@jaw.id/cli 0.0.8 → 0.1.0

package/dist/commands/session/setup.js

@@ -0,0 +1,960 @@
+import { Command, Flags } from '@oclif/core';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
+import WebSocket from 'ws';
+
+// src/commands/session/setup.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
+};
+
+// src/lib/validation.ts
+var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;
+var HEX_RE = /^0x[0-9a-fA-F]+$/;
+var VALID_SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
+function parsePermissionsConfig(raw) {
+  const errors = [];
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error("Invalid permissions:\n  - Must be an object");
+  }
+  const obj = raw;
+  const calls = obj.calls;
+  const spends = obj.spends;
+  if (!calls && !spends) {
+    throw new Error('Invalid permissions:\n  - Must include at least "calls" or "spends"');
+  }
+  if (calls !== void 0) {
+    if (!Array.isArray(calls) || calls.length === 0) {
+      errors.push("calls: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < calls.length; i++) {
+        const c = calls[i];
+        if (!c || typeof c !== "object") {
+          errors.push(`calls.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof c.target !== "string" || !ADDRESS_RE.test(c.target)) {
+          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (c.selector !== void 0 && (typeof c.selector !== "string" || !SELECTOR_RE.test(c.selector))) {
+          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);
+        }
+      }
+    }
+  }
+  if (spends !== void 0) {
+    if (!Array.isArray(spends) || spends.length === 0) {
+      errors.push("spends: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < spends.length; i++) {
+        const s = spends[i];
+        if (!s || typeof s !== "object") {
+          errors.push(`spends.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof s.token !== "string" || !ADDRESS_RE.test(s.token)) {
+          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (typeof s.allowance !== "string" || !HEX_RE.test(s.allowance)) {
+          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);
+        }
+        if (typeof s.unit !== "string" || !VALID_SPEND_UNITS.has(s.unit)) {
+          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(", ")}`);
+        }
+        if (s.multiplier !== void 0 && (!Number.isInteger(s.multiplier) || s.multiplier < 1)) {
+          errors.push(`spends.${i}.multiplier: Must be a positive integer`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    throw new Error(`Invalid permissions:
+${errors.map((e) => `  - ${e}`).join("\n")}`);
+  }
+  return raw;
+}
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+function isValidRelayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "wss:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isWebSocket = parsed.protocol === "wss:" || parsed.protocol === "ws:";
+    return isTrustedHost && isSecure && isWebSocket;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+
+// src/lib/crypto.ts
+var subtle = globalThis.crypto.subtle;
+async function generateKeyPair() {
+  return subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
+}
+async function deriveSharedSecret(privateKey, peerPublicKey) {
+  return subtle.deriveKey(
+    { name: "ECDH", public: peerPublicKey },
+    privateKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptMessage(sharedSecret, payload) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
+  return {
+    iv: bufferToBase64(iv),
+    ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
+  };
+}
+async function decryptMessage(sharedSecret, envelope) {
+  const iv = Buffer.from(envelope.iv, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
+  return JSON.parse(new TextDecoder().decode(plainBuf));
+}
+async function exportKeyToHex(type, key) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  const buf = await subtle.exportKey(format, key);
+  return bytesToHex(new Uint8Array(buf));
+}
+async function importKeyFromHex(type, hex) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  return subtle.importKey(
+    format,
+    Buffer.from(hexToBytes(hex)),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    type === "private" ? ["deriveKey"] : []
+  );
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new Error("Invalid hex: odd length");
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+function bufferToBase64(buf) {
+  return Buffer.from(buf).toString("base64");
+}
+
+// src/lib/ws-bridge.ts
+var DEFAULT_TIMEOUT_MS = 12e4;
+var MAX_MESSAGE_BYTES = 5 * 1024 * 1024;
+var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
+var MAX_RECONNECT_ATTEMPTS = 3;
+var RECONNECT_BASE_DELAY_MS = 1e3;
+var WSBridge = class {
+  relayUrl;
+  session;
+  timeout;
+  config;
+  privateKeyHex;
+  publicKeyHex;
+  peerPublicKeyHex;
+  sharedSecret = null;
+  ws = null;
+  disposed = false;
+  // Auto-reopen browser state
+  onBrowserNeeded;
+  onPeerKeyChanged;
+  lastBrowserOpenTime = 0;
+  // Reconnection state
+  reconnectAttempts = 0;
+  /** Updated after key exchange — caller should persist this. */
+  get peerPublicKey() {
+    return this.peerPublicKeyHex;
+  }
+  constructor(options) {
+    this.relayUrl = options.relayUrl;
+    this.session = options.session;
+    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    this.config = options.config;
+    this.privateKeyHex = options.privateKeyHex;
+    this.publicKeyHex = options.publicKeyHex;
+    this.peerPublicKeyHex = options.peerPublicKeyHex;
+  }
+  /**
+   * Connect to the relay and wait for the browser to be ready.
