@jaw.id/cli 0.0.3 → 0.0.7

package/dist/lib/ws-bridge.js

@@ -1,50 +1,203 @@
 import * as crypto from 'crypto';
 import WebSocket from 'ws';
 
+// src/lib/ws-bridge.ts
+
+// src/lib/crypto.ts
+var subtle = globalThis.crypto.subtle;
+async function deriveSharedSecret(privateKey, peerPublicKey) {
+  return subtle.deriveKey(
+    { name: "ECDH", public: peerPublicKey },
+    privateKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptMessage(sharedSecret, payload) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const cipherBuf = await subtle.encrypt(
+    { name: "AES-GCM", iv },
+    sharedSecret,
+    plaintext
+  );
+  return {
+    iv: bufferToBase64(iv),
+    ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
+  };
+}
+async function decryptMessage(sharedSecret, envelope) {
+  const iv = Buffer.from(envelope.iv, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  const plainBuf = await subtle.decrypt(
+    { name: "AES-GCM", iv },
+    sharedSecret,
+    ciphertext
+  );
+  return JSON.parse(new TextDecoder().decode(plainBuf));
+}
+async function importKeyFromHex(type, hex) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  return subtle.importKey(
+    format,
+    Buffer.from(hexToBytes(hex)),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    type === "private" ? ["deriveKey"] : []
+  );
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new Error("Invalid hex: odd length");
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+function bufferToBase64(buf) {
+  return Buffer.from(buf).toString("base64");
+}
+
 // src/lib/ws-bridge.ts
 var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_MESSAGE_BYTES = 5 * 1024 * 1024;
+var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
+var MAX_RECONNECT_ATTEMPTS = 3;
+var RECONNECT_BASE_DELAY_MS = 1e3;
 var WSBridge = class {
-  port;
-  token;
+  relayUrl;
+  session;
   timeout;
+  config;
+  privateKeyHex;
+  publicKeyHex;
+  peerPublicKeyHex;
+  sharedSecret = null;
   ws = null;
+  disposed = false;
+  // Auto-reopen browser state
+  onBrowserNeeded;
+  onPeerKeyChanged;
+  lastBrowserOpenTime = 0;
+  // Reconnection state
+  reconnectAttempts = 0;
+  /** Updated after key exchange — caller should persist this. */
+  get peerPublicKey() {
+    return this.peerPublicKeyHex;
+  }
   constructor(options) {
-    this.port = options.port;
-    this.token = options.token;
+    this.relayUrl = options.relayUrl;
+    this.session = options.session;
     this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    this.config = options.config;
+    this.privateKeyHex = options.privateKeyHex;
+    this.publicKeyHex = options.publicKeyHex;
+    this.peerPublicKeyHex = options.peerPublicKeyHex;
   }
   /**
-   * Connect to the daemon's WebSocket server.
+   * Connect to the relay and wait for the browser to be ready.
+   *
+   * @param onBrowserNeeded — called when the relay reports no browser connected.
+   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.
    */
-  async connect() {
+  async connect(onBrowserNeeded, onPeerKeyChanged) {
+    this.onBrowserNeeded = onBrowserNeeded;
+    this.onPeerKeyChanged = onPeerKeyChanged;
+    if (this.peerPublicKeyHex) {
+      await this.deriveSecret();
+    }
+    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);
+  }
+  async connectInternal(onBrowserNeeded, onPeerKeyChanged) {
     return new Promise((resolve, reject) => {
-      const url = `ws://127.0.0.1:${this.port}?token=${encodeURIComponent(this.token)}&role=cli`;
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
       const ws = new WebSocket(url);
+      let browserOpened = false;
+      let resolved = false;
+      let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
         reject(
           new Error(
-            "Browser SDK did not connect in time.\nIf the browser tab failed to open, run `jaw disconnect` then try again."
+            "Browser did not connect in time.\nRun `jaw disconnect` then try again."
           )
         );
       }, 3e4);
-      ws.on("open", () => {
+      const sendEncryptedInit = async () => {
+        if (!this.sharedSecret) return;
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "init",
+          apiKey: this.config.apiKey,
+          chainId: this.config.chainId,
+          ens: this.config.ens,
+          paymasterUrl: this.config.paymasterUrl
+        });
+        this.sendRaw(ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      };
+      const waitForReady = () => {
+        const readyTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("Browser SDK did not become ready in time."));
+        }, 15e3);
+        const onMsg = async (data) => {
+          const msg = safeParse(data);
+          if (!msg) return;
+          if (msg.type === "encrypted" && this.sharedSecret) {
+            try {
+              const inner = await decryptMessage(
+                this.sharedSecret,
+                msg
+              );
+              if (inner.type === "ready") {
+                clearTimeout(readyTimer);
+                ws.off("message", onMsg);
+                this.reconnectAttempts = 0;
+                resolve();
+              }
+            } catch {
+            }
+          }
+        };
+        ws.on("message", onMsg);
+      };
+      const onBrowserReady = async () => {
+        if (resolved) return;
+        resolved = true;
         clearTimeout(timer);
+        waitForReady();
+        await sendEncryptedInit();
+      };
+      ws.on("open", () => {
         this.ws = ws;
       });
-      ws.on("message", (data) => {
-        let msg;
-        try {
-          msg = JSON.parse(data.toString());
-        } catch {
-          return;
-        }
-        if (msg.type === "status" && msg.browserConnected) {
-          clearTimeout(timer);
-          resolve();
+      ws.on("message", async (data) => {
+        const msg = safeParse(data);
+        if (!msg) return;
+        if (msg.type === "status") {
+          if (msg.browserConnected) {
+            if (this.sharedSecret) {
+              await onBrowserReady();
+            } else {
+              expectingKeyExchange = true;
+            }
+          } else if (!browserOpened && onBrowserNeeded) {
+            browserOpened = true;
+            expectingKeyExchange = true;
+            onBrowserNeeded().catch(() => {
+            });
+          }
         } else if (msg.type === "browser_connected") {
-          clearTimeout(timer);
-          resolve();
+          expectingKeyExchange = true;
+        } else if (msg.type === "browser_disconnected") {
+          this.handleBrowserDisconnect();
+        } else if (msg.type === "key_exchange" && expectingKeyExchange) {
+          expectingKeyExchange = false;
+          const peerKey = msg.publicKey;
+          this.peerPublicKeyHex = peerKey;
+          await this.deriveSecret();
+          onPeerKeyChanged?.(peerKey);
+          await onBrowserReady();
         }
       });
       ws.on("error", (err) => {
@@ -53,18 +206,32 @@ var WSBridge = class {
       });
       ws.on("close", () => {
         clearTimeout(timer);
+        if (!this.disposed) {
+          this.handleRelayDisconnect();
+        }
       });
     });
   }
   /**
-   * Send an RPC request through the daemon to the browser SDK.
+   * Send an encrypted RPC request through the relay to the browser SDK.
