@1sat/cli 0.0.120 → 0.0.121

package/dist/cli.js

@@ -386,6 +386,120 @@ var init_monitor_once = __esm(() => {
   init_monitor_lock();
 });
 
+// src/wallet-api/admin.ts
+import { PERMISSION_SCHEME_IDS } from "@1sat/types";
+import {
+  LocalWalletPermissionsManager
+} from "@1sat/wallet";
+function adminWallet(wallet, store) {
+  const manager = new LocalWalletPermissionsManager(wallet, CLI_ADMIN_ORIGINATOR, { permissionModules: adminPermissionModules }, { store });
+  return withAdminOriginator(manager);
+}
+function withAdminOriginator(manager) {
+  return new Proxy(manager, {
+    get(target, property, receiver) {
+      const value = Reflect.get(target, property, receiver);
+      if (typeof value !== "function")
+        return value;
+      return (args) => value.call(target, args, CLI_ADMIN_ORIGINATOR);
+    }
+  });
+}
+var CLI_ADMIN_ORIGINATOR = "1sat-cli.internal", adminPermissionModules;
+var init_admin = __esm(() => {
+  adminPermissionModules = Object.fromEntries(PERMISSION_SCHEME_IDS.map((scheme) => [
+    scheme,
+    {
+      onRequest: async (req) => ({ args: req.args }),
+      onResponse: async (res) => res
+    }
+  ]));
+});
+
+// src/wallet-api/permission-store.ts
+import {
+  existsSync as existsSync3,
+  mkdirSync as mkdirSync2,
+  readFileSync as readFileSync4,
+  renameSync,
+  writeFileSync as writeFileSync4
+} from "node:fs";
+import { dirname, join as join5 } from "node:path";
+import {
+  permissionKeyToString
+} from "@1sat/wallet";
+function permissionStorePath(dataDir, chain) {
+  return join5(dataDir, `permissions-${chain}.json`);
+}
+
+class FilePermissionStore {
+  path;
+  constructor(path) {
+    this.path = path;
+  }
+  async findGrant(key) {
+    return this.load().grants[permissionKeyToString(key)] ?? null;
+  }
+  async putGrant(grant) {
+    const file = this.load();
+    file.grants[permissionKeyToString(grant.key)] = grant;
+    this.save(file);
+  }
+  async deleteGrant(key) {
+    const file = this.load();
+    const id = permissionKeyToString(key);
+    if (!(id in file.grants))
+      return;
+    delete file.grants[id];
+    this.save(file);
+  }
+  async deleteAllForOriginator(originator) {
+    const file = this.load();
+    let removed = 0;
+    for (const [id, grant] of Object.entries(file.grants)) {
+      if (grant.key.originator === originator) {
+        delete file.grants[id];
+        removed++;
+      }
+    }
+    if (removed > 0)
+      this.save(file);
+    return removed;
+  }
+  async listGrants(filter) {
+    const out = [];
+    for (const grant of Object.values(this.load().grants)) {
+      if (filter?.originator && grant.key.originator !== filter.originator)
+        continue;
+      if (filter?.type && grant.key.type !== filter.type)
+        continue;
+      out.push(grant);
+    }
+    return out;
+  }
+  load() {
+    if (!existsSync3(this.path))
+      return { version: FILE_VERSION, grants: {} };
+    const raw = readFileSync4(this.path, "utf8");
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== FILE_VERSION) {
+      throw new Error(`Unsupported permission store version ${String(parsed.version)} in ${this.path}`);
+    }
+    return { version: FILE_VERSION, grants: parsed.grants ?? {} };
+  }
+  save(file) {
+    const dir = dirname(this.path);
+    if (!existsSync3(dir))
+      mkdirSync2(dir, { recursive: true, mode: 448 });
+    const tmp = `${this.path}.${process.pid}.tmp`;
+    writeFileSync4(tmp, `${JSON.stringify(file, null, 2)}
+`, { mode: 384 });
+    renameSync(tmp, this.path);
+  }
+}
+var FILE_VERSION = 1;
+var init_permission_store = () => {};
+
 // src/context.ts
 import { createContext } from "@1sat/actions";
 import { createNodeWallet as createNodeWallet2 } from "@1sat/wallet-node";
@@ -405,7 +519,8 @@ async function loadContext(privateKey, opts) {
     backups: config.backups,
     skipInitialMonitor: true
   });
-  const ctx = createContext(walletResult.wallet, {
+  const wallet = adminWallet(walletResult.wallet, new FilePermissionStore(permissionStorePath(dataDir, opts.chain)));
+  const ctx = createContext(wallet, {
     services: walletResult.services,
     chain: opts.chain,
     dataDir,
@@ -428,6 +543,8 @@ async function loadContext(privateKey, opts) {
