@1sat/permission-module 0.0.1

package/dist/commitmentCache.d.ts

@@ -0,0 +1,36 @@
+import type { CapturedCommitment } from './types';
+/**
+ * In-memory cache of approved-transaction commitments, keyed by
+ * `(originator, reference)`. Entries expire after `ttlSeconds` and are
+ * swept periodically.
+ *
+ * Lookup also supports finding by `(originator, hashOutputs)` so a
+ * createSignature whose preimage encodes a known hashOutputs can be
+ * verified without knowing which reference produced it.
+ */
+export declare class CommitmentCache {
+    private readonly entries;
+    private readonly ttlMs;
+    private sweepHandle;
+    constructor(ttlSeconds: number);
+    /** Begin periodic eviction. Idempotent. */
+    start(): void;
+    stop(): void;
+    /** Store a commitment under (originator, reference). */
+    put(originator: string, commitment: CapturedCommitment): void;
+    /** Look up by (originator, reference). Returns null if expired or missing. */
+    getByReference(originator: string, reference: string): CapturedCommitment | null;
+    /**
+     * Find any non-expired commitment for `originator` whose `hashOutputs`
+     * matches. Returns null if nothing matches.
+     */
+    findByHashOutputs(originator: string, hashOutputs: string): CapturedCommitment | null;
+    /** Drop all commitments for an originator (e.g. session ended). */
+    deleteOriginator(originator: string): void;
+    /** For tests/diagnostics. */
+    size(): number;
+    private key;
+    private isExpired;
+    private evictExpired;
+}
+//# sourceMappingURL=commitmentCache.d.ts.map

package/dist/commitmentCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitmentCache.d.ts","sourceRoot":"","sources":["../src/commitmentCache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAA;AAEjD;;;;;;;;GAQG;AACH,qBAAa,eAAe;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAwC;IAChE,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,WAAW,CAA8C;gBAErD,UAAU,EAAE,MAAM;IAI9B,2CAA2C;IAC3C,KAAK,IAAI,IAAI;IASb,IAAI,IAAI,IAAI;IAMZ,wDAAwD;IACxD,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,kBAAkB,GAAG,IAAI;IAI7D,8EAA8E;IAC9E,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAUhF;;;OAGG;IACH,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IAYrF,mEAAmE;IACnE,gBAAgB,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAO1C,6BAA6B;IAC7B,IAAI,IAAI,MAAM;IAId,OAAO,CAAC,GAAG;IAIX,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,YAAY;CAKpB"}

package/dist/commitmentCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commitmentCache.js","sourceRoot":"","sources":["../src/commitmentCache.ts"],"names":[],"mappings":"AAEA;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IACV,OAAO,GAAG,IAAI,GAAG,EAA8B,CAAA;IAC/C,KAAK,CAAQ;IACtB,WAAW,GAA0C,IAAI,CAAA;IAEjE,YAAY,UAAkB;QAC7B,IAAI,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAA;IAC/B,CAAC;IAED,2CAA2C;IAC3C,KAAK;QACJ,IAAI,IAAI,CAAC,WAAW;YAAE,OAAM;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAA;QAC3D,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,QAAQ,CAAC,CAAA;QACnE,+CAA+C;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,WAAgD,CAAA;QACpE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAA;IACjB,CAAC;IAED,IAAI;QACH,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAM;QAC7B,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAC/B,IAAI,CAAC,WAAW,GAAG,IAAI,CAAA;IACxB,CAAC;IAED,wDAAwD;IACxD,GAAG,CAAC,UAAkB,EAAE,UAA8B;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC,EAAE,UAAU,CAAC,CAAA;IACzE,CAAC;IAED,8EAA8E;IAC9E,cAAc,CAAC,UAAkB,EAAE,SAAiB;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;QAC/D,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAA;QACvB,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAA;YACpD,OAAO,IAAI,CAAA;QACZ,CAAC;QACD,OAAO,KAAK,CAAA;IACb,CAAC;IAED;;;OAGG;IACH,iBAAiB,CAAC,UAAkB,EAAE,WAAmB;QACxD,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC;gBAAE,SAAQ;YAC7C,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;gBACtB,SAAQ;YACT,CAAC;YACD,IAAI,KAAK,CAAC,WAAW,KAAK,WAAW;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACZ,CAAC;IAED,mEAAmE;IACnE,gBAAgB,CAAC,UAAkB;QAClC,MAAM,MAAM,GAAG,GAAG,UAAU,GAAG,CAAA;QAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACjD,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACjD,CAAC;IACF,CAAC;IAED,6BAA6B;IAC7B,IAAI;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAA;IACzB,CAAC;IAEO,GAAG,CAAC,UAAkB,EAAE,SAAiB;QAChD,OAAO,GAAG,UAAU,IAAI,SAAS,EAAE,CAAA;IACpC,CAAC;IAEO,SAAS,CAAC,KAAyB;QAC1C,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,KAAK,CAAA;IAClD,CAAC;IAEO,YAAY;QACnB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;gBAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QAClD,CAAC;IACF,CAAC;CACD"}

