@jaw.id/cli 0.0.7 → 0.1.0

package/dist/mcp/handlers/daemon.js

@@ -23,21 +23,44 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
+function ensureDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
 function loadConfig() {
   if (!fs2.existsSync(PATHS.config)) {
     return {};
   }
   const raw = fs2.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
     );
   }
 }
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs2.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
 function redactConfig(config) {
   return {
     ...config,
@@ -59,11 +82,7 @@ async function deriveSharedSecret(privateKey, peerPublicKey) {
 async function encryptMessage(sharedSecret, payload) {
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-  const cipherBuf = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    plaintext
-  );
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
   return {
     iv: bufferToBase64(iv),
     ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
@@ -72,11 +91,7 @@ async function encryptMessage(sharedSecret, payload) {
 async function decryptMessage(sharedSecret, envelope) {
   const iv = Buffer.from(envelope.iv, "base64");
   const ciphertext = Buffer.from(envelope.ciphertext, "base64");
-  const plainBuf = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    ciphertext
-  );
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
   return JSON.parse(new TextDecoder().decode(plainBuf));
 }
 async function importKeyFromHex(type, hex) {
@@ -160,11 +175,7 @@ var WSBridge = class {
       let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
-        reject(
-          new Error(
-            "Browser did not connect in time.\nRun `jaw disconnect` then try again."
-          )
-        );
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
       }, 3e4);
       const sendEncryptedInit = async () => {
         if (!this.sharedSecret) return;
@@ -187,10 +198,7 @@ var WSBridge = class {
           if (!msg) return;
           if (msg.type === "encrypted" && this.sharedSecret) {
             try {
-              const inner = await decryptMessage(
-                this.sharedSecret,
-                msg
-              );
+              const inner = await decryptMessage(this.sharedSecret, msg);
               if (inner.type === "ready") {
                 clearTimeout(readyTimer);
                 ws.off("message", onMsg);
@@ -228,6 +236,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -277,9 +289,7 @@ var WSBridge = class {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new Error(
-            `Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`
-          )
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
         );
         this.close();
       }, this.timeout);
@@ -287,10 +297,7 @@ var WSBridge = class {
         const msg = safeParse(data);
         if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
         try {
-          const inner = await decryptMessage(
-            this.sharedSecret,
-            msg
-          );
+          const inner = await decryptMessage(this.sharedSecret, msg);
           if (inner.type === "rpc_response" && inner.id === id) {
             clearTimeout(timer);
             ws.off("message", onMessage);
@@ -298,11 +305,7 @@ var WSBridge = class {
               resolve(inner.data);
             } else {
               const err = inner.error;
-              reject(
-                new Error(
-                  err ? `[${err.code}] ${err.message}` : "Request failed"
-                )
-              );
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
             }
           }
         } catch {
@@ -312,9 +315,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
@@ -322,10 +322,7 @@ var WSBridge = class {
         const envelope = await encryptMessage(this.sharedSecret, {
           type: "shutdown"
         });
-        this.sendRaw(
-          this.ws,
-          JSON.stringify({ type: "encrypted", ...envelope })
-        );
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
       } catch {
       }
     }
@@ -403,10 +400,8 @@ var WSBridge = class {
     this.reconnectAttempts++;
     setTimeout(() => {
       if (this.disposed) return;
-      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(
-        () => {
-        }
-      );
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
     }, delay);
   }
   /** Send a raw string over the WebSocket, enforcing message size limits. */
@@ -416,10 +411,7 @@ var WSBridge = class {
   async deriveSecret() {
     if (!this.peerPublicKeyHex) return;
     const privateKey = await importKeyFromHex("private", this.privateKeyHex);
-    const peerPublicKey = await importKeyFromHex(
-      "public",
-      this.peerPublicKeyHex
-    );
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
     this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
   }
 };
@@ -524,9 +516,7 @@ function registerDaemonTools(server) {
           config
         };
         return {
-          content: [
-            { type: "text", text: JSON.stringify(status, null, 2) }
-          ]
+          content: [{ type: "text", text: JSON.stringify(status, null, 2) }]
         };
       } catch (err) {
         return mcpError(err);

package/dist/mcp/handlers/daemon.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/crypto.ts","../../../src/lib/ws-bridge.ts","../../../src/lib/bridge-singleton.ts","../../../src/mcp/handlers/daemon.ts"],"names":["fs","fs3"],"mappings":";;;;;;;;;AAAO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AACxC,CAAA;ACAO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAUO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;;;ACxBA,IAAM,MAAA,GAAS,WAAW,MAAA,CAAO,MAAA;AAYjC,eAAsB,kBAAA,CACpB,YACA,aAAA,EACe;AACf,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,aAAA,EAAc;AAAA,IACtC,UAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AASA,eAAsB,cAAA,CACpB,cACA,OAAA,EAC4B;AAC5B,EAAA,MAAM,KAAK,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,OAAA;AAAA,IAC7B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG;AAAA,IACtB,YAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAe,EAAE,CAAA;AAAA,IACrB,UAAA,EAAY,cAAA,CAAe,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GACtD;AACF;AAEA,eAAsB,cAAA,CACpB,cACA,QAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA;AAAA,IAC5B,EAAE,IAAA,EAAM,SAAA,EAAW,EAAA,EAAG;AAAA,IACtB,YAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACtD;AAaA,eAAsB,gBAAA,CACpB,MACA,GAAA,EACe;AACf,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,SAAA,GAAY,OAAA,GAAU,MAAA;AAC9C,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,MAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,IAAA,KAAS,SAAA,GAAY,CAAC,WAAW,IAAI;AAAC,GACxC;AACF;AAUA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtC,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC3C;;;AChFA,IAAM,kBAAA,GAAqB,IAAA;AAU3B,IAAM,iBAAA,GAAoB,IAAI,IAAA,GAAO,IAAA;AAGrC,IAAM,0BAAA,GAA6B,GAAA;AAGnC,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,uBAAA,GAA0B,GAAA;AAEzB,IAAM,WAAN,MAAe;AAAA,EACH,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACR,YAAA;AAAA,EACD,gBAAA;AAAA,EACA,YAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAA,GAAW,KAAA;AAAA;AAAA,EAGX,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA,GAAsB,CAAA;AAAA;AAAA,EAGtB,iBAAA,GAAoB,CAAA;AAAA;AAAA,EAG5B,IAAI,aAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAClC,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,eAAA,EACA,gBAAA,EACe;AAEf,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAGxB,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAc,eAAA,CACZ,eAAA,EACA,gBAAA,EACe;AACf,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,oBAAA,GAAuB,CAAC,IAAA,CAAK,gBAAA;AAEjC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF;AAAA;AAEF,SACF;AAAA,MACF,GAAG,GAAM,CAAA;AAET,MAAA,MAAM,oBAAoB,YAAY;AACpC,QAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM,MAAA;AAAA,UACN,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,UACpB,OAAA,EAAS,KAAK,MAAA,CAAO,OAAA;AAAA,UACrB,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,UACjB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,SAC3B,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MACrE,CAAA;AAEA,MAAA,MAAM,eAAe,MAAM;AACzB,QAAA,MAAM,UAAA,GAAa,WAAW,MAAM;AAClC,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,2CAA2C,CAAC,CAAA;AAAA,QAC/D,GAAG,IAAM,CAAA;AAET,QAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,KAAyB;AAC5C,UAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,UAAA,IAAI,CAAC,GAAA,EAAK;AAEV,UAAA,IAAI,GAAA,CAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,YAAA,EAAc;AACjD,YAAA,IAAI;AACF,cAAA,MAAM,QAAQ,MAAM,cAAA;AAAA,gBAClB,IAAA,CAAK,YAAA;AAAA,gBACL;AAAA,eACF;AACA,cAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,gBAAA,YAAA,CAAa,UAAU,CAAA;AACvB,gBAAA,EAAA,CAAG,GAAA,CAAI,WAAW,KAAK,CAAA;AACvB,gBAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,CAAA;AACA,QAAA,EAAA,CAAG,EAAA,CAAG,WAAW,KAAK,CAAA;AAAA,MACxB,CAAA;AAEA,MAAA,MAAM,iBAAiB,YAAY;AACjC,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,YAAA,EAAa;AACb,QAAA,MAAM,iBAAA,EAAkB;AAAA,MAC1B,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,OAAO,IAAA,KAAS;AAC/B,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,EAAK;AAEV,QAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,UAAA,IAAI,IAAI,gBAAA,EAAkB;AACxB,YAAA,IAAI,KAAK,YAAA,EAAc;AAErB,cAAA,MAAM,cAAA,EAAe;AAAA,YACvB,CAAA,MAAO;AAEL,cAAA,oBAAA,GAAuB,IAAA;AAAA,YACzB;AAAA,UACF,CAAA,MAAA,IAAW,CAAC,aAAA,IAAiB,eAAA,EAAiB;AAC5C,YAAA,aAAA,GAAgB,IAAA;AAChB,YAAA,oBAAA,GAAuB,IAAA;AACvB,YAAA,eAAA,EAAgB,CAAE,MAAM,MAAM;AAAA,YAE9B,CAAC,CAAA;AAAA,UACH;AAAA,QACF,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,oBAAA,GAAuB,IAAA;AAAA,QAEzB,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,sBAAA,EAAwB;AAE9C,UAAA,IAAA,CAAK,uBAAA,EAAwB;AAAA,QAC/B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,oBAAA,EAAsB;AAC9D,UAAA,oBAAA,GAAuB,KAAA;AACvB,UAAA,MAAM,UAAU,GAAA,CAAI,SAAA;AACpB,UAAA,IAAA,CAAK,gBAAA,GAAmB,OAAA;AACxB,UAAA,MAAM,KAAK,YAAA,EAAa;AACxB,UAAA,gBAAA,GAAmB,OAAO,CAAA;AAC1B,UAAA,MAAM,cAAA,EAAe;AAAA,QACvB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,IAAA,CAAK,qBAAA,EAAsB;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,MAAM,oDAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,MACvD,IAAA,EAAM,aAAA;AAAA,MACN,EAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU,CAAA;AACpE,IAAA,iBAAA,CAAkB,YAAY,MAAM,CAAA;AAEpC,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA;AAAA,YACF,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA;AAAA;AAEhD,SACF;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAyB;AAChD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,SAAS,WAAA,IAAe,CAAC,KAAK,YAAA,EAAc;AAE5D,QAAA,IAAI;AACF,UAAA,MAAM,QAAQ,MAAM,cAAA;AAAA,YAClB,IAAA,CAAK,YAAA;AAAA,YACL;AAAA,WACF;AACA,UAAA,IAAI,KAAA,CAAM,IAAA,KAAS,cAAA,IAAkB,KAAA,CAAM,OAAO,EAAA,EAAI;AACpD,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