@jaw.id/cli 0.1.25 → 0.2.0

package/dist/commands/x402/status.js

@@ -0,0 +1,1047 @@
+import { Command, Flags } from '@oclif/core';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import 'crypto';
+import { privateKeyToAccount } from 'viem/accounts';
+import { parseAbi, formatUnits, erc20Abi, createPublicClient, http, zeroAddress, BaseError, ContractFunctionRevertedError } from 'viem';
+import 'viem/experimental/erc7739';
+import { polygonAmoy, polygon, baseSepolia, base } from 'viem/chains';
+
+// src/base-command.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
+};
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+function loadSessionKey() {
+  if (!fs.existsSync(PATHS.keystore)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const contents = fs.readFileSync(PATHS.keystore, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(contents);
+  } catch {
+    throw new Error(`Keystore at ${PATHS.keystore} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+  return parsed.privateKey;
+}
+function keystoreExists() {
+  return fs.existsSync(PATHS.keystore);
+}
+var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;
+var HEX_RE = /^0x[0-9a-fA-F]+$/;
+var ALLOWANCE_RE = /^(0x[0-9a-fA-F]+|[0-9]+)$/;
+var SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
+function isPositiveInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function parseGrantedPermission(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const r = raw;
+  const { account, spender, salt } = r;
+  if (typeof account !== "string" || !ADDRESS_RE.test(account)) return void 0;
+  if (typeof spender !== "string" || !ADDRESS_RE.test(spender)) return void 0;
+  if (typeof salt !== "string" || !HEX_RE.test(salt)) return void 0;
+  if (!isPositiveInt(r.start) || !isPositiveInt(r.end)) return void 0;
+  if (!Array.isArray(r.calls) || r.calls.length === 0) return void 0;
+  const calls = [];
+  for (const entry of r.calls) {
+    if (typeof entry !== "object" || entry === null) return void 0;
+    const { target, selector } = entry;
+    if (typeof target !== "string" || !ADDRESS_RE.test(target)) return void 0;
+    if (typeof selector !== "string" || !SELECTOR_RE.test(selector)) return void 0;
+    calls.push({ target, selector });
+  }
+  if (!Array.isArray(r.spends)) return void 0;
+  const spends = [];
+  for (const entry of r.spends) {
+    if (typeof entry !== "object" || entry === null) return void 0;
+    const { token, allowance, unit, multiplier } = entry;
+    if (typeof token !== "string" || !ADDRESS_RE.test(token)) return void 0;
+    if (typeof allowance !== "string" || !ALLOWANCE_RE.test(allowance)) return void 0;
+    if (typeof unit !== "string" || !SPEND_UNITS.has(unit)) return void 0;
+    if (!isPositiveInt(multiplier) || multiplier > 65535) return void 0;
+    spends.push({ token, allowance, unit, multiplier });
+  }
+  return { account, spender, start: r.start, end: r.end, salt, calls, spends };
+}
+function isLegacySession(config) {
+  return config.mode !== "eip7702";
+}
+function liveOrphans(orphans, now = Date.now() / 1e3) {
+  return (orphans ?? []).filter((orphan) => orphan.expiry > now);
+}
+function writeSessionConfig(config) {
+  ensureDir(PATHS.root);
+  const temp = `${PATHS.sessionConfig}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  fs.chmodSync(temp, 384);
+  fs.renameSync(temp, PATHS.sessionConfig);
+}
+function saveRecoveredPermission(config, permission) {
+  const current = tryLoadSessionConfig();
+  if (!current || current.permissionId !== config.permissionId) return false;
+  writeSessionConfig({ ...current, permission });
+  return true;
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+function tryLoadSessionConfig() {
+  try {
+    return loadSessionConfig();
+  } catch {
+    return null;
+  }
+}
+
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+function usdcForNetwork(network) {
+  return Object.hasOwn(USDC_BY_NETWORK, network) ? USDC_BY_NETWORK[network] : void 0;
+}
+var JAW_RPC_URL = "https://api.justaname.id/proxy/v1/rpc";
+var CHAINS = {
+  [base.id]: base,
+  [baseSepolia.id]: baseSepolia,
+  [polygon.id]: polygon,
+  [polygonAmoy.id]: polygonAmoy
+};
+for (const chainId of Object.values(USDC_BY_NETWORK).map((a) => a.chainId)) {
+  if (!CHAINS[chainId]) {
+    throw new Error(
+      `x402 balance: USDC registry has chain ${chainId} but no viem chain is mapped for it in balance.ts`
