@jaw.id/cli 0.0.7 → 0.1.0

package/dist/mcp/server.js

@@ -15,12 +15,10 @@ var rpcMethodSchema = {
   params: z.any().optional().describe(
     "Method parameters \u2014 structure varies by method. Read the jaw://api-reference/{method} resource for the expected format."
   ),
-  chainId: z.number().optional().describe(
-    "Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia"
-  )
+  chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia")
 };
 var configSetSchema = {
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "paymasterUrl", "ens", "relayUrl"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl"]).describe("Config key"),
   value: z.string().describe("Config value")
 };
 
@@ -51,7 +49,9 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
 
 // src/lib/validation.ts
@@ -82,13 +82,23 @@ function ensureDir(dir) {
   fs2.mkdirSync(dir, { recursive: true, mode: 448 });
   fs2.chmodSync(dir, 448);
 }
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
 function loadConfig() {
   if (!fs2.existsSync(PATHS.config)) {
     return {};
   }
   const raw = fs2.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
@@ -110,14 +120,10 @@ function redactConfig(config) {
 }
 function setConfigValue(key, value) {
   if (key === "keysUrl" && typeof value === "string" && !isValidKeysUrl(value)) {
-    throw new Error(
-      `Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`
-    );
+    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
   }
   if (key === "relayUrl" && typeof value === "string" && !isValidRelayUrl(value)) {
-    throw new Error(
-      `Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`
-    );
+    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);
   }
   const config = loadConfig();
   const updated = { ...config, [key]: value };
@@ -127,11 +133,7 @@ function setConfigValue(key, value) {
 // src/lib/crypto.ts
 var subtle = globalThis.crypto.subtle;
 async function generateKeyPair() {
-  return subtle.generateKey(
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    ["deriveKey"]
-  );
+  return subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
 }
 async function deriveSharedSecret(privateKey, peerPublicKey) {
   return subtle.deriveKey(
@@ -145,11 +147,7 @@ async function deriveSharedSecret(privateKey, peerPublicKey) {
 async function encryptMessage(sharedSecret, payload) {
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-  const cipherBuf = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    plaintext
-  );
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
   return {
     iv: bufferToBase64(iv),
     ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
@@ -158,11 +156,7 @@ async function encryptMessage(sharedSecret, payload) {
 async function decryptMessage(sharedSecret, envelope) {
   const iv = Buffer.from(envelope.iv, "base64");
   const ciphertext = Buffer.from(envelope.ciphertext, "base64");
-  const plainBuf = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    ciphertext
-  );
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
   return JSON.parse(new TextDecoder().decode(plainBuf));
 }
 async function exportKeyToHex(type, key) {
@@ -254,11 +248,7 @@ var WSBridge = class {
       let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
-        reject(
-          new Error(
-            "Browser did not connect in time.\nRun `jaw disconnect` then try again."
-          )
-        );
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
       }, 3e4);
       const sendEncryptedInit = async () => {
         if (!this.sharedSecret) return;
@@ -281,10 +271,7 @@ var WSBridge = class {
           if (!msg) return;
           if (msg.type === "encrypted" && this.sharedSecret) {
             try {
-              const inner = await decryptMessage(
-                this.sharedSecret,
-                msg
-              );
+              const inner = await decryptMessage(this.sharedSecret, msg);
               if (inner.type === "ready") {
                 clearTimeout(readyTimer);
                 ws.off("message", onMsg);
@@ -322,6 +309,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -371,9 +362,7 @@ var WSBridge = class {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new Error(
-            `Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`
-          )
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
         );
         this.close();
       }, this.timeout);
@@ -381,10 +370,7 @@ var WSBridge = class {
         const msg = safeParse(data);
         if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
         try {
-          const inner = await decryptMessage(
-            this.sharedSecret,
-            msg
-          );
+          const inner = await decryptMessage(this.sharedSecret, msg);
           if (inner.type === "rpc_response" && inner.id === id) {
             clearTimeout(timer);
             ws.off("message", onMessage);
@@ -392,11 +378,7 @@ var WSBridge = class {
               resolve(inner.data);
             } else {
               const err = inner.error;
-              reject(
-                new Error(
-                  err ? `[${err.code}] ${err.message}` : "Request failed"
-                )
-              );
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
             }
           }
         } catch {
@@ -406,9 +388,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
@@ -416,10 +395,7 @@ var WSBridge = class {
         const envelope = await encryptMessage(this.sharedSecret, {
           type: "shutdown"
         });
-        this.sendRaw(
-          this.ws,
-          JSON.stringify({ type: "encrypted", ...envelope })
-        );
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
       } catch {
       }
     }
@@ -497,10 +473,8 @@ var WSBridge = class {
     this.reconnectAttempts++;
     setTimeout(() => {
       if (this.disposed) return;
-      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(
-        () => {
-        }
-      );
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
     }, delay);
   }
   /** Send a raw string over the WebSocket, enforcing message size limits. */
@@ -510,10 +484,7 @@ var WSBridge = class {
   async deriveSecret() {
     if (!this.peerPublicKeyHex) return;
     const privateKey = await importKeyFromHex("private", this.privateKeyHex);
-    const peerPublicKey = await importKeyFromHex(
-      "public",
-      this.peerPublicKeyHex
-    );
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
     this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
   }
 };
@@ -575,17 +546,19 @@ async function getBridge(options) {
     throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
   }
   let relaySession = loadRelaySession();
-  if (relaySession && relaySession.relayUrl === relayUrl) {
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
     try {
-      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl);
+      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
     } catch {
       deleteRelaySession();
       relaySession = null;
     }
+  } else if (relaySession) {
+    deleteRelaySession();
   }
   const session = await createNewSession(relayUrl);
   saveRelaySession(session);
-  return await connectBridge(session, options, chainId, keysUrl, relayUrl);
+  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
 }
 async function createNewSession(relayUrl) {
   const kp = await generateKeyPair();
@@ -600,7 +573,7 @@ async function createNewSession(relayUrl) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl) {
+async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
   const config = loadConfig();
   const bridge = new WSBridge({
     relayUrl,
@@ -610,19 +583,19 @@ async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl)
       apiKey: options.apiKey,
       chainId,
       ens: options.ens ?? config.ens,
-      paymasterUrl: options.paymasterUrl ?? config.paymasterUrl
+      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
     },
     privateKeyHex: relaySession.privateKey,
     publicKeyHex: relaySession.publicKey,
     peerPublicKeyHex: relaySession.peerPublicKey
   });
   await bridge.connect(
-    // onBrowserNeeded
-    async () => {
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
       const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
       const { default: open } = await import('open');
       await open(bridgeUrl);
-    },
+    } : void 0,
     // onPeerKeyChanged
     (newPeerKey) => {
       relaySession.peerPublicKey = newPeerKey;
@@ -682,9 +655,7 @@ async function shutdownDaemon() {
 function resolveApiKey() {
   const apiKey = process.env["JAW_API_KEY"] ?? loadConfig().apiKey;
   if (!apiKey) {
-    throw new Error(
-      "API key required. Set JAW_API_KEY env var or run: jaw config set apiKey <key>"
-    );
+    throw new Error("API key required. Set JAW_API_KEY env var or run: jaw config set apiKey <key>");
   }
   return apiKey;
 }
@@ -696,12 +667,14 @@ function registerRpcTool(server) {
     async (params) => {
       const config = loadConfig();
       const apiKey = resolveApiKey();
+      const chainId = params.chainId ?? config.defaultChain ?? 1;
+      const pm = config.paymasters?.[chainId];
       const bridge = await getBridge({
         keysUrl: config.keysUrl,
         apiKey,
-        chainId: params.chainId ?? config.defaultChain,
+        chainId,
         ens: config.ens,
-        paymasterUrl: config.paymasterUrl
+        paymasterUrl: pm?.url
       });
       try {
         const result = await bridge.request(params.method, params.params);
@@ -717,26 +690,19 @@ function registerRpcTool(server) {
 