    */
   async request(method, params) {
     const ws = this.ws;
     if (!ws || ws.readyState !== WebSocket.OPEN) {
-      throw new Error("Not connected to bridge daemon");
+      throw new Error("Not connected to relay");
+    }
+    if (!this.sharedSecret) {
+      throw new Error("No shared secret \u2014 key exchange not completed");
     }
     const id = crypto.randomUUID();
+    const envelope = await encryptMessage(this.sharedSecret, {
+      type: "rpc_request",
+      id,
+      method,
+      params
+    });
+    const serialized = JSON.stringify({ type: "encrypted", ...envelope });
+    assertMessageSize(serialized, method);
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
@@ -74,58 +241,91 @@ var WSBridge = class {
         );
         this.close();
       }, this.timeout);
-      const onMessage = (data) => {
-        let msg;
+      const onMessage = async (data) => {
+        const msg = safeParse(data);
+        if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
         try {
-          msg = JSON.parse(data.toString());
-        } catch {
-          return;
-        }
-        if (msg.type === "rpc_response" && msg.id === id) {
-          clearTimeout(timer);
-          ws.off("message", onMessage);
-          if (msg.success) {
-            resolve(msg.data);
-          } else {
-            const err = msg.error;
-            reject(
-              new Error(
-                err ? `[${err.code}] ${err.message}` : "Request failed"
-              )
-            );
+          const inner = await decryptMessage(
+            this.sharedSecret,
+            msg
+          );
+          if (inner.type === "rpc_response" && inner.id === id) {
+            clearTimeout(timer);
+            ws.off("message", onMessage);
+            if (inner.success) {
+              resolve(inner.data);
+            } else {
+              const err = inner.error;
+              reject(
+                new Error(
+                  err ? `[${err.code}] ${err.message}` : "Request failed"
+                )
+              );
+            }
           }
+        } catch {
         }
       };
       ws.on("message", onMessage);
-      ws.send(
-        JSON.stringify({
-          id,
-          type: "rpc_request",
-          method,
-          params
-        })
-      );
+      this.sendRaw(ws, serialized);
     });
   }
-  /**
-   * Check if the WebSocket connection is open.
-   */
   isOpen() {
     return this.ws?.readyState === WebSocket.OPEN;
   }
-  /**
-   * Send a shutdown signal to the daemon.
-   */
-  shutdown() {
-    if (this.ws?.readyState === WebSocket.OPEN) {
-      this.ws.send(JSON.stringify({ type: "shutdown" }));
+  async shutdown() {
+    this.disposed = true;
+    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
+      try {
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "shutdown"
+        });
+        this.sendRaw(
+          this.ws,
+          JSON.stringify({ type: "encrypted", ...envelope })
+        );
+      } catch {
+      }
     }
     this.close();
   }
   /**
-   * Close the client connection (daemon stays alive).
+   * Connect to relay and send shutdown directly — no init/ready handshake.
+   * Used by `jaw disconnect` when we just need to tell the browser to close.
    */
+  async connectAndShutdown() {
+    if (!this.peerPublicKeyHex) {
+      return;
+    }
+    this.disposed = true;
+    await this.deriveSecret();
+    return new Promise((resolve) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      const timer = setTimeout(() => {
+        try {
+          ws.close();
+        } catch {
+        }
+        resolve();
+      }, 3e3);
+      ws.on("open", async () => {
+        this.ws = ws;
+        try {
+          await this.shutdown();
+        } catch {
+        }
+        clearTimeout(timer);
+        resolve();
+      });
+      ws.on("error", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  }
   close() {
+    this.disposed = true;
     if (this.ws) {
       try {
         this.ws.close();
@@ -134,7 +334,69 @@ var WSBridge = class {
       this.ws = null;
     }
   }
+  /**
+   * Auto-reopen browser when browser_disconnected is received from relay.
+   * Respects a cooldown to prevent rapid re-opening.
+   */
+  handleBrowserDisconnect() {
+    if (this.disposed || !this.onBrowserNeeded) return;
+    const now = Date.now();
+    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {
+      return;
+    }
+    this.lastBrowserOpenTime = now;
+    this.sharedSecret = null;
+    this.peerPublicKeyHex = null;
+    this.onBrowserNeeded().catch(() => {
+    });
+  }
+  /**
+   * Attempt to reconnect to the relay with exponential backoff
+   * when the WebSocket connection drops unexpectedly.
+   */
+  handleRelayDisconnect() {
+    if (this.disposed) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;
+    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);
+    this.reconnectAttempts++;
+    setTimeout(() => {
+      if (this.disposed) return;
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(
+        () => {
+        }
+      );
+    }, delay);
+  }
+  /** Send a raw string over the WebSocket, enforcing message size limits. */
+  sendRaw(ws, data) {
+    ws.send(data);
+  }
+  async deriveSecret() {
+    if (!this.peerPublicKeyHex) return;
+    const privateKey = await importKeyFromHex("private", this.privateKeyHex);
+    const peerPublicKey = await importKeyFromHex(
+      "public",
+      this.peerPublicKeyHex
+    );
+    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
+  }
 };
+function assertMessageSize(serialized, method) {
+  const byteLength = Buffer.byteLength(serialized, "utf-8");
+  if (byteLength > MAX_MESSAGE_BYTES) {
+    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);
+    throw new Error(
+      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). Try reducing the number of calls in your batch.`
+    );
+  }
+}
+function safeParse(data) {
+  try {
+    return JSON.parse(data.toString());
+  } catch {
+    return null;
+  }
+}
 
 export { WSBridge };
 //# sourceMappingURL=ws-bridge.js.map

package/dist/lib/ws-bridge.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/lib/ws-bridge.ts"],"names":[],"mappings":";;;;AAiBA,IAAM,kBAAA,GAAqB,IAAA;AAEpB,IAAM,WAAN,MAAe;AAAA,EACH,IAAA;AAAA,EACA,KAAA;AAAA,EACA,OAAA;AAAA,EACT,EAAA,GAAuB,IAAA;AAAA,EAE/B,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,OAAO,OAAA,CAAQ,IAAA;AACpB,IAAA,IAAA,CAAK,QAAQ,OAAA,CAAQ,KAAA;AACrB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAAA,EACpC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,GAAyB;AAC7B,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,kBAAkB,IAAA,CAAK,IAAI,UAAU,kBAAA,CAAmB,IAAA,CAAK,KAAK,CAAC,CAAA,SAAA,CAAA;AAC/E,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF;AAAA;AAEF,SACF;AAAA,MACF,GAAG,GAAM,CAAA;AAET,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,CAAC,IAAA,KAAS;AACzB,QAAA,IAAI,GAAA;AACJ,QAAA,IAAI;AACF,UAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AACN,UAAA;AAAA,QACF;AAKA,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,QAAA,IAAY,GAAA,CAAI,gBAAA,EAAkB;AACjD,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,EAAQ;AAAA,QACV,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,OAAA,EAAQ;AAAA,QACV;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAAA,MACpB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,gCAAgC,CAAA;AAAA,IAClD;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA;AAAA;AAEhD,SACF;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,CAAC,IAAA,KAAyB;AAC1C,QAAA,IAAI,GAAA;AACJ,QAAA,IAAI;AACF,UAAA,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AACN,UAAA;AAAA,QACF;AAEA,QAAA,IAAI,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,GAAA,CAAI,OAAO,EAAA,EAAI;AAChD,UAAA,YAAA,CAAa,KAAK,CAAA;AAClB,UAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,UAAA,IAAI,IAAI,OAAA,EAAS;AACf,YAAA,OAAA,CAAQ,IAAI,IAAI,CAAA;AAAA,UAClB,CAAA,MAAO;AACL,YAAA,MAAM,MAAM,GAAA,CAAI,KAAA;AAGhB,YAAA,MAAA;AAAA,cACE,IAAI,KAAA;AAAA,gBACF,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK;AAAA;AACzC,aACF;AAAA,UACF;AAAA,QACF;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAE1B,MAAA,EAAA,CAAG,IAAA;AAAA,QACD,KAAK,SAAA,CAAU;AAAA,UACb,EAAA;AAAA,UACA,IAAA,EAAM,aAAA;AAAA,UACN,MAAA;AAAA,UACA;AAAA,SACD;AAAA,OACH;AAAA,IACF,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA;AAAA;AAAA;AAAA,EAKA,QAAA,GAAiB;AACf,IAAA,IAAI,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,EAAM;AAC1C,MAAA,IAAA,CAAK,EAAA,CAAG,KAAK,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,UAAA,EAAY,CAAC,CAAA;AAAA,IACnD;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA,EAKA,KAAA,GAAc;AACZ,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AACF","file":"ws-bridge.js","sourcesContent":["/**\n * WSBridge — CLI-side client\n *\n * Lightweight WebSocket client that connects to the background daemon.