@jaw.id/cli 0.1.26 → 0.2.1

package/dist/commands/session/add.js

@@ -0,0 +1,1547 @@
+import { Command, Flags } from '@oclif/core';
+import * as fs from 'fs';
+import * as path from 'path';
+import * as os from 'os';
+import * as crypto from 'crypto';
+import WebSocket from 'ws';
+import { parseAbi, parseUnits, formatUnits, erc20Abi, zeroAddress, toFunctionSelector, createPublicClient, http } from 'viem';
+import { polygonAmoy, polygon, baseSepolia, base } from 'viem/chains';
+
+// src/commands/session/add.ts
+var JAW_DIR = path.join(os.homedir(), ".jaw");
+var PATHS = {
+  root: JAW_DIR,
+  config: path.join(JAW_DIR, "config.json"),
+  session: path.join(JAW_DIR, "session.json"),
+  relay: path.join(JAW_DIR, "relay.json"),
+  keystore: path.join(JAW_DIR, "keystore.json"),
+  sessionConfig: path.join(JAW_DIR, "session-config.json"),
+  x402Log: path.join(JAW_DIR, "x402-log.jsonl"),
+  paymentLock: path.join(JAW_DIR, "x402-payment.lock")
+};
+
+// src/lib/validation.ts
+var ADDRESS_RE = /^0x[0-9a-fA-F]{40}$/;
+var SELECTOR_RE = /^0x[0-9a-fA-F]{8}$/;
+var ALLOWANCE_RE = /^(0x[0-9a-fA-F]+|[0-9]+)$/;
+var VALID_SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
+function parsePermissionsConfig(raw) {
+  const errors = [];
+  if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
+    throw new Error("Invalid permissions:\n  - Must be an object");
+  }
+  const obj = raw;
+  const calls = obj.calls;
+  const spends = obj.spends;
+  if (!calls && !spends) {
+    throw new Error('Invalid permissions:\n  - Must include at least "calls" or "spends"');
+  }
+  if (calls !== void 0) {
+    if (!Array.isArray(calls) || calls.length === 0) {
+      errors.push("calls: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < calls.length; i++) {
+        const c = calls[i];
+        if (!c || typeof c !== "object") {
+          errors.push(`calls.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof c.target !== "string" || !ADDRESS_RE.test(c.target)) {
+          errors.push(`calls.${i}.target: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (c.selector !== void 0 && (typeof c.selector !== "string" || !SELECTOR_RE.test(c.selector))) {
+          errors.push(`calls.${i}.selector: Must be a 4-byte hex selector (e.g. 0xa9059cbb)`);
+        }
+      }
+    }
+  }
+  if (spends !== void 0) {
+    if (!Array.isArray(spends) || spends.length === 0) {
+      errors.push("spends: Must be a non-empty array");
+    } else {
+      for (let i = 0; i < spends.length; i++) {
+        const s = spends[i];
+        if (!s || typeof s !== "object") {
+          errors.push(`spends.${i}: Must be an object`);
+          continue;
+        }
+        if (typeof s.token !== "string" || !ADDRESS_RE.test(s.token)) {
+          errors.push(`spends.${i}.token: Must be a valid 0x address (40 hex chars)`);
+        }
+        if (typeof s.allowance !== "string" || !ALLOWANCE_RE.test(s.allowance)) {
+          errors.push(`spends.${i}.allowance: Must be a decimal or 0x hex integer`);
+        }
+        if (typeof s.unit !== "string" || !VALID_SPEND_UNITS.has(s.unit)) {
+          errors.push(`spends.${i}.unit: Must be one of: ${[...VALID_SPEND_UNITS].join(", ")}`);
+        }
+        if (s.multiplier !== void 0 && (!Number.isInteger(s.multiplier) || s.multiplier < 1)) {
+          errors.push(`spends.${i}.multiplier: Must be a positive integer`);
+        }
+      }
+    }
+  }
+  if (errors.length > 0) {
+    throw new Error(`Invalid permissions:
+${errors.map((e) => `  - ${e}`).join("\n")}`);
+  }
+  return raw;
+}
+function isValidKeysUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "https:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    return isTrustedHost && isSecure;
+  } catch {
+    return false;
+  }
+}
+function isValidRelayUrl(url) {
+  try {
+    const parsed = new URL(url);
+    const isTrustedHost = parsed.hostname.endsWith(".jaw.id") || parsed.hostname === "jaw.id" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isSecure = parsed.protocol === "wss:" || parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    const isWebSocket = parsed.protocol === "wss:" || parsed.protocol === "ws:";
+    return isTrustedHost && isSecure && isWebSocket;
+  } catch {
+    return false;
+  }
+}
+
+// src/lib/config.ts
+function ensureDir(dir) {
+  fs.mkdirSync(dir, { recursive: true, mode: 448 });
+  fs.chmodSync(dir, 448);
+}
+function migrateConfig(config) {
+  if (config.paymasterUrl && !config.paymasters) {
+    const chainId = config.defaultChain ?? 1;
+    config.paymasters = { [chainId]: { url: config.paymasterUrl } };
+    delete config.paymasterUrl;
+    saveConfig(config);
+  }
+  return config;
+}
+function loadConfig() {
+  if (!fs.existsSync(PATHS.config)) {
+    return {};
+  }
+  const raw = fs.readFileSync(PATHS.config, "utf-8");
+  try {
+    const config = JSON.parse(raw);
+    return migrateConfig(config);
+  } catch {
+    throw new Error(
+      `Config file at ${PATHS.config} is not valid JSON. Run \`jaw config set apiKey=<key>\` to reset it.`
+    );
+  }
+}
+function saveConfig(config) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.config, JSON.stringify(config, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+
+// src/lib/output.ts
+function formatOutput(data, format) {
+  if (format === "json") {
+    return JSON.stringify(data, replaceBigInt, 2);
+  }
+  return formatHuman(data);
+}
+function replaceBigInt(_key, value) {
+  if (typeof value === "bigint") {
+    return value.toString();
+  }
+  return value;
+}
+function formatHuman(data, indent = 0) {
+  if (data === null || data === void 0) {
+    return "null";
+  }
+  if (typeof data === "string" || typeof data === "number" || typeof data === "boolean" || typeof data === "bigint") {
+    return String(data);
+  }
+  if (Array.isArray(data)) {
+    if (data.length === 0) return "(empty)";
+    return data.map((item, i) => `${i + 1}. ${formatHuman(item, indent + 2)}`).join("\n");
+  }
+  if (typeof data === "object") {
+    const entries = Object.entries(data);
+    if (entries.length === 0) return "(empty)";
+    const pad = " ".repeat(indent);
+    const maxKeyLen = Math.max(...entries.map(([k]) => k.length));
+    return entries.map(([key, val]) => {
+      const paddedKey = key.padEnd(maxKeyLen);
+      const valStr = typeof val === "object" && val !== null ? "\n" + formatHuman(val, indent + 2) : String(val);
+      return `${pad}${paddedKey}  ${valStr}`;
+    }).join("\n");
+  }
+  return String(data);
+}
+
+// src/base-command.ts
+var BaseCommand = class extends Command {
+  static baseFlags = {
+    output: Flags.string({
+      char: "o",
+      description: "Output format",
+      options: ["json", "human"],
+      default: "human",
+      env: "JAW_OUTPUT"
+    }),
+    chain: Flags.integer({
+      char: "c",
+      description: "Chain ID",
+      env: "JAW_CHAIN_ID"
+    }),
+    "api-key": Flags.string({
+      description: "JAW API key",
+      env: "JAW_API_KEY"
+    }),
+    yes: Flags.boolean({
+      char: "y",
+      description: "Skip confirmations (for AI agents)",
+      default: false
+    }),
+    quiet: Flags.boolean({
+      char: "q",
+      description: "Suppress non-essential output",
+      default: false
+    })
+  };
+  resolveApiKey(flags) {
+    const apiKey = flags["api-key"] ?? loadConfig().apiKey;
+    if (!apiKey) {
+      this.error("API key required. Set via --api-key, JAW_API_KEY env, or `jaw config set apiKey <key>`");
+    }
+    return apiKey;
+  }
+  resolveChainId(flags) {
+    const chainId = flags.chain ?? loadConfig().defaultChain;
+    if (!chainId) {
+      this.error("Chain ID required. Set via --chain, JAW_CHAIN_ID env, or `jaw config set defaultChain <id>`");
+    }
+    return chainId;
+  }
