@jaw.id/cli 0.0.7 → 0.1.0

package/dist/commands/config/write.js

@@ -0,0 +1,288 @@
+import * as fs from 'fs';
+import { Command, Flags } from '@oclif/core';
+import * as path from 'path';
+import * as os from 'os';
+
+// src/commands/config/write.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
+};
+
+// src/lib/validation.ts
+var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;
+var HEX_RE = /^0x[0-9a-fA-F]+$/;
+var VALID_SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
+function parsePermissionsConfig(raw) {
+  const errors = [];
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error("Invalid permissions:\n  - Must be an object");
+  }
+  const obj = raw;
+  const calls = obj.calls;
+  const spends = obj.spends;
+  if (!calls && !spends) {
+    throw new Error('Invalid permissions:\n  - Must include at least "calls" or "spends"');
+  }
+  if (calls !== void 0) {
+    if (!Array.isArray(calls) || calls.length === 0) {
+      errors.push("calls: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < calls.length; i++) {
+        const c = calls[i];
+        if (!c || typeof c !== "object") {
+          errors.push(`calls.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof c.target !== "string" || !ADDRESS_RE.test(c.target)) {
+          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (c.selector !== void 0 && (typeof c.selector !== "string" || !SELECTOR_RE.test(c.selector))) {
+          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);
+        }
+      }
+    }
+  }
+  if (spends !== void 0) {
+    if (!Array.isArray(spends) || spends.length === 0) {
+      errors.push("spends: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < spends.length; i++) {
+        const s = spends[i];
+        if (!s || typeof s !== "object") {
+          errors.push(`spends.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof s.token !== "string" || !ADDRESS_RE.test(s.token)) {
+          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (typeof s.allowance !== "string" || !HEX_RE.test(s.allowance)) {
+          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);
+        }
+        if (typeof s.unit !== "string" || !VALID_SPEND_UNITS.has(s.unit)) {
+          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(", ")}`);
+        }
+        if (s.multiplier !== void 0 && (!Number.isInteger(s.multiplier) || s.multiplier < 1)) {
+          errors.push(`spends.${i}.multiplier: Must be a positive integer`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    throw new Error(`Invalid permissions:
+${errors.map((e) => `  - ${e}`).join("\n")}`);
+  }
+  return raw;
+}
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+function isValidRelayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "wss:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isWebSocket = parsed.protocol === "wss:" || parsed.protocol === "ws:";
+    return isTrustedHost && isSecure && isWebSocket;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+
+// src/commands/config/write.ts
+var ConfigWrite = class _ConfigWrite extends BaseCommand {
+  static description = "Write full config from inline JSON or a file path to ~/.jaw/config.json.";
+  static examples = [
+    `<%= config.bin %> config write '{"apiKey":"...","defaultChain":84532}'`,
+    "<%= config.bin %> config write ./jaw-config.json"
+  ];
+  static strict = false;
+  static flags = {
+    ...BaseCommand.baseFlags
+  };
+  async run() {
+    const { argv } = await this.parse(_ConfigWrite);
+    const rawArgs = argv;
+    if (rawArgs.length === 0) {
+      this.error(`Provide inline JSON or a file path.
+Usage: jaw config write '{"apiKey":"..."}'`);
+    }
+    const input = rawArgs.join("").trim();
+    let raw;
+    if (input.startsWith("{")) {
+      raw = input;
+    } else {
+      if (!fs.existsSync(input)) {
+        this.error(`File not found: ${input}`);
+      }
+      raw = fs.readFileSync(input, "utf-8");
+    }
+    let config;
+    try {
+      config = JSON.parse(raw);
+    } catch {
+      try {
+        const compact = raw.replace(/\s+/g, "");
+        config = JSON.parse(compact);
+      } catch {
+        this.error("Invalid JSON");
+      }
+    }
+    if (config.keysUrl && !isValidKeysUrl(config.keysUrl)) {
+      this.error(`Untrusted keysUrl: ${config.keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