,YAAA,IAAI,MAAM,OAAA,EAAS;AACjB,cAAA,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,YACpB,CAAA,MAAO;AACL,cAAA,MAAM,MAAM,KAAA,CAAM,KAAA;AAGlB,cAAA,MAAA;AAAA,gBACE,IAAI,KAAA;AAAA,kBACF,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK;AAAA;AACzC,eACF;AAAA,YACF;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,UAAU,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,IAAQ,KAAK,YAAA,EAAc;AAC/D,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAA,CAAK,OAAA;AAAA,UACH,IAAA,CAAK,EAAA;AAAA,UACL,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU;AAAA,SACnD;AAAA,MACF,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAA,GAAoC;AACxC,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,KAAK,YAAA,EAAa;AAExB,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,EAAM;AAAA,QACX,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,GAAG,GAAI,CAAA;AAEP,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,YAAY;AACxB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,QAAA,IAAI;AACF,UAAA,MAAM,KAAK,QAAA,EAAS;AAAA,QACtB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,mBAAA,GAAsB,0BAAA,EAA4B;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,GAAA;AAG3B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AAExB,IAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,KAAA,CAAM,MAAM;AAAA,IAEnC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,IAAA,CAAK,qBAAqB,sBAAA,EAAwB;AAEtD,IAAA,MAAM,QAAQ,uBAAA,GAA0B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,iBAAiB,CAAA;AAC1E,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,eAAA,CAAgB,IAAA,CAAK,eAAA,EAAiB,IAAA,CAAK,gBAAgB,CAAA,CAAE,KAAA;AAAA,QAChE,MAAM;AAAA,QAEN;AAAA,OACF;AAAA,IACF,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA,EAGQ,OAAA,CAAQ,IAAe,IAAA,EAAoB;AACjD,IAAA,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EACd;AAAA,EAEA,MAAc,YAAA,GAA8B;AAC1C,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC5B,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,SAAA,EAAW,KAAK,aAAa,CAAA;AACvE,IAAA,MAAM,gBAAgB,MAAM,gBAAA;AAAA,MAC1B,QAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,MAAM,kBAAA,CAAmB,UAAA,EAAY,aAAa,CAAA;AAAA,EACxE;AACF,CAAA;AAMA,SAAS,iBAAA,CAAkB,YAAoB,MAAA,EAAsB;AACnE,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,OAAO,CAAA;AACxD,EAAA,IAAI,aAAa,iBAAA,EAAmB;AAClC,IAAA,MAAM,MAAA,GAAA,CAAU,UAAA,IAAc,IAAA,GAAO,IAAA,CAAA,EAAO,QAAQ,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,eAAe,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,WAAA,EAAc,iBAAA,IAAqB,OAAO,IAAA,CAAK,CAAA,qDAAA;AAAA,KAE9F;AAAA,EACF;AACF;AAEA,SAAS,UAAU,IAAA,EAAsD;AACvE,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACpbA,SAAS,gBAAA,GAAwC;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,GAAG,OAAO,IAAA;AACxC,IAAA,MAAM,GAAA,GAAS,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAA;AAChD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,CAAC,MAAA,CAAO,QAAA,IAAY,CAAC,MAAA,CAAO,UAAA,IAAc,CAAC,MAAA,CAAO,SAAA,EAAW;AAClF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUA,SAAS,kBAAA,GAA2B;AAClC,EAAA,IAAI;AACF,IAAA,IAAO,eAAW,KAAA,CAAM,KAAK,GAAM,GAAA,CAAA,UAAA,CAAW,MAAM,KAAK,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AA4GA,eAAsB,cAAA,GAAgC;AACpD,EAAA,MAAM,UAAU,gBAAA,EAAiB;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AAGd,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,QAAA,CAAS;AAAA,MAC1B,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,GAAA;AAAA,MACT,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,SAAS,CAAA,EAAE;AAAA,MACjC,eAAe,OAAA,CAAQ,UAAA;AAAA,MACvB,cAAc,OAAA,CAAQ,SAAA;AAAA,MACtB,kBAAkB,OAAA,CAAQ;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,OAAO,kBAAA,EAAmB;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,kBAAA,EAAmB;AAGnB,EAAA,MAAM,YAAA,GAAe,MAAM,IAAA,GAAO,cAAA;AAClC,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,GAAO,aAAA;AAC/B,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,GAAO,cAAA;AAChC,EAAA,IAAI;AACF,IAAA,IAAO,GAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,GAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAC9D,MAAA,IAAI,IAAA,CAAK,OAAO,MAAA,CAAO,SAAA,CAAU,KAAK,GAAG,CAAA,IAAK,IAAA,CAAK,GAAA,GAAM,CAAA,EAAG;AAC1D,QAAA,IAAI;AAAE,UAAA,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AAAA,QAAG,CAAA,CAAA,MAAQ;AAAA,QAAqB;AAAA,MACxE;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAAe;AACvB,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,YAAA,EAAc,SAAA,EAAW,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI;AAAE,MAAA,IAAO,GAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAM,eAAW,CAAC,CAAA;AAAA,IAAG,CAAA,CAAA,MAAQ;AAAA,IAAe;AAAA,EACvE;AACF;;;AC9MO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,YAAA;AAAA,IACA,+JAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,IAAI,YAAA,GAAe,KAAA;AAEnB,QAAA,IAAI;AACF,UAAA,IAAOC,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AAC9B,YAAA,IAAA,CAAK,KAAA,CAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAChD,YAAA,YAAA,GAAe,IAAA;AAAA,UACjB;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,YAAA,GAAe,KAAA;AAAA,QACjB;AAEA,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AAExC,QAAA,MAAM,MAAA,GAAS;AAAA,UACb,KAAA,EAAO,eACH,EAAE,OAAA,EAAS,MAAK,GAChB,EAAE,SAAS,KAAA,EAAM;AAAA,UACrB,gBAAA,EAAkB,cAAA;AAAA,UAClB;AAAA,SACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP,EAAE,MAAM,MAAA,EAAiB,IAAA,EAAM,KAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA;AAAE;AACjE,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,oHAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"daemon.js","sourcesContent":["export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: \"text\" as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: \"text\" as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}","import * as path from \"node:path\";\nimport * as os from \"node:os\";\n\nconst JAW_DIR = path.join(os.homedir(), \".jaw\");\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, \"config.json\"),\n  session: path.join(JAW_DIR, \"session.json\"),\n  relay: path.join(JAW_DIR, \"relay.json\"),\n} as const;\n","import * as fs from \"node:fs\";\nimport { PATHS } from \"./paths.js\";\nimport type { JawConfig } from \"./types.js\";\nimport { isValidKeysUrl, isValidRelayUrl } from \"./validation.js\";\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, \"utf-8\");\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`,\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(\n  key: keyof JawConfig,\n): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(\n  key: keyof JawConfig,\n  value: string | number,\n): void {\n  if (\n    key === \"keysUrl\" &&\n    typeof value === \"string\" &&\n    !isValidKeysUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`,\n    );\n  }\n  if (\n    key === \"relayUrl\" &&\n    typeof value === \"string\" &&\n    !isValidRelayUrl(value)\n  ) {\n    throw new Error(\n      `Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`,\n    );\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","/**\n * E2E encryption primitives for CLI ↔ browser communication.\n *\n * Uses ECDH P-256 for key exchange and AES-256-GCM for message encryption.\n * Mirrors the same crypto operations in @jaw.id/core but uses only\n * Node.js built-in crypto.subtle — no external dependencies.\n */\n\nimport type { webcrypto } from \"node:crypto\";\n\ntype CKey = webcrypto.CryptoKey;\ntype CKeyPair = webcrypto.CryptoKeyPair;\n\nconst subtle = globalThis.crypto.subtle;\n\n// ── Key generation ───────────────────────────────────────────────\n\nexport async function generateKeyPair(): Promise<CKeyPair> {\n  return subtle.generateKey(\n    { name: \"ECDH\", namedCurve: \"P-256\" },\n    true,\n    [\"deriveKey\"],\n  ) as Promise<CKeyPair>;\n}\n\nexport async function deriveSharedSecret(\n  privateKey: CKey,\n  peerPublicKey: CKey,\n): Promise<CKey> {\n  return subtle.deriveKey(\n    { name: \"ECDH\", public: peerPublicKey },\n    privateKey,\n    { name: \"AES-GCM\", length: 256 },\n    false,\n    [\"encrypt\", \"decrypt\"],\n  );\n}\n\n// ── Encrypt / Decrypt ────────────────────────────────────────────\n\nexport interface EncryptedEnvelope {\n  iv: string; // base64\n  ciphertext: string; // base64\n}\n\nexport async function encryptMessage(\n  sharedSecret: CKey,\n  payload: Record<string, unknown>,\n): Promise<EncryptedEnvelope> {\n  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const cipherBuf = await subtle.encrypt(\n    { name: \"AES-GCM\", iv },\n    sharedSecret,\n    plaintext,\n  );\n  return {\n    iv: bufferToBase64(iv),\n    ciphertext: bufferToBase64(new Uint8Array(cipherBuf)),\n  };\n}\n\nexport async function decryptMessage(\n  sharedSecret: CKey,\n  envelope: EncryptedEnvelope,\n): Promise<Record<string, unknown>> {\n  const iv = Buffer.from(envelope.iv, \"base64\");\n  const ciphertext = Buffer.from(envelope.ciphertext, \"base64\");\n  const plainBuf = await subtle.decrypt(\n    { name: \"AES-GCM\", iv },\n    sharedSecret,\n    ciphertext,\n  );\n  return JSON.parse(new TextDecoder().decode(plainBuf));\n}\n\n// ── Key import / export (hex) ────────────────────────────────────\n\nexport async function exportKeyToHex(\n  type: \"private\" | \"public\",\n  key: CKey,\n): Promise<string> {\n  const format = type === \"private\" ? \"pkcs8\" : \"spki\";\n  const buf = await subtle.exportKey(format, key);\n  return bytesToHex(new Uint8Array(buf));\n}\n\nexport async function importKeyFromHex(\n  type: \"private\" | \"public\",\n  hex: string,\n): Promise<CKey> {\n  const format = type === \"private\" ? \"pkcs8\" : \"spki\";\n  return subtle.importKey(\n    format,\n    Buffer.from(hexToBytes(hex)),\n    { name: \"ECDH\", namedCurve: \"P-256\" },\n    true,\n    type === \"private\" ? [\"deriveKey\"] : [],\n  );\n}\n\n// ── Encoding helpers ─────────────────────────────────────────────\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, \"0\"))\n    .join(\"\");\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error(\"Invalid hex: odd length\");\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nfunction bufferToBase64(buf: Uint8Array): string {\n  return Buffer.from(buf).toString(\"base64\");\n}\n","/**\n * WSBridge — CLI-side relay client\n *\n * Connects to the cloud relay (wss://relay.jaw.id) instead of a local daemon.\n * All messages (except key_exchange) are E2E encrypted via ECDH + AES-256-GCM.\n */\n\nimport * as crypto from \"node:crypto\";\nimport type { webcrypto } from \"node:crypto\";\nimport WebSocket from \"ws\";\nimport {\n  deriveSharedSecret,\n  encryptMessage,\n  decryptMessage,\n  importKeyFromHex,\n  type EncryptedEnvelope,\n} from \"./crypto.js\";\n\ntype CKey = webcrypto.CryptoKey;\n\nexport interface WSBridgeConfig {\n  apiKey: string;\n  chainId: number;\n  ens?: string;\n  paymasterUrl?: string;\n}\n\nexport interface WSBridgeOptions {\n  relayUrl: string;\n  session: string;\n  timeout?: number;\n  config: WSBridgeConfig;\n  /** CLI's ECDH private key (hex). Loaded from relay.json for existing sessions. */\n  privateKeyHex: string;\n  /** CLI's ECDH public key (hex). Sent to browser for key derivation. */\n  publicKeyHex: string;\n  /** Browser's ECDH public key (hex). Null if new session (key exchange needed). */\n  peerPublicKeyHex: string | null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\n/**\n * Maximum outbound message size (5 MB).