+  outputResult(data, format) {
+    const output = formatOutput(data, format);
+    this.log(output);
+  }
+};
+
+// src/lib/crypto.ts
+var subtle = globalThis.crypto.subtle;
+async function generateKeyPair() {
+  return subtle.generateKey({ name: "ECDH", namedCurve: "P-256" }, true, ["deriveKey"]);
+}
+async function deriveSharedSecret(privateKey, peerPublicKey) {
+  return subtle.deriveKey(
+    { name: "ECDH", public: peerPublicKey },
+    privateKey,
+    { name: "AES-GCM", length: 256 },
+    false,
+    ["encrypt", "decrypt"]
+  );
+}
+async function encryptMessage(sharedSecret, payload) {
+  const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+  const plaintext = new TextEncoder().encode(JSON.stringify(payload));
+  const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv }, sharedSecret, plaintext);
+  return {
+    iv: bufferToBase64(iv),
+    ciphertext: bufferToBase64(new Uint8Array(cipherBuf))
+  };
+}
+async function decryptMessage(sharedSecret, envelope) {
+  const iv = Buffer.from(envelope.iv, "base64");
+  const ciphertext = Buffer.from(envelope.ciphertext, "base64");
+  const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv }, sharedSecret, ciphertext);
+  return JSON.parse(new TextDecoder().decode(plainBuf));
+}
+async function exportKeyToHex(type, key) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  const buf = await subtle.exportKey(format, key);
+  return bytesToHex(new Uint8Array(buf));
+}
+async function importKeyFromHex(type, hex) {
+  const format = type === "private" ? "pkcs8" : "spki";
+  return subtle.importKey(
+    format,
+    Buffer.from(hexToBytes(hex)),
+    { name: "ECDH", namedCurve: "P-256" },
+    true,
+    type === "private" ? ["deriveKey"] : []
+  );
+}
+function bytesToHex(bytes) {
+  return Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+}
+function hexToBytes(hex) {
+  if (hex.length % 2 !== 0) throw new Error("Invalid hex: odd length");
+  const bytes = new Uint8Array(hex.length / 2);
+  for (let i = 0; i < hex.length; i += 2) {
+    bytes[i / 2] = parseInt(hex.substring(i, i + 2), 16);
+  }
+  return bytes;
+}
+function bufferToBase64(buf) {
+  return Buffer.from(buf).toString("base64");
+}
+
+// src/lib/ws-bridge.ts
+function buildInitPayload(config) {
+  return {
+    type: "init",
+    apiKey: config.apiKey,
+    chainId: config.chainId,
+    ens: config.ens,
+    paymasterUrl: config.paymasterUrl,
+    ...config.paymasterUrl && config.paymasterContext ? { paymasterContext: config.paymasterContext } : {}
+  };
+}
+var DEFAULT_TIMEOUT_MS = 12e4;
+var DEFAULT_CONNECT_TIMEOUT_MS = 3e4;
+var MAX_MESSAGE_BYTES = 5 * 1024 * 1024;
+var BROWSER_REOPEN_COOLDOWN_MS = 5e3;
+var MAX_RECONNECT_ATTEMPTS = 3;
+var RECONNECT_BASE_DELAY_MS = 1e3;
+var WSBridge = class {
+  relayUrl;
+  session;
+  timeout;
+  connectTimeout;
+  config;
+  privateKeyHex;
+  publicKeyHex;
+  peerPublicKeyHex;
+  sharedSecret = null;
+  ws = null;
+  disposed = false;
+  // Auto-reopen browser state
+  onBrowserNeeded;
+  onPeerKeyChanged;
+  lastBrowserOpenTime = 0;
+  // Reconnection state
+  reconnectAttempts = 0;
+  /** Updated after key exchange — caller should persist this. */
+  get peerPublicKey() {
+    return this.peerPublicKeyHex;
+  }
+  constructor(options) {
+    this.relayUrl = options.relayUrl;
+    this.session = options.session;
+    this.timeout = options.timeout ?? DEFAULT_TIMEOUT_MS;
+    this.connectTimeout = options.connectTimeout ?? DEFAULT_CONNECT_TIMEOUT_MS;
+    this.config = options.config;
+    this.privateKeyHex = options.privateKeyHex;
+    this.publicKeyHex = options.publicKeyHex;
+    this.peerPublicKeyHex = options.peerPublicKeyHex;
+  }
+  /**
+   * Connect to the relay and wait for the browser to be ready.
+   *
+   * @param onBrowserNeeded — called when the relay reports no browser connected.
+   * @param onPeerKeyChanged — called when a key_exchange updates the peer key.
+   */
+  async connect(onBrowserNeeded, onPeerKeyChanged) {
+    this.onBrowserNeeded = onBrowserNeeded;
+    this.onPeerKeyChanged = onPeerKeyChanged;
+    if (this.peerPublicKeyHex) {
+      await this.deriveSecret();
+    }
+    return this.connectInternal(onBrowserNeeded, onPeerKeyChanged);
+  }
+  async connectInternal(onBrowserNeeded, onPeerKeyChanged) {
+    return new Promise((resolve, reject) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      let browserOpened = false;
+      let resolved = false;
+      let expectingKeyExchange = !this.peerPublicKeyHex;
+      const timer = setTimeout(() => {
+        ws.close();
+        reject(
+          new Error(
+            `Browser did not connect within ${Math.round(this.connectTimeout / 1e3)}s.
+Run \`jaw disconnect\` then try again, or raise JAW_BRIDGE_TIMEOUT_MS.`
+          )
+        );
+      }, this.connectTimeout);
+      const sendEncryptedInit = async () => {
+        if (!this.sharedSecret) return;
+        const envelope = await encryptMessage(this.sharedSecret, buildInitPayload(this.config));
+        this.sendRaw(ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      };
+      const waitForReady = () => {
+        const readyTimer = setTimeout(() => {
+          ws.close();
+          reject(new Error("Browser SDK did not become ready in time."));
+        }, 15e3);
+        const onMsg = async (data) => {
+          const msg = safeParse(data);
+          if (!msg) return;
+          if (msg.type === "encrypted" && this.sharedSecret) {
+            try {
+              const inner = await decryptMessage(this.sharedSecret, msg);
+              if (inner.type === "ready") {
+                clearTimeout(readyTimer);
+                ws.off("message", onMsg);
+                this.reconnectAttempts = 0;
+                resolve();
+              }
+            } catch {
+            }
+          }
+        };
+        ws.on("message", onMsg);
+      };
+      const onBrowserReady = async () => {
+        if (resolved) return;
+        resolved = true;
+        clearTimeout(timer);
+        waitForReady();
+        await sendEncryptedInit();
+      };
+      ws.on("open", () => {
+        this.ws = ws;
+      });
+      ws.on("message", async (data) => {
+        const msg = safeParse(data);
+        if (!msg) return;
+        if (msg.type === "status") {
+          if (msg.browserConnected) {
+            if (this.sharedSecret) {
+              await onBrowserReady();
+            } else {
+              expectingKeyExchange = true;
+            }
+          } else if (!browserOpened && onBrowserNeeded) {
+            browserOpened = true;
+            expectingKeyExchange = true;
+            onBrowserNeeded().catch(() => {
+            });
+          } else if (!onBrowserNeeded) {
+            clearTimeout(timer);
+            ws.close();
+            reject(new Error("Browser not connected \u2014 relay session is stale."));
+          }
+        } else if (msg.type === "browser_connected") {
+          expectingKeyExchange = true;
+        } else if (msg.type === "browser_disconnected") {
+          this.handleBrowserDisconnect();
+        } else if (msg.type === "key_exchange" && expectingKeyExchange) {
+          expectingKeyExchange = false;
+          const peerKey = msg.publicKey;
+          this.peerPublicKeyHex = peerKey;
+          await this.deriveSecret();
+          onPeerKeyChanged?.(peerKey);
+          await onBrowserReady();
+        }
+      });
+      ws.on("error", (err) => {
+        clearTimeout(timer);
+        reject(err);
+      });
+      ws.on("close", () => {
+        clearTimeout(timer);
+        if (!this.disposed) {
+          this.handleRelayDisconnect();
+        }
+      });
+    });
+  }
+  /**
+   * Send an encrypted RPC request through the relay to the browser SDK.
