@jaw.id/cli 0.1.26 → 0.2.1

package/dist/base-command.js

@@ -11,7 +11,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/config.ts

package/dist/base-command.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/lib/paths.ts","../src/lib/config.ts","../src/lib/output.ts","../src/base-command.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;ACPO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;ACvCO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF","file":"base-command.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n"]}
+{"version":3,"sources":["../src/lib/paths.ts","../src/lib/config.ts","../src/lib/output.ts","../src/base-command.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB,CAAA;AAAA,EACvD,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,gBAAgB,CAAA;AAAA,EAC5C,WAAA,EAAkB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,mBAAmB;AACrD,CAAA;;;ACRO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;;;ACxCO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF","file":"base-command.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n  x402Log: path.join(JAW_DIR, 'x402-log.jsonl'),\n  paymentLock: path.join(JAW_DIR, 'x402-payment.lock'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig, SettableConfigKey } from './types.js';\nimport type { X402Policy, X402PolicyKey } from '../x402/policy.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\n/**\n * Set one field of the `x402` payment policy. Array fields (allow-lists) are\n * comma-split. Intentionally NOT reachable from the MCP tool surface: an agent\n * must not be able to raise its own spending caps — only a human at the CLI.\n */\nexport function setX402PolicyValue(key: X402PolicyKey, value: string): void {\n  const config = loadConfig();\n  const x402: X402Policy = { ...(config.x402 ?? {}) };\n  if (key === 'maxAmountPerPayment' || key === 'maxTotalPerSession' || key === 'topUpFloat') {\n    // These are base-unit amounts read via BigInt() on the hot payment path;\n    // reject anything that isn't a non-negative integer here so a bad value\n    // can never turn into a per-payment failure later.\n    if (!/^\\d+$/.test(value.trim())) {\n      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);\n    }\n    x402[key] = value.trim();\n  } else {\n    x402[key] = value\n      .split(',')\n      .map((v) => v.trim())\n      .filter(Boolean);\n  }\n  saveConfig({ ...config, x402 });\n}\n\nexport function setConfigValue(key: SettableConfigKey, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  // Numeric keys: coerce + validate here so EVERY caller is safe. The MCP tool\n  // passes raw strings (its schema types value as a string), so without this a\n  // `sessionExpiry: \"abc\"` would land as a string and turn `expiry * 86400`\n  // into NaN, and a `defaultChain` string would ride into an RPC URL verbatim.\n  let toStore: string | number = value;\n  if (key === 'defaultChain' || key === 'sessionExpiry') {\n    // Strict: reject anything parseInt would silently truncate ('1.5' -> 1,\n    // '0x10' -> 0, '10abc' -> 10). Only a bare positive decimal integer passes.\n    const n = typeof value === 'number' ? value : /^\\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;\n    if (!Number.isInteger(n) || n <= 0) {\n      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);\n    }\n    toStore = n;\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: toStore };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n"]}

package/dist/commands/config/set.js

@@ -2,6 +2,7 @@ import { Command, Flags } from '@oclif/core';
 import * as fs from 'fs';
 import * as path from 'path';
 import * as os from 'os';
+import 'viem';
 
 // src/base-command.ts
 var JAW_DIR = path.join(os.homedir(), ".jaw");
@@ -11,7 +12,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/validation.ts
@@ -72,6 +75,19 @@ function saveConfig(config) {
     mode: 384
   });
 }
+function setX402PolicyValue(key, value) {
+  const config = loadConfig();
+  const x402 = { ...config.x402 ?? {} };
+  if (key === "maxAmountPerPayment" || key === "maxTotalPerSession" || key === "topUpFloat") {
+    if (!/^\d+$/.test(value.trim())) {
+      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);
+    }
+    x402[key] = value.trim();
+  } else {
+    x402[key] = value.split(",").map((v) => v.trim()).filter(Boolean);
+  }
+  saveConfig({ ...config, x402 });
+}
 function setConfigValue(key, value) {
   if (key === "keysUrl" && typeof value === "string" && !isValidKeysUrl(value)) {
     throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
@@ -79,8 +95,16 @@ function setConfigValue(key, value) {
   if (key === "relayUrl" && typeof value === "string" && !isValidRelayUrl(value)) {
     throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);
   }
+  let toStore = value;
+  if (key === "defaultChain" || key === "sessionExpiry") {
+    const n = typeof value === "number" ? value : /^\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;
+    if (!Number.isInteger(n) || n <= 0) {
+      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);
+    }
+    toStore = n;
+  }
   const config = loadConfig();
-  const updated = { ...config, [key]: value };
+  const updated = { ...config, [key]: toStore };
   saveConfig(updated);
 }
 
@@ -172,17 +196,97 @@ var BaseCommand = class extends Command {
   }
 };
 
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+
+// src/x402/policy.ts
+({
+  // 10 USDC per process
+  allowedAssets: Object.values(USDC_BY_NETWORK).map((asset) => asset.address)});
+var X402_SCALAR_KEYS = ["maxAmountPerPayment", "maxTotalPerSession", "topUpFloat"];
+var X402_ARRAY_KEYS = ["allowedAssets", "allowedNetworks", "allowedHosts", "allowedPayTo"];
+function isX402PolicyKey(key) {
+  return X402_SCALAR_KEYS.includes(key) || X402_ARRAY_KEYS.includes(key);
+}
+var LIMIT_PERIODS = ["minute", "hour", "day", "week", "month", "year", "forever"];
+function parseLimit(input) {
+  const trimmed = input.trim();
+  if (!trimmed) throw new Error("Limit is empty. Use --limit <amount>/<period>, for example 10/day.");
+  const [rawAmount, rawPeriod = "day", ...rest] = trimmed.split("/");
+  if (rest.length > 0) {
+    throw new Error(`Invalid limit "${input}". Expected <amount>/<period>, for example 10/day.`);
+  }
+  const amount = rawAmount.trim();
+  if (!/^\d+(\.\d+)?$/.test(amount)) {
+    throw new Error(`Invalid limit amount "${rawAmount}". Expected a positive number, for example 10 or 2.5.`);
+  }
+  const period = rawPeriod.trim().toLowerCase();
+  if (!LIMIT_PERIODS.includes(period)) {
+    throw new Error(`Invalid limit period "${rawPeriod}". Expected one of: ${LIMIT_PERIODS.join(", ")}.`);
+  }
+  return { amount, period };
+}
+
 // src/commands/config/set.ts
-var VALID_KEYS = ["apiKey", "defaultChain", "keysUrl", "ens", "relayUrl", "sessionExpiry"];
+var VALID_KEYS = [
+  "apiKey",
+  "defaultChain",
+  "keysUrl",
+  "ens",
+  "relayUrl",
+  "sessionExpiry",
+  // Settable here and nowhere else. Like the x402 policy fields below, the MCP
+  // tool cannot reach it, so an agent cannot raise the ceiling on what it is
+  // allowed to ask a human to approve.
+  "grantCeiling"
+];
 function isValidKey(key) {
   return VALID_KEYS.includes(key);
 }
+function isSettableKey(key) {
+  return isValidKey(key) || key.startsWith("x402.") && isX402PolicyKey(key.slice("x402.".length));
+}
 var ConfigSet = class _ConfigSet extends BaseCommand {
   static description = "Set one or more configuration values. Accepts key=value pairs or a single key value.";
   static examples = [
     "<%= config.bin %> config set apiKey=your-api-key defaultChain=8453",
     "<%= config.bin %> config set ens=yourdomain.eth sessionExpiry=14",
-    "<%= config.bin %> config set apiKey your-api-key"
+    "<%= config.bin %> config set apiKey your-api-key",
+    "<%= config.bin %> config set x402.maxAmountPerPayment=50000 x402.maxTotalPerSession=1000000",
+    "<%= config.bin %> config set x402.allowedNetworks=eip155:8453,eip155:84532"
   ];
   static strict = false;
   static args = {};
@@ -202,12 +306,35 @@ Usage: jaw config set key=value [key=value ...]`
     }
     const results = [];
     for (const { key, value } of entries) {
-      const parsed = key === "defaultChain" || key === "sessionExpiry" ? parseInt(value, 10) : value;
-      if ((key === "defaultChain" || key === "sessionExpiry") && isNaN(parsed)) {
-        this.error(`Invalid number for ${key}: ${value}`);
+      if (key.startsWith("x402.")) {
+        const sub = key.slice("x402.".length);
+        if (!isX402PolicyKey(sub)) {
+          this.error(`Invalid x402 config key: ${sub}`);
+        }
+        try {
+          setX402PolicyValue(sub, value);
+        } catch (err) {
+          this.error(err instanceof Error ? err.message : String(err));
+        }
+        results.push({ key, value });
+        continue;
+      }
+      if (!isValidKey(key)) {
+        this.error(`Invalid config key: ${key}`);
+      }
+      if (key === "grantCeiling" && value.trim() !== "") {
+        try {
+          parseLimit(value);
+        } catch (err) {
+          this.error(`Invalid grantCeiling: ${err instanceof Error ? err.message : String(err)}`);
+        }
+      }
+      try {
+        setConfigValue(key, value);
+      } catch (err) {
+        this.error(err instanceof Error ? err.message : String(err));
       }
-      setConfigValue(key, parsed);
-      const displayValue = key === "apiKey" && typeof value === "string" ? `${value.slice(0, 8)}...` : parsed;
+      const displayValue = key === "apiKey" && typeof value === "string" ? `${value.slice(0, 8)}...` : value;
       results.push({ key, value: displayValue });
     }
     if (flags.output === "json") {
@@ -220,6 +347,7 @@ Usage: jaw config set key=value [key=value ...]`
   }
   parseEntries(rawArgs) {
     const entries = [];
+    const validKeysHint = `Valid keys: ${VALID_KEYS.join(", ")}, x402.<maxAmountPerPayment|maxTotalPerSession|allowedAssets|allowedNetworks|allowedHosts|allowedPayTo>`;
     let i = 0;
     while (i < rawArgs.length) {
       const arg = rawArgs[i];
@@ -227,13 +355,13 @@ Usage: jaw config set key=value [key=value ...]`
         const eqIndex = arg.indexOf("=");
         const key = arg.slice(0, eqIndex);
         const value = arg.slice(eqIndex + 1);
-        if (!isValidKey(key)) {
+        if (!isSettableKey(key)) {
           this.error(`Invalid config key: ${key}
-Valid keys: ${VALID_KEYS.join(", ")}`);
+${validKeysHint}`);
         }
         entries.push({ key, value });
         i++;
-      } else if (isValidKey(arg) && i + 1 < rawArgs.length) {
+      } else if (isSettableKey(arg) && i + 1 < rawArgs.length) {
         entries.push({ key: arg, value: rawArgs[i + 1] });
         i += 2;
       } else {