+    );
+  }
+}
+var clients = /* @__PURE__ */ new Map();
+function rpcTransport(chainId, apiKey) {
+  if (!apiKey) return http();
+  return http(`${JAW_RPC_URL}?chainId=${chainId}&api-key=${apiKey}`);
+}
+function publicClientFor(chainId) {
+  const chain = CHAINS[chainId];
+  if (!chain) throw new Error(`x402: no viem chain configured for chainId ${chainId}`);
+  const apiKey = loadConfig().apiKey;
+  const key = `${chainId}:${apiKey ?? ""}`;
+  let client = clients.get(key);
+  if (!client) {
+    client = createPublicClient({ chain, transport: rpcTransport(chainId, apiKey) });
+    clients.set(key, client);
+  }
+  return client;
+}
+var readOnChain = (asset, owner) => publicClientFor(asset.chainId).readContract({
+  address: asset.address,
+  abi: erc20Abi,
+  functionName: "balanceOf",
+  args: [owner]
+});
+async function usdcBalance(network, owner, read = readOnChain) {
+  const asset = usdcForNetwork(network);
+  if (!asset) throw new Error(`Unsupported x402 network: ${network}`);
+  const raw = await read(asset, owner);
+  return { network, asset: asset.address, raw: raw.toString(), formatted: formatUnits(raw, asset.decimals) };
+}
+
+// src/x402/payer.ts
+parseAbi(["function allowance(address owner, address spender) view returns (uint256)"]);
+parseAbi([
+  "function eip712Domain() view returns (bytes1 fields, string name, string version, uint256 chainId, address verifyingContract, bytes32 salt, uint256[] extensions)"
+]);
+function sessionPayerAddress() {
+  if (!keystoreExists()) {
+    throw new Error("No session key. Run `jaw session setup` first.");
+  }
+  return privateKeyToAccount(loadSessionKey()).address;
+}
+function readX402Log(limit) {
+  let raw;
+  try {
+    raw = fs.readFileSync(PATHS.x402Log, "utf-8");
+  } catch {
+    return [];
+  }
+  const entries = raw.split("\n").filter((line) => line.trim().length > 0).map((line) => {
+    try {
+      return JSON.parse(line);
+    } catch {
+      return null;
+    }
+  }).filter((e) => e !== null);
+  return limit && limit > 0 ? entries.slice(-limit) : entries;
+}
+function spendFigureOf(entry) {
+  if (entry.status !== "paid" && entry.status !== "failed") return 0n;
+  const parse = (value) => {
+    if (!value) return 0n;
+    try {
+      const parsed = BigInt(value);
+      return parsed > 0n ? parsed : 0n;
+    } catch {
+      return 0n;
+    }
+  };
+  if (entry.status === "paid") return parse(entry.amount);
+  const ceiling = parse(entry.authorized);
+  const charge = parse(entry.amount);
+  return ceiling > charge ? ceiling : charge;
+}
+function sumSpentSince(payerAddress, since) {
+  const payer = payerAddress.toLowerCase();
+  return readX402Log().reduce((total, entry) => {
+    if (entry.payer?.toLowerCase() !== payer) return total;
+    if (since && entry.at < since) return total;
+    return total + spendFigureOf(entry);
+  }, 0n);
+}
+function sumToppedUpSince(payerAddress, since) {
+  const payer = payerAddress.toLowerCase();
+  return readX402Log().reduce((total, entry) => {
+    if (!entry.topUpAmount) return total;
+    if (entry.payer?.toLowerCase() !== payer) return total;
+    if (since && entry.at < since) return total;
+    try {
+      return total + BigInt(entry.topUpAmount);
+    } catch {
+      return total;
+    }
+  }, 0n);
+}
+
+// src/x402/amount.ts
+function parseBigInt(value) {
+  if (value === void 0 || value === null || value === "") return null;
+  try {
+    return BigInt(value);
+  } catch {
+    return null;
+  }
+}
+
+// src/x402/period.ts
+var PERIOD_UNITS = ["minute", "hour", "day", "week", "month", "forever"];
+function isPeriodUnit(value) {
+  return typeof value === "string" && PERIOD_UNITS.includes(value);
+}
+function normalizePeriod(unit, multiplier) {
+  const m = Math.max(1, Math.floor(multiplier ?? 1));
+  if (unit === "year") return { unit: "month", multiplier: m * 12 };
+  if (isPeriodUnit(unit)) return { unit, multiplier: m };
+  return void 0;
+}
+var FIXED_UNIT_SECONDS = {
+  minute: 60,
+  hour: 3600,
+  day: 86400,
+  week: 604800
+};
+function addMonths(unixSeconds, months) {
+  const d = new Date(unixSeconds * 1e3);
+  const day = d.getUTCDate();
+  const target = new Date(
+    Date.UTC(d.getUTCFullYear(), d.getUTCMonth() + months, 1, d.getUTCHours(), d.getUTCMinutes(), d.getUTCSeconds())
+  );
+  const daysInTarget = new Date(Date.UTC(target.getUTCFullYear(), target.getUTCMonth() + 1, 0)).getUTCDate();