+    }
+    if (config.relayUrl && !isValidRelayUrl(config.relayUrl)) {
+      this.error(`Untrusted relayUrl: ${config.relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
+    }
+    if (config.permissions) {
+      try {
+        parsePermissionsConfig(config.permissions);
+      } catch (error) {
+        this.error(error.message);
+      }
+    }
+    saveConfig(config);
+    this.log("Config written to ~/.jaw/config.json");
+  }
+};
+
+export { ConfigWrite as default };
+//# sourceMappingURL=write.js.map
+//# sourceMappingURL=write.js.map

package/dist/commands/config/write.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/lib/output.ts","../../../src/base-command.ts","../../../src/commands/config/write.ts"],"names":["fs2"],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;ACVA,IAAM,UAAA,GAAa,qBAAA;AACnB,IAAM,WAAA,GAAc,oBAAA;AACpB,IAAM,MAAA,GAAS,kBAAA;AACf,IAAM,iBAAA,mBAAoB,IAAI,GAAA,CAAI,CAAC,QAAA,EAAU,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAQ,OAAA,EAAS,MAAA,EAAQ,SAAS,CAAC,CAAA;AAExF,SAAS,uBAAuB,GAAA,EAAiC;AACtE,EAAA,MAAM,SAAmB,EAAC;AAE1B,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,GAAA,KAAQ,QAAQ,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,EAAG;AACjE,IAAA,MAAM,IAAI,MAAM,6CAA6C,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,GAAA,GAAM,GAAA;AACZ,EAAA,MAAM,QAAQ,GAAA,CAAI,KAAA;AAClB,EAAA,MAAM,SAAS,GAAA,CAAI,MAAA;AAEnB,EAAA,IAAI,CAAC,KAAA,IAAS,CAAC,MAAA,EAAQ;AACrB,IAAA,MAAM,IAAI,MAAM,qEAAqE,CAAA;AAAA,EACvF;AAEA,EAAA,IAAI,UAAU,MAAA,EAAW;AACvB,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC/C,MAAA,MAAA,CAAO,KAAK,kCAAkC,CAAA;AAAA,IAChD,CAAA,MAAO;AACL,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,KAAA,CAAM,QAAQ,CAAA,EAAA,EAAK;AACrC,QAAA,MAAM,CAAA,GAAI,MAAM,CAAC,CAAA;AACjB,QAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU;AAC/B,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,MAAA,EAAS,CAAC,CAAA,mBAAA,CAAqB,CAAA;AAC3C,UAAA;AAAA,QACF;AACA,QAAA,IAAI,OAAO,EAAE,MAAA,KAAW,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,MAAM,CAAA,EAAG;AAC9D,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,MAAA,EAAS,CAAC,CAAA,kDAAA,CAAoD,CAAA;AAAA,QAC5E;AACA,QAAA,IAAI,CAAA,CAAE,QAAA,KAAa,MAAA,KAAc,OAAO,CAAA,CAAE,QAAA,KAAa,QAAA,IAAY,CAAC,WAAA,CAAY,IAAA,CAAK,CAAA,CAAE,QAAQ,CAAA,CAAA,EAAI;AACjG,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,MAAA,EAAS,CAAC,CAAA,0DAAA,CAA4D,CAAA;AAAA,QACpF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,WAAW,MAAA,EAAW;AACxB,IAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA,IAAK,MAAA,CAAO,WAAW,CAAA,EAAG;AACjD,MAAA,MAAA,CAAO,KAAK,mCAAmC,CAAA;AAAA,IACjD,CAAA,MAAO;AACL,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,MAAA,CAAO,QAAQ,CAAA,EAAA,EAAK;AACtC,QAAA,MAAM,CAAA,GAAI,OAAO,CAAC,CAAA;AAClB,QAAA,IAAI,CAAC,CAAA,IAAK,OAAO,CAAA,KAAM,QAAA,EAAU;AAC/B,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,OAAA,EAAU,CAAC,CAAA,mBAAA,CAAqB,CAAA;AAC5C,UAAA;AAAA,QACF;AACA,QAAA,IAAI,OAAO,EAAE,KAAA,KAAU,QAAA,IAAY,CAAC,UAAA,CAAW,IAAA,CAAK,CAAA,CAAE,KAAK,CAAA,EAAG;AAC5D,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,OAAA,EAAU,CAAC,CAAA,iDAAA,CAAmD,CAAA;AAAA,QAC5E;AACA,QAAA,IAAI,OAAO,EAAE,SAAA,KAAc,QAAA,IAAY,CAAC,MAAA,CAAO,IAAA,CAAK,CAAA,CAAE,SAAS,CAAA,EAAG;AAChE,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,OAAA,EAAU,CAAC,CAAA,4CAAA,CAA8C,CAAA;AAAA,QACvE;AACA,QAAA,IAAI,OAAO,EAAE,IAAA,KAAS,QAAA,IAAY,CAAC,iBAAA,CAAkB,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,EAAG;AAChE,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,OAAA,EAAU,CAAC,CAAA,uBAAA,EAA0B,CAAC,GAAG,iBAAiB,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,QACtF;AACA,QAAA,IAAI,CAAA,CAAE,UAAA,KAAe,MAAA,KAAc,CAAC,MAAA,CAAO,SAAA,CAAU,CAAA,CAAE,UAAU,CAAA,IAAM,CAAA,CAAE,UAAA,GAAwB,CAAA,CAAA,EAAI;AACnG,UAAA,MAAA,CAAO,IAAA,CAAK,CAAA,OAAA,EAAU,CAAC,CAAA,uCAAA,CAAyC,CAAA;AAAA,QAClE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,MAAA,CAAO,SAAS,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA;AAAA,EAAyB,MAAA,CAAO,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,IAAA,EAAO,CAAC,CAAA,CAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,EACrF;AAEA,EAAA,OAAO,GAAA;AACT;AAEO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACxG,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACtG,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACtE,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACnGO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;ACvCO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF,CAAA;;;ACjDA,IAAqB,WAAA,GAArB,MAAqB,YAAA,SAAoB,WAAA,CAAY;AAAA,EACnD,OAAgB,WAAA,GAAc,0EAAA;AAAA,EAE9B,OAAgB,QAAA,GAAW;AAAA,IACzB,CAAA,sEAAA,CAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,OAAgB,MAAA,GAAS,KAAA;AAAA,EAEzB,OAAgB,KAAA,GAAQ;AAAA,IACtB,GAAG,WAAA,CAAY;AAAA,GACjB;AAAA,EAEA,MAAM,GAAA,GAAqB;AACzB,IAAA,MAAM,EAAE,IAAA,EAAK,GAAI,MAAM,IAAA,CAAK,MAAM,YAAW,CAAA;AAC7C,IAAA,MAAM,OAAA,GAAU,IAAA;AAEhB,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,IAAA,CAAK,KAAA,CAAM,CAAA;AAAA,0CAAA,CAAmF,CAAA;AAAA,IAChG;AAGA,IAAA,MAAM,KAAA,GAAQ,OAAA,CAAQ,IAAA,CAAK,EAAE,EAAE,IAAA,EAAK;AAEpC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,EAAG;AACzB,MAAA,GAAA,GAAM,KAAA;AAAA,IACR,CAAA,MAAO;AACL,MAAA,IAAI,CAAIA,EAAA,CAAA,UAAA,CAAW,KAAK,CAAA,EAAG;AACzB,QAAA,IAAA,CAAK,KAAA,CAAM,CAAA,gBAAA,EAAmB,KAAK,CAAA,CAAE,CAAA;AAAA,MACvC;AACA,MAAA,GAAA,GAASA,EAAA,CAAA,YAAA,CAAa,OAAO,OAAO,CAAA;AAAA,IACtC;AAEA,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,MAAA,GAAS,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,IACzB,CAAA,CAAA,MAAQ;AAEN,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AACtC,QAAA,MAAA,GAAS,IAAA,CAAK,MAAM,OAAO,CAAA;AAAA,MAC7B,CAAA,CAAA,MAAQ;AACN,QAAA,IAAA,CAAK,MAAM,cAAc,CAAA;AAAA,MAC3B;AAAA,IACF;AAEA,IAAA,IAAI,OAAO,OAAA,IAAW,CAAC,cAAA,CAAe,MAAA,CAAO,OAAO,CAAA,EAAG;AACrD,MAAA,IAAA,CAAK,KAAA,CAAM,CAAA,mBAAA,EAAsB,MAAA,CAAO,OAAO,CAAA,iDAAA,CAAmD,CAAA;AAAA,IACpG;AACA,IAAA,IAAI,OAAO,QAAA,IAAY,CAAC,eAAA,CAAgB,MAAA,CAAO,QAAQ,CAAA,EAAG;AACxD,MAAA,IAAA,CAAK,KAAA,CAAM,CAAA,oBAAA,EAAuB,MAAA,CAAO,QAAQ,CAAA,2CAAA,CAA6C,CAAA;AAAA,IAChG;AACA,IAAA,IAAI,OAAO,WAAA,EAAa;AACtB,MAAA,IAAI;AACF,QAAA,sBAAA,CAAuB,OAAO,WAAW,CAAA;AAAA,MAC3C,SAAS,KAAA,EAAO;AACd,QAAA,IAAA,CAAK,KAAA,CAAO,MAAgB,OAAO,CAAA;AAAA,MACrC;AAAA,IACF;AAEA,IAAA,UAAA,CAAW,MAAM,CAAA;AACjB,IAAA,IAAA,CAAK,IAAI,sCAAsC,CAAA;AAAA,EACjD;AACF","file":"write.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import type { PermissionsConfig } from './types.js';\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;\nconst HEX_RE = /^0x[0-9a-fA-F]+$/;\nconst VALID_SPEND_UNITS = new Set(['minute', 'hour', 'day', 'week', 'month', 'year', 'forever']);\n\nexport function parsePermissionsConfig(raw: unknown): PermissionsConfig {\n  const errors: string[] = [];\n\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw new Error('Invalid permissions:\\n  - Must be an object');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const calls = obj.calls as unknown[] | undefined;\n  const spends = obj.spends as unknown[] | undefined;\n\n  if (!calls && !spends) {\n    throw new Error('Invalid permissions:\\n  - Must include at least \"calls\" or \"spends\"');\n  }\n\n  if (calls !== undefined) {\n    if (!Array.isArray(calls) || calls.length === 0) {\n      errors.push('calls: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < calls.length; i++) {\n        const c = calls[i] as Record<string, unknown>;\n        if (!c || typeof c !== 'object') {\n          errors.push(`calls.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof c.target !== 'string' || !ADDRESS_RE.test(c.target)) {\n          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (c.selector !== undefined && (typeof c.selector !== 'string' || !SELECTOR_RE.test(c.selector))) {\n          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);\n        }\n      }\n    }\n  }\n\n  if (spends !== undefined) {\n    if (!Array.isArray(spends) || spends.length === 0) {\n      errors.push('spends: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < spends.length; i++) {\n        const s = spends[i] as Record<string, unknown>;\n        if (!s || typeof s !== 'object') {\n          errors.push(`spends.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof s.token !== 'string' || !ADDRESS_RE.test(s.token)) {\n          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (typeof s.allowance !== 'string' || !HEX_RE.test(s.allowance)) {\n          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);\n        }\n        if (typeof s.unit !== 'string' || !VALID_SPEND_UNITS.has(s.unit)) {\n          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(', ')}`);\n        }\n        if (s.multiplier !