@jaw.id/cli 0.0.8 → 0.1.1

package/dist/mcp/handlers/config.js

@@ -14,7 +14,7 @@ import * as os from 'os';
   chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia")
 });
 var configSetSchema = {
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "paymasterUrl", "ens", "relayUrl"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl"]).describe("Config key"),
   value: z.string().describe("Config value")
 };
 
@@ -35,7 +35,9 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
 
 // src/lib/validation.ts
@@ -66,13 +68,23 @@ function ensureDir(dir) {
   fs.mkdirSync(dir, { recursive: true, mode: 448 });
   fs.chmodSync(dir, 448);
 }
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
 function loadConfig() {
   if (!fs.existsSync(PATHS.config)) {
     return {};
   }
   const raw = fs.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
@@ -118,7 +130,7 @@ function registerConfigTools(server) {
   });
   server.tool(
     "jaw_config_set",
-    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens, relayUrl).",
+    "Set a CLI configuration value (apiKey, defaultChain, keysUrl, ens, relayUrl).",
     configSetSchema,
     async (params) => {
       try {

package/dist/mcp/handlers/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/tools.ts","../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/mcp/handlers/config.ts"],"names":[],"mappings":";;;;;;CAM+B;AAAA,EAC7B,MAAA,EAAQ,CAAA,CACL,MAAA,EAAO,CACP,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,MAAA,EAAQ,CAAA,CACL,GAAA,EAAI,CACJ,UAAS,CACT,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,SAAS,CAAA,CACN,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kGAAkG;AAChH;AAEO,IAAM,eAAA,GAAkB;AAAA,EAC7B,GAAA,EAAK,CAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,cAAA,EAAgB,SAAA,EAAW,cAAA,EAAgB,KAAA,EAAO,UAAU,CAAC,CAAA,CAAE,SAAS,YAAY,CAAA;AAAA,EAC3G,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAC3C,CAAA;;;AC7BO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AACxC,CAAA;;;AC0BO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACxG,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACtG,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACtE,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;AC5DO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;AAOO,SAAS,cAAA,CAAe,KAAsB,KAAA,EAA8B;AACjF,EAAA,IAAI,GAAA,KAAQ,aAAa,OAAO,KAAA,KAAU,YAAY,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,iDAAA,CAAmD,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,GAAA,KAAQ,cAAc,OAAO,KAAA,KAAU,YAAY,CAAC,eAAA,CAAgB,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAA,EAAM;AAC1C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;ACjDO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA,CAAK,iBAAA,EAAmB,oDAAA,EAAsD,IAAI,YAAY;AACnG,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AACxC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAiB,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAAA,OACnE;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,SAAS,GAAG,CAAA;AAAA,IACrB;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,6FAAA;AAAA,IACA,eAAA;AAAA,IACA,OAAO,MAAA,KAAW;AAChB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,QAAQ,cAAA,EAAgB;AACjC,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AACrC,UAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,UACrD;AACA,UAAA,cAAA,CAAe,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,QAChC,CAAA,MAAO;AACL,UAAA,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAAA,QACzC;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,aAAA;AAAA;AACzB;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"config.js","sourcesContent":["import { z } from 'zod';\n\n/**\n * Single generic RPC method schema.\n * Accepts any EIP-1193 RPC method and forwards to JAWProvider.\n */\nexport const rpcMethodSchema = {\n  method: z\n    .string()\n    .describe(\n      'EIP-1193 RPC method name (e.g. wallet_connect, wallet_sendCalls, personal_sign). ' +\n        'Read the jaw://api-reference resource for the full list and jaw://api-reference/{method} for parameter details.'\n    ),\n  params: z\n    .any()\n    .optional()\n    .describe(\n      'Method parameters — structure varies by method. ' +\n        'Read the jaw://api-reference/{method} resource for the expected format.'\n    ),\n  chainId: z\n    .number()\n    .optional()\n    .describe('Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia'),\n};\n\nexport const configSetSchema = {\n  key: z.enum(['apiKey', 'defaultChain', 'keysUrl', 'paymasterUrl', 'ens', 'relayUrl']).describe('Config key'),\n  value: z.string().describe('Config value'),\n};\n","export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: 'text' as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: 'text' as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}\n","import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n} as const;\n","export function isValidAddress(value: string): boolean {\n  return /^0x[0-9a-fA-F]{40}$/.test(value);\n}\n\nexport function isValidHex(value: string): boolean {\n  return /^0x[0-9a-fA-F]*$/.test(value);\n}\n\nexport function isValidChainId(value: string | number): boolean {\n  const num = typeof value === 'string' ? parseInt(value, 10) : value;\n  return Number.isInteger(num) && num > 0;\n}\n\nexport function parseChainId(value: string): number {\n  const num = parseInt(value, 10);\n  if (!isValidChainId(num)) {\n    throw new Error(`Invalid chain ID: ${value}`);\n  }\n  return num;\n}\n\nexport function assertAddress(value: string, label = 'address'): `0x${string}` {\n  if (!isValidAddress(value)) {\n    throw new Error(`Invalid ${label}: ${value}`);\n  }\n  return value as `0x${string}`;\n}\n\nexport function parseWei(raw: string, label = 'value'): bigint {\n  try {\n    return BigInt(raw);\n  } catch {\n    throw new Error(`Invalid ${label}: \"${raw}\" is not a valid wei amount`);\n  }\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'https:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'wss:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    const isWebSocket = parsed.protocol === 'wss:' || parsed.protocol === 'ws:';\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(key: keyof JawConfig): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { configSetSchema } from '../tools.js';\nimport { mcpError } from '../helpers.js';\nimport { loadConfig, setConfigValue, redactConfig } from '../../lib/config.js';\n\nexport function registerConfigTools(server: McpServer): void {\n  server.tool('jaw_config_show', 'Show current CLI configuration (API key redacted).', {}, async () => {\n    try {\n      const config = redactConfig(loadConfig());\n      return {\n        content: [{ type: 'text' as const, text: JSON.stringify(config) }],\n      };\n    } catch (err) {\n      return mcpError(err);\n    }\n  });\n\n  server.tool(\n    'jaw_config_set',\n    'Set a CLI configuration value (apiKey, defaultChain, keysUrl, paymasterUrl, ens, relayUrl).',\n    configSetSchema,\n    async (params) => {\n      try {\n        if (params.key === 'defaultChain') {\n          const num = parseInt(params.value, 10);\n          if (isNaN(num) || num <= 0) {\n            throw new Error(`Invalid chain ID: ${params.value}`);\n          }\n          setConfigValue(params.key, num);\n        } else {\n          setConfigValue(params.key, params.value);\n        }\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: `Set ${params.key} successfully`,\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n}\n"]}
+{"version":3,"sources":["../../../src/mcp/tools.ts","../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/mcp/handlers/config.ts"],"names":[],"mappings":";;;;;;CAM+B;AAAA,EAC7B,MAAA,EAAQ,CAAA,CACL,MAAA,EAAO,CACP,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,MAAA,EAAQ,CAAA,CACL,GAAA,EAAI,CACJ,UAAS,CACT,QAAA;AAAA,IACC;AAAA,GAEF;AAAA,EACF,SAAS,CAAA,CACN,MAAA,GACA,QAAA,EAAS,CACT,SAAS,kGAAkG;AAChH;AAEO,IAAM,eAAA,GAAkB;AAAA,EAC7B,GAAA,EAAK,CAAA,CAAE,IAAA,CAAK,CAAC,QAAA,EAAU,cAAA,EAAgB,SAAA,EAAW,KAAA,EAAO,UAAU,CAAC,CAAA,CAAE,QAAA,CAAS,YAAY,CAAA;AAAA,EAC3F,KAAA,EAAO,CAAA,CAAE,MAAA,EAAO,CAAE,SAAS,cAAc;AAC3C,CAAA;;;AC7BO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;AC+DO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACxG,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACtG,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACtE,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACnGO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;AAEO,SAAS,cAAA,CAAe,KAAsB,KAAA,EAA8B;AACjF,EAAA,IAAI,GAAA,KAAQ,aAAa,OAAO,KAAA,KAAU,YAAY,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,iDAAA,CAAmD,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,GAAA,KAAQ,cAAc,OAAO,KAAA,KAAU,YAAY,CAAC,eAAA,CAAgB,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAA,EAAM;AAC1C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;ACvDO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA,CAAK,iBAAA,EAAmB,oDAAA,EAAsD,IAAI,YAAY;AACnG,IAAA,IAAI;AACF,MAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AACxC,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAiB,MAAM,IAAA,CAAK,SAAA,CAAU,MAAM,CAAA,EAAG;AAAA,OACnE;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,SAAS,GAAG,CAAA;AAAA,IACrB;AAAA,EACF,CAAC,CAAA;AAED,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,+EAAA;AAAA,IACA,eAAA;AAAA,IACA,OAAO,MAAA,KAAW;AAChB,MAAA,IAAI;AACF,QAAA,IAAI,MAAA,CAAO,QAAQ,cAAA,EAAgB;AACjC,UAAA,MAAM,GAAA,GAAM,QAAA,CAAS,MAAA,CAAO,KAAA,EAAO,EAAE,CAAA;AACrC,UAAA,IAAI,KAAA,CAAM,GAAG,CAAA,IAAK,GAAA,IAAO,CAAA,EAAG;AAC1B,YAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kBAAA,EAAqB,MAAA,CAAO,KAAK,CAAA,CAAE,CAAA;AAAA,UACrD;AACA,UAAA,cAAA,CAAe,MAAA,CAAO,KAAK,GAAG,CAAA;AAAA,QAChC,CAAA,MAAO;AACL,UAAA,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,MAAA,CAAO,KAAK,CAAA;AAAA,QACzC;AACA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM,CAAA,IAAA,EAAO,MAAA,CAAO,GAAG,CAAA,aAAA;AAAA;AACzB;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"config.js","sourcesContent":["import { z } from 'zod';\n\n/**\n * Single generic RPC method schema.\n * Accepts any EIP-1193 RPC method and forwards to JAWProvider.\n */\nexport const rpcMethodSchema = {\n  method: z\n    .string()\n    .describe(\n      'EIP-1193 RPC method name (e.g. wallet_connect, wallet_sendCalls, personal_sign). ' +\n        'Read the jaw://api-reference resource for the full list and jaw://api-reference/{method} for parameter details.'\n    ),\n  params: z\n    .any()\n    .optional()\n    .describe(\n      'Method parameters — structure varies by method. ' +\n        'Read the jaw://api-reference/{method} resource for the expected format.'\n    ),\n  chainId: z\n    .number()\n    .optional()\n    .describe('Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia'),\n};\n\nexport const configSetSchema = {\n  key: z.enum(['apiKey', 'defaultChain', 'keysUrl', 'ens', 'relayUrl']).describe('Config key'),\n  value: z.string().describe('Config value'),\n};\n","export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: 'text' as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: 'text' as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}\n","import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import type { PermissionsConfig } from './types.js';\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;\nconst HEX_RE = /^0x[0-9a-fA-F]+$/;\nconst VALID_SPEND_UNITS = new Set(['minute', 'hour', 'day', 'week', 'month', 'year', 'forever']);\n\nexport function parsePermissionsConfig(raw: unknown): PermissionsConfig {\n  const errors: string[] = [];\n\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw new Error('Invalid permissions:\\n  - Must be an object');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const calls = obj.calls as unknown[] | undefined;\n  const spends = obj.spends as unknown[] | undefined;\n\n  if (!calls && !spends) {\n    throw new Error('Invalid permissions:\\n  - Must include at least \"calls\" or \"spends\"');\n  }\n\n  if (calls !== undefined) {\n    if (!Array.isArray(calls) || calls.length === 0) {\n      errors.push('calls: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < calls.length; i++) {\n        const c = calls[i] as Record<string, unknown>;\n        if (!c || typeof c !== 'object') {\n          errors.push(`calls.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof c.target !