+  target.setUTCDate(Math.min(day, daysInTarget));
+  return Math.floor(target.getTime() / 1e3);
+}
+function currentPeriodWindow(input) {
+  const { anchor, unit, now, permissionEnd } = input;
+  const multiplier = Math.max(1, Math.floor(input.multiplier ?? 1));
+  if (unit === "forever") {
+    return { start: anchor, end: permissionEnd };
+  }
+  let start;
+  let end;
+  if (unit === "month") {
+    let index = 0;
+    let cursor = anchor;
+    let next = addMonths(anchor, multiplier);
+    while (next <= now) {
+      index += 1;
+      cursor = next;
+      next = addMonths(anchor, (index + 1) * multiplier);
+    }
+    start = cursor;
+    end = next;
+  } else {
+    const duration = FIXED_UNIT_SECONDS[unit] * multiplier;
+    const elapsed = Math.max(0, now - anchor);
+    const index = Math.floor(elapsed / duration);
+    start = anchor + index * duration;
+    end = start + duration;
+  }
+  return { start, end: Math.min(end, permissionEnd) };
+}
+function describePeriod(unit, multiplier) {
+  if (unit === "forever") return "the whole permission";
+  return describeSpendPeriod(unit, multiplier);
+}
+function describeSpendPeriod(unit, multiplier) {
+  const n = Math.max(1, Math.floor(multiplier ?? 1));
+  return n === 1 ? unit : `${n} ${unit}s`;
+}
+
+// src/x402/policy.ts
+var DEFAULT_X402_POLICY = {
+  maxAmountPerPayment: "1000000",
+  // 1 USDC per payment
+  maxTotalPerSession: "10000000",
+  // 10 USDC per process
+  allowedAssets: Object.values(USDC_BY_NETWORK).map((asset) => asset.address),
+  allowedNetworks: Object.keys(USDC_BY_NETWORK)
+};
+function policyFromPermission(permission, chainId) {
+  if (!permission) return {};
+  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);
+  if (!usdc) return {};
+  const forToken = permission.spends.filter((spend) => spend.token.toLowerCase() === usdc.address.toLowerCase());
+  if (forToken.length === 0) return {};
+  const start = new Date(permission.start * 1e3);
+  if (Number.isNaN(start.getTime())) return {};
+  const anchor = start.toISOString();
+  const perPeriod = [];
+  for (const spend of forToken) {
+    let allowance;
+    try {
+      const parsed = BigInt(spend.allowance);
+      if (parsed < 0n) continue;
+      allowance = parsed.toString();
+    } catch {
+      continue;
+    }
+    const period = normalizePeriod(spend.unit, spend.multiplier);
+    if (!period) continue;
+    perPeriod.push({ allowance, unit: period.unit, multiplier: period.multiplier, anchor });
+  }
+  if (perPeriod.length === 0) return {};
+  return {
+    // The registry's canonical address, not the permission's literal string:
+    // they match case-insensitively and this seeds an allowlist compared that
+    // way.
+    allowedAssets: [usdc.address],
+    allowedNetworks: [usdc.wireNetwork],
+    perPeriod
+  };
+}
+function resolveX402Policy(configPolicy, grantPolicy) {
+  const merged = { ...DEFAULT_X402_POLICY, ...grantPolicy ?? {}, ...configPolicy ?? {} };
+  if (grantPolicy?.perPeriod !== void 0 && configPolicy?.maxTotalPerSession === void 0) {
+    delete merged.maxTotalPerSession;
+  }
+  return merged;
+}
+function resolveSessionX402Policy(configPolicy, session) {
+  return resolveX402Policy(configPolicy, policyFromPermission(session?.permission, session?.chainId ?? 0));
+}
+function sameLimit(a, b) {
+  return a.unit === b.unit && a.multiplier === b.multiplier && a.allowance === b.allowance;
+}
+var PERMISSION_MANAGER_ABI = parseAbi([
+  "struct CallPermission { address target; bytes4 selector; address checker; }",
+  "struct SpendLimit { address token; uint160 allowance; uint8 unit; uint16 multiplier; }",
+  "struct Permission { address account; address spender; uint48 start; uint48 end; uint256 salt; CallPermission[] calls; SpendLimit[] spends; }",
+  "struct PeriodSpend { uint48 start; uint48 end; uint160 spend; }",
+  "function getHash(Permission permission) view returns (bytes32)",
+  "function isApproved(Permission permission) view returns (bool)",
+  "function isRevoked(Permission permission) view returns (bool)",
+  "function getCurrentPeriod(Permission permission, SpendLimit spendLimit) view returns (PeriodSpend)",
+  // Carried so the two time-bound reverts can be told apart from a node that
+  // did not answer. Everything else the manager can revert with decodes to an
+  // unnamed error, which is treated as unavailable rather than guessed at.