 var init_context = __esm(() => {
   init_config();
   init_monitor_once();
+  init_admin();
+  init_permission_store();
 });
 
 // src/output.ts
@@ -563,7 +680,7 @@ var init_action = __esm(() => {
 });
 
 // src/help.ts
-import { readFileSync as readFileSync4 } from "node:fs";
+import { readFileSync as readFileSync5 } from "node:fs";
 import chalk2 from "chalk";
 function getVersion() {
   return VERSION;
@@ -717,7 +834,7 @@ var VERSION, GLOBAL_OPTIONS, ENV_VARS, COMMANDS;
 var init_help = __esm(() => {
   VERSION = (() => {
     try {
-      const pkg = JSON.parse(readFileSync4(new URL("../package.json", import.meta.url), "utf8"));
+      const pkg = JSON.parse(readFileSync5(new URL("../package.json", import.meta.url), "utf8"));
       return pkg.version || "0.0.11";
     } catch {
       return "0.0.11";
@@ -1390,7 +1507,82 @@ var init_help = __esm(() => {
         { name: "monitor", description: "Monitor daemon only" },
         {
           name: "wallet-api",
-          description: "App-facing BRC-100 wallet endpoint only (headless, default port 3321)"
+          description: "App-facing BRC-100 wallet endpoint only (headless, default port 3321). Ungranted requests are denied with the `1sat permissions grant` command that would allow them"
+        }
+      ]
+    },
+    {
+      group: "Server",
+      name: "permissions",
+      description: "What apps on `1sat serve wallet-api` may do. Grants live in <dataDir>/permissions-<chain>.json; the endpoint reads the file on every check, so a grant applies to the app's next call without a restart. Works with the server stopped or running and needs no wallet key.",
+      subcommands: [
+        {
+          name: "list",
+          description: "Show grants, grouped by app origin",
+          positional: "[<origin>]"
+        },
+        {
+          name: "grant",
+          description: "Allow an app one or more permissions. Selectors may be combined in one call.",
+          positional: "<origin>",
+          args: [
+            {
+              flag: "--protocol",
+              values: "<name>",
+              description: "Protocol name; requires --level"
+            },
+            {
+              flag: "--level",
+              values: "<0|1|2>",
+              description: "Protocol security level"
+            },
+            {
+              flag: "--counterparty",
+              values: "<hex|self|anyone>",
+              description: "Counterparty for a level 0/2 protocol (default self; ignored at level 1), or a certificate's verifier (also --verifier)"
+            },
+            {
+              flag: "--privileged",
+              description: "Grant the privileged variant of a protocol/certificate"
+            },
+            { flag: "--basket", values: "<name>", description: "Basket access" },
+            {
+              flag: "--label",
+              values: "<name>",
+              description: "Action label (a level-1 `action label <name>` protocol)"
+            },
+            {
+              flag: "--certificate",
+              values: "<type>",
+              description: "Certificate type; requires --fields"
+            },
+            {
+              flag: "--fields",
+              values: "<a,b>",
+              description: "Certificate fields that may be disclosed"
+            },
+            {
+              flag: "--spending",
+              values: "<satoshis>",
+              description: "Monthly spending cap; month-to-date spend is read from action history on every check"
+            }
+          ]
+        },
+        {
+          name: "revoke",
+          description: "Remove matching grants, or every grant for an origin",
+          positional: "<origin>",
+          args: [
+            {
+              flag: "--all",
+              description: "Remove every grant for the origin"
+            },
+            {
+              flag: "--protocol",
+              values: "<name>",
+              description: "Same selectors as `grant`"
+            }
+          ]
         }
       ]
     },
@@ -1573,7 +1765,7 @@ var init_authfetch_request = __esm(() => {
 });
 
 // src/commands/authfetch.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { confirm, isCancel as isCancel2 } from "@clack/prompts";