== 'string' || !ADDRESS_RE.test(c.target)) {\n          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (c.selector !== undefined && (typeof c.selector !== 'string' || !SELECTOR_RE.test(c.selector))) {\n          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);\n        }\n      }\n    }\n  }\n\n  if (spends !== undefined) {\n    if (!Array.isArray(spends) || spends.length === 0) {\n      errors.push('spends: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < spends.length; i++) {\n        const s = spends[i] as Record<string, unknown>;\n        if (!s || typeof s !== 'object') {\n          errors.push(`spends.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof s.token !== 'string' || !ADDRESS_RE.test(s.token)) {\n          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (typeof s.allowance !== 'string' || !HEX_RE.test(s.allowance)) {\n          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);\n        }\n        if (typeof s.unit !== 'string' || !VALID_SPEND_UNITS.has(s.unit)) {\n          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(', ')}`);\n        }\n        if (s.multiplier !== undefined && (!Number.isInteger(s.multiplier) || (s.multiplier as number) < 1)) {\n          errors.push(`spends.${i}.multiplier: Must be a positive integer`);\n        }\n      }\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Invalid permissions:\\n${errors.map((e) => `  - ${e}`).join('\\n')}`);\n  }\n\n  return raw as PermissionsConfig;\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'https:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'wss:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    const isWebSocket = parsed.protocol === 'wss:' || parsed.protocol === 'ws:';\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { configSetSchema } from '../tools.js';\nimport { mcpError } from '../helpers.js';\nimport { loadConfig, setConfigValue, redactConfig } from '../../lib/config.js';\n\nexport function registerConfigTools(server: McpServer): void {\n  server.tool('jaw_config_show', 'Show current CLI configuration (API key redacted).', {}, async () => {\n    try {\n      const config = redactConfig(loadConfig());\n      return {\n        content: [{ type: 'text' as const, text: JSON.stringify(config) }],\n      };\n    } catch (err) {\n      return mcpError(err);\n    }\n  });\n\n  server.tool(\n    'jaw_config_set',\n    'Set a CLI configuration value (apiKey, defaultChain, keysUrl, ens, relayUrl).',\n    configSetSchema,\n    async (params) => {\n      try {\n        if (params.key === 'defaultChain') {\n          const num = parseInt(params.value, 10);\n          if (isNaN(num) || num <= 0) {\n            throw new Error(`Invalid chain ID: ${params.value}`);\n          }\n          setConfigValue(params.key, num);\n        } else {\n          setConfigValue(params.key, params.value);\n        }\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: `Set ${params.key} successfully`,\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n}\n"]}

package/dist/mcp/handlers/daemon.js

@@ -23,21 +23,44 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
+function ensureDir(dir) {
+  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs2.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
 function loadConfig() {
   if (!fs2.existsSync(PATHS.config)) {
     return {};
   }
   const raw = fs2.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
     );
   }
 }
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs2.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
 function redactConfig(config) {
   return {
     ...config,
@@ -213,6 +236,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -288,9 +315,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {

package/dist/mcp/handlers/daemon.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/crypto.ts","../../../src/lib/ws-bridge.ts","../../../src/lib/bridge-singleton.ts","../../../src/mcp/handlers/daemon.ts"],"names":["fs","fs3"],"mappings":";;;;;;;;;AAAO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY;AACxC,CAAA;ACAO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,MAAM,GAAG,CAAA;AAAA,EACvB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAUO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;;;ACxBA,IAAM,MAAA,GAAS,WAAW,MAAA,CAAO,MAAA;AAQjC,eAAsB,kBAAA,CAAmB,YAAkB,aAAA,EAAoC;AAC7F,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,aAAA,EAAc;AAAA,IACtC,UAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AASA,eAAsB,cAAA,CAAe,cAAoB,OAAA,EAA8D;AACrH,EAAA,MAAM,KAAK,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,SAAS,CAAA;AACvF,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAe,EAAE,CAAA;AAAA,IACrB,UAAA,EAAY,cAAA,CAAe,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GACtD;AACF;AAEA,eAAsB,cAAA,CACpB,cACA,QAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,UAAU,CAAA;AACvF,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACtD;AAUA,eAAsB,gBAAA,CAAiB,MAA4B,GAAA,EAA4B;AAC7F,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,SAAA,GAAY,OAAA,GAAU,MAAA;AAC9C,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,MAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,IAAA,KAAS,SAAA,GAAY,CAAC,WAAW,IAAI;AAAC,GACxC;AACF;AAUA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtC,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC3C;;;ACxDA,IAAM,kBAAA,GAAqB,IAAA;AAU3B,IAAM,iBAAA,GAAoB,IAAI,IAAA,GAAO,IAAA;AAGrC,IAAM,0BAAA,GAA6B,GAAA;AAGnC,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,uBAAA,GAA0B,GAAA;AAEzB,IAAM,WAAN,MAAe;AAAA,EACH,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACR,YAAA;AAAA,EACD,gBAAA;AAAA,EACA,YAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAA,GAAW,KAAA;AAAA;AAAA,EAGX,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA,GAAsB,CAAA;AAAA;AAAA,EAGtB,iBAAA,GAAoB,CAAA;AAAA;AAAA,EAG5B,IAAI,aAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAClC,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,eAAA,EACA,gBAAA,EACe;AAEf,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAGxB,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAc,eAAA,CACZ,eAAA,EACA,gBAAA,EACe;AACf,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,oBAAA,GAAuB,CAAC,IAAA,CAAK,gBAAA;AAEjC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,wEAA6E,CAAC,CAAA;AAAA,MACjG,GAAG,GAAM,CAAA;AAET,MAAA,MAAM,oBAAoB,YAAY;AACpC,QAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM,MAAA;AAAA,UACN,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,UACpB,OAAA,EAAS,KAAK,MAAA,CAAO,OAAA;AAAA,UACrB,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,UACjB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,SAC3B,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MACrE,CAAA;AAEA,MAAA,MAAM,eAAe,MAAM;AACzB,QAAA,MAAM,UAAA,GAAa,WAAW,MAAM;AAClC,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,2CAA2C,CAAC,CAAA;AAAA,QAC/D,GAAG,IAAM,CAAA;AAET,QAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,KAAyB;AAC5C,UAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,UAAA,IAAI,CAAC,GAAA,EAAK;AAEV,UAAA,IAAI,GAAA,CAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,YAAA,EAAc;AACjD,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,cAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,gBAAA,YAAA,CAAa,UAAU,CAAA;AACvB,gBAAA,EAAA,CAAG,GAAA,CAAI,WAAW,KAAK,CAAA;AACvB,gBAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,CAAA;AACA,QAAA,EAAA,CAAG,EAAA,CAAG,WAAW,KAAK,CAAA;AAAA,MACxB,CAAA;AAEA,MAAA,MAAM,iBAAiB,YAAY;AACjC,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,YAAA,EAAa;AACb,QAAA,MAAM,iBAAA,EAAkB;AAAA,MAC1B,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,OAAO,IAAA,KAAS;AAC/B,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,EAAK;AAEV,QAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,UAAA,IAAI,IAAI,gBAAA,EAAkB;AACxB,YAAA,IAAI,KAAK,YAAA,EAAc;AAErB,cAAA,MAAM,cAAA,EAAe;AAAA,YACvB,CAAA,MAAO;AAEL,cAAA,oBAAA,GAAuB,IAAA;AAAA,YACzB;AAAA,UACF,CAAA,MAAA,IAAW,CAAC,aAAA,IAAiB,eAAA,EAAiB;AAC5C,YAAA,aAAA,GAAgB,IAAA;AAChB,YAAA,oBAAA,GAAuB,IAAA;AACvB,YAAA,eAAA,EAAgB,CAAE,MAAM,MAAM;AAAA,YAE9B,CAAC,CAAA;AAAA,UACH;AAAA,QACF,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,oBAAA,GAAuB,IAAA;AAAA,QAEzB,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,sBAAA,EAAwB;AAE9C,UAAA,IAAA,CAAK,uBAAA,EAAwB;AAAA,QAC/B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,oBAAA,EAAsB;AAC9D,UAAA,oBAAA,GAAuB,KAAA;AACvB,UAAA,MAAM,UAAU,GAAA,CAAI,SAAA;AACpB,UAAA,IAAA,CAAK,gBAAA,GAAmB,OAAA;AACxB,UAAA,MAAM,KAAK,YAAA,EAAa;AACxB,UAAA,gBAAA,GAAmB,OAAO,CAAA;AAC1B,UAAA,MAAM,cAAA,EAAe;AAAA,QACvB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,IAAA,CAAK,qBAAA,EAAsB;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,MAAM,oDAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,MACvD,IAAA,EAAM,aAAA;AAAA,MACN,EAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU,CAAA;AACpE,IAAA,iBAAA,CAAkB,YAAY,MAAM,CAAA;AAEpC,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA,CAAqD;AAAA,SAC/G;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAyB;AAChD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,SAAS,WAAA,IAAe,CAAC,KAAK,YAAA,EAAc;AAE5D,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,UAAA,IAAI,KAAA,CAAM,IAAA,KAAS,cAAA,IAAkB,KAAA,CAAM,OAAO,EAAA,EAAI;AACpD,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,YAAA,IAAI,MAAM,OAAA,EAAS;AACjB,cAAA,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,YACpB,CAAA,MAAO;AACL,cAAA,MAAM,MAAM,KAAA,CAAM,KAAA;AAClB,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,GAAA,GAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,gBAAgB,CAAC,CAAA;AAAA,YAC3E;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,UAAU,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAA,GAAkB;AAChB,IAAA,OAAO,IAAA,CAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA;AAAA,EAC3C;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,IAAQ,KAAK,YAAA,EAAc;AAC/D,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAA,GAAoC;AACxC,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,KAAK,YAAA,EAAa;AAExB,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,EAAM;AAAA,QACX,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,GAAG,GAAI,CAAA;AAEP,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,YAAY;AACxB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,QAAA,IAAI;AACF,UAAA,MAAM,KAAK,QAAA,EAAS;AAAA,QACtB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,mBAAA,GAAsB,0BAAA,EAA4B;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,GAAA;AAG3B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AAExB,IAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,KAAA,CAAM,MAAM;AAAA,IAEnC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,IAAA,CAAK,qBAAqB,sBAAA,EAAwB;AAEtD,IAAA,MAAM,QAAQ,uBAAA,GAA0B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,iBAAiB,CAAA;AAC1E,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,eAAA,EAAiB,KAAK,gBAAgB,CAAA,CAAE,MAAM,MAAM;AAAA,MAE9E,CAAC,CAAA;AAAA,IACH,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA,EAGQ,OAAA,CAAQ,IAAe,IAAA,EAAoB;AACjD,IAAA,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EACd;AAAA,EAEA,MAAc,YAAA,GAA8B;AAC1C,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC5B,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,SAAA,EAAW,KAAK,aAAa,CAAA;AACvE,IAAA,MAAM,aAAA,GAAgB,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAK,gBAAgB,CAAA;AAC5E,IAAA,IAAA,CAAK,YAAA,GAAe,MAAM,kBAAA,CAAmB,UAAA,EAAY,aAAa,CAAA;AAAA,EACxE;AACF,CAAA;AAMA,SAAS,iBAAA,CAAkB,YAAoB,MAAA,EAAsB;AACnE,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,OAAO,CAAA;AACxD,EAAA,IAAI,aAAa,iBAAA,EAAmB;AAClC,IAAA,MAAM,MAAA,GAAA,CAAU,UAAA,IAAc,IAAA,GAAO,IAAA,CAAA,EAAO,QAAQ,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,eAAe,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,WAAA,EAAc,iBAAA,IAAqB,OAAO,IAAA,CAAK,CAAA,qDAAA;AAAA,KAE9F;AAAA,EACF;AACF;AAEA,SAAS,UAAU,IAAA,EAAsD;AACvE,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;ACxZA,SAAS,gBAAA,GAAwC;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,GAAG,OAAO,IAAA;AACxC,IAAA,MAAM,GAAA,GAAS,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAA;AAChD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,CAAC,MAAA,CAAO,QAAA,IAAY,CAAC,MAAA,CAAO,UAAA,IAAc,CAAC,MAAA,CAAO,SAAA,EAAW;AAClF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUA,SAAS,kBAAA,GAA2B;AAClC,EAAA,IAAI;AACF,IAAA,IAAO,eAAW,KAAA,CAAM