\n *\n * wallet_sendCalls with large batches (50+ calls, complex calldata) can reach\n * hundreds of KB. Base64 encoding of the AES-GCM ciphertext adds ~33% overhead.\n * 5 MB is generous enough for any realistic batch while still preventing\n * accidental memory issues.\n */\nconst MAX_MESSAGE_BYTES = 5 * 1024 * 1024;\n\n/** Minimum time between browser reopen attempts (ms). */\nconst BROWSER_REOPEN_COOLDOWN_MS = 5_000;\n\n/** Maximum reconnection attempts before giving up. */\nconst MAX_RECONNECT_ATTEMPTS = 3;\n\n/** Base delay for exponential backoff (ms). */\nconst RECONNECT_BASE_DELAY_MS = 1_000;\n\nexport class WSBridge {\n  private readonly relayUrl: string;\n  private readonly session: string;\n  private readonly timeout: number;\n  private readonly config: WSBridgeConfig;\n  private readonly privateKeyHex: string;\n  readonly publicKeyHex: string;\n  private peerPublicKeyHex: string | null;\n  private sharedSecret: CKey | null = null;\n  private ws: WebSocket | null = null;\n  private disposed = false;\n\n  // Auto-reopen browser state\n  private onBrowserNeeded: (() => Promise<void>) | undefined;\n  private onPeerKeyChanged: ((key: string) => void) | undefined;\n  private lastBrowserOpenTime = 0;\n\n  // Reconnection state\n  private reconnectAttempts = 0;\n\n  /** Updated after key exchange — caller should persist this. */\n  get peerPublicKey(): string | null {\n    return this.peerPublicKeyHex;\n  }\n\n  constructor(options: WSBridgeOptions) {\n    this.relayUrl = options.relayUrl;\n    this.session = options.session;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n    this.config = options.config;\n    this.privateKeyHex = options.privateKeyHex;\n    this.publicKeyHex = options.publicKeyHex;\n    this.peerPublicKeyHex = options.peerPublicKeyHex;\n  }\n\n  /**\n   * Connect to the relay and wait for the browser to be ready.\n   *\n   * @param onBrowserNeeded — called when the relay reports no browser connected.\n   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.\n   */\n  async connect(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void,\n  ): Promise<void> {\n    // Store callbacks for auto-reopen on browser disconnect\n    this.onBrowserNeeded = onBrowserNeeded;\n    this.onPeerKeyChanged = onPeerKeyChanged;\n\n    // Pre-derive shared secret if we already have the peer key\n    if (this.peerPublicKeyHex) {\n      await this.deriveSecret();\n    }\n\n    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);\n  }\n\n  private async connectInternal(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void,\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      let browserOpened = false;\n      let resolved = false;\n      let expectingKeyExchange = !this.peerPublicKeyHex;\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(\n          new Error(\n            \"Browser did not connect in time.\\n\" +\n              \"Run `jaw disconnect` then try again.\",\n          ),\n        );\n      }, 30_000);\n\n      const sendEncryptedInit = async () => {\n        if (!this.sharedSecret) return;\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: \"init\",\n          apiKey: this.config.apiKey,\n          chainId: this.config.chainId,\n          ens: this.config.ens,\n          paymasterUrl: this.config.paymasterUrl,\n        });\n        this.sendRaw(ws, JSON.stringify({ type: \"encrypted\", ...envelope }));\n      };\n\n      const waitForReady = () => {\n        const readyTimer = setTimeout(() => {\n          ws.close();\n          reject(new Error(\"Browser SDK did not become ready in time.\"));\n        }, 15_000);\n\n        const onMsg = async (data: WebSocket.Data) => {\n          const msg = safeParse(data);\n          if (!msg) return;\n\n          if (msg.type === \"encrypted\" && this.sharedSecret) {\n            try {\n              const inner = await decryptMessage(\n                this.sharedSecret,\n                msg as unknown as EncryptedEnvelope,\n              );\n              if (inner.type === \"ready\") {\n                clearTimeout(readyTimer);\n                ws.off(\"message\", onMsg);\n                this.reconnectAttempts = 0; // Reset on successful connect\n                resolve();\n              }\n            } catch {\n              // Not a valid encrypted message for us, ignore\n            }\n          }\n        };\n        ws.on(\"message\", onMsg);\n      };\n\n      const onBrowserReady = async () => {\n        if (resolved) return;\n        resolved = true;\n        clearTimeout(timer);\n        // Set up listener BEFORE sending init to avoid missing the ready response\n        waitForReady();\n        await sendEncryptedInit();\n      };\n\n      ws.on(\"open\", () => {\n        this.ws = ws;\n      });\n\n      ws.on(\"message\", async (data) => {\n        const msg = safeParse(data);\n        if (!msg) return;\n\n        if (msg.type === \"status\") {\n          if (msg.browserConnected) {\n            if (this.sharedSecret) {\n              // Already have shared secret — skip key exchange\n              await onBrowserReady();\n            } else {\n              // Browser is connected but we don't have its key yet.\n              expectingKeyExchange = true;\n            }\n          } else if (!browserOpened && onBrowserNeeded) {\n            browserOpened = true;\n            expectingKeyExchange = true;\n            onBrowserNeeded().catch(() => {\n              /* best effort */\n            });\n          }\n        } else if (msg.type === \"browser_connected\") {\n          expectingKeyExchange = true;\n          // Wait for key_exchange from browser\n        } else if (msg.type === \"browser_disconnected\") {\n          // Browser tab closed — attempt to reopen after cooldown\n          this.handleBrowserDisconnect();\n        } else if (msg.type === \"key_exchange\" && expectingKeyExchange) {\n          expectingKeyExchange = false;\n          const peerKey = msg.publicKey as string;\n          this.peerPublicKeyHex = peerKey;\n          await this.deriveSecret();\n          onPeerKeyChanged?.(peerKey);\n          await onBrowserReady();\n        }\n      });\n\n      ws.on(\"error\", (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on(\"close\", () => {\n        clearTimeout(timer);\n        if (!this.disposed) {\n          this.handleRelayDisconnect();\n        }\n      });\n    });\n  }\n\n  /**\n   * Send an encrypted RPC request through the relay to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error(\"Not connected to relay\");\n    }\n    if (!this.sharedSecret) {\n      throw new Error(\"No shared secret — key exchange not completed\");\n    }\n\n    const id = crypto.randomUUID();\n\n    const envelope = await encryptMessage(this.sharedSecret, {\n      type: \"rpc_request\",\n      id,\n      method,\n      params,\n    });\n\n    const serialized = JSON.stringify({ type: \"encrypted\", ...envelope });\n    assertMessageSize(serialized, method);\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(\n            `Request timed out after ${this.timeout / 1000}s. ` +\n              \"Did you complete the action in the browser?\",\n          ),\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = async (data: WebSocket.Data) => {\n        const msg = safeParse(data);\n        if (!msg || msg.type !== \"encrypted\" || !this.sharedSecret) return;\n\n        try {\n          const inner = await decryptMessage(\n            this.sharedSecret,\n            msg as unknown as EncryptedEnvelope,\n          );\n          if (inner.type === \"rpc_response\" && inner.id === id) {\n            clearTimeout(timer);\n            ws.off(\"message\", onMessage);\n\n            if (inner.success) {\n              resolve(inner.data);\n            } else {\n              const err = inner.error as\n                | { code: number; message: string }\n                | undefined;\n              reject(\n                new Error(\n                  err ? `[${err.code}] ${err.message}` : \"Request failed\",\n                ),\n              );\n            }\n          }\n        } catch {\n          // Decryption failed — not our message or tampered, ignore\n        }\n      };\n\n      ws.on(\"message\", onMessage);\n      this.sendRaw(ws, serialized);\n    });\n  }\n\n  isOpen(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  async shutdown(): Promise<void> {\n    this.disposed = true;\n    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {\n      try {\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: \"shutdown\",\n        });\n        this.sendRaw(\n          this.ws,\n          JSON.stringify({ type: \"encrypted\", ...envelope }),\n        );\n      } catch {\n        // Best effort\n      }\n    }\n    this.close();\n  }\n\n  /**\n   * Connect to relay and send shutdown directly — no init/ready handshake.\n   * Used by `jaw disconnect` when we just need to tell the browser to close.\n   */\n  async connectAndShutdown(): Promise<void> {\n    if (!this.peerPublicKeyHex) {\n      // No peer key means browser never connected — nothing to shut down\n      return;\n    }\n\n    this.disposed = true;\n    await this.deriveSecret();\n\n    return new Promise<void>((resolve) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        try {\n          ws.close();\n        } catch {\n          /* ignore */\n        }\n        resolve();\n      }, 3000);\n\n      ws.on(\"open\", async () => {\n        this.ws = ws;\n        try {\n          await this.shutdown();\n        } catch {\n          // Best effort\n        }\n        clearTimeout(timer);\n        resolve();\n      });\n\n      ws.on(\"error\", () => {\n        clearTimeout(timer);\n        resolve();\n      });\n    });\n  }\n\n  close(): void {\n    this.disposed = true;\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n\n  /**\n   * Auto-reopen browser when browser_disconnected is received from relay.\n   * Respects a cooldown to prevent rapid re-opening.\n   */\n  private handleBrowserDisconnect(): void {\n    if (this.disposed || !this.onBrowserNeeded) return;\n\n    const now = Date.now();\n    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {\n      return; // Too soon — skip this reopen\n    }\n\n    this.lastBrowserOpenTime = now;\n\n    // Reset shared secret — the new browser tab will do a fresh key exchange\n    this.sharedSecret = null;\n    this.peerPublicKeyHex = null;\n\n    this.onBrowserNeeded().catch(() => {\n      // Best effort — if browser open fails, the next request will error\n    });\n  }\n\n  /**\n   * Attempt to reconnect to the relay with exponential backoff\n   * when the WebSocket connection drops unexpectedly.