+   *
+   * @param onBrowserNeeded — called when the relay reports no browser connected.
+   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.
+   */
+  async connect(onBrowserNeeded, onPeerKeyChanged) {
+    this.onBrowserNeeded = onBrowserNeeded;
+    this.onPeerKeyChanged = onPeerKeyChanged;
+    if (this.peerPublicKeyHex) {
+      await this.deriveSecret();
+    }
+    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);
+  }
+  async connectInternal(onBrowserNeeded, onPeerKeyChanged) {
+    return new Promise((resolve, reject) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      let browserOpened = false;
+      let resolved = false;
+      let expectingKeyExchange = !this.peerPublicKeyHex;
+      const timer = setTimeout(() => {
+        ws.close();
+        reject(new Error("Browser did not connect in time.\nRun `jaw disconnect` then try again."));
+      }, 3e4);
+      const sendEncryptedInit = async () => {
+        if (!this.sharedSecret) return;
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "init",
+          apiKey: this.config.apiKey,
+          chainId: this.config.chainId,
+          ens: this.config.ens,
+          paymasterUrl: this.config.paymasterUrl
+        });
+        this.sendRaw(ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      };
+      const waitForReady = () => {
+        const readyTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("Browser SDK did not become ready in time."));
+        }, 15e3);
+        const onMsg = async (data) => {
+          const msg = safeParse(data);
+          if (!msg) return;
+          if (msg.type === "encrypted" && this.sharedSecret) {
+            try {
+              const inner = await decryptMessage(this.sharedSecret, msg);
+              if (inner.type === "ready") {
+                clearTimeout(readyTimer);
+                ws.off("message", onMsg);
+                this.reconnectAttempts = 0;
+                resolve();
+              }
+            } catch {
+            }
+          }
+        };
+        ws.on("message", onMsg);
+      };
+      const onBrowserReady = async () => {
+        if (resolved) return;
+        resolved = true;
+        clearTimeout(timer);
+        waitForReady();
+        await sendEncryptedInit();
+      };
+      ws.on("open", () => {
+        this.ws = ws;
+      });
+      ws.on("message", async (data) => {
+        const msg = safeParse(data);
+        if (!msg) return;
+        if (msg.type === "status") {
+          if (msg.browserConnected) {
+            if (this.sharedSecret) {
+              await onBrowserReady();
+            } else {
+              expectingKeyExchange = true;
+            }
+          } else if (!browserOpened && onBrowserNeeded) {
+            browserOpened = true;
+            expectingKeyExchange = true;
+            onBrowserNeeded().catch(() => {
+            });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
+          }
+        } else if (msg.type === "browser_connected") {
+          expectingKeyExchange = true;
+        } else if (msg.type === "browser_disconnected") {
+          this.handleBrowserDisconnect();
+        } else if (msg.type === "key_exchange" && expectingKeyExchange) {
+          expectingKeyExchange = false;
+          const peerKey = msg.publicKey;
+          this.peerPublicKeyHex = peerKey;
+          await this.deriveSecret();
+          onPeerKeyChanged?.(peerKey);
+          await onBrowserReady();
+        }
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+      ws.on("close", () => {
+        clearTimeout(timer);
+        if (!this.disposed) {
+          this.handleRelayDisconnect();
+        }
+      });
+    });
+  }
+  /**
+   * Send an encrypted RPC request through the relay to the browser SDK.
+   */
+  async request(method, params) {
+    const ws = this.ws;
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      throw new Error("Not connected to relay");
+    }
+    if (!this.sharedSecret) {
+      throw new Error("No shared secret \u2014 key exchange not completed");
+    }
+    const id = crypto.randomUUID();
+    const envelope = await encryptMessage(this.sharedSecret, {
+      type: "rpc_request",
+      id,
+      method,
+      params
+    });
+    const serialized = JSON.stringify({ type: "encrypted", ...envelope });
+    assertMessageSize(serialized, method);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
+        );
+        this.close();
+      }, this.timeout);
+      const onMessage = async (data) => {
+        const msg = safeParse(data);
+        if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
+        try {
+          const inner = await decryptMessage(this.sharedSecret, msg);
+          if (inner.type === "rpc_response" && inner.id === id) {
+            clearTimeout(timer);
+            ws.off("message", onMessage);
+            if (inner.success) {
+              resolve(inner.data);
+            } else {
+              const err = inner.error;
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
+            }
+          }
+        } catch {
+        }
+      };
+      ws.on("message", onMessage);
+      this.sendRaw(ws, serialized);
+    });
+  }
+  async shutdown() {
+    this.disposed = true;
+    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
+      try {
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "shutdown"
+        });
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      } catch {
+      }
+    }
+    this.close();
+  }
+  /**
+   * Connect to relay and send shutdown directly — no init/ready handshake.