package/dist/commands/config/set.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/lib/output.ts","../../../src/base-command.ts","../../../src/commands/config/set.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;AC+DO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACxG,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACtG,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACtE,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACnGO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAgCO,SAAS,cAAA,CAAe,KAAsB,KAAA,EAA8B;AACjF,EAAA,IAAI,GAAA,KAAQ,aAAa,OAAO,KAAA,KAAU,YAAY,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,iDAAA,CAAmD,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,GAAA,KAAQ,cAAc,OAAO,KAAA,KAAU,YAAY,CAAC,eAAA,CAAgB,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAC3F;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,KAAA,EAAM;AAC1C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;ACjFO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF,CAAA;;;ACpDA,IAAM,aAAa,CAAC,QAAA,EAAU,gBAAgB,SAAA,EAAW,KAAA,EAAO,YAAY,eAAe,CAAA;AAI3F,SAAS,WAAW,GAAA,EAA8B;AAChD,EAAA,OAAO,UAAA,CAAW,SAAS,GAAe,CAAA;AAC5C;AAEA,IAAqB,SAAA,GAArB,MAAqB,UAAA,SAAkB,WAAA,CAAY;AAAA,EACjD,OAAgB,WAAA,GAAc,sFAAA;AAAA,EAE9B,OAAgB,QAAA,GAAW;AAAA,IACzB,oEAAA;AAAA,IACA,kEAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,OAAgB,MAAA,GAAS,KAAA;AAAA,EAEzB,OAAgB,OAAO,EAAC;AAAA,EAExB,OAAgB,KAAA,GAAQ;AAAA,IACtB,GAAG,WAAA,CAAY;AAAA,GACjB;AAAA,EAEA,MAAM,GAAA,GAAqB;AACzB,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,IAAA,CAAK,MAAM,UAAS,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,IAAA;AAGhB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AAEzC,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,IAAA,CAAK,KAAA;AAAA,QACH,CAAA;AAAA,YAAA,EAAmD,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC;AAAA,+CAAA;AAAA,OAC1E;AAAA,IACF;AAEA,IAAA,MAAM,UAAqD,EAAC;AAE5D,IAAA,KAAA,MAAW,EAAE,GAAA,EAAK,KAAA,EAAM,IAAK,OAAA,EAAS;AACpC,MAAA,MAAM,MAAA,GAAS,QAAQ,cAAA,IAAkB,GAAA,KAAQ,kBAAkB,QAAA,CAAS,KAAA,EAAO,EAAE,CAAA,GAAI,KAAA;AAEzF,MAAA,IAAA,CAAK,QAAQ,cAAA,IAAkB,GAAA,KAAQ,eAAA,KAAoB,KAAA,CAAM,MAAgB,CAAA,EAAG;AAClF,QAAA,IAAA,CAAK,KAAA,CAAM,CAAA,mBAAA,EAAsB,GAAG,CAAA,EAAA,EAAK,KAAK,CAAA,CAAE,CAAA;AAAA,MAClD;AAEA,MAAA,cAAA,CAAe,KAAK,MAAyB,CAAA;AAE7C,MAAA,MAAM,YAAA,GAAe,GAAA,KAAQ,QAAA,IAAY,OAAO,KAAA,KAAU,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ,MAAA;AAEjG,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,cAAc,CAAA;AAAA,IAC3C;AAEA,IAAA,IAAI,KAAA,CAAM,WAAW,MAAA,EAAQ;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,QAAQ,MAAA,KAAW,CAAA,GAAI,QAAQ,CAAC,CAAA,GAAI,SAAS,MAAM,CAAA;AAAA,IACvE,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,EAAE,GAAA,EAAK,KAAA,EAAM,IAAK,OAAA,EAAS;AACpC,QAAA,IAAA,CAAK,GAAA,CAAI,CAAA,IAAA,EAAO,GAAG,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAA,EAAuD;AAC1E,IAAA,MAAM,UAA8C,EAAC;AAErD,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AAErB,MAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAG;AAErB,QAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AAChC,QAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA;AAEnC,QAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,UAAA,IAAA,CAAK,KAAA,CAAM,uBAAuB,GAAG;AAAA,YAAA,EAAiB,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAAA,QAC/E;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAC3B,QAAA,CAAA,EAAA;AAAA,MACF,WAAW,UAAA,CAAW,GAAG,KAAK,CAAA,GAAI,CAAA,GAAI,QAAQ,MAAA,EAAQ;AAEpD,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,GAAA,EAAK,OAAO,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAA,EAAG,CAAA;AAChD,QAAA,CAAA,IAAK,CAAA;AAAA,MACP,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,KAAA,CAAM,wBAAwB,GAAG;AAAA,+CAAA,CAAmD,CAAA;AAAA,MAC3F;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF","file":"set.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import type { PermissionsConfig } from './types.js';\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;\nconst HEX_RE = /^0x[0-9a-fA-F]+$/;\nconst VALID_SPEND_UNITS = new Set(['minute', 'hour', 'day', 'week', 'month', 'year', 'forever']);\n\nexport function parsePermissionsConfig(raw: unknown): PermissionsConfig {\n  const errors: string[] = [];\n\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw new Error('Invalid permissions:\\n  - Must be an object');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const calls = obj.calls as unknown[] | undefined;\n  const spends = obj.spends as unknown[] | undefined;\n\n  if (!calls && !spends) {\n    throw new Error('Invalid permissions:\\n  - Must include at least \"calls\" or \"spends\"');\n  }\n\n  if (calls !== undefined) {\n    if (!Array.isArray(calls) || calls.length === 0) {\n      errors.push('calls: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < calls.length; i++) {\n        const c = calls[i] as Record<string, unknown>;\n        if (!c || typeof c !== 'object') {\n          errors.push(`calls.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof c.target !== 'string' || !ADDRESS_RE.test(c.target)) {\n          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (c.selector !== undefined && (typeof c.selector !== 'string' || !SELECTOR_RE.test(c.selector))) {\n          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);\n        }\n      }\n    }\n  }\n\n  if (spends !== undefined) {\n    if (!Array.isArray(spends) || spends.length === 0) {\n      errors.push('spends: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < spends.length; i++) {\n        const s = spends[i] as Record<string, unknown>;\n        if (!s || typeof s !== 'object') {\n          errors.push(`spends.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof s.token !== 'string' || !ADDRESS_RE.test(s.token)) {\n          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (typeof s.allowance !== 'string' || !HEX_RE.test(s.allowance)) {\n          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);\n        }\n        if (typeof s.unit !== 'string' || !VALID_SPEND_UNITS.has(s.unit)) {\n          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(', ')}`);\n        }\n        if (s.multiplier !== undefined && (!Number.isInteger(s.multiplier) || (s.multiplier as number) < 1)) {\n          errors.push(`spends.${i}.multiplier: Must be a positive integer`);\n        }\n      }\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Invalid permissions:\\n${errors.map((e) => `  - ${e}`).join('\\n')}`);\n  }\n\n  return raw as PermissionsConfig;\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'https:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'wss:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    const isWebSocket = parsed.protocol === 'wss:' || parsed.protocol === 'ws:';\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n","import { BaseCommand } from '../../base-command.js';\nimport { setConfigValue } from '../../lib/config.js';\n\nconst VALID_KEYS = ['apiKey', 'defaultChain', 'keysUrl', 'ens', 'relayUrl', 'sessionExpiry'] as const;\n\ntype ValidKey = (typeof VALID_KEYS)[number];\n\nfunction isValidKey(key: string): key is ValidKey {\n  return VALID_KEYS.includes(key as ValidKey);\n}\n\nexport default class ConfigSet extends BaseCommand {\n  static override description = 'Set one or more configuration values. Accepts key=value pairs or a single key value.';\n\n  static override examples = [\n    '<%= config.bin %> config set apiKey=your-api-key defaultChain=8453',\n    '<%= config.bin %> config set ens=yourdomain.eth sessionExpiry=14',\n    '<%= config.bin %> config set apiKey your-api-key',\n  ];\n\n  static override strict = false;\n\n  static override args = {};\n\n  static override flags = {\n    ...BaseCommand.baseFlags,\n  };\n\n  async run(): Promise<void> {\n    const { argv, flags } = await this.parse(ConfigSet);\n    const rawArgs = argv as string[];\n\n    // Parse key=value pairs from all args\n    const entries = this.parseEntries(rawArgs);\n\n    if (entries.length === 0) {\n      this.error(\n        `No valid key=value pairs provided.\\nValid keys: ${VALID_KEYS.join(', ')}\\nUsage: jaw config set key=value [key=value ...]`\n      );\n    }\n\n    const results: { key: string; value: string | number }[] = [];\n\n    for (const { key, value } of entries) {\n      const parsed = key === 'defaultChain' || key === 'sessionExpiry' ? parseInt(value, 10) : value;\n\n      if ((key === 'defaultChain' || key === 'sessionExpiry') && isNaN(parsed as number)) {\n        this.error(`Invalid number for ${key}: ${value}`);\n      }\n\n      setConfigValue(key, parsed as string | number);\n\n      const displayValue = key === 'apiKey' && typeof value === 'string' ? `${value.slice(0, 8)}...` : parsed;\n\n      results.push({ key, value: displayValue });\n    }\n\n    if (flags.output === 'json') {\n      this.outputResult(results.length === 1 ? results[0] : results, 'json');\n    } else {\n      for (const { key, value } of results) {\n        this.log(`Set ${key} = ${value}`);\n      }\n    }\n  }\n\n  private parseEntries(rawArgs: string[]): { key: ValidKey; value: string }[] {\n    const entries: { key: ValidKey; value: string }[] = [];\n\n    let i = 0;\n    while (i < rawArgs.length) {\n      const arg = rawArgs[i];\n\n      if (arg.includes('=')) {\n        // key=value syntax\n        const eqIndex = arg.indexOf('=');\n        const key = arg.slice(0, eqIndex);\n        const value = arg.slice(eqIndex + 1);\n\n        if (!isValidKey(key)) {\n          this.error(`Invalid config key: ${key}\\nValid keys: ${VALID_KEYS.join(', ')}`);\n        }\n        entries.push({ key, value });\n        i++;\n      } else if (isValidKey(arg) && i + 1 < rawArgs.length) {\n        // key value syntax (legacy)\n        entries.push({ key: arg, value: rawArgs[i + 1] });\n        i += 2;\n      } else {\n        this.error(`Unexpected argument: ${arg}\\nUsage: jaw config set key=value [key=value ...]`);\n      }\n    }\n\n    return entries;\n  }\n}\n"]}
+{"version":3,"sources":["../../../src/lib/paths.ts","../../../src/lib/validation.ts","../../../src/lib/config.ts","../../../src/lib/output.ts","../../../src/base-command.ts","../../../src/x402/asset-registry.ts","../../../src/x402/policy.ts","../../../src/x402/grant-preset.ts","../../../src/commands/config/set.ts"],"names":[],"mappings":";;;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB,CAAA;AAAA,EACvD,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,gBAAgB,CAAA;AAAA,EAC5C,WAAA,EAAkB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,mBAAmB;AACrD,CAAA;;;ACiEO,SAAS,eAAe,GAAA,EAAsB;AACnD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,QAAA,IAAY,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACxG,IAAA,OAAO,aAAA,IAAiB,QAAA;AAAA,EAC1B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,gBAAgB,GAAA,EAAsB;AACpD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,MAAM,aAAA,GACJ,MAAA,CAAO,QAAA,CAAS,QAAA,CAAS,SAAS,CAAA,IAClC,MAAA,CAAO,QAAA,KAAa,QAAA,IACpB,MAAA,CAAO,QAAA,KAAa,WAAA,IACpB,OAAO,QAAA,KAAa,WAAA;AACtB,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,WAAA,IAAe,OAAO,QAAA,KAAa,WAAA;AACtG,IAAA,MAAM,WAAA,GAAc,MAAA,CAAO,QAAA,KAAa,MAAA,IAAU,OAAO,QAAA,KAAa,KAAA;AACtE,IAAA,OAAO,iBAAiB,QAAA,IAAY,WAAA;AAAA,EACtC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;ACtGO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAqCO,SAAS,kBAAA,CAAmB,KAAoB,KAAA,EAAqB;AAC1E,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,OAAmB,EAAE,GAAI,MAAA,CAAO,IAAA,IAAQ,EAAC,EAAG;AAClD,EAAA,IAAI,GAAA,KAAQ,qBAAA,IAAyB,GAAA,KAAQ,oBAAA,IAAwB,QAAQ,YAAA,EAAc;AAIzF,IAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,CAAA,EAAG;AAC/B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,mDAAA,EAAsD,KAAK,CAAA,CAAE,CAAA;AAAA,IACrF;AACA,IAAA,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA,CAAM,IAAA,EAAK;AAAA,EACzB,CAAA,MAAO;AACL,IAAA,IAAA,CAAK,GAAG,CAAA,GAAI,KAAA,CACT,KAAA,CAAM,GAAG,CAAA,CACT,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAA,CACnB,OAAO,OAAO,CAAA;AAAA,EACnB;AACA,EAAA,UAAA,CAAW,EAAE,GAAG,MAAA,EAAQ,IAAA,EAAM,CAAA;AAChC;AAEO,SAAS,cAAA,CAAe,KAAwB,KAAA,EAA8B;AACnF,EAAA,IAAI,GAAA,KAAQ,aAAa,OAAO,KAAA,KAAU,YAAY,CAAC,cAAA,CAAe,KAAK,CAAA,EAAG;AAC5E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAsB,KAAK,CAAA,iDAAA,CAAmD,CAAA;AAAA,EAChG;AACA,EAAA,IAAI,GAAA,KAAQ,cAAc,OAAO,KAAA,KAAU,YAAY,CAAC,eAAA,CAAgB,KAAK,CAAA,EAAG;AAC9E,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,oBAAA,EAAuB,KAAK,CAAA,2CAAA,CAA6C,CAAA;AAAA,EAC3F;AAKA,EAAA,IAAI,OAAA,GAA2B,KAAA;AAC/B,EAAA,IAAI,GAAA,KAAQ,cAAA,IAAkB,GAAA,KAAQ,eAAA,EAAiB;AAGrD,IAAA,MAAM,IAAI,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,QAAQ,IAAA,CAAK,KAAA,CAAM,IAAA,EAAM,IAAI,QAAA,CAAS,KAAA,CAAM,IAAA,EAAK,EAAG,EAAE,CAAA,GAAI,GAAA;AACxG,IAAA,IAAI,CAAC,MAAA,CAAO,SAAA,CAAU,CAAC,CAAA,IAAK,KAAK,CAAA,EAAG;AAClC,MAAA,MAAM,IAAI,MAAM,CAAA,EAAG,GAAG,qCAAqC,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACpF;AACA,IAAA,OAAA,GAAU,CAAA;AAAA,EACZ;AACA,EAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,EAAA,MAAM,UAAU,EAAE,GAAG,QAAQ,CAAC,GAAG,GAAG,OAAA,EAAQ;AAC5C,EAAA,UAAA,CAAW,OAAO,CAAA;AACpB;;;ACzHO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF,CAAA;;;AChCO,IAAM,eAAA,GAA6C;AAAA,EACxD,aAAA,EAAe;AAAA,IACb,OAAA,EAAS,4CAAA;AAAA,IACT,OAAA,EAAS,IAAA;AAAA,IACT,WAAA,EAAa,aAAA;AAAA,IACb,QAAA,EAAU,UAAA;AAAA,IACV,WAAA,EAAa,GAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACZ;AAAA,EACA,cAAA,EAAgB;AAAA,IACd,OAAA,EAAS,4CAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,WAAA,EAAa,cAAA;AAAA,IACb,QAAA,EAAU,MAAA;AAAA,IACV,WAAA,EAAa,GAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACZ;AAAA,EACA,YAAA,EAAc;AAAA,IACZ,OAAA,EAAS,4CAAA;AAAA,IACT,OAAA,EAAS,GAAA;AAAA,IACT,WAAA,EAAa,YAAA;AAAA,IACb,QAAA,EAAU,UAAA;AAAA,IACV,WAAA,EAAa,GAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACZ;AAAA,EACA,cAAA,EAAgB;AAAA,IACd,OAAA,EAAS,4CAAA;AAAA,IACT,OAAA,EAAS,KAAA;AAAA,IACT,WAAA,EAAa,cAAA;AAAA,IACb,QAAA,EAAU,MAAA;AAAA,IACV,WAAA,EAAa,GAAA;AAAA,IACb,QAAA,EAAU;AAAA;AAEd,CAAA;;;CCuC+C;AAAA,EAEzB;AAAA,EACpB,aAAA,EAAe,OAAO,MAAA,CAAO,eAAe,EAAE,GAAA,CAAI,CAAC,KAAA,KAAU,KAAA,CAAM,OAAO,CAE5E;AA8JO,IAAM,gBAAA,GAAmB,CAAC,qBAAA,EAAuB,oBAAA,EAAsB,YAAY,CAAA;AACnF,IAAM,eAAA,GAAkB,CAAC,eAAA,EAAiB,iBAAA,EAAmB,gBAAgB,cAAc,CAAA;AAG3F,SAAS,gBAAgB,GAAA,EAAmC;AACjE,EAAA,OAAQ,iBAAuC,QAAA,CAAS,GAAG,CAAA,IAAM,eAAA,CAAsC,SAAS,GAAG,CAAA;AACrH;AClPO,IAAM,aAAA,GAAgB,CAAC,QAAA,EAAU,MAAA,EAAQ,OAAO,MAAA,EAAQ,OAAA,EAAS,QAAQ,SAAS,CAAA;AAiBlF,SAAS,WAAW,KAAA,EAA4B;AACrD,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,EAAK;AAC3B,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,MAAM,oEAAoE,CAAA;AAElG,EAAA,MAAM,CAAC,WAAW,SAAA,GAAY,KAAA,EAAO,GAAG,IAAI,CAAA,GAAI,OAAA,CAAQ,KAAA,CAAM,GAAG,CAAA;AACjE,EAAA,IAAI,IAAA,CAAK,SAAS,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,eAAA,EAAkB,KAAK,CAAA,kDAAA,CAAoD,CAAA;AAAA,EAC7F;AAEA,EAAA,MAAM,MAAA,GAAS,UAAU,IAAA,EAAK;AAG9B,EAAA,IAAI,CAAC,eAAA,CAAgB,IAAA,CAAK,MAAM,CAAA,EAAG;AACjC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,SAAS,CAAA,qDAAA,CAAuD,CAAA;AAAA,EAC3G;AAEA,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,IAAA,EAAK,CAAE,WAAA,EAAY;AAC5C,EAAA,IAAI,CAAE,aAAA,CAAoC,QAAA,CAAS,MAAM,CAAA,EAAG;AAC1D,IAAA,MAAM,IAAI,MAAM,CAAA,sBAAA,EAAyB,SAAS,uBAAuB,aAAA,CAAc,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAG,CAAA;AAAA,EACtG;AAEA,EAAA,OAAO,EAAE,QAAQ,MAAA,EAAO;AAC1B;;;ACxDA,IAAM,UAAA,GAAa;AAAA,EACjB,QAAA;AAAA,EACA,cAAA;AAAA,EACA,SAAA;AAAA,EACA,KAAA;AAAA,EACA,UAAA;AAAA,EACA,eAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAA;AAIA,SAAS,WAAW,GAAA,EAA8B;AAChD,EAAA,OAAO,UAAA,CAAW,SAAS,GAAe,CAAA;AAC5C;AAKA,SAAS,cAAc,GAAA,EAAsB;AAC3C,EAAA,OAAO,UAAA,CAAW,GAAG,CAAA,IAAM,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,IAAK,eAAA,CAAgB,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAC,CAAA;AACjG;AAEA,IAAqB,SAAA,GAArB,MAAqB,UAAA,SAAkB,WAAA,CAAY;AAAA,EACjD,OAAgB,WAAA,GAAc,sFAAA;AAAA,EAE9B,OAAgB,QAAA,GAAW;AAAA,IACzB,oEAAA;AAAA,IACA,kEAAA;AAAA,IACA,kDAAA;AAAA,IACA,6FAAA;AAAA,IACA;AAAA,GACF;AAAA,EAEA,OAAgB,MAAA,GAAS,KAAA;AAAA,EAEzB,OAAgB,OAAO,EAAC;AAAA,EAExB,OAAgB,KAAA,GAAQ;AAAA,IACtB,GAAG,WAAA,CAAY;AAAA,GACjB;AAAA,EAEA,MAAM,GAAA,GAAqB;AACzB,IAAA,MAAM,EAAE,IAAA,EAAM,KAAA,KAAU,MAAM,IAAA,CAAK,MAAM,UAAS,CAAA;AAClD,IAAA,MAAM,OAAA,GAAU,IAAA;AAGhB,IAAA,MAAM,OAAA,GAAU,IAAA,CAAK,YAAA,CAAa,OAAO,CAAA;AAEzC,IAAA,IAAI,OAAA,CAAQ,WAAW,CAAA,EAAG;AACxB,MAAA,IAAA,CAAK,KAAA;AAAA,QACH,CAAA;AAAA,YAAA,EAAmD,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC;AAAA,+CAAA;AAAA,OAC1E;AAAA,IACF;AAEA,IAAA,MAAM,UAAqD,EAAC;AAE5D,IAAA,KAAA,MAAW,EAAE,GAAA,EAAK,KAAA,EAAM,IAAK,OAAA,EAAS;AACpC,MAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAC3B,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,KAAA,CAAM,OAAA,CAAQ,MAAM,CAAA;AACpC,QAAA,IAAI,CAAC,eAAA,CAAgB,GAAG,CAAA,EAAG;AACzB,UAAA,IAAA,CAAK,KAAA,CAAM,CAAA,yBAAA,EAA4B,GAAG,CAAA,CAAE,CAAA;AAAA,QAC9C;AAIA,QAAA,IAAI;AACF,UAAA,kBAAA,CAAmB,KAAK,KAAK,CAAA;AAAA,QAC/B,SAAS,GAAA,EAAK;AACZ,UAAA,IAAA,CAAK,MAAM,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,QAC7D;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAC3B,QAAA;AAAA,MACF;AAEA,MAAA,IAAI,CAAC,UAAA,CAAW,GAAG,CAAA,EAAG;AACpB,QAAA,IAAA,CAAK,KAAA,CAAM,CAAA,oBAAA,EAAuB,GAAG,CAAA,CAAE,CAAA;AAAA,MACzC;AAIA,MAAA,IAAI,GAAA,KAAQ,cAAA,IAAkB,KAAA,CAAM,IAAA,OAAW,EAAA,EAAI;AACjD,QAAA,IAAI;AACF,UAAA,UAAA,CAAW,KAAK,CAAA;AAAA,QAClB,SAAS,GAAA,EAAK;AACZ,UAAA,IAAA,CAAK,KAAA,CAAM,yBAAyB,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA,CAAE,CAAA;AAAA,QACxF;AAAA,MACF;AAGA,MAAA,IAAI;AACF,QAAA,cAAA,CAAe,KAAK,KAAK,CAAA;AAAA,MAC3B,SAAS,GAAA,EAAK;AACZ,QAAA,IAAA,CAAK,MAAM,GAAA,YAAe,KAAA,GAAQ,IAAI,OAAA,GAAU,MAAA,CAAO,GAAG,CAAC,CAAA;AAAA,MAC7D;AAEA,MAAA,MAAM,YAAA,GAAe,GAAA,KAAQ,QAAA,IAAY,OAAO,KAAA,KAAU,QAAA,GAAW,CAAA,EAAG,KAAA,CAAM,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ,KAAA;AAEjG,MAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,cAAc,CAAA;AAAA,IAC3C;AAEA,IAAA,IAAI,KAAA,CAAM,WAAW,MAAA,EAAQ;AAC3B,MAAA,IAAA,CAAK,YAAA,CAAa,QAAQ,MAAA,KAAW,CAAA,GAAI,QAAQ,CAAC,CAAA,GAAI,SAAS,MAAM,CAAA;AAAA,IACvE,CAAA,MAAO;AACL,MAAA,KAAA,MAAW,EAAE,GAAA,EAAK,KAAA,EAAM,IAAK,OAAA,EAAS;AACpC,QAAA,IAAA,CAAK,GAAA,CAAI,CAAA,IAAA,EAAO,GAAG,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AAAA,MAClC;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,aAAa,OAAA,EAAqD;AACxE,IAAA,MAAM,UAA4C,EAAC;AACnD,IAAA,MAAM,aAAA,GAAgB,CAAA,YAAA,EAAe,UAAA,CAAW,IAAA,CAAK,IAAI,CAAC,CAAA,uGAAA,CAAA;AAE1D,IAAA,IAAI,CAAA,GAAI,CAAA;AACR,IAAA,OAAO,CAAA,GAAI,QAAQ,MAAA,EAAQ;AACzB,MAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AAErB,MAAA,IAAI,GAAA,CAAI,QAAA,CAAS,GAAG,CAAA,EAAG;AAErB,QAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AAC/B,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,OAAO,CAAA;AAChC,QAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA;AAEnC,QAAA,IAAI,CAAC,aAAA,CAAc,GAAG,CAAA,EAAG;AACvB,UAAA,IAAA,CAAK,KAAA,CAAM,uBAAuB,GAAG;AAAA,EAAK,aAAa,CAAA,CAAE,CAAA;AAAA,QAC3D;AACA,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,KAAA,EAAO,CAAA;AAC3B,QAAA,CAAA,EAAA;AAAA,MACF,WAAW,aAAA,CAAc,GAAG,KAAK,CAAA,GAAI,CAAA,GAAI,QAAQ,MAAA,EAAQ;AAEvD,QAAA,OAAA,CAAQ,IAAA,CAAK,EAAE,GAAA,EAAK,GAAA,EAAK,OAAO,OAAA,CAAQ,CAAA,GAAI,CAAC,CAAA,EAAG,CAAA;AAChD,QAAA,CAAA,IAAK,CAAA;AAAA,MACP,CAAA,MAAO;AACL,QAAA,IAAA,CAAK,KAAA,CAAM,wBAAwB,GAAG;AAAA,+CAAA,CAAmD,CAAA;AAAA,MAC3F;AAAA,IACF;AAEA,IAAA,OAAO,OAAA;AAAA,EACT;AACF","file":"set.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n  x402Log: path.join(JAW_DIR, 'x402-log.jsonl'),\n  paymentLock: path.join(JAW_DIR, 'x402-payment.lock'),\n} as const;\n","import type { PermissionsConfig } from './types.js';\n\nconst ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;\nconst SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;\n// The SDK hands `allowance` straight to BigInt(), which takes decimal and hex\n// alike, and the permissions doc shows the decimal form\n// (parseUnits('100', 6).toString()). Accepting only hex here made the CLI\n// stricter than the SDK it wraps, so the documented example failed validation.\nconst ALLOWANCE_RE = /^(0x[0-9a-fA-F]+|[0-9]+)$/;\nconst VALID_SPEND_UNITS = new Set(['minute', 'hour', 'day', 'week', 'month', 'year', 'forever']);\n\nexport function parsePermissionsConfig(raw: unknown): PermissionsConfig {\n  const errors: string[] = [];\n\n  if (typeof raw !== 'object' || raw === null || Array.isArray(raw)) {\n    throw new Error('Invalid permissions:\\n  - Must be an object');\n  }\n\n  const obj = raw as Record<string, unknown>;\n  const calls = obj.calls as unknown[] | undefined;\n  const spends = obj.spends as unknown[] | undefined;\n\n  if (!calls && !spends) {\n    throw new Error('Invalid permissions:\\n  - Must include at least \"calls\" or \"spends\"');\n  }\n\n  if (calls !== undefined) {\n    if (!Array.isArray(calls) || calls.length === 0) {\n      errors.push('calls: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < calls.length; i++) {\n        const c = calls[i] as Record<string, unknown>;\n        if (!c || typeof c !== 'object') {\n          errors.push(`calls.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof c.target !== 'string' || !ADDRESS_RE.test(c.target)) {\n          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (c.selector !== undefined && (typeof c.selector !== 'string' || !SELECTOR_RE.test(c.selector))) {\n          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);\n        }\n      }\n    }\n  }\n\n  if (spends !== undefined) {\n    if (!Array.isArray(spends) || spends.length === 0) {\n      errors.push('spends: Must be a non-empty array');\n    } else {\n      for (let i = 0; i < spends.length; i++) {\n        const s = spends[i] as Record<string, unknown>;\n        if (!s || typeof s !== 'object') {\n          errors.push(`spends.${i}: Must be an object`);\n          continue;\n        }\n        if (typeof s.token !== 'string' || !ADDRESS_RE.test(s.token)) {\n          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);\n        }\n        if (typeof s.allowance !== 'string' || !ALLOWANCE_RE.test(s.allowance)) {\n          errors.push(`spends.${i}.allowance: Must be a decimal or 0x hex integer`);\n        }\n        if (typeof s.unit !== 'string' || !VALID_SPEND_UNITS.has(s.unit)) {\n          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(', ')}`);\n        }\n        if (s.multiplier !== undefined && (!Number.isInteger(s.multiplier) || (s.multiplier as number) < 1)) {\n          errors.push(`spends.${i}.multiplier: Must be a positive integer`);\n        }\n      }\n    }\n  }\n\n  if (errors.length > 0) {\n    throw new Error(`Invalid permissions:\\n${errors.map((e) => `  - ${e}`).join('\\n')}`);\n  }\n\n  return raw as PermissionsConfig;\n}\n\nexport function isValidKeysUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'https:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    return isTrustedHost && isSecure;\n  } catch {\n    return false;\n  }\n}\n\nexport function isValidRelayUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    const isTrustedHost =\n      parsed.hostname.endsWith('.jaw.id') ||\n      parsed.hostname === 'jaw.id' ||\n      parsed.hostname === 'localhost' ||\n      parsed.hostname === '127.0.0.1';\n    const isSecure = parsed.protocol === 'wss:' || parsed.hostname === 'localhost' || parsed.hostname === '127.0.0.1';\n    const isWebSocket = parsed.protocol === 'wss:' || parsed.protocol === 'ws:';\n    return isTrustedHost && isSecure && isWebSocket;\n  } catch {\n    return false;\n  }\n}\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig, SettableConfigKey } from './types.js';\nimport type { X402Policy, X402PolicyKey } from '../x402/policy.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\n/**\n * Set one field of the `x402` payment policy. Array fields (allow-lists) are\n * comma-split. Intentionally NOT reachable from the MCP tool surface: an agent\n * must not be able to raise its own spending caps — only a human at the CLI.\n */\nexport function setX402PolicyValue(key: X402PolicyKey, value: string): void {\n  const config = loadConfig();\n  const x402: X402Policy = { ...(config.x402 ?? {}) };\n  if (key === 'maxAmountPerPayment' || key === 'maxTotalPerSession' || key === 'topUpFloat') {\n    // These are base-unit amounts read via BigInt() on the hot payment path;\n    // reject anything that isn't a non-negative integer here so a bad value\n    // can never turn into a per-payment failure later.