+   */
+  async request(method, params) {
+    const ws = this.ws;
+    if (!ws || ws.readyState !== WebSocket.OPEN) {
+      throw new Error("Not connected to relay");
+    }
+    if (!this.sharedSecret) {
+      throw new Error("No shared secret \u2014 key exchange not completed");
+    }
+    const id = crypto.randomUUID();
+    const envelope = await encryptMessage(this.sharedSecret, {
+      type: "rpc_request",
+      id,
+      method,
+      params
+    });
+    const serialized = JSON.stringify({ type: "encrypted", ...envelope });
+    assertMessageSize(serialized, method);
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        reject(
+          new Error(`Request timed out after ${this.timeout / 1e3}s. Did you complete the action in the browser?`)
+        );
+        this.close();
+      }, this.timeout);
+      const onMessage = async (data) => {
+        const msg = safeParse(data);
+        if (!msg || msg.type !== "encrypted" || !this.sharedSecret) return;
+        try {
+          const inner = await decryptMessage(this.sharedSecret, msg);
+          if (inner.type === "rpc_response" && inner.id === id) {
+            clearTimeout(timer);
+            ws.off("message", onMessage);
+            if (inner.success) {
+              resolve(inner.data);
+            } else {
+              const err = inner.error;
+              reject(new Error(err ? `[${err.code}] ${err.message}` : "Request failed"));
+            }
+          }
+        } catch {
+        }
+      };
+      ws.on("message", onMessage);
+      this.sendRaw(ws, serialized);
+    });
+  }
+  async shutdown() {
+    this.disposed = true;
+    if (this.ws?.readyState === WebSocket.OPEN && this.sharedSecret) {
+      try {
+        const envelope = await encryptMessage(this.sharedSecret, {
+          type: "shutdown"
+        });
+        this.sendRaw(this.ws, JSON.stringify({ type: "encrypted", ...envelope }));
+      } catch {
+      }
+    }
+    this.close();
+  }
+  /**
+   * Connect to relay and send shutdown directly — no init/ready handshake.
+   * Used by `jaw disconnect` when we just need to tell the browser to close.
+   */
+  async connectAndShutdown() {
+    if (!this.peerPublicKeyHex) {
+      return;
+    }
+    this.disposed = true;
+    await this.deriveSecret();
+    return new Promise((resolve) => {
+      const url = `${this.relayUrl}?session=${encodeURIComponent(this.session)}&role=cli`;
+      const ws = new WebSocket(url);
+      const timer = setTimeout(() => {
+        try {
+          ws.close();
+        } catch {
+        }
+        resolve();
+      }, 3e3);
+      ws.on("open", async () => {
+        this.ws = ws;
+        try {
+          await this.shutdown();
+        } catch {
+        }
+        clearTimeout(timer);
+        resolve();
+      });
+      ws.on("error", () => {
+        clearTimeout(timer);
+        resolve();
+      });
+    });
+  }
+  close() {
+    this.disposed = true;
+    if (this.ws) {
+      try {
+        this.ws.close();
+      } catch {
+      }
+      this.ws = null;
+    }
+  }
+  /**
+   * Auto-reopen browser when browser_disconnected is received from relay.
+   * Respects a cooldown to prevent rapid re-opening.
+   */
+  handleBrowserDisconnect() {
+    if (this.disposed || !this.onBrowserNeeded) return;
+    const now = Date.now();
+    if (now - this.lastBrowserOpenTime < BROWSER_REOPEN_COOLDOWN_MS) {
+      return;
+    }
+    this.lastBrowserOpenTime = now;
+    this.sharedSecret = null;
+    this.peerPublicKeyHex = null;
+    this.onBrowserNeeded().catch(() => {
+    });
+  }
+  /**
+   * Attempt to reconnect to the relay with exponential backoff
+   * when the WebSocket connection drops unexpectedly.
+   */
+  handleRelayDisconnect() {
+    if (this.disposed) return;
+    if (this.reconnectAttempts >= MAX_RECONNECT_ATTEMPTS) return;
+    const delay = RECONNECT_BASE_DELAY_MS * Math.pow(2, this.reconnectAttempts);
+    this.reconnectAttempts++;
+    setTimeout(() => {
+      if (this.disposed) return;
+      this.connectInternal(this.onBrowserNeeded, this.onPeerKeyChanged).catch(() => {
+      });
+    }, delay);
+  }
+  /** Send a raw string over the WebSocket, enforcing message size limits. */
+  sendRaw(ws, data) {
+    ws.send(data);
+  }
+  async deriveSecret() {
+    if (!this.peerPublicKeyHex) return;
+    const privateKey = await importKeyFromHex("private", this.privateKeyHex);
+    const peerPublicKey = await importKeyFromHex("public", this.peerPublicKeyHex);
+    this.sharedSecret = await deriveSharedSecret(privateKey, peerPublicKey);
+  }
+};
+function assertMessageSize(serialized, method) {
+  const byteLength = Buffer.byteLength(serialized, "utf-8");
+  if (byteLength > MAX_MESSAGE_BYTES) {
+    const sizeMB = (byteLength / (1024 * 1024)).toFixed(2);
+    throw new Error(
+      `Message for ${method} is too large (${sizeMB} MB, limit ${MAX_MESSAGE_BYTES / (1024 * 1024)} MB). Try reducing the number of calls in your batch.`
+    );
+  }
+}
+function safeParse(data) {
+  try {
+    return JSON.parse(data.toString());
+  } catch {
+    return null;
+  }
+}
+function loadRelaySession() {
+  try {
+    if (!fs.existsSync(PATHS.relay)) return null;
+    const raw = fs.readFileSync(PATHS.relay, "utf-8");
+    const parsed = JSON.parse(raw);
+    if (!parsed.session || !parsed.relayUrl || !parsed.privateKey || !parsed.publicKey) {
+      return null;
+    }
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function saveRelaySession(info) {
+  ensureDir(PATHS.root);
+  fs.writeFileSync(PATHS.relay, JSON.stringify(info, null, 2) + "\n", {
+    encoding: "utf-8",
+    mode: 384
+  });
+}
+function deleteRelaySession() {
+  try {
+    if (fs.existsSync(PATHS.relay)) fs.unlinkSync(PATHS.relay);
+  } catch {
+  }
+}
+
+// src/lib/bridge-singleton.ts
+var DEFAULT_KEYS_URL = "https://keys.jaw.id";
+var DEFAULT_RELAY_URL = "wss://relay.jaw.id";
+async function getBridge(options) {
+  const config = loadConfig();
+  const envTimeout = Number(process.env["JAW_BRIDGE_TIMEOUT_MS"]);
+  const fromEnv = Number.isFinite(envTimeout) && envTimeout > 0 ? envTimeout : void 0;
+  const timeout = options.timeout ?? fromEnv;
+  const connectTimeout = options.connectTimeout ?? fromEnv;
+  const keysUrl = options.keysUrl ?? config.keysUrl ?? DEFAULT_KEYS_URL;
