@jaw.id/cli 0.1.25 → 0.2.0

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2025-2026 Torquem Technologies Ltd. dba JustaLab
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/NOTICE

@@ -0,0 +1,5 @@
+JAW.id
+Copyright 2025-2026 Torquem Technologies Ltd. dba JustaLab
+
+This product includes software developed by Torquem Technologies Ltd. dba JustaLab
+(https://jaw.id).

package/README.md

@@ -237,3 +237,7 @@ The daemon also writes runtime state to `~/.jaw/`:
 | `bridge.json`  | Active daemon connection info (port, token, pid) |
 | `session.json` | Cached session state                             |
 | `daemon.log`   | Daemon stdout/stderr for debugging               |
+
+## License
+
+[Apache-2.0](./LICENSE)

package/dist/base-command.js

@@ -11,7 +11,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/config.ts

package/dist/base-command.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/paths.ts","../src/lib/config.ts","../src/lib/output.ts","../src/base-command.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;ACPO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;ACvCO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF","file":"base-command.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n"]}
+{"version":3,"sources":["../src/lib/paths.ts","../src/lib/config.ts","../src/lib/output.ts","../src/base-command.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB,CAAA;AAAA,EACvD,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,gBAAgB,CAAA;AAAA,EAC5C,WAAA,EAAkB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,mBAAmB;AACrD,CAAA;;;ACRO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;ACxCO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF","file":"base-command.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n  x402Log: path.join(JAW_DIR, 'x402-log.jsonl'),\n  paymentLock: path.join(JAW_DIR, 'x402-payment.lock'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig, SettableConfigKey } from './types.js';\nimport type { X402Policy, X402PolicyKey } from '../x402/policy.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\n/**\n * Set one field of the `x402` payment policy. Array fields (allow-lists) are\n * comma-split. Intentionally NOT reachable from the MCP tool surface: an agent\n * must not be able to raise its own spending caps — only a human at the CLI.\n */\nexport function setX402PolicyValue(key: X402PolicyKey, value: string): void {\n  const config = loadConfig();\n  const x402: X402Policy = { ...(config.x402 ?? {}) };\n  if (key === 'maxAmountPerPayment' || key === 'maxTotalPerSession' || key === 'topUpFloat') {\n    // These are base-unit amounts read via BigInt() on the hot payment path;\n    // reject anything that isn't a non-negative integer here so a bad value\n    // can never turn into a per-payment failure later.\n    if (!/^\\d+$/.test(value.trim())) {\n      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);\n    }\n    x402[key] = value.trim();\n  } else {\n    x402[key] = value\n      .split(',')\n      .map((v) => v.trim())\n      .filter(Boolean);\n  }\n  saveConfig({ ...config, x402 });\n}\n\nexport function setConfigValue(key: SettableConfigKey, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  // Numeric keys: coerce + validate here so EVERY caller is safe. The MCP tool\n  // passes raw strings (its schema types value as a string), so without this a\n  // `sessionExpiry: \"abc\"` would land as a string and turn `expiry * 86400`\n  // into NaN, and a `defaultChain` string would ride into an RPC URL verbatim.\n  let toStore: string | number = value;\n  if (key === 'defaultChain' || key === 'sessionExpiry') {\n    // Strict: reject anything parseInt would silently truncate ('1.5' -> 1,\n    // '0x10' -> 0, '10abc' -> 10). Only a bare positive decimal integer passes.\n    const n = typeof value === 'number' ? value : /^\\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;\n    if (!Number.isInteger(n) || n <= 0) {\n      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);\n    }\n    toStore = n;\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: toStore };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n"]}

package/dist/commands/config/set.js

@@ -2,6 +2,7 @@ import { Command, Flags } from '@oclif/core';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import 'viem';
 
 // src/base-command.ts
 var JAW_DIR = path.join(os.homedir(), ".jaw");
@@ -11,7 +12,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/validation.ts
@@ -72,6 +75,19 @@ function saveConfig(config) {
     mode: 384
   });
 }
+function setX402PolicyValue(key, value) {
+  const config = loadConfig();
+  const x402 = { ...config.x402 ?? {} };
+  if (key === "maxAmountPerPayment" || key === "maxTotalPerSession" || key === "topUpFloat") {
+    if (!/^\d+$/.test(value.trim())) {
+      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);
+    }
+    x402[key] = value.trim();
+  } else {
+    x402[key] = value.split(",").map((v) => v.trim()).filter(Boolean);
+  }
+  saveConfig({ ...config, x402 });
+}
 function setConfigValue(key, value) {
   if (key === "keysUrl" && typeof value === "string" && !isValidKeysUrl(value)) {
     throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
@@ -79,8 +95,16 @@ function setConfigValue(key, value) {
   if (key === "relayUrl" && typeof value === "string" && !isValidRelayUrl(value)) {
     throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);
   }
+  let toStore = value;
+  if (key === "defaultChain" || key === "sessionExpiry") {
+    const n = typeof value === "number" ? value : /^\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;
+    if (!Number.isInteger(n) || n <= 0) {
+      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);
+    }
+    toStore = n;
+  }
   const config = loadConfig();
-  const updated = { ...config, [key]: value };
+  const updated = { ...config, [key]: toStore };
   saveConfig(updated);
 }
 
@@ -172,17 +196,97 @@ var BaseCommand = class extends Command {
   }
 };
 