 async function handleAuthfetchCommand(args, opts) {
   if (!args[0] || args[0] === "help" || args.includes("--help") || args.includes("-h")) {
@@ -1632,7 +1824,7 @@ Unknown or missing method: ${method ?? ""}`);
   }
   let body;
   if (bodyRaw !== undefined) {
-    body = bodyRaw.startsWith("@") ? readFileSync5(bodyRaw.slice(1), "utf8") : bodyRaw;
+    body = bodyRaw.startsWith("@") ? readFileSync6(bodyRaw.slice(1), "utf8") : bodyRaw;
     if (!headers["Content-Type"] && !headers["content-type"]) {
       headers["Content-Type"] = "application/json";
     }
@@ -2077,7 +2269,7 @@ var init_init = __esm(() => {
 });
 
 // src/beef.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 import { Utils } from "@bsv/sdk";
 function parseBeefFlag(value) {
   if (!value)
@@ -2086,7 +2278,7 @@ function parseBeefFlag(value) {
     if (!value.includes(`
 `) && !value.includes(" ") && value.length < 4096) {
       try {
-        const buf = readFileSync6(value);
+        const buf = readFileSync7(value);
         return Array.from(buf);
       } catch {}
     }
@@ -2227,7 +2419,7 @@ var init_locks = __esm(() => {
 });
 
 // src/commands/mcp-proxy.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync3, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
 import { Hash, KeyDeriver, PrivateKey as PrivateKey3, Signature, Utils as Utils2 } from "@bsv/sdk";
 import { createLogger, initLogger } from "evlog";
 function generateNonce() {
@@ -2236,12 +2428,12 @@ function generateNonce() {
   return toBase64(Array.from(bytes));
 }
 function getClientKey() {
-  mkdirSync2(KEY_DIR, { recursive: true });
-  if (existsSync3(CLIENT_KEY_PATH)) {
-    return PrivateKey3.fromWif(readFileSync7(CLIENT_KEY_PATH, "utf-8").trim());
+  mkdirSync3(KEY_DIR, { recursive: true });
+  if (existsSync4(CLIENT_KEY_PATH)) {
+    return PrivateKey3.fromWif(readFileSync8(CLIENT_KEY_PATH, "utf-8").trim());
   }
   const key = PrivateKey3.fromRandom();
-  writeFileSync4(CLIENT_KEY_PATH, key.toWif(), { mode: 384 });
+  writeFileSync5(CLIENT_KEY_PATH, key.toWif(), { mode: 384 });
   const log = createLogger({ context: "startup" });
   log.set({ event: "key_generated", path: CLIENT_KEY_PATH });
   log.emit();
@@ -2739,7 +2931,7 @@ var init_opns = __esm(() => {
 });
 
 // src/commands/ordinals.ts
-import { readFileSync as readFileSync8 } from "node:fs";
+import { readFileSync as readFileSync9 } from "node:fs";
 import { basename, extname } from "node:path";
 import {
   burnOrdinals,
@@ -2857,7 +3049,7 @@ async function ordinalsInscribe(args, opts) {
   }
   let fileBytes;
   try {
-    fileBytes = readFileSync8(file);
+    fileBytes = readFileSync9(file);
   } catch (err) {
     fatal(`Failed to read file: ${err.message}`);
   }
@@ -3045,6 +3237,335 @@ var init_ordinals = __esm(() => {
   };
 });
 
+// src/wallet-api/grants.ts
+import {
+  normalizeOriginator,
+  permissionKeyToString as permissionKeyToString2
+} from "@1sat/wallet";
+function shellQuote(value) {
+  if (value !== "" && /^[A-Za-z0-9_@%+=:,./-]+$/.test(value))
+    return value;
+  return `"${value.replace(/(["\\$`])/g, "\\$1")}"`;
+}
+function grantCommand(spec, prefix = GRANT_COMMAND) {
+  const key = spec.key;
+  const parts = [prefix, shellQuote(key.originator)];
+  switch (key.type) {
+    case "protocol": {
+      if (key.protocolLevel === 1 && key.protocolName.startsWith(LABEL_PROTOCOL_PREFIX)) {
+        parts.push("--label", shellQuote(key.protocolName.slice(LABEL_PROTOCOL_PREFIX.length)));
+        break;
+      }
+      parts.push("--protocol", shellQuote(key.protocolName));
+      parts.push("--level", String(key.protocolLevel));
+      if (key.protocolLevel !== 1 && key.counterparty) {
+        parts.push("--counterparty", shellQuote(key.counterparty));
+      }
+      if (key.privileged)
+        parts.push("--privileged");
+      break;
+    }
+    case "basket":
+      parts.push("--basket", shellQuote(key.basket));
+      break;
+    case "certificate":
+      parts.push("--certificate", shellQuote(key.certType));
+      parts.push("--fields", shellQuote(key.fields.join(",")));
+      if (key.verifier) {
+        parts.push("--counterparty", shellQuote(key.verifier));
+      }
+      if (key.privileged)