\n * Each CLI command creates a WSBridge, sends one request, and exits.\n * The daemon (and browser SDK) stay alive across commands.\n */\n\nimport * as crypto from \"node:crypto\";\nimport WebSocket from \"ws\";\n\nexport interface WSBridgeOptions {\n  port: number;\n  token: string;\n  timeout?: number;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\nexport class WSBridge {\n  private readonly port: number;\n  private readonly token: string;\n  private readonly timeout: number;\n  private ws: WebSocket | null = null;\n\n  constructor(options: WSBridgeOptions) {\n    this.port = options.port;\n    this.token = options.token;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n  }\n\n  /**\n   * Connect to the daemon's WebSocket server.\n   */\n  async connect(): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `ws://127.0.0.1:${this.port}?token=${encodeURIComponent(this.token)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(\n          new Error(\n            \"Browser SDK did not connect in time.\\n\" +\n              \"If the browser tab failed to open, run `jaw disconnect` then try again.\",\n          ),\n        );\n      }, 30_000);\n\n      ws.on(\"open\", () => {\n        clearTimeout(timer);\n        this.ws = ws;\n      });\n\n      ws.on(\"message\", (data) => {\n        let msg: Record<string, unknown>;\n        try {\n          msg = JSON.parse(data.toString()) as Record<string, unknown>;\n        } catch {\n          return;\n        }\n        // Wait for the status message confirming daemon is ready.\n        // If browser isn't connected yet, stay connected and wait for\n        // a \"browser_connected\" event (the daemon notifies CLI clients\n        // when the browser joins).\n        if (msg.type === \"status\" && msg.browserConnected) {\n          clearTimeout(timer);\n          resolve();\n        } else if (msg.type === \"browser_connected\") {\n          clearTimeout(timer);\n          resolve();\n        }\n      });\n\n      ws.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on(\"close\", () => {\n        clearTimeout(timer);\n      });\n    });\n  }\n\n  /**\n   * Send an RPC request through the daemon to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error(\"Not connected to bridge daemon\");\n    }\n\n    const id = crypto.randomUUID();\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(\n            `Request timed out after ${this.timeout / 1000}s. ` +\n              \"Did you complete the action in the browser?\",\n          ),\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = (data: WebSocket.Data) => {\n        let msg: Record<string, unknown>;\n        try {\n          msg = JSON.parse(data.toString()) as Record<string, unknown>;\n        } catch {\n          return;\n        }\n\n        if (msg.type === \"rpc_response\" && msg.id === id) {\n          clearTimeout(timer);\n          ws.off(\"message\", onMessage);\n\n          if (msg.success) {\n            resolve(msg.data);\n          } else {\n            const err = msg.error as\n              | { code: number; message: string }\n              | undefined;\n            reject(\n              new Error(\n                err ? `[${err.code}] ${err.message}` : \"Request failed\",\n              ),\n            );\n          }\n        }\n      };\n\n      ws.on(\"message\", onMessage);\n\n      ws.send(\n        JSON.stringify({\n          id,\n          type: \"rpc_request\",\n          method,\n          params,\n        }),\n      );\n    });\n  }\n\n  /**\n   * Check if the WebSocket connection is open.\n   */\n  isOpen(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  /**\n   * Send a shutdown signal to the daemon.\n   */\n  shutdown(): void {\n    if (this.ws?.readyState === WebSocket.OPEN) {\n      this.ws.send(JSON.stringify({ type: \"shutdown\" }));\n    }\n    this.close();\n  }\n\n  /**\n   * Close the client connection (daemon stays alive).\n   */\n  close(): void {\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../../src/lib/crypto.ts","../../src/lib/ws-bridge.ts"],"names":[],"mappings":";;;;;;AAaA,IAAM,MAAA,GAAS,WAAW,MAAA,CAAO,MAAA;AAYjC,eAAsB,kBAAA,CACpB,YACA,aAAA,EACe;AACf,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,aAAA,EAAc;AAAA,IACtC,UAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AASA,eAAsB,cAAA,CACpB,cACA,OAAA,EAC4B;AAC5B,EAAA,MAAM,KAAK,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,OAAA;AAAA,IAC7B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG;AAAA,IACtB,YAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAe,EAAE,CAAA;AAAA,IACrB,UAAA,EAAY,cAAA,CAAe,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GACtD;AACF;AAEA,eAAsB,cAAA,CACpB,cACA,QAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA;AAAA,IAC5B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG;AAAA,IACtB,YAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACtD;AAaA,eAAsB,gBAAA,CACpB,MACA,GAAA,EACe;AACf,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,SAAA,GAAY,OAAA,GAAU,MAAA;AAC9C,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,MAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,IAAA,KAAS,SAAA,GAAY,CAAC,WAAW,IAAI;AAAC,GACxC;AACF;AAUA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtC,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC3C;;;AChFA,IAAM,kBAAA,GAAqB,IAAA;AAU3B,IAAM,iBAAA,GAAoB,IAAI,IAAA,GAAO,IAAA;AAGrC,IAAM,0BAAA,GAA6B,GAAA;AAGnC,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,uBAAA,GAA0B,GAAA;AAEzB,IAAM,WAAN,MAAe;AAAA,EACH,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACR,YAAA;AAAA,EACD,gBAAA;AAAA,EACA,YAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAA,GAAW,KAAA;AAAA;AAAA,EAGX,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA,GAAsB,CAAA;AAAA;AAAA,EAGtB,iBAAA,GAAoB,CAAA;AAAA;AAAA,EAG5B,IAAI,aAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAClC,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,eAAA,EACA,gBAAA,EACe;AAEf,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAGxB,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAc,eAAA,CACZ,eAAA,EACA,gBAAA,EACe;AACf,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,oBAAA,GAAuB,CAAC,IAAA,CAAK,gBAAA;AAEjC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF;AAAA;AAEF,SACF;AAAA,MACF,GAAG,GAAM,CAAA;AAET,MAAA,MAAM,oBAAoB,YAAY;AACpC,QAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM,MAAA;AAAA,UACN,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,UACpB,OAAA,EAAS,KAAK,MAAA,CAAO,OAAA;AAAA,UACrB,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,UACjB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,SAC3B,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