package/dist/createOneSatPermissionModule.d.ts

@@ -0,0 +1,38 @@
+import { type CreateOneSatPermissionModuleArgs } from './types';
+/**
+ * Mirror of the `PermissionsModule` interface from `@bsv/wallet-toolbox`.
+ * Duplicated here to keep this package free of a hard dependency on the
+ * toolbox at type-level — consumers register the returned object under
+ * `permissionModules['1sat']` in their `WalletPermissionsManager` config.
+ */
+export interface PermissionsModule {
+    onRequest(req: {
+        method: string;
+        args: object;
+        originator: string;
+    }): Promise<{
+        args: object;
+    }>;
+    onResponse(res: unknown, context: {
+        method: string;
+        originator: string;
+    }): Promise<unknown>;
+}
+/** Returned by the factory; lets callers stop the cache eviction timer. */
+export interface OneSatPermissionModule extends PermissionsModule {
+    /** Stop the periodic cache eviction. */
+    dispose(): void;
+}
+/**
+ * Build a permission module that gates 1Sat-asset signing via hashOutputs
+ * commitments captured at createAction time.
+ *
+ * Register the returned object in `WalletPermissionsManager` config:
+ *
+ *   const oneSat = createOneSatPermissionModule({ wallet, promptHandler });
+ *   new WalletPermissionsManager(wallet, adminOriginator, {
+ *     permissionModules: { '1sat': oneSat },
+ *   });
+ */
+export declare function createOneSatPermissionModule(args: CreateOneSatPermissionModuleArgs): OneSatPermissionModule;
+//# sourceMappingURL=createOneSatPermissionModule.d.ts.map

package/dist/createOneSatPermissionModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOneSatPermissionModule.d.ts","sourceRoot":"","sources":["../src/createOneSatPermissionModule.ts"],"names":[],"mappings":"AAaA,OAAO,EACN,KAAK,gCAAgC,EAErC,MAAM,SAAS,CAAA;AAEhB;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IACjC,SAAS,CAAC,GAAG,EAAE;QACd,MAAM,EAAE,MAAM,CAAA;QACd,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,MAAM,CAAA;KAClB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC7B,UAAU,CACT,GAAG,EAAE,OAAO,EACZ,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,GAC7C,OAAO,CAAC,OAAO,CAAC,CAAA;CACnB;AAED,2EAA2E;AAC3E,MAAM,WAAW,sBAAuB,SAAQ,iBAAiB;IAChE,wCAAwC;IACxC,OAAO,IAAI,IAAI,CAAA;CACf;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,4BAA4B,CAC3C,IAAI,EAAE,gCAAgC,GACpC,sBAAsB,CA4DxB"}

package/dist/createOneSatPermissionModule.js

@@ -0,0 +1,54 @@
+import { CommitmentCache } from './commitmentCache';
+import { handleCreateActionRequest, handleCreateActionResponse, handleCreateSignatureRequest, handleGetPublicKeyRequest, } from './handlers';
+import { DEFAULT_COMMITMENT_TTL_SECONDS, } from './types';
+/**
+ * Build a permission module that gates 1Sat-asset signing via hashOutputs
+ * commitments captured at createAction time.
+ *
+ * Register the returned object in `WalletPermissionsManager` config:
+ *
+ *   const oneSat = createOneSatPermissionModule({ wallet, promptHandler });
+ *   new WalletPermissionsManager(wallet, adminOriginator, {
+ *     permissionModules: { '1sat': oneSat },
+ *   });
+ */
+export function createOneSatPermissionModule(args) {
+    const cache = new CommitmentCache(args.commitmentTtlSeconds ?? DEFAULT_COMMITMENT_TTL_SECONDS);
+    cache.start();
+    const deps = {
+        wallet: args.wallet,
+        promptHandler: args.promptHandler,
+        cache,
+        adminOriginator: args.adminOriginator,
+    };
+    return {
+        async onRequest(req) {
+            switch (req.method) {
+                case 'createAction': {
+                    const next = await handleCreateActionRequest(deps, req.args, req.originator);
+                    return { args: next };
+                }
+                case 'createSignature': {
+                    const next = await handleCreateSignatureRequest(deps, req.args, req.originator);
+                    return { args: next };
+                }
+                case 'getPublicKey': {
+                    const next = handleGetPublicKeyRequest(deps, req.args, req.originator);
+                    return { args: next };
+                }
+                default:
+                    return { args: req.args };
+            }
+        },
+        async onResponse(res, context) {
+            if (context.method === 'createAction') {
+                return handleCreateActionResponse(deps, res, context.originator);
+            }
+            return res;
+        },
+        dispose() {
+            cache.stop();
+        },
+    };
+}
+//# sourceMappingURL=createOneSatPermissionModule.js.map