+        parts.push("--privileged");
+      break;
+    case "spending":
+      parts.push("--spending", String(spec.authorizedAmount ?? 0));
+      break;
+  }
+  return parts.join(" ");
+}
+function describeKey(spec) {
+  const key = spec.key;
+  switch (key.type) {
+    case "protocol": {
+      if (key.protocolLevel === 1 && key.protocolName.startsWith(LABEL_PROTOCOL_PREFIX)) {
+        return `label    ${key.protocolName.slice(LABEL_PROTOCOL_PREFIX.length)}`;
+      }
+      const bits = [`"${key.protocolName}" (level ${key.protocolLevel}`];
+      if (key.protocolLevel !== 1 && key.counterparty) {
+        bits.push(`, counterparty ${key.counterparty}`);
+      }
+      if (key.privileged)
+        bits.push(", privileged");
+      return `protocol ${bits.join("")})`;
+    }
+    case "basket":
+      return `basket   "${key.basket}"`;
+    case "certificate":
+      return `cert     "${key.certType}" fields [${key.fields.join(", ")}]${key.verifier ? ` to ${key.verifier}` : ""}${key.privileged ? " (privileged)" : ""}`;
+    case "spending":
+      return `spending up to ${spec.authorizedAmount ?? 0} sat per month`;
+  }
+}
+function specsFromFlags(origin, flags) {
+  const originator = normalizeOriginator(origin);
+  if (!originator)
+    throw new Error("An app origin is required");
+  const specs = [];
+  if (flags.protocol !== undefined || flags.label !== undefined) {
+    if (flags.protocol !== undefined && flags.label !== undefined) {
+      throw new Error("Use either --protocol or --label, not both");
+    }
+    const isLabel = flags.label !== undefined;
+    const name = isLabel ? `${LABEL_PROTOCOL_PREFIX}${flags.label}` : flags.protocol;
+    if (!name.trim() || name === LABEL_PROTOCOL_PREFIX) {
+      throw new Error(isLabel ? "--label requires a name" : "--protocol requires a name");
+    }
+    const level = isLabel ? 1 : parseLevel(flags.level);
+    specs.push({
+      key: {
+        type: "protocol",
+        originator,
+        privileged: flags.privileged,
+        protocolLevel: level,
+        protocolName: name,
+        counterparty: level === 1 ? "" : flags.counterparty ?? "self"
+      }
+    });
+  }
+  if (flags.basket !== undefined) {
+    if (!flags.basket.trim())
+      throw new Error("--basket requires a name");
+    specs.push({
+      key: { type: "basket", originator, basket: flags.basket }
+    });
+  }
+  if (flags.certificate !== undefined) {
+    if (!flags.certificate.trim()) {
+      throw new Error("--certificate requires a certificate type");
+    }
+    const fields = (flags.fields ?? "").split(",").map((f) => f.trim()).filter((f) => f.length > 0);
+    if (fields.length === 0) {
+      throw new Error("--certificate requires --fields <a,b>");
+    }
+    specs.push({
+      key: {
+        type: "certificate",
+        originator,
+        privileged: flags.privileged,
+        verifier: flags.counterparty ?? "",
+        certType: flags.certificate,
+        fields: fields.sort()
+      }
+    });
+  }
+  if (flags.spending !== undefined) {
+    const satoshis = Number(flags.spending);
+    if (!Number.isInteger(satoshis) || satoshis <= 0) {
+      throw new Error("--spending requires a positive whole number of satoshis");
+    }
+    specs.push({
+      key: { type: "spending", originator },
+      authorizedAmount: satoshis
+    });
+  }
+  if (specs.length === 0) {
+    throw new Error("Nothing selected. Pass --protocol/--label, --basket, --certificate or --spending");
+  }
+  return specs;
+}
+function parseLevel(value) {
+  if (value === undefined) {
+    throw new Error("--protocol requires --level <0|1|2>");
+  }
+  if (value !== "0" && value !== "1" && value !== "2") {
+    throw new Error(`--level must be 0, 1 or 2 (got ${value})`);
+  }
+  return Number(value);
+}
+function specId(spec) {
+  return permissionKeyToString2(spec.key);
+}
+var LABEL_PROTOCOL_PREFIX = "action label ", GRANT_COMMAND = "1sat permissions grant";
+var init_grants = () => {};
+
+// src/commands/permissions.ts
+import { normalizeOriginator as normalizeOriginator2 } from "@1sat/wallet";
+async function handlePermissionsCommand(args, opts) {
+  const [subcommand, ...rest] = args;
+  switch (subcommand) {
+    case "list":