MACrE,CAAA;AAEA,MAAA,MAAM,eAAe,MAAM;AACzB,QAAA,MAAM,UAAA,GAAa,WAAW,MAAM;AAClC,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,2CAA2C,CAAC,CAAA;AAAA,QAC/D,GAAG,IAAM,CAAA;AAET,QAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,KAAyB;AAC5C,UAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,UAAA,IAAI,CAAC,GAAA,EAAK;AAEV,UAAA,IAAI,GAAA,CAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,YAAA,EAAc;AACjD,YAAA,IAAI;AACF,cAAA,MAAM,QAAQ,MAAM,cAAA;AAAA,gBAClB,IAAA,CAAK,YAAA;AAAA,gBACL;AAAA,eACF;AACA,cAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,gBAAA,YAAA,CAAa,UAAU,CAAA;AACvB,gBAAA,EAAA,CAAG,GAAA,CAAI,WAAW,KAAK,CAAA;AACvB,gBAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,CAAA;AACA,QAAA,EAAA,CAAG,EAAA,CAAG,WAAW,KAAK,CAAA;AAAA,MACxB,CAAA;AAEA,MAAA,MAAM,iBAAiB,YAAY;AACjC,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,YAAA,EAAa;AACb,QAAA,MAAM,iBAAA,EAAkB;AAAA,MAC1B,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,OAAO,IAAA,KAAS;AAC/B,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,EAAK;AAEV,QAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,UAAA,IAAI,IAAI,gBAAA,EAAkB;AACxB,YAAA,IAAI,KAAK,YAAA,EAAc;AAErB,cAAA,MAAM,cAAA,EAAe;AAAA,YACvB,CAAA,MAAO;AAEL,cAAA,oBAAA,GAAuB,IAAA;AAAA,YACzB;AAAA,UACF,CAAA,MAAA,IAAW,CAAC,aAAA,IAAiB,eAAA,EAAiB;AAC5C,YAAA,aAAA,GAAgB,IAAA;AAChB,YAAA,oBAAA,GAAuB,IAAA;AACvB,YAAA,eAAA,EAAgB,CAAE,MAAM,MAAM;AAAA,YAE9B,CAAC,CAAA;AAAA,UACH;AAAA,QACF,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,oBAAA,GAAuB,IAAA;AAAA,QAEzB,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,sBAAA,EAAwB;AAE9C,UAAA,IAAA,CAAK,uBAAA,EAAwB;AAAA,QAC/B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,oBAAA,EAAsB;AAC9D,UAAA,oBAAA,GAAuB,KAAA;AACvB,UAAA,MAAM,UAAU,GAAA,CAAI,SAAA;AACpB,UAAA,IAAA,CAAK,gBAAA,GAAmB,OAAA;AACxB,UAAA,MAAM,KAAK,YAAA,EAAa;AACxB,UAAA,gBAAA,GAAmB,OAAO,CAAA;AAC1B,UAAA,MAAM,cAAA,EAAe;AAAA,QACvB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,IAAA,CAAK,qBAAA,EAAsB;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,MAAM,oDAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,MACvD,IAAA,EAAM,aAAA;AAAA,MACN,EAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU,CAAA;AACpE,IAAA,iBAAA,CAAkB,YAAY,MAAM,CAAA;AAEpC,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA;AAAA;AAEhD,SACF;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAyB;AAChD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,SAAS,WAAA,IAAe,CAAC,KAAK,YAAA,EAAc;AAE5D,QAAA,IAAI;AACF,UAAA,MAAM,QAAQ,MAAM,cAAA;AAAA,YAClB,IAAA,CAAK,YAAA;AAAA,YACL;AAAA,WACF;AACA,UAAA,IAAI,KAAA,CAAM,IAAA,KAAS,cAAA,IAAkB,KAAA,CAAM,OAAO,EAAA,EAAI;AACpD,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,YAAA,IAAI,MAAM,OAAA,EAAS;AACjB,cAAA,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,YACpB,CAAA,MAAO;AACL,cAAA,MAAM,MAAM,KAAA,CAAM,KAAA;AAGlB,cAAA,MAAA;AAAA,gBACE,IAAI,KAAA;AAAA,kBACF,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK;AAAA;AACzC,eACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,UAAU,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,IAAQ,KAAK,YAAA,EAAc;AAC/D,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAA,CAAK,OAAA;AAAA,UACH,IAAA,CAAK,EAAA;AAAA,UACL,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU;AAAA,SACnD;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAA,GAAoC;AACxC,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,KAAK,YAAA,EAAa;AAExB,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,EAAM;AAAA,QACX,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,GAAG,GAAI,CAAA;AAEP,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,YAAY;AACxB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,QAAA,IAAI;AACF,UAAA,MAAM,KAAK,QAAA,EAAS;AAAA,QACtB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,mBAAA,GAAsB,0BAAA,EAA4B;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,GAAA;AAG3B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AAExB,IAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,KAAA,CAAM,MAAM;AAAA,IAEnC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,IAAA,CAAK,qBAAqB,sBAAA,EAAwB;AAEtD,IAAA,MAAM,QAAQ,uBAAA,GAA0B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,iBAAiB,CAAA;AAC1E,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,eAAA,EAAiB,IAAA,CAAK,gBAAgB,CAAA,CAAE,KAAA;AAAA,QAChE,MAAM;AAAA,QAEN;AAAA,OACF;AAAA,IACF,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA,EAGQ,OAAA,CAAQ,IAAe,IAAA,EAAoB;AACjD,IAAA,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EACd;AAAA,EAEA,MAAc,YAAA,GAA8B;AAC1C,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC5B,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,SAAA,EAAW,KAAK,aAAa,CAAA;AACvE,IAAA,MAAM,gBAAgB,MAAM,gBAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,MAAM,kBAAA,CAAmB,UAAA,EAAY,aAAa,CAAA;AAAA,EACxE;AACF;AAMA,SAAS,iBAAA,CAAkB,YAAoB,MAAA,EAAsB;AACnE,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,OAAO,CAAA;AACxD,EAAA,IAAI,aAAa,iBAAA,EAAmB;AAClC,IAAA,MAAM,MAAA,GAAA,CAAU,UAAA,IAAc,IAAA,GAAO,IAAA,CAAA,EAAO,QAAQ,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,eAAe,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,WAAA,EAAc,iBAAA,IAAqB,OAAO,IAAA,CAAK,CAAA,qDAAA;AAAA,KAE9F;AAAA,EACF;AACF;AAEA,SAAS,UAAU,IAAA,EAAsD;AACvE,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF","file":"ws-bridge.js","sourcesContent":["/**\n * E2E encryption primitives for CLI ↔ browser communication.\n *\n * Uses ECDH P-256 for key exchange and AES-256-GCM for message encryption.\n * Mirrors the same crypto operations in @jaw.id/core but uses only\n * Node.js built-in crypto.subtle — no external dependencies.\n */\n\nimport type { webcrypto } from \"node:crypto\";\n\ntype CKey = webcrypto.CryptoKey;\ntype CKeyPair = webcrypto.CryptoKeyPair;\n\nconst subtle = globalThis.crypto.subtle;\n\n// ── Key generation ───────────────────────────────────────────────\n\nexport async function generateKeyPair(): Promise<CKeyPair> {\n  return subtle.generateKey(\n    { name: \"ECDH\", namedCurve: \"P-256\" },\n    true,\n    [\"deriveKey\"],\n  ) as Promise<CKeyPair>;\n}\n\nexport async function deriveSharedSecret(\n  privateKey: CKey,\n  peerPublicKey: CKey,\n): Promise<CKey> {\n  return subtle.deriveKey(\n    { name: \"ECDH\", public: peerPublicKey },\n    privateKey,\n    { name: \"AES-GCM\", length: 256 },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n// ── Encrypt / Decrypt ────────────────────────────────────────────\n\nexport interface EncryptedEnvelope {\n  iv: string; // base64\n  ciphertext: string; // base64\n}\n\nexport async function encryptMessage(\n  sharedSecret: CKey,\n  payload: Record<string, unknown>,\n): Promise<EncryptedEnvelope> {\n  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const cipherBuf = await subtle.encrypt(\n    { name: \"AES-GCM\", iv },\n    sharedSecret,\n    plaintext,\n  );\n  return {\n    iv: bufferToBase64(iv),\n    ciphertext: bufferToBase64(new Uint8Array(cipherBuf)),\n  };\n}\n\nexport async function decryptMessage(\n  sharedSecret: CKey,\n  envelope: EncryptedEnvelope,\n): Promise<Record<string, unknown>> {\n  const iv = Buffer.from(envelope.iv, \"base64\");\n  const ciphertext = Buffer.from(envelope.ciphertext, \"base64\");\n  const plainBuf = await subtle.decrypt(\n    { name: \"AES-GCM\", iv },\n    sharedSecret,\n    ciphertext,\n  );\n  return JSON.parse(new TextDecoder().decode(plainBuf));\n}\n\n// ── Key import / export (hex) ────────────────────────────────────\n\nexport async function exportKeyToHex(\n  type: \"private\" | \"public\",\n  key: CKey,\n): Promise<string> {\n  const format = type === \"private\" ? \"pkcs8\" : \"spki\";\n  const buf = await subtle.exportKey(format, key);\n  return bytesToHex(new Uint8Array(buf));\n}\n\nexport async function importKeyFromHex(\n  type: \"private\" | \"public\",\n  hex: string,\n): Promise<CKey> {\n  const format = type === \"private\" ? \"pkcs8\" : \"spki\";\n  return subtle.importKey(\n    format,\n    Buffer.from(hexToBytes(hex)),\n    { name: \"ECDH\", namedCurve: \"P-256\" },\n    true,\n    type === \"private\" ? [\"deriveKey\"] : [],\n  );\n}\n\n// ── Encoding helpers ─────────────────────────────────────────────\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error(\"Invalid hex: odd length\");\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nfunction bufferToBase64(buf: Uint8Array): string {\n  return Buffer.from(buf).toString(\"base64\");\n}\n","/**\n * WSBridge — CLI-side relay client\n *\n * Connects to the cloud relay (wss://relay.jaw.id) instead of a local daemon.