\n   */\n  private handleRelayDisconnect(): void {\n    if (this.disposed) return;\n    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;\n\n    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);\n    this.reconnectAttempts++;\n\n    setTimeout(() => {\n      if (this.disposed) return;\n      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(\n        () => {\n          // Reconnection failed — will retry if attempts remain\n        },\n      );\n    }, delay);\n  }\n\n  /** Send a raw string over the WebSocket, enforcing message size limits. */\n  private sendRaw(ws: WebSocket, data: string): void {\n    ws.send(data);\n  }\n\n  private async deriveSecret(): Promise<void> {\n    if (!this.peerPublicKeyHex) return;\n    const privateKey = await importKeyFromHex(\"private\", this.privateKeyHex);\n    const peerPublicKey = await importKeyFromHex(\n      \"public\",\n      this.peerPublicKeyHex,\n    );\n    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);\n  }\n}\n\n/**\n * Validate message size before sending to the relay.\n * Throws with a descriptive error if the message is too large.\n */\nfunction assertMessageSize(serialized: string, method: string): void {\n  const byteLength = Buffer.byteLength(serialized, \"utf-8\");\n  if (byteLength > MAX_MESSAGE_BYTES) {\n    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);\n    throw new Error(\n      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). ` +\n        \"Try reducing the number of calls in your batch.\",\n    );\n  }\n}\n\nfunction safeParse(data: WebSocket.Data): Record<string, unknown> | null {\n  try {\n    return JSON.parse(data.toString()) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Bridge lifecycle management — relay edition.\n *\n * - Generates a session token + ECDH keypair for new sessions\n * - Opens the browser to keys.jaw.id/cli-bridge\n * - Saves relay state to ~/.jaw/relay.json\n * - Creates a WSBridge client connected to the relay\n */\n\nimport * as fs from \"node:fs\";\nimport * as crypto from \"node:crypto\";\nimport { PATHS } from \"./paths.js\";\nimport { ensureDir, loadConfig } from \"./config.js\";\nimport { WSBridge } from \"./ws-bridge.js\";\nimport { isValidKeysUrl, isValidRelayUrl } from \"./validation.js\";\nimport { generateKeyPair, exportKeyToHex } from \"./crypto.js\";\n\nconst DEFAULT_KEYS_URL = \"https://keys.jaw.id\";\nconst DEFAULT_RELAY_URL = \"wss://relay.jaw.id\";\n\ninterface RelaySession {\n  session: string;\n  relayUrl: string;\n  privateKey: string;\n  publicKey: string;\n  peerPublicKey: string | null;\n  startedAt: string;\n}\n\nexport interface BridgeOptions {\n  keysUrl?: string;\n  relayUrl?: string;\n  apiKey: string;\n  chainId?: number;\n  ens?: string;\n  paymasterUrl?: string;\n  timeout?: number;\n}\n\nfunction loadRelaySession(): RelaySession | null {\n  try {\n    if (!fs.existsSync(PATHS.relay)) return null;\n    const raw = fs.readFileSync(PATHS.relay, \"utf-8\");\n    const parsed = JSON.parse(raw) as RelaySession;\n    // Basic validation\n    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {\n      return null;\n    }\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nfunction saveRelaySession(info: RelaySession): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + \"\\n\", {\n    encoding: \"utf-8\",\n    mode: 0o600,\n  });\n}\n\nfunction deleteRelaySession(): void {\n  try {\n    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);\n  } catch {\n    // ignore\n  }\n}\n\n/**\n * Get or create a relay bridge connection.\n */\nexport async function getBridge(options: BridgeOptions): Promise<WSBridge> {\n  const config = loadConfig();\n  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;\n  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;\n  const chainId = options.chainId ?? config.defaultChain ?? 1;\n  if (!isValidKeysUrl(keysUrl)) {\n    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (!isValidRelayUrl(relayUrl)) {\n    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n\n  // Try existing session first\n  let relaySession = loadRelaySession();\n  if (relaySession && relaySession.relayUrl === relayUrl) {\n    try {\n      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl);\n    } catch {\n      // Connection failed — stale session or relay restarted.\n      // Delete and fall through to create a new one.\n      deleteRelaySession();\n      relaySession = null;\n    }\n  }\n\n  // New session\n  const session = await createNewSession(relayUrl);\n  saveRelaySession(session);\n  return await connectBridge(session, options, chainId, keysUrl, relayUrl);\n}\n\nasync function createNewSession(relayUrl: string): Promise<RelaySession> {\n  const kp = await generateKeyPair();\n  const privateKey = await exportKeyToHex(\"private\", kp.privateKey);\n  const publicKey = await exportKeyToHex(\"public\", kp.publicKey);\n\n  return {\n    session: crypto.randomUUID(),\n    relayUrl,\n    privateKey,\n    publicKey,\n    peerPublicKey: null,\n    startedAt: new Date().toISOString(),\n  };\n}\n\nasync function connectBridge(\n  relaySession: RelaySession,\n  options: BridgeOptions,\n  chainId: number,\n  keysUrl: string,\n  relayUrl: string,\n): Promise<WSBridge> {\n  const config = loadConfig();\n  const bridge = new WSBridge({\n    relayUrl,\n    session: relaySession.session,\n    timeout: options.timeout,\n    config: {\n      apiKey: options.apiKey,\n      chainId,\n      ens: options.ens ?? config.ens,\n      paymasterUrl: options.paymasterUrl ?? config.paymasterUrl,\n    },\n    privateKeyHex: relaySession.privateKey,\n    publicKeyHex: relaySession.publicKey,\n    peerPublicKeyHex: relaySession.peerPublicKey,\n  });\n\n  await bridge.connect(\n    // onBrowserNeeded\n    async () => {\n      const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);\n      const { default: open } = await import(\"open\");\n      await open(bridgeUrl);\n    },\n    // onPeerKeyChanged\n    (newPeerKey) => {\n      relaySession.peerPublicKey = newPeerKey;\n      saveRelaySession(relaySession);\n    },\n  );\n\n  return bridge;\n}\n\nfunction buildBridgeUrl(\n  keysUrl: string,\n  session: string,\n  relayUrl: string,\n  cliPublicKeyHex: string,\n): string {\n  const url = new URL(\"/cli-bridge\", keysUrl);\n  url.searchParams.set(\"session\", session);\n  url.searchParams.set(\"relay\", relayUrl);\n  // CLI public key in fragment — not sent to server\n  url.hash = `pk=${cliPublicKeyHex}`;\n  return url.toString();\n}\n\n/**\n * Shutdown: close the relay session and clean up.\n */\nexport async function shutdownDaemon(): Promise<void> {\n  const session = loadRelaySession();\n  if (!session) return;\n\n  // Send shutdown directly — no init/ready handshake needed\n  try {\n    const bridge = new WSBridge({\n      relayUrl: session.relayUrl,\n      session: session.session,\n      timeout: 5000,\n      config: { apiKey: \"\", chainId: 1 },\n      privateKeyHex: session.privateKey,\n      publicKeyHex: session.publicKey,\n      peerPublicKeyHex: session.peerPublicKey,\n    });\n    await bridge.connectAndShutdown();\n  } catch {\n    // Best effort — relay or browser may already be gone\n  }\n\n  deleteRelaySession();\n\n  // Legacy cleanup: kill old daemon process and remove files\n  const legacyBridge = PATHS.root + \"/bridge.json\";\n  const legacyLog = PATHS.root + \"/daemon.log\";\n  const legacyLock = PATHS.root + \"/daemon.lock\";\n  try {\n    if (fs.existsSync(legacyBridge)) {\n      const info = JSON.parse(fs.readFileSync(legacyBridge, \"utf-8\"));\n      if (info.pid && Number.isInteger(info.pid) && info.pid > 0) {\n        try { process.kill(info.pid, \"SIGTERM\"); } catch { /* already dead */ }\n      }\n    }\n  } catch { /* ignore */ }\n  for (const f of [legacyBridge, legacyLog, legacyLock]) {\n    try { if (fs.existsSync(f)) fs.unlinkSync(f); } catch { /* ignore */ }\n  }\n}\n","import * as fs from \"node:fs\";\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport { mcpError } from \"../helpers.js\";\nimport { shutdownDaemon } from \"../../lib/bridge-singleton.js\";\nimport { PATHS } from \"../../lib/paths.js\";\nimport { loadConfig, redactConfig } from \"../../lib/config.js\";\n\nexport function registerDaemonTools(server: McpServer): void {\n  server.tool(\n    \"jaw_status\",\n    \"Check the current status of the JAW.id relay bridge — whether a relay session \" +\n      \"exists, the bridge connection is active, and what configuration is in use.\",\n    {},\n    async () => {\n      try {\n        let relaySession = false;\n\n        try {\n          if (fs.existsSync(PATHS.relay)) {\n            JSON.parse(fs.readFileSync(PATHS.relay, \"utf-8\"));\n            relaySession = true;\n          }\n        } catch {\n          relaySession = false;\n        }\n\n        const config = redactConfig(loadConfig());\n\n        const status = {\n          relay: relaySession\n            ? { session: true }\n            : { session: false },\n          bridgeConnection: \"disconnected\",\n          config,\n        };\n\n        return {\n          content: [\n            { type: \"text\" as const, text: JSON.stringify(status, null, 2) },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n\n  server.tool(\n    \"jaw_disconnect\",\n    \"Close the relay session and browser tab. \" +\n      \"Call this when you are done making wallet requests to clean up resources.\",\n    {},\n    async () => {\n      try {\n        await shutdownDaemon();\n        return {\n          content: [\n            {\n              type: \"text\" as const,\n              text: \"Relay session closed and browser tab dismissed.\",\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    },\n  );\n}\n"]}