+    case "ls":
+      return permissionsList(rest, opts);
+    case "grant":
+      return permissionsGrant(rest, opts);
+    case "revoke":
+      return permissionsRevoke(rest, opts);
+    default:
+      printCommandHelp("permissions", opts.json);
+      if (subcommand && subcommand !== "help") {
+        process.exit(1);
+      }
+  }
+}
+function openStore(opts) {
+  const path = permissionStorePath(ensureDataDir(), opts.chain);
+  return { store: new FilePermissionStore(path), path };
+}
+function commandPrefix(opts) {
+  return opts.chain === "test" ? "1sat --chain test permissions grant" : "1sat permissions grant";
+}
+function grantFlags(args) {
+  return {
+    protocol: extractFlag(args, "--protocol"),
+    level: extractFlag(args, "--level"),
+    counterparty: extractFlag(args, "--counterparty") ?? extractFlag(args, "--verifier"),
+    privileged: hasFlag(args, "--privileged"),
+    basket: extractFlag(args, "--basket"),
+    label: extractFlag(args, "--label"),
+    certificate: extractFlag(args, "--certificate"),
+    fields: extractFlag(args, "--fields"),
+    spending: extractFlag(args, "--spending")
+  };
+}
+function firstPositional(args) {
+  for (let i = 0;i < args.length; i++) {
+    const arg = args[i];
+    if (arg.startsWith("--")) {
+      if (!BOOLEAN_FLAGS.has(arg))
+        i++;
+      continue;
+    }
+    return arg;
+  }
+  return;
+}
+function toSpec(grant) {
+  return grant.authorizedAmount != null ? { key: grant.key, authorizedAmount: grant.authorizedAmount } : { key: grant.key };
+}
+async function permissionsList(args, opts) {
+  const { store, path } = openStore(opts);
+  const origin = firstPositional(args);
+  const filter = origin ? { originator: normalizeOriginator2(origin) } : {};
+  const grants = await store.listGrants(filter);
+  if (opts.json) {
+    output(grants, opts);
+    return;
+  }
+  if (grants.length === 0) {
+    output(origin ? `No grants for ${normalizeOriginator2(origin)} in ${path}` : `No grants in ${path}`, opts);
+    return;
+  }
+  const byOrigin = new Map;
+  for (const grant of grants) {
+    const list = byOrigin.get(grant.key.originator) ?? [];
+    list.push(grant);
+    byOrigin.set(grant.key.originator, list);
+  }
+  for (const name of [...byOrigin.keys()].sort()) {
+    console.log(`
+${formatValue(name)}`);
+    for (const grant of byOrigin.get(name) ?? []) {
+      const expiry = grant.expiry > 0 ? ` expires ${new Date(grant.expiry * 1000).toISOString()}` : "";
+      console.log(`  ${describeKey(toSpec(grant))}${formatLabel(expiry)}${formatLabel(grant.reason ? ` — ${grant.reason}` : "")}`);
+    }
+  }
+  console.log(`
+  ${grants.length} grant(s) in ${path}`);
+}
+async function permissionsGrant(args, opts) {
+  const origin = firstPositional(args);
+  if (!origin)
+    fatal("Missing <origin>. See `1sat permissions --help`");
+  let specs;
+  try {
+    specs = specsFromFlags(origin, grantFlags(args));
+  } catch (err) {
+    return fatal(err.message);
+  }
+  const { store, path } = openStore(opts);
+  const now = Date.now();
+  for (const spec of specs) {
+    await store.putGrant({
+      key: spec.key,
+      expiry: 0,
+      grantedAt: now,
+      ...spec.authorizedAmount != null ? { authorizedAmount: spec.authorizedAmount } : {}
+    });
+  }
+  if (opts.json) {
+    output({
+      granted: specs.map((spec) => ({
+        id: specId(spec),
+        key: spec.key,
+        authorizedAmount: spec.authorizedAmount
+      })),
+      store: path
+    }, opts);
+    return;
+  }
+  for (const spec of specs) {
+    console.log(`granted ${describeKey(spec)}`);
+  }
+  console.log(`
+  ${specs.length} grant(s) written to ${path}. A running \`1sat serve wallet-api\` picks them up on the app's next call.`);
+}
+async function permissionsRevoke(args, opts) {
+  const origin = firstPositional(args);
+  if (!origin)
+    fatal("Missing <origin>. See `1sat permissions --help`");
+  const originator = normalizeOriginator2(origin);
+  const { store, path } = openStore(opts);
+  if (hasFlag(args, "--all")) {
+    const removed = await store.deleteAllForOriginator(originator);
+    if (opts.json) {
+      output({ originator, removed, store: path }, opts);
+      return;
+    }