 // src/mcp/handlers/config.ts
 function registerConfigTools(server) {
-  server.tool(
-    "jaw_config_show",
-    "Show current CLI configuration (API key redacted).",
-    {},
-    async () => {
-      try {
-        const config = redactConfig(loadConfig());
-        return {
-          content: [
-            { type: "text", text: JSON.stringify(config) }
-          ]
-        };
-      } catch (err) {
-        return mcpError(err);
-      }
+  server.tool("jaw_config_show", "Show current CLI configuration (API key redacted).", {}, async () => {
+    try {
+      const config = redactConfig(loadConfig());
+      return {
+        content: [{ type: "text", text: JSON.stringify(config) }]
+      };
+    } catch (err) {
+      return mcpError(err);
     }
-  );
+  });
   server.tool(
     "jaw_config_set",
-    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens, relayUrl).",
+    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, ens, relayUrl).",
     configSetSchema,
     async (params) => {
       try {
@@ -786,9 +752,7 @@ function registerDaemonTools(server) {
           config
         };
         return {
-          content: [
-            { type: "text", text: JSON.stringify(status, null, 2) }
-          ]
+          content: [{ type: "text", text: JSON.stringify(status, null, 2) }]
         };
       } catch (err) {
         return mcpError(err);
@@ -853,9 +817,7 @@ function registerResources(server) {
     async (uri, variables) => {
       const method = String(variables.method);
       if (!/^[\w_]+$/.test(method)) {
-        throw new Error(
-          `Invalid method name: "${method}". Expected an RPC method like wallet_sendCalls.`
-        );
+        throw new Error(`Invalid method name: "${method}". Expected an RPC method like wallet_sendCalls.`);
       }
       return {
         contents: [