+{"version":3,"sources":["../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/crypto.ts","../../../src/lib/ws-bridge.ts","../../../src/lib/bridge-singleton.ts","../../../src/mcp/handlers/daemon.ts"],"names":["fs","fs3"],"mappings":";;;;;;;;;AAAO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;ACPO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAGA,cAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAGA,GAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAGA,GAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;;;ACnCA,IAAM,MAAA,GAAS,WAAW,MAAA,CAAO,MAAA;AAQjC,eAAsB,kBAAA,CAAmB,YAAkB,aAAA,EAAoC;AAC7F,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,aAAA,EAAc;AAAA,IACtC,UAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AASA,eAAsB,cAAA,CAAe,cAAoB,OAAA,EAA8D;AACrH,EAAA,MAAM,KAAK,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,SAAS,CAAA;AACvF,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAe,EAAE,CAAA;AAAA,IACrB,UAAA,EAAY,cAAA,CAAe,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GACtD;AACF;AAEA,eAAsB,cAAA,CACpB,cACA,QAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,UAAU,CAAA;AACvF,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACtD;AAUA,eAAsB,gBAAA,CAAiB,MAA4B,GAAA,EAA4B;AAC7F,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,SAAA,GAAY,OAAA,GAAU,MAAA;AAC9C,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,MAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,IAAA,KAAS,SAAA,GAAY,CAAC,WAAW,IAAI;AAAC,GACxC;AACF;AAUA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtC,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC3C;;;ACxDA,IAAM,kBAAA,GAAqB,IAAA;AAU3B,IAAM,iBAAA,GAAoB,IAAI,IAAA,GAAO,IAAA;AAGrC,IAAM,0BAAA,GAA6B,GAAA;AAGnC,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,uBAAA,GAA0B,GAAA;AAEzB,IAAM,WAAN,MAAe;AAAA,EACH,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACR,YAAA;AAAA,EACD,gBAAA;AAAA,EACA,YAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAA,GAAW,KAAA;AAAA;AAAA,EAGX,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA,GAAsB,CAAA;AAAA;AAAA,EAGtB,iBAAA,GAAoB,CAAA;AAAA;AAAA,EAG5B,IAAI,aAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAClC,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,eAAA,EACA,gBAAA,EACe;AAEf,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAGxB,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAc,eAAA,CACZ,eAAA,EACA,gBAAA,EACe;AACf,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,oBAAA,GAAuB,CAAC,IAAA,CAAK,gBAAA;AAEjC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,wEAA6E,CAAC,CAAA;AAAA,MACjG,GAAG,GAAM,CAAA;AAET,MAAA,MAAM,oBAAoB,YAAY;AACpC,QAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM,MAAA;AAAA,UACN,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,UACpB,OAAA,EAAS,KAAK,MAAA,CAAO,OAAA;AAAA,UACrB,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,UACjB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,SAC3B,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MACrE,CAAA;AAEA,MAAA,MAAM,eAAe,MAAM;AACzB,QAAA,MAAM,UAAA,GAAa,WAAW,MAAM;AAClC,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,2CAA2C,CAAC,CAAA;AAAA,QAC/D,GAAG,IAAM,CAAA;AAET,QAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,KAAyB;AAC5C,UAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,UAAA,IAAI,CAAC,GAAA,EAAK;AAEV,UAAA,IAAI,GAAA,CAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,YAAA,EAAc;AACjD,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,cAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,gBAAA,YAAA,CAAa,UAAU,CAAA;AACvB,gBAAA,EAAA,CAAG,GAAA,CAAI,WAAW,KAAK,CAAA;AACvB,gBAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,CAAA;AACA,QAAA,EAAA,CAAG,EAAA,CAAG,WAAW,KAAK,CAAA;AAAA,MACxB,CAAA;AAEA,MAAA,MAAM,iBAAiB,YAAY;AACjC,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,YAAA,EAAa;AACb,QAAA,MAAM,iBAAA,EAAkB;AAAA,MAC1B,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,OAAO,IAAA,KAAS;AAC/B,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,EAAK;AAEV,QAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,UAAA,IAAI,IAAI,gBAAA,EAAkB;AACxB,YAAA,IAAI,KAAK,YAAA,EAAc;AAErB,cAAA,MAAM,cAAA,EAAe;AAAA,YACvB,CAAA,MAAO;AAEL,cAAA,oBAAA,GAAuB,IAAA;AAAA,YACzB;AAAA,UACF,CAAA,MAAA,IAAW,CAAC,aAAA,IAAiB,eAAA,EAAiB;AAC5C,YAAA,aAAA,GAAgB,IAAA;AAChB,YAAA,oBAAA,GAAuB,IAAA;AACvB,YAAA,eAAA,EAAgB,CAAE,MAAM,MAAM;AAAA,YAE9B,CAAC,CAAA;AAAA,UACH,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAM3B,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,KAAA,EAAM;AACT,YAAA,MAAA,CAAO,IAAI,KAAA,CAAM,sDAAiD,CAAC,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,oBAAA,GAAuB,IAAA;AAAA,QAEzB,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,sBAAA,EAAwB;AAE9C,UAAA,IAAA,CAAK,uBAAA,EAAwB;AAAA,QAC/B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,oBAAA,EAAsB;AAC9D,UAAA,oBAAA,GAAuB,KAAA;AACvB,UAAA,MAAM,UAAU,GAAA,CAAI,SAAA;AACpB,UAAA,IAAA,CAAK,gBAAA,GAAmB,OAAA;AACxB,UAAA,MAAM,KAAK,YAAA,EAAa;AACxB,UAAA,gBAAA,GAAmB,OAAO,CAAA;AAC1B,UAAA,MAAM,cAAA,EAAe;AAAA,QACvB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,IAAA,CAAK,qBAAA,EAAsB;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,MAAM,oDAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,MACvD,IAAA,EAAM,aAAA;AAAA,MACN,EAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU,CAAA;AACpE,IAAA,iBAAA,CAAkB,YAAY,MAAM,CAAA;AAEpC,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA,CAAqD;AAAA,SAC/G;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAyB;AAChD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,SAAS,WAAA,IAAe,CAAC,KAAK,YAAA,EAAc;AAE5D,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,UAAA,IAAI,KAAA,CAAM,IAAA,KAAS,cAAA,IAAkB,KAAA,CAAM,OAAO,EAAA,EAAI;AACpD,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,YAAA,IAAI,MAAM,OAAA,EAAS;AACjB,cAAA,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,YACpB,CAAA,MAAO;AACL,cAAA,MAAM,MAAM,KAAA,CAAM,KAAA;AAClB,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,GAAA,GAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,gBAAgB,CAAC,CAAA;AAAA,YAC3E;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,UAAU,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,IAAQ,KAAK,YAAA,EAAc;AAC/D,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAA,GAAoC;AACxC,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,KAAK,YAAA,EAAa;AAExB,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,EAAM;AAAA,QACX,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,GAAG,GAAI,CAAA;AAEP,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,YAAY;AACxB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,QAAA,IAAI;AACF,UAAA,MAAM,KAAK,QAAA,EAAS;AAAA,QACtB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,mBAAA,GAAsB,0BAAA,EAA4B;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,GAAA;AAG3B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AAExB,IAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,KAAA,CAAM,MAAM;AAAA,IAEnC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,IAAA,CAAK,qBAAqB,sBAAA,EAAwB;AAEtD,IAAA,MAAM,QAAQ,uBAAA,GAA0B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,iBAAiB,CAAA;AAC1E,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,eAAA,EAAiB,KAAK,gBAAgB,CAAA,CAAE,MAAM,MAAM;AAAA,MAE9E,CAAC,CAAA;AAAA,IACH,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA,EAGQ,OAAA,CAAQ,IAAe,IAAA,EAAoB;AACjD,IAAA,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EACd;AAAA,EAEA,MAAc,YAAA,GAA8B;AAC1C,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC5B,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,SAAA,EAAW,KAAK,aAAa,CAAA;AACvE,IAAA,MAAM,aAAA,GAAgB,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAK,gBAAgB,CAAA;AAC5E,IAAA,IAAA,CAAK,YAAA,GAAe,MAAM,kBAAA,CAAmB,UAAA,EAAY,aAAa,CAAA;AAAA,EACxE;AACF,CAAA;AAMA,SAAS,iBAAA,CAAkB,YAAoB,MAAA,EAAsB;AACnE,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,OAAO,CAAA;AACxD,EAAA,IAAI,aAAa,iBAAA,EAAmB;AAClC,IAAA,MAAM,MAAA,GAAA,CAAU,UAAA,IAAc,IAAA,GAAO,IAAA,CAAA,EAAO,QAAQ,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,eAAe,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,WAAA,EAAc,iBAAA,IAAqB,OAAO,IAAA,CAAK,CAAA,qDAAA;AAAA,KAE9F;AAAA,EACF;AACF;AAEA,SAAS,UAAU,IAAA,EAAsD;AACvE,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AC7ZA,SAAS,gBAAA,GAAwC;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,GAAG,OAAO,IAAA;AACxC,IAAA,MAAM,GAAA,GAAS,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAA;AAChD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,CAAC,MAAA,CAAO,QAAA,IAAY,CAAC,MAAA,CAAO,UAAA,IAAc,CAAC,MAAA,CAAO,SAAA,EAAW;AAClF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUA,SAAS,kBAAA,GAA2B;AAClC,EAAA,IAAI;AACF,IAAA,IAAO,eAAW,KAAA,CAAM,KAAK,GAAM,GAAA,CAAA,UAAA,CAAW,MAAM,KAAK,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AA8GA,eAAsB,cAAA,GAAgC;AACpD,EAAA,MAAM,UAAU,gBAAA,EAAiB;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AAGd,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,QAAA,CAAS;AAAA,MAC1B,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,GAAA;AAAA,MACT,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,SAAS,CAAA,EAAE;AAAA,MACjC,eAAe,OAAA,CAAQ,UAAA;AAAA,MACvB,cAAc,OAAA,CAAQ,SAAA;AAAA,MACtB,kBAAkB,OAAA,CAAQ;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,OAAO,kBAAA,EAAmB;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,kBAAA,EAAmB;AAGnB,EAAA,MAAM,YAAA,GAAe,MAAM,IAAA,GAAO,cAAA;AAClC,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,GAAO,aAAA;AAC/B,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,GAAO,cAAA;AAChC,EAAA,IAAI;AACF,IAAA,IAAO,GAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,GAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAC9D,MAAA,IAAI,IAAA,CAAK,OAAO,MAAA,CAAO,SAAA,CAAU,KAAK,GAAG,CAAA,IAAK,IAAA,CAAK,GAAA,GAAM,CAAA,EAAG;AAC1D,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,YAAA,EAAc,SAAA,EAAW,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI;AACF,MAAA,IAAO,GAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAM,eAAW,CAAC,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AC1NO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,YAAA;AAAA,IACA,+JAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,IAAI,YAAA,GAAe,KAAA;AAEnB,QAAA,IAAI;AACF,UAAA,IAAOC,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AAC9B,YAAA,IAAA,CAAK,KAAA,CAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAChD,YAAA,YAAA,GAAe,IAAA;AAAA,UACjB;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,YAAA,GAAe,KAAA;AAAA,QACjB;AAEA,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AAExC,QAAA,MAAM,MAAA,GAAS;AAAA,UACb,KAAA,EAAO,eAAe,EAAE,OAAA,EAAS,MAAK,GAAI,EAAE,SAAS,KAAA,EAAM;AAAA,UAC3D,gBAAA,EAAkB,cAAA;AAAA,UAClB;AAAA,SACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,SAC5E;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,oHAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"daemon.js","sourcesContent":["export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: 'text' as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: 'text' as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}\n","import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","/**\n * E2E encryption primitives for CLI ↔ browser communication.\n *\n * Uses ECDH P-256 for key exchange and AES-256-GCM for message encryption.\n * Mirrors the same crypto operations in @jaw.id/core but uses only\n * Node.js built-in crypto.subtle — no external dependencies.