,KAAK,GAAM,GAAA,CAAA,UAAA,CAAW,MAAM,KAAK,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAuGA,eAAsB,cAAA,GAAgC;AACpD,EAAA,MAAM,UAAU,gBAAA,EAAiB;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AAGd,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,QAAA,CAAS;AAAA,MAC1B,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,GAAA;AAAA,MACT,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,SAAS,CAAA,EAAE;AAAA,MACjC,eAAe,OAAA,CAAQ,UAAA;AAAA,MACvB,cAAc,OAAA,CAAQ,SAAA;AAAA,MACtB,kBAAkB,OAAA,CAAQ;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,OAAO,kBAAA,EAAmB;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,kBAAA,EAAmB;AAGnB,EAAA,MAAM,YAAA,GAAe,MAAM,IAAA,GAAO,cAAA;AAClC,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,GAAO,aAAA;AAC/B,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,GAAO,cAAA;AAChC,EAAA,IAAI;AACF,IAAA,IAAO,GAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,GAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAC9D,MAAA,IAAI,IAAA,CAAK,OAAO,MAAA,CAAO,SAAA,CAAU,KAAK,GAAG,CAAA,IAAK,IAAA,CAAK,GAAA,GAAM,CAAA,EAAG;AAC1D,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,YAAA,EAAc,SAAA,EAAW,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI;AACF,MAAA,IAAO,GAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAM,eAAW,CAAC,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF;;;ACnNO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,YAAA;AAAA,IACA,+JAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,IAAI,YAAA,GAAe,KAAA;AAEnB,QAAA,IAAI;AACF,UAAA,IAAOC,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AAC9B,YAAA,IAAA,CAAK,KAAA,CAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAChD,YAAA,YAAA,GAAe,IAAA;AAAA,UACjB;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,YAAA,GAAe,KAAA;AAAA,QACjB;AAEA,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AAExC,QAAA,MAAM,MAAA,GAAS;AAAA,UACb,KAAA,EAAO,eAAe,EAAE,OAAA,EAAS,MAAK,GAAI,EAAE,SAAS,KAAA,EAAM;AAAA,UAC3D,gBAAA,EAAkB,cAAA;AAAA,UAClB;AAAA,SACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,SAC5E;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,oHAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"daemon.js","sourcesContent":["export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: 'text' as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: 'text' as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}\n","import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    return JSON.parse(raw) as JawConfig;\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function getConfigValue(key: keyof JawConfig): string | number | undefined {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","/**\n * E2E encryption primitives for CLI ↔ browser communication.\n *\n * Uses ECDH P-256 for key exchange and AES-256-GCM for message encryption.\n * Mirrors the same crypto operations in @jaw.id/core but uses only\n * Node.js built-in crypto.subtle — no external dependencies.\n */\n\nimport type { webcrypto } from 'node:crypto';\n\ntype CKey = webcrypto.CryptoKey;\ntype CKeyPair = webcrypto.CryptoKeyPair;\n\nconst subtle = globalThis.crypto.subtle;\n\n// ── Key generation ───────────────────────────────────────────────\n\nexport async function generateKeyPair(): Promise<CKeyPair> {\n  return subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveKey']) as Promise<CKeyPair>;\n}\n\nexport async function deriveSharedSecret(privateKey: CKey, peerPublicKey: CKey): Promise<CKey> {\n  return subtle.deriveKey(\n    { name: 'ECDH', public: peerPublicKey },\n    privateKey,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    ['encrypt', 'decrypt']\n  );\n}\n\n// ── Encrypt / Decrypt ────────────────────────────────────────────\n\nexport interface EncryptedEnvelope {\n  iv: string; // base64\n  ciphertext: string; // base64\n}\n\nexport async function encryptMessage(sharedSecret: CKey, payload: Record<string, unknown>): Promise<EncryptedEnvelope> {\n  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const cipherBuf = await subtle.encrypt({ name: 'AES-GCM', iv }, sharedSecret, plaintext);\n  return {\n    iv: bufferToBase64(iv),\n    ciphertext: bufferToBase64(new Uint8Array(cipherBuf)),\n  };\n}\n\nexport async function decryptMessage(\n  sharedSecret: CKey,\n  envelope: EncryptedEnvelope\n): Promise<Record<string, unknown>> {\n  const iv = Buffer.from(envelope.iv, 'base64');\n  const ciphertext = Buffer.from(envelope.ciphertext, 'base64');\n  const plainBuf = await subtle.decrypt({ name: 'AES-GCM', iv }, sharedSecret, ciphertext);\n  return JSON.parse(new TextDecoder().decode(plainBuf));\n}\n\n// ── Key import / export (hex) ────────────────────────────────────\n\nexport async function exportKeyToHex(type: 'private' | 'public', key: CKey): Promise<string> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  const buf = await subtle.exportKey(format, key);\n  return bytesToHex(new Uint8Array(buf));\n}\n\nexport async function importKeyFromHex(type: 'private' | 'public', hex: string): Promise<CKey> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  return subtle.importKey(\n    format,\n    Buffer.from(hexToBytes(hex)),\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true,\n    type === 'private' ? ['deriveKey'] : []\n  );\n}\n\n// ── Encoding helpers ─────────────────────────────────────────────\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('Invalid hex: odd length');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nfunction bufferToBase64(buf: Uint8Array): string {\n  return Buffer.from(buf).toString('base64');\n}\n","/**\n * WSBridge — CLI-side relay client\n *\n * Connects to the cloud relay (wss://relay.jaw.id) instead of a local daemon.\n * All messages (except key_exchange) are E2E encrypted via ECDH + AES-256-GCM.\n */\n\nimport * as crypto from 'node:crypto';\nimport type { webcrypto } from 'node:crypto';\nimport WebSocket from 'ws';\nimport {\n  deriveSharedSecret,\n  encryptMessage,\n  decryptMessage,\n  importKeyFromHex,\n  type EncryptedEnvelope,\n} from './crypto.js';\n\ntype CKey = webcrypto.CryptoKey;\n\nexport interface WSBridgeConfig {\n  apiKey: string;\n  chainId: number;\n  ens?: string;\n  paymasterUrl?: string;\n}\n\nexport interface WSBridgeOptions {\n  relayUrl: string;\n  session: string;\n  timeout?: number;\n  config: WSBridgeConfig;\n  /** CLI's ECDH private key (hex). Loaded from relay.json for existing sessions. */\n  privateKeyHex: string;\n  /** CLI's ECDH public key (hex). Sent to browser for key derivation. */\n  publicKeyHex: string;\n  /** Browser's ECDH public key (hex). Null if new session (key exchange needed). */\n  peerPublicKeyHex: string | null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\n/**\n * Maximum outbound message size (5 MB).\n *\n * wallet_sendCalls with large batches (50+ calls, complex calldata) can reach\n * hundreds of KB. Base64 encoding of the AES-GCM ciphertext adds ~33% overhead.\n * 5 MB is generous enough for any realistic batch while still preventing\n * accidental memory issues.\n */\nconst MAX_MESSAGE_BYTES = 5 * 1024 * 1024;\n\n/** Minimum time between browser reopen attempts (ms). */\nconst BROWSER_REOPEN_COOLDOWN_MS = 5_000;\n\n/** Maximum reconnection attempts before giving up. */\nconst MAX_RECONNECT_ATTEMPTS = 3;\n\n/** Base delay for exponential backoff (ms). */\nconst RECONNECT_BASE_DELAY_MS = 1_000;\n\nexport class WSBridge {\n  private readonly relayUrl: string;\n  private readonly session: string;\n  private readonly timeout: number;\n  private readonly config: WSBridgeConfig;\n  private readonly privateKeyHex: string;\n  readonly publicKeyHex: string;\n  private peerPublicKeyHex: string | null;\n  private sharedSecret: CKey | null = null;\n  private ws: WebSocket | null = null;\n  private disposed = false;\n\n  // Auto-reopen browser state\n  private onBrowserNeeded: (() => Promise<void>) | undefined;\n  private onPeerKeyChanged: ((key: string) => void) | undefined;\n  private lastBrowserOpenTime = 0;\n\n  // Reconnection state\n  private reconnectAttempts = 0;\n\n  /** Updated after key exchange — caller should persist this. */\n  get peerPublicKey(): string | null {\n    return this.peerPublicKeyHex;\n  }\n\n  constructor(options: WSBridgeOptions) {\n    this.relayUrl = options.relayUrl;\n    this.session = options.session;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n    this.config = options.config;\n    this.privateKeyHex = options.privateKeyHex;\n    this.publicKeyHex = options.publicKeyHex;\n    this.peerPublicKeyHex = options.peerPublicKeyHex;\n  }\n\n  /**\n   * Connect to the relay and wait for the browser to be ready.\n   *\n   * @param onBrowserNeeded — called when the relay reports no browser connected.\n   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.\n   */\n  async connect(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    // Store callbacks for auto-reopen on browser disconnect\n    this.onBrowserNeeded = onBrowserNeeded;\n    this.onPeerKeyChanged = onPeerKeyChanged;\n\n    // Pre-derive shared secret if we already have the peer key\n    if (this.peerPublicKeyHex) {\n      await this.deriveSecret();\n    }\n\n    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);\n  }\n\n  private async connectInternal(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      let browserOpened = false;\n      let resolved = false;\n      let expectingKeyExchange = !this.peerPublicKeyHex;\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(new Error('Browser did not connect in time.\\n' + 'Run `jaw disconnect` then try again.'));\n      }, 30_000);\n\n      const sendEncryptedInit = async () => {\n        if (!this.sharedSecret) return;\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'init',\n          apiKey: this.config.apiKey,\n          chainId: this.config.chainId,\n          ens: this.config.ens,\n          paymasterUrl: this.config.paymasterUrl,\n        });\n        this.sendRaw(ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      };\n\n      const waitForReady = () => {\n        const readyTimer = setTimeout(() => {\n          ws.close();\n          reject(new Error('Browser SDK did not become ready in time.'));\n        }, 15_000);\n\n        const onMsg = async (data: WebSocket.Data) => {\n          const msg = safeParse(data);\n          if (!msg) return;\n\n          if (msg.type === 'encrypted' && this.sharedSecret) {\n            try {\n              const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n              if (inner.type === 'ready') {\n                clearTimeout(readyTimer);\n                ws.off('message', onMsg);\n                this.reconnectAttempts = 0; // Reset on successful connect\n                resolve();\n              }\n            } catch {\n              // Not a valid encrypted message for us, ignore\n            }\n          }\n        };\n        ws.on('message', onMsg);\n      };\n\n      const onBrowserReady = async () => {\n        if (resolved) return;\n        resolved = true;\n        clearTimeout(timer);\n        // Set up listener BEFORE sending init to avoid missing the ready response\n        waitForReady();\n        await sendEncryptedInit();\n      };\n\n      ws.on('open', () => {\n        this.ws = ws;\n      });\n\n      ws.on('message', async (data) => {\n        const msg = safeParse(data);\n        if (!msg) return;\n\n        if (msg.type === 'status') {\n          if (msg.browserConnected) {\n            if (this.sharedSecret) {\n              // Already have shared secret — skip key exchange\n              await onBrowserReady();\n            } else {\n              // Browser is connected but we don't have its key yet.\n              expectingKeyExchange = true;\n            }\n          } else if (!browserOpened && onBrowserNeeded) {\n            browserOpened = true;\n            expectingKeyExchange = true;\n            onBrowserNeeded().catch(() => {\n              /* best effort */\n            });\n          }\n        } else if (msg.type === 'browser_connected') {\n          expectingKeyExchange = true;\n          // Wait for key_exchange from browser\n        } else if (msg.type === 'browser_disconnected') {\n          // Browser tab closed — attempt to reopen after cooldown\n          this.handleBrowserDisconnect();\n        } else if (msg.type === 'key_exchange' && expectingKeyExchange) {\n          expectingKeyExchange = false;\n          const peerKey = msg.publicKey as string;\n          this.peerPublicKeyHex = peerKey;\n          await this.deriveSecret();\n          onPeerKeyChanged?.