF","file":"validation.js","sourcesContent":["export function isValidAddress(value: string): boolean {\n  return /^0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nexport function isValidHex(value: string): boolean {\n  return /^0x[0-9a-fA-F]*$/.test(value);\n}\n\nexport function isValidChainId(value: string | number): boolean {\n  const num = typeof value === \"string\" ? parseInt(value, 10) : value;\n  return Number.isInteger(num) && num > 0;\n}\n\nexport function parseChainId(value: string): number {\n  const num = parseInt(value, 10);\n  if (!isValidChainId(num)) {\n    throw new Error(`Invalid chain ID: ${value}`);\n  }\n  return num;\n}\n\nexport function assertAddress(value: string, label = \"address\"): `0x${string}` {\n  if (!isValidAddress(value)) {\n    throw new Error(`Invalid ${label}: ${value}`);\n  }\n  return value as `0x${string}`;\n}\n\nexport function parseWei(raw: string, label = \"value\"): bigint {\n  try {\n    return BigInt(raw);\n  } catch {\n    throw new Error(`Invalid ${label}: \"${raw}\" is not a valid wei amount`);\n  }\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith(\".jaw.id\") ||\n      parsed.hostname === \"jaw.id\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isSecure =\n      parsed.protocol === \"https:\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n"]}

package/dist/lib/ws-bridge.js

@@ -0,0 +1,141 @@
+import * as crypto from 'crypto';
+import WebSocket from 'ws';
+
+// src/lib/ws-bridge.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var WSBridge = class {
+  port;
+  token;
+  timeout;
+  ws = null;
+  constructor(options) {
+    this.port = options.port;
+    this.token = options.token;
+    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+  }
+  /**
+   * Connect to the daemon's WebSocket server.
+   */
+  async connect() {
+    return new Promise((resolve, reject) => {
+      const url = `ws://127.0.0.1:${this.port}?token=${encodeURIComponent(this.token)}&role=cli`;
+      const ws = new WebSocket(url);
+      const timer = setTimeout(() => {
+        ws.close();
+        reject(
+          new Error(
+            "Browser SDK did not connect in time.\nIf the browser tab failed to open, run `jaw disconnect` then try again."
+          )
+        );
+      }, 3e4);
+      ws.on("open", () => {
+        clearTimeout(timer);
+        this.ws = ws;
+      });
+      ws.on("message", (data) => {
+        let msg;
+        try {
+          msg = JSON.parse(data.toString());
+        } catch {
+          return;
+        }
+        if (msg.type === "status" && msg.browserConnected) {
+          clearTimeout(timer);
+          resolve();
+        } else if (msg.type === "browser_connected") {
+          clearTimeout(timer);
+          resolve();
+        }
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+      ws.on("close", () => {
+        clearTimeout(timer);
+      });
+    });
+  }
+  /**
+   * Send an RPC request through the daemon to the browser SDK.
+   */
+  async request(method, params) {
+    const ws = this.ws;
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      throw new Error("Not connected to bridge daemon");
+    }
+    const id = crypto.randomUUID();
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new Error(
+            `Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`
+          )
+        );
+        this.close();
+      }, this.timeout);
+      const onMessage = (data) => {
+        let msg;
+        try {
+          msg = JSON.parse(data.toString());
+        } catch {
+          return;
+        }
+        if (msg.type === "rpc_response" && msg.id === id) {
+          clearTimeout(timer);
+          ws.off("message", onMessage);
+          if (msg.success) {
+            resolve(msg.data);
+          } else {
+            const err = msg.error;
+            reject(
+              new Error(
+                err ? `[${err.code}] ${err.message}` : "Request failed"
+              )
+            );
+          }
+        }
+      };
+      ws.on("message", onMessage);
+      ws.send(
+        JSON.stringify({
+          id,
+          type: "rpc_request",
+          method,
+          params
+        })
+      );
+    });
+  }
+  /**
+   * Check if the WebSocket connection is open.
+   */
+  isOpen() {
+    return this.ws?.readyState === WebSocket.OPEN;
+  }
+  /**
+   * Send a shutdown signal to the daemon.