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+
+// src/x402/policy.ts
+({
+  // 10 USDC per process
+  allowedAssets: Object.values(USDC_BY_NETWORK).map((asset) => asset.address)});
+var X402_SCALAR_KEYS = ["maxAmountPerPayment", "maxTotalPerSession", "topUpFloat"];
+var X402_ARRAY_KEYS = ["allowedAssets", "allowedNetworks", "allowedHosts", "allowedPayTo"];
+function isX402PolicyKey(key) {
+  return X402_SCALAR_KEYS.includes(key) || X402_ARRAY_KEYS.includes(key);
+}
+var LIMIT_PERIODS = ["minute", "hour", "day", "week", "month", "year", "forever"];
+function parseLimit(input) {
+  const trimmed = input.trim();
+  if (!trimmed) throw new Error("Limit is empty. Use --limit <amount>/<period>, for example 10/day.");
+  const [rawAmount, rawPeriod = "day", ...rest] = trimmed.split("/");
+  if (rest.length > 0) {
+    throw new Error(`Invalid limit "${input}". Expected <amount>/<period>, for example 10/day.`);
+  }
+  const amount = rawAmount.trim();
+  if (!/^\d+(\.\d+)?$/.test(amount)) {
+    throw new Error(`Invalid limit amount "${rawAmount}". Expected a positive number, for example 10 or 2.5.`);
+  }
+  const period = rawPeriod.trim().toLowerCase();
+  if (!LIMIT_PERIODS.includes(period)) {
+    throw new Error(`Invalid limit period "${rawPeriod}". Expected one of: ${LIMIT_PERIODS.join(", ")}.`);
+  }
+  return { amount, period };
+}
+
 // src/commands/config/set.ts
-var VALID_KEYS = ["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl", "sessionExpiry"];
+var VALID_KEYS = [
+  "apiKey",
+  "defaultChain",
+  "keysUrl",
+  "ens",
+  "relayUrl",
+  "sessionExpiry",
+  // Settable here and nowhere else. Like the x402 policy fields below, the MCP
+  // tool cannot reach it, so an agent cannot raise the ceiling on what it is
+  // allowed to ask a human to approve.
+  "grantCeiling"
+];
 function isValidKey(key) {
   return VALID_KEYS.includes(key);
 }
+function isSettableKey(key) {
+  return isValidKey(key) || key.startsWith("x402.") && isX402PolicyKey(key.slice("x402.".length));
+}
 var ConfigSet = class _ConfigSet extends BaseCommand {
   static description = "Set one or more configuration values. Accepts key=value pairs or a single key value.";
   static examples = [
     "<%= config.bin %> config set apiKey=your-api-key defaultChain=8453",
     "<%= config.bin %> config set ens=yourdomain.eth sessionExpiry=14",
-    "<%= config.bin %> config set apiKey your-api-key"
+    "<%= config.bin %> config set apiKey your-api-key",
+    "<%= config.bin %> config set x402.maxAmountPerPayment=50000 x402.maxTotalPerSession=1000000",
+    "<%= config.bin %> config set x402.allowedNetworks=eip155:8453,eip155:84532"
   ];
   static strict = false;
   static args = {};
@@ -202,12 +306,35 @@ Usage: jaw config set key=value [key=value ...]`
     }
     const results = [];
     for (const { key, value } of entries) {
-      const parsed = key === "defaultChain" || key === "sessionExpiry" ? parseInt(value, 10) : value;
-      if ((key === "defaultChain" || key === "sessionExpiry") && isNaN(parsed)) {
-        this.error(`Invalid number for ${key}: ${value}`);
+      if (key.startsWith("x402.")) {
+        const sub = key.slice("x402.".length);
+        if (!isX402PolicyKey(sub)) {
+          this.error(`Invalid x402 config key: ${sub}`);
+        }
+        try {
+          setX402PolicyValue(sub, value);
+        } catch (err) {
+          this.error(err instanceof Error ? err.message : String(err));
+        }
+        results.push({ key, value });
+        continue;
+      }
+      if (!isValidKey(key)) {
+        this.error(`Invalid config key: ${key}`);
+      }
+      if (key === "grantCeiling" && value.trim() !== "") {
+        try {
+          parseLimit(value);
+        } catch (err) {
+          this.error(`Invalid grantCeiling: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      try {
+        setConfigValue(key, value);
+      } catch (err) {
+        this.error(err instanceof Error ? err.message : String(err));
       }
-      setConfigValue(key, parsed);
-      const displayValue = key === "apiKey" && typeof value === "string" ? `${value.slice(0, 8)}...` : parsed;
+      const displayValue = key === "apiKey" && typeof value === "string" ? `${value.slice(0, 8)}...` : value;
       results.push({ key, value: displayValue });
     }
     if (flags.output === "json") {
@@ -220,6 +347,7 @@ Usage: jaw config set key=value [key=value ...]`
   }
   parseEntries(rawArgs) {
     const entries = [];
+    const validKeysHint = `Valid keys: ${VALID_KEYS.join(", ")}, x402.<maxAmountPerPayment|maxTotalPerSession|allowedAssets|allowedNetworks|allowedHosts|allowedPayTo>`;
     let i = 0;
     while (i < rawArgs.length) {
       const arg = rawArgs[i];
@@ -227,13 +355,13 @@ Usage: jaw config set key=value [key=value ...]`
         const eqIndex = arg.indexOf("=");
         const key = arg.slice(0, eqIndex);
         const value = arg.slice(eqIndex + 1);
-        if (!isValidKey(key)) {
+        if (!isSettableKey(key)) {
           this.error(`Invalid config key: ${key}
-Valid keys: ${VALID_KEYS.join(", ")}`);
+${validKeysHint}`);
         }
         entries.push({ key, value });
         i++;
-      } else if (isValidKey(arg) && i + 1 < rawArgs.length) {
+      } else if (isSettableKey(arg) && i + 1 < rawArgs.length) {
         entries.push({ key: arg, value: rawArgs[i + 1] });
         i += 2;
       } else {