\n    if (!/^\\d+$/.test(value.trim())) {\n      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);\n    }\n    x402[key] = value.trim();\n  } else {\n    x402[key] = value\n      .split(',')\n      .map((v) => v.trim())\n      .filter(Boolean);\n  }\n  saveConfig({ ...config, x402 });\n}\n\nexport function setConfigValue(key: SettableConfigKey, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  // Numeric keys: coerce + validate here so EVERY caller is safe. The MCP tool\n  // passes raw strings (its schema types value as a string), so without this a\n  // `sessionExpiry: \"abc\"` would land as a string and turn `expiry * 86400`\n  // into NaN, and a `defaultChain` string would ride into an RPC URL verbatim.\n  let toStore: string | number = value;\n  if (key === 'defaultChain' || key === 'sessionExpiry') {\n    // Strict: reject anything parseInt would silently truncate ('1.5' -> 1,\n    // '0x10' -> 0, '10abc' -> 10). Only a bare positive decimal integer passes.\n    const n = typeof value === 'number' ? value : /^\\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;\n    if (!Number.isInteger(n) || n <= 0) {\n      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);\n    }\n    toStore = n;\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: toStore };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n","// USDC asset registry, mirrored from the backend's\n// `apps/ens/src/external/payment/asset-registry.ts`. Keep this in sync when the\n// server adds a chain. `wireNetwork` is the CAIP-2 id used on the x402 v2 wire.\n\nexport interface UsdcAsset {\n  address: `0x${string}`;\n  chainId: number;\n  wireNetwork: string;\n  /** EIP-712 domain `name` for this deployment's USDC. */\n  usdcName: string;\n  /** EIP-712 domain `version`. */\n  usdcVersion: string;\n  /**\n   * Token decimals. Every USDC deployment here is 6, but carrying it on the\n   * registry entry (rather than a literal `6` at the format site) keeps the\n   * source of truth in one place and is ready for a non-6-decimal asset when\n   * the registry grows past USDC. Reading it off-chain from the contract is\n   * deliberately avoided: the registry is a controlled allowlist, so an extra\n   * RPC round-trip and trusting a token's self-reported decimals buy nothing.\n   */\n  decimals: number;\n}\n\nexport const USDC_BY_NETWORK: Record<string, UsdcAsset> = {\n  'eip155:8453': {\n    address: '0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913',\n    chainId: 8453,\n    wireNetwork: 'eip155:8453',\n    usdcName: 'USD Coin',\n    usdcVersion: '2',\n    decimals: 6,\n  },\n  'eip155:84532': {\n    address: '0x036CbD53842c5426634e7929541eC2318f3dCF7e',\n    chainId: 84532,\n    wireNetwork: 'eip155:84532',\n    usdcName: 'USDC',\n    usdcVersion: '2',\n    decimals: 6,\n  },\n  'eip155:137': {\n    address: '0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359',\n    chainId: 137,\n    wireNetwork: 'eip155:137',\n    usdcName: 'USD Coin',\n    usdcVersion: '2',\n    decimals: 6,\n  },\n  'eip155:80002': {\n    address: '0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582',\n    chainId: 80002,\n    wireNetwork: 'eip155:80002',\n    usdcName: 'USDC',\n    usdcVersion: '2',\n    decimals: 6,\n  },\n};\n\n/**\n * Look up USDC metadata by CAIP-2 network id, or `undefined` if unsupported.\n *\n * Own keys only. The network reaches here from a 402 challenge and from the\n * Bazaar catalogue, both untrusted, and a plain index answers `constructor` or\n * `toString` with something off the prototype: callers then read `.address` off\n * a function and throw where they expected an unsupported network.\n */\nexport function usdcForNetwork(network: string): UsdcAsset | undefined {\n  return Object.hasOwn(USDC_BY_NETWORK, network) ? USDC_BY_NETWORK[network] : undefined;\n}\n","import { USDC_BY_NETWORK, usdcForNetwork } from './asset-registry.js';\nimport { parseBigInt, parseNonNegativeBigInt } from './amount.js';\nimport { describePeriod, normalizePeriod, type PeriodUnit } from './period.js';\nimport { isHexShaped, isPayableAddress, isZeroAddress } from './address.js';\nimport { UPTO_VERIFIED_CHAIN_IDS } from './permit2.js';\nimport { isX402Scheme, type X402PaymentRequirement } from './types.js';\nimport type { GrantedPermission } from '../lib/session-config.js';\n\n/**\n * One spend limit the grant puts on the payment token.\n *\n * A list of these rather than a single allowance and window, because\n * `_checkAndIncrementSpend` charges every limit whose token matches and does\n * not stop at the first. Which one refuses depends on the amount and on the\n * moment, so a single pair cannot answer it, and picking one on the caller's\n * behalf is what reported a month's budget as a day's.\n */\nexport interface GrantedPeriodLimit {\n  /** Base units, decimal string. */\n  allowance: string;\n  unit: PeriodUnit;\n  multiplier: number;\n  /** ISO timestamp the windows are anchored at: the permission's own start. */\n  anchor: string;\n}\n\n/**\n * A limit and what has been drawn against it inside the window containing now.\n *\n * Both meters, because the two caps count different things and always have:\n * the allowance is drawn down by what is pulled through the permission, while\n * a payment is what the payer sends out of the float it already holds.\n */\nexport interface LimitUsage extends GrantedPeriodLimit {\n  /** Payments made from the payer inside this window. */\n  spent: bigint;\n  /** Pulled through the permission inside this window, which is what the allowance loses. */\n  toppedUp: bigint;\n  /** When this limit's current window ends. */\n  endsAt: Date;\n  /**\n   * Where `toppedUp` came from. From the ledger it is a floor, since the ledger\n   * only sees what went through `payAndFetch`; from the chain it is what the\n   * contract will meter against.\n   */\n  source: 'ledger' | 'chain';\n}\n\n/**\n * Tool-level x402 limits (from `~/.jaw/config.json`'s `x402` block). An agent\n * holding a signing key must be fenced in: no single payment above the cap, no\n * cumulative overspend, and only allow-listed assets/networks/recipients. In\n * pull mode these sit alongside the session-EOA's own balance; in push mode the\n * on-chain permission is the hard ceiling and these are the inner guardrails.\n */\nexport interface X402Policy {\n  /** Max base units for a single payment. */\n  maxAmountPerPayment?: string;\n  /**\n   * Max cumulative base units across the whole session. Not a per-process cap:\n   * the running total is rebuilt from the payment ledger since the session was\n   * created, so it survives restarts. User-configured only, never seeded from\n   * the grant (see `perPeriod` for that).\n   */\n  maxTotalPerSession?: string;\n  /**\n   * Max base units within one period of the on-chain grant, seeded from it and\n   * resetting every period exactly as the permission does. This is the field\n   * that mirrors the chain; `maxTotalPerSession` is the user's own ceiling on\n   * top. Set together with `period`.\n   */\n  perPeriod?: GrantedPeriodLimit[];\n  /** Allowed asset contract addresses (case-insensitive). Empty/undefined = any. */\n  allowedAssets?: string[];\n  /** Allowed CAIP-2 networks. Empty/undefined = any. */\n  allowedNetworks?: string[];\n  /** Allowed resource hostnames. Empty/undefined = any. */\n  allowedHosts?: string[];\n  /** Allowed `payTo` addresses (case-insensitive). Empty/undefined = any. */\n  allowedPayTo?: string[];\n  /**\n   * Flow 2b: refill target (base units) for the session payer when a top-up\n   * runs. Unset = top up exactly the shortfall. Bounded on-chain by the\n   * permission either way.\n   */\n  topUpFloat?: string;\n}\n\n/**\n * Conservative caps applied when the user has not configured `x402` limits, so a\n * fresh setup is never unbounded: capped amounts, and only the registry's USDC\n * deployments on their known networks (any other asset a server asks for is\n * refused). USDC has 6 decimals: 1_000_000 = 1 USDC. Override per field via\n * `jaw config set x402.*`.\n */\nexport const DEFAULT_X402_POLICY: X402Policy = {\n  maxAmountPerPayment: '1000000', // 1 USDC per payment\n  maxTotalPerSession: '10000000', // 10 USDC per process\n  allowedAssets: Object.values(USDC_BY_NETWORK).map((asset) => asset.address),\n  allowedNetworks: Object.keys(USDC_BY_NETWORK),\n};\n\n/**\n * The x402 policy a granted permission implies.\n *\n * Derived on read rather than stored beside the permission. The session used to\n * carry both: the struct, and a `grantedSpend` summary of one USDC limit\n * written at grant time. Two shapes for one fact, at different fidelities, and\n * every consumer had to know which one it was reading. Each of the bugs in this\n * area was a version of the two disagreeing, and the reconciliation between\n * them was itself a source of them. A value that cannot be stored out of date\n * cannot go out of date.\n *\n * Every limit is carried, not reduced to one: the contract charges each of\n * them, so which refuses depends on the amount and the moment, and a single\n * pair cannot answer that.\n */\nexport function policyFromPermission(permission: GrantedPermission | undefined, chainId: number): X402Policy {\n  if (!permission) return {};\n  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);\n  if (!usdc) return {};\n\n  const forToken = permission.spends.filter((spend) => spend.token.toLowerCase() === usdc.address.toLowerCase());\n  if (forToken.length === 0) return {};\n\n  // Guarded on the Date, not on the number. `toISOString` throws for a value\n  // outside the Date range, and `parseGrantedPermission` only checks that the\n  // start is a positive integer: 99999999999999 passes that and is finite, and\n  // still raises. The session file is JSON a person can edit, and everything\n  // else in this module degrades on bad input rather than taking the command\n  // down.\n  const start = new Date(permission.start * 1000);\n  if (Number.isNaN(start.getTime())) return {};\n  const anchor = start.toISOString();\n  const perPeriod: GrantedPeriodLimit[] = [];\n  for (const spend of forToken) {\n    let allowance: string;\n    try {\n      const parsed = BigInt(spend.allowance);\n      // A negative allowance would seed a cap that refuses everything or worse.\n      if (parsed < 0n) continue;\n      allowance = parsed.toString();\n    } catch {\n      continue;\n    }\n    // Normalised the way the SDK normalises before encoding, so a `year` grant\n    // lands on the same month-based window the permission actually enforces.\n    const period = normalizePeriod(spend.unit, spend.multiplier);\n    if (!period) continue;\n    perPeriod.push({ allowance, unit: period.unit, multiplier: period.multiplier, anchor });\n  }\n  if (perPeriod.length === 0) return {};\n\n  return {\n    // The registry's canonical address, not the permission's literal string:\n    // they match case-insensitively and this seeds an allowlist compared that\n    // way.\n    allowedAssets: [usdc.address],\n    allowedNetworks: [usdc.wireNetwork],\n    perPeriod,\n  };\n}\n\nexport function resolveX402Policy(configPolicy?: X402Policy, grantPolicy?: X402Policy): X402Policy {\n  const merged: X402Policy = { ...DEFAULT_X402_POLICY, ...(grantPolicy ?? {}), ...(configPolicy ?? {}) };\n  // The default session cap is the guardrail for an unconfigured setup that has\n  // no grant to bound it. Once a grant supplies a per-period cap, that cap is\n  // what the user approved on chain, and leaving the 10-USDC default sitting on\n  // top of it would strand a longer grant well short of its own limit: a\n  // 5-per-day grant over 7 days permits 35, and the default would stop it at 10.\n  // A session cap the user set explicitly still applies on top.\n  if (grantPolicy?.perPeriod !