+  "error JustaPermissionManager_BeforePermissionStart(uint48 currentTimestamp, uint48 start)",
+  "error JustaPermissionManager_AfterPermissionEnd(uint48 currentTimestamp, uint48 end)"
+]);
+var TIME_BOUND_ERRORS = /* @__PURE__ */ new Set([
+  "JustaPermissionManager_BeforePermissionStart",
+  "JustaPermissionManager_AfterPermissionEnd"
+]);
+var PERIOD_UNIT_ENUM = {
+  minute: 0,
+  hour: 1,
+  day: 2,
+  week: 3,
+  month: 4,
+  forever: 5
+};
+function toContractSpendLimit(spend) {
+  const unit = spend.unit === "year" ? "month" : spend.unit;
+  const multiplier = spend.unit === "year" ? spend.multiplier * 12 : spend.multiplier;
+  if (!Object.hasOwn(PERIOD_UNIT_ENUM, unit)) return null;
+  return {
+    token: spend.token,
+    allowance: BigInt(spend.allowance),
+    unit: PERIOD_UNIT_ENUM[unit],
+    multiplier
+  };
+}
+function toContractPermission(permission) {
+  const spends = [];
+  for (const spend of permission.spends) {
+    const converted = toContractSpendLimit(spend);
+    if (!converted) return null;
+    spends.push(converted);
+  }
+  let salt;
+  try {
+    salt = BigInt(permission.salt);
+  } catch {
+    return null;
+  }
+  return {
+    account: permission.account,
+    spender: permission.spender,
+    start: permission.start,
+    end: permission.end,
+    salt,
+    calls: permission.calls.map((call) => ({
+      target: call.target,
+      selector: call.selector,
+      checker: zeroAddress
+    })),
+    spends
+  };
+}
+var DEFAULT_TIMEOUT_MS = 5e3;
+async function within(work, timeoutMs = DEFAULT_TIMEOUT_MS) {
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), timeoutMs);
+    });
+    return await Promise.race([work, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function managerAddress(override) {
+  if (override) return override;
+  const { PERMISSIONS_MANAGER_ADDRESS } = await import('@jaw.id/core');
+  return PERMISSIONS_MANAGER_ADDRESS;
+}
+function reader(chainId, deps) {
+  if (deps.readContract) return deps.readContract;
+  try {
+    const client = publicClientFor(chainId);
+    return (args) => client.readContract(args);
+  } catch {
+    return null;
+  }
+}
+async function readPermissionState(target, deps = {}) {
+  if (!target.permission) return { status: "unavailable" };
+  const permission = toContractPermission(target.permission);
+  if (!permission) return { status: "unavailable" };
+  const read = reader(target.chainId, deps);
+  if (!read) return { status: "unavailable" };
+  try {
+    const address = await managerAddress(deps.manager);
+    const [hash, approved, revoked] = await within(
+      Promise.all([
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "getHash", args: [permission] }),
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "isApproved", args: [permission] }),
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "isRevoked", args: [permission] })
+      ]),
+      deps.timeoutMs
+    );
+    if (typeof hash !== "string" || hash.toLowerCase() !== target.permissionId.toLowerCase()) {
+      return { status: "mismatch" };
+    }
+    return { status: "ok", approved: approved === true, revoked: revoked === true };
+  } catch {
+    return { status: "unavailable" };
+  }
+}
+async function readCurrentPeriods(target, deps = {}) {
+  if (!target.permission) return [];
+  const permission = toContractPermission(target.permission);
+  if (!permission) return [];
+  const granted = target.permission.spends;
+  const indexes = granted.map((spend, index) => ({ spend, index })).filter(({ spend }) => spend.token.toLowerCase() === target.token.toLowerCase());
+  if (indexes.length === 0) return [];
+  const unreadable = indexes.map(({ spend }) => ({ ...spend, period: { status: "unavailable" } }));
+  const read = reader(target.chainId, deps);
+  if (!read) return unreadable;
+  try {
+    const address = await managerAddress(deps.manager);
+    const settled = await within(
+      Promise.allSettled([
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "getHash", args: [permission] }),