\n * All messages (except key_exchange) are E2E encrypted via ECDH + AES-256-GCM.\n */\n\nimport * as crypto from \"node:crypto\";\nimport type { webcrypto } from \"node:crypto\";\nimport WebSocket from \"ws\";\nimport {\n  deriveSharedSecret,\n  encryptMessage,\n  decryptMessage,\n  importKeyFromHex,\n  type EncryptedEnvelope,\n} from \"./crypto.js\";\n\ntype CKey = webcrypto.CryptoKey;\n\nexport interface WSBridgeConfig {\n  apiKey: string;\n  chainId: number;\n  ens?: string;\n  paymasterUrl?: string;\n}\n\nexport interface WSBridgeOptions {\n  relayUrl: string;\n  session: string;\n  timeout?: number;\n  config: WSBridgeConfig;\n  /** CLI's ECDH private key (hex). Loaded from relay.json for existing sessions. */\n  privateKeyHex: string;\n  /** CLI's ECDH public key (hex). Sent to browser for key derivation. */\n  publicKeyHex: string;\n  /** Browser's ECDH public key (hex). Null if new session (key exchange needed). */\n  peerPublicKeyHex: string | null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\n/**\n * Maximum outbound message size (5 MB).\n *\n * wallet_sendCalls with large batches (50+ calls, complex calldata) can reach\n * hundreds of KB. Base64 encoding of the AES-GCM ciphertext adds ~33% overhead.\n * 5 MB is generous enough for any realistic batch while still preventing\n * accidental memory issues.\n */\nconst MAX_MESSAGE_BYTES = 5 * 1024 * 1024;\n\n/** Minimum time between browser reopen attempts (ms). */\nconst BROWSER_REOPEN_COOLDOWN_MS = 5_000;\n\n/** Maximum reconnection attempts before giving up. */\nconst MAX_RECONNECT_ATTEMPTS = 3;\n\n/** Base delay for exponential backoff (ms). */\nconst RECONNECT_BASE_DELAY_MS = 1_000;\n\nexport class WSBridge {\n  private readonly relayUrl: string;\n  private readonly session: string;\n  private readonly timeout: number;\n  private readonly config: WSBridgeConfig;\n  private readonly privateKeyHex: string;\n  readonly publicKeyHex: string;\n  private peerPublicKeyHex: string | null;\n  private sharedSecret: CKey | null = null;\n  private ws: WebSocket | null = null;\n  private disposed = false;\n\n  // Auto-reopen browser state\n  private onBrowserNeeded: (() => Promise<void>) | undefined;\n  private onPeerKeyChanged: ((key: string) => void) | undefined;\n  private lastBrowserOpenTime = 0;\n\n  // Reconnection state\n  private reconnectAttempts = 0;\n\n  /** Updated after key exchange — caller should persist this. */\n  get peerPublicKey(): string | null {\n    return this.peerPublicKeyHex;\n  }\n\n  constructor(options: WSBridgeOptions) {\n    this.relayUrl = options.relayUrl;\n    this.session = options.session;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n    this.config = options.config;\n    this.privateKeyHex = options.privateKeyHex;\n    this.publicKeyHex = options.publicKeyHex;\n    this.peerPublicKeyHex = options.peerPublicKeyHex;\n  }\n\n  /**\n   * Connect to the relay and wait for the browser to be ready.\n   *\n   * @param onBrowserNeeded — called when the relay reports no browser connected.\n   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.\n   */\n  async connect(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void,\n  ): Promise<void> {\n    // Store callbacks for auto-reopen on browser disconnect\n    this.onBrowserNeeded = onBrowserNeeded;\n    this.onPeerKeyChanged = onPeerKeyChanged;\n\n    // Pre-derive shared secret if we already have the peer key\n    if (this.peerPublicKeyHex) {\n      await this.deriveSecret();\n    }\n\n    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);\n  }\n\n  private async connectInternal(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void,\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      let browserOpened = false;\n      let resolved = false;\n      let expectingKeyExchange = !this.peerPublicKeyHex;\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(\n          new Error(\n            \"Browser did not connect in time.\\n\" +\n              \"Run `jaw disconnect` then try again.\",\n          ),\n        );\n      }, 30_000);\n\n      const sendEncryptedInit = async () => {\n        if (!this.sharedSecret) return;\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: \"init\",\n          apiKey: this.config.apiKey,\n          chainId: this.config.chainId,\n          ens: this.config.ens,\n          paymasterUrl: this.config.paymasterUrl,\n        });\n        this.sendRaw(ws, JSON.stringify({ type: \"encrypted\", ...envelope }));\n      };\n\n      const waitForReady = () => {\n        const readyTimer = setTimeout(() => {\n          ws.close();\n          reject(new Error(\"Browser SDK did not become ready in time.\"));\n        }, 15_000);\n\n        const onMsg = async (data: WebSocket.Data) => {\n          const msg = safeParse(data);\n          if (!msg) return;\n\n          if (msg.type === \"encrypted\" && this.sharedSecret) {\n            try {\n              const inner = await decryptMessage(\n                this.sharedSecret,\n                msg as unknown as EncryptedEnvelope,\n              );\n              if (inner.type === \"ready\") {\n                clearTimeout(readyTimer);\n                ws.off(\"message\", onMsg);\n                this.reconnectAttempts = 0; // Reset on successful connect\n                resolve();\n              }\n            } catch {\n              // Not a valid encrypted message for us, ignore\n            }\n          }\n        };\n        ws.on(\"message\", onMsg);\n      };\n\n      const onBrowserReady = async () => {\n        if (resolved) return;\n        resolved = true;\n        clearTimeout(timer);\n        // Set up listener BEFORE sending init to avoid missing the ready response\n        waitForReady();\n        await sendEncryptedInit();\n      };\n\n      ws.on(\"open\", () => {\n        this.ws = ws;\n      });\n\n      ws.on(\"message\", async (data) => {\n        const msg = safeParse(data);\n        if (!msg) return;\n\n        if (msg.type === \"status\") {\n          if (msg.browserConnected) {\n            if (this.sharedSecret) {\n              // Already have shared secret — skip key exchange\n              await onBrowserReady();\n            } else {\n              // Browser is connected but we don't have its key yet.\n              expectingKeyExchange = true;\n            }\n          } else if (!browserOpened && onBrowserNeeded) {\n            browserOpened = true;\n            expectingKeyExchange = true;\n            onBrowserNeeded().catch(() => {\n              /* best effort */\n            });\n          }\n        } else if (msg.type === \"browser_connected\") {\n          expectingKeyExchange = true;\n          // Wait for key_exchange from browser\n        } else if (msg.type === \"browser_disconnected\") {\n          // Browser tab closed — attempt to reopen after cooldown\n          this.handleBrowserDisconnect();\n        } else if (msg.type === \"key_exchange\" && expectingKeyExchange) {\n          expectingKeyExchange = false;\n          const peerKey = msg.publicKey as string;\n          this.peerPublicKeyHex = peerKey;\n          await this.deriveSecret();\n          onPeerKeyChanged?.