== undefined && configPolicy?.maxTotalPerSession === undefined) {\n    delete merged.maxTotalPerSession;\n  }\n  return merged;\n}\n\n/**\n * Resolve the policy for a live session. Every front end goes through this, so\n * `jaw x402 pay`, `jaw x402 status` and the MCP tool all enforce and report the\n * same caps. Resolving from config alone is what let them drift: the CLI paid\n * under the 10-USDC defaults on every registry network while the MCP tool\n * refused at the granted per-period allowance, and status printed a session cap\n * that the grant had already deleted.\n */\nexport function resolveSessionX402Policy(\n  configPolicy?: X402Policy,\n  session?: { chainId: number; permission?: GrantedPermission } | null\n): X402Policy {\n  return resolveX402Policy(configPolicy, policyFromPermission(session?.permission, session?.chainId ?? 0));\n}\n\n/**\n * The most a single top-up may move into the payer: the smallest cap that\n * actually binds, never a preferred one. Preferring the per-period cap let a\n * 5-USDC/day grant pre-fund 5 USDC into a session the user had explicitly capped\n * at 1, which is the idle-funds-at-risk case `TopUpOptions.maxTopUp` exists to\n * prevent. Undefined when neither cap is set, meaning the on-chain permission is\n * the only bound.\n *\n * What is left of each cap, not the whole cap: a 10/day grant with 9 already\n * used has 1 to give, and pulling 10 through the permission reverts on chain.\n * With `topUpFloat` set near the cap that revert is a refused payment whose\n * price fit comfortably, so what is already used has to be subtracted here.\n *\n * Each cap is measured against what actually consumes it, which is not the same\n * meter for both. A per-period cap mirrors the on-chain allowance, and what draws\n * that down is the top-up itself, so it counts top-ups. `maxTotalPerSession` is\n * the user's own ceiling on what the session may spend, so it counts payments.\n * Reading the period cap off payments made it lag by whatever float the payer\n * still held, and the pull that overshot was refused on chain.\n */\n/**\n * Two limits are the same budget when they meter the same window for the same\n * allowance.\n *\n * The allowance is part of it, not decoration. `normalizePeriod` maps a yearly\n * grant onto months, while the merge keys on the raw unit, so `session add` can\n * leave a `year` and a `month` limit that both normalise to the same window.\n * Keyed on the window alone they both resolved to the first usage entry, and\n * the on-chain figures, which are matched by allowance too, were then read off\n * the wrong limit.\n */\nexport function sameLimit(\n  a: { unit: string; multiplier: number; allowance: string },\n  b: { unit: string; multiplier: number; allowance: string }\n): boolean {\n  return a.unit === b.unit && a.multiplier === b.multiplier && a.allowance === b.allowance;\n}\n\nexport function topUpCeiling(\n  policy: X402Policy,\n  used: { periodUsage?: LimitUsage[]; spentThisSession?: bigint } = {}\n): bigint | undefined {\n  const left = (cap: string | undefined, alreadyUsed = 0n): bigint | undefined => {\n    const parsed = parseNonNegativeBigInt(cap);\n    if (parsed === undefined) return undefined;\n    return parsed > alreadyUsed ? parsed - alreadyUsed : 0n;\n  };\n  const caps = [\n    // Every limit the policy holds, not every entry the caller built. The\n    // contract charges all of them, so a refill sized against any single one\n    // can still be refused by another, and a limit whose usage could not be\n    // computed still bounds the pull at its full width rather than vanishing.\n    // An allowance that cannot be read bounds at zero rather than dropping out.\n    // `checkPolicy` refuses outright on the same input, and letting it vanish\n    // here is the shape this set out to remove: with the session default\n    // deleted by a seeded grant, nothing local would bound the pull.\n    ...(policy.perPeriod ?? []).map(\n      (limit) =>\n        left(limit.allowance, (used.periodUsage ?? []).find((entry) => sameLimit(entry, limit))?.toppedUp) ?? 0n\n    ),\n    left(policy.maxTotalPerSession, used.spentThisSession),\n  ].filter((cap): cap is bigint => cap !== undefined);\n  return caps.length > 0 ? caps.reduce((a, b) => (a < b ? a : b)) : undefined;\n}\n\n/** Policy keys settable from the CLI, split by value shape. */\nexport const X402_SCALAR_KEYS = ['maxAmountPerPayment', 'maxTotalPerSession', 'topUpFloat'] as const;\nexport const X402_ARRAY_KEYS = ['allowedAssets', 'allowedNetworks', 'allowedHosts', 'allowedPayTo'] as const;\nexport type X402PolicyKey = (typeof X402_SCALAR_KEYS)[number] | (typeof X402_ARRAY_KEYS)[number];\n\nexport function isX402PolicyKey(key: string): key is X402PolicyKey {\n  return (X402_SCALAR_KEYS as readonly string[]).includes(key) || (X402_ARRAY_KEYS as readonly string[]).includes(key);\n}\n\nexport interface PolicyContext {\n  /** Hostname of the resource being paid for (for `allowedHosts`). */\n  host?: string;\n  /** Base units already spent this session (for `maxTotalPerSession`). */\n  spentThisSession?: bigint;\n  /**\n   * Every limit on the payment token with what has been drawn against it inside\n   * the window containing now. Each must be counted over its own window, which\n   * resets as that limit does.\n   */\n  periodUsage?: LimitUsage[];\n}\n\nexport interface PolicyResult {\n  ok: boolean;\n  reason?: string;\n}\n\nconst has = (list: string[] | undefined): list is string[] => Array.isArray(list) && list.length > 0;\nconst eqAddr = (a: string, b: string) => a.toLowerCase() === b.toLowerCase();\n\n/**\n * How much of the user's budget a requirement asks for.\n *\n * Under `exact` that is the price. Under `upto` it is a ceiling the server may\n * charge anything below, and the caps still measure it, because a signature is\n * worth its ceiling to whoever holds it and no cap can be enforced against a\n * number nobody knows yet. Saying so in the refusal is the difference between a\n * user understanding why a five dollar ceiling was refused on a service that\n * charges a fraction of a cent, and thinking the cap is broken.\n *\n * Exported because the caps are not the only thing that refuses over this\n * number: `--max-amount` does too, from the selection loop, and a refusal that\n * spelled it differently there would teach the reader the ceiling is a price.\n */\nexport const asks = (requirement: X402PaymentRequirement): string =>\n  requirement.scheme === 'upto' ? `up to ${requirement.amount}` : requirement.amount;\n\n/**\n * Decide whether a chosen payment requirement is allowed to be paid. Returns the\n * first failing reason so the caller can refuse clearly instead of overpaying.\n */\nexport function checkPolicy(\n  requirement: X402PaymentRequirement,\n  policy: X402Policy,\n  ctx: PolicyContext = {}\n): PolicyResult {\n  // The wire value is untrusted: it arrives as a plain string and is only cast\n  // to the union, so this is a runtime check and not a redundant one.\n  if (!isX402Scheme(requirement.scheme)) {\n    return { ok: false, reason: `unsupported scheme: ${String(requirement.scheme)}` };\n  }\n\n  // The settlement proxy is deployed on fewer chains than the asset registry\n  // knows, and a permit naming a spender with no code can never settle. The\n  // check belongs here rather than in the signer: this runs during selection,\n  // so an `upto` option on an unverified chain is skipped instead of shadowing\n  // a payable `exact` option on the same challenge, a dry run reports the\n  // refusal a real run would make, and nothing has been funded yet when it does.\n  if (requirement.scheme === 'upto') {\n    const asset = usdcForNetwork(requirement.network);\n    if (!asset) {\n      return { ok: false, reason: `unsupported x402 network: ${requirement.network}` };\n    }\n    if (!UPTO_VERIFIED_CHAIN_IDS.includes(asset.chainId)) {\n      return {\n        ok: false,\n        reason:\n          `x402 upto is not available on ${requirement.network}: the settlement proxy is only verified on ` +\n          `chain ids ${UPTO_VERIFIED_CHAIN_IDS.join(', ')}`,\n      };\n    }\n    // The witness names the only address the proxy accepts as the settling\n    // caller, so a challenge without one can never be paid. The signer refuses\n    // it too, but by then the payer has been topped up for a payment that was\n    // never going to happen; refused here, the option is skipped during\n    // selection like the unverified chain above, and an `exact` option on the\n    // same challenge still pays.\n    const facilitator = requirement.extra?.['facilitatorAddress'];\n    if (!isHexShaped(facilitator) || isZeroAddress(facilitator)) {\n      return {\n        ok: false,\n        reason:\n          `x402 upto needs a settling facilitator in extra.facilitatorAddress on ${requirement.network}, ` +\n          `got ${JSON.stringify(facilitator)}`,\n      };\n    }\n    // Present and the right shape, but unreadable: a different problem from an\n    // absent one, and it sends whoever reads this somewhere else.\n    if (!isPayableAddress(facilitator)) {\n      return {\n        ok: false,\n        reason: `extra.facilitatorAddress is not a readable address on ${requirement.network}: ${facilitator}`,\n      };\n    }\n  }\n\n  // Ahead of every allowlist, because these hold whether or not one is\n  // configured and because a challenge nobody can act on should say so rather\n  // than report whichever allowlist it also happened to miss. Here rather than\n  // in a signer so nothing has been funded when they refuse: a settlement that\n  // cannot succeed still reserves its whole figure against the caps, on the\n  // rule that a failed attempt may have been broadcast. See address.ts.\n  for (const [field, value] of [\n    ['asset', requirement.asset],\n    ['payTo', requirement.payTo],\n  ] as const) {\n    if (!isPayableAddress(value)) {\n      return { ok: false, reason: `${field} is not a readable address on ${requirement.network}: ${value}` };\n    }\n  }\n  if (isZeroAddress(requirement.payTo)) {\n    return { ok: false, reason: `payTo is the zero address on ${requirement.network}` };\n  }\n\n  if (has(policy.allowedNetworks) && !policy.allowedNetworks.includes(requirement.network)) {\n    return { ok: false, reason: `network not allowed: ${requirement.network}` };\n  }\n\n  if (has(policy.allowedAssets) && !policy.allowedAssets.some((a) => eqAddr(a, requirement.asset))) {\n    return { ok: false, reason: `asset not allowed: ${requirement.asset}` };\n  }\n\n  if (has(policy.allowedPayTo) && !policy.allowedPayTo.some((a) => eqAddr(a, requirement.payTo))) {\n    return { ok: false, reason: `payTo not allowed: ${requirement.payTo}` };\n  }\n\n  if (has(policy.allowedHosts) && (!ctx.host || !policy.allowedHosts.includes(ctx.host))) {\n    return { ok: false, reason: `host not allowed: ${ctx.host ?? '(unknown)'}` };\n  }\n\n  const amount = parseBigInt(requirement.amount);\n  if (amount === null) {\n    return { ok: false, reason: `invalid amount: ${requirement.amount}` };\n  }\n  if (amount < 0n) {\n    return { ok: false, reason: `negative amount: ${requirement.amount}` };\n  }\n\n  if (policy.maxAmountPerPayment !== undefined) {\n    const cap = parseBigInt(policy.maxAmountPerPayment);\n    if (cap === null) {\n      return { ok: false, reason: `invalid maxAmountPerPayment in config: ${policy.maxAmountPerPayment}` };\n    }\n    if (amount > cap) {\n      return {\n        ok: false,\n        reason: `amount ${asks(requirement)} exceeds maxAmountPerPayment ${policy.maxAmountPerPayment}`,\n      };\n    }\n  }\n\n  // Checked before the session cap: this is the one that mirrors the on-chain\n  // permission, so when both would refuse, the reason the chain would give is\n  // the more useful one to report.\n  // Driven by the limits the policy holds, with usage looked up per limit and\n  // absent usage read as zero. Iterating the caller's list instead made a cap\n  // exist only when someone managed to build an entry for it: a limit dropped\n  // while computing usage, which happens on an unparseable anchor, silently\n  // stopped being enforced, and since a seeded grant deletes the session\n  // default there was then nothing bounding a pull at all.