+        ...indexes.map(
+          ({ index }) => read({
+            address,
+            abi: PERMISSION_MANAGER_ABI,
+            functionName: "getCurrentPeriod",
+            args: [permission, permission.spends[index]]
+          })
+        )
+      ]),
+      deps.timeoutMs
+    );
+    const [hashed, ...counters] = settled;
+    const hash = hashed.status === "fulfilled" ? hashed.value : null;
+    if (typeof hash !== "string" || hash.toLowerCase() !== target.permissionId.toLowerCase()) {
+      return unreadable;
+    }
+    return indexes.map(({ spend }, i) => {
+      const result = counters[i];
+      if (result.status === "rejected") {
+        return {
+          ...spend,
+          period: isTimeBoundRevert(result.reason) ? { status: "outside-window" } : { status: "unavailable" }
+        };
+      }
+      const period = result.value;
+      return {
+        ...spend,
+        period: period ? {
+          status: "ok",
+          start: Number(period.start),
+          end: Number(period.end),
+          spend: BigInt(period.spend)
+        } : { status: "unavailable" }
+      };
+    });
+  } catch {
+    return unreadable;
+  }
+}
+function isTimeBoundRevert(err) {
+  if (!(err instanceof BaseError)) return false;
+  const revert = err.walk((e) => e instanceof ContractFunctionRevertedError);
+  return revert instanceof ContractFunctionRevertedError && TIME_BOUND_ERRORS.has(revert.data?.errorName ?? "");
+}
+async function readLiveness(session, deps = {}) {
+  const state = await readPermissionState(session, deps);
+  if (state.status === "unavailable") return "unknown";
+  if (state.status === "mismatch") return "mismatch";
+  if (state.revoked) return "revoked";
+  return state.approved ? "active" : "unapproved";
+}
+
+// src/x402/spend-window.ts
+function currentLimitUsage(policy, payerAddress, session, now = /* @__PURE__ */ new Date()) {
+  if (!session || !policy.perPeriod) return [];
+  const usage = [];
+  for (const limit of policy.perPeriod) {
+    const anchorMs = Date.parse(limit.anchor);
+    if (Number.isNaN(anchorMs)) continue;
+    const window = currentPeriodWindow({
+      anchor: Math.floor(anchorMs / 1e3),
+      unit: limit.unit,
+      multiplier: limit.multiplier,
+      now: Math.floor(now.getTime() / 1e3),
+      permissionEnd: session.expiry
+    });
+    const since = new Date(window.start * 1e3).toISOString();
+    usage.push({
+      ...limit,
+      spent: sumSpentSince(payerAddress, since),
+      toppedUp: sumToppedUpSince(payerAddress, since),
+      endsAt: new Date(window.end * 1e3),
+      source: "ledger"
+    });
+  }
+  return usage;
+}
+async function currentLimitUsageOnChain(policy, payerAddress, session, now = /* @__PURE__ */ new Date(), deps = {}) {
+  const local = currentLimitUsage(policy, payerAddress, session, now);
+  if (!session || local.length === 0) return local;
+  const asset = Object.values(USDC_BY_NETWORK).find((a) => a.chainId === session.chainId);
+  if (!asset) return local;
+  const onChain = await readCurrentPeriods(
+    {
+      chainId: session.chainId,
+      permissionId: session.permissionId,
+      permission: session.permission,
+      token: asset.address
+    },
+    deps
+  );
+  if (onChain.length === 0) return local;
+  return local.map((limit) => {
+    const match = onChain.find((candidate) => {
+      const normalized = normalizePeriod(candidate.unit, candidate.multiplier);
+      if (normalized?.unit !== limit.unit || normalized.multiplier !== limit.multiplier) return false;
+      const a = parseBigInt(candidate.allowance);
+      const b = parseBigInt(limit.allowance);
+      return a !== null && b !== null && a === b;
+    });
+    if (!match || match.period.status !== "ok") return limit;
+    const since = new Date(match.period.start * 1e3).toISOString();
+    const fromLedger = sumToppedUpSince(payerAddress, since);
+    const metered = match.period.spend >= fromLedger;
+    return {
