@jaw.id/cli 0.0.8 → 0.1.0

package/dist/commands/session/revoke.js

@@ -0,0 +1,727 @@
+import { Command, Flags } from '@oclif/core';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
+import WebSocket from 'ws';
+
+// src/base-command.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
+};
+
+// src/lib/validation.ts
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+function isValidRelayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "wss:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isWebSocket = parsed.protocol === "wss:" || parsed.protocol === "ws:";
+    return isTrustedHost && isSecure && isWebSocket;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+
+// src/lib/crypto.ts
+var subtle = globalThis.crypto.subtle;
+async function generateKeyPair() {
+  return subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
+}
+async function deriveSharedSecret(privateKey, peerPublicKey) {
+  return subtle.deriveKey(
+    { name: "ECDH", public: peerPublicKey },
+    privateKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptMessage(sharedSecret, payload) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
+  return {
+    iv: bufferToBase64(iv),
+    ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
+  };
+}
+async function decryptMessage(sharedSecret, envelope) {
+  const iv = Buffer.from(envelope.iv, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
+  return JSON.parse(new TextDecoder().decode(plainBuf));
+}
+async function exportKeyToHex(type, key) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  const buf = await subtle.exportKey(format, key);
+  return bytesToHex(new Uint8Array(buf));
+}
+async function importKeyFromHex(type, hex) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  return subtle.importKey(
+    format,
+    Buffer.from(hexToBytes(hex)),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    type === "private" ? ["deriveKey"] : []
+  );
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new Error("Invalid hex: odd length");
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+function bufferToBase64(buf) {
+  return Buffer.from(buf).toString("base64");
+}
+
+// src/lib/ws-bridge.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_MESSAGE_BYTES = 5 * 1024 * 1024;
+var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
+var MAX_RECONNECT_ATTEMPTS = 3;
+var RECONNECT_BASE_DELAY_MS = 1e3;
+var WSBridge = class {
+  relayUrl;
+  session;
+  timeout;
+  config;
+  privateKeyHex;
+  publicKeyHex;
+  peerPublicKeyHex;
+  sharedSecret = null;
+  ws = null;
+  disposed = false;
+  // Auto-reopen browser state
+  onBrowserNeeded;
+  onPeerKeyChanged;
+  lastBrowserOpenTime = 0;
+  // Reconnection state
+  reconnectAttempts = 0;
+  /** Updated after key exchange — caller should persist this. */
+  get peerPublicKey() {
+    return this.peerPublicKeyHex;
+  }
+  constructor(options) {
+    this.relayUrl = options.relayUrl;
+    this.session = options.session;
+    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    this.config = options.config;
+    this.privateKeyHex = options.privateKeyHex;
+    this.publicKeyHex = options.publicKeyHex;
+    this.peerPublicKeyHex = options.peerPublicKeyHex;
+  }
+  /**
+   * Connect to the relay and wait for the browser to be ready.
+   *
+   * @param onBrowserNeeded — called when the relay reports no browser connected.
+   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.
+   */
+  async connect(onBrowserNeeded, onPeerKeyChanged) {
+    this.onBrowserNeeded = onBrowserNeeded;
+    this.onPeerKeyChanged = onPeerKeyChanged;
+    if (this.peerPublicKeyHex) {
+      await this.deriveSecret();
+    }
+    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);
+  }
+  async connectInternal(onBrowserNeeded, onPeerKeyChanged) {
+    return new Promise((resolve, reject) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      let browserOpened = false;
+      let resolved = false;
+      let expectingKeyExchange = !this.peerPublicKeyHex;
+      const timer = setTimeout(() => {
+        ws.close();
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
+      }, 3e4);
+      const sendEncryptedInit = async () => {
+        if (!this.sharedSecret) return;
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "init",
+          apiKey: this.config.apiKey,
+          chainId: this.config.chainId,
+          ens: this.config.ens,
+          paymasterUrl: this.config.paymasterUrl
+        });
+        this.sendRaw(ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      };
+      const waitForReady = () => {
+        const readyTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("Browser SDK did not become ready in time."));
+        }, 15e3);
+        const onMsg = async (data) => {
+          const msg = safeParse(data);
+          if (!msg) return;
+          if (msg.type === "encrypted" && this.sharedSecret) {
+            try {
+              const inner = await decryptMessage(this.sharedSecret, msg);
+              if (inner.type === "ready") {
+                clearTimeout(readyTimer);
+                ws.off("message", onMsg);
+                this.reconnectAttempts = 0;
+                resolve();
+              }
+            } catch {
+            }
+          }
+        };
+        ws.on("message", onMsg);
+      };
+      const onBrowserReady = async () => {
+        if (resolved) return;
+        resolved = true;
+        clearTimeout(timer);
+        waitForReady();
+        await sendEncryptedInit();
+      };
+      ws.on("open", () => {
+        this.ws = ws;
+      });
+      ws.on("message", async (data) => {
+        const msg = safeParse(data);
+        if (!msg) return;
+        if (msg.type === "status") {
+          if (msg.browserConnected) {
+            if (this.sharedSecret) {
+              await onBrowserReady();
+            } else {
+              expectingKeyExchange = true;
+            }
+          } else if (!browserOpened && onBrowserNeeded) {
+            browserOpened = true;
+            expectingKeyExchange = true;
+            onBrowserNeeded().catch(() => {
+            });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
+          }
+        } else if (msg.type === "browser_connected") {
+          expectingKeyExchange = true;
+        } else if (msg.type === "browser_disconnected") {
+          this.handleBrowserDisconnect();
+        } else if (msg.type === "key_exchange" && expectingKeyExchange) {
+          expectingKeyExchange = false;
+          const peerKey = msg.publicKey;
+          this.peerPublicKeyHex = peerKey;
+          await this.deriveSecret();
+          onPeerKeyChanged?.(peerKey);
+          await onBrowserReady();
+        }
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+      ws.on("close", () => {
+        clearTimeout(timer);
+        if (!this.disposed) {
+          this.handleRelayDisconnect();
+        }
+      });
+    });
+  }
+  /**
+   * Send an encrypted RPC request through the relay to the browser SDK.
