@jaw.id/cli 0.0.7 → 0.1.0

package/dist/commands/rpc/call.js

@@ -1,5 +1,5 @@
 import { Command, Flags, Args } from '@oclif/core';
-import * as fs2 from 'fs';
+import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
 import * as crypto from 'crypto';
@@ -11,7 +11,9 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
 
 // src/lib/validation.ts
@@ -39,22 +41,39 @@ function isValidRelayUrl(url) {
 
 // src/lib/config.ts
 function ensureDir(dir) {
-  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs2.chmodSync(dir, 448);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
 }
 function loadConfig() {
-  if (!fs2.existsSync(PATHS.config)) {
+  if (!fs.existsSync(PATHS.config)) {
     return {};
   }
-  const raw = fs2.readFileSync(PATHS.config, "utf-8");
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
     );
   }
 }
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
 
 // src/lib/output.ts
 function formatOutput(data, format) {
@@ -127,18 +146,14 @@ var BaseCommand = class extends Command {
   resolveApiKey(flags) {
     const apiKey = flags["api-key"] ?? loadConfig().apiKey;
     if (!apiKey) {
-      this.error(
-        "API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`"
-      );
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
     }
     return apiKey;
   }
   resolveChainId(flags) {
     const chainId = flags.chain ?? loadConfig().defaultChain;
     if (!chainId) {
-      this.error(
-        "Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`"
-      );
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
     }
     return chainId;
   }
@@ -151,11 +166,7 @@ var BaseCommand = class extends Command {
 // src/lib/crypto.ts
 var subtle = globalThis.crypto.subtle;
 async function generateKeyPair() {
-  return subtle.generateKey(
-    { name: "ECDH", namedCurve: "P-256" },
-    true,
-    ["deriveKey"]
-  );
+  return subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
 }
 async function deriveSharedSecret(privateKey, peerPublicKey) {
   return subtle.deriveKey(
@@ -169,11 +180,7 @@ async function deriveSharedSecret(privateKey, peerPublicKey) {
 async function encryptMessage(sharedSecret, payload) {
   const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
   const plaintext = new TextEncoder().encode(JSON.stringify(payload));
-  const cipherBuf = await subtle.encrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    plaintext
-  );
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
   return {
     iv: bufferToBase64(iv),
     ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
@@ -182,11 +189,7 @@ async function encryptMessage(sharedSecret, payload) {
 async function decryptMessage(sharedSecret, envelope) {
   const iv = Buffer.from(envelope.iv, "base64");
   const ciphertext = Buffer.from(envelope.ciphertext, "base64");
-  const plainBuf = await subtle.decrypt(
-    { name: "AES-GCM", iv },
-    sharedSecret,
-    ciphertext
-  );
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
   return JSON.parse(new TextDecoder().decode(plainBuf));
 }
 async function exportKeyToHex(type, key) {
@@ -278,11 +281,7 @@ var WSBridge = class {
       let expectingKeyExchange = !this.peerPublicKeyHex;
       const timer = setTimeout(() => {
         ws.close();
-        reject(
-          new Error(
-            "Browser did not connect in time.\nRun `jaw disconnect` then try again."
-          )
-        );
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
       }, 3e4);
       const sendEncryptedInit = async () => {
         if (!this.sharedSecret) return;
@@ -305,10 +304,7 @@ var WSBridge = class {
           if (!msg) return;
           if (msg.type === "encrypted" && this.sharedSecret) {
             try {
-              const inner = await decryptMessage(
-                this.sharedSecret,
-                msg
-              );
+              const inner = await decryptMessage(this.sharedSecret, msg);
               if (inner.type === "ready") {
                 clearTimeout(readyTimer);
                 ws.off("message", onMsg);
@@ -346,6 +342,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -395,9 +395,7 @@ var WSBridge = class {
     return new Promise((resolve, reject) => {
       const timer = setTimeout(() => {
         reject(
-          new Error(
-            `Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`
-          )
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
         );
         this.close();
       }, this.timeout);
@@ -405,10 +403,7 @@ var WSBridge = class {
         const msg = safeParse(data);
         if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
         try {
-          const inner = await decryptMessage(
-            this.sharedSecret,
-            msg
-          );
+          const inner = await decryptMessage(this.sharedSecret, msg);
           if (inner.type === "rpc_response" && inner.id === id) {
             clearTimeout(timer);
             ws.off("message", onMessage);
@@ -416,11 +411,7 @@ var WSBridge = class {
               resolve(inner.data);
             } else {
               const err = inner.error;
-              reject(
-                new Error(
-                  err ? `[${err.code}] ${err.message}` : "Request failed"
-                )
-              );
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
             }
           }
         } catch {
@@ -430,9 +421,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
@@ -440,10 +428,7 @@ var WSBridge = class {
         const envelope = await encryptMessage(this.sharedSecret, {
           type: "shutdown"
         });
-        this.sendRaw(
-          this.ws,
-          JSON.stringify({ type: "encrypted", ...envelope })
-        );
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
       } catch {
       }
     }
@@ -521,10 +506,8 @@ var WSBridge = class {
     this.reconnectAttempts++;
     setTimeout(() => {
       if (this.disposed) return;
-      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(
-        () => {
-        }
-      );
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
     }, delay);
   }
   /** Send a raw string over the WebSocket, enforcing message size limits. */
@@ -534,10 +517,7 @@ var WSBridge = class {
   async deriveSecret() {
     if (!this.peerPublicKeyHex) return;
     const privateKey = await importKeyFromHex("private", this.privateKeyHex);
-    const peerPublicKey = await importKeyFromHex(
-      "public",
-      this.peerPublicKeyHex
-    );
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