+   */
+  shutdown() {
+    if (this.ws?.readyState === WebSocket.OPEN) {
+      this.ws.send(JSON.stringify({ type: "shutdown" }));
+    }
+    this.close();
+  }
+  /**
+   * Close the client connection (daemon stays alive).
+   */
+  close() {
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+};
+
+export { WSBridge };
+//# sourceMappingURL=ws-bridge.js.map
+//# sourceMappingURL=ws-bridge.js.map

package/dist/lib/ws-bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/ws-bridge.ts"],"names":[],"mappings":";;;;AAiBA,IAAM,kBAAA,GAAqB,IAAA;AAEpB,IAAM,WAAN,MAAe;AAAA,EACH,IAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACT,EAAA,GAAuB,IAAA;AAAA,EAE/B,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAAyB;AAC7B,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,kBAAkB,IAAA,CAAK,IAAI,UAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAC,CAAA,SAAA,CAAA;AAC/E,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF;AAAA;AAEF,SACF;AAAA,MACF,GAAG,GAAM,CAAA;AAET,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,QAAA,IAAI,GAAA;AACJ,QAAA,IAAI;AACF,UAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AACN,UAAA;AAAA,QACF;AAKA,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,QAAA,IAAY,GAAA,CAAI,gBAAA,EAAkB;AACjD,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,EAAQ;AAAA,QACV,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAAA,MACpB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA;AAAA;AAEhD,SACF;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,CAAC,IAAA,KAAyB;AAC1C,QAAA,IAAI,GAAA;AACJ,QAAA,IAAI;AACF,UAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AACN,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,GAAA,CAAI,OAAO,EAAA,EAAI;AAChD,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,UAAA,IAAI,IAAI,OAAA,EAAS;AACf,YAAA,OAAA,CAAQ,IAAI,IAAI,CAAA;AAAA,UAClB,CAAA,MAAO;AACL,YAAA,MAAM,MAAM,GAAA,CAAI,KAAA;AAGhB,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK;AAAA;AACzC,aACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAE1B,MAAA,EAAA,CAAG,IAAA;AAAA,QACD,KAAK,SAAA,CAAU;AAAA,UACb,EAAA;AAAA,UACA,IAAA,EAAM,aAAA;AAAA,UACN,MAAA;AAAA,UACA;AAAA,SACD;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA,GAAiB;AACf,IAAA,IAAI,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC1C,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnD;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AACF","file":"ws-bridge.js","sourcesContent":["/**\n * WSBridge — CLI-side client\n *\n * Lightweight WebSocket client that connects to the background daemon.\n * Each CLI command creates a WSBridge, sends one request, and exits.\n * The daemon (and browser SDK) stay alive across commands.\n */\n\nimport * as crypto from \"node:crypto\";\nimport WebSocket from \"ws\";\n\nexport interface WSBridgeOptions {\n  port: number;\n  token: string;\n  timeout?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\nexport class WSBridge {\n  private readonly port: number;\n  private readonly token: string;\n  private readonly timeout: number;\n  private ws: WebSocket | null = null;\n\n  constructor(options: WSBridgeOptions) {\n    this.port = options.port;\n    this.token = options.token;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  }\n\n  /**\n   * Connect to the daemon's WebSocket server.\n   */\n  async connect(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `ws://127.0.0.1:${this.port}?token=${encodeURIComponent(this.token)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(\n          new Error(\n            \"Browser SDK did not connect in time.\\n\" +\n              \"If the browser tab failed to open, run `jaw disconnect` then try again.