+  const relayUrl = options.relayUrl ?? config.relayUrl ?? DEFAULT_RELAY_URL;
+  const chainId = options.chainId ?? config.defaultChain ?? 1;
+  if (!isValidKeysUrl(keysUrl)) {
+    throw new Error(`Untrusted keysUrl: ${keysUrl}. Must be a *.jaw.id domain (HTTPS) or localhost.`);
+  }
+  if (!isValidRelayUrl(relayUrl)) {
+    throw new Error(`Untrusted relayUrl: ${relayUrl}. Must be wss://*.jaw.id or ws://localhost.`);
+  }
+  let relaySession = loadRelaySession();
+  if (relaySession && relaySession.relayUrl === relayUrl && relaySession.peerPublicKey) {
+    try {
+      return await connectBridge({ ...options, timeout }, relaySession, chainId, keysUrl, relayUrl, false);
+    } catch {
+      deleteRelaySession();
+      relaySession = null;
+    }
+  } else if (relaySession) {
+    deleteRelaySession();
+  }
+  const session = await createNewSession(relayUrl);
+  saveRelaySession(session);
+  return await connectBridge({ ...options, timeout, connectTimeout }, session, chainId, keysUrl, relayUrl, true);
+}
+async function createNewSession(relayUrl) {
+  const kp = await generateKeyPair();
+  const privateKey = await exportKeyToHex("private", kp.privateKey);
+  const publicKey = await exportKeyToHex("public", kp.publicKey);
+  return {
+    session: crypto.randomUUID(),
+    relayUrl,
+    privateKey,
+    publicKey,
+    peerPublicKey: null,
+    startedAt: (/* @__PURE__ */ new Date()).toISOString()
+  };
+}
+async function connectBridge(options, relaySession, chainId, keysUrl, relayUrl, openBrowser) {
+  const config = loadConfig();
+  const paymaster = config.paymasters?.[chainId];
+  const bridge = new WSBridge({
+    relayUrl,
+    session: relaySession.session,
+    timeout: options.timeout,
+    connectTimeout: options.connectTimeout,
+    config: {
+      apiKey: options.apiKey,
+      chainId,
+      ens: options.ens ?? config.ens,
+      paymasterUrl: paymaster?.url,
+      paymasterContext: paymaster?.context
+    },
+    privateKeyHex: relaySession.privateKey,
+    publicKeyHex: relaySession.publicKey,
+    peerPublicKeyHex: relaySession.peerPublicKey
+  });
+  await bridge.connect(
+    // onBrowserNeeded — only open a browser for new sessions
+    openBrowser ? async () => {
+      const bridgeUrl = buildBridgeUrl(keysUrl, relaySession.session, relayUrl, relaySession.publicKey);
+      if (process.env["JAW_NO_BROWSER"]) {
+        process.stderr.write(`Open this URL to approve:
+${bridgeUrl}
+`);
+        return;
+      }
+      const { default: open } = await import('open');
+      await open(bridgeUrl);
+    } : void 0,
+    // onPeerKeyChanged
+    (newPeerKey) => {
+      relaySession.peerPublicKey = newPeerKey;
+      saveRelaySession(relaySession);
+    }
+  );
+  return bridge;
+}
+function buildBridgeUrl(keysUrl, session, relayUrl, cliPublicKeyHex) {
+  const url = new URL("/cli-bridge", keysUrl);
+  url.searchParams.set("session", session);
+  url.searchParams.set("relay", relayUrl);
+  url.hash = `pk=${cliPublicKeyHex}`;
+  return url.toString();
+}
+function keystoreExists() {
+  return fs.existsSync(PATHS.keystore);
+}
+var ADDRESS_RE2 = /^0x[0-9a-fA-F]{40}$/;
+var SELECTOR_RE2 = /^0x[0-9a-fA-F]{8}$/;
+var HEX_RE = /^0x[0-9a-fA-F]+$/;
+var ALLOWANCE_RE2 = /^(0x[0-9a-fA-F]+|[0-9]+)$/;
+var SPEND_UNITS = /* @__PURE__ */ new Set(["minute", "hour", "day", "week", "month", "year", "forever"]);
+function isPositiveInt(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0;
+}
+function parseGrantedPermission(raw) {
+  if (typeof raw !== "object" || raw === null) return void 0;
+  const r = raw;
+  const { account, spender, salt } = r;
+  if (typeof account !== "string" || !ADDRESS_RE2.test(account)) return void 0;
+  if (typeof spender !== "string" || !ADDRESS_RE2.test(spender)) return void 0;
+  if (typeof salt !== "string" || !HEX_RE.test(salt)) return void 0;
+  if (!isPositiveInt(r.start) || !isPositiveInt(r.end)) return void 0;
+  if (!Array.isArray(r.calls) || r.calls.length === 0) return void 0;
+  const calls = [];
+  for (const entry of r.calls) {
+    if (typeof entry !== "object" || entry === null) return void 0;
+    const { target, selector } = entry;
+    if (typeof target !== "string" || !ADDRESS_RE2.test(target)) return void 0;
+    if (typeof selector !== "string" || !SELECTOR_RE2.test(selector)) return void 0;
+    calls.push({ target, selector });
+  }
+  if (!Array.isArray(r.spends)) return void 0;
+  const spends = [];
+  for (const entry of r.spends) {
+    if (typeof entry !== "object" || entry === null) return void 0;
+    const { token, allowance, unit, multiplier } = entry;
+    if (typeof token !== "string" || !ADDRESS_RE2.test(token)) return void 0;
+    if (typeof allowance !== "string" || !ALLOWANCE_RE2.test(allowance)) return void 0;
+    if (typeof unit !== "string" || !SPEND_UNITS.has(unit)) return void 0;
+    if (!isPositiveInt(multiplier) || multiplier > 65535) return void 0;
+    spends.push({ token, allowance, unit, multiplier });
+  }
+  return { account, spender, start: r.start, end: r.end, salt, calls, spends };
+}
+function isLegacySession(config) {
+  return config.mode !== "eip7702";
+}
+function liveOrphans(orphans, now = Date.now() / 1e3) {
+  return (orphans ?? []).filter((orphan) => orphan.expiry > now);
+}
+function saveSessionConfig(input) {
+  writeSessionConfig({ ...input, createdAt: input.createdAt ?? (/* @__PURE__ */ new Date()).toISOString() });
+}
+function writeSessionConfig(config) {
+  ensureDir(PATHS.root);
+  const temp = `${PATHS.sessionConfig}.${process.pid}.tmp`;
+  fs.writeFileSync(temp, JSON.stringify(config, null, 2) + "\n", { encoding: "utf-8", mode: 384 });
+  fs.chmodSync(temp, 384);
+  fs.renameSync(temp, PATHS.sessionConfig);
+}
+function saveRecoveredPermission(config, permission) {
+  const current = tryLoadSessionConfig();
+  if (!current || current.permissionId !== config.permissionId) return false;
+  writeSessionConfig({ ...current, permission });
+  return true;
+}
+function saveRevokeProgress(config, progress) {
+  const next = { ...tryLoadSessionConfig() ?? config };
+  if (progress.orphans.length > 0) next.orphanedPermissions = progress.orphans;
+  else delete next.orphanedPermissions;
+  writeSessionConfig(next);
+}
+function loadSessionConfig() {
+  if (!fs.existsSync(PATHS.sessionConfig)) {