package/dist/createOneSatPermissionModule.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"createOneSatPermissionModule.js","sourceRoot":"","sources":["../src/createOneSatPermissionModule.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EACN,yBAAyB,EACzB,0BAA0B,EAC1B,4BAA4B,EAC5B,yBAAyB,GACzB,MAAM,YAAY,CAAA;AACnB,OAAO,EAEN,8BAA8B,GAC9B,MAAM,SAAS,CAAA;AA0BhB;;;;;;;;;;GAUG;AACH,MAAM,UAAU,4BAA4B,CAC3C,IAAsC;IAEtC,MAAM,KAAK,GAAG,IAAI,eAAe,CAChC,IAAI,CAAC,oBAAoB,IAAI,8BAA8B,CAC3D,CAAA;IACD,KAAK,CAAC,KAAK,EAAE,CAAA;IAEb,MAAM,IAAI,GAAG;QACZ,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK;QACL,eAAe,EAAE,IAAI,CAAC,eAAe;KACrC,CAAA;IAED,OAAO;QACN,KAAK,CAAC,SAAS,CAAC,GAAG;YAClB,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;gBACpB,KAAK,cAAc,CAAC,CAAC,CAAC;oBACrB,MAAM,IAAI,GAAG,MAAM,yBAAyB,CAC3C,IAAI,EACJ,GAAG,CAAC,IAAwB,EAC5B,GAAG,CAAC,UAAU,CACd,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBACtB,CAAC;gBACD,KAAK,iBAAiB,CAAC,CAAC,CAAC;oBACxB,MAAM,IAAI,GAAG,MAAM,4BAA4B,CAC9C,IAAI,EACJ,GAAG,CAAC,IAA2B,EAC/B,GAAG,CAAC,UAAU,CACd,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBACtB,CAAC;gBACD,KAAK,cAAc,CAAC,CAAC,CAAC;oBACrB,MAAM,IAAI,GAAG,yBAAyB,CACrC,IAAI,EACJ,GAAG,CAAC,IAAwB,EAC5B,GAAG,CAAC,UAAU,CACd,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;gBACtB,CAAC;gBACD;oBACC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAA;YAC3B,CAAC;QACF,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO;YAC5B,IAAI,OAAO,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;gBACvC,OAAO,0BAA0B,CAChC,IAAI,EACJ,GAAyB,EACzB,OAAO,CAAC,UAAU,CAClB,CAAA;YACF,CAAC;YACD,OAAO,GAAG,CAAA;QACX,CAAC;QAED,OAAO;YACN,KAAK,CAAC,IAAI,EAAE,CAAA;QACb,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/handlers.d.ts

@@ -0,0 +1,45 @@
+import type { CreateActionArgs, CreateActionResult, CreateSignatureArgs, GetPublicKeyArgs, WalletInterface } from '@bsv/sdk';
+import { CommitmentCache } from './commitmentCache';
+import type { PromptHandler } from './types';
+interface HandlerDeps {
+    wallet: WalletInterface;
+    promptHandler: PromptHandler;
+    cache: CommitmentCache;
+    adminOriginator?: string;
+}
+/**
+ * createAction onRequest:
+ *   1. Admin originator → return args unchanged.
+ *   2. Substitute placeholder markers in outputs (AIP/Sigma).
+ *   3. Prompt user with structured intent. Reject throws.
+ */
+export declare function handleCreateActionRequest(deps: HandlerDeps, args: CreateActionArgs, originator: string): Promise<CreateActionArgs>;
+/**
+ * createAction onResponse:
+ *   Extract the signable transaction's hashOutputs and authorized outpoint
+ *   set, store under (originator, reference).
+ *
+ *   Admin-originator calls return without capturing — admin operations
+ *   don't need commitment binding because subsequent createSignature calls
+ *   will also auto-grant.
+ */
+export declare function handleCreateActionResponse(deps: HandlerDeps, res: CreateActionResult, originator: string): Promise<CreateActionResult>;
+/**
+ * createSignature onRequest:
+ *   1. Admin → auto-grant.
+ *   2. If args.data is a BIP-143 preimage and its hashOutputs +
+ *      outpoint match a captured commitment → auto-grant.
+ *   3. Else prompt with sighash-decoded context.
+ */
+export declare function handleCreateSignatureRequest(deps: HandlerDeps, args: CreateSignatureArgs, originator: string): Promise<CreateSignatureArgs>;
+/**
+ * getPublicKey onRequest:
+ *   Admin → allow. External → reject. There is no use case where an
+ *   external dApp needs a derived pubkey under the 'p 1sat' protocol
+ *   on the user's wallet (BRC-29 sender derivation is done locally by
+ *   the sender from the recipient's identity key). Rejecting closes
+ *   the surface entirely.
+ */
+export declare function handleGetPublicKeyRequest(deps: HandlerDeps, args: GetPublicKeyArgs, originator: string): GetPublicKeyArgs;
+export {};
+//# sourceMappingURL=handlers.d.ts.map