== undefined && (!Number.isInteger(s.multiplier) || (s.multiplier as number) < 1)) {\n          errors.push(`spends.${i}.multiplier: Must be a positive integer`);\n        }\n      }\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Invalid permissions:\\n${errors.map((e) => `  - ${e}`).join('\\n')}`);\n  }\n\n  return raw as PermissionsConfig;\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'https:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'wss:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    const isWebSocket = parsed.protocol === 'wss:' || parsed.protocol === 'ws:';\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n","import * as fs from 'node:fs';\nimport { BaseCommand } from '../../base-command.js';\nimport { saveConfig } from '../../lib/config.js';\nimport type { JawConfig } from '../../lib/types.js';\nimport { isValidKeysUrl, isValidRelayUrl, parsePermissionsConfig } from '../../lib/validation.js';\n\nexport default class ConfigWrite extends BaseCommand {\n  static override description = 'Write full config from inline JSON or a file path to ~/.jaw/config.json.';\n\n  static override examples = [\n    '<%= config.bin %> config write \\'{\"apiKey\":\"...\",\"defaultChain\":84532}\\'',\n    '<%= config.bin %> config write ./jaw-config.json',\n  ];\n\n  static override strict = false;\n\n  static override flags = {\n    ...BaseCommand.baseFlags,\n  };\n\n  async run(): Promise<void> {\n    const { argv } = await this.parse(ConfigWrite);\n    const rawArgs = argv as string[];\n\n    if (rawArgs.length === 0) {\n      this.error('Provide inline JSON or a file path.\\nUsage: jaw config write \\'{\"apiKey\":\"...\"}\\'');\n    }\n\n    // Join all args (handles terminal line wrapping)\n    const input = rawArgs.join('').trim();\n\n    let raw: string;\n    if (input.startsWith('{')) {\n      raw = input;\n    } else {\n      if (!fs.existsSync(input)) {\n        this.error(`File not found: ${input}`);\n      }\n      raw = fs.readFileSync(input, 'utf-8');\n    }\n\n    let config: JawConfig;\n    try {\n      config = JSON.parse(raw) as JawConfig;\n    } catch {\n      // Terminal wrapping may insert spaces/newlines inside strings — try removing all whitespace\n      try {\n        const compact = raw.replace(/\\s+/g, '');\n        config = JSON.parse(compact) as JawConfig;\n      } catch {\n        this.error('Invalid JSON');\n      }\n    }\n\n    if (config.keysUrl && !isValidKeysUrl(config.keysUrl)) {\n      this.error(`Untrusted keysUrl: ${config.keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n    }\n    if (config.relayUrl && !isValidRelayUrl(config.relayUrl)) {\n      this.error(`Untrusted relayUrl: ${config.relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);\n    }\n    if (config.permissions) {\n      try {\n        parsePermissionsConfig(config.permissions);\n      } catch (error) {\n        this.error((error as Error).message);\n      }\n    }\n\n    saveConfig(config);\n    this.log('Config written to ~/.jaw/config.json');\n  }\n}\n"]}

package/dist/commands/disconnect.js

@@ -11,23 +11,46 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
 
 // src/lib/config.ts
+function ensureDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
 function loadConfig() {
   if (!fs2.existsSync(PATHS.config)) {
     return {};
   }
   const raw = fs2.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
     );
   }
 }
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs2.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
 
 // src/lib/output.ts
 function formatOutput(data, format) {
@@ -100,18 +123,14 @@ var BaseCommand = class extends Command {
   resolveApiKey(flags) {
     const apiKey = flags["api-key"] ?? loadConfig().apiKey;
     if (!apiKey) {
-      this.error(
-        "API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`"
-      );
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
     }
     return apiKey;
   }
   resolveChainId(flags) {
     const chainId = flags.chain ?? loadConfig().defaultChain;
     if (!chainId) {
-      this.error(
-        "Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`"
-      );
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
     }
     return chainId;
   }