\n  const exceeded: Array<{ limit: GrantedPeriodLimit; usage?: LimitUsage }> = [];\n  for (const limit of policy.perPeriod ?? []) {\n    const cap = parseBigInt(limit.allowance);\n    if (cap === null) {\n      return { ok: false, reason: `invalid allowance from grant: ${limit.allowance}` };\n    }\n    const usage = (ctx.periodUsage ?? []).find((entry) => sameLimit(entry, limit));\n    const spent = usage?.spent ?? 0n;\n    if (spent + amount > cap) exceeded.push({ limit, usage });\n  }\n  if (exceeded.length > 0) {\n    // The one that frees up last, not the smallest. A refusal is read to decide\n    // what to do next, and naming the day limit when the month will refuse\n    // again tomorrow sends someone back for nothing. Without a window from the\n    // caller the order is undefined, so the first is as good as any.\n    const latest = exceeded.reduce((a, b) =>\n      (a.usage?.endsAt?.getTime() ?? 0) >= (b.usage?.endsAt?.getTime() ?? 0) ? a : b\n    );\n    const others = exceeded.length - 1;\n    const window = describePeriod(latest.limit.unit, latest.limit.multiplier);\n    const resets = latest.usage ? `, which resets ${latest.usage.endsAt.toISOString()}` : '';\n    return {\n      ok: false,\n      reason:\n        `payment ${asks(requirement)} would exceed the granted ${latest.limit.allowance} per ${window}${resets}` +\n        (others > 0 ? ` (${others} other limit${others === 1 ? '' : 's'} also applies)` : ''),\n    };\n  }\n\n  if (policy.maxTotalPerSession !== undefined) {\n    const cap = parseBigInt(policy.maxTotalPerSession);\n    if (cap === null) {\n      return { ok: false, reason: `invalid maxTotalPerSession in config: ${policy.maxTotalPerSession}` };\n    }\n    const spent = ctx.spentThisSession ?? 0n;\n    if (spent + amount > cap) {\n      return {\n        ok: false,\n        reason:\n          `payment ${asks(requirement)} would exceed maxTotalPerSession ${policy.maxTotalPerSession} ` +\n          `(already spent ${spent} since the session was created; raise it with ` +\n          `\\`jaw config set x402.maxTotalPerSession <base units>\\`)`,\n      };\n    }\n  }\n\n  return { ok: true };\n}\n","import { parseUnits } from 'viem';\nimport { USDC_BY_NETWORK } from './asset-registry.js';\nimport type { PermissionsConfig } from '../lib/types.js';\n\n/**\n * Build the permission an x402 payer actually needs, so nobody has to hand-write\n * it.\n *\n * Paying an x402 challenge, and refilling the payer through the permission when\n * it falls short, only ever needs one thing: a USDC `transfer` on the session's\n * chain, capped per period. Spelling that out by hand means knowing the USDC\n * address for your chain and the exact `transfer(address,uint256)` signature,\n * which is a lot to ask before a first payment. The registry already knows the\n * address and the decimals, so derive it.\n */\n\nconst TRANSFER_SIGNATURE = 'transfer(address,uint256)';\n\n/** SpendLimit.allowance is uint160 in JustaPermissionManager. */\nconst MAX_ALLOWANCE = 2n ** 160n - 1n;\n\n/** Spend periods accepted on a limit, matching the units the grant validator takes. */\nexport const LIMIT_PERIODS = ['minute', 'hour', 'day', 'week', 'month', 'year', 'forever'] as const;\nexport type LimitPeriod = (typeof LIMIT_PERIODS)[number];\n\n/** Applied when `--x402` is given with no explicit limit. Matches the default x402 session cap. */\nexport const DEFAULT_X402_LIMIT = '10/day';\n\nexport interface ParsedLimit {\n  /** Human amount as written, e.g. \"10\" or \"2.5\". */\n  amount: string;\n  period: LimitPeriod;\n}\n\n/**\n * Parse a `<amount>[/<period>]` limit, e.g. `10/day`, `2.5/week`, or a bare `10`\n * which means per day. The amount stays a decimal string here; scaling to base\n * units needs the token's decimals and happens in `buildX402Permissions`.\n */\nexport function parseLimit(input: string): ParsedLimit {\n  const trimmed = input.trim();\n  if (!trimmed) throw new Error('Limit is empty. Use --limit <amount>/<period>, for example 10/day.');\n\n  const [rawAmount, rawPeriod = 'day', ...rest] = trimmed.split('/');\n  if (rest.length > 0) {\n    throw new Error(`Invalid limit \"${input}\". Expected <amount>/<period>, for example 10/day.`);\n  }\n\n  const amount = rawAmount.trim();\n  // Reject exponent and sign forms up front: parseUnits would either throw a\n  // less helpful error or silently accept something the user did not mean.\n  if (!/^\\d+(\\.\\d+)?$/.test(amount)) {\n    throw new Error(`Invalid limit amount \"${rawAmount}\". Expected a positive number, for example 10 or 2.5.`);\n  }\n\n  const period = rawPeriod.trim().toLowerCase() as LimitPeriod;\n  if (!(LIMIT_PERIODS as readonly string[]).includes(period)) {\n    throw new Error(`Invalid limit period \"${rawPeriod}\". Expected one of: ${LIMIT_PERIODS.join(', ')}.`);\n  }\n\n  return { amount, period };\n}\n\n/**\n * The USDC-transfer permission for `chainId`, capped at `limit` per period.\n * Throws when the chain has no USDC in the registry, since there is nothing\n * meaningful to grant for x402 there.\n */\nexport function buildX402Permissions(chainId: number, limit: string = DEFAULT_X402_LIMIT): PermissionsConfig {\n  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);\n  if (!usdc) {\n    const supported = Object.values(USDC_BY_NETWORK)\n      .map((a) => a.chainId)\n      .sort((a, b) => a - b)\n      .join(', ');\n    throw new Error(`No USDC configured for chain ${chainId}. x402 payments are supported on: ${supported}.`);\n  }\n\n  const { amount, period } = parseLimit(limit);\n  let allowance: bigint;\n  try {\n    allowance = parseUnits(amount, usdc.decimals);\n  } catch {\n    throw new Error(`Invalid limit amount \"${amount}\" for a token with ${usdc.decimals} decimals.`);\n  }\n  if (allowance <= 0n) {\n    throw new Error(`Limit \"${limit}\" resolves to zero, which would refuse every payment.`);\n  }\n  // SpendLimit.allowance is a uint160 on chain. Past that the grant fails deep\n  // in ABI encoding with an opaque range error, so refuse here where the number\n  // the user typed is still in hand.\n  if (allowance > MAX_ALLOWANCE) {\n    throw new Error(`Limit \"${limit}\" is larger than a spend allowance can hold (max ${MAX_ALLOWANCE}).`);\n  }\n\n  return {\n    calls: [{ target: usdc.address, functionSignature: TRANSFER_SIGNATURE }],\n    spends: [{ token: usdc.address, allowance: allowance.toString(), unit: period, multiplier: 1 }],\n  };\n}\n\n/** One-line summary of what an --x402 grant permits, for the setup output. */\nexport function describeX402Grant(limit: string = DEFAULT_X402_LIMIT): string {\n  const { amount, period } = parseLimit(limit);\n  const per = period === 'forever' ? 'in total' : `per ${period}`;\n  return `${amount} USDC ${per}, transfers only`;\n}\n","import { BaseCommand } from '../../base-command.js';\nimport { setConfigValue, setX402PolicyValue } from '../../lib/config.js';\nimport { isX402PolicyKey } from '../../x402/policy.js';\nimport { parseLimit } from '../../x402/grant-preset.js';\n\nconst VALID_KEYS = [\n  'apiKey',\n  'defaultChain',\n  'keysUrl',\n  'ens',\n  'relayUrl',\n  'sessionExpiry',\n  // Settable here and nowhere else. Like the x402 policy fields below, the MCP\n  // tool cannot reach it, so an agent cannot raise the ceiling on what it is\n  // allowed to ask a human to approve.\n  'grantCeiling',\n] as const;\n\ntype ValidKey = (typeof VALID_KEYS)[number];\n\nfunction isValidKey(key: string): key is ValidKey {\n  return VALID_KEYS.includes(key as ValidKey);\n}\n\n// x402 policy fields are addressed as `x402.<field>` (e.g. x402.maxAmountPerPayment).\n// Array fields take a comma-separated value. This lives on the CLI only — the MCP\n// tool cannot set the policy, so an agent cannot widen its own spending caps.\nfunction isSettableKey(key: string): boolean {\n  return isValidKey(key) || (key.startsWith('x402.') && isX402PolicyKey(key.slice('x402.'.length)));\n}\n\nexport default class ConfigSet extends BaseCommand {\n  static override description = 'Set one or more configuration values. Accepts key=value pairs or a single key value.';\n\n  static override examples = [\n    '<%= config.bin %> config set apiKey=your-api-key defaultChain=8453',\n    '<%= config.bin %> config set ens=yourdomain.eth sessionExpiry=14',\n    '<%= config.bin %> config set apiKey your-api-key',\n    '<%= config.bin %> config set x402.maxAmountPerPayment=50000 x402.maxTotalPerSession=1000000',\n    '<%= config.bin %> config set x402.allowedNetworks=eip155:8453,eip155:84532',\n  ];\n\n  static override strict = false;\n\n  static override args = {};\n\n  static override flags = {\n    ...BaseCommand.baseFlags,\n  };\n\n  async run(): Promise<void> {\n    const { argv, flags } = await this.parse(ConfigSet);\n    const rawArgs = argv as string[];\n\n    // Parse key=value pairs from all args\n    const entries = this.parseEntries(rawArgs);\n\n    if (entries.length === 0) {\n      this.error(\n        `No valid key=value pairs provided.\\nValid keys: ${VALID_KEYS.join(', ')}\\nUsage: jaw config set key=value [key=value ...]`\n      );\n    }\n\n    const results: { key: string; value: string | number }[] = [];\n\n    for (const { key, value } of entries) {\n      if (key.startsWith('x402.')) {\n        const sub = key.slice('x402.'.length);\n        if (!isX402PolicyKey(sub)) {\n          this.error(`Invalid x402 config key: ${sub}`);\n        }\n        // Same guard as the branch below: the setter rejects a non-integer\n        // amount by throwing, and unhandled that reaches the user as a stack\n        // trace instead of the one-line error oclif prints.\n        try {\n          setX402PolicyValue(sub, value);\n        } catch (err) {\n          this.error(err instanceof Error ? err.message : String(err));\n        }\n        results.push({ key, value });\n        continue;\n      }\n\n      if (!isValidKey(key)) {\n        this.error(`Invalid config key: ${key}`);\n      }\n      // Parsed while the user is still looking at what they typed. A ceiling\n      // that cannot be read refuses every grant, which is safe but reports the\n      // mistake a long way from where it was made. An empty value clears it.\n      if (key === 'grantCeiling' && value.trim() !== '') {\n        try {\n          parseLimit(value);\n        } catch (err) {\n          this.error(`Invalid grantCeiling: ${err instanceof Error ? err.message : String(err)}`);\n        }\n      }\n      // setConfigValue coerces + validates numeric keys (defaultChain,\n      // sessionExpiry) in one place, shared with the MCP tool path.\n      try {\n        setConfigValue(key, value);\n      } catch (err) {\n        this.error(err instanceof Error ? err.message : String(err));\n      }\n\n      const displayValue = key === 'apiKey' && typeof value === 'string' ? `${value.slice(0, 8)}...` : value;\n\n      results.push({ key, value: displayValue });\n    }\n\n    if (flags.output === 'json') {\n      this.outputResult(results.length === 1 ? results[0] : results, 'json');\n    } else {\n      for (const { key, value } of results) {\n        this.log(`Set ${key} = ${value}`);\n      }\n    }\n  }\n\n  private parseEntries(rawArgs: string[]): { key: string; value: string }[] {\n    const entries: { key: string; value: string }[] = [];\n    const validKeysHint = `Valid keys: ${VALID_KEYS.join(', ')}, x402.<maxAmountPerPayment|maxTotalPerSession|allowedAssets|allowedNetworks|allowedHosts|allowedPayTo>`;\n\n    let i = 0;\n    while (i < rawArgs.length) {\n      const arg = rawArgs[i];\n\n      if (arg.includes('=')) {\n        // key=value syntax\n        const eqIndex = arg.indexOf('=');\n        const key = arg.slice(0, eqIndex);\n        const value = arg.slice(eqIndex + 1);\n\n        if (!isSettableKey(key)) {\n          this.error(`Invalid config key: ${key}\\n${validKeysHint}`);\n        }\n        entries.push({ key, value });\n        i++;\n      } else if (isSettableKey(arg) && i + 1 < rawArgs.length) {\n        // key value syntax (legacy)\n        entries.push({ key: arg, value: rawArgs[i + 1] });\n        i += 2;\n      } else {\n        this.error(`Unexpected argument: ${arg}\\nUsage: jaw config set key=value [key=value ...]`);\n      }\n    }\n\n    return entries;\n  }\n}\n"]}