+    throw new Error("No session configured. Run `jaw session setup` first.");
+  }
+  const raw = fs.readFileSync(PATHS.sessionConfig, "utf-8");
+  try {
+    return JSON.parse(raw);
+  } catch {
+    throw new Error(`Session config at ${PATHS.sessionConfig} is corrupted. Run \`jaw session setup\` to recreate it.`);
+  }
+}
+function tryLoadSessionConfig() {
+  try {
+    return loadSessionConfig();
+  } catch {
+    return null;
+  }
+}
+
+// src/x402/asset-registry.ts
+var USDC_BY_NETWORK = {
+  "eip155:8453": {
+    address: "0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913",
+    chainId: 8453,
+    wireNetwork: "eip155:8453",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:84532": {
+    address: "0x036CbD53842c5426634e7929541eC2318f3dCF7e",
+    chainId: 84532,
+    wireNetwork: "eip155:84532",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:137": {
+    address: "0x3c499c542cEF5E3811e1192ce70d8cC03d5c3359",
+    chainId: 137,
+    wireNetwork: "eip155:137",
+    usdcName: "USD Coin",
+    usdcVersion: "2",
+    decimals: 6
+  },
+  "eip155:80002": {
+    address: "0x41E94Eb019C0762f9Bfcf9Fb1E58725BfB0e7582",
+    chainId: 80002,
+    wireNetwork: "eip155:80002",
+    usdcName: "USDC",
+    usdcVersion: "2",
+    decimals: 6
+  }
+};
+function usdcForNetwork(network) {
+  return Object.hasOwn(USDC_BY_NETWORK, network) ? USDC_BY_NETWORK[network] : void 0;
+}
+
+// src/x402/grant-preset.ts
+var TRANSFER_SIGNATURE = "transfer(address,uint256)";
+var MAX_ALLOWANCE = 2n ** 160n - 1n;
+var LIMIT_PERIODS = ["minute", "hour", "day", "week", "month", "year", "forever"];
+var DEFAULT_X402_LIMIT = "10/day";
+function parseLimit(input) {
+  const trimmed = input.trim();
+  if (!trimmed) throw new Error("Limit is empty. Use --limit <amount>/<period>, for example 10/day.");
+  const [rawAmount, rawPeriod = "day", ...rest] = trimmed.split("/");
+  if (rest.length > 0) {
+    throw new Error(`Invalid limit "${input}". Expected <amount>/<period>, for example 10/day.`);
+  }
+  const amount = rawAmount.trim();
+  if (!/^\d+(\.\d+)?$/.test(amount)) {
+    throw new Error(`Invalid limit amount "${rawAmount}". Expected a positive number, for example 10 or 2.5.`);
+  }
+  const period = rawPeriod.trim().toLowerCase();
+  if (!LIMIT_PERIODS.includes(period)) {
+    throw new Error(`Invalid limit period "${rawPeriod}". Expected one of: ${LIMIT_PERIODS.join(", ")}.`);
+  }
+  return { amount, period };
+}
+function buildX402Permissions(chainId, limit = DEFAULT_X402_LIMIT) {
+  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);
+  if (!usdc) {
+    const supported = Object.values(USDC_BY_NETWORK).map((a) => a.chainId).sort((a, b) => a - b).join(", ");
+    throw new Error(`No USDC configured for chain ${chainId}. x402 payments are supported on: ${supported}.`);
+  }
+  const { amount, period } = parseLimit(limit);
+  let allowance;
+  try {
+    allowance = parseUnits(amount, usdc.decimals);
+  } catch {
+    throw new Error(`Invalid limit amount "${amount}" for a token with ${usdc.decimals} decimals.`);
+  }
+  if (allowance <= 0n) {
+    throw new Error(`Limit "${limit}" resolves to zero, which would refuse every payment.`);
+  }
+  if (allowance > MAX_ALLOWANCE) {
+    throw new Error(`Limit "${limit}" is larger than a spend allowance can hold (max ${MAX_ALLOWANCE}).`);
+  }
+  return {
+    calls: [{ target: usdc.address, functionSignature: TRANSFER_SIGNATURE }],
+    spends: [{ token: usdc.address, allowance: allowance.toString(), unit: period, multiplier: 1 }]
+  };
+}
+
+// src/x402/period.ts
+function describeSpendPeriod(unit, multiplier) {
+  const n = Math.max(1, Math.floor(multiplier ?? 1));
+  return n === 1 ? unit : `${n} ${unit}s`;
+}
+function periodLengthSeconds(unit, multiplier, bound2) {
+  const lengths = {
+    minute: 60,
+    hour: 3600,
+    day: 86400,
+    week: 604800,
+    month: (bound2 === "min" ? 28 : 31) * 86400,
+    year: (bound2 === "min" ? 365 : 366) * 86400,
+    forever: Number.POSITIVE_INFINITY
+  };
+  if (!Object.hasOwn(lengths, unit)) return null;
+  return lengths[unit] * Math.max(1, Math.floor(multiplier));
+}
+
+// src/x402/amount.ts
+function parseBigInt(value) {
+  if (value === void 0 || value === null || value === "") return null;
+  try {
+    return BigInt(value);
+  } catch {
+    return null;
+  }
+}
+
+// src/lib/terminal.ts
+var INVISIBLE_AND_BIDI = /[\u200B-\u200F\u2028\u2029\u202A-\u202E\u2066-\u2069\uFEFF]/g;
+var LINE_CONTROLS = /[\u0000-\u001F\u007F-\u009F]/g;
+var REPLACEMENT = "\uFFFD";
+var DEFAULT_LINE_LENGTH = 200;
+function bound(text, maxLength) {
+  if (text.length <= maxLength) return text;
+  return `${text.slice(0, maxLength)}\u2026 (${text.length - maxLength} more characters)`;
+}
+function sanitizeLine(value, maxLength = DEFAULT_LINE_LENGTH) {
+  const text = typeof value === "string" ? value : String(value);
+  return bound(text.replace(LINE_CONTROLS, REPLACEMENT).replace(INVISIBLE_AND_BIDI, REPLACEMENT), maxLength);
+}
+
+// src/x402/status-report.ts
+function formatUsdc(base2, decimals) {
+  if (base2 === void 0) return "unlimited";
+  const value = parseBigInt(base2);
+  if (value === null) return `${sanitizeLine(base2, 32)} (invalid)`;
+  const scale = 10n ** BigInt(decimals);
+  const whole = value / scale;
+  const frac = (value % scale).toString().padStart(decimals, "0").replace(/0+$/, "");
+  return `${whole}${frac ? `.${frac}` : ""} USDC`;
+}
+
+// src/x402/grant-ceiling.ts
+function whyGrantExceedsCeiling(permissions, chainId, ceiling) {
+  if (!ceiling) return null;
+  let parsed;
+  try {
+    parsed = parseLimit(ceiling);
+  } catch {
+    return `The grant ceiling in your config is not a valid limit: ${ceiling}. Fix it with \`jaw config set grantCeiling <amount>/<period>\`, or remove it.`;
+  }
+  const usdc = Object.values(USDC_BY_NETWORK).find((asset) => asset.chainId === chainId);
+  if (!usdc) {
+    return (permissions.spends ?? []).length > 0 ? `The grant ceiling is set to ${ceiling}, and chain ${chainId} has no USDC in the registry to measure a spend against it. Grant on a supported chain, or remove the ceiling with \`jaw config set grantCeiling ""\`.` : null;
+  }
+  const maxAllowance = parseUnits(parsed.amount, usdc.decimals);
+  const ceilingSeconds = periodLengthSeconds(parsed.period, 1, "max");