+      ...limit,
+      spent: sumSpentSince(payerAddress, since),
+      toppedUp: metered ? match.period.spend : fromLedger,
+      endsAt: new Date(match.period.end * 1e3),
+      source: metered ? "chain" : "ledger"
+    };
+  });
+}
+
+// src/x402/gas-reserve.ts
+function gasReserve(asset) {
+  return 10n ** BigInt(asset.decimals) / 10n;
+}
+
+// src/lib/terminal.ts
+var INVISIBLE_AND_BIDI = /[\u200B-\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+var LINE_CONTROLS = /[\u0000-\u001F\u007F-\u009F]/g;
+var REPLACEMENT = "\uFFFD";
+var DEFAULT_LINE_LENGTH = 200;
+function bound(text, maxLength) {
+  if (text.length <= maxLength) return text;
+  return `${text.slice(0, maxLength)}\u2026 (${text.length - maxLength} more characters)`;
+}
+function sanitizeLine(value, maxLength = DEFAULT_LINE_LENGTH) {
+  const text = typeof value === "string" ? value : String(value);
+  return bound(text.replace(LINE_CONTROLS, REPLACEMENT).replace(INVISIBLE_AND_BIDI, REPLACEMENT), maxLength);
+}
+
+// src/x402/status-report.ts
+function formatUsdc(base2, decimals) {
+  if (base2 === void 0) return "unlimited";
+  const value = parseBigInt(base2);
+  if (value === null) return `${sanitizeLine(base2, 32)} (invalid)`;
+  const scale = 10n ** BigInt(decimals);
+  const whole = value / scale;
+  const frac = (value % scale).toString().padStart(decimals, "0").replace(/0+$/, "");
+  return `${whole}${frac ? `.${frac}` : ""} USDC`;
+}
+function formatRemaining(seconds) {
+  const days = Math.floor(seconds / 86400);
+  if (days > 0) return `${days} day${days === 1 ? "" : "s"} left`;
+  const hours = Math.max(0, Math.floor(seconds / 3600));
+  return `${hours}h left`;
+}
+function diagnose(facts) {
+  const problems = [];
+  if (facts.expired) {
+    problems.push("The session expired. Run `jaw session setup --x402`.");
+  }
+  if (facts.liveness === "revoked") {
+    problems.push(
+      "The permission was revoked on chain, so nothing can be pulled through it any more. Run `jaw session setup --x402` to grant a new one."
+    );
+  }
+  if (facts.liveness === "unapproved") {
+    problems.push(
+      "The chain has no record of this permission being approved. If the session was just created, the grant may not have been mined yet; otherwise run `jaw session setup --x402`."
+    );
+  }
+  if (facts.outdated) {
+    problems.push(
+      "This session was created by an older CLI and cannot pay: its permission belongs to an address separate from the session key. Run `jaw session setup --x402` to recreate it."
+    );
+  }
+  if (!facts.hasAsset) {
+    problems.push("This chain has no USDC configured, so x402 payments cannot be made on it.");
+  }
+  if (facts.hasAsset && facts.ownerBalance === null) {
+    problems.push(
+      facts.payerBalance === null ? "Could not read balances. Check the API key and network." : `Could not read the owner balance for ${facts.ownerAddress}. The address may be malformed.`
+    );
+  }
+  if (facts.ownerBalance !== null && Number(facts.ownerBalance) === 0) {
+    const payerHoldsMoreThanItsGas = facts.payerBalance !== null && Number(facts.payerBalance) > (facts.payerReserve ?? 0);
+    problems.push(
+      payerHoldsMoreThanItsGas ? "The owner account is empty but the payer holds USDC. Payments will work, but they bypass the permission, so the cap you granted is not applying. Move the funds to the owner." : "The owner account holds no USDC, so there is nothing to pay with."
+    );
+  }
+  if (facts.periodCap != null && facts.periodSpent != null && facts.periodSpent >= facts.periodCap) {
+    problems.push(
+      `The granted allowance for this ${facts.periodLabel ?? "period"} is used up. It resets at the end of the window, or grant a new permission with \`jaw session setup --x402\`.`
+    );
+  }
+  if (facts.sessionCap !== null && facts.spent >= facts.sessionCap) {
+    problems.push(
+      "The session cap is used up. Raise it with `jaw config set x402.maxTotalPerSession <base units>` or start a new session."