\n */\n\nimport type { webcrypto } from 'node:crypto';\n\ntype CKey = webcrypto.CryptoKey;\ntype CKeyPair = webcrypto.CryptoKeyPair;\n\nconst subtle = globalThis.crypto.subtle;\n\n// ── Key generation ───────────────────────────────────────────────\n\nexport async function generateKeyPair(): Promise<CKeyPair> {\n  return subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveKey']) as Promise<CKeyPair>;\n}\n\nexport async function deriveSharedSecret(privateKey: CKey, peerPublicKey: CKey): Promise<CKey> {\n  return subtle.deriveKey(\n    { name: 'ECDH', public: peerPublicKey },\n    privateKey,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    ['encrypt', 'decrypt']\n  );\n}\n\n// ── Encrypt / Decrypt ────────────────────────────────────────────\n\nexport interface EncryptedEnvelope {\n  iv: string; // base64\n  ciphertext: string; // base64\n}\n\nexport async function encryptMessage(sharedSecret: CKey, payload: Record<string, unknown>): Promise<EncryptedEnvelope> {\n  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const cipherBuf = await subtle.encrypt({ name: 'AES-GCM', iv }, sharedSecret, plaintext);\n  return {\n    iv: bufferToBase64(iv),\n    ciphertext: bufferToBase64(new Uint8Array(cipherBuf)),\n  };\n}\n\nexport async function decryptMessage(\n  sharedSecret: CKey,\n  envelope: EncryptedEnvelope\n): Promise<Record<string, unknown>> {\n  const iv = Buffer.from(envelope.iv, 'base64');\n  const ciphertext = Buffer.from(envelope.ciphertext, 'base64');\n  const plainBuf = await subtle.decrypt({ name: 'AES-GCM', iv }, sharedSecret, ciphertext);\n  return JSON.parse(new TextDecoder().decode(plainBuf));\n}\n\n// ── Key import / export (hex) ────────────────────────────────────\n\nexport async function exportKeyToHex(type: 'private' | 'public', key: CKey): Promise<string> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  const buf = await subtle.exportKey(format, key);\n  return bytesToHex(new Uint8Array(buf));\n}\n\nexport async function importKeyFromHex(type: 'private' | 'public', hex: string): Promise<CKey> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  return subtle.importKey(\n    format,\n    Buffer.from(hexToBytes(hex)),\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true,\n    type === 'private' ? ['deriveKey'] : []\n  );\n}\n\n// ── Encoding helpers ─────────────────────────────────────────────\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('Invalid hex: odd length');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nfunction bufferToBase64(buf: Uint8Array): string {\n  return Buffer.from(buf).toString('base64');\n}\n","/**\n * WSBridge — CLI-side relay client\n *\n * Connects to the cloud relay (wss://relay.jaw.id) instead of a local daemon.\n * All messages (except key_exchange) are E2E encrypted via ECDH + AES-256-GCM.\n */\n\nimport * as crypto from 'node:crypto';\nimport type { webcrypto } from 'node:crypto';\nimport WebSocket from 'ws';\nimport {\n  deriveSharedSecret,\n  encryptMessage,\n  decryptMessage,\n  importKeyFromHex,\n  type EncryptedEnvelope,\n} from './crypto.js';\n\ntype CKey = webcrypto.CryptoKey;\n\nexport interface WSBridgeConfig {\n  apiKey: string;\n  chainId: number;\n  ens?: string;\n  paymasterUrl?: string;\n}\n\nexport interface WSBridgeOptions {\n  relayUrl: string;\n  session: string;\n  timeout?: number;\n  config: WSBridgeConfig;\n  /** CLI's ECDH private key (hex). Loaded from relay.json for existing sessions. */\n  privateKeyHex: string;\n  /** CLI's ECDH public key (hex). Sent to browser for key derivation. */\n  publicKeyHex: string;\n  /** Browser's ECDH public key (hex). Null if new session (key exchange needed). */\n  peerPublicKeyHex: string | null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\n/**\n * Maximum outbound message size (5 MB).\n *\n * wallet_sendCalls with large batches (50+ calls, complex calldata) can reach\n * hundreds of KB. Base64 encoding of the AES-GCM ciphertext adds ~33% overhead.\n * 5 MB is generous enough for any realistic batch while still preventing\n * accidental memory issues.\n */\nconst MAX_MESSAGE_BYTES = 5 * 1024 * 1024;\n\n/** Minimum time between browser reopen attempts (ms). */\nconst BROWSER_REOPEN_COOLDOWN_MS = 5_000;\n\n/** Maximum reconnection attempts before giving up. */\nconst MAX_RECONNECT_ATTEMPTS = 3;\n\n/** Base delay for exponential backoff (ms). */\nconst RECONNECT_BASE_DELAY_MS = 1_000;\n\nexport class WSBridge {\n  private readonly relayUrl: string;\n  private readonly session: string;\n  private readonly timeout: number;\n  private readonly config: WSBridgeConfig;\n  private readonly privateKeyHex: string;\n  readonly publicKeyHex: string;\n  private peerPublicKeyHex: string | null;\n  private sharedSecret: CKey | null = null;\n  private ws: WebSocket | null = null;\n  private disposed = false;\n\n  // Auto-reopen browser state\n  private onBrowserNeeded: (() => Promise<void>) | undefined;\n  private onPeerKeyChanged: ((key: string) => void) | undefined;\n  private lastBrowserOpenTime = 0;\n\n  // Reconnection state\n  private reconnectAttempts = 0;\n\n  /** Updated after key exchange — caller should persist this. */\n  get peerPublicKey(): string | null {\n    return this.peerPublicKeyHex;\n  }\n\n  constructor(options: WSBridgeOptions) {\n    this.relayUrl = options.relayUrl;\n    this.session = options.session;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n    this.config = options.config;\n    this.privateKeyHex = options.privateKeyHex;\n    this.publicKeyHex = options.publicKeyHex;\n    this.peerPublicKeyHex = options.peerPublicKeyHex;\n  }\n\n  /**\n   * Connect to the relay and wait for the browser to be ready.\n   *\n   * @param onBrowserNeeded — called when the relay reports no browser connected.\n   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.\n   */\n  async connect(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    // Store callbacks for auto-reopen on browser disconnect\n    this.onBrowserNeeded = onBrowserNeeded;\n    this.onPeerKeyChanged = onPeerKeyChanged;\n\n    // Pre-derive shared secret if we already have the peer key\n    if (this.peerPublicKeyHex) {\n      await this.deriveSecret();\n    }\n\n    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);\n  }\n\n  private async connectInternal(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      let browserOpened = false;\n      let resolved = false;\n      let expectingKeyExchange = !this.peerPublicKeyHex;\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(new Error('Browser did not connect in time.\\n' + 'Run `jaw disconnect` then try again.'));\n      }, 30_000);\n\n      const sendEncryptedInit = async () => {\n        if (!this.sharedSecret) return;\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'init',\n          apiKey: this.config.apiKey,\n          chainId: this.config.chainId,\n          ens: this.config.ens,\n          paymasterUrl: this.config.paymasterUrl,\n        });\n        this.sendRaw(ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      };\n\n      const waitForReady = () => {\n        const readyTimer = setTimeout(() => {\n          ws.close();\n          reject(new Error('Browser SDK did not become ready in time.'));\n        }, 15_000);\n\n        const onMsg = async (data: WebSocket.Data) => {\n          const msg = safeParse(data);\n          if (!msg) return;\n\n          if (msg.type === 'encrypted' && this.sharedSecret) {\n            try {\n              const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n              if (inner.type === 'ready') {\n                clearTimeout(readyTimer);\n                ws.off('message', onMsg);\n                this.reconnectAttempts = 0; // Reset on successful connect\n                resolve();\n              }\n            } catch {\n              // Not a valid encrypted message for us, ignore\n            }\n          }\n        };\n        ws.on('message', onMsg);\n      };\n\n      const onBrowserReady = async () => {\n        if (resolved) return;\n        resolved = true;\n        clearTimeout(timer);\n        // Set up listener BEFORE sending init to avoid missing the ready response\n        waitForReady();\n        await sendEncryptedInit();\n      };\n\n      ws.on('open', () => {\n        this.ws = ws;\n      });\n\n      ws.on('message', async (data) => {\n        const msg = safeParse(data);\n        if (!msg) return;\n\n        if (msg.type === 'status') {\n          if (msg.browserConnected) {\n            if (this.sharedSecret) {\n              // Already have shared secret — skip key exchange\n              await onBrowserReady();\n            } else {\n              // Browser is connected but we don't have its key yet.\n              expectingKeyExchange = true;\n            }\n          } else if (!browserOpened && onBrowserNeeded) {\n            browserOpened = true;\n            expectingKeyExchange = true;\n            onBrowserNeeded().catch(() => {\n              /* best effort */\n            });\n          } else if (!onBrowserNeeded) {\n            // Reuse path (bridge-singleton.ts called connectBridge with\n            // openBrowser=false): the relay reports no browser connected and\n            // we have no callback to open one. Bail immediately so the\n            // caller can fall through to a fresh session, instead of waiting\n            // out the 30s connect-timer.\n            clearTimeout(timer);\n            ws.close();\n            reject(new Error('Browser not connected — relay session is stale.'));\n          }\n        } else if (msg.type === 'browser_connected') {\n          expectingKeyExchange = true;\n          // Wait for key_exchange from browser\n        } else if (msg.type === 'browser_disconnected') {\n          // Browser tab closed — attempt to reopen after cooldown\n          this.handleBrowserDisconnect();\n        } else if (msg.type === 'key_exchange' && expectingKeyExchange) {\n          expectingKeyExchange = false;\n          const peerKey = msg.publicKey as string;\n          this.peerPublicKeyHex = peerKey;\n          await this.deriveSecret();\n          onPeerKeyChanged?.(peerKey);\n          await onBrowserReady();\n        }\n      });\n\n      ws.on('error', (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on('close', () => {\n        clearTimeout(timer);\n        if (!this.disposed) {\n          this.handleRelayDisconnect();\n        }\n      });\n    });\n  }\n\n  /**\n   * Send an encrypted RPC request through the relay to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error('Not connected to relay');\n    }\n    if (!this.sharedSecret) {\n      throw new Error('No shared secret — key exchange not completed');\n    }\n\n    const id = crypto.randomUUID();\n\n    const envelope = await encryptMessage(this.sharedSecret, {\n      type: 'rpc_request',\n      id,\n      method,\n      params,\n    });\n\n    const serialized = JSON.stringify({ type: 'encrypted', ...envelope });\n    assertMessageSize(serialized, method);\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(`Request timed out after ${this.timeout / 1000}s. ` + 'Did you complete the action in the browser?')\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = async (data: WebSocket.Data) => {\n        const msg = safeParse(data);\n        if (!msg || msg.type !