+  if (ceilingSeconds === null) return null;
+  for (const spend of permissions.spends ?? []) {
+    if (spend.token.toLowerCase() !== usdc.address.toLowerCase()) {
+      return `The grant ceiling is set to ${ceiling}, and this permission spends ${spend.token}, which cannot be measured against it. Grant USDC, or remove the ceiling with \`jaw config set grantCeiling ""\`.`;
+    }
+    let allowance;
+    try {
+      allowance = BigInt(spend.allowance);
+    } catch {
+      return `This permission asks for an allowance that cannot be read: ${spend.allowance}.`;
+    }
+    if (allowance > maxAllowance) {
+      return `This grant asks for ${formatUsdc(allowance.toString(), usdc.decimals)} per period, over the ${ceiling} ceiling set on this machine. Lower it, or raise the ceiling with \`jaw config set grantCeiling <amount>/<period>\`.`;
+    }
+    const grantSeconds = periodLengthSeconds(spend.unit, spend.multiplier ?? 1, "min");
+    if (grantSeconds === null) {
+      return `This permission uses a spend period this CLI does not recognise: ${spend.unit}.`;
+    }
+    const sameUnit = spend.unit === parsed.period;
+    if (!sameUnit && grantSeconds < ceilingSeconds) {
+      return `This grant resets its allowance every ${describeSpendPeriod(spend.unit, spend.multiplier ?? 1)}, which is more often than the ${ceiling} ceiling set on this machine allows. A shorter period is more money over the same time, even at the same allowance.`;
+    }
+  }
+  return null;
+}
+var JAW_RPC_URL = "https://api.justaname.id/proxy/v1/rpc";
+var CHAINS = {
+  [base.id]: base,
+  [baseSepolia.id]: baseSepolia,
+  [polygon.id]: polygon,
+  [polygonAmoy.id]: polygonAmoy
+};
+for (const chainId of Object.values(USDC_BY_NETWORK).map((a) => a.chainId)) {
+  if (!CHAINS[chainId]) {
+    throw new Error(
+      `x402 balance: USDC registry has chain ${chainId} but no viem chain is mapped for it in balance.ts`
+    );
+  }
+}
+var clients = /* @__PURE__ */ new Map();
+function rpcTransport(chainId, apiKey) {
+  if (!apiKey) return http();
+  return http(`${JAW_RPC_URL}?chainId=${chainId}&api-key=${apiKey}`);
+}
+function publicClientFor(chainId) {
+  const chain = CHAINS[chainId];
+  if (!chain) throw new Error(`x402: no viem chain configured for chainId ${chainId}`);
+  const apiKey = loadConfig().apiKey;
+  const key = `${chainId}:${apiKey ?? ""}`;
+  let client = clients.get(key);
+  if (!client) {
+    client = createPublicClient({ chain, transport: rpcTransport(chainId, apiKey) });
+    clients.set(key, client);
+  }
+  return client;
+}
+var readOnChain = (asset, owner) => publicClientFor(asset.chainId).readContract({
+  address: asset.address,
+  abi: erc20Abi,
+  functionName: "balanceOf",
+  args: [owner]
+});
+async function usdcBalance(network, owner, read = readOnChain) {
+  const asset = usdcForNetwork(network);
+  if (!asset) throw new Error(`Unsupported x402 network: ${network}`);
+  const raw = await read(asset, owner);
+  return { network, asset: asset.address, raw: raw.toString(), formatted: formatUnits(raw, asset.decimals) };
+}
+
+// src/x402/gas-reserve.ts
+function gasReserve(asset) {
+  return 10n ** BigInt(asset.decimals) / 10n;
+}
+function firstOperationCost(asset) {
+  return 10n ** BigInt(asset.decimals) / 100n;
+}
+
+// src/x402/funded-owner.ts
+async function whyOwnerCannotFundSession(check) {
+  const asset = usdcForNetwork(`eip155:${check.chainId}`);
+  if (!asset) return null;
+  const accounts = await check.request("eth_requestAccounts");
+  const owner = accounts?.[0];
+  if (!owner) return null;
+  const read = check.readBalance ?? (async (network, address) => BigInt((await usdcBalance(network, address)).raw));
+  let held;
+  try {
+    held = await read(asset.wireNetwork, owner);
+  } catch {
+    return null;
+  }
+  const needed = gasReserve(asset);
+  if (held >= needed) return null;
+  return `${owner} holds ${formatUsdc(held.toString(), asset.decimals)} on chain ${check.chainId}, and setting up a session needs at least ${formatUsdc(needed.toString(), asset.decimals)} there. That much rides along in the grant so the session can pay for its own first transaction. Fund the account and run this again.`;
+}
+async function whySpenderCannotPay(check) {
+  const asset = usdcForNetwork(`eip155:${check.chainId}`);
+  if (!asset) return null;
+  const read = check.readBalance ?? (async (network, address) => BigInt((await usdcBalance(network, address)).raw));
+  let held;
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), check.timeoutMs ?? 5e3);
+    });
+    held = await Promise.race([read(asset.wireNetwork, check.spender), expired]);
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+  const needed = firstOperationCost(asset);
+  if (held >= needed) return null;
+  return `${check.spender} holds ${formatUsdc(held.toString(), asset.decimals)} on chain ${check.chainId}, which is not enough to pay for its first operation. The session pays its own gas, and the grant asked this wallet to send it a little along with the permission. Nothing usable arrived: the wallet may not implement that yet, or it could not price the transfer, or the granted allowance was too small to cover one. Send ${formatUsdc(needed.toString(), asset.decimals)} to that address and the session works from there.`;
+}
+var PERMISSION_MANAGER_ABI = parseAbi([
+  "struct CallPermission { address target; bytes4 selector; address checker; }",
+  "struct SpendLimit { address token; uint160 allowance; uint8 unit; uint16 multiplier; }",
+  "struct Permission { address account; address spender; uint48 start; uint48 end; uint256 salt; CallPermission[] calls; SpendLimit[] spends; }",
+  "struct PeriodSpend { uint48 start; uint48 end; uint160 spend; }",
+  "function getHash(Permission permission) view returns (bytes32)",
+  "function isApproved(Permission permission) view returns (bool)",
+  "function isRevoked(Permission permission) view returns (bool)",
+  "function getCurrentPeriod(Permission permission, SpendLimit spendLimit) view returns (PeriodSpend)",
+  // Carried so the two time-bound reverts can be told apart from a node that
+  // did not answer. Everything else the manager can revert with decodes to an
+  // unnamed error, which is treated as unavailable rather than guessed at.