package/dist/commands/config/show.js

@@ -11,7 +11,9 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/config.ts

package/dist/commands/config/show.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/output.ts","../../../src/base-command.ts","../../../src/commands/config/show.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB;AACzD,CAAA;;;ACPO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAGA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,KAAA,MAAW,OAAO,CAAC,GAAG,OAAO,YAAA,CAAa,IAAA,EAAM,CAAA,EAAG;AACjD,MAAA,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,OAAO,QAAA,EAAS;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ,MAAA;AAAA,IAC5D,GAAI,OAAO,UAAA,IAAc;AAAA,MACvB,YAAY,MAAA,CAAO,WAAA;AAAA,QACjB,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,UAAU,CAAA,CAAE,IAAI,CAAC,CAAC,OAAA,EAAS,EAAE,CAAA,KAAM;AAAA,UACvD,OAAA;AAAA;AAAA;AAAA,UAGA,EAAE,GAAG,EAAA,EAAI,GAAA,EAAK,gBAAA,CAAiB,EAAA,CAAG,GAAG,CAAA,EAAG,OAAA,EAAS,EAAA,CAAG,OAAA,GAAU,KAAA,GAAQ,MAAA;AAAU,SACjF;AAAA;AACH;AACF,GACF;AACF;;;ACrEO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF,CAAA;;;ACpDA,IAAqB,UAAA,GAArB,MAAqB,WAAA,SAAmB,WAAA,CAAY;AAAA,EAClD,OAAgB,WAAA,GAAc,gCAAA;AAAA,EAE9B,OAAgB,QAAA,GAAW,CAAC,+BAAA,EAAiC,6CAA6C,CAAA;AAAA,EAE1G,OAAgB,KAAA,GAAQ;AAAA,IACtB,GAAG,WAAA,CAAY;AAAA,GACjB;AAAA,EAEA,MAAM,GAAA,GAAqB;AACzB,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,MAAM,WAAU,CAAA;AAC7C,IAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,IAAA,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,MAAM,CAAA,EAAG,MAAM,MAA0B,CAAA;AAAA,EAC1E;AACF","file":"show.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig } from './types.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\nexport function setConfigValue(key: keyof JawConfig, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: value };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n","import { BaseCommand } from '../../base-command.js';\nimport { loadConfig, redactConfig } from '../../lib/config.js';\n\nexport default class ConfigShow extends BaseCommand {\n  static override description = 'Show current CLI configuration';\n\n  static override examples = ['<%= config.bin %> config show', '<%= config.bin %> config show --output json'];\n\n  static override flags = {\n    ...BaseCommand.baseFlags,\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ConfigShow);\n    const config = loadConfig();\n    this.outputResult(redactConfig(config), flags.output as 'json' | 'human');\n  }\n}\n"]}
+{"version":3,"sources":["../../../src/lib/paths.ts","../../../src/lib/config.ts","../../../src/lib/output.ts","../../../src/base-command.ts","../../../src/commands/config/show.ts"],"names":[],"mappings":";;;;;;AAGA,IAAM,OAAA,GAAe,IAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,EAAQ,EAAG,MAAM,CAAA;AAEvC,IAAM,KAAA,GAAQ;AAAA,EACnB,IAAA,EAAM,OAAA;AAAA,EACN,MAAA,EAAa,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,aAAa,CAAA;AAAA,EACxC,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,cAAc,CAAA;AAAA,EAC1C,KAAA,EAAY,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,YAAY,CAAA;AAAA,EACtC,QAAA,EAAe,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,eAAe,CAAA;AAAA,EAC5C,aAAA,EAAoB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,qBAAqB,CAAA;AAAA,EACvD,OAAA,EAAc,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,gBAAgB,CAAA;AAAA,EAC5C,WAAA,EAAkB,IAAA,CAAA,IAAA,CAAK,OAAA,EAAS,mBAAmB;AACrD,CAAA;;;ACRO,SAAS,UAAU,GAAA,EAAmB;AAC3C,EAAG,aAAU,GAAA,EAAK,EAAE,WAAW,IAAA,EAAM,IAAA,EAAM,KAAO,CAAA;AAClD,EAAG,EAAA,CAAA,SAAA,CAAU,KAAK,GAAK,CAAA;AACzB;AAEA,SAAS,cAAc,MAAA,EAA8B;AACnD,EAAA,IAAI,MAAA,CAAO,YAAA,IAAgB,CAAC,MAAA,CAAO,UAAA,EAAY;AAC7C,IAAA,MAAM,OAAA,GAAU,OAAO,YAAA,IAAgB,CAAA;AACvC,IAAA,MAAA,CAAO,UAAA,GAAa,EAAE,CAAC,OAAO,GAAG,EAAE,GAAA,EAAK,MAAA,CAAO,YAAA,EAAa,EAAE;AAC9D,IAAA,OAAO,MAAA,CAAO,YAAA;AACd,IAAA,UAAA,CAAW,MAAM,CAAA;AAAA,EACnB;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,UAAA,GAAwB;AACtC,EAAA,IAAI,CAAI,EAAA,CAAA,UAAA,CAAW,KAAA,CAAM,MAAM,CAAA,EAAG;AAChC,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,GAAA,GAAS,EAAA,CAAA,YAAA,CAAa,KAAA,CAAM,MAAA,EAAQ,OAAO,CAAA;AACjD,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAC7B,IAAA,OAAO,cAAc,MAAM,CAAA;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,eAAA,EAAkB,MAAM,MAAM,CAAA,oEAAA;AAAA,KAChC;AAAA,EACF;AACF;AAEO,SAAS,WAAW,MAAA,EAAyB;AAClD,EAAA,SAAA,CAAU,MAAM,IAAI,CAAA;AACpB,EAAG,EAAA,CAAA,aAAA,CAAc,MAAM,MAAA,EAAQ,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IACrE,QAAA,EAAU,OAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAGA,SAAS,iBAAiB,GAAA,EAAqB;AAC7C,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,IAAA,KAAA,MAAW,OAAO,CAAC,GAAG,OAAO,YAAA,CAAa,IAAA,EAAM,CAAA,EAAG;AACjD,MAAA,MAAA,CAAO,YAAA,CAAa,GAAA,CAAI,GAAA,EAAK,KAAK,CAAA;AAAA,IACpC;AACA,IAAA,OAAO,OAAO,QAAA,EAAS;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEO,SAAS,aAAa,MAAA,EAA4C;AACvE,EAAA,OAAO;AAAA,IACL,GAAG,MAAA;AAAA,IACH,MAAA,EAAQ,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,OAAO,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,GAAA,CAAA,GAAQ,MAAA;AAAA,IAC5D,GAAI,OAAO,UAAA,IAAc;AAAA,MACvB,YAAY,MAAA,CAAO,WAAA;AAAA,QACjB,MAAA,CAAO,OAAA,CAAQ,MAAA,CAAO,UAAU,CAAA,CAAE,IAAI,CAAC,CAAC,OAAA,EAAS,EAAE,CAAA,KAAM;AAAA,UACvD,OAAA;AAAA;AAAA;AAAA,UAGA,EAAE,GAAG,EAAA,EAAI,GAAA,EAAK,gBAAA,CAAiB,EAAA,CAAG,GAAG,CAAA,EAAG,OAAA,EAAS,EAAA,CAAG,OAAA,GAAU,KAAA,GAAQ,MAAA;AAAU,SACjF;AAAA;AACH;AACF,GACF;AACF;;;ACtEO,SAAS,YAAA,CAAa,MAAe,MAAA,EAA8B;AACxE,EAAA,IAAI,WAAW,MAAA,EAAQ;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,aAAA,EAAe,CAAC,CAAA;AAAA,EAC9C;AACA,EAAA,OAAO,YAAY,IAAI,CAAA;AACzB;AAEA,SAAS,aAAA,CAAc,MAAc,KAAA,EAAyB;AAC5D,EAAA,IAAI,OAAO,UAAU,QAAA,EAAU;AAC7B,IAAA,OAAO,MAAM,QAAA,EAAS;AAAA,EACxB;AACA,EAAA,OAAO,KAAA;AACT;AAEA,SAAS,WAAA,CAAY,IAAA,EAAe,MAAA,GAAS,CAAA,EAAW;AACtD,EAAA,IAAI,IAAA,KAAS,IAAA,IAAQ,IAAA,KAAS,MAAA,EAAW;AACvC,IAAA,OAAO,MAAA;AAAA,EACT;AAEA,EAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,QAAA,IAAY,OAAO,IAAA,KAAS,SAAA,IAAa,OAAO,IAAA,KAAS,QAAA,EAAU;AACjH,IAAA,OAAO,OAAO,IAAI,CAAA;AAAA,EACpB;AAEA,EAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,IAAI,CAAA,EAAG;AACvB,IAAA,IAAI,IAAA,CAAK,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AAC9B,IAAA,OAAO,KAAK,GAAA,CAAI,CAAC,IAAA,EAAM,CAAA,KAAM,GAAG,CAAA,GAAI,CAAC,CAAA,EAAA,EAAK,WAAA,CAAY,MAAM,MAAA,GAAS,CAAC,CAAC,CAAA,CAAE,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACtF;AAEA,EAAA,IAAI,OAAO,SAAS,QAAA,EAAU;AAC5B,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,IAA+B,CAAA;AAC9D,IAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,CAAA,EAAG,OAAO,SAAA;AACjC,IAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AAC7B,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,GAAA,CAAI,GAAG,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAC,CAAA,KAAM,CAAA,CAAE,MAAM,CAAC,CAAA;AAC5D,IAAA,OAAO,QACJ,GAAA,CAAI,CAAC,CAAC,GAAA,EAAK,GAAG,CAAA,KAAM;AACnB,MAAA,MAAM,SAAA,GAAY,GAAA,CAAI,MAAA,CAAO,SAAS,CAAA;AACtC,MAAA,MAAM,MAAA,GAAS,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,KAAQ,IAAA,GAAO,IAAA,GAAO,WAAA,CAAY,GAAA,EAAK,MAAA,GAAS,CAAC,CAAA,GAAI,OAAO,GAAG,CAAA;AACzG,MAAA,OAAO,CAAA,EAAG,GAAG,CAAA,EAAG,SAAS,KAAK,MAAM,CAAA,CAAA;AAAA,IACtC,CAAC,CAAA,CACA,IAAA,CAAK,IAAI,CAAA;AAAA,EACd;AAEA,EAAA,OAAO,OAAO,IAAI,CAAA;AACpB;;;ACxCO,IAAe,WAAA,GAAf,cAAmC,OAAA,CAAQ;AAAA,EAChD,OAAgB,SAAA,GAAY;AAAA,IAC1B,MAAA,EAAQ,MAAM,MAAA,CAAO;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,eAAA;AAAA,MACb,OAAA,EAAS,CAAC,MAAA,EAAQ,OAAO,CAAA;AAAA,MACzB,OAAA,EAAS,OAAA;AAAA,MACT,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,UAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,SAAA,EAAW,MAAM,MAAA,CAAO;AAAA,MACtB,WAAA,EAAa,aAAA;AAAA,MACb,GAAA,EAAK;AAAA,KACN,CAAA;AAAA,IACD,GAAA,EAAK,MAAM,OAAA,CAAQ;AAAA,MACjB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,oCAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,IACD,KAAA,EAAO,MAAM,OAAA,CAAQ;AAAA,MACnB,IAAA,EAAM,GAAA;AAAA,MACN,WAAA,EAAa,+BAAA;AAAA,MACb,OAAA,EAAS;AAAA,KACV;AAAA,GACH;AAAA,EAEU,cAAc,KAAA,EAAuC;AAC7D,IAAA,MAAM,MAAA,GAAS,KAAA,CAAM,SAAS,CAAA,IAAK,YAAW,CAAE,MAAA;AAChD,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,IAAA,CAAK,MAAM,wFAAwF,CAAA;AAAA,IACrG;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEU,eAAe,KAAA,EAAmC;AAC1D,IAAA,MAAM,OAAA,GAAU,KAAA,CAAM,KAAA,IAAS,UAAA,EAAW,CAAE,YAAA;AAC5C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,IAAA,CAAK,MAAM,6FAA6F,CAAA;AAAA,IAC1G;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AAAA,EAEU,YAAA,CAAa,MAAe,MAAA,EAA4B;AAChE,IAAA,MAAM,MAAA,GAAS,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AACxC,IAAA,IAAA,CAAK,IAAI,MAAM,CAAA;AAAA,EACjB;AACF,CAAA;;;ACpDA,IAAqB,UAAA,GAArB,MAAqB,WAAA,SAAmB,WAAA,CAAY;AAAA,EAClD,OAAgB,WAAA,GAAc,gCAAA;AAAA,EAE9B,OAAgB,QAAA,GAAW,CAAC,+BAAA,EAAiC,6CAA6C,CAAA;AAAA,EAE1G,OAAgB,KAAA,GAAQ;AAAA,IACtB,GAAG,WAAA,CAAY;AAAA,GACjB;AAAA,EAEA,MAAM,GAAA,GAAqB;AACzB,IAAA,MAAM,EAAE,KAAA,EAAM,GAAI,MAAM,IAAA,CAAK,MAAM,WAAU,CAAA;AAC7C,IAAA,MAAM,SAAS,UAAA,EAAW;AAC1B,IAAA,IAAA,CAAK,YAAA,CAAa,YAAA,CAAa,MAAM,CAAA,EAAG,MAAM,MAA0B,CAAA;AAAA,EAC1E;AACF","file":"show.js","sourcesContent":["import * as path from 'node:path';\nimport * as os from 'node:os';\n\nconst JAW_DIR = path.join(os.homedir(), '.jaw');\n\nexport const PATHS = {\n  root: JAW_DIR,\n  config: path.join(JAW_DIR, 'config.json'),\n  session: path.join(JAW_DIR, 'session.json'),\n  relay: path.join(JAW_DIR, 'relay.json'),\n  keystore: path.join(JAW_DIR, 'keystore.json'),\n  sessionConfig: path.join(JAW_DIR, 'session-config.json'),\n  x402Log: path.join(JAW_DIR, 'x402-log.jsonl'),\n  paymentLock: path.join(JAW_DIR, 'x402-payment.lock'),\n} as const;\n","import * as fs from 'node:fs';\nimport { PATHS } from './paths.js';\nimport type { JawConfig, SettableConfigKey } from './types.js';\nimport type { X402Policy, X402PolicyKey } from '../x402/policy.js';\nimport { isValidKeysUrl, isValidRelayUrl } from './validation.js';\n\nexport function ensureDir(dir: string): void {\n  fs.mkdirSync(dir, { recursive: true, mode: 0o700 });\n  fs.chmodSync(dir, 0o700);\n}\n\nfunction migrateConfig(config: JawConfig): JawConfig {\n  if (config.paymasterUrl && !config.paymasters) {\n    const chainId = config.defaultChain ?? 1;\n    config.paymasters = { [chainId]: { url: config.paymasterUrl } };\n    delete config.paymasterUrl;\n    saveConfig(config);\n  }\n  return config;\n}\n\nexport function loadConfig(): JawConfig {\n  if (!fs.existsSync(PATHS.config)) {\n    return {};\n  }\n  const raw = fs.readFileSync(PATHS.config, 'utf-8');\n  try {\n    const config = JSON.parse(raw) as JawConfig;\n    return migrateConfig(config);\n  } catch {\n    throw new Error(\n      `Config file at ${PATHS.config} is not valid JSON. Run \\`jaw config set apiKey=<key>\\` to reset it.`\n    );\n  }\n}\n\nexport function saveConfig(config: JawConfig): void {\n  ensureDir(PATHS.root);\n  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + '\\n', {\n    encoding: 'utf-8',\n    mode: 0o600,\n  });\n}\n\n/** Paymaster URLs embed provider API keys as query params (e.g. Pimlico's ?apikey=...). */\nfunction redactUrlSecrets(url: string): string {\n  try {\n    const parsed = new URL(url);\n    for (const key of [...parsed.searchParams.keys()]) {\n      parsed.searchParams.set(key, '***');\n    }\n    return parsed.toString();\n  } catch {\n    return '***';\n  }\n}\n\nexport function redactConfig(config: JawConfig): Record<string, unknown> {\n  return {\n    ...config,\n    apiKey: config.apiKey ? `${config.apiKey.slice(0, 8)}...` : undefined,\n    ...(config.paymasters && {\n      paymasters: Object.fromEntries(\n        Object.entries(config.paymasters).map(([chainId, pm]) => [\n          chainId,\n          // context is a free-form object (usually just a sponsorshipPolicyId) but a\n          // provider could stash a token there, so mask it rather than hand it to the agent.\n          { ...pm, url: redactUrlSecrets(pm.url), context: pm.context ? '***' : undefined },\n        ])\n      ),\n    }),\n  };\n}\n\n/**\n * Set one field of the `x402` payment policy. Array fields (allow-lists) are\n * comma-split. Intentionally NOT reachable from the MCP tool surface: an agent\n * must not be able to raise its own spending caps — only a human at the CLI.\n */\nexport function setX402PolicyValue(key: X402PolicyKey, value: string): void {\n  const config = loadConfig();\n  const x402: X402Policy = { ...(config.x402 ?? {}) };\n  if (key === 'maxAmountPerPayment' || key === 'maxTotalPerSession' || key === 'topUpFloat') {\n    // These are base-unit amounts read via BigInt() on the hot payment path;\n    // reject anything that isn't a non-negative integer here so a bad value\n    // can never turn into a per-payment failure later.\n    if (!/^\\d+$/.test(value.trim())) {\n      throw new Error(`${key} must be a non-negative integer (base units), got: ${value}`);\n    }\n    x402[key] = value.trim();\n  } else {\n    x402[key] = value\n      .split(',')\n      .map((v) => v.trim())\n      .filter(Boolean);\n  }\n  saveConfig({ ...config, x402 });\n}\n\nexport function setConfigValue(key: SettableConfigKey, value: string | number): void {\n  if (key === 'keysUrl' && typeof value === 'string' && !isValidKeysUrl(value)) {\n    throw new Error(`Untrusted keysUrl: ${value}. Must be a *.jaw.id domain (HTTPS) or localhost.`);\n  }\n  if (key === 'relayUrl' && typeof value === 'string' && !isValidRelayUrl(value)) {\n    throw new Error(`Untrusted relayUrl: ${value}. Must be wss://*.jaw.id or ws://localhost.`);\n  }\n  // Numeric keys: coerce + validate here so EVERY caller is safe. The MCP tool\n  // passes raw strings (its schema types value as a string), so without this a\n  // `sessionExpiry: \"abc\"` would land as a string and turn `expiry * 86400`\n  // into NaN, and a `defaultChain` string would ride into an RPC URL verbatim.\n  let toStore: string | number = value;\n  if (key === 'defaultChain' || key === 'sessionExpiry') {\n    // Strict: reject anything parseInt would silently truncate ('1.5' -> 1,\n    // '0x10' -> 0, '10abc' -> 10). Only a bare positive decimal integer passes.\n    const n = typeof value === 'number' ? value : /^\\d+$/.test(value.trim()) ? parseInt(value.trim(), 10) : NaN;\n    if (!Number.isInteger(n) || n <= 0) {\n      throw new Error(`${key} must be a positive integer, got: ${JSON.stringify(value)}`);\n    }\n    toStore = n;\n  }\n  const config = loadConfig();\n  const updated = { ...config, [key]: toStore };\n  saveConfig(updated);\n}\n","import type { OutputFormat } from './types.js';\n\nexport function formatOutput(data: unknown, format: OutputFormat): string {\n  if (format === 'json') {\n    return JSON.stringify(data, replaceBigInt, 2);\n  }\n  return formatHuman(data);\n}\n\nfunction replaceBigInt(_key: string, value: unknown): unknown {\n  if (typeof value === 'bigint') {\n    return value.toString();\n  }\n  return value;\n}\n\nfunction formatHuman(data: unknown, indent = 0): string {\n  if (data === null || data === undefined) {\n    return 'null';\n  }\n\n  if (typeof data === 'string' || typeof data === 'number' || typeof data === 'boolean' || typeof data === 'bigint') {\n    return String(data);\n  }\n\n  if (Array.isArray(data)) {\n    if (data.length === 0) return '(empty)';\n    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join('\\n');\n  }\n\n  if (typeof data === 'object') {\n    const entries = Object.entries(data as Record<string, unknown>);\n    if (entries.length === 0) return '(empty)';\n    const pad = ' '.repeat(indent);\n    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));\n    return entries\n      .map(([key, val]) => {\n        const paddedKey = key.padEnd(maxKeyLen);\n        const valStr = typeof val === 'object' && val !== null ? '\\n' + formatHuman(val, indent + 2) : String(val);\n        return `${pad}${paddedKey}  ${valStr}`;\n      })\n      .join('\\n');\n  }\n\n  return String(data);\n}\n","import { Command, Flags } from '@oclif/core';\nimport type { OutputFormat } from './lib/types.js';\nimport { loadConfig } from './lib/config.js';\nimport { formatOutput } from './lib/output.js';\n\nexport abstract class BaseCommand extends Command {\n  static override baseFlags = {\n    output: Flags.string({\n      char: 'o',\n      description: 'Output format',\n      options: ['json', 'human'],\n      default: 'human',\n      env: 'JAW_OUTPUT',\n    }),\n    chain: Flags.integer({\n      char: 'c',\n      description: 'Chain ID',\n      env: 'JAW_CHAIN_ID',\n    }),\n    'api-key': Flags.string({\n      description: 'JAW API key',\n      env: 'JAW_API_KEY',\n    }),\n    yes: Flags.boolean({\n      char: 'y',\n      description: 'Skip confirmations (for AI agents)',\n      default: false,\n    }),\n    quiet: Flags.boolean({\n      char: 'q',\n      description: 'Suppress non-essential output',\n      default: false,\n    }),\n  };\n\n  protected resolveApiKey(flags: { 'api-key'?: string }): string {\n    const apiKey = flags['api-key'] ?? loadConfig().apiKey;\n    if (!apiKey) {\n      this.error('API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`');\n    }\n    return apiKey;\n  }\n\n  protected resolveChainId(flags: { chain?: number }): number {\n    const chainId = flags.chain ?? loadConfig().defaultChain;\n    if (!chainId) {\n      this.error('Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`');\n    }\n    return chainId;\n  }\n\n  protected outputResult(data: unknown, format: OutputFormat): void {\n    const output = formatOutput(data, format);\n    this.log(output);\n  }\n}\n","import { BaseCommand } from '../../base-command.js';\nimport { loadConfig, redactConfig } from '../../lib/config.js';\n\nexport default class ConfigShow extends BaseCommand {\n  static override description = 'Show current CLI configuration';\n\n  static override examples = ['<%= config.bin %> config show', '<%= config.bin %> config show --output json'];\n\n  static override flags = {\n    ...BaseCommand.baseFlags,\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ConfigShow);\n    const config = loadConfig();\n    this.outputResult(redactConfig(config), flags.output as 'json' | 'human');\n  }\n}\n"]}