+   */
+  async request(method, params) {
+    const ws = this.ws;
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      throw new Error("Not connected to relay");
+    }
+    if (!this.sharedSecret) {
+      throw new Error("No shared secret \u2014 key exchange not completed");
+    }
+    const id = crypto.randomUUID();
+    const envelope = await encryptMessage(this.sharedSecret, {
+      type: "rpc_request",
+      id,
+      method,
+      params
+    });
+    const serialized = JSON.stringify({ type: "encrypted", ...envelope });
+    assertMessageSize(serialized, method);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
+        );
+        this.close();
+      }, this.timeout);
+      const onMessage = async (data) => {
+        const msg = safeParse(data);
+        if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
+        try {
+          const inner = await decryptMessage(this.sharedSecret, msg);
+          if (inner.type === "rpc_response" && inner.id === id) {
+            clearTimeout(timer);
+            ws.off("message", onMessage);
+            if (inner.success) {
+              resolve(inner.data);
+            } else {
+              const err = inner.error;
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
+            }
+          }
+        } catch {
+        }
+      };
+      ws.on("message", onMessage);
+      this.sendRaw(ws, serialized);
+    });
+  }
+  async shutdown() {
+    this.disposed = true;
+    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
+      try {
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "shutdown"
+        });
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      } catch {
+      }
+    }
+    this.close();
+  }
+  /**
+   * Connect to relay and send shutdown directly — no init/ready handshake.
+   * Used by `jaw disconnect` when we just need to tell the browser to close.
+   */
+  async connectAndShutdown() {
+    if (!this.peerPublicKeyHex) {
+      return;
+    }
+    this.disposed = true;
+    await this.deriveSecret();
+    return new Promise((resolve) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      const timer = setTimeout(() => {
+        try {
+          ws.close();
+        } catch {
+        }
+        resolve();
+      }, 3e3);
+      ws.on("open", async () => {
+        this.ws = ws;
+        try {
+          await this.shutdown();
+        } catch {
+        }
+        clearTimeout(timer);
+        resolve();
+      });
+      ws.on("error", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  }
+  close() {
+    this.disposed = true;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+  /**
+   * Auto-reopen browser when browser_disconnected is received from relay.
+   * Respects a cooldown to prevent rapid re-opening.
+   */
+  handleBrowserDisconnect() {
+    if (this.disposed || !this.onBrowserNeeded) return;
+    const now = Date.now();
+    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {
+      return;
+    }
+    this.lastBrowserOpenTime = now;
+    this.sharedSecret = null;
+    this.peerPublicKeyHex = null;
+    this.onBrowserNeeded().catch(() => {
+    });
+  }
+  /**
+   * Attempt to reconnect to the relay with exponential backoff
+   * when the WebSocket connection drops unexpectedly.