package/dist/handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,gBAAgB,EAGhB,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAInD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAE5C,UAAU,WAAW;IACpB,MAAM,EAAE,eAAe,CAAA;IACvB,aAAa,EAAE,aAAa,CAAA;IAC5B,KAAK,EAAE,eAAe,CAAA;IACtB,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB;AAED;;;;;GAKG;AACH,wBAAsB,yBAAyB,CAC9C,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,gBAAgB,CAAC,CA6B3B;AAED;;;;;;;;GAQG;AACH,wBAAsB,0BAA0B,CAC/C,IAAI,EAAE,WAAW,EACjB,GAAG,EAAE,kBAAkB,EACvB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,kBAAkB,CAAC,CAsB7B;AAED;;;;;;GAMG;AACH,wBAAsB,4BAA4B,CACjD,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,mBAAmB,EACzB,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC,mBAAmB,CAAC,CAkC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACxC,IAAI,EAAE,WAAW,EACjB,IAAI,EAAE,gBAAgB,EACtB,UAAU,EAAE,MAAM,GAChB,gBAAgB,CAKlB"}

package/dist/handlers.js

@@ -0,0 +1,156 @@
+import { Transaction } from '@bsv/sdk';
+import { computeHashOutputs } from './hashOutputs';
+import { substitutePlaceholders } from './placeholder';
+import { MIN_BIP143_PREIMAGE_BYTES, parsePreimage } from './sighashParser';
+/**
+ * createAction onRequest:
+ *   1. Admin originator → return args unchanged.
+ *   2. Substitute placeholder markers in outputs (AIP/Sigma).
+ *   3. Prompt user with structured intent. Reject throws.
+ */
+export async function handleCreateActionRequest(deps, args, originator) {
+    if (isAdmin(deps, originator))
+        return args;
+    let outputs = args.outputs ?? [];
+    if (outputs.length > 0) {
+        outputs = await substitutePlaceholders(outputs, deps.wallet, (refVin) => resolveInputOutpoint(args.inputs ?? [], refVin));
+    }
+    const summary = summarizeIntent(args);
+    const approved = await deps.promptHandler({
+        kind: 'transaction',
+        originator,
+        intent: {
+            description: args.description,
+            inputs: args.inputs?.map(stripInputForPrompt) ?? [],
+            outputs: outputs.map(stripOutputForPrompt),
+            labels: args.labels ?? [],
+        },
+        summary,
+    });
+    if (!approved) {
+        throw new Error('1Sat permission module: user rejected the transaction.');
+    }
+    return { ...args, outputs };
+}
+/**
+ * createAction onResponse:
+ *   Extract the signable transaction's hashOutputs and authorized outpoint
+ *   set, store under (originator, reference).
+ *
+ *   Admin-originator calls return without capturing — admin operations
+ *   don't need commitment binding because subsequent createSignature calls
+ *   will also auto-grant.
+ */
+export async function handleCreateActionResponse(deps, res, originator) {
+    if (isAdmin(deps, originator))
+        return res;
+    const signable = res.signableTransaction;
+    if (!signable?.tx || !signable.reference)
+        return res;
+    const tx = Transaction.fromAtomicBEEF(signable.tx);
+    const hashOutputs = computeHashOutputs(tx);
+    const authorizedOutpoints = new Set();
+    for (const inp of tx.inputs) {
+        const txid = inp.sourceTXID ?? inp.sourceTransaction?.id('hex');
+        if (!txid)
+            continue;
+        authorizedOutpoints.add(`${txid}.${inp.sourceOutputIndex}`);
+    }
+    deps.cache.put(originator, {
+        hashOutputs,
+        authorizedOutpoints,
+        approvedAt: Date.now(),
+        reference: signable.reference,
+    });
+    return res;
+}
+/**
+ * createSignature onRequest:
+ *   1. Admin → auto-grant.
+ *   2. If args.data is a BIP-143 preimage and its hashOutputs +
+ *      outpoint match a captured commitment → auto-grant.
+ *   3. Else prompt with sighash-decoded context.
+ */
+export async function handleCreateSignatureRequest(deps, args, originator) {
+    if (isAdmin(deps, originator))
+        return args;
+    const data = args.hashToDirectlySign ?? args.data;
+    if (data && data.length >= MIN_BIP143_PREIMAGE_BYTES) {
+        const parsed = parsePreimage(data);
+        if (parsed) {
+            const commitment = deps.cache.findByHashOutputs(originator, parsed.hashOutputs);
+            if (commitment && commitment.authorizedOutpoints.has(parsed.outpoint)) {
+                return args;
+            }
+            if (commitment) {
+                throw new Error(`1Sat permission module: signature requested for outpoint ${parsed.outpoint} which was not part of the approved transaction.`);
+            }
+        }
+    }
+    const approved = await deps.promptHandler({
+        kind: 'signature',
+        originator,
+        intent: {
+            protocolID: args.protocolID,
+            keyID: args.keyID,
+            counterparty: args.counterparty,
+            dataLength: data?.length ?? 0,
+        },
+        summary: 'Sign payload',
+    });
+    if (!approved) {
+        throw new Error('1Sat permission module: user rejected the signature.');
+    }
+    return args;
+}
+/**
+ * getPublicKey onRequest:
+ *   Admin → allow. External → reject. There is no use case where an
+ *   external dApp needs a derived pubkey under the 'p 1sat' protocol
+ *   on the user's wallet (BRC-29 sender derivation is done locally by
+ *   the sender from the recipient's identity key). Rejecting closes
+ *   the surface entirely.
+ */
+export function handleGetPublicKeyRequest(deps, args, originator) {
+    if (isAdmin(deps, originator))
+        return args;
+    throw new Error("1Sat permission module: getPublicKey under 'p 1sat' is not available to external originators.");
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function isAdmin(deps, originator) {
+    return !!deps.adminOriginator && originator === deps.adminOriginator;
+}
+function resolveInputOutpoint(inputs, refVin) {
+    const inp = inputs[refVin];
+    if (!inp?.outpoint)
+        return null;
+    const [txid, voutStr] = inp.outpoint.split('.');
+    const vout = Number.parseInt(voutStr, 10);
+    if (!txid || Number.isNaN(vout))
+        return null;
+    return { txid, vout };
+}
+function stripInputForPrompt(input) {
+    return {
+        outpoint: input.outpoint,
+        inputDescription: input.inputDescription,
+    };
+}
+function stripOutputForPrompt(output) {
+    return {
+        satoshis: output.satoshis,
+        outputDescription: output.outputDescription,
+        basket: output.basket,
+        lockingScriptLength: output.lockingScript.length / 2,
+    };
+}
+function summarizeIntent(args) {
+    if (args.description)
+        return args.description;
+    const ins = args.inputs?.length ?? 0;
+    const outs = args.outputs?.length ?? 0;
+    return `Transaction with ${ins} input(s) and ${outs} output(s)`;
+}
+//# sourceMappingURL=handlers.js.map