+    output(`revoked ${removed} grant(s) for ${originator}`, opts);
+    return;
+  }
+  let specs;
+  try {
+    specs = specsFromFlags(origin, grantFlags(args));
+  } catch (err) {
+    return fatal(`${err.message}. Pass --all to revoke everything for an origin.`);
+  }
+  const removed = [];
+  const missing = [];
+  for (const spec of specs) {
+    if (await store.findGrant(spec.key)) {
+      await store.deleteGrant(spec.key);
+      removed.push(spec);
+    } else {
+      missing.push(spec);
+    }
+  }
+  if (opts.json) {
+    output({
+      revoked: removed.map((spec) => ({ id: specId(spec), key: spec.key })),
+      notFound: missing.map((spec) => ({ id: specId(spec), key: spec.key })),
+      store: path
+    }, opts);
+    return;
+  }
+  for (const spec of removed)
+    console.log(`revoked ${describeKey(spec)}`);
+  for (const spec of missing) {
+    console.log(`no such grant: ${describeKey(spec)} (grant it with \`${grantCommand(spec, commandPrefix(opts))}\`)`);
+  }
+  console.log(`
+  ${removed.length} grant(s) removed from ${path}`);
+}
+var BOOLEAN_FLAGS;
+var init_permissions = __esm(() => {
+  init_config();
+  init_help();
+  init_output();
+  init_grants();
+  init_permission_store();
+  BOOLEAN_FLAGS = new Set(["--privileged", "--all"]);
+});
+
 // src/commands/remote.ts
 import { StorageClient } from "@1sat/wallet-node";
 import { WalletServerClient, topUpStorage } from "@1sat/wallet-server";
@@ -3533,8 +4054,135 @@ var init_repricer = __esm(() => {
   init_providers();
 });
 
+// src/wallet-api/deny.ts
+import { AsyncLocalStorage } from "node:async_hooks";
+import {
+  normalizeOriginator as normalizeOriginator3,
+  permissionKeyFromRequest,
+  permissionKeysFromGroup
+} from "@1sat/wallet";
+function bindPermissionDenials(manager, options = {}) {
+  const prefix = options.grantCommandPrefix ?? GRANT_COMMAND;
+  const log = options.log ?? ((line) => console.log(line));
+  const record = (origin, commands) => {
+    const message = denialMessage(origin, commands);
+    inFlight.getStore()?.push(message);
+    log(`[wallet-api] ${message}`);
+  };
+  const single = async (request) => {
+    const origin = displayOrigin(request);
+    try {
+      record(origin, [grantCommand(specFromRequest(request), prefix)]);
+    } catch (err) {
+      log(`[wallet-api] could not describe request: ${err.message}`);
+    }
+    await safely(log, "deny", () => manager.denyPermission(request.requestID));
+  };
+  const grouped = async (request) => {
+    const origin = normalizeOriginator3(request.originator);
+    try {
+      record(origin, specsFromGroupedRequest(request).map((spec) => grantCommand(spec, prefix)));
+    } catch (err) {
+      log(`[wallet-api] could not describe request: ${err.message}`);
+    }
+    await safely(log, "deny", () => manager.denyGroupedPermission(request.requestID));
+  };
+  manager.bindCallback("onProtocolPermissionRequested", single);
+  manager.bindCallback("onBasketAccessRequested", single);
+  manager.bindCallback("onCertificateAccessRequested", single);
+  manager.bindCallback("onSpendingAuthorizationRequested", single);
+  manager.bindCallback("onGroupedPermissionRequested", grouped);
+}
+async function withDenialMessage(fn) {
+  const messages = [];
+  try {
+    return await inFlight.run(messages, fn);
+  } catch (err) {
+    const code = err?.code;
+    if (code !== DENIED_CODE || messages.length === 0)
+      throw err;
+    const denied = new Error(messages.join(" "));
+    denied.code = DENIED_CODE;
+    throw denied;
+  }
+}
+function denialMessage(origin, commands) {
+  const quoted = commands.map((c) => `\`${c}\``);
+  const list = quoted.length > 1 ? `${quoted.slice(0, -1).join(", ")} and ${quoted[quoted.length - 1]}` : quoted[0];
+  return `permission denied for ${origin}: run ${list} and retry`;
+}
+function specFromRequest(request) {
+  const key = permissionKeyFromRequest(request);
+  return key.type === "spending" ? { key, authorizedAmount: request.spending?.satoshis ?? 0 } : { key };
+}
+function specsFromGroupedRequest(request) {
+  const amount = request.permissions.spendingAuthorization?.amount ?? 0;
+  return permissionKeysFromGroup(request.originator, request.permissions).map((key) => key.type === "spending" ? { key, authorizedAmount: amount } : { key });