(peerKey);\n          await onBrowserReady();\n        }\n      });\n\n      ws.on('error', (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on('close', () => {\n        clearTimeout(timer);\n        if (!this.disposed) {\n          this.handleRelayDisconnect();\n        }\n      });\n    });\n  }\n\n  /**\n   * Send an encrypted RPC request through the relay to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error('Not connected to relay');\n    }\n    if (!this.sharedSecret) {\n      throw new Error('No shared secret — key exchange not completed');\n    }\n\n    const id = crypto.randomUUID();\n\n    const envelope = await encryptMessage(this.sharedSecret, {\n      type: 'rpc_request',\n      id,\n      method,\n      params,\n    });\n\n    const serialized = JSON.stringify({ type: 'encrypted', ...envelope });\n    assertMessageSize(serialized, method);\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(`Request timed out after ${this.timeout / 1000}s. ` + 'Did you complete the action in the browser?')\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = async (data: WebSocket.Data) => {\n        const msg = safeParse(data);\n        if (!msg || msg.type !== 'encrypted' || !this.sharedSecret) return;\n\n        try {\n          const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n          if (inner.type === 'rpc_response' && inner.id === id) {\n            clearTimeout(timer);\n            ws.off('message', onMessage);\n\n            if (inner.success) {\n              resolve(inner.data);\n            } else {\n              const err = inner.error as { code: number; message: string } | undefined;\n              reject(new Error(err ? `[${err.code}] ${err.message}` : 'Request failed'));\n            }\n          }\n        } catch {\n          // Decryption failed — not our message or tampered, ignore\n        }\n      };\n\n      ws.on('message', onMessage);\n      this.sendRaw(ws, serialized);\n    });\n  }\n\n  isOpen(): boolean {\n    return this.ws?.readyState === WebSocket.OPEN;\n  }\n\n  async shutdown(): Promise<void> {\n    this.disposed = true;\n    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {\n      try {\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'shutdown',\n        });\n        this.sendRaw(this.ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      } catch {\n        // Best effort\n      }\n    }\n    this.close();\n  }\n\n  /**\n   * Connect to relay and send shutdown directly — no init/ready handshake.\n   * Used by `jaw disconnect` when we just need to tell the browser to close.\n   */\n  async connectAndShutdown(): Promise<void> {\n    if (!this.peerPublicKeyHex) {\n      // No peer key means browser never connected — nothing to shut down\n      return;\n    }\n\n    this.disposed = true;\n    await this.deriveSecret();\n\n    return new Promise<void>((resolve) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        try {\n          ws.close();\n        } catch {\n          /* ignore */\n        }\n        resolve();\n      }, 3000);\n\n      ws.on('open', async () => {\n        this.ws = ws;\n        try {\n          await this.shutdown();\n        } catch {\n          // Best effort\n        }\n        clearTimeout(timer);\n        resolve();\n      });\n\n      ws.on('error', () => {\n        clearTimeout(timer);\n        resolve();\n      });\n    });\n  }\n\n  close(): void {\n    this.disposed = true;\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n\n  /**\n   * Auto-reopen browser when browser_disconnected is received from relay.\n   * Respects a cooldown to prevent rapid re-opening.\n   */\n  private handleBrowserDisconnect(): void {\n    if (this.disposed || !this.onBrowserNeeded) return;\n\n    const now = Date.now();\n    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {\n      return; // Too soon — skip this reopen\n    }\n\n    this.lastBrowserOpenTime = now;\n\n    // Reset shared secret — the new browser tab will do a fresh key exchange\n    this.sharedSecret = null;\n    this.peerPublicKeyHex = null;\n\n    this.onBrowserNeeded().catch(() => {\n      // Best effort — if browser open fails, the next request will error\n    });\n  }\n\n  /**\n   * Attempt to reconnect to the relay with exponential backoff\n   * when the WebSocket connection drops unexpectedly.\n   */\n  private handleRelayDisconnect(): void {\n    if (this.disposed) return;\n    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;\n\n    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);\n    this.reconnectAttempts++;\n\n    setTimeout(() => {\n      if (this.disposed) return;\n      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {\n        // Reconnection failed — will retry if attempts remain\n      });\n    }, delay);\n  }\n\n  /** Send a raw string over the WebSocket, enforcing message size limits. */\n  private sendRaw(ws: WebSocket, data: string): void {\n    ws.send(data);\n  }\n\n  private async deriveSecret(): Promise<void> {\n    if (!this.peerPublicKeyHex) return;\n    const privateKey = await importKeyFromHex('private', this.privateKeyHex);\n    const peerPublicKey = await importKeyFromHex('public', this.peerPublicKeyHex);\n    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);\n  }\n}\n\n/**\n * Validate message size before sending to the relay.\n * Throws with a descriptive error if the message is too large.\n */\nfunction assertMessageSize(serialized: string, method: string): void {\n  const byteLength = Buffer.byteLength(serialized, 'utf-8');\n  if (byteLength > MAX_MESSAGE_BYTES) {\n    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);\n    throw new Error(\n      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). ` +\n        'Try reducing the number of calls in your batch.'\n    );\n  }\n}\n\nfunction safeParse(data: WebSocket.Data): Record<string, unknown> | null {\n  try {\n    return JSON.parse(data.toString()) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Bridge lifecycle management — relay edition.\n *\n * - Generates a session token + ECDH keypair for new sessions\n * - Opens the browser to keys.jaw.id/cli-bridge\n * - Saves relay state to ~/.jaw/relay.json\n * - Creates a WSBridge client connected to the relay\n */\n\nimport * as fs from 'node:fs';\nimport * as crypto from 'node:crypto';\nimport { PATHS } from './paths.js';\nimport { ensureDir, loadConfig } from './config.js';\nimport { WSBridge } from './ws-bridge.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\nimport { generateKeyPair, exportKeyToHex } from './crypto.js';\n\nconst DEFAULT_KEYS_URL = 'https://keys.jaw.id';\nconst DEFAULT_RELAY_URL = 'wss://relay.jaw.id';\n\ninterface RelaySession {\n  session: string;\n  relayUrl: string;\n  privateKey: string;\n  publicKey: string;\n  peerPublicKey: string | null;\n  startedAt: string;\n}\n\nexport interface BridgeOptions {\n  keysUrl?: string;\n  relayUrl?: string;\n  apiKey: string;\n  chainId?: number;\n  ens?: string;\n  paymasterUrl?: string;\n  timeout?: number;\n}\n\nfunction loadRelaySession(): RelaySession | null {\n  try {\n    if (!fs.existsSync(PATHS.relay)) return null;\n    const raw = fs.readFileSync(PATHS.relay, 'utf-8');\n    const parsed = JSON.parse(raw) as RelaySession;\n    // Basic validation\n    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {\n      return null;\n    }\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nfunction saveRelaySession(info: RelaySession): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nfunction deleteRelaySession(): void {\n  try {\n    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);\n  } catch {\n    // ignore\n  }\n}\n\n/**\n * Get or create a relay bridge connection.\n */\nexport async function getBridge(options: BridgeOptions): Promise<WSBridge> {\n  const config = loadConfig();\n  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;\n  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;\n  const chainId = options.chainId ?? config.defaultChain ?? 1;\n  if (!isValidKeysUrl(keysUrl)) {\n    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (!isValidRelayUrl(relayUrl)) {\n    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n\n  // Try existing session first\n  let relaySession = loadRelaySession();\n  if (relaySession && relaySession.relayUrl === relayUrl) {\n    try {\n      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl);\n    } catch {\n      // Connection failed — stale session or relay restarted.\n      // Delete and fall through to create a new one.\n      deleteRelaySession();\n      relaySession = null;\n    }\n  }\n\n  // New session\n  const session = await createNewSession(relayUrl);\n  saveRelaySession(session);\n  return await connectBridge(session, options, chainId, keysUrl, relayUrl);\n}\n\nasync function createNewSession(relayUrl: string): Promise<RelaySession> {\n  const kp = await generateKeyPair();\n  const privateKey = await exportKeyToHex('private', kp.privateKey);\n  const publicKey = await exportKeyToHex('public', kp.publicKey);\n\n  return {\n    session: crypto.randomUUID(),\n    relayUrl,\n    privateKey,\n    publicKey,\n    peerPublicKey: null,\n    startedAt: new Date().toISOString(),\n  };\n}\n\nasync function connectBridge(\n  relaySession: RelaySession,\n  options: BridgeOptions,\n  chainId: number,\n  keysUrl: string,\n  relayUrl: string\n): Promise<WSBridge> {\n  const config = loadConfig();\n  const bridge = new WSBridge({\n    relayUrl,\n    session: relaySession.session,\n    timeout: options.timeout,\n    config: {\n      apiKey: options.apiKey,\n      chainId,\n      ens: options.ens ?? config.ens,\n      paymasterUrl: options.paymasterUrl ?? config.paymasterUrl,\n    },\n    privateKeyHex: relaySession.privateKey,\n    publicKeyHex: relaySession.publicKey,\n    peerPublicKeyHex: relaySession.peerPublicKey,\n  });\n\n  await bridge.connect(\n    // onBrowserNeeded\n    async () => {\n      const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);\n      const { default: open } = await import('open');\n      await open(bridgeUrl);\n    },\n    // onPeerKeyChanged\n    (newPeerKey) => {\n      relaySession.peerPublicKey = newPeerKey;\n      saveRelaySession(relaySession);\n    }\n  );\n\n  return bridge;\n}\n\nfunction buildBridgeUrl(keysUrl: string, session: string, relayUrl: string, cliPublicKeyHex: string): string {\n  const url = new URL('/cli-bridge', keysUrl);\n  url.searchParams.set('session', session);\n  url.searchParams.set('relay', relayUrl);\n  // CLI public key in fragment — not sent to server\n  url.hash = `pk=${cliPublicKeyHex}`;\n  return url.toString();\n}\n\n/**\n * Shutdown: close the relay session and clean up.\n */\nexport async function shutdownDaemon(): Promise<void> {\n  const session = loadRelaySession();\n  if (!session) return;\n\n  // Send shutdown directly — no init/ready handshake needed\n  try {\n    const bridge = new WSBridge({\n      relayUrl: session.relayUrl,\n      session: session.session,\n      timeout: 5000,\n      config: { apiKey: '', chainId: 1 },\n      privateKeyHex: session.privateKey,\n      publicKeyHex: session.publicKey,\n      peerPublicKeyHex: session.peerPublicKey,\n    });\n    await bridge.connectAndShutdown();\n  } catch {\n    // Best effort — relay or browser may already be gone\n  }\n\n  deleteRelaySession();\n\n  // Legacy cleanup: kill old daemon process and remove files\n  const legacyBridge = PATHS.root + '/bridge.json';\n  const legacyLog = PATHS.root + '/daemon.log';\n  const legacyLock = PATHS.root + '/daemon.lock';\n  try {\n    if (fs.existsSync(legacyBridge)) {\n      const info = JSON.parse(fs.readFileSync(legacyBridge, 'utf-8'));\n      if (info.pid && Number.isInteger(info.pid) && info.pid > 0) {\n        try {\n          process.kill(info.pid, 'SIGTERM');\n        } catch {\n          /* already dead */\n        }\n      }\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const f of [legacyBridge, legacyLog, legacyLock]) {\n    try {\n      if (fs.existsSync(f)) fs.unlinkSync(f);\n    } catch {\n      /* ignore */\n    }\n  }\n}\n","import * as fs from 'node:fs';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { mcpError } from '../helpers.js';\nimport { shutdownDaemon } from '../../lib/bridge-singleton.js';\nimport { PATHS } from '../../lib/paths.js';\nimport { loadConfig, redactConfig } from '../../lib/config.js';\n\nexport function registerDaemonTools(server: McpServer): void {\n  server.tool(\n    'jaw_status',\n    'Check the current status of the JAW.id relay bridge — whether a relay session ' +\n      'exists, the bridge connection is active, and what configuration is in use.',\n    {},\n    async () => {\n      try {\n        let relaySession = false;\n\n        try {\n          if (fs.existsSync(PATHS.relay)) {\n            JSON.parse(fs.readFileSync(PATHS.relay, 'utf-8'));\n            relaySession = true;\n          }\n        } catch {\n          relaySession = false;\n        }\n\n        const config = redactConfig(loadConfig());\n\n        const status = {\n          relay: relaySession ? { session: true } : { session: false },\n          bridgeConnection: 'disconnected',\n          config,\n        };\n\n        return {\n          content: [{ type: 'text' as const, text: JSON.stringify(status, null, 2) }],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n\n  server.tool(\n    'jaw_disconnect',\n    'Close the relay session and browser tab. ' +\n      'Call this when you are done making wallet requests to clean up resources.',\n    {},\n    async () => {\n      try {\n        await shutdownDaemon();\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: 'Relay session closed and browser tab dismissed.',\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n}\n"]}