(peerKey);\n          await onBrowserReady();\n        }\n      });\n\n      ws.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on(\"close\", () => {\n        clearTimeout(timer);\n        if (!this.disposed) {\n          this.handleRelayDisconnect();\n        }\n      });\n    });\n  }\n\n  /**\n   * Send an encrypted RPC request through the relay to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error(\"Not connected to relay\");\n    }\n    if (!this.sharedSecret) {\n      throw new Error(\"No shared secret — key exchange not completed\");\n    }\n\n    const id = crypto.randomUUID();\n\n    const envelope = await encryptMessage(this.sharedSecret, {\n      type: \"rpc_request\",\n      id,\n      method,\n      params,\n    });\n\n    const serialized = JSON.stringify({ type: \"encrypted\", ...envelope });\n    assertMessageSize(serialized, method);\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(\n            `Request timed out after ${this.timeout / 1000}s. ` +\n              \"Did you complete the action in the browser?\",\n          ),\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = async (data: WebSocket.Data) => {\n        const msg = safeParse(data);\n        if (!msg || msg.type !== \"encrypted\" || !this.sharedSecret) return;\n\n        try {\n          const inner = await decryptMessage(\n            this.sharedSecret,\n            msg as unknown as EncryptedEnvelope,\n          );\n          if (inner.type === \"rpc_response\" && inner.id === id) {\n            clearTimeout(timer);\n            ws.off(\"message\", onMessage);\n\n            if (inner.success) {\n              resolve(inner.data);\n            } else {\n              const err = inner.error as\n                | { code: number; message: string }\n                | undefined;\n              reject(\n                new Error(\n                  err ? `[${err.code}] ${err.message}` : \"Request failed\",\n                ),\n              );\n            }\n          }\n        } catch {\n          // Decryption failed — not our message or tampered, ignore\n        }\n      };\n\n      ws.on(\"message\", onMessage);\n      this.sendRaw(ws, serialized);\n    });\n  }\n\n  isOpen(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  async shutdown(): Promise<void> {\n    this.disposed = true;\n    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {\n      try {\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: \"shutdown\",\n        });\n        this.sendRaw(\n          this.ws,\n          JSON.stringify({ type: \"encrypted\", ...envelope }),\n        );\n      } catch {\n        // Best effort\n      }\n    }\n    this.close();\n  }\n\n  /**\n   * Connect to relay and send shutdown directly — no init/ready handshake.\n   * Used by `jaw disconnect` when we just need to tell the browser to close.\n   */\n  async connectAndShutdown(): Promise<void> {\n    if (!this.peerPublicKeyHex) {\n      // No peer key means browser never connected — nothing to shut down\n      return;\n    }\n\n    this.disposed = true;\n    await this.deriveSecret();\n\n    return new Promise<void>((resolve) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        try {\n          ws.close();\n        } catch {\n          /* ignore */\n        }\n        resolve();\n      }, 3000);\n\n      ws.on(\"open\", async () => {\n        this.ws = ws;\n        try {\n          await this.shutdown();\n        } catch {\n          // Best effort\n        }\n        clearTimeout(timer);\n        resolve();\n      });\n\n      ws.on(\"error\", () => {\n        clearTimeout(timer);\n        resolve();\n      });\n    });\n  }\n\n  close(): void {\n    this.disposed = true;\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n\n  /**\n   * Auto-reopen browser when browser_disconnected is received from relay.\n   * Respects a cooldown to prevent rapid re-opening.\n   */\n  private handleBrowserDisconnect(): void {\n    if (this.disposed || !this.onBrowserNeeded) return;\n\n    const now = Date.now();\n    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {\n      return; // Too soon — skip this reopen\n    }\n\n    this.lastBrowserOpenTime = now;\n\n    // Reset shared secret — the new browser tab will do a fresh key exchange\n    this.sharedSecret = null;\n    this.peerPublicKeyHex = null;\n\n    this.onBrowserNeeded().catch(() => {\n      // Best effort — if browser open fails, the next request will error\n    });\n  }\n\n  /**\n   * Attempt to reconnect to the relay with exponential backoff\n   * when the WebSocket connection drops unexpectedly.\n   */\n  private handleRelayDisconnect(): void {\n    if (this.disposed) return;\n    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;\n\n    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);\n    this.reconnectAttempts++;\n\n    setTimeout(() => {\n      if (this.disposed) return;\n      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(\n        () => {\n          // Reconnection failed — will retry if attempts remain\n        },\n      );\n    }, delay);\n  }\n\n  /** Send a raw string over the WebSocket, enforcing message size limits. */\n  private sendRaw(ws: WebSocket, data: string): void {\n    ws.send(data);\n  }\n\n  private async deriveSecret(): Promise<void> {\n    if (!this.peerPublicKeyHex) return;\n    const privateKey = await importKeyFromHex(\"private\", this.privateKeyHex);\n    const peerPublicKey = await importKeyFromHex(\n      \"public\",\n      this.peerPublicKeyHex,\n    );\n    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);\n  }\n}\n\n/**\n * Validate message size before sending to the relay.\n * Throws with a descriptive error if the message is too large.\n */\nfunction assertMessageSize(serialized: string, method: string): void {\n  const byteLength = Buffer.byteLength(serialized, \"utf-8\");\n  if (byteLength > MAX_MESSAGE_BYTES) {\n    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);\n    throw new Error(\n      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). ` +\n        \"Try reducing the number of calls in your batch.\",\n    );\n  }\n}\n\nfunction safeParse(data: WebSocket.Data): Record<string, unknown> | null {\n  try {\n    return JSON.parse(data.toString()) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n"]}

package/dist/mcp/handlers/config.js

@@ -16,7 +16,7 @@ import * as os from 'os';
   )
 });
 var configSetSchema = {
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "paymasterUrl", "ens"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "paymasterUrl", "ens", "relayUrl"]).describe("Config key"),
   value: z.string().describe("Config value")
 };
 
@@ -37,8 +37,7 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  bridge: path.join(JAW_DIR, "bridge.json"),
-  daemonLog: path.join(JAW_DIR, "daemon.log")
+  relay: path.join(JAW_DIR, "relay.json")
 };
 
 // src/lib/validation.ts
@@ -52,6 +51,17 @@ function isValidKeysUrl(url) {
     return false;
   }
 }
+function isValidRelayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "wss:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isWebSocket = parsed.protocol === "wss:" || parsed.protocol === "ws:";
+    return isTrustedHost && isSecure && isWebSocket;
+  } catch {
+    return false;
+  }
+}
 
 // src/lib/config.ts
 function ensureDir(dir) {
@@ -90,6 +100,11 @@ function setConfigValue(key, value) {
       `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`
     );
   }
+  if (key === "relayUrl" && typeof value === "string" && !isValidRelayUrl(value)) {
+    throw new Error(
+      `Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`
+    );
+  }