package/dist/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sourceRoot":"","sources":["../src/handlers.ts"],"names":[],"mappings":"AASA,OAAO,EAAQ,WAAW,EAAE,MAAM,UAAU,CAAA;AAE5C,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAA;AAU1E;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC9C,IAAiB,EACjB,IAAsB,EACtB,UAAkB;IAElB,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,IAAI,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAA;IAChC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO,GAAG,MAAM,sBAAsB,CACrC,OAAO,EACP,IAAI,CAAC,MAAM,EACX,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,MAAM,CAAC,CAC3D,CAAA;IACF,CAAC;IAED,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IACrC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,EAAE,aAAa;QACnB,UAAU;QACV,MAAM,EAAE;YACP,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE;YACnD,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAC1C,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE;SACzB;QACD,OAAO;KACP,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAA;IAC1E,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAA;AAC5B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC/C,IAAiB,EACjB,GAAuB,EACvB,UAAkB;IAElB,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,GAAG,CAAA;IACzC,MAAM,QAAQ,GAAG,GAAG,CAAC,mBAAmB,CAAA;IACxC,IAAI,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,SAAS;QAAE,OAAO,GAAG,CAAA;IAEpD,MAAM,EAAE,GAAG,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAA;IAClD,MAAM,WAAW,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAA;IAC1C,MAAM,mBAAmB,GAAG,IAAI,GAAG,EAAU,CAAA;IAC7C,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,iBAAiB,EAAE,EAAE,CAAC,KAAK,CAAC,CAAA;QAC/D,IAAI,CAAC,IAAI;YAAE,SAAQ;QACnB,mBAAmB,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,GAAG,CAAC,iBAAiB,EAAE,CAAC,CAAA;IAC5D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE;QAC1B,WAAW;QACX,mBAAmB;QACnB,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;KAC7B,CAAC,CAAA;IAEF,OAAO,GAAG,CAAA;AACX,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,IAAiB,EACjB,IAAyB,EACzB,UAAkB;IAElB,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1C,MAAM,IAAI,GAAG,IAAI,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAA;IACjD,IAAI,IAAI,IAAI,IAAI,CAAC,MAAM,IAAI,yBAAyB,EAAE,CAAC;QACtD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;QAClC,IAAI,MAAM,EAAE,CAAC;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAA;YAC/E,IAAI,UAAU,IAAI,UAAU,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvE,OAAO,IAAI,CAAA;YACZ,CAAC;YACD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,IAAI,KAAK,CACd,4DAA4D,MAAM,CAAC,QAAQ,kDAAkD,CAC7H,CAAA;YACF,CAAC;QACF,CAAC;IACF,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC;QACzC,IAAI,EAAE,WAAW;QACjB,UAAU;QACV,MAAM,EAAE;YACP,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,UAAU,EAAE,IAAI,EAAE,MAAM,IAAI,CAAC;SAC7B;QACD,OAAO,EAAE,cAAc;KACvB,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAA;IACxE,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,yBAAyB,CACxC,IAAiB,EACjB,IAAsB,EACtB,UAAkB;IAElB,IAAI,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC;QAAE,OAAO,IAAI,CAAA;IAC1C,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAA;AACF,CAAC;AAED,8EAA8E;AAC9E,UAAU;AACV,8EAA8E;AAE9E,SAAS,OAAO,CAAC,IAAiB,EAAE,UAAkB;IACrD,OAAO,CAAC,CAAC,IAAI,CAAC,eAAe,IAAI,UAAU,KAAK,IAAI,CAAC,eAAe,CAAA;AACrE,CAAC;AAED,SAAS,oBAAoB,CAC5B,MAA2B,EAC3B,MAAc;IAEd,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAA;IAC1B,IAAI,CAAC,GAAG,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC/B,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;IACzC,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAA;IAC5C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAwB;IACpD,OAAO;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;KACxC,CAAA;AACF,CAAC;AAED,SAAS,oBAAoB,CAAC,MAA0B;IACvD,OAAO;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,mBAAmB,EAAE,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;KACpD,CAAA;AACF,CAAC;AAED,SAAS,eAAe,CAAC,IAAsB;IAC9C,IAAI,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC,WAAW,CAAA;IAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAA;IACpC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAA;IACtC,OAAO,oBAAoB,GAAG,iBAAiB,IAAI,YAAY,CAAA;AAChE,CAAC"}