+    );
+  }
+  return problems;
+}
+
+// src/x402/permission-recovery.ts
+var RECOVERY_TIMEOUT_MS = 5e3;
+async function recoverPermission(session, apiKey, deps = {}) {
+  if (session.permission) return session.permission;
+  if (!apiKey) return void 0;
+  const fetchPermission = deps.fetchPermission ?? (async (id, key) => {
+    const { getPermissionFromRelay } = await import('@jaw.id/core');
+    return getPermissionFromRelay(id, key);
+  });
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), deps.timeoutMs ?? RECOVERY_TIMEOUT_MS);
+    });
+    const relayed = await Promise.race([fetchPermission(session.permissionId, apiKey), expired]);
+    const permission = parseGrantedPermission(relayed);
+    if (!permission) return void 0;
+    if (permission.account.toLowerCase() !== session.ownerAddress.toLowerCase() || permission.spender.toLowerCase() !== session.sessionAddress.toLowerCase() || permission.end !== session.expiry) {
+      return void 0;
+    }
+    return saveRecoveredPermission(session, permission) ? permission : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+// src/commands/x402/status.ts
+var X402Status = class _X402Status extends BaseCommand {
+  static description = "Show x402 payment readiness: which account holds the funds, the resolved caps, and what has been spent. Reads only, never pays.";
+  static examples = ["<%= config.bin %> x402 status", "<%= config.bin %> x402 status --output json"];
+  static flags = {
+    ...BaseCommand.baseFlags
+  };
+  async run() {
+    const { flags } = await this.parse(_X402Status);
+    const format = flags.output;
+    const session = keystoreExists() ? tryLoadSessionConfig() : null;
+    if (!session) {
+      if (format === "json") {
+        this.outputResult({ ready: false, reason: "no session" }, format);
+        return;
+      }
+      this.log("No session. Run `jaw session setup --x402` to create one.");
+      return;
+    }
+    const config = loadConfig();
+    const now = Date.now() / 1e3;
+    const expired = session.expiry <= now;
+    const asset = Object.values(USDC_BY_NETWORK).find((a) => a.chainId === session.chainId);
+    const payer = sessionPayerAddress();
+    const stillLive = liveOrphans(session.orphanedPermissions, now);
+    const [balances, recovered] = await Promise.all([
+      Promise.all(
+        [session.ownerAddress, payer].map(async (address) => {
+          if (!asset) return null;
+          try {
+            return (await usdcBalance(asset.wireNetwork, address)).formatted;
+          } catch {
+            return null;
+          }
+        })
+      ),
+      // Recovered first for a session written before the struct was stored,
+      // which is otherwise stuck reporting "cannot tell" forever.
+      recoverPermission(session, config.apiKey)
+    ]);
+    const [ownerBalance, payerBalance] = balances;
+    const current = recovered ? { ...session, permission: recovered } : session;
+    const liveness = await readLiveness(current);
+    const policy = resolveSessionX402Policy(config.x402, current);
+    const spent = sumSpentSince(payer, session.createdAt);
+    const sessionCap = parseBigInt(policy.maxTotalPerSession);
+    const decimals = asset?.decimals ?? 6;
+    const usage = await currentLimitUsageOnChain(policy, payer, current);
+    const limits = (policy.perPeriod ?? []).map((limit) => {
+      const measured = usage.find((entry) => sameLimit(entry, limit));
+      return measured ?? {
+        ...limit,
+        spent: 0n,
+        toppedUp: 0n,
+        endsAt: null,
+        source: "unmeasured"
+      };
+    });
+    const remaining = (limit) => {
+      const cap = parseBigInt(limit.allowance);
+      if (cap === null) return null;
+      return cap > limit.toppedUp ? cap - limit.toppedUp : 0n;
+    };
+    const tightest = limits.reduce((a, b) => {
+      const left = remaining(b);
+      if (left === null) return a;
+      const best = a === null ? null : remaining(a);
+      return best === null || left < best ? b : a;
+    }, null);
+    const problems = diagnose({
+      expired,
+      liveness,
+      ownerAddress: session.ownerAddress,
+      ownerBalance,
+      payerBalance,
+      hasAsset: asset !== void 0,
+      spent,
+      sessionCap,
+      periodCap: tightest ? parseBigInt(tightest.allowance) : null,
+      // Top-ups, not payments: the period cap mirrors the on-chain allowance
+      // and the top-up is what draws it down, exactly as `topUpCeiling`
+      // measures it. Payments lag by whatever float the payer still holds,
+      // which kept this check quiet while the grant was already drained.
+      // Null, not the zero an unmeasured limit carries: `diagnose` compares it
+      // against the cap, and a figure nobody read is not a measurement of zero.