\",\n          ),\n        );\n      }, 30_000);\n\n      ws.on(\"open\", () => {\n        clearTimeout(timer);\n        this.ws = ws;\n      });\n\n      ws.on(\"message\", (data) => {\n        let msg: Record<string, unknown>;\n        try {\n          msg = JSON.parse(data.toString()) as Record<string, unknown>;\n        } catch {\n          return;\n        }\n        // Wait for the status message confirming daemon is ready.\n        // If browser isn't connected yet, stay connected and wait for\n        // a \"browser_connected\" event (the daemon notifies CLI clients\n        // when the browser joins).\n        if (msg.type === \"status\" && msg.browserConnected) {\n          clearTimeout(timer);\n          resolve();\n        } else if (msg.type === \"browser_connected\") {\n          clearTimeout(timer);\n          resolve();\n        }\n      });\n\n      ws.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on(\"close\", () => {\n        clearTimeout(timer);\n      });\n    });\n  }\n\n  /**\n   * Send an RPC request through the daemon to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error(\"Not connected to bridge daemon\");\n    }\n\n    const id = crypto.randomUUID();\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(\n            `Request timed out after ${this.timeout / 1000}s. ` +\n              \"Did you complete the action in the browser?\",\n          ),\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = (data: WebSocket.Data) => {\n        let msg: Record<string, unknown>;\n        try {\n          msg = JSON.parse(data.toString()) as Record<string, unknown>;\n        } catch {\n          return;\n        }\n\n        if (msg.type === \"rpc_response\" && msg.id === id) {\n          clearTimeout(timer);\n          ws.off(\"message\", onMessage);\n\n          if (msg.success) {\n            resolve(msg.data);\n          } else {\n            const err = msg.error as\n              | { code: number; message: string }\n              | undefined;\n            reject(\n              new Error(\n                err ? `[${err.code}] ${err.message}` : \"Request failed\",\n              ),\n            );\n          }\n        }\n      };\n\n      ws.on(\"message\", onMessage);\n\n      ws.send(\n        JSON.stringify({\n          id,\n          type: \"rpc_request\",\n          method,\n          params,\n        }),\n      );\n    });\n  }\n\n  /**\n   * Check if the WebSocket connection is open.\n   */\n  isOpen(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  /**\n   * Send a shutdown signal to the daemon.\n   */\n  shutdown(): void {\n    if (this.ws?.readyState === WebSocket.OPEN) {\n      this.ws.send(JSON.stringify({ type: \"shutdown\" }));\n    }\n    this.close();\n  }\n\n  /**\n   * Close the client connection (daemon stays alive).\n   */\n  close(): void {\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n}\n"]}

package/dist/lib/ws-daemon.js

@@ -0,0 +1,344 @@
+#!/usr/bin/env node
+import * as crypto from 'crypto';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import { WebSocketServer, WebSocket } from 'ws';
+
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var BRIDGE_PATH = path.join(JAW_DIR, "bridge.json");
+var HEARTBEAT_INTERVAL_MS = 3e4;
+var IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var MAX_PENDING_REQUESTS = 100;
+var MAX_CLI_CLIENTS = 50;
+var RATE_LIMIT_WINDOW_MS = 6e4;
+var RATE_LIMIT_MAX_REQUESTS = 60;
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+var args = JSON.parse(process.argv[2] ?? "{}");
+if (!isValidKeysUrl(args.keysUrl)) {
+  process.stderr.write(
+    `Untrusted keysUrl: ${args.keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.