package/dist/hashOutputs.d.ts

@@ -0,0 +1,13 @@
+import { type Transaction } from '@bsv/sdk';
+/**
+ * Compute the BIP-143 `hashOutputs` (double-SHA256 of the serialized output
+ * set) for a transaction. This is the value the module captures at
+ * `createAction` onResponse and verifies against `createSignature` preimages.
+ *
+ * Serialization per output:
+ *   - 8 bytes value (little-endian)
+ *   - varint locking-script length
+ *   - locking-script bytes
+ */
+export declare function computeHashOutputs(tx: Transaction): string;
+//# sourceMappingURL=hashOutputs.d.ts.map

package/dist/hashOutputs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashOutputs.d.ts","sourceRoot":"","sources":["../src/hashOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAQ,KAAK,WAAW,EAAS,MAAM,UAAU,CAAA;AAExD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,WAAW,GAAG,MAAM,CAS1D"}

package/dist/hashOutputs.js

@@ -0,0 +1,51 @@
+import { Hash, Utils } from '@bsv/sdk';
+/**
+ * Compute the BIP-143 `hashOutputs` (double-SHA256 of the serialized output
+ * set) for a transaction. This is the value the module captures at
+ * `createAction` onResponse and verifies against `createSignature` preimages.
+ *
+ * Serialization per output:
+ *   - 8 bytes value (little-endian)
+ *   - varint locking-script length
+ *   - locking-script bytes
+ */
+export function computeHashOutputs(tx) {
+    const buf = [];
+    for (const out of tx.outputs) {
+        writeUint64LE(buf, BigInt(out.satoshis ?? 0));
+        const scriptBytes = out.lockingScript.toBinary();
+        writeVarint(buf, scriptBytes.length);
+        for (const b of scriptBytes)
+            buf.push(b);
+    }
+    return Utils.toHex(Hash.hash256(buf));
+}
+function writeUint64LE(buf, value) {
+    let v = value;
+    for (let i = 0; i < 8; i++) {
+        buf.push(Number(v & 0xffn));
+        v >>= 8n;
+    }
+}
+function writeVarint(buf, n) {
+    if (n < 0xfd) {
+        buf.push(n);
+        return;
+    }
+    if (n <= 0xffff) {
+        buf.push(0xfd, n & 0xff, (n >> 8) & 0xff);
+        return;
+    }
+    if (n <= 0xffffffff) {
+        buf.push(0xfe, n & 0xff, (n >> 8) & 0xff, (n >> 16) & 0xff, (n >> 24) & 0xff);
+        return;
+    }
+    // > 4 GB script length — implausible in practice.
+    buf.push(0xff);
+    let v = BigInt(n);
+    for (let i = 0; i < 8; i++) {
+        buf.push(Number(v & 0xffn));
+        v >>= 8n;
+    }
+}
+//# sourceMappingURL=hashOutputs.js.map