+   */
+  handleRelayDisconnect() {
+    if (this.disposed) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;
+    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);
+    this.reconnectAttempts++;
+    setTimeout(() => {
+      if (this.disposed) return;
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
+    }, delay);
+  }
+  /** Send a raw string over the WebSocket, enforcing message size limits. */
+  sendRaw(ws, data) {
+    ws.send(data);
+  }
+  async deriveSecret() {
+    if (!this.peerPublicKeyHex) return;
+    const privateKey = await importKeyFromHex("private", this.privateKeyHex);
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
+    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
+  }
+};
+function assertMessageSize(serialized, method) {
+  const byteLength = Buffer.byteLength(serialized, "utf-8");
+  if (byteLength > MAX_MESSAGE_BYTES) {
+    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);
+    throw new Error(
+      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). Try reducing the number of calls in your batch.`
+    );
+  }
+}
+function safeParse(data) {
+  try {
+    return JSON.parse(data.toString());
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/bridge-singleton.ts
+var DEFAULT_KEYS_URL = "https://keys.jaw.id";
+var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
+function loadRelaySession() {
+  try {
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveRelaySession(info) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function deleteRelaySession() {
+  try {
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
+  } catch {
+  }
+}
+async function getBridge(options) {
+  const config = loadConfig();
+  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
+  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;
+  const chainId = options.chainId ?? config.defaultChain ?? 1;
+  if (!isValidKeysUrl(keysUrl)) {
+    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
+  }
+  if (!isValidRelayUrl(relayUrl)) {
+    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
+  }
+  let relaySession = loadRelaySession();
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
+    try {
+      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
+    } catch {
+      deleteRelaySession();
+      relaySession = null;
+    }
+  } else if (relaySession) {
+    deleteRelaySession();
+  }
+  const session = await createNewSession(relayUrl);
+  saveRelaySession(session);
+  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
+}
+async function createNewSession(relayUrl) {
+  const kp = await generateKeyPair();
+  const privateKey = await exportKeyToHex("private", kp.privateKey);
+  const publicKey = await exportKeyToHex("public", kp.publicKey);
+  return {
+    session: crypto.randomUUID(),
+    relayUrl,
+    privateKey,
+    publicKey,
+    peerPublicKey: null,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
+  const config = loadConfig();
+  const bridge = new WSBridge({
+    relayUrl,
+    session: relaySession.session,
+    timeout: options.timeout,
+    config: {
+      apiKey: options.apiKey,
+      chainId,
+      ens: options.ens ?? config.ens,
+      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
+    },
+    privateKeyHex: relaySession.privateKey,
+    publicKeyHex: relaySession.publicKey,
+    peerPublicKeyHex: relaySession.peerPublicKey
+  });
+  await bridge.connect(
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
+      const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
+      const { default: open } = await import('open');
+      await open(bridgeUrl);
+    } : void 0,
+    // onPeerKeyChanged
+    (newPeerKey) => {
+      relaySession.peerPublicKey = newPeerKey;
+      saveRelaySession(relaySession);
+    }
+  );
+  return bridge;
+}
+function buildBridgeUrl(keysUrl, session, relayUrl, cliPublicKeyHex) {
+  const url = new URL("/cli-bridge", keysUrl);
+  url.searchParams.set("session", session);
+  url.searchParams.set("relay", relayUrl);
+  url.hash = `pk=${cliPublicKeyHex}`;
+  return url.toString();
+}
+function deleteKeystore() {
+  if (fs.existsSync(PATHS.keystore)) {
+    fs.unlinkSync(PATHS.keystore);
+  }
+}
+function keystoreExists() {
+  return fs.existsSync(PATHS.keystore);
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+function deleteSessionConfig() {
+  if (fs.existsSync(PATHS.sessionConfig)) {
+    fs.unlinkSync(PATHS.sessionConfig);
+  }
+}
+
+// src/commands/session/revoke.ts
+var SessionRevoke = class _SessionRevoke extends BaseCommand {
+  static description = "Revoke on-chain permission and delete local session key.";
+  static flags = {
+    ...BaseCommand.baseFlags
+  };
+  async run() {
+    const { flags } = await this.parse(_SessionRevoke);
+    const format = flags.output;
+    if (!keystoreExists()) {
+      this.log("No session to revoke.");
+      return;
+    }
+    const sessionConfig = loadSessionConfig();
+    const isExpired = sessionConfig.expiry <= Date.now() / 1e3;
+    if (isExpired) {
+      deleteKeystore();
+      deleteSessionConfig();
+      if (format === "json") {
+        this.outputResult({ revoked: true, skippedOnChain: true }, format);
+      } else {
+        this.log("Session already expired. Cleaned up local files.");
+      }
+      return;
+    }
+    const config = loadConfig();
+    const apiKey = this.resolveApiKey(flags);
+    const pm = config.paymasters?.[sessionConfig.chainId];
+    if (!flags.quiet) {
+      this.log("Opening browser to revoke permission...");
+    }
+    const bridge = await getBridge({
+      keysUrl: config.keysUrl,
+      apiKey,
+      chainId: sessionConfig.chainId,
+      ens: config.ens,
+      paymasterUrl: pm?.url
+    });
+    try {
+      await bridge.request("wallet_revokePermissions", [{ id: sessionConfig.permissionId }]);
+    } finally {
+      bridge.close();
+    }
+    deleteKeystore();
+    deleteSessionConfig();
+    if (format === "json") {
+      this.outputResult({ revoked: true, skippedOnChain: false }, format);
+    } else {
+      this.log("Session revoked. On-chain permission removed and local keys deleted.");
+    }
+  }
+};
+
+export { SessionRevoke as default };
+//# sourceMappingURL=revoke.js.map
+//# sourceMappingURL=revoke.js.map