+  "error JustaPermissionManager_BeforePermissionStart(uint48 currentTimestamp, uint48 start)",
+  "error JustaPermissionManager_AfterPermissionEnd(uint48 currentTimestamp, uint48 end)"
+]);
+var PERIOD_UNIT_ENUM = {
+  minute: 0,
+  hour: 1,
+  day: 2,
+  week: 3,
+  month: 4,
+  forever: 5
+};
+function toContractSpendLimit(spend) {
+  const unit = spend.unit === "year" ? "month" : spend.unit;
+  const multiplier = spend.unit === "year" ? spend.multiplier * 12 : spend.multiplier;
+  if (!Object.hasOwn(PERIOD_UNIT_ENUM, unit)) return null;
+  return {
+    token: spend.token,
+    allowance: BigInt(spend.allowance),
+    unit: PERIOD_UNIT_ENUM[unit],
+    multiplier
+  };
+}
+function toContractPermission(permission) {
+  const spends = [];
+  for (const spend of permission.spends) {
+    const converted = toContractSpendLimit(spend);
+    if (!converted) return null;
+    spends.push(converted);
+  }
+  let salt;
+  try {
+    salt = BigInt(permission.salt);
+  } catch {
+    return null;
+  }
+  return {
+    account: permission.account,
+    spender: permission.spender,
+    start: permission.start,
+    end: permission.end,
+    salt,
+    calls: permission.calls.map((call) => ({
+      target: call.target,
+      selector: call.selector,
+      checker: zeroAddress
+    })),
+    spends
+  };
+}
+var DEFAULT_TIMEOUT_MS2 = 5e3;
+async function within(work, timeoutMs = DEFAULT_TIMEOUT_MS2) {
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), timeoutMs);
+    });
+    return await Promise.race([work, expired]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function managerAddress(override) {
+  if (override) return override;
+  const { PERMISSIONS_MANAGER_ADDRESS } = await import('@jaw.id/core');
+  return PERMISSIONS_MANAGER_ADDRESS;
+}
+function reader(chainId, deps) {
+  if (deps.readContract) return deps.readContract;
+  try {
+    const client = publicClientFor(chainId);
+    return (args) => client.readContract(args);
+  } catch {
+    return null;
+  }
+}
+async function readPermissionState(target, deps = {}) {
+  if (!target.permission) return { status: "unavailable" };
+  const permission = toContractPermission(target.permission);
+  if (!permission) return { status: "unavailable" };
+  const read = reader(target.chainId, deps);
+  if (!read) return { status: "unavailable" };
+  try {
+    const address = await managerAddress(deps.manager);
+    const [hash, approved, revoked] = await within(
+      Promise.all([
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "getHash", args: [permission] }),
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "isApproved", args: [permission] }),
+        read({ address, abi: PERMISSION_MANAGER_ABI, functionName: "isRevoked", args: [permission] })
+      ]),
+      deps.timeoutMs
+    );
+    if (typeof hash !== "string" || hash.toLowerCase() !== target.permissionId.toLowerCase()) {
+      return { status: "mismatch" };
+    }
+    return { status: "ok", approved: approved === true, revoked: revoked === true };
+  } catch {
+    return { status: "unavailable" };
+  }
+}
+async function readLiveness(session, deps = {}) {
+  const state = await readPermissionState(session, deps);
+  if (state.status === "unavailable") return "unknown";
+  if (state.status === "mismatch") return "mismatch";
+  if (state.revoked) return "revoked";
+  return state.approved ? "active" : "unapproved";
+}
+
+// src/x402/permission-recovery.ts
+var RECOVERY_TIMEOUT_MS = 5e3;
+async function recoverPermission(session, apiKey, deps = {}) {
+  if (session.permission) return session.permission;
+  if (!apiKey) return void 0;
+  const fetchPermission = deps.fetchPermission ?? (async (id, key) => {
+    const { getPermissionFromRelay } = await import('@jaw.id/core');
+    return getPermissionFromRelay(id, key);
+  });
+  let timer;
+  try {
+    const expired = new Promise((_, reject) => {
+      timer = setTimeout(() => reject(new Error("timed out")), deps.timeoutMs ?? RECOVERY_TIMEOUT_MS);
+    });
+    const relayed = await Promise.race([fetchPermission(session.permissionId, apiKey), expired]);
+    const permission = parseGrantedPermission(relayed);
+    if (!permission) return void 0;
+    if (permission.account.toLowerCase() !== session.ownerAddress.toLowerCase() || permission.spender.toLowerCase() !== session.sessionAddress.toLowerCase() || permission.end !== session.expiry) {
+      return void 0;
+    }
+    return saveRecoveredPermission(session, permission) ? permission : void 0;
+  } catch {
+    return void 0;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function callKey(call) {
+  const selector = call.selector ?? (call.functionSignature ? safeSelector(call.functionSignature) : void 0);
+  return selector ? `${call.target.toLowerCase()}:${selector.toLowerCase()}` : null;
+}
+function safeSelector(signature) {
+  try {
+    return toFunctionSelector(signature);
+  } catch {
+    return void 0;
+  }
+}
+function spendKey(spend) {
+  return `${spend.token.toLowerCase()}:${spend.unit}:${spend.multiplier ?? 1}`;
+}
+function tokenKey(spend) {
+  return spend.token.toLowerCase();
+}
+function mergePermissions(existing, addition) {
+  const calls = existing.calls.map((call) => ({
+    target: call.target,
+    selector: call.selector
+  }));
+  const seenCalls = new Set(existing.calls.map(callKey));
+  for (const call of addition.calls ?? []) {
+    const key = callKey(call);
+    if (key && seenCalls.has(key)) continue;
+    if (key) seenCalls.add(key);
+    calls.push(call);
+  }
+  const superseded = new Set((addition.spends ?? []).map(spendKey));
+  const spends = existing.spends.filter((spend) => !superseded.has(spendKey(spend))).map((spend) => ({
+    token: spend.token,
+    // Normalised out of the hex the grant response carries, so the merged
+    // document reads the way a hand-written one does.
+    allowance: BigInt(spend.allowance).toString(),
+    unit: spend.unit,
+    multiplier: spend.multiplier
+  }));
+  for (const spend of addition.spends ?? []) {
+    spends.push({
+      token: spend.token,
+      allowance: BigInt(spend.allowance).toString(),
+      unit: spend.unit,
+      multiplier: spend.multiplier ?? 1
+    });
+  }
+  return {
+    ...calls.length > 0 ? { calls } : {},
+    ...spends.length > 0 ? { spends } : {}
+  };
+}
+function describeMerge(existing, merged) {
+  const lines = [];
+  const hadCalls = new Set(existing.calls.map(callKey));
+  for (const call of merged.calls ?? []) {
+    const key = callKey(call);
+    if (key && hadCalls.has(key)) continue;
+    lines.push(`  + call    ${call.target} ${call.selector ?? call.functionSignature ?? ""}`.trimEnd());
+  }
+  const had = new Map(existing.spends.map((spend) => [spendKey(spend), BigInt(spend.allowance)]));
+  const changed = [];
+  for (const spend of merged.spends ?? []) {
+    const was = had.get(spendKey(spend));
+    const now = BigInt(spend.allowance);
+    if (was === void 0) {
+      lines.push(
+        `  + spend   ${spend.allowance} of ${spend.token} per ${describeSpendPeriod(spend.unit, spend.multiplier)}`
+      );
+      changed.push(spend);
+    } else if (was !== now) {
+      lines.push(
+        `  ~ spend   ${spend.token} per ${describeSpendPeriod(spend.unit, spend.multiplier)}: ${was} to ${now}`
+      );
+      changed.push(spend);
+    }
+  }
+  for (const spend of changed) {
+    const others = (merged.spends ?? []).filter((o) => o !== spend && tokenKey(o) === tokenKey(spend));
+    for (const other of others) {
+      lines.push(
+        `  ! note    ${other.allowance} per ${describeSpendPeriod(other.unit, other.multiplier)} on the same token still applies; every limit on a token is charged, so the tightest of them binds`
+      );
+    }
+  }
+  return lines;
+}
+
+// src/commands/session/add.ts
+var SessionAdd = class _SessionAdd extends BaseCommand {
+  static description = "Add permissions to the current session, keeping the ones it already has (one browser approval to grant, one to revoke the old).";
+  static examples = [
+    "<%= config.bin %> session add --x402",
+    "<%= config.bin %> session add --x402 --limit 10/day",
+    `<%= config.bin %> session add --permissions '{"calls":[...]}'`
+  ];
+  static flags = {
+    ...BaseCommand.baseFlags,
+    permissions: Flags.string({
+      description: "Permissions to add (inline JSON or file path).",
+      exclusive: ["x402"]
+    }),
+    x402: Flags.boolean({
+      description: "Add exactly what x402 payments need on the session chain. Tune the cap with --limit.",
+      default: false,
+      exclusive: ["permissions"]
+    }),
+    limit: Flags.string({
+      description: `Spend cap for --x402, as <amount>/<period> (default ${DEFAULT_X402_LIMIT}).`
+    })
+  };
+  async run() {
+    const { flags } = await this.parse(_SessionAdd);
+    const config = loadConfig();
+    const format = flags.output;
+    const apiKey = this.resolveApiKey(flags);
+    if (flags.limit && !flags.x402) {
+      this.error("--limit only applies to --x402. Re-run with --x402, or set the cap inside --permissions.");
+    }
+    if (!flags.x402 && !flags.permissions) {
+      this.error("Nothing to add. Pass --x402 for the payment preset, or --permissions with a scope.");
+    }
+    if (!keystoreExists()) {
+      this.error("No session to add to. Run `jaw session setup` first.");
+    }
+    const session = loadSessionConfig();
+    if (session.expiry <= Date.now() / 1e3) {
+      this.error("The session expired, so there is nothing to add to. Run `jaw session setup` to create a new one.");
+    }
+    if (isLegacySession(session)) {
+      this.error(
+        "This session was created by an older CLI and cannot be added to: its permission belongs to an address separate from the session key. Run `jaw session setup` to recreate it."