package/dist/hashOutputs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hashOutputs.js","sourceRoot":"","sources":["../src/hashOutputs.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAoB,KAAK,EAAE,MAAM,UAAU,CAAA;AAExD;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAAe;IACjD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,GAAG,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;QAC9B,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAA;QAC7C,MAAM,WAAW,GAAG,GAAG,CAAC,aAAa,CAAC,QAAQ,EAAE,CAAA;QAChD,WAAW,CAAC,GAAG,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;QACpC,KAAK,MAAM,CAAC,IAAI,WAAW;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;AACtC,CAAC;AAED,SAAS,aAAa,CAAC,GAAa,EAAE,KAAa;IAClD,IAAI,CAAC,GAAG,KAAK,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;QAC3B,CAAC,KAAK,EAAE,CAAA;IACT,CAAC;AACF,CAAC;AAED,SAAS,WAAW,CAAC,GAAa,EAAE,CAAS;IAC5C,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACX,OAAM;IACP,CAAC;IACD,IAAI,CAAC,IAAI,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,CAAA;QACzC,OAAM;IACP,CAAC;IACD,IAAI,CAAC,IAAI,UAAU,EAAE,CAAC;QACrB,GAAG,CAAC,IAAI,CACP,IAAI,EACJ,CAAC,GAAG,IAAI,EACR,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,IAAI,EACf,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,EAChB,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,IAAI,CAChB,CAAA;QACD,OAAM;IACP,CAAC;IACD,kDAAkD;IAClD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IACd,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAA;IACjB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAA;QAC3B,CAAC,KAAK,EAAE,CAAA;IACT,CAAC;AACF,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export { createOneSatPermissionModule, type OneSatPermissionModule, type PermissionsModule, } from './createOneSatPermissionModule';
+export { CommitmentCache } from './commitmentCache';
+export { computeHashOutputs } from './hashOutputs';
+export { aipPlaceholderBytes, sigmaPlaceholderBytes, substitutePlaceholders, } from './placeholder';
+export { MIN_BIP143_PREIMAGE_BYTES, parsePreimage, type ParsedPreimage, } from './sighashParser';
+export { DEFAULT_COMMITMENT_TTL_SECONDS, type CapturedCommitment, type CreateOneSatPermissionModuleArgs, type PromptHandler, type PromptKind, type PromptRequest, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,4BAA4B,EAC5B,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACtB,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EACN,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,GACtB,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,yBAAyB,EACzB,aAAa,EACb,KAAK,cAAc,GACnB,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,EAC9B,KAAK,kBAAkB,EACvB,KAAK,gCAAgC,EACrC,KAAK,aAAa,EAClB,KAAK,UAAU,EACf,KAAK,aAAa,GAClB,MAAM,SAAS,CAAA"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { createOneSatPermissionModule, } from './createOneSatPermissionModule';
+export { CommitmentCache } from './commitmentCache';
+export { computeHashOutputs } from './hashOutputs';
+export { aipPlaceholderBytes, sigmaPlaceholderBytes, substitutePlaceholders, } from './placeholder';
+export { MIN_BIP143_PREIMAGE_BYTES, parsePreimage, } from './sighashParser';
+export { DEFAULT_COMMITMENT_TTL_SECONDS, } from './types';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,4BAA4B,GAG5B,MAAM,gCAAgC,CAAA;AACvC,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAA;AAClD,OAAO,EACN,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,GACtB,MAAM,eAAe,CAAA;AACtB,OAAO,EACN,yBAAyB,EACzB,aAAa,GAEb,MAAM,iBAAiB,CAAA;AACxB,OAAO,EACN,8BAA8B,GAM9B,MAAM,SAAS,CAAA"}