+   * Used by `jaw disconnect` when we just need to tell the browser to close.
+   */
+  async connectAndShutdown() {
+    if (!this.peerPublicKeyHex) {
+      return;
+    }
+    this.disposed = true;
+    await this.deriveSecret();
+    return new Promise((resolve) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      const timer = setTimeout(() => {
+        try {
+          ws.close();
+        } catch {
+        }
+        resolve();
+      }, 3e3);
+      ws.on("open", async () => {
+        this.ws = ws;
+        try {
+          await this.shutdown();
+        } catch {
+        }
+        clearTimeout(timer);
+        resolve();
+      });
+      ws.on("error", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  }
+  close() {
+    this.disposed = true;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+  /**
+   * Auto-reopen browser when browser_disconnected is received from relay.
+   * Respects a cooldown to prevent rapid re-opening.
+   */
+  handleBrowserDisconnect() {
+    if (this.disposed || !this.onBrowserNeeded) return;
+    const now = Date.now();
+    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {
+      return;
+    }
+    this.lastBrowserOpenTime = now;
+    this.sharedSecret = null;
+    this.peerPublicKeyHex = null;
+    this.onBrowserNeeded().catch(() => {
+    });
+  }
+  /**
+   * Attempt to reconnect to the relay with exponential backoff
+   * when the WebSocket connection drops unexpectedly.
+   */
+  handleRelayDisconnect() {
+    if (this.disposed) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;
+    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);
+    this.reconnectAttempts++;
+    setTimeout(() => {
+      if (this.disposed) return;
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
+    }, delay);
+  }
+  /** Send a raw string over the WebSocket, enforcing message size limits. */
+  sendRaw(ws, data) {
+    ws.send(data);
+  }
+  async deriveSecret() {
+    if (!this.peerPublicKeyHex) return;
+    const privateKey = await importKeyFromHex("private", this.privateKeyHex);
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
+    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
+  }
+};
+function assertMessageSize(serialized, method) {
+  const byteLength = Buffer.byteLength(serialized, "utf-8");
+  if (byteLength > MAX_MESSAGE_BYTES) {
+    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);
+    throw new Error(
+      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). Try reducing the number of calls in your batch.`
+    );
+  }
+}
+function safeParse(data) {
+  try {
+    return JSON.parse(data.toString());
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/bridge-singleton.ts
+var DEFAULT_KEYS_URL = "https://keys.jaw.id";
+var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
+function loadRelaySession() {
+  try {
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveRelaySession(info) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function deleteRelaySession() {
+  try {
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
+  } catch {
+  }
+}
+async function getBridge(options) {
+  const config = loadConfig();
+  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
+  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;
+  const chainId = options.chainId ?? config.defaultChain ?? 1;
+  if (!isValidKeysUrl(keysUrl)) {
+    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
+  }
+  if (!isValidRelayUrl(relayUrl)) {
+    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
+  }
+  let relaySession = loadRelaySession();
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
+    try {
+      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
+    } catch {
+      deleteRelaySession();
+      relaySession = null;
+    }
+  } else if (relaySession) {
+    deleteRelaySession();
+  }
+  const session = await createNewSession(relayUrl);
+  saveRelaySession(session);
+  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
+}
+async function createNewSession(relayUrl) {
+  const kp = await generateKeyPair();
+  const privateKey = await exportKeyToHex("private", kp.privateKey);
+  const publicKey = await exportKeyToHex("public", kp.publicKey);
+  return {
+    session: crypto.randomUUID(),
+    relayUrl,
+    privateKey,
+    publicKey,
+    peerPublicKey: null,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
+  const config = loadConfig();
+  const bridge = new WSBridge({
+    relayUrl,
+    session: relaySession.session,
+    timeout: options.timeout,
+    config: {
+      apiKey: options.apiKey,
+      chainId,
+      ens: options.ens ?? config.ens,
+      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