+{"version":3,"sources":["../../../src/mcp/helpers.ts","../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/crypto.ts","../../../src/lib/ws-bridge.ts","../../../src/lib/bridge-singleton.ts","../../../src/mcp/handlers/daemon.ts"],"names":["fs","fs3"],"mappings":";;;;;;;;;AAAO,SAAS,SAAS,GAAA,EAAc;AACrC,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,IAAA;AAAA,IACT,OAAA,EAAS;AAAA,MACP;AAAA,QACE,IAAA,EAAM,MAAA;AAAA,QACN,IAAA,EAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA;AAClE;AACF,GACF;AACF;ACPA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;ACPO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAGA,cAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAGA,GAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAGA,GAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ;AAAA,GAC9D;AACF;;;ACnCA,IAAM,MAAA,GAAS,WAAW,MAAA,CAAO,MAAA;AAQjC,eAAsB,kBAAA,CAAmB,YAAkB,aAAA,EAAoC;AAC7F,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAA,EAAQ,aAAA,EAAc;AAAA,IACtC,UAAA;AAAA,IACA,EAAE,IAAA,EAAM,SAAA,EAAW,MAAA,EAAQ,GAAA,EAAI;AAAA,IAC/B,KAAA;AAAA,IACA,CAAC,WAAW,SAAS;AAAA,GACvB;AACF;AASA,eAAsB,cAAA,CAAe,cAAoB,OAAA,EAA8D;AACrH,EAAA,MAAM,KAAK,UAAA,CAAW,MAAA,CAAO,gBAAgB,IAAI,UAAA,CAAW,EAAE,CAAC,CAAA;AAC/D,EAAA,MAAM,SAAA,GAAY,IAAI,WAAA,EAAY,CAAE,OAAO,IAAA,CAAK,SAAA,CAAU,OAAO,CAAC,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,SAAS,CAAA;AACvF,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,eAAe,EAAE,CAAA;AAAA,IACrB,UAAA,EAAY,cAAA,CAAe,IAAI,UAAA,CAAW,SAAS,CAAC;AAAA,GACtD;AACF;AAEA,eAAsB,cAAA,CACpB,cACA,QAAA,EACkC;AAClC,EAAA,MAAM,EAAA,GAAK,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,IAAI,QAAQ,CAAA;AAC5C,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,IAAA,CAAK,QAAA,CAAS,YAAY,QAAQ,CAAA;AAC5D,EAAA,MAAM,QAAA,GAAW,MAAM,MAAA,CAAO,OAAA,CAAQ,EAAE,MAAM,SAAA,EAAW,EAAA,EAAG,EAAG,YAAA,EAAc,UAAU,CAAA;AACvF,EAAA,OAAO,KAAK,KAAA,CAAM,IAAI,aAAY,CAAE,MAAA,CAAO,QAAQ,CAAC,CAAA;AACtD;AAUA,eAAsB,gBAAA,CAAiB,MAA4B,GAAA,EAA4B;AAC7F,EAAA,MAAM,MAAA,GAAS,IAAA,KAAS,SAAA,GAAY,OAAA,GAAU,MAAA;AAC9C,EAAA,OAAO,MAAA,CAAO,SAAA;AAAA,IACZ,MAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,UAAA,CAAW,GAAG,CAAC,CAAA;AAAA,IAC3B,EAAE,IAAA,EAAM,MAAA,EAAQ,UAAA,EAAY,OAAA,EAAQ;AAAA,IACpC,IAAA;AAAA,IACA,IAAA,KAAS,SAAA,GAAY,CAAC,WAAW,IAAI;AAAC,GACxC;AACF;AAUA,SAAS,WAAW,GAAA,EAAyB;AAC3C,EAAA,IAAI,IAAI,MAAA,GAAS,CAAA,KAAM,GAAG,MAAM,IAAI,MAAM,yBAAyB,CAAA;AACnE,EAAA,MAAM,KAAA,GAAQ,IAAI,UAAA,CAAW,GAAA,CAAI,SAAS,CAAC,CAAA;AAC3C,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,GAAA,CAAI,MAAA,EAAQ,KAAK,CAAA,EAAG;AACtC,IAAA,KAAA,CAAM,CAAA,GAAI,CAAC,CAAA,GAAI,QAAA,CAAS,GAAA,CAAI,UAAU,CAAA,EAAG,CAAA,GAAI,CAAC,CAAA,EAAG,EAAE,CAAA;AAAA,EACrD;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,eAAe,GAAA,EAAyB;AAC/C,EAAA,OAAO,MAAA,CAAO,IAAA,CAAK,GAAG,CAAA,CAAE,SAAS,QAAQ,CAAA;AAC3C;;;ACxDA,IAAM,kBAAA,GAAqB,IAAA;AAU3B,IAAM,iBAAA,GAAoB,IAAI,IAAA,GAAO,IAAA;AAGrC,IAAM,0BAAA,GAA6B,GAAA;AAGnC,IAAM,sBAAA,GAAyB,CAAA;AAG/B,IAAM,uBAAA,GAA0B,GAAA;AAEzB,IAAM,WAAN,MAAe;AAAA,EACH,QAAA;AAAA,EACA,OAAA;AAAA,EACA,OAAA;AAAA,EACA,MAAA;AAAA,EACA,aAAA;AAAA,EACR,YAAA;AAAA,EACD,gBAAA;AAAA,EACA,YAAA,GAA4B,IAAA;AAAA,EAC5B,EAAA,GAAuB,IAAA;AAAA,EACvB,QAAA,GAAW,KAAA;AAAA;AAAA,EAGX,eAAA;AAAA,EACA,gBAAA;AAAA,EACA,mBAAA,GAAsB,CAAA;AAAA;AAAA,EAGtB,iBAAA,GAAoB,CAAA;AAAA;AAAA,EAG5B,IAAI,aAAA,GAA+B;AACjC,IAAA,OAAO,IAAA,CAAK,gBAAA;AAAA,EACd;AAAA,EAEA,YAAY,OAAA,EAA0B;AACpC,IAAA,IAAA,CAAK,WAAW,OAAA,CAAQ,QAAA;AACxB,IAAA,IAAA,CAAK,UAAU,OAAA,CAAQ,OAAA;AACvB,IAAA,IAAA,CAAK,OAAA,GAAU,QAAQ,OAAA,IAAW,kBAAA;AAClC,IAAA,IAAA,CAAK,SAAS,OAAA,CAAQ,MAAA;AACtB,IAAA,IAAA,CAAK,gBAAgB,OAAA,CAAQ,aAAA;AAC7B,IAAA,IAAA,CAAK,eAAe,OAAA,CAAQ,YAAA;AAC5B,IAAA,IAAA,CAAK,mBAAmB,OAAA,CAAQ,gBAAA;AAAA,EAClC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAA,CACJ,eAAA,EACA,gBAAA,EACe;AAEf,IAAA,IAAA,CAAK,eAAA,GAAkB,eAAA;AACvB,IAAA,IAAA,CAAK,gBAAA,GAAmB,gBAAA;AAGxB,IAAA,IAAI,KAAK,gBAAA,EAAkB;AACzB,MAAA,MAAM,KAAK,YAAA,EAAa;AAAA,IAC1B;AAEA,IAAA,OAAO,IAAA,CAAK,eAAA,CAAgB,eAAA,EAAiB,gBAAgB,CAAA;AAAA,EAC/D;AAAA,EAEA,MAAc,eAAA,CACZ,eAAA,EACA,gBAAA,EACe;AACf,IAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,IAAI,aAAA,GAAgB,KAAA;AACpB,MAAA,IAAI,QAAA,GAAW,KAAA;AACf,MAAA,IAAI,oBAAA,GAAuB,CAAC,IAAA,CAAK,gBAAA;AAEjC,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAA,MAAA,CAAO,IAAI,KAAA,CAAM,wEAA6E,CAAC,CAAA;AAAA,MACjG,GAAG,GAAM,CAAA;AAET,MAAA,MAAM,oBAAoB,YAAY;AACpC,QAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACxB,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM,MAAA;AAAA,UACN,MAAA,EAAQ,KAAK,MAAA,CAAO,MAAA;AAAA,UACpB,OAAA,EAAS,KAAK,MAAA,CAAO,OAAA;AAAA,UACrB,GAAA,EAAK,KAAK,MAAA,CAAO,GAAA;AAAA,UACjB,YAAA,EAAc,KAAK,MAAA,CAAO;AAAA,SAC3B,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MACrE,CAAA;AAEA,MAAA,MAAM,eAAe,MAAM;AACzB,QAAA,MAAM,UAAA,GAAa,WAAW,MAAM;AAClC,UAAA,EAAA,CAAG,KAAA,EAAM;AACT,UAAA,MAAA,CAAO,IAAI,KAAA,CAAM,2CAA2C,CAAC,CAAA;AAAA,QAC/D,GAAG,IAAM,CAAA;AAET,QAAA,MAAM,KAAA,GAAQ,OAAO,IAAA,KAAyB;AAC5C,UAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,UAAA,IAAI,CAAC,GAAA,EAAK;AAEV,UAAA,IAAI,GAAA,CAAI,IAAA,KAAS,WAAA,IAAe,IAAA,CAAK,YAAA,EAAc;AACjD,YAAA,IAAI;AACF,cAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,cAAA,IAAI,KAAA,CAAM,SAAS,OAAA,EAAS;AAC1B,gBAAA,YAAA,CAAa,UAAU,CAAA;AACvB,gBAAA,EAAA,CAAG,GAAA,CAAI,WAAW,KAAK,CAAA;AACvB,gBAAA,IAAA,CAAK,iBAAA,GAAoB,CAAA;AACzB,gBAAA,OAAA,EAAQ;AAAA,cACV;AAAA,YACF,CAAA,CAAA,MAAQ;AAAA,YAER;AAAA,UACF;AAAA,QACF,CAAA;AACA,QAAA,EAAA,CAAG,EAAA,CAAG,WAAW,KAAK,CAAA;AAAA,MACxB,CAAA;AAEA,MAAA,MAAM,iBAAiB,YAAY;AACjC,QAAA,IAAI,QAAA,EAAU;AACd,QAAA,QAAA,GAAW,IAAA;AACX,QAAA,YAAA,CAAa,KAAK,CAAA;AAElB,QAAA,YAAA,EAAa;AACb,QAAA,MAAM,iBAAA,EAAkB;AAAA,MAC1B,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,MAAM;AAClB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAA,EAAW,OAAO,IAAA,KAAS;AAC/B,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,EAAK;AAEV,QAAA,IAAI,GAAA,CAAI,SAAS,QAAA,EAAU;AACzB,UAAA,IAAI,IAAI,gBAAA,EAAkB;AACxB,YAAA,IAAI,KAAK,YAAA,EAAc;AAErB,cAAA,MAAM,cAAA,EAAe;AAAA,YACvB,CAAA,MAAO;AAEL,cAAA,oBAAA,GAAuB,IAAA;AAAA,YACzB;AAAA,UACF,CAAA,MAAA,IAAW,CAAC,aAAA,IAAiB,eAAA,EAAiB;AAC5C,YAAA,aAAA,GAAgB,IAAA;AAChB,YAAA,oBAAA,GAAuB,IAAA;AACvB,YAAA,eAAA,EAAgB,CAAE,MAAM,MAAM;AAAA,YAE9B,CAAC,CAAA;AAAA,UACH,CAAA,MAAA,IAAW,CAAC,eAAA,EAAiB;AAM3B,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,KAAA,EAAM;AACT,YAAA,MAAA,CAAO,IAAI,KAAA,CAAM,sDAAiD,CAAC,CAAA;AAAA,UACrE;AAAA,QACF,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,mBAAA,EAAqB;AAC3C,UAAA,oBAAA,GAAuB,IAAA;AAAA,QAEzB,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,sBAAA,EAAwB;AAE9C,UAAA,IAAA,CAAK,uBAAA,EAAwB;AAAA,QAC/B,CAAA,MAAA,IAAW,GAAA,CAAI,IAAA,KAAS,cAAA,IAAkB,oBAAA,EAAsB;AAC9D,UAAA,oBAAA,GAAuB,KAAA;AACvB,UAAA,MAAM,UAAU,GAAA,CAAI,SAAA;AACpB,UAAA,IAAA,CAAK,gBAAA,GAAmB,OAAA;AACxB,UAAA,MAAM,KAAK,YAAA,EAAa;AACxB,UAAA,gBAAA,GAAmB,OAAO,CAAA;AAC1B,UAAA,MAAM,cAAA,EAAe;AAAA,QACvB;AAAA,MACF,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,OAAA,EAAS,CAAC,GAAA,KAAQ;AACtB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,MAAA,CAAO,GAAG,CAAA;AAAA,MACZ,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,IAAI,CAAC,KAAK,QAAA,EAAU;AAClB,UAAA,IAAA,CAAK,qBAAA,EAAsB;AAAA,QAC7B;AAAA,MACF,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAA,CAAQ,MAAA,EAAgB,MAAA,EAAoC;AAChE,IAAA,MAAM,KAAK,IAAA,CAAK,EAAA;AAChB,IAAA,IAAI,CAAC,EAAA,IAAM,EAAA,CAAG,UAAA,KAAe,UAAU,IAAA,EAAM;AAC3C,MAAA,MAAM,IAAI,MAAM,wBAAwB,CAAA;AAAA,IAC1C;AACA,IAAA,IAAI,CAAC,KAAK,YAAA,EAAc;AACtB,MAAA,MAAM,IAAI,MAAM,oDAA+C,CAAA;AAAA,IACjE;AAEA,IAAA,MAAM,KAAY,MAAA,CAAA,UAAA,EAAW;AAE7B,IAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,MACvD,IAAA,EAAM,aAAA;AAAA,MACN,EAAA;AAAA,MACA,MAAA;AAAA,MACA;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,KAAK,SAAA,CAAU,EAAE,MAAM,WAAA,EAAa,GAAG,UAAU,CAAA;AACpE,IAAA,iBAAA,CAAkB,YAAY,MAAM,CAAA;AAEpC,IAAA,OAAO,IAAI,OAAA,CAAiB,CAAC,OAAA,EAAS,MAAA,KAAW;AAC/C,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,MAAA;AAAA,UACE,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAA,GAAU,GAAI,CAAA,8CAAA,CAAqD;AAAA,SAC/G;AACA,QAAA,IAAA,CAAK,KAAA,EAAM;AAAA,MACb,CAAA,EAAG,KAAK,OAAO,CAAA;AAEf,MAAA,MAAM,SAAA,GAAY,OAAO,IAAA,KAAyB;AAChD,QAAA,MAAM,GAAA,GAAM,UAAU,IAAI,CAAA;AAC1B,QAAA,IAAI,CAAC,GAAA,IAAO,GAAA,CAAI,SAAS,WAAA,IAAe,CAAC,KAAK,YAAA,EAAc;AAE5D,QAAA,IAAI;AACF,UAAA,MAAM,KAAA,GAAQ,MAAM,cAAA,CAAe,IAAA,CAAK,cAAc,GAAmC,CAAA;AACzF,UAAA,IAAI,KAAA,CAAM,IAAA,KAAS,cAAA,IAAkB,KAAA,CAAM,OAAO,EAAA,EAAI;AACpD,YAAA,YAAA,CAAa,KAAK,CAAA;AAClB,YAAA,EAAA,CAAG,GAAA,CAAI,WAAW,SAAS,CAAA;AAE3B,YAAA,IAAI,MAAM,OAAA,EAAS;AACjB,cAAA,OAAA,CAAQ,MAAM,IAAI,CAAA;AAAA,YACpB,CAAA,MAAO;AACL,cAAA,MAAM,MAAM,KAAA,CAAM,KAAA;AAClB,cAAA,MAAA,CAAO,IAAI,KAAA,CAAM,GAAA,GAAM,CAAA,CAAA,EAAI,GAAA,CAAI,IAAI,CAAA,EAAA,EAAK,GAAA,CAAI,OAAO,CAAA,CAAA,GAAK,gBAAgB,CAAC,CAAA;AAAA,YAC3E;AAAA,UACF;AAAA,QACF,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF,CAAA;AAEA,MAAA,EAAA,CAAG,EAAA,CAAG,WAAW,SAAS,CAAA;AAC1B,MAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,UAAU,CAAA;AAAA,IAC7B,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI,UAAA,KAAe,SAAA,CAAU,IAAA,IAAQ,KAAK,YAAA,EAAc;AAC/D,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,MAAM,cAAA,CAAe,IAAA,CAAK,YAAA,EAAc;AAAA,UACvD,IAAA,EAAM;AAAA,SACP,CAAA;AACD,QAAA,IAAA,CAAK,OAAA,CAAQ,IAAA,CAAK,EAAA,EAAI,IAAA,CAAK,SAAA,CAAU,EAAE,IAAA,EAAM,WAAA,EAAa,GAAG,QAAA,EAAU,CAAC,CAAA;AAAA,MAC1E,CAAA,CAAA,MAAQ;AAAA,MAER;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAA,EAAM;AAAA,EACb;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,kBAAA,GAAoC;AACxC,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAE1B,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,MAAM,KAAK,YAAA,EAAa;AAExB,IAAA,OAAO,IAAI,OAAA,CAAc,CAAC,OAAA,KAAY;AACpC,MAAA,MAAM,GAAA,GAAM,GAAG,IAAA,CAAK,QAAQ,YAAY,kBAAA,CAAmB,IAAA,CAAK,OAAO,CAAC,CAAA,SAAA,CAAA;AACxE,MAAA,MAAM,EAAA,GAAK,IAAI,SAAA,CAAU,GAAG,CAAA;AAE5B,MAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,QAAA,IAAI;AACF,UAAA,EAAA,CAAG,KAAA,EAAM;AAAA,QACX,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,OAAA,EAAQ;AAAA,MACV,GAAG,GAAI,CAAA;AAEP,MAAA,EAAA,CAAG,EAAA,CAAG,QAAQ,YAAY;AACxB,QAAA,IAAA,CAAK,EAAA,GAAK,EAAA;AACV,QAAA,IAAI;AACF,UAAA,MAAM,KAAK,QAAA,EAAS;AAAA,QACtB,CAAA,CAAA,MAAQ;AAAA,QAER;AACA,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAED,MAAA,EAAA,CAAG,EAAA,CAAG,SAAS,MAAM;AACnB,QAAA,YAAA,CAAa,KAAK,CAAA;AAClB,QAAA,OAAA,EAAQ;AAAA,MACV,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAAA,EAEA,KAAA,GAAc;AACZ,IAAA,IAAA,CAAK,QAAA,GAAW,IAAA;AAChB,IAAA,IAAI,KAAK,EAAA,EAAI;AACX,MAAA,IAAI;AACF,QAAA,IAAA,CAAK,GAAG,KAAA,EAAM;AAAA,MAChB,CAAA,CAAA,MAAQ;AAAA,MAER;AACA,MAAA,IAAA,CAAK,EAAA,GAAK,IAAA;AAAA,IACZ;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,uBAAA,GAAgC;AACtC,IAAA,IAAI,IAAA,CAAK,QAAA,IAAY,CAAC,IAAA,CAAK,eAAA,EAAiB;AAE5C,IAAA,MAAM,GAAA,GAAM,KAAK,GAAA,EAAI;AACrB,IAAA,IAAI,GAAA,GAAM,IAAA,CAAK,mBAAA,GAAsB,0BAAA,EAA4B;AAC/D,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,mBAAA,GAAsB,GAAA;AAG3B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AACpB,IAAA,IAAA,CAAK,gBAAA,GAAmB,IAAA;AAExB,IAAA,IAAA,CAAK,eAAA,EAAgB,CAAE,KAAA,CAAM,MAAM;AAAA,IAEnC,CAAC,CAAA;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,qBAAA,GAA8B;AACpC,IAAA,IAAI,KAAK,QAAA,EAAU;AACnB,IAAA,IAAI,IAAA,CAAK,qBAAqB,sBAAA,EAAwB;AAEtD,IAAA,MAAM,QAAQ,uBAAA,GAA0B,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,iBAAiB,CAAA;AAC1E,IAAA,IAAA,CAAK,iBAAA,EAAA;AAEL,IAAA,UAAA,CAAW,MAAM;AACf,MAAA,IAAI,KAAK,QAAA,EAAU;AACnB,MAAA,IAAA,CAAK,gBAAgB,IAAA,CAAK,eAAA,EAAiB,KAAK,gBAAgB,CAAA,CAAE,MAAM,MAAM;AAAA,MAE9E,CAAC,CAAA;AAAA,IACH,GAAG,KAAK,CAAA;AAAA,EACV;AAAA;AAAA,EAGQ,OAAA,CAAQ,IAAe,IAAA,EAAoB;AACjD,IAAA,EAAA,CAAG,KAAK,IAAI,CAAA;AAAA,EACd;AAAA,EAEA,MAAc,YAAA,GAA8B;AAC1C,IAAA,IAAI,CAAC,KAAK,gBAAA,EAAkB;AAC5B,IAAA,MAAM,UAAA,GAAa,MAAM,gBAAA,CAAiB,SAAA,EAAW,KAAK,aAAa,CAAA;AACvE,IAAA,MAAM,aAAA,GAAgB,MAAM,gBAAA,CAAiB,QAAA,EAAU,KAAK,gBAAgB,CAAA;AAC5E,IAAA,IAAA,CAAK,YAAA,GAAe,MAAM,kBAAA,CAAmB,UAAA,EAAY,aAAa,CAAA;AAAA,EACxE;AACF,CAAA;AAMA,SAAS,iBAAA,CAAkB,YAAoB,MAAA,EAAsB;AACnE,EAAA,MAAM,UAAA,GAAa,MAAA,CAAO,UAAA,CAAW,UAAA,EAAY,OAAO,CAAA;AACxD,EAAA,IAAI,aAAa,iBAAA,EAAmB;AAClC,IAAA,MAAM,MAAA,GAAA,CAAU,UAAA,IAAc,IAAA,GAAO,IAAA,CAAA,EAAO,QAAQ,CAAC,CAAA;AACrD,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,eAAe,MAAM,CAAA,eAAA,EAAkB,MAAM,CAAA,WAAA,EAAc,iBAAA,IAAqB,OAAO,IAAA,CAAK,CAAA,qDAAA;AAAA,KAE9F;AAAA,EACF;AACF;AAEA,SAAS,UAAU,IAAA,EAAsD;AACvE,EAAA,IAAI;AACF,IAAA,OAAO,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU,CAAA;AAAA,EACnC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;;;AC7ZA,SAAS,gBAAA,GAAwC;AAC/C,EAAA,IAAI;AACF,IAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,GAAG,OAAO,IAAA;AACxC,IAAA,MAAM,GAAA,GAAS,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAA;AAChD,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAE7B,IAAA,IAAI,CAAC,MAAA,CAAO,OAAA,IAAW,CAAC,MAAA,CAAO,QAAA,IAAY,CAAC,MAAA,CAAO,UAAA,IAAc,CAAC,MAAA,CAAO,SAAA,EAAW;AAClF,MAAA,OAAO,IAAA;AAAA,IACT;AACA,IAAA,OAAO,MAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAUA,SAAS,kBAAA,GAA2B;AAClC,EAAA,IAAI;AACF,IAAA,IAAO,eAAW,KAAA,CAAM,KAAK,GAAM,GAAA,CAAA,UAAA,CAAW,MAAM,KAAK,CAAA;AAAA,EAC3D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AA8GA,eAAsB,cAAA,GAAgC;AACpD,EAAA,MAAM,UAAU,gBAAA,EAAiB;AACjC,EAAA,IAAI,CAAC,OAAA,EAAS;AAGd,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,QAAA,CAAS;AAAA,MAC1B,UAAU,OAAA,CAAQ,QAAA;AAAA,MAClB,SAAS,OAAA,CAAQ,OAAA;AAAA,MACjB,OAAA,EAAS,GAAA;AAAA,MACT,MAAA,EAAQ,EAAE,MAAA,EAAQ,EAAA,EAAI,SAAS,CAAA,EAAE;AAAA,MACjC,eAAe,OAAA,CAAQ,UAAA;AAAA,MACvB,cAAc,OAAA,CAAQ,SAAA;AAAA,MACtB,kBAAkB,OAAA,CAAQ;AAAA,KAC3B,CAAA;AACD,IAAA,MAAM,OAAO,kBAAA,EAAmB;AAAA,EAClC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,kBAAA,EAAmB;AAGnB,EAAA,MAAM,YAAA,GAAe,MAAM,IAAA,GAAO,cAAA;AAClC,EAAA,MAAM,SAAA,GAAY,MAAM,IAAA,GAAO,aAAA;AAC/B,EAAA,MAAM,UAAA,GAAa,MAAM,IAAA,GAAO,cAAA;AAChC,EAAA,IAAI;AACF,IAAA,IAAO,GAAA,CAAA,UAAA,CAAW,YAAY,CAAA,EAAG;AAC/B,MAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAS,GAAA,CAAA,YAAA,CAAa,YAAA,EAAc,OAAO,CAAC,CAAA;AAC9D,MAAA,IAAI,IAAA,CAAK,OAAO,MAAA,CAAO,SAAA,CAAU,KAAK,GAAG,CAAA,IAAK,IAAA,CAAK,GAAA,GAAM,CAAA,EAAG;AAC1D,QAAA,IAAI;AACF,UAAA,OAAA,CAAQ,IAAA,CAAK,IAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AAAA,QAClC,CAAA,CAAA,MAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,KAAA,MAAW,CAAA,IAAK,CAAC,YAAA,EAAc,SAAA,EAAW,UAAU,CAAA,EAAG;AACrD,IAAA,IAAI;AACF,MAAA,IAAO,GAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAM,eAAW,CAAC,CAAA;AAAA,IACvC,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AC1NO,SAAS,oBAAoB,MAAA,EAAyB;AAC3D,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,YAAA;AAAA,IACA,+JAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,IAAI,YAAA,GAAe,KAAA;AAEnB,QAAA,IAAI;AACF,UAAA,IAAOC,GAAA,CAAA,UAAA,CAAW,KAAA,CAAM,KAAK,CAAA,EAAG;AAC9B,YAAA,IAAA,CAAK,KAAA,CAASA,GAAA,CAAA,YAAA,CAAa,KAAA,CAAM,KAAA,EAAO,OAAO,CAAC,CAAA;AAChD,YAAA,YAAA,GAAe,IAAA;AAAA,UACjB;AAAA,QACF,CAAA,CAAA,MAAQ;AACN,UAAA,YAAA,GAAe,KAAA;AAAA,QACjB;AAEA,QAAA,MAAM,MAAA,GAAS,YAAA,CAAa,UAAA,EAAY,CAAA;AAExC,QAAA,MAAM,MAAA,GAAS;AAAA,UACb,KAAA,EAAO,eAAe,EAAE,OAAA,EAAS,MAAK,GAAI,EAAE,SAAS,KAAA,EAAM;AAAA,UAC3D,gBAAA,EAAkB,cAAA;AAAA,UAClB;AAAA,SACF;AAEA,QAAA,OAAO;AAAA,UACL,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAiB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,SAC5E;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,IAAA;AAAA,IACL,gBAAA;AAAA,IACA,oHAAA;AAAA,IAEA,EAAC;AAAA,IACD,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,cAAA,EAAe;AACrB,QAAA,OAAO;AAAA,UACL,OAAA,EAAS;AAAA,YACP;AAAA,cACE,IAAA,EAAM,MAAA;AAAA,cACN,IAAA,EAAM;AAAA;AACR;AACF,SACF;AAAA,MACF,SAAS,GAAA,EAAK;AACZ,QAAA,OAAO,SAAS,GAAG,CAAA;AAAA,MACrB;AAAA,IACF;AAAA,GACF;AACF","file":"daemon.js","sourcesContent":["export function mcpError(err: unknown) {\n  return {\n    isError: true as const,\n    content: [\n      {\n        type: 'text' as const,\n        text: `Error: ${err instanceof Error ? err.message : String(err)}`,\n      },\n    ],\n  };\n}\n\nexport function mcpResult(data: unknown) {\n  return {\n    content: [\n      {\n        type: 'text' as const,\n        text: JSON.stringify(data),\n      },\n    ],\n  };\n}\n","import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","/**\n * E2E encryption primitives for CLI ↔ browser communication.\n *\n * Uses ECDH P-256 for key exchange and AES-256-GCM for message encryption.\n * Mirrors the same crypto operations in @jaw.id/core but uses only\n * Node.js built-in crypto.subtle — no external dependencies.\n */\n\nimport type { webcrypto } from 'node:crypto';\n\ntype CKey = webcrypto.CryptoKey;\ntype CKeyPair = webcrypto.CryptoKeyPair;\n\nconst subtle = globalThis.crypto.subtle;\n\n// ── Key generation ───────────────────────────────────────────────\n\nexport async function generateKeyPair(): Promise<CKeyPair> {\n  return subtle.generateKey({ name: 'ECDH', namedCurve: 'P-256' }, true, ['deriveKey']) as Promise<CKeyPair>;\n}\n\nexport async function deriveSharedSecret(privateKey: CKey, peerPublicKey: CKey): Promise<CKey> {\n  return subtle.deriveKey(\n    { name: 'ECDH', public: peerPublicKey },\n    privateKey,\n    { name: 'AES-GCM', length: 256 },\n    false,\n    ['encrypt', 'decrypt']\n  );\n}\n\n// ── Encrypt / Decrypt ────────────────────────────────────────────\n\nexport interface EncryptedEnvelope {\n  iv: string; // base64\n  ciphertext: string; // base64\n}\n\nexport async function encryptMessage(sharedSecret: CKey, payload: Record<string, unknown>): Promise<EncryptedEnvelope> {\n  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));\n  const plaintext = new TextEncoder().encode(JSON.stringify(payload));\n  const cipherBuf = await subtle.encrypt({ name: 'AES-GCM', iv }, sharedSecret, plaintext);\n  return {\n    iv: bufferToBase64(iv),\n    ciphertext: bufferToBase64(new Uint8Array(cipherBuf)),\n  };\n}\n\nexport async function decryptMessage(\n  sharedSecret: CKey,\n  envelope: EncryptedEnvelope\n): Promise<Record<string, unknown>> {\n  const iv = Buffer.from(envelope.iv, 'base64');\n  const ciphertext = Buffer.from(envelope.ciphertext, 'base64');\n  const plainBuf = await subtle.decrypt({ name: 'AES-GCM', iv }, sharedSecret, ciphertext);\n  return JSON.parse(new TextDecoder().decode(plainBuf));\n}\n\n// ── Key import / export (hex) ────────────────────────────────────\n\nexport async function exportKeyToHex(type: 'private' | 'public', key: CKey): Promise<string> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  const buf = await subtle.exportKey(format, key);\n  return bytesToHex(new Uint8Array(buf));\n}\n\nexport async function importKeyFromHex(type: 'private' | 'public', hex: string): Promise<CKey> {\n  const format = type === 'private' ? 'pkcs8' : 'spki';\n  return subtle.importKey(\n    format,\n    Buffer.from(hexToBytes(hex)),\n    { name: 'ECDH', namedCurve: 'P-256' },\n    true,\n    type === 'private' ? ['deriveKey'] : []\n  );\n}\n\n// ── Encoding helpers ─────────────────────────────────────────────\n\nfunction bytesToHex(bytes: Uint8Array): string {\n  return Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n}\n\nfunction hexToBytes(hex: string): Uint8Array {\n  if (hex.length % 2 !== 0) throw new Error('Invalid hex: odd length');\n  const bytes = new Uint8Array(hex.length / 2);\n  for (let i = 0; i < hex.length; i += 2) {\n    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);\n  }\n  return bytes;\n}\n\nfunction bufferToBase64(buf: Uint8Array): string {\n  return Buffer.from(buf).toString('base64');\n}\n","/**\n * WSBridge — CLI-side relay client\n *\n * Connects to the cloud relay (wss://relay.jaw.id) instead of a local daemon.\n * All messages (except key_exchange) are E2E encrypted via ECDH + AES-256-GCM.\n */\n\nimport * as crypto from 'node:crypto';\nimport type { webcrypto } from 'node:crypto';\nimport WebSocket from 'ws';\nimport {\n  deriveSharedSecret,\n  encryptMessage,\n  decryptMessage,\n  importKeyFromHex,\n  type EncryptedEnvelope,\n} from './crypto.js';\n\ntype CKey = webcrypto.CryptoKey;\n\nexport interface WSBridgeConfig {\n  apiKey: string;\n  chainId: number;\n  ens?: string;\n  paymasterUrl?: string;\n}\n\nexport interface WSBridgeOptions {\n  relayUrl: string;\n  session: string;\n  timeout?: number;\n  config: WSBridgeConfig;\n  /** CLI's ECDH private key (hex). Loaded from relay.json for existing sessions. */\n  privateKeyHex: string;\n  /** CLI's ECDH public key (hex). Sent to browser for key derivation. */\n  publicKeyHex: string;\n  /** Browser's ECDH public key (hex). Null if new session (key exchange needed). */\n  peerPublicKeyHex: string | null;\n}\n\nconst DEFAULT_TIMEOUT_MS = 120_000;\n\n/**\n * Maximum outbound message size (5 MB).\n *\n * wallet_sendCalls with large batches (50+ calls, complex calldata) can reach\n * hundreds of KB. Base64 encoding of the AES-GCM ciphertext adds ~33% overhead.\n * 5 MB is generous enough for any realistic batch while still preventing\n * accidental memory issues.\n */\nconst MAX_MESSAGE_BYTES = 5 * 1024 * 1024;\n\n/** Minimum time between browser reopen attempts (ms). */\nconst BROWSER_REOPEN_COOLDOWN_MS = 5_000;\n\n/** Maximum reconnection attempts before giving up. */\nconst MAX_RECONNECT_ATTEMPTS = 3;\n\n/** Base delay for exponential backoff (ms). */\nconst RECONNECT_BASE_DELAY_MS = 1_000;\n\nexport class WSBridge {\n  private readonly relayUrl: string;\n  private readonly session: string;\n  private readonly timeout: number;\n  private readonly config: WSBridgeConfig;\n  private readonly privateKeyHex: string;\n  readonly publicKeyHex: string;\n  private peerPublicKeyHex: string | null;\n  private sharedSecret: CKey | null = null;\n  private ws: WebSocket | null = null;\n  private disposed = false;\n\n  // Auto-reopen browser state\n  private onBrowserNeeded: (() => Promise<void>) | undefined;\n  private onPeerKeyChanged: ((key: string) => void) | undefined;\n  private lastBrowserOpenTime = 0;\n\n  // Reconnection state\n  private reconnectAttempts = 0;\n\n  /** Updated after key exchange — caller should persist this. */\n  get peerPublicKey(): string | null {\n    return this.peerPublicKeyHex;\n  }\n\n  constructor(options: WSBridgeOptions) {\n    this.relayUrl = options.relayUrl;\n    this.session = options.session;\n    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;\n    this.config = options.config;\n    this.privateKeyHex = options.privateKeyHex;\n    this.publicKeyHex = options.publicKeyHex;\n    this.peerPublicKeyHex = options.peerPublicKeyHex;\n  }\n\n  /**\n   * Connect to the relay and wait for the browser to be ready.\n   *\n   * @param onBrowserNeeded — called when the relay reports no browser connected.\n   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.\n   */\n  async connect(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    // Store callbacks for auto-reopen on browser disconnect\n    this.onBrowserNeeded = onBrowserNeeded;\n    this.onPeerKeyChanged = onPeerKeyChanged;\n\n    // Pre-derive shared secret if we already have the peer key\n    if (this.peerPublicKeyHex) {\n      await this.deriveSecret();\n    }\n\n    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);\n  }\n\n  private async connectInternal(\n    onBrowserNeeded?: () => Promise<void>,\n    onPeerKeyChanged?: (newPeerPublicKeyHex: string) => void\n  ): Promise<void> {\n    return new Promise((resolve, reject) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      let browserOpened = false;\n      let resolved = false;\n      let expectingKeyExchange = !this.peerPublicKeyHex;\n\n      const timer = setTimeout(() => {\n        ws.close();\n        reject(new Error('Browser did not connect in time.