+}
+function displayOrigin(request) {
+  return normalizeOriginator3(request.originator);
+}
+async function safely(log, what, fn) {
+  try {
+    await fn();
+  } catch (err) {
+    log(`[wallet-api] ${what} failed: ${err.message}`);
+  }
+}
+var inFlight, DENIED_CODE = "ERR_PERMISSION_DENIED";
+var init_deny = __esm(() => {
+  init_grants();
+  inFlight = new AsyncLocalStorage;
+});
+
+// src/wallet-api/endpoint.ts
+import { LocalWalletPermissionsManager as LocalWalletPermissionsManager2 } from "@1sat/wallet";
+import {
+  startBRC100Server
+} from "@1sat/wallet-server";
+function walletApiHandle(wallet) {
+  return {
+    async call(method, args, origin) {
+      const fn = wallet[method];
+      if (typeof fn !== "function") {
+        throw new Error(`Method not available: ${method}`);
+      }
+      return withDenialMessage(() => fn.call(wallet, args, origin));
+    }
+  };
+}
+async function startWalletApi(options) {
+  const log = options.log ?? ((line) => console.log(line));
+  const manager = new LocalWalletPermissionsManager2(options.wallet, CLI_ADMIN_ORIGINATOR, { ...options.managerConfig }, { store: new FilePermissionStore(options.storePath) });
+  bindPermissionDenials(manager, {
+    grantCommandPrefix: options.grantCommandPrefix,
+    log
+  });
+  const server = await startBRC100Server({
+    host: options.host,
+    port: options.port,
+    adminOriginator: CLI_ADMIN_ORIGINATOR,
+    wallet: walletApiHandle(manager),
+    onEvent: (event) => {
+      if (event.event !== "brc100_call")
+        return;
+      const line = `[wallet-api] ${event.method} from ${event.origin || "(no origin)"} -> ${event.status}`;
+      log(event.error ? `${line}: ${event.error}` : line);
+    }
+  });
+  return {
+    server,
+    close: () => server.close()
+  };
+}
+var init_endpoint = __esm(() => {
+  init_admin();
+  init_deny();
+  init_permission_store();
+});
+
 // src/commands/serve.ts
-import { join as join5 } from "node:path";
+import { join as join6 } from "node:path";
 import {
   createNodeWallet as createNodeWallet3
 } from "@1sat/wallet-node";
@@ -3543,8 +4191,7 @@ import {
   KnexHandleCertStore,
   KnexPendingStore,
   createHostServer,
-  createWalletServer,
-  startBRC100Server
+  createWalletServer
 } from "@1sat/wallet-server";
 import { initLogger as initLogger2 } from "evlog";
 import knexLib from "knex";
@@ -3620,7 +4267,7 @@ async function resolveServe(opts) {
   };
 }
 function deriveSqliteFilename(dataDir, chain) {
-  return join5(dataDir, `wallet-${chain}.db`);
+  return join6(dataDir, `wallet-${chain}.db`);
 }
 function resolveMonitorEnabled(configured) {
   const fromEnv = process.env.ONESAT_MONITOR;
@@ -3674,7 +4321,7 @@ async function runWithStorage(resolved, mode) {
     skipInitialMonitor: true
   });
   if (mode === "wallet-api") {
-    const dapp = await startDappEndpoint(walletResult);
+    const dapp = await startDappEndpoint(walletResult, resolved);
     return {
       stop: async () => {
         await dapp.close();
@@ -3812,7 +4459,7 @@ async function startWalletServer(resolved, walletResult, accounts, mode) {
 }
 function createMessageboxKnex(storage, messagebox, resolved) {
   if (storage.provider === "bun-sqlite") {
-    const filename = messagebox?.dbPath ?? join5(resolved.dataDir, `messagebox-${resolved.chain}.db`);
+    const filename = messagebox?.dbPath ?? join6(resolved.dataDir, `messagebox-${resolved.chain}.db`);
     return knexLib({
       client: "sqlite3",
       connection: { filename },
@@ -3870,50 +4517,24 @@ function waitForShutdown() {
     process.once("SIGTERM", () => handler("SIGTERM"));
   });
 }
-function walletApiHandle(wallet) {
-  return {
-    async call(method, args, origin) {
-      const iface = wallet;
-      const fn = iface[method];
-      if (typeof fn !== "function") {
-        throw new Error(`Method not available: ${method}`);
-      }
-      return await fn.call(iface, args, origin);
-    }
-  };
-}
-async function startDappEndpoint(walletResult) {
+async function startDappEndpoint(walletResult, resolved) {
   const config = loadConfig();
   const dapp = config.server?.dapp ?? {};
   const host = dapp.host ?? DEFAULT_DAPP_HOST;