   const config = loadConfig();
   const updated = { ...config, [key]: value };
   saveConfig(updated);
@@ -116,7 +131,7 @@ function registerConfigTools(server) {
   );
   server.tool(
     "jaw_config_set",
-    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens).",
+    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens, relayUrl).",
     configSetSchema,
     async (params) => {
       try {

package/dist/mcp/handlers/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/tools.ts","../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/mcp/handlers/config.ts"],"names":[],"mappings":";;;;;;CAM+B;AAAA,EAC7B,MAAA,EAAQ,CAAA,CACL,MAAA,EAAO,CACP,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,MAAA,EAAQ,CAAA,CACL,GAAA,EAAI,CACJ,UAAS,CACT,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,OAAA,EAAS,CAAA,CACN,MAAA,EAAO,CACP,UAAS,CACT,QAAA;AAAA,IACC;AAAA;AAEN;AAEO,IAAM,eAAA,GAAkB;AAAA,EAC7B,GAAA,EAAK,CAAA,CACF,IAAA,CAAK,CAAC,QAAA,EAAU,cAAA,EAAgB,SAAA,EAAW,cAAA,EAAgB,KAAK,CAAC,CAAA,CACjE,QAAA,CAAS,YAAY,CAAA;AAAA,EACxB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAC3C,CAAA;;;ACjCO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,SAAA,EAAgB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AAC5C,CAAA;;;ACyBO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,QAAA,KAAa,QAAA,IACpB,OAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;AC/CO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;AASO,SAAS,cAAA,CACd,KACA,KAAA,EACM;AACN,EAAA,IACE,GAAA,KAAQ,aACR,OAAO,KAAA,KAAU,YACjB,CAAC,cAAA,CAAe,KAAK,CAAA,EACrB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sBAAsB,KAAK,CAAA,iDAAA;AAAA,KAC7B;AAAA,EACF;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAA,EAAM;AAC1C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;ACzDO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,iBAAA;AAAA,IACA,oDAAA;AAAA,IACA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AACxC,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP,EAAE,IAAA,EAAM,MAAA,EAAiB,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAE;AACxD,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,mFAAA;AAAA,IACA,eAAA;AAAA,IACA,OAAO,MAAA,KAAW;AAChB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,QAAQ,cAAA,EAAgB;AACjC,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AACrC,UAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,UACrD;AACA,UAAA,cAAA,CAAe,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,QAChC,CAAA,MAAO;AACL,UAAA,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAAA,QACzC;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,aAAA;AAAA;AACzB;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"config.js","sourcesContent":["import { z } from \"zod\";\n\n/**\n * Single generic RPC method schema.\n * Accepts any EIP-1193 RPC method and forwards to JAWProvider.\n */\nexport const rpcMethodSchema = {\n  method: z\n    .string()\n    .describe(\n      \"EIP-1193 RPC method name (e.g. wallet_connect, wallet_sendCalls, personal_sign). \" +\n        \"Read the jaw://api-reference resource for the full list and jaw://api-reference/{method} for parameter details.\",\n    ),\n  params: z\n    .any()\n    .optional()\n    .describe(\n      \"Method parameters — structure varies by method. \" +\n        \"Read the jaw://api-reference/{method} resource for the expected format.\",\n    ),\n  chainId: z\n    .number()\n    .optional()\n    .describe(\n      \"Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia\",\n    ),\n};\n\nexport const configSetSchema = {\n  key: z\n    .enum([\"apiKey\", \"defaultChain\", \"keysUrl\", \"paymasterUrl\", \"ens\"])\n    .describe(\"Config key\"),\n  value: z.string().describe(\"Config value\"),\n};\n","export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: \"text\" as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: \"text\" as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}","import * as path from \"node:path\";\nimport * as os from \"node:os\";\n\nconst JAW_DIR = path.join(os.homedir(), \".jaw\");\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, \"config.json\"),\n  session: path.join(JAW_DIR, \"session.json\"),\n  bridge: path.join(JAW_DIR, \"bridge.json\"),\n  daemonLog: path.join(JAW_DIR, \"daemon.log\"),\n} as const;\n","export function isValidAddress(value: string): boolean {\n  return /^0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nexport function isValidHex(value: string): boolean {\n  return /^0x[0-9a-fA-F]*$/.test(value);\n}\n\nexport function isValidChainId(value: string | number): boolean {\n  const num = typeof value === \"string\" ? parseInt(value, 10) : value;\n  return Number.isInteger(num) && num > 0;\n}\n\nexport function parseChainId(value: string): number {\n  const num = parseInt(value, 10);\n  if (!isValidChainId(num)) {\n    throw new Error(`Invalid chain ID: ${value}`);\n  }\n  return num;\n}\n\nexport function assertAddress(value: string, label = \"address\"): `0x${string}` {\n  if (!isValidAddress(value)) {\n    throw new Error(`Invalid ${label}: ${value}`);\n  }\n  return value as `0x${string}`;\n}\n\nexport function parseWei(raw: string, label = \"value\"): bigint {\n  try {\n    return BigInt(raw);\n  } catch {\n    throw new Error(`Invalid ${label}: \"${raw}\" is not a valid wei amount`);\n  }\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith(\".jaw.id\") ||\n      parsed.hostname === \"jaw.id\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isSecure =\n      parsed.protocol === \"https:\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from \"node:fs\";\nimport { PATHS } from \"./paths.js\";\nimport type { JawConfig } from \"./types.js\";\nimport { isValidKeysUrl } from \"./validation.js\";\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, \"utf-8\");\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`,\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(\n  key: keyof JawConfig,\n): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(\n  key: keyof JawConfig,\n  value: string | number,\n): void {\n  if (\n    key === \"keysUrl\" &&\n    typeof value === \"string\" &&\n    !isValidKeysUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`,\n    );\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { configSetSchema } from \"../tools.js\";\nimport { mcpError } from \"../helpers.js\";\nimport { loadConfig, setConfigValue, redactConfig } from \"../../lib/config.js\";\n\nexport function registerConfigTools(server: McpServer): void {\n  server.tool(\n    \"jaw_config_show\",\n    \"Show current CLI configuration (API key redacted).\",\n    {},\n    async () => {\n      try {\n        const config = redactConfig(loadConfig());\n        return {\n          content: [\n            { type: \"text\" as const, text: JSON.stringify(config) },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n\n  server.tool(\n    \"jaw_config_set\",\n    \"Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens).\",\n    configSetSchema,\n    async (params) => {\n      try {\n        if (params.key === \"defaultChain\") {\n          const num = parseInt(params.value, 10);\n          if (isNaN(num) || num <= 0) {\n            throw new Error(`Invalid chain ID: ${params.value}`);\n          }\n          setConfigValue(params.key, num);\n        } else {\n          setConfigValue(params.key, params.value);\n        }\n        return {\n          content: [\n            {\n              type: \"text\" as const,\n              text: `Set ${params.key} successfully`,\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n}\n"]}