@@ -135,11 +154,7 @@ async function deriveSharedSecret(privateKey, peerPublicKey) {
 async function encryptMessage(sharedSecret, payload) {
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-  const cipherBuf = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    plaintext
-  );
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
   return {
     iv: bufferToBase64(iv),
     ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
@@ -148,11 +163,7 @@ async function encryptMessage(sharedSecret, payload) {
 async function decryptMessage(sharedSecret, envelope) {
   const iv = Buffer.from(envelope.iv, "base64");
   const ciphertext = Buffer.from(envelope.ciphertext, "base64");
-  const plainBuf = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    ciphertext
-  );
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
   return JSON.parse(new TextDecoder().decode(plainBuf));
 }
 async function importKeyFromHex(type, hex) {
@@ -236,11 +247,7 @@ var WSBridge = class {
       let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
-        reject(
-          new Error(
-            "Browser did not connect in time.\nRun `jaw disconnect` then try again."
-          )
-        );
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
       }, 3e4);
       const sendEncryptedInit = async () => {
         if (!this.sharedSecret) return;
@@ -263,10 +270,7 @@ var WSBridge = class {
           if (!msg) return;
           if (msg.type === "encrypted" && this.sharedSecret) {
             try {
-              const inner = await decryptMessage(
-                this.sharedSecret,
-                msg
-              );
+              const inner = await decryptMessage(this.sharedSecret, msg);
               if (inner.type === "ready") {
                 clearTimeout(readyTimer);
                 ws.off("message", onMsg);
@@ -304,6 +308,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -353,9 +361,7 @@ var WSBridge = class {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new Error(
-            `Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`
-          )
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
         );
         this.close();
       }, this.timeout);
@@ -363,10 +369,7 @@ var WSBridge = class {
         const msg = safeParse(data);
         if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
         try {
-          const inner = await decryptMessage(
-            this.sharedSecret,
-            msg
-          );
+          const inner = await decryptMessage(this.sharedSecret, msg);
           if (inner.type === "rpc_response" && inner.id === id) {
             clearTimeout(timer);
             ws.off("message", onMessage);
@@ -374,11 +377,7 @@ var WSBridge = class {
               resolve(inner.data);
             } else {
               const err = inner.error;
-              reject(
-                new Error(
-                  err ? `[${err.code}] ${err.message}` : "Request failed"
-                )
-              );
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
             }
           }
         } catch {
@@ -388,9 +387,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
@@ -398,10 +394,7 @@ var WSBridge = class {
         const envelope = await encryptMessage(this.sharedSecret, {
           type: "shutdown"
         });
-        this.sendRaw(
-          this.ws,
-          JSON.stringify({ type: "encrypted", ...envelope })
-        );
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
       } catch {
       }
     }
@@ -479,10 +472,8 @@ var WSBridge = class {
     this.reconnectAttempts++;
     setTimeout(() => {
       if (this.disposed) return;
-      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(
-        () => {
-        }
-      );
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
     }, delay);
   }
   /** Send a raw string over the WebSocket, enforcing message size limits. */
@@ -492,10 +483,7 @@ var WSBridge = class {
   async deriveSecret() {
     if (!this.peerPublicKeyHex) return;
     const privateKey = await importKeyFromHex("private", this.privateKeyHex);
-    const peerPublicKey = await importKeyFromHex(
-      "public",
-      this.peerPublicKeyHex
-    );
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
     this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
   }
 };