== 'encrypted' || !this.sharedSecret) return;\n\n        try {\n          const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n          if (inner.type === 'rpc_response' && inner.id === id) {\n            clearTimeout(timer);\n            ws.off('message', onMessage);\n\n            if (inner.success) {\n              resolve(inner.data);\n            } else {\n              const err = inner.error as { code: number; message: string } | undefined;\n              reject(new Error(err ? `[${err.code}] ${err.message}` : 'Request failed'));\n            }\n          }\n        } catch {\n          // Decryption failed — not our message or tampered, ignore\n        }\n      };\n\n      ws.on('message', onMessage);\n      this.sendRaw(ws, serialized);\n    });\n  }\n\n  async shutdown(): Promise<void> {\n    this.disposed = true;\n    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {\n      try {\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'shutdown',\n        });\n        this.sendRaw(this.ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      } catch {\n        // Best effort\n      }\n    }\n    this.close();\n  }\n\n  /**\n   * Connect to relay and send shutdown directly — no init/ready handshake.\n   * Used by `jaw disconnect` when we just need to tell the browser to close.\n   */\n  async connectAndShutdown(): Promise<void> {\n    if (!this.peerPublicKeyHex) {\n      // No peer key means browser never connected — nothing to shut down\n      return;\n    }\n\n    this.disposed = true;\n    await this.deriveSecret();\n\n    return new Promise<void>((resolve) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        try {\n          ws.close();\n        } catch {\n          /* ignore */\n        }\n        resolve();\n      }, 3000);\n\n      ws.on('open', async () => {\n        this.ws = ws;\n        try {\n          await this.shutdown();\n        } catch {\n          // Best effort\n        }\n        clearTimeout(timer);\n        resolve();\n      });\n\n      ws.on('error', () => {\n        clearTimeout(timer);\n        resolve();\n      });\n    });\n  }\n\n  close(): void {\n    this.disposed = true;\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n\n  /**\n   * Auto-reopen browser when browser_disconnected is received from relay.\n   * Respects a cooldown to prevent rapid re-opening.\n   */\n  private handleBrowserDisconnect(): void {\n    if (this.disposed || !this.onBrowserNeeded) return;\n\n    const now = Date.now();\n    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {\n      return; // Too soon — skip this reopen\n    }\n\n    this.lastBrowserOpenTime = now;\n\n    // Reset shared secret — the new browser tab will do a fresh key exchange\n    this.sharedSecret = null;\n    this.peerPublicKeyHex = null;\n\n    this.onBrowserNeeded().catch(() => {\n      // Best effort — if browser open fails, the next request will error\n    });\n  }\n\n  /**\n   * Attempt to reconnect to the relay with exponential backoff\n   * when the WebSocket connection drops unexpectedly.\n   */\n  private handleRelayDisconnect(): void {\n    if (this.disposed) return;\n    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;\n\n    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);\n    this.reconnectAttempts++;\n\n    setTimeout(() => {\n      if (this.disposed) return;\n      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {\n        // Reconnection failed — will retry if attempts remain\n      });\n    }, delay);\n  }\n\n  /** Send a raw string over the WebSocket, enforcing message size limits. */\n  private sendRaw(ws: WebSocket, data: string): void {\n    ws.send(data);\n  }\n\n  private async deriveSecret(): Promise<void> {\n    if (!this.peerPublicKeyHex) return;\n    const privateKey = await importKeyFromHex('private', this.privateKeyHex);\n    const peerPublicKey = await importKeyFromHex('public', this.peerPublicKeyHex);\n    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);\n  }\n}\n\n/**\n * Validate message size before sending to the relay.\n * Throws with a descriptive error if the message is too large.\n */\nfunction assertMessageSize(serialized: string, method: string): void {\n  const byteLength = Buffer.byteLength(serialized, 'utf-8');\n  if (byteLength > MAX_MESSAGE_BYTES) {\n    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);\n    throw new Error(\n      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). ` +\n        'Try reducing the number of calls in your batch.'\n    );\n  }\n}\n\nfunction safeParse(data: WebSocket.Data): Record<string, unknown> | null {\n  try {\n    return JSON.parse(data.toString()) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Bridge lifecycle management — relay edition.\n *\n * - Generates a session token + ECDH keypair for new sessions\n * - Opens the browser to keys.jaw.id/cli-bridge\n * - Saves relay state to ~/.jaw/relay.json\n * - Creates a WSBridge client connected to the relay\n */\n\nimport * as fs from 'node:fs';\nimport * as crypto from 'node:crypto';\nimport { PATHS } from './paths.js';\nimport { ensureDir, loadConfig } from './config.js';\nimport { WSBridge } from './ws-bridge.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\nimport { generateKeyPair, exportKeyToHex } from './crypto.js';\n\nconst DEFAULT_KEYS_URL = 'https://keys.jaw.id';\nconst DEFAULT_RELAY_URL = 'wss://relay.jaw.id';\n\ninterface RelaySession {\n  session: string;\n  relayUrl: string;\n  privateKey: string;\n  publicKey: string;\n  peerPublicKey: string | null;\n  startedAt: string;\n}\n\nexport interface BridgeOptions {\n  keysUrl?: string;\n  relayUrl?: string;\n  apiKey: string;\n  chainId?: number;\n  ens?: string;\n  paymasterUrl?: string;\n  timeout?: number;\n}\n\nfunction loadRelaySession(): RelaySession | null {\n  try {\n    if (!fs.existsSync(PATHS.relay)) return null;\n    const raw = fs.readFileSync(PATHS.relay, 'utf-8');\n    const parsed = JSON.parse(raw) as RelaySession;\n    // Basic validation\n    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {\n      return null;\n    }\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nfunction saveRelaySession(info: RelaySession): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nfunction deleteRelaySession(): void {\n  try {\n    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);\n  } catch {\n    // ignore\n  }\n}\n\n/**\n * Get or create a relay bridge connection.\n */\nexport async function getBridge(options: BridgeOptions): Promise<WSBridge> {\n  const config = loadConfig();\n  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;\n  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;\n  const chainId = options.chainId ?? config.defaultChain ?? 1;\n  if (!isValidKeysUrl(keysUrl)) {\n    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (!isValidRelayUrl(relayUrl)) {\n    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n\n  // Try existing session first — but never open a browser for a stale session.\n  // If the browser is already connected, reuse it. If not, fall through to a new session.\n  let relaySession = loadRelaySession();\n  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {\n    try {\n      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);\n    } catch {\n      // Connection failed — stale session or relay restarted.\n      // Delete and fall through to create a new one.\n      deleteRelaySession();\n      relaySession = null;\n    }\n  } else if (relaySession) {\n    // Incomplete session (no peer key) — discard\n    deleteRelaySession();\n  }\n\n  // New session — this is the only path that opens a browser\n  const session = await createNewSession(relayUrl);\n  saveRelaySession(session);\n  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);\n}\n\nasync function createNewSession(relayUrl: string): Promise<RelaySession> {\n  const kp = await generateKeyPair();\n  const privateKey = await exportKeyToHex('private', kp.privateKey);\n  const publicKey = await exportKeyToHex('public', kp.publicKey);\n\n  return {\n    session: crypto.randomUUID(),\n    relayUrl,\n    privateKey,\n    publicKey,\n    peerPublicKey: null,\n    startedAt: new Date().toISOString(),\n  };\n}\n\nasync function connectBridge(\n  relaySession: RelaySession,\n  options: BridgeOptions,\n  chainId: number,\n  keysUrl: string,\n  relayUrl: string,\n  openBrowser: boolean\n): Promise<WSBridge> {\n  const config = loadConfig();\n  const bridge = new WSBridge({\n    relayUrl,\n    session: relaySession.session,\n    timeout: options.timeout,\n    config: {\n      apiKey: options.apiKey,\n      chainId,\n      ens: options.ens ?? config.ens,\n      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url,\n    },\n    privateKeyHex: relaySession.privateKey,\n    publicKeyHex: relaySession.publicKey,\n    peerPublicKeyHex: relaySession.peerPublicKey,\n  });\n\n  await bridge.connect(\n    // onBrowserNeeded — only open a browser for new sessions\n    openBrowser\n      ? async () => {\n          const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);\n          const { default: open } = await import('open');\n          await open(bridgeUrl);\n        }\n      : undefined,\n    // onPeerKeyChanged\n    (newPeerKey) => {\n      relaySession.peerPublicKey = newPeerKey;\n      saveRelaySession(relaySession);\n    }\n  );\n\n  return bridge;\n}\n\nfunction buildBridgeUrl(keysUrl: string, session: string, relayUrl: string, cliPublicKeyHex: string): string {\n  const url = new URL('/cli-bridge', keysUrl);\n  url.searchParams.set('session', session);\n  url.searchParams.set('relay', relayUrl);\n  // CLI public key in fragment — not sent to server\n  url.hash = `pk=${cliPublicKeyHex}`;\n  return url.toString();\n}\n\n/**\n * Shutdown: close the relay session and clean up.