     this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
   }
 };
@@ -563,8 +543,8 @@ var DEFAULT_KEYS_URL = "https://keys.jaw.id";
 var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 function loadRelaySession() {
   try {
-    if (!fs2.existsSync(PATHS.relay)) return null;
-    const raw = fs2.readFileSync(PATHS.relay, "utf-8");
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
       return null;
@@ -576,14 +556,14 @@ function loadRelaySession() {
 }
 function saveRelaySession(info) {
   ensureDir(PATHS.root);
-  fs2.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
 }
 function deleteRelaySession() {
   try {
-    if (fs2.existsSync(PATHS.relay)) fs2.unlinkSync(PATHS.relay);
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
   } catch {
   }
 }
@@ -599,17 +579,19 @@ async function getBridge(options) {
     throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
   }
   let relaySession = loadRelaySession();
-  if (relaySession && relaySession.relayUrl === relayUrl) {
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
     try {
-      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl);
+      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
     } catch {
       deleteRelaySession();
       relaySession = null;
     }
+  } else if (relaySession) {
+    deleteRelaySession();
   }
   const session = await createNewSession(relayUrl);
   saveRelaySession(session);
-  return await connectBridge(session, options, chainId, keysUrl, relayUrl);
+  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
 }
 async function createNewSession(relayUrl) {
   const kp = await generateKeyPair();
@@ -624,7 +606,7 @@ async function createNewSession(relayUrl) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl) {
+async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
   const config = loadConfig();
   const bridge = new WSBridge({
     relayUrl,
@@ -634,19 +616,19 @@ async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl)
       apiKey: options.apiKey,
       chainId,
       ens: options.ens ?? config.ens,
-      paymasterUrl: options.paymasterUrl ?? config.paymasterUrl
+      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
     },
     privateKeyHex: relaySession.privateKey,
     publicKeyHex: relaySession.publicKey,
     peerPublicKeyHex: relaySession.peerPublicKey
   });
   await bridge.connect(
-    // onBrowserNeeded
-    async () => {
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
       const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
       const { default: open } = await import('open');
       await open(bridgeUrl);
-    },
+    } : void 0,
     // onPeerKeyChanged
     (newPeerKey) => {
       relaySession.peerPublicKey = newPeerKey;
@@ -682,16 +664,141 @@ var BROWSER_REQUIRED_METHODS = /* @__PURE__ */ new Set([
 function requiresBrowser(method) {
   return BROWSER_REQUIRED_METHODS.has(method);
 }
+var SESSION_SUPPORTED_METHODS = /* @__PURE__ */ new Set([
+  "eth_requestAccounts",
+  "eth_accounts",
+  "wallet_sendCalls",
+  "wallet_getCallsStatus",
+  "personal_sign",
+  "eth_signTypedData_v4"
+]);
+function supportsSessionMode(method) {
+  return SESSION_SUPPORTED_METHODS.has(method);
+}
+function loadSessionKey() {
+  if (!fs.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+
+// src/lib/session-bridge.ts
+var SessionBridge = class {
+  options;
+  session = null;
+  constructor(options) {
+    this.options = { ...options };
+    if (!this.options.paymasterUrl) {
+      const config = loadConfig();
+      const pm = config.paymasters?.[this.options.chainId];
+      if (pm) {
+        this.options.paymasterUrl = pm.url;
+        this.options.paymasterContext = pm.context;
+      }
+    }
+  }
+  async getSession() {
+    if (this.session) {
+      this.checkExpiry(this.session.config);
+      return this.session;
+    }
+    const config = loadSessionConfig();
+    this.checkExpiry(config);
+    if (config.chainId !== this.options.chainId) {
+      throw new Error(
+        `Session was created for chain ${config.chainId}, but --chain ${this.options.chainId} was requested. Run \`jaw session setup --chain ${this.options.chainId}\` to create a session for that chain.`
+      );
+    }
+    let privateKeyHex = loadSessionKey();
+    const { privateKeyToAccount } = await import('viem/accounts');
+    const localAccount = privateKeyToAccount(privateKeyHex);
+    privateKeyHex = null;
+    const { Account } = await import('@jaw.id/core');
+    const account = await Account.fromLocalAccount(
+      {
+        chainId: this.options.chainId,
+        apiKey: this.options.apiKey,
+        paymasterUrl: this.options.paymasterUrl,
+        paymasterContext: this.options.paymasterContext
+      },
+      localAccount
+    );
+    this.session = { account, config };
+    return this.session;
+  }
+  checkExpiry(config) {
+    if (config.expiry <= Date.now() / 1e3) {
+      const expiryDate = new Date(config.expiry * 1e3).toISOString();
+      throw new Error(`Session expired on ${expiryDate}. Run \`jaw session setup\` to create a new session.`);
+    }
+  }
+  async request(method, params) {
+    const { account, config } = await this.getSession();
+    switch (method) {
+      case "eth_requestAccounts":
+      case "eth_accounts":
+        return [config.sessionAddress];
+      case "wallet_sendCalls": {
+        const payload = Array.isArray(params) ? params[0] : params;
+        const { calls } = payload;
+        return account.sendCalls(calls, {
+          permissionId: config.permissionId
+        });
+      }
+      case "wallet_getCallsStatus": {
+        const batchId = Array.isArray(params) ? params[0] : params;
+        return account.getCallStatus(batchId);
+      }
+      case "personal_sign": {
+        const message = Array.isArray(params) ? params[0] : params;
+        return account.signMessage(message);
+      }
+      case "eth_signTypedData_v4": {
+        const asArray = Array.isArray(params) ? params : [params];
+        const raw = asArray.length > 1 ? asArray[1] : asArray[0];
+        const typedData = typeof raw === "string" ? JSON.parse(raw) : raw;
+        return account.signTypedData(typedData);
+      }
+      case "wallet_grantPermissions":
+        throw new Error("Requires browser \u2014 run `jaw session setup`.");
+      case "wallet_revokePermissions":
+        throw new Error("Requires browser \u2014 run `jaw session revoke`.");
+      default:
+        throw new Error(`Method ${method} is not supported in auto mode.`);
+    }
+  }
+  close() {
+  }
+};
 