+      periodSpent: tightest && tightest.endsAt !== null ? tightest.toppedUp : null,
+      periodLabel: tightest ? describePeriod(tightest.unit, tightest.multiplier) : null,
+      outdated: isLegacySession(session),
+      // Same units as the formatted balances. Exact in a double: the reserve
+      // is a tenth of a token, six decimals at most.
+      payerReserve: asset ? Number(gasReserve(asset)) / 10 ** asset.decimals : 0
+    });
+    if (format === "json") {
+      this.outputResult(
+        {
+          ready: problems.length === 0,
+          problems,
+          chainId: session.chainId,
+          permission: { id: session.permissionId, onChain: liveness },
+          ...stillLive.length > 0 ? { stillLiveOnChain: stillLive } : {},
+          owner: { address: session.ownerAddress, usdc: ownerBalance },
+          payer: { address: payer, usdc: payerBalance },
+          policy: {
+            maxAmountPerPayment: policy.maxAmountPerPayment,
+            maxTotalPerSession: policy.maxTotalPerSession,
+            // Every one of them: the contract charges all, and naming one as
+            // the budget is what this set out to stop.
+            perPeriod: limits.map((limit) => ({
+              allowance: limit.allowance,
+              unit: limit.unit,
+              multiplier: limit.multiplier,
+              used: limit.endsAt === null ? null : limit.toppedUp.toString(),
+              usedFrom: limit.source,
+              resetsAt: limit.endsAt === null ? null : limit.endsAt.toISOString()
+            })),
+            topUpFloat: policy.topUpFloat
+          },
+          spentThisSession: spent.toString(),
+          expiry: session.expiry,
+          expired
+        },
+        format
+      );
+      return;
+    }
+    this.log(expired ? "Session expired.\n" : "Session active.\n");
+    this.log(`  owner   ${session.ownerAddress}   ${fmt(ownerBalance)}   <- funds go here`);
+    this.log(`  payer   ${payer}   ${fmt(payerBalance)}`);
+    this.log("");
+    this.log(`  chain   ${session.chainId}${asset ? "" : "   (no USDC configured for this chain)"}`);
+    if (liveness !== "unknown") {
+      this.log(`  perm    ${session.permissionId}   ${LIVENESS_LABEL[liveness]}`);
+    }
+    if (stillLive.length > 0) {
+      this.log(
+        `          ${stillLive.length} permission${stillLive.length === 1 ? "" : "s"} from earlier sessions still live on this account; \`jaw session revoke\` removes them too`
+      );
+    }
+    this.log(`  caps    ${formatUsdc(policy.maxAmountPerPayment, decimals)} per payment`);
+    for (const limit of limits) {
+      const floor = limit.source === "chain" ? "" : "at least ";
+      const window = limit.endsAt === null ? " (usage unknown)" : ` (resets ${limit.endsAt.toISOString()})`;
+      const used = limit.endsAt === null ? "?" : `${floor}${formatUsdc(limit.toppedUp.toString(), decimals)}`;
+      this.log(
+        `          ${used} of ${formatUsdc(limit.allowance, decimals)} used this ${describePeriod(limit.unit, limit.multiplier)}${window}`
+      );
+    }
+    if (limits.length > 1) {
+      this.log("          all of them apply, so the tightest is what binds");
+    }
+    this.log(
+      `          at least ${formatUsdc(spent.toString(), decimals)} of ${formatUsdc(policy.maxTotalPerSession, decimals)} spent this session`
+    );
+    this.log("          the session figure is counted from this CLI's ledger, which a direct jaw_rpc send bypasses");
+    if (policy.topUpFloat) {
+      this.log(`  float   tops the payer up to ${formatUsdc(policy.topUpFloat, decimals)} when it runs short`);
+    }
+    this.log(
+      `  expires ${new Date(session.expiry * 1e3).toISOString()}${expired ? "" : ` (${formatRemaining(session.expiry - now)})`}`
+    );
+    if (problems.length > 0) {
+      this.log("");
+      for (const problem of problems) this.log(`  ! ${problem}`);
+    }
+  }
+};
+function fmt(balance) {
+  return balance === null ? "     ?    " : `${balance} USDC`;
+}
+var LIVENESS_LABEL = {
+  active: "live on chain",
+  revoked: "REVOKED on chain",
+  unapproved: "not approved on chain",
+  mismatch: "does not match the stored permission"
+};
+
+export { X402Status as default };
+//# sourceMappingURL=status.js.map
+//# sourceMappingURL=status.js.map