\\n' + 'Run `jaw disconnect` then try again.'));\n      }, 30_000);\n\n      const sendEncryptedInit = async () => {\n        if (!this.sharedSecret) return;\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'init',\n          apiKey: this.config.apiKey,\n          chainId: this.config.chainId,\n          ens: this.config.ens,\n          paymasterUrl: this.config.paymasterUrl,\n        });\n        this.sendRaw(ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      };\n\n      const waitForReady = () => {\n        const readyTimer = setTimeout(() => {\n          ws.close();\n          reject(new Error('Browser SDK did not become ready in time.'));\n        }, 15_000);\n\n        const onMsg = async (data: WebSocket.Data) => {\n          const msg = safeParse(data);\n          if (!msg) return;\n\n          if (msg.type === 'encrypted' && this.sharedSecret) {\n            try {\n              const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n              if (inner.type === 'ready') {\n                clearTimeout(readyTimer);\n                ws.off('message', onMsg);\n                this.reconnectAttempts = 0; // Reset on successful connect\n                resolve();\n              }\n            } catch {\n              // Not a valid encrypted message for us, ignore\n            }\n          }\n        };\n        ws.on('message', onMsg);\n      };\n\n      const onBrowserReady = async () => {\n        if (resolved) return;\n        resolved = true;\n        clearTimeout(timer);\n        // Set up listener BEFORE sending init to avoid missing the ready response\n        waitForReady();\n        await sendEncryptedInit();\n      };\n\n      ws.on('open', () => {\n        this.ws = ws;\n      });\n\n      ws.on('message', async (data) => {\n        const msg = safeParse(data);\n        if (!msg) return;\n\n        if (msg.type === 'status') {\n          if (msg.browserConnected) {\n            if (this.sharedSecret) {\n              // Already have shared secret — skip key exchange\n              await onBrowserReady();\n            } else {\n              // Browser is connected but we don't have its key yet.\n              expectingKeyExchange = true;\n            }\n          } else if (!browserOpened && onBrowserNeeded) {\n            browserOpened = true;\n            expectingKeyExchange = true;\n            onBrowserNeeded().catch(() => {\n              /* best effort */\n            });\n          } else if (!onBrowserNeeded) {\n            // Reuse path (bridge-singleton.ts called connectBridge with\n            // openBrowser=false): the relay reports no browser connected and\n            // we have no callback to open one. Bail immediately so the\n            // caller can fall through to a fresh session, instead of waiting\n            // out the 30s connect-timer.\n            clearTimeout(timer);\n            ws.close();\n            reject(new Error('Browser not connected — relay session is stale.'));\n          }\n        } else if (msg.type === 'browser_connected') {\n          expectingKeyExchange = true;\n          // Wait for key_exchange from browser\n        } else if (msg.type === 'browser_disconnected') {\n          // Browser tab closed — attempt to reopen after cooldown\n          this.handleBrowserDisconnect();\n        } else if (msg.type === 'key_exchange' && expectingKeyExchange) {\n          expectingKeyExchange = false;\n          const peerKey = msg.publicKey as string;\n          this.peerPublicKeyHex = peerKey;\n          await this.deriveSecret();\n          onPeerKeyChanged?.(peerKey);\n          await onBrowserReady();\n        }\n      });\n\n      ws.on('error', (err) => {\n        clearTimeout(timer);\n        reject(err);\n      });\n\n      ws.on('close', () => {\n        clearTimeout(timer);\n        if (!this.disposed) {\n          this.handleRelayDisconnect();\n        }\n      });\n    });\n  }\n\n  /**\n   * Send an encrypted RPC request through the relay to the browser SDK.\n   */\n  async request(method: string, params?: unknown): Promise<unknown> {\n    const ws = this.ws;\n    if (!ws || ws.readyState !== WebSocket.OPEN) {\n      throw new Error('Not connected to relay');\n    }\n    if (!this.sharedSecret) {\n      throw new Error('No shared secret — key exchange not completed');\n    }\n\n    const id = crypto.randomUUID();\n\n    const envelope = await encryptMessage(this.sharedSecret, {\n      type: 'rpc_request',\n      id,\n      method,\n      params,\n    });\n\n    const serialized = JSON.stringify({ type: 'encrypted', ...envelope });\n    assertMessageSize(serialized, method);\n\n    return new Promise<unknown>((resolve, reject) => {\n      const timer = setTimeout(() => {\n        reject(\n          new Error(`Request timed out after ${this.timeout / 1000}s. ` + 'Did you complete the action in the browser?')\n        );\n        this.close();\n      }, this.timeout);\n\n      const onMessage = async (data: WebSocket.Data) => {\n        const msg = safeParse(data);\n        if (!msg || msg.type !== 'encrypted' || !this.sharedSecret) return;\n\n        try {\n          const inner = await decryptMessage(this.sharedSecret, msg as unknown as EncryptedEnvelope);\n          if (inner.type === 'rpc_response' && inner.id === id) {\n            clearTimeout(timer);\n            ws.off('message', onMessage);\n\n            if (inner.success) {\n              resolve(inner.data);\n            } else {\n              const err = inner.error as { code: number; message: string } | undefined;\n              reject(new Error(err ? `[${err.code}] ${err.message}` : 'Request failed'));\n            }\n          }\n        } catch {\n          // Decryption failed — not our message or tampered, ignore\n        }\n      };\n\n      ws.on('message', onMessage);\n      this.sendRaw(ws, serialized);\n    });\n  }\n\n  async shutdown(): Promise<void> {\n    this.disposed = true;\n    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {\n      try {\n        const envelope = await encryptMessage(this.sharedSecret, {\n          type: 'shutdown',\n        });\n        this.sendRaw(this.ws, JSON.stringify({ type: 'encrypted', ...envelope }));\n      } catch {\n        // Best effort\n      }\n    }\n    this.close();\n  }\n\n  /**\n   * Connect to relay and send shutdown directly — no init/ready handshake.\n   * Used by `jaw disconnect` when we just need to tell the browser to close.\n   */\n  async connectAndShutdown(): Promise<void> {\n    if (!this.peerPublicKeyHex) {\n      // No peer key means browser never connected — nothing to shut down\n      return;\n    }\n\n    this.disposed = true;\n    await this.deriveSecret();\n\n    return new Promise<void>((resolve) => {\n      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;\n      const ws = new WebSocket(url);\n\n      const timer = setTimeout(() => {\n        try {\n          ws.close();\n        } catch {\n          /* ignore */\n        }\n        resolve();\n      }, 3000);\n\n      ws.on('open', async () => {\n        this.ws = ws;\n        try {\n          await this.shutdown();\n        } catch {\n          // Best effort\n        }\n        clearTimeout(timer);\n        resolve();\n      });\n\n      ws.on('error', () => {\n        clearTimeout(timer);\n        resolve();\n      });\n    });\n  }\n\n  close(): void {\n    this.disposed = true;\n    if (this.ws) {\n      try {\n        this.ws.close();\n      } catch {\n        // ignore\n      }\n      this.ws = null;\n    }\n  }\n\n  /**\n   * Auto-reopen browser when browser_disconnected is received from relay.\n   * Respects a cooldown to prevent rapid re-opening.\n   */\n  private handleBrowserDisconnect(): void {\n    if (this.disposed || !this.onBrowserNeeded) return;\n\n    const now = Date.now();\n    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {\n      return; // Too soon — skip this reopen\n    }\n\n    this.lastBrowserOpenTime = now;\n\n    // Reset shared secret — the new browser tab will do a fresh key exchange\n    this.sharedSecret = null;\n    this.peerPublicKeyHex = null;\n\n    this.onBrowserNeeded().catch(() => {\n      // Best effort — if browser open fails, the next request will error\n    });\n  }\n\n  /**\n   * Attempt to reconnect to the relay with exponential backoff\n   * when the WebSocket connection drops unexpectedly.\n   */\n  private handleRelayDisconnect(): void {\n    if (this.disposed) return;\n    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;\n\n    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);\n    this.reconnectAttempts++;\n\n    setTimeout(() => {\n      if (this.disposed) return;\n      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {\n        // Reconnection failed — will retry if attempts remain\n      });\n    }, delay);\n  }\n\n  /** Send a raw string over the WebSocket, enforcing message size limits. */\n  private sendRaw(ws: WebSocket, data: string): void {\n    ws.send(data);\n  }\n\n  private async deriveSecret(): Promise<void> {\n    if (!this.peerPublicKeyHex) return;\n    const privateKey = await importKeyFromHex('private', this.privateKeyHex);\n    const peerPublicKey = await importKeyFromHex('public', this.peerPublicKeyHex);\n    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);\n  }\n}\n\n/**\n * Validate message size before sending to the relay.\n * Throws with a descriptive error if the message is too large.\n */\nfunction assertMessageSize(serialized: string, method: string): void {\n  const byteLength = Buffer.byteLength(serialized, 'utf-8');\n  if (byteLength > MAX_MESSAGE_BYTES) {\n    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);\n    throw new Error(\n      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). ` +\n        'Try reducing the number of calls in your batch.'\n    );\n  }\n}\n\nfunction safeParse(data: WebSocket.Data): Record<string, unknown> | null {\n  try {\n    return JSON.parse(data.toString()) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Bridge lifecycle management — relay edition.\n *\n * - Generates a session token + ECDH keypair for new sessions\n * - Opens the browser to keys.jaw.id/cli-bridge\n * - Saves relay state to ~/.jaw/relay.json\n * - Creates a WSBridge client connected to the relay\n */\n\nimport * as fs from 'node:fs';\nimport * as crypto from 'node:crypto';\nimport { PATHS } from './paths.js';\nimport { ensureDir, loadConfig } from './config.js';\nimport { WSBridge } from './ws-bridge.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\nimport { generateKeyPair, exportKeyToHex } from './crypto.js';\n\nconst DEFAULT_KEYS_URL = 'https://keys.jaw.id';\nconst DEFAULT_RELAY_URL = 'wss://relay.jaw.id';\n\ninterface RelaySession {\n  session: string;\n  relayUrl: string;\n  privateKey: string;\n  publicKey: string;\n  peerPublicKey: string | null;\n  startedAt: string;\n}\n\nexport interface BridgeOptions {\n  keysUrl?: string;\n  relayUrl?: string;\n  apiKey: string;\n  chainId?: number;\n  ens?: string;\n  paymasterUrl?: string;\n  timeout?: number;\n}\n\nfunction loadRelaySession(): RelaySession | null {\n  try {\n    if (!fs.existsSync(PATHS.relay)) return null;\n    const raw = fs.readFileSync(PATHS.relay, 'utf-8');\n    const parsed = JSON.parse(raw) as RelaySession;\n    // Basic validation\n    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {\n      return null;\n    }\n    return parsed;\n  } catch {\n    return null;\n  }\n}\n\nfunction saveRelaySession(info: RelaySession): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\nfunction deleteRelaySession(): void {\n  try {\n    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);\n  } catch {\n    // ignore\n  }\n}\n\n/**\n * Get or create a relay bridge connection.\n */\nexport async function getBridge(options: BridgeOptions): Promise<WSBridge> {\n  const config = loadConfig();\n  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;\n  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;\n  const chainId = options.chainId ?? config.defaultChain ?? 