 // src/commands/rpc/call.ts
 var RpcCall = class _RpcCall extends BaseCommand {
-  static description = "Execute any JAW.id RPC method via the browser bridge.";
+  static description = "Execute any JAW.id RPC method via the browser bridge or local session key.";
   static examples = [
     `<%= config.bin %> rpc call wallet_sendCalls '{"calls":[{"to":"0x...","value":"0x0"}]}'`,
     `<%= config.bin %> rpc call personal_sign '"Hello World"'`,
     "<%= config.bin %> rpc call wallet_getAssets",
     "<%= config.bin %> rpc call eth_requestAccounts",
-    `<%= config.bin %> rpc call wallet_getCallsStatus '"0x..."'`
+    `<%= config.bin %> rpc call wallet_getCallsStatus '"0x..."'`,
+    `<%= config.bin %> rpc call wallet_sendCalls '{"calls":[...]}' --session`
   ];
   static args = {
     method: Args.string({
@@ -709,6 +816,12 @@ var RpcCall = class _RpcCall extends BaseCommand {
       char: "t",
       description: "Request timeout in seconds",
       default: 120
+    }),
+    session: Flags.boolean({
+      char: "s",
+      description: "Use local session key (auto mode)",
+      default: false,
+      env: "JAW_SESSION"
     })
   };
   async run() {
@@ -725,21 +838,34 @@ var RpcCall = class _RpcCall extends BaseCommand {
     const format = flags.output;
     const config = loadConfig();
     const apiKey = this.resolveApiKey(flags);
-    const bridge = await getBridge({
-      keysUrl: config.keysUrl,
-      apiKey,
-      chainId: flags.chain ?? config.defaultChain,
-      ens: config.ens,
-      paymasterUrl: config.paymasterUrl,
-      timeout: flags.timeout * 1e3
-    });
-    if (!flags.quiet) {
-      if (requiresBrowser(method)) {
-        this.log(
-          `Sending ${method}... Check your browser to approve the request.`
+    const chainId = flags.chain ?? config.defaultChain ?? 1;
+    let bridge;
+    if (flags.session) {
+      if (!supportsSessionMode(method)) {
+        this.error(
+          `Method ${method} is not supported in session mode. Use without --session to route through the browser bridge.`
         );
-      } else {
-        this.log(`Sending ${method}...`);
+      }
+      bridge = new SessionBridge({ apiKey, chainId });
+      if (!flags.quiet) {
+        this.log(`Sending ${method} (session mode)...`);
+      }
+    } else {
+      const pm = config.paymasters?.[chainId];
+      bridge = await getBridge({
+        keysUrl: config.keysUrl,
+        apiKey,
+        chainId,
+        ens: config.ens,
+        paymasterUrl: pm?.url,
+        timeout: flags.timeout * 1e3
+      });
+      if (!flags.quiet) {
+        if (requiresBrowser(method)) {
+          this.log(`Sending ${method}... Check your browser to approve the request.`);
+        } else {
+          this.log(`Sending ${method}...`);
+        }
       }
     }
     try {