+`
+  );
+  process.exit(1);
+}
+var apiKey = process.env.JAW_DAEMON_API_KEY ?? "";
+delete process.env.JAW_DAEMON_API_KEY;
+var token = crypto.randomUUID();
+var timeout = args.timeout ?? 12e4;
+var pendingRequests = /* @__PURE__ */ new Map();
+var browserWs = null;
+var browserReady = false;
+var idleTimer = null;
+var heartbeat = null;
+var lastBrowserOpenTime = 0;
+var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
+var serverPort = null;
+var cliClients = /* @__PURE__ */ new Set();
+var rateLimits = /* @__PURE__ */ new WeakMap();
+function isRateLimited(ws) {
+  const now = Date.now();
+  let entry = rateLimits.get(ws);
+  if (!entry) {
+    entry = { timestamps: [] };
+    rateLimits.set(ws, entry);
+  }
+  entry.timestamps = entry.timestamps.filter(
+    (t) => now - t < RATE_LIMIT_WINDOW_MS
+  );
+  if (entry.timestamps.length >= RATE_LIMIT_MAX_REQUESTS) {
+    return true;
+  }
+  entry.timestamps.push(now);
+  return false;
+}
+async function reopenBrowser() {
+  if (!serverPort) return;
+  if (browserReady || browserWs?.readyState === WebSocket.OPEN) return;
+  const now = Date.now();
+  if (now - lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) return;
+  lastBrowserOpenTime = now;
+  const bridgeUrl = buildBridgeUrl(serverPort);
+  try {
+    const { default: open } = await import('open');
+    await open(bridgeUrl);
+  } catch {
+  }
+}
+function resetIdleTimer() {
+  if (idleTimer) clearTimeout(idleTimer);
+  idleTimer = setTimeout(() => {
+    cleanup();
+    process.exit(0);
+  }, IDLE_TIMEOUT_MS);
+}
+function cleanup() {
+  if (heartbeat) clearInterval(heartbeat);
+  if (browserWs?.readyState === WebSocket.OPEN) {
+    browserWs.send(JSON.stringify({ type: "shutdown" }));
+  }
+  try {
+    if (fs.existsSync(BRIDGE_PATH)) fs.unlinkSync(BRIDGE_PATH);
+  } catch {
+  }
+}
+process.on("SIGTERM", () => {
+  cleanup();
+  process.exit(0);
+});
+process.on("SIGINT", () => {
+  cleanup();
+  process.exit(0);
+});
+process.on("exit", cleanup);
+var MAX_PAYLOAD_BYTES = 1048576;
+var wss = new WebSocketServer({
+  host: "127.0.0.1",
+  port: 0,
+  maxPayload: MAX_PAYLOAD_BYTES
+});
+wss.on("listening", async () => {
+  const addr = wss.address();
+  if (typeof addr === "string" || !addr) {
+    process.exit(1);
+  }
+  const port = addr.port;
+  serverPort = port;
+  fs.mkdirSync(JAW_DIR, { recursive: true, mode: 448 });
+  const info = {
+    port,
+    token,
+    pid: process.pid,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  fs.writeFileSync(BRIDGE_PATH, JSON.stringify(info, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+  lastBrowserOpenTime = Date.now();
+  const bridgeUrl = buildBridgeUrl(port);
+  const { default: open } = await import('open');
+  await open(bridgeUrl);
+  resetIdleTimer();
+});
+wss.on("connection", (ws, req) => {
+  const url = new URL(req.url ?? "", "http://127.0.0.1");
+  const urlToken = url.searchParams.get("token");
+  const role = url.searchParams.get("role");
+  if (urlToken !== token) {
+    ws.close(4001, "Invalid token");
+    return;
+  }
+  if (role === "browser") {
+    handleBrowserConnection(ws);
+  } else {
+    handleCliConnection(ws);
+  }
+});
+function handleBrowserConnection(ws) {
+  if (browserWs) {
+    browserWs.close(4e3, "Replaced by new browser connection");
+  }
+  browserWs = ws;
+  browserReady = false;
+  ws.send(
+    JSON.stringify({
+      type: "init",
+      apiKey,
+      chainId: args.chainId,
+      ens: args.ens,
+      paymasterUrl: args.paymasterUrl
+    })
+  );
+  ws.on("message", (data) => {
+    let msg;
+    try {
+      msg = JSON.parse(data.toString());
+    } catch {
+      return;
+    }
+    switch (msg.type) {
+      case "ready":
+        browserReady = true;
+        if (heartbeat) clearInterval(heartbeat);
+        heartbeat = setInterval(() => {
+          if (browserWs?.readyState === WebSocket.OPEN) {
+            browserWs.send(JSON.stringify({ type: "ping" }));
+          }
+        }, HEARTBEAT_INTERVAL_MS);
+        for (const cli of cliClients) {
+          if (cli.readyState === WebSocket.OPEN) {
+            cli.send(JSON.stringify({ type: "browser_connected" }));
+          }
+        }
+        break;
+      case "rpc_response": {
+        const id = msg.id;
+        const pending = pendingRequests.get(id);
+        if (!pending) return;
+        clearTimeout(pending.timer);
+        pendingRequests.delete(id);
+        if (pending.clientWs.readyState === WebSocket.OPEN) {
+          pending.clientWs.send(
+            JSON.stringify({
+              id: pending.clientId,
+              type: "rpc_response",
+              success: msg.success,
+              data: msg.data,
+              error: msg.error,
+              address: msg.address
+            })
+          );
+        }
+        break;
+      }
+    }
+  });
+  ws.on("close", () => {
+    if (browserWs === ws) {
+      browserReady = false;
+      browserWs = null;
+      for (const [, pending] of pendingRequests) {
+        clearTimeout(pending.timer);
+        if (pending.clientWs.readyState === WebSocket.OPEN) {
+          pending.clientWs.send(
+            JSON.stringify({
+              id: pending.clientId,
+              type: "rpc_response",
+              success: false,
+              error: {
+                code: -32001,
+                message: "Browser tab was closed. Reopening \u2014 please retry in a few seconds."