1;\n  if (!isValidKeysUrl(keysUrl)) {\n    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (!isValidRelayUrl(relayUrl)) {\n    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n\n  // Try existing session first — but never open a browser for a stale session.\n  // If the browser is already connected, reuse it. If not, fall through to a new session.\n  let relaySession = loadRelaySession();\n  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {\n    try {\n      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);\n    } catch {\n      // Connection failed — stale session or relay restarted.\n      // Delete and fall through to create a new one.\n      deleteRelaySession();\n      relaySession = null;\n    }\n  } else if (relaySession) {\n    // Incomplete session (no peer key) — discard\n    deleteRelaySession();\n  }\n\n  // New session — this is the only path that opens a browser\n  const session = await createNewSession(relayUrl);\n  saveRelaySession(session);\n  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);\n}\n\nasync function createNewSession(relayUrl: string): Promise<RelaySession> {\n  const kp = await generateKeyPair();\n  const privateKey = await exportKeyToHex('private', kp.privateKey);\n  const publicKey = await exportKeyToHex('public', kp.publicKey);\n\n  return {\n    session: crypto.randomUUID(),\n    relayUrl,\n    privateKey,\n    publicKey,\n    peerPublicKey: null,\n    startedAt: new Date().toISOString(),\n  };\n}\n\nasync function connectBridge(\n  relaySession: RelaySession,\n  options: BridgeOptions,\n  chainId: number,\n  keysUrl: string,\n  relayUrl: string,\n  openBrowser: boolean\n): Promise<WSBridge> {\n  const config = loadConfig();\n  const bridge = new WSBridge({\n    relayUrl,\n    session: relaySession.session,\n    timeout: options.timeout,\n    config: {\n      apiKey: options.apiKey,\n      chainId,\n      ens: options.ens ?? config.ens,\n      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url,\n    },\n    privateKeyHex: relaySession.privateKey,\n    publicKeyHex: relaySession.publicKey,\n    peerPublicKeyHex: relaySession.peerPublicKey,\n  });\n\n  await bridge.connect(\n    // onBrowserNeeded — only open a browser for new sessions\n    openBrowser\n      ? async () => {\n          const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);\n          const { default: open } = await import('open');\n          await open(bridgeUrl);\n        }\n      : undefined,\n    // onPeerKeyChanged\n    (newPeerKey) => {\n      relaySession.peerPublicKey = newPeerKey;\n      saveRelaySession(relaySession);\n    }\n  );\n\n  return bridge;\n}\n\nfunction buildBridgeUrl(keysUrl: string, session: string, relayUrl: string, cliPublicKeyHex: string): string {\n  const url = new URL('/cli-bridge', keysUrl);\n  url.searchParams.set('session', session);\n  url.searchParams.set('relay', relayUrl);\n  // CLI public key in fragment — not sent to server\n  url.hash = `pk=${cliPublicKeyHex}`;\n  return url.toString();\n}\n\n/**\n * Shutdown: close the relay session and clean up.\n */\nexport async function shutdownDaemon(): Promise<void> {\n  const session = loadRelaySession();\n  if (!session) return;\n\n  // Send shutdown directly — no init/ready handshake needed\n  try {\n    const bridge = new WSBridge({\n      relayUrl: session.relayUrl,\n      session: session.session,\n      timeout: 5000,\n      config: { apiKey: '', chainId: 1 },\n      privateKeyHex: session.privateKey,\n      publicKeyHex: session.publicKey,\n      peerPublicKeyHex: session.peerPublicKey,\n    });\n    await bridge.connectAndShutdown();\n  } catch {\n    // Best effort — relay or browser may already be gone\n  }\n\n  deleteRelaySession();\n\n  // Legacy cleanup: kill old daemon process and remove files\n  const legacyBridge = PATHS.root + '/bridge.json';\n  const legacyLog = PATHS.root + '/daemon.log';\n  const legacyLock = PATHS.root + '/daemon.lock';\n  try {\n    if (fs.existsSync(legacyBridge)) {\n      const info = JSON.parse(fs.readFileSync(legacyBridge, 'utf-8'));\n      if (info.pid && Number.isInteger(info.pid) && info.pid > 0) {\n        try {\n          process.kill(info.pid, 'SIGTERM');\n        } catch {\n          /* already dead */\n        }\n      }\n    }\n  } catch {\n    /* ignore */\n  }\n  for (const f of [legacyBridge, legacyLog, legacyLock]) {\n    try {\n      if (fs.existsSync(f)) fs.unlinkSync(f);\n    } catch {\n      /* ignore */\n    }\n  }\n}\n","import * as fs from 'node:fs';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { mcpError } from '../helpers.js';\nimport { shutdownDaemon } from '../../lib/bridge-singleton.js';\nimport { PATHS } from '../../lib/paths.js';\nimport { loadConfig, redactConfig } from '../../lib/config.js';\n\nexport function registerDaemonTools(server: McpServer): void {\n  server.tool(\n    'jaw_status',\n    'Check the current status of the JAW.id relay bridge — whether a relay session ' +\n      'exists, the bridge connection is active, and what configuration is in use.',\n    {},\n    async () => {\n      try {\n        let relaySession = false;\n\n        try {\n          if (fs.existsSync(PATHS.relay)) {\n            JSON.parse(fs.readFileSync(PATHS.relay, 'utf-8'));\n            relaySession = true;\n          }\n        } catch {\n          relaySession = false;\n        }\n\n        const config = redactConfig(loadConfig());\n\n        const status = {\n          relay: relaySession ? { session: true } : { session: false },\n          bridgeConnection: 'disconnected',\n          config,\n        };\n\n        return {\n          content: [{ type: 'text' as const, text: JSON.stringify(status, null, 2) }],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n\n  server.tool(\n    'jaw_disconnect',\n    'Close the relay session and browser tab. ' +\n      'Call this when you are done making wallet requests to clean up resources.',\n    {},\n    async () => {\n      try {\n        await shutdownDaemon();\n        return {\n          content: [\n            {\n              type: 'text' as const,\n              text: 'Relay session closed and browser tab dismissed.',\n            },\n          ],\n        };\n      } catch (err) {\n        return mcpError(err);\n      }\n    }\n  );\n}\n"]}

package/dist/mcp/handlers/rpc.js

@@ -1,5 +1,5 @@
 import { z } from 'zod';
-import * as fs2 from 'fs';
+import * as fs from 'fs';
 import * as crypto from 'crypto';
 import * as path from 'path';
 import * as os from 'os';
@@ -16,7 +16,7 @@ var rpcMethodSchema = {
   chainId: z.number().optional().describe("Target chain ID (overrides default). E.g., 1 for Ethereum, 8453 for Base, 84532 for Base Sepolia")
 };
 ({
-  key: z.enum(["apiKey", "defaultChain", "keysUrl", "paymasterUrl", "ens", "relayUrl"]).describe("Config key"),
+  key: z.enum(["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl"]).describe("Config key"),
   value: z.string().describe("Config value")
 });
 
@@ -47,7 +47,9 @@ var PATHS = {
   root: JAW_DIR,
   config: path.join(JAW_DIR, "config.json"),
   session: path.join(JAW_DIR, "session.json"),
-  relay: path.join(JAW_DIR, "relay.json")
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json")
 };
 
 // src/lib/validation.ts
@@ -75,22 +77,39 @@ function isValidRelayUrl(url) {
 
 // src/lib/config.ts
 function ensureDir(dir) {
-  fs2.mkdirSync(dir, { recursive: true, mode: 448 });
-  fs2.chmodSync(dir, 448);
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
 }
 function loadConfig() {
-  if (!fs2.existsSync(PATHS.config)) {
+  if (!fs.existsSync(PATHS.config)) {
     return {};
   }
-  const raw = fs2.readFileSync(PATHS.config, "utf-8");
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
   try {
-    return JSON.parse(raw);
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
   } catch {
     throw new Error(
       `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
     );
   }
 }
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
 
 // src/lib/crypto.ts
 var subtle = globalThis.crypto.subtle;
@@ -271,6 +290,10 @@ var WSBridge = class {
             expectingKeyExchange = true;
             onBrowserNeeded().catch(() => {
             });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
           }
         } else if (msg.type === "browser_connected") {
           expectingKeyExchange = true;
@@ -346,9 +369,6 @@ var WSBridge = class {
       this.sendRaw(ws, serialized);
     });
   }
-  isOpen() {
-    return this.ws?.readyState === WebSocket.OPEN;
-  }
   async shutdown() {
     this.disposed = true;
     if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
@@ -471,8 +491,8 @@ var DEFAULT_KEYS_URL = "https://keys.jaw.id";
 var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
 function loadRelaySession() {
   try {
-    if (!fs2.existsSync(PATHS.relay)) return null;
-    const raw = fs2.readFileSync(PATHS.relay, "utf-8");
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
     const parsed = JSON.parse(raw);
     if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
       return null;
@@ -484,14 +504,14 @@ function loadRelaySession() {
 }
 function saveRelaySession(info) {
   ensureDir(PATHS.root);
-  fs2.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
     encoding: "utf-8",
     mode: 384
   });
 }
 function deleteRelaySession() {
   try {
-    if (fs2.existsSync(PATHS.relay)) fs2.unlinkSync(PATHS.relay);
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
   } catch {
   }
 }
@@ -507,17 +527,19 @@ async function getBridge(options) {
     throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
   }
   let relaySession = loadRelaySession();
-  if (relaySession && relaySession.relayUrl === relayUrl) {
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
     try {
-      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl);
+      return await connectBridge(relaySession, options, chainId, keysUrl, relayUrl, false);
     } catch {
       deleteRelaySession();
       relaySession = null;
     }
+  } else if (relaySession) {
+    deleteRelaySession();
   }
   const session = await createNewSession(relayUrl);
   saveRelaySession(session);
-  return await connectBridge(session, options, chainId, keysUrl, relayUrl);
+  return await connectBridge(session, options, chainId, keysUrl, relayUrl, true);
 }
 async function createNewSession(relayUrl) {
   const kp = await generateKeyPair();
@@ -532,7 +554,7 @@ async function createNewSession(relayUrl) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
 }
-async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl) {
+async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl, openBrowser) {
   const config = loadConfig();
   const bridge = new WSBridge({
     relayUrl,
@@ -542,19 +564,19 @@ async function connectBridge(relaySession, options, chainId, keysUrl, relayUrl)
       apiKey: options.apiKey,
       chainId,
       ens: options.ens ?? config.ens,
-      paymasterUrl: options.paymasterUrl ?? config.paymasterUrl
+      paymasterUrl: options.paymasterUrl ?? config.paymasters?.[chainId]?.url
     },
     privateKeyHex: relaySession.privateKey,
     publicKeyHex: relaySession.publicKey,
     peerPublicKeyHex: relaySession.peerPublicKey
   });
   await bridge.connect(
-    // onBrowserNeeded
-    async () => {
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
       const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
       const { default: open } = await import('open');
       await open(bridgeUrl);
-    },
+    } : void 0,
     // onPeerKeyChanged
     (newPeerKey) => {
       relaySession.peerPublicKey = newPeerKey;
@@ -587,12 +609,14 @@ function registerRpcTool(server) {
     async (params) => {
       const config = loadConfig();
       const apiKey = resolveApiKey();
+      const chainId = params.chainId ?? config.defaultChain ?? 1;
+      const pm = config.paymasters?.[chainId];
       const bridge = await getBridge({
         keysUrl: config.keysUrl,
         apiKey,
-        chainId: params.chainId ?? config.defaultChain,
+        chainId,
         ens: config.ens,
-        paymasterUrl: config.paymasterUrl
+        paymasterUrl: pm?.url
       });
       try {
         const result = await bridge.request(params.method, params.params);