+    },
+    privateKeyHex: relaySession.privateKey,
+    publicKeyHex: relaySession.publicKey,
+    peerPublicKeyHex: relaySession.peerPublicKey
+  });
+  await bridge.connect(
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
+      const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
+      const { default: open } = await import('open');
+      await open(bridgeUrl);
+    } : void 0,
+    // onPeerKeyChanged
+    (newPeerKey) => {
+      relaySession.peerPublicKey = newPeerKey;
+      saveRelaySession(relaySession);
+    }
+  );
+  return bridge;
+}
+function buildBridgeUrl(keysUrl, session, relayUrl, cliPublicKeyHex) {
+  const url = new URL("/cli-bridge", keysUrl);
+  url.searchParams.set("session", session);
+  url.searchParams.set("relay", relayUrl);
+  url.hash = `pk=${cliPublicKeyHex}`;
+  return url.toString();
+}
+function generateSessionKey() {
+  const bytes = crypto.randomBytes(32);
+  return `0x${bytes.toString("hex")}`;
+}
+function saveKeystore(privateKeyHex, address) {
+  const keystore = {
+    version: 2,
+    privateKey: privateKeyHex,
+    address,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.keystore, JSON.stringify(keystore, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+  fs.chmodSync(PATHS.keystore, 384);
+}
+function loadSessionKey() {
+  if (!fs.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function keystoreExists() {
+  return fs.existsSync(PATHS.keystore);
+}
+function saveSessionConfig(input) {
+  const config = {
+    ...input,
+    createdAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.sessionConfig, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+  fs.chmodSync(PATHS.sessionConfig, 384);
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+
+// src/commands/session/setup.ts
+var SessionSetup = class _SessionSetup extends BaseCommand {
+  static description = "Generate a session key and grant scoped on-chain permissions (one-time browser approval).";
+  static examples = [
+    "<%= config.bin %> session setup --chain 84532",
+    `<%= config.bin %> session setup --permissions '{"calls":[...]}' --expiry 14`,
+    "<%= config.bin %> session setup --permissions ./permissions.json"
+  ];
+  static flags = {
+    ...BaseCommand.baseFlags,
+    permissions: Flags.string({
+      description: "Permission scope (inline JSON or file path). Overrides config.permissions."
+    }),
+    expiry: Flags.integer({
+      description: "Permission expiry in days. Overrides config.sessionExpiry."
+    })
+  };
+  async run() {
+    const { flags } = await this.parse(_SessionSetup);
+    const config = loadConfig();
+    const format = flags.output;
+    const apiKey = this.resolveApiKey(flags);
+    const chainId = this.resolveChainId(flags);
+    let reuseKey = null;
+    let oldPermissionRevoked = false;
+    if (keystoreExists()) {
+      const existing = loadSessionConfig();
+      const isActive = existing.expiry > Date.now() / 1e3;
+      if (!flags.yes && !process.stdin.isTTY) {
+        this.error(
+          "Existing session found, but stdin is not a terminal (piped, redirected, or running in CI). Re-run with --yes to overwrite the existing session non-interactively."
+        );
+      }
+      if (!flags.yes) {
+        const readline = await import('readline');
+        const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+        const ask = (q) => new Promise((resolve) => rl.question(q, resolve));
+        if (isActive) {
+          const remaining = Math.floor((existing.expiry - Date.now() / 1e3) / 86400);
+          this.log("Active session found:\n");
+          this.log(`  Session address:  ${existing.sessionAddress}`);
+          this.log(`  Permission ID:    ${existing.permissionId}`);
+          this.log(`  Chain:            ${existing.chainId}`);
+          this.log(
+            `  Expires:          ${new Date(existing.expiry * 1e3).toISOString()} (${remaining} days remaining)`
+          );
+          this.log("\nThe old on-chain permission will NOT be revoked automatically.");
+          this.log("Anyone with the old session key can still use it until expiry.\n");
+          const revokeAnswer = await ask("Revoke old permission on-chain first? (Y/n) ");
+          if (revokeAnswer.toLowerCase() !== "n") {
+            this.log("Opening browser to revoke old permission...");
+            const pm = config.paymasters?.[existing.chainId];
+            const revokeBridge = await getBridge({
+              keysUrl: config.keysUrl,
+              apiKey,
+              chainId: existing.chainId,
+              ens: config.ens,
+              paymasterUrl: pm?.url
+            });
+            try {