+{"version":3,"sources":["../../../src/mcp/tools.ts","../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/mcp/handlers/config.ts"],"names":[],"mappings":";;;;;;CAM+B;AAAA,EAC7B,MAAA,EAAQ,CAAA,CACL,MAAA,EAAO,CACP,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,MAAA,EAAQ,CAAA,CACL,GAAA,EAAI,CACJ,UAAS,CACT,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,OAAA,EAAS,CAAA,CACN,MAAA,EAAO,CACP,UAAS,CACT,QAAA;AAAA,IACC;AAAA;AAEN;AAEO,IAAM,eAAA,GAAkB;AAAA,EAC7B,GAAA,EAAK,CAAA,CACF,IAAA,CAAK,CAAC,QAAA,EAAU,cAAA,EAAgB,SAAA,EAAW,cAAA,EAAgB,KAAA,EAAO,UAAU,CAAC,CAAA,CAC7E,SAAS,YAAY,CAAA;AAAA,EACxB,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAC3C,CAAA;;;ACjCO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AACxC,CAAA;;;AC0BO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,QAAA,KAAa,QAAA,IACpB,OAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GACJ,OAAO,QAAA,KAAa,MAAA,IACpB,OAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,WAAA,GACJ,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACpD,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACnEO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;AASO,SAAS,cAAA,CACd,KACA,KAAA,EACM;AACN,EAAA,IACE,GAAA,KAAQ,aACR,OAAO,KAAA,KAAU,YACjB,CAAC,cAAA,CAAe,KAAK,CAAA,EACrB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sBAAsB,KAAK,CAAA,iDAAA;AAAA,KAC7B;AAAA,EACF;AACA,EAAA,IACE,GAAA,KAAQ,cACR,OAAO,KAAA,KAAU,YACjB,CAAC,eAAA,CAAgB,KAAK,CAAA,EACtB;AACA,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,uBAAuB,KAAK,CAAA,2CAAA;AAAA,KAC9B;AAAA,EACF;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAA,EAAM;AAC1C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;AClEO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,iBAAA;AAAA,IACA,oDAAA;AAAA,IACA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AACxC,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP,EAAE,IAAA,EAAM,MAAA,EAAiB,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA;AAAE;AACxD,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,6FAAA;AAAA,IACA,eAAA;AAAA,IACA,OAAO,MAAA,KAAW;AAChB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,QAAQ,cAAA,EAAgB;AACjC,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AACrC,UAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,UACrD;AACA,UAAA,cAAA,CAAe,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,QAChC,CAAA,MAAO;AACL,UAAA,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAAA,QACzC;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,aAAA;AAAA;AACzB;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"config.js","sourcesContent":["import { z } from \"zod\";\n\n/**\n * Single generic RPC method schema.\n * Accepts any EIP-1193 RPC method and forwards to JAWProvider.\n */\nexport const rpcMethodSchema = {\n  method: z\n    .string()\n    .describe(\n      \"EIP-1193 RPC method name (e.g. wallet_connect, wallet_sendCalls, personal_sign). \" +\n        \"Read the jaw://api-reference resource for the full list and jaw://api-reference/{method} for parameter details.\",\n    ),\n  params: z\n    .any()\n    .optional()\n    .describe(\n      \"Method parameters — structure varies by method. \" +\n        \"Read the jaw://api-reference/{method} resource for the expected format.\",\n    ),\n  chainId: z\n    .number()\n    .optional()\n    .describe(\n      \"Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia\",\n    ),\n};\n\nexport const configSetSchema = {\n  key: z\n    .enum([\"apiKey\", \"defaultChain\", \"keysUrl\", \"paymasterUrl\", \"ens\", \"relayUrl\"])\n    .describe(\"Config key\"),\n  value: z.string().describe(\"Config value\"),\n};\n","export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: \"text\" as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: \"text\" as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}","import * as path from \"node:path\";\nimport * as os from \"node:os\";\n\nconst JAW_DIR = path.join(os.homedir(), \".jaw\");\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, \"config.json\"),\n  session: path.join(JAW_DIR, \"session.json\"),\n  relay: path.join(JAW_DIR, \"relay.json\"),\n} as const;\n","export function isValidAddress(value: string): boolean {\n  return /^0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nexport function isValidHex(value: string): boolean {\n  return /^0x[0-9a-fA-F]*$/.test(value);\n}\n\nexport function isValidChainId(value: string | number): boolean {\n  const num = typeof value === \"string\" ? parseInt(value, 10) : value;\n  return Number.isInteger(num) && num > 0;\n}\n\nexport function parseChainId(value: string): number {\n  const num = parseInt(value, 10);\n  if (!isValidChainId(num)) {\n    throw new Error(`Invalid chain ID: ${value}`);\n  }\n  return num;\n}\n\nexport function assertAddress(value: string, label = \"address\"): `0x${string}` {\n  if (!isValidAddress(value)) {\n    throw new Error(`Invalid ${label}: ${value}`);\n  }\n  return value as `0x${string}`;\n}\n\nexport function parseWei(raw: string, label = \"value\"): bigint {\n  try {\n    return BigInt(raw);\n  } catch {\n    throw new Error(`Invalid ${label}: \"${raw}\" is not a valid wei amount`);\n  }\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith(\".jaw.id\") ||\n      parsed.hostname === \"jaw.id\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isSecure =\n      parsed.protocol === \"https:\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith(\".jaw.id\") ||\n      parsed.hostname === \"jaw.id\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isSecure =\n      parsed.protocol === \"wss:\" ||\n      parsed.hostname === \"localhost\" ||\n      parsed.hostname === \"127.0.0.1\";\n    const isWebSocket =\n      parsed.protocol === \"wss:\" || parsed.protocol === \"ws:\";\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from \"node:fs\";\nimport { PATHS } from \"./paths.js\";\nimport type { JawConfig } from \"./types.js\";\nimport { isValidKeysUrl, isValidRelayUrl } from \"./validation.js\";\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, \"utf-8\");\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`,\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(\n  key: keyof JawConfig,\n): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(\n  key: keyof JawConfig,\n  value: string | number,\n): void {\n  if (\n    key === \"keysUrl\" &&\n    typeof value === \"string\" &&\n    !isValidKeysUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`,\n    );\n  }\n  if (\n    key === \"relayUrl\" &&\n    typeof value === \"string\" &&\n    !isValidRelayUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`,\n    );\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { configSetSchema } from \"../tools.js\";\nimport { mcpError } from \"../helpers.js\";\nimport { loadConfig, setConfigValue, redactConfig } from \"../../lib/config.js\";\n\nexport function registerConfigTools(server: McpServer): void {\n  server.tool(\n    \"jaw_config_show\",\n    \"Show current CLI configuration (API key redacted).\",\n    {},\n    async () => {\n      try {\n        const config = redactConfig(loadConfig());\n        return {\n          content: [\n            { type: \"text\" as const, text: JSON.stringify(config) },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n\n  server.tool(\n    \"jaw_config_set\",\n    \"Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens, relayUrl).\",\n    configSetSchema,\n    async (params) => {\n      try {\n        if (params.key === \"defaultChain\") {\n          const num = parseInt(params.value, 10);\n          if (isNaN(num) || num <= 0) {\n            throw new Error(`Invalid chain ID: ${params.value}`);\n          }\n          setConfigValue(params.key, num);\n        } else {\n          setConfigValue(params.key, params.value);\n        }\n        return {\n          content: [\n            {\n              type: \"text\" as const,\n              text: `Set ${params.key} successfully`,\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n}\n"]}