   const port = dapp.port ?? (process.env.ONESAT_DAPP_PORT ? Number(process.env.ONESAT_DAPP_PORT) : DEFAULT_DAPP_PORT);
-  const approve = dapp.approve === true;
-  const handle = await startBRC100Server({
+  const storePath = permissionStorePath(resolved.dataDir, resolved.chain);
+  const grantCommandPrefix = resolved.chain === "test" ? "1sat --chain test permissions grant" : GRANT_COMMAND;
+  const api = await startWalletApi({
+    wallet: walletResult.wallet,
+    storePath,
     host,
     port,
-    wallet: walletApiHandle(walletResult.wallet),
-    approvalPolicy: approve ? async ({ method, origin, args }) => {
-      const { confirm, isCancel } = await import("@clack/prompts");
-      console.log(`
-[brc-100] ${method} requested by ${origin}`);
-      console.log(`          ${JSON.stringify(args).slice(0, 400)}`);
-      const ok = await confirm({
-        message: `Approve ${method}?`
-      });
-      if (isCancel(ok) || !ok) {
-        throw new Error("User denied permission");
-      }
-    } : undefined,
-    onEvent: (event) => {
-      if (event.event === "brc100_sensitive") {
-        const trustNote = event.trusted ? " (trusted)" : approve ? "" : " (auto-approved)";
-        console.log(`[brc-100] sensitive ${event.method} from ${event.origin}${trustNote}`);
-      }
-    }
+    grantCommandPrefix
   });
   console.log(`[wallet-api] BRC-100 app endpoint on http://${host}:${port}`);
-  console.log(approve ? "[wallet-api] sensitive methods require TTY confirmation" : "[wallet-api] sensitive methods are AUTO-APPROVED (headless). " + "Set server.dapp.approve=true to require confirmation.");
-  return { close: async () => await handle.close() };
+  console.log(`[wallet-api] permission grants: ${storePath}`);
+  console.log("[wallet-api] ungranted requests are denied; the error names the `1sat permissions grant` command that allows them");
+  return { close: () => api.close() };
 }
 var DEFAULT_HOST = "127.0.0.1", DEFAULT_PORT = 8100, DEFAULT_STACK_URL = "https://api.1sat.app", DEFAULT_BASELINE_BYTES, DEFAULT_PURCHASE_UNIT_BYTES = 1073741824, DEFAULT_SATS_PER_UNIT = 1e6, DEFAULT_DURATION_BLOCKS = 4383, DEFAULT_STORAGE_IDENTITY_KEY = "1sat-cli-default", DEFAULT_PG_SCHEMA = "messagebox", DEFAULT_DAPP_HOST = "127.0.0.1", DEFAULT_DAPP_PORT = 3321;
 var init_serve = __esm(() => {
@@ -3924,6 +4545,9 @@ var init_serve = __esm(() => {
   init_monitor_lock();
   init_output();
   init_repricer();
+  init_endpoint();
+  init_grants();
+  init_permission_store();
   DEFAULT_BASELINE_BYTES = 1024 * 1024 * 1024;
 });
 
@@ -3978,7 +4602,7 @@ var init_social = __esm(() => {
 });
 
 // src/commands/storage.ts
-import { join as join6 } from "node:path";
+import { join as join7 } from "node:path";
 import { StorageBunSqlite, nominateInvalidReqs } from "@1sat/wallet-node";
 import { StorageProvider } from "@bsv/wallet-toolbox";
 async function handleStorageCommand(args, opts) {
@@ -4048,7 +4672,7 @@ async function openServeStorage(opts) {
   } else {
     storage = new StorageBunSqlite({
       ...baseOptions,
-      filename: join6(ensureDataDir(), `wallet-${chain}.db`)
+      filename: join7(ensureDataDir(), `wallet-${chain}.db`)
     });
   }
   await storage.makeAvailable();
@@ -5447,13 +6071,13 @@ var init_wallet = __esm(() => {
 });
 
 // src/main.ts
-import { existsSync as existsSync4 } from "node:fs";
+import { existsSync as existsSync5 } from "node:fs";
 import { resolve } from "node:path";
 import { config as loadEnv } from "dotenv";
 function applyEnvFiles(paths) {
   for (const p of paths) {
     const abs = resolve(p);
-    if (!existsSync4(abs)) {
+    if (!existsSync5(abs)) {
       throw new Error(`Env file not found: ${p}`);
     }
     const result = loadEnv({ path: abs, quiet: true, override: true });
@@ -5537,6 +6161,9 @@ async function main() {
     case "serve":
       await handleServeCommand(rest, flags);
       break;
+    case "permissions":
+      await handlePermissionsCommand(rest, flags);
+      break;
     case "storage":
       await handleStorageCommand(rest, flags);
       break;
@@ -5564,6 +6191,7 @@ var init_main = __esm(() => {
   init_messagebox();
   init_opns();
   init_ordinals();
+  init_permissions();
   init_remote();
   init_serve();
   init_social();