+              }
+            })
+          );
+        }
+      }
+      pendingRequests.clear();
+    }
+  });
+}
+function handleCliConnection(ws) {
+  if (cliClients.size >= MAX_CLI_CLIENTS) {
+    ws.close(4002, "Too many CLI connections");
+    return;
+  }
+  resetIdleTimer();
+  cliClients.add(ws);
+  ws.send(
+    JSON.stringify({
+      type: "status",
+      browserConnected: browserReady
+    })
+  );
+  if (!browserReady) {
+    reopenBrowser();
+  }
+  ws.on("close", () => {
+    cliClients.delete(ws);
+  });
+  ws.on("message", (data) => {
+    let msg;
+    try {
+      msg = JSON.parse(data.toString());
+    } catch {
+      return;
+    }
+    if (msg.type === "rpc_request") {
+      resetIdleTimer();
+      handleCliRpcRequest(ws, msg);
+    } else if (msg.type === "shutdown") {
+      cleanup();
+      process.exit(0);
+    }
+  });
+}
+function handleCliRpcRequest(clientWs, msg) {
+  const clientId = msg.id;
+  if (isRateLimited(clientWs)) {
+    clientWs.send(
+      JSON.stringify({
+        id: clientId,
+        type: "rpc_response",
+        success: false,
+        error: {
+          code: -32005,
+          message: "Rate limited. Too many requests \u2014 try again shortly."
+        }
+      })
+    );
+    return;
+  }
+  if (pendingRequests.size >= MAX_PENDING_REQUESTS) {
+    clientWs.send(
+      JSON.stringify({
+        id: clientId,
+        type: "rpc_response",
+        success: false,
+        error: {
+          code: -32006,
+          message: "Too many pending requests. Wait for current requests to complete."
+        }
+      })
+    );
+    return;
+  }
+  if (!browserReady || !browserWs || browserWs.readyState !== WebSocket.OPEN) {
+    reopenBrowser();
+    clientWs.send(
+      JSON.stringify({
+        id: clientId,
+        type: "rpc_response",
+        success: false,
+        error: {
+          code: -32001,
+          message: "Browser tab was closed. Reopening \u2014 please retry in a few seconds."
+        }
+      })
+    );
+    return;
+  }
+  const daemonId = crypto.randomUUID();
+  const timer = setTimeout(() => {
+    pendingRequests.delete(daemonId);
+    if (clientWs.readyState === WebSocket.OPEN) {
+      clientWs.send(
+        JSON.stringify({
+          id: clientId,
+          type: "rpc_response",
+          success: false,
+          error: {
+            code: -32e3,
+            message: `Request timed out after ${timeout / 1e3}s`
+          }
+        })
+      );
+    }
+  }, timeout);
+  pendingRequests.set(daemonId, { clientWs, clientId, timer });
+  browserWs.send(
+    JSON.stringify({
+      id: daemonId,
+      type: "rpc_request",
+      method: msg.method,
+      params: msg.params
+    })
+  );
+}
+function buildBridgeUrl(port) {
+  const url = new URL("/cli-bridge", args.keysUrl);
+  url.searchParams.set("wsPort", String(port));
+  url.hash = `token=${encodeURIComponent(token)}`;
+  return url.toString();
+}
+//# sourceMappingURL=ws-daemon.js.map
+//# sourceMappingURL=ws-daemon.js.map