\n */\nexport async function shutdownDaemon(): Promise<void> {\n  const session = loadRelaySession();\n  if (!session) return;\n\n  // Send shutdown directly — no init/ready handshake needed\n  try {\n    const bridge = new WSBridge({\n      relayUrl: session.relayUrl,\n      session: session.session,\n      timeout: 5000,\n      config: { apiKey: '', chainId: 1 },\n      privateKeyHex: session.privateKey,\n      publicKeyHex: session.publicKey,\n      peerPublicKeyHex: session.peerPublicKey,\n    });\n    await bridge.connectAndShutdown();\n  } catch {\n    // Best effort — relay or browser may already be gone\n  }\n\n  deleteRelaySession();\n\n  // Legacy cleanup: kill old daemon process and remove files\n  const legacyBridge = PATHS.root + '/bridge.json';\n  const legacyLog = PATHS.root + '/daemon.log';\n  const legacyLock = PATHS.root + '/daemon.lock';\n  try {\n    if (fs.existsSync(legacyBridge)) {\n      const info = JSON.parse(fs.readFileSync(legacyBridge, 'utf-8'));\n      if (info.pid && Number.isInteger(info.pid) && info.pid > 0) {\n        try {\n          process.kill(info.pid, 'SIGTERM');\n        } catch {\n          /* already dead */\n        }\n      }\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const f of [legacyBridge, legacyLog, legacyLock]) {\n    try {\n      if (fs.existsSync(f)) fs.unlinkSync(f);\n    } catch {\n      /* ignore */\n    }\n  }\n}\n","import * as fs from 'node:fs';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { mcpError } from '../helpers.js';\nimport { shutdownDaemon } from '../../lib/bridge-singleton.js';\nimport { PATHS } from '../../lib/paths.js';\nimport { loadConfig, redactConfig } from '../../lib/config.js';\n\nexport function registerDaemonTools(server: McpServer): void {\n  server.tool(\n    'jaw_status',\n    'Check the current status of the JAW.id relay bridge — whether a relay session ' +\n      'exists, the bridge connection is active, and what configuration is in use.',\n    {},\n    async () => {\n      try {\n        let relaySession = false;\n\n        try {\n          if (fs.existsSync(PATHS.relay)) {\n            JSON.parse(fs.readFileSync(PATHS.relay, 'utf-8'));\n            relaySession = true;\n          }\n        } catch {\n          relaySession = false;\n        }\n\n        const config = redactConfig(loadConfig());\n\n        const status = {\n          relay: relaySession ? { session: true } : { session: false },\n          bridgeConnection: 'disconnected',\n          config,\n        };\n\n        return {\n          content: [{ type: 'text' as const, text: JSON.stringify(status, null, 2) }],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n\n  server.tool(\n    'jaw_disconnect',\n    'Close the relay session and browser tab. ' +\n      'Call this when you are done making wallet requests to clean up resources.',\n    {},\n    async () => {\n      try {\n        await shutdownDaemon();\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: 'Relay session closed and browser tab dismissed.',\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n}\n"]}

package/dist/mcp/handlers/resources.js

@@ -38,9 +38,7 @@ function registerResources(server) {
     async (uri, variables) => {
       const method = String(variables.method);
       if (!/^[\w_]+$/.test(method)) {
-        throw new Error(
-          `Invalid method name: "${method}". Expected an RPC method like wallet_sendCalls.`
-        );
+        throw new Error(`Invalid method name: "${method}". Expected an RPC method like wallet_sendCalls.`);
       }
       return {
         contents: [

package/dist/mcp/handlers/resources.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/handlers/resources.ts"],"names":[],"mappings":";;;AAEA,IAAM,SAAA,GAAY,mCAAA;AAElB,eAAe,UAAU,GAAA,EAA8B;AACrD,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAG5B,EAAA,OAAO,KACJ,OAAA,CAAQ,mCAAA,EAAqC,EAAE,CAAA,CAC/C,OAAA,CAAQ,mCAAmC,EAAE,CAAA,CAC7C,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAW,GAAG,CAAA,CACtB,QAAQ,QAAA,EAAU,GAAG,CAAA,CACrB,OAAA,CAAQ,SAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,GAAG,EACpB,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA,CACtB,OAAA,CAAQ,UAAU,GAAG,CAAA,CACrB,QAAQ,SAAA,EAAW,GAAG,EACtB,IAAA,EAAK;AACV;AAEO,SAAS,kBAAkB,MAAA,EAAyB;AAEzD,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,eAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,MACE,WAAA,EACE,yJAAA;AAAA,MAEF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,aAAa;AAAA,MACX,QAAA,EAAU;AAAA,QACR;AAAA,UACE,GAAA,EAAK,qBAAA;AAAA,UACL,QAAA,EAAU,YAAA;AAAA,UACV,IAAA,EAAM,MAAM,SAAA,CAAU,SAAS;AAAA;AACjC;AACF,KACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,sBAAA;AAAA,IACA,IAAI,gBAAA,CAAiB,8BAAA,EAAgC,EAAE,IAAA,EAAM,QAAW,CAAA;AAAA,IACxE;AAAA,MACE,WAAA,EACE,2MAAA;AAAA,MAGF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAO,KAAK,SAAA,KAAc;AACxB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AAGtC,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,yBAAyB,MAAM,CAAA,gDAAA;AAAA,SACjC;AAAA,MACF;AAEA,MAAA,OAAO;AAAA,QACL,QAAA,EAAU;AAAA,UACR;AAAA,YACE,KAAK,GAAA,CAAI,IAAA;AAAA,YACT,QAAA,EAAU,YAAA;AAAA,YACV,MAAM,MAAM,SAAA,CAAU,GAAG,SAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE;AAAA;AAChD;AACF,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"resources.js","sourcesContent":["import { type McpServer, ResourceTemplate } from \"@modelcontextprotocol/sdk/server/mcp.js\";\n\nconst DOCS_BASE = \"https://docs.jaw.id/api-reference\";\n\nasync function fetchDocs(url: string): Promise<string> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);\n  }\n  const html = await res.text();\n  // Strip HTML tags for a readable text representation.\n  // MCP resources are consumed by LLMs, so plain text is ideal.\n  return html\n    .replace(/<script[^>]*>[\\s\\S]*?<\\/script>/gi, \"\")\n    .replace(/<style[^>]*>[\\s\\S]*?<\\/style>/gi, \"\")\n    .replace(/<[^>]+>/g, \" \")\n    .replace(/&nbsp;/g, \" \")\n    .replace(/&amp;/g, \"&\")\n    .replace(/&lt;/g, \"<\")\n    .replace(/&gt;/g, \">\")\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\s{2,}/g, \" \")\n    .trim();\n}\n\nexport function registerResources(server: McpServer): void {\n  // Overview of all RPC methods\n  server.resource(\n    \"api-reference\",\n    \"jaw://api-reference\",\n    {\n      description:\n        \"JAW.id API reference — lists all supported RPC methods with descriptions. \" +\n        \"Read this before using the jaw_rpc tool to understand available methods.\",\n      mimeType: \"text/plain\",\n    },\n    async () => ({\n      contents: [\n        {\n          uri: \"jaw://api-reference\",\n          mimeType: \"text/plain\",\n          text: await fetchDocs(DOCS_BASE),\n        },\n      ],\n    }),\n  );\n\n  // Per-method documentation with parameter details\n  server.resource(\n    \"api-reference-method\",\n    new ResourceTemplate(\"jaw://api-reference/{method}\", { list: undefined }),\n    {\n      description:\n        \"Detailed documentation for a specific RPC method including parameters, \" +\n        \"request/response format, and examples. Use the method name from the \" +\n        \"api-reference overview (e.g. wallet_sendCalls, personal_sign).\",\n      mimeType: \"text/plain\",\n    },\n    async (uri, variables) => {\n      const method = String(variables.method);\n\n      // Validate method name to prevent path traversal (e.g. ../../admin)\n      if (!/^[\\w_]+$/.test(method)) {\n        throw new Error(\n          `Invalid method name: \"${method}\". Expected an RPC method like wallet_sendCalls.`,\n        );\n      }\n\n      return {\n        contents: [\n          {\n            uri: uri.href,\n            mimeType: \"text/plain\",\n            text: await fetchDocs(`${DOCS_BASE}/${method}`),\n          },\n        ],\n      };\n    },\n  );\n}"]}
+{"version":3,"sources":["../../../src/mcp/handlers/resources.ts"],"names":[],"mappings":";;;AAEA,IAAM,SAAA,GAAY,mCAAA;AAElB,eAAe,UAAU,GAAA,EAA8B;AACrD,EAAA,MAAM,GAAA,GAAM,MAAM,KAAA,CAAM,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,GAAA,CAAI,UAAU,CAAA,CAAE,CAAA;AAAA,EACzE;AACA,EAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAG5B,EAAA,OAAO,KACJ,OAAA,CAAQ,mCAAA,EAAqC,EAAE,CAAA,CAC/C,OAAA,CAAQ,mCAAmC,EAAE,CAAA,CAC7C,OAAA,CAAQ,UAAA,EAAY,GAAG,CAAA,CACvB,OAAA,CAAQ,WAAW,GAAG,CAAA,CACtB,QAAQ,QAAA,EAAU,GAAG,CAAA,CACrB,OAAA,CAAQ,SAAS,GAAG,CAAA,CACpB,QAAQ,OAAA,EAAS,GAAG,EACpB,OAAA,CAAQ,SAAA,EAAW,GAAG,CAAA,CACtB,OAAA,CAAQ,UAAU,GAAG,CAAA,CACrB,QAAQ,SAAA,EAAW,GAAG,EACtB,IAAA,EAAK;AACV;AAEO,SAAS,kBAAkB,MAAA,EAAyB;AAEzD,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,eAAA;AAAA,IACA,qBAAA;AAAA,IACA;AAAA,MACE,WAAA,EACE,yJAAA;AAAA,MAEF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,aAAa;AAAA,MACX,QAAA,EAAU;AAAA,QACR;AAAA,UACE,GAAA,EAAK,qBAAA;AAAA,UACL,QAAA,EAAU,YAAA;AAAA,UACV,IAAA,EAAM,MAAM,SAAA,CAAU,SAAS;AAAA;AACjC;AACF,KACF;AAAA,GACF;AAGA,EAAA,MAAA,CAAO,QAAA;AAAA,IACL,sBAAA;AAAA,IACA,IAAI,gBAAA,CAAiB,8BAAA,EAAgC,EAAE,IAAA,EAAM,QAAW,CAAA;AAAA,IACxE;AAAA,MACE,WAAA,EACE,2MAAA;AAAA,MAGF,QAAA,EAAU;AAAA,KACZ;AAAA,IACA,OAAO,KAAK,SAAA,KAAc;AACxB,MAAA,MAAM,MAAA,GAAS,MAAA,CAAO,SAAA,CAAU,MAAM,CAAA;AAGtC,MAAA,IAAI,CAAC,UAAA,CAAW,IAAA,CAAK,MAAM,CAAA,EAAG;AAC5B,QAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,MAAM,CAAA,gDAAA,CAAkD,CAAA;AAAA,MACnG;AAEA,MAAA,OAAO;AAAA,QACL,QAAA,EAAU;AAAA,UACR;AAAA,YACE,KAAK,GAAA,CAAI,IAAA;AAAA,YACT,QAAA,EAAU,YAAA;AAAA,YACV,MAAM,MAAM,SAAA,CAAU,GAAG,SAAS,CAAA,CAAA,EAAI,MAAM,CAAA,CAAE;AAAA;AAChD;AACF,OACF;AAAA,IACF;AAAA,GACF;AACF","file":"resources.js","sourcesContent":["import { type McpServer, ResourceTemplate } from '@modelcontextprotocol/sdk/server/mcp.js';\n\nconst DOCS_BASE = 'https://docs.jaw.id/api-reference';\n\nasync function fetchDocs(url: string): Promise<string> {\n  const res = await fetch(url);\n  if (!res.ok) {\n    throw new Error(`Failed to fetch docs: ${res.status} ${res.statusText}`);\n  }\n  const html = await res.text();\n  // Strip HTML tags for a readable text representation.\n  // MCP resources are consumed by LLMs, so plain text is ideal.\n  return html\n    .replace(/<script[^>]*>[\\s\\S]*?<\\/script>/gi, '')\n    .replace(/<style[^>]*>[\\s\\S]*?<\\/style>/gi, '')\n    .replace(/<[^>]+>/g, ' ')\n    .replace(/&nbsp;/g, ' ')\n    .replace(/&amp;/g, '&')\n    .replace(/&lt;/g, '<')\n    .replace(/&gt;/g, '>')\n    .replace(/&quot;/g, '\"')\n    .replace(/&#39;/g, \"'\")\n    .replace(/\\s{2,}/g, ' ')\n    .trim();\n}\n\nexport function registerResources(server: McpServer): void {\n  // Overview of all RPC methods\n  server.resource(\n    'api-reference',\n    'jaw://api-reference',\n    {\n      description:\n        'JAW.id API reference — lists all supported RPC methods with descriptions. ' +\n        'Read this before using the jaw_rpc tool to understand available methods.',\n      mimeType: 'text/plain',\n    },\n    async () => ({\n      contents: [\n        {\n          uri: 'jaw://api-reference',\n          mimeType: 'text/plain',\n          text: await fetchDocs(DOCS_BASE),\n        },\n      ],\n    })\n  );\n\n  // Per-method documentation with parameter details\n  server.resource(\n    'api-reference-method',\n    new ResourceTemplate('jaw://api-reference/{method}', { list: undefined }),\n    {\n      description:\n        'Detailed documentation for a specific RPC method including parameters, ' +\n        'request/response format, and examples. Use the method name from the ' +\n        'api-reference overview (e.g. wallet_sendCalls, personal_sign).',\n      mimeType: 'text/plain',\n    },\n    async (uri, variables) => {\n      const method = String(variables.method);\n\n      // Validate method name to prevent path traversal (e.g. ../../admin)\n      if (!/^[\\w_]+$/.test(method)) {\n        throw new Error(`Invalid method name: \"${method}\". Expected an RPC method like wallet_sendCalls.`);\n      }\n\n      return {\n        contents: [\n          {\n            uri: uri.href,\n            mimeType: 'text/plain',\n            text: await fetchDocs(`${DOCS_BASE}/${method}`),\n          },\n        ],\n      };\n    }\n  );\n}\n"]}