+              await revokeBridge.request("wallet_revokePermissions", [{ id: existing.permissionId }]);
+            } finally {
+              revokeBridge.close();
+            }
+            oldPermissionRevoked = true;
+            this.log("Old permission revoked.");
+          }
+          const reuseAnswer = await ask("Reuse existing session key? (Y/n) ");
+          if (reuseAnswer.toLowerCase() !== "n") {
+            reuseKey = loadSessionKey();
+          }
+        } else {
+          const overwrite = await ask("Expired session found. Overwrite? (y/N) ");
+          if (overwrite.toLowerCase() !== "y") {
+            rl.close();
+            this.log("Aborted.");
+            return;
+          }
+        }
+        rl.close();
+      } else if (isActive) {
+        this.logToStderr(
+          `Warning: overwriting active session without revoking. Old permission ${existing.permissionId} on chain ${existing.chainId} remains live until ${new Date(existing.expiry * 1e3).toISOString()}.`
+        );
+      }
+    }
+    try {
+      const permissions = this.resolvePermissions(flags.permissions, config.permissions);
+      const expiryDays = flags.expiry ?? config.sessionExpiry ?? 7;
+      const expiryTimestamp = Math.floor(Date.now() / 1e3) + expiryDays * 86400;
+      const privateKeyHex = reuseKey ?? generateSessionKey();
+      const { privateKeyToAccount } = await import('viem/accounts');
+      const localAccount = privateKeyToAccount(privateKeyHex);
+      const { Account } = await import('@jaw.id/core');
+      const pm = config.paymasters?.[chainId];
+      const account = await Account.fromLocalAccount(
+        {
+          chainId,
+          apiKey,
+          paymasterUrl: pm?.url,
+          paymasterContext: pm?.context
+        },
+        localAccount
+      );
+      const sessionAddress = account.address;
+      if (!flags.quiet) {
+        this.log("Opening browser to approve permissions...");
+      }
+      const bridge = await getBridge({
+        keysUrl: config.keysUrl,
+        apiKey,
+        chainId,
+        ens: config.ens,
+        paymasterUrl: pm?.url
+      });
+      let grantResponse;
+      try {
+        grantResponse = await bridge.request("wallet_grantPermissions", [
+          {
+            spender: sessionAddress,
+            expiry: expiryTimestamp,
+            permissions,
+            chainId
+          }
+        ]);
+      } finally {
+        bridge.close();
+      }
+      saveKeystore(privateKeyHex, sessionAddress);
+      saveSessionConfig({
+        ownerAddress: grantResponse.account,
+        sessionAddress,
+        permissionId: grantResponse.permissionId,
+        chainId,
+        expiry: expiryTimestamp
+      });
+      const summary = {
+        ownerAddress: grantResponse.account,
+        sessionAddress,
+        permissionId: grantResponse.permissionId,
+        expiry: expiryTimestamp
+      };
+      if (flags.quiet) {
+        this.outputResult(summary, format);
+      } else {
+        this.log("\nSession created successfully.\n");
+        this.log(`  Session address:  ${sessionAddress}`);
+        this.log(`  Owner address:    ${grantResponse.account}`);
+        this.log(`  Permission ID:    ${grantResponse.permissionId}`);
+        this.log(`  Chain:            ${chainId}`);
+        this.log(`  Expires:          ${new Date(expiryTimestamp * 1e3).toISOString()} (${expiryDays} days)`);
+        this.log("\nUse --session flag to execute RPC calls in auto mode.");
+      }
+    } catch (error) {
+      if (oldPermissionRevoked) {
+        this.logToStderr(
+          "Old permission was revoked on-chain but setup did not complete. Local session-config still references the revoked permission; run `jaw session setup` again to create a new session."
+        );
+      }
+      throw error;
+    }
+  }
+  resolvePermissions(flagValue, configValue) {
+    let raw;
+    if (flagValue) {
+      if (flagValue.trimStart().startsWith("{")) {
+        try {
+          raw = JSON.parse(flagValue);
+        } catch {
+          this.error(`--permissions is not valid JSON: ${flagValue}`);
+        }
+      } else {
+        const content = fs.readFileSync(flagValue, "utf-8");
+        try {
+          raw = JSON.parse(content);
+        } catch {
+          this.error(`Permissions file at ${flagValue} is not valid JSON.`);
+        }
+      }
+    } else if (configValue) {
+      raw = configValue;
+    } else {
+      this.error('Permissions required. Set via --permissions flag or add "permissions" to ~/.jaw/config.json');
+    }
+    return parsePermissionsConfig(raw);
+  }
+};
+
+export { SessionSetup as default };
+//# sourceMappingURL=setup.js.map
+//# sourceMappingURL=setup.js.map