+      );
+    }
+    const existing = await recoverPermission(session, apiKey);
+    if (!existing) {
+      this.error(
+        "This session does not carry the permission it was granted, so what it already allows cannot be read. Run `jaw session setup` to recreate it, and adding will work from then on."
+      );
+    }
+    const liveness = await readLiveness({ ...session, permission: existing });
+    if (liveness === "revoked") {
+      this.error(
+        "The permission this session names was revoked on chain. Run `jaw session setup` to create a new one."
+      );
+    }
+    if (liveness === "mismatch") {
+      this.error(
+        "The permission stored for this session does not match the one that was granted, so what it already allows cannot be read. Run `jaw session setup` to recreate it."
+      );
+    }
+    const addition = this.resolveAddition(flags, session.chainId);
+    const merged = mergePermissions(existing, addition);
+    const changes = describeMerge(existing, merged);
+    if (changes.length === 0) {
+      this.log("The session already allows all of this. Nothing to do.");
+      return;
+    }
+    const overCeiling = whyGrantExceedsCeiling(addition, session.chainId, config.grantCeiling);
+    if (overCeiling) this.error(overCeiling);
+    const mergeOverCeiling = whyGrantExceedsCeiling(merged, session.chainId, config.grantCeiling);
+    if (mergeOverCeiling) {
+      this.logToStderr(
+        // Not "holds more than the ceiling allows": three of the five reasons
+        // this returns are "cannot be measured against it" rather than "is over
+        // it", and a chain with no registry USDC produced a sentence that
+        // contradicted itself.
+        `Warning: what this session already holds does not clear the grant ceiling on this machine, and re-granting carries it over. ${mergeOverCeiling}`
+      );
+    }
+    if (!flags.quiet && format !== "json") {
+      this.log("Adding to the current session:\n");
+      for (const change of changes) this.log(change);
+      this.log(
+        "\nThe union is granted as a new permission and the old one is revoked, so the browser asks twice.\nThe session key is kept, so the address and its balance do not change.\n"
+      );
+      this.log("Opening browser to approve...");
+    }
+    const permissions = parsePermissionsConfig(merged);
+    const bridge = await getBridge({ keysUrl: config.keysUrl, apiKey, chainId: session.chainId, ens: config.ens });
+    let granted;
+    try {
+      const accounts = await bridge.request("eth_requestAccounts");
+      const connected = accounts?.[0];
+      if (connected && connected.toLowerCase() !== session.ownerAddress.toLowerCase()) {
+        this.error(
+          `This session's permission belongs to ${session.ownerAddress}, but ${connected} is connected in the browser. Connect that account, or run \`jaw session setup\` to start a session on this one.`
+        );
+      }
+      if (flags.x402) {
+        const blocked = await whyOwnerCannotFundSession({
+          chainId: session.chainId,
+          request: (m, p) => bridge.request(m, p)
+        });
+        if (blocked) this.error(blocked);
+      }
+      granted = await bridge.request("wallet_grantPermissions", [
+        {
+          spender: session.sessionAddress,
+          expiry: session.expiry,
+          permissions,
+          chainId: session.chainId,
+          capabilities: { prefundSpender: true }
+        }
+      ]);
+    } finally {
+      bridge.close();
+    }
+    const response = granted;
+    const permission = parseGrantedPermission(granted);
+    const orphans = liveOrphans(session.orphanedPermissions);
+    const updated = {
+      ownerAddress: response.account,
+      sessionAddress: session.sessionAddress,
+      permissionId: response.permissionId,
+      chainId: session.chainId,
+      expiry: session.expiry,
+      mode: "eip7702",
+      // Kept, not restamped: it is what the session spend total is counted
+      // from, and adding a capability must not hand the session cap a clean
+      // slate.
+      createdAt: session.createdAt,
+      ...permission ? { permission } : {},
+      orphanedPermissions: [{ id: session.permissionId, chainId: session.chainId, expiry: session.expiry }, ...orphans]
+    };
+    saveSessionConfig(updated);
+    let revoked = false;
+    try {
+      const revokeBridge = await getBridge({
+        keysUrl: config.keysUrl,
+        apiKey,
+        chainId: session.chainId,
+        ens: config.ens
+      });
+      try {
+        await revokeBridge.request("wallet_revokePermissions", [{ id: session.permissionId }]);
+        revoked = true;
+      } finally {
+        revokeBridge.close();
+      }
+    } catch (err) {
+      this.logToStderr(
+        `Warning: the new permission was granted, but revoking the old one failed: ${err instanceof Error ? err.message : String(err)}. It stays live until it expires, and \`jaw session revoke\` will revoke it.`
+      );
+    }
+    if (revoked) {
+      saveRevokeProgress({ ...updated, createdAt: session.createdAt }, { orphans});
+    }
+    if (flags.x402) {
+      const unfunded = await whySpenderCannotPay({
+        chainId: session.chainId,
+        spender: session.sessionAddress
+      });
+      if (unfunded) this.logToStderr(`
+Warning: ${unfunded}`);
+    }
+    const summary = {
+      sessionAddress: session.sessionAddress,
+      permissionId: response.permissionId,
+      previousPermissionId: session.permissionId,
+      previousRevoked: revoked,
+      expiry: session.expiry
+    };
+    if (format === "json" || flags.quiet) {
+      this.outputResult(summary, format);
+      return;
+    }
+    this.log("\nSession updated.\n");
+    this.log(`  Session address:  ${session.sessionAddress}`);
+    this.log(`  Permission ID:    ${response.permissionId}`);
+    this.log(`  Chain:            ${session.chainId}`);
+    this.log(`  Expires:          ${new Date(session.expiry * 1e3).toISOString()}`);
+  }
+  resolveAddition(flags, chainId) {
+    if (flags.x402) {
+      try {
+        return parsePermissionsConfig(buildX402Permissions(chainId, flags.limit));
+      } catch (err) {
+        this.error(err instanceof Error ? err.message : String(err));
+      }
+    }
+    const value = flags.permissions;
+    let raw;
+    if (value.trimStart().startsWith("{")) {
+      try {
+        raw = JSON.parse(value);
+      } catch {
+        this.error(`--permissions is not valid JSON: ${value}`);
+      }
+    } else {
+      const content = fs.readFileSync(value, "utf-8");
+      try {
+        raw = JSON.parse(content);
+      } catch {
+        this.error(`Permissions file at ${value} is not valid JSON.`);
+      }
+    }
+    return parsePermissionsConfig(raw);
+  }
+};
+
+export { SessionAdd as default };
+//# sourceMappingURL=add.js.map
+//# sourceMappingURL=add.js.map