package/dist/commands/config/write.js

@@ -11,13 +11,15 @@ var PATHS = {
   session: path.join(JAW_DIR, "session.json"),
   relay: path.join(JAW_DIR, "relay.json"),
   keystore: path.join(JAW_DIR, "keystore.json"),
-  sessionConfig: path.join(JAW_DIR, "session-config.json")
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
 };
 
 // src/lib/validation.ts
 var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
 var SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;
-var HEX_RE = /^0x[0-9a-fA-F]+$/;
+var ALLOWANCE_RE = /^(0x[0-9a-fA-F]+|[0-9]+)$/;
 var VALID_SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
 function parsePermissionsConfig(raw) {
   const errors = [];
@@ -62,8 +64,8 @@ function parsePermissionsConfig(raw) {
         if (typeof s.token !== "string" || !ADDRESS_RE.test(s.token)) {
           errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);
         }
-        if (typeof s.allowance !== "string" || !HEX_RE.test(s.allowance)) {
-          errors.push(`spends.${i}.allowance: Must be a non-empty 0x hex value`);
+        if (typeof s.allowance !== "string" || !ALLOWANCE_RE.test(s.allowance)) {
+          errors.push(`spends.${i}.allowance: Must be a decimal or 0x hex integer`);
         }
         if (typeof s.unit !== "string" || !VALID_SPEND_UNITS.has(s.unit)) {
           errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(", ")}`);