package/dist/placeholder.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Placeholder substitution: SDK actions that need an AIP or Sigma signature
+ * embedded in an output script append a marker push at the script tail.
+ * The module detects the marker, strips it, and runs the appropriate
+ * signing helper to produce the real trailing pushes — using the underlying
+ * wallet directly so the inner signature call doesn't re-prompt.
+ *
+ * Marker format (UTF-8 bytes pushed as a single data push at the script tail):
+ *
+ *   1SATPM:AIP                       — needs BAP-AIP signature
+ *   1SATPM:SIGMA:<targetVout>:<refVin> — needs Sigma signature
+ *
+ * Example: a BSocial post action constructs the OP_RETURN with all data
+ * pushes, then appends a single push of `'1SATPM:AIP'`. The module sees
+ * this trailing push, removes it, calls `applyBapAip` on the resulting
+ * script, and writes the modified locking script back to the createAction
+ * args before passing them to the underlying wallet.
+ */
+import type { CreateActionOutput, WalletInterface } from '@bsv/sdk';
+/**
+ * Build the AIP placeholder bytes the SDK should append.
+ *
+ * @param keyID - Optional explicit BAP keyID to sign with. Omit to use
+ *                the current rotated signing key (resolved by the module
+ *                via `resolveCurrentKeyId`).
+ */
+export declare const aipPlaceholderBytes: (keyID?: string) => number[];
+/**
+ * Build the Sigma placeholder bytes the SDK should append.
+ *
+ * @param targetVout - which output of the new tx the signature covers
+ * @param refVin     - which input of the new tx anchors the input hash
+ */
+export declare const sigmaPlaceholderBytes: (targetVout: number, refVin: number) => number[];
+/**
+ * Inspect every output in `outputs` and substitute placeholder markers with
+ * real signatures. Mutation is returned via a fresh array; the caller writes
+ * it back into the createAction args before forwarding to the underlying
+ * wallet.
+ *
+ * For Sigma placeholders, the source-input outpoint is needed to compute
+ * the input hash. The caller supplies a `resolveSigmaInputOutpoint(refVin)`
+ * function that maps a vin index to `{ txid, vout }` (typically by reading
+ * `args.inputs[refVin].outpoint`).
+ */
+export declare function substitutePlaceholders(outputs: CreateActionOutput[], wallet: WalletInterface, resolveSigmaInputOutpoint: (refVin: number) => {
+    txid: string;
+    vout: number;
+} | null): Promise<CreateActionOutput[]>;
+//# sourceMappingURL=placeholder.d.ts.map

package/dist/placeholder.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder.d.ts","sourceRoot":"","sources":["../src/placeholder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAUH,OAAO,KAAK,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAGnE;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,MAAM,EAIzD,CAAA;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,GACjC,YAAY,MAAM,EAClB,QAAQ,MAAM,KACZ,MAAM,EAIP,CAAA;AA0CF;;;;;;;;;;GAUG;AACH,wBAAsB,sBAAsB,CAC3C,OAAO,EAAE,kBAAkB,EAAE,EAC7B,MAAM,EAAE,eAAe,EACvB,yBAAyB,EAAE,CAC1B,MAAM,EAAE,MAAM,KACV;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,GACxC,OAAO,CAAC,kBAAkB,EAAE,CAAC,CA2B/B"}

package/dist/placeholder.js

@@ -0,0 +1,108 @@
+/**
+ * Placeholder substitution: SDK actions that need an AIP or Sigma signature
+ * embedded in an output script append a marker push at the script tail.
+ * The module detects the marker, strips it, and runs the appropriate
+ * signing helper to produce the real trailing pushes — using the underlying
+ * wallet directly so the inner signature call doesn't re-prompt.
+ *
+ * Marker format (UTF-8 bytes pushed as a single data push at the script tail):
+ *
+ *   1SATPM:AIP                       — needs BAP-AIP signature
+ *   1SATPM:SIGMA:<targetVout>:<refVin> — needs Sigma signature
+ *
+ * Example: a BSocial post action constructs the OP_RETURN with all data
+ * pushes, then appends a single push of `'1SATPM:AIP'`. The module sees
+ * this trailing push, removes it, calls `applyBapAip` on the resulting
+ * script, and writes the modified locking script back to the createAction
+ * args before passing them to the underlying wallet.
+ */
+import { applyBapAip, applySigma } from '@1sat/actions';
+import { P1SAT_AIP_PLACEHOLDER, P1SAT_AIP_PLACEHOLDER_PREFIX, P1SAT_PLACEHOLDER_PREFIX, P1SAT_SIGMA_PLACEHOLDER_PREFIX, } from '@1sat/types';
+import { Script, Utils } from '@bsv/sdk';
+/**
+ * Build the AIP placeholder bytes the SDK should append.
+ *
+ * @param keyID - Optional explicit BAP keyID to sign with. Omit to use
+ *                the current rotated signing key (resolved by the module
+ *                via `resolveCurrentKeyId`).
+ */
+export const aipPlaceholderBytes = (keyID) => Utils.toArray(keyID ? `${P1SAT_AIP_PLACEHOLDER_PREFIX}${keyID}` : P1SAT_AIP_PLACEHOLDER, 'utf8');
+/**
+ * Build the Sigma placeholder bytes the SDK should append.
+ *
+ * @param targetVout - which output of the new tx the signature covers
+ * @param refVin     - which input of the new tx anchors the input hash
+ */
+export const sigmaPlaceholderBytes = (targetVout, refVin) => Utils.toArray(`${P1SAT_SIGMA_PLACEHOLDER_PREFIX}${targetVout}:${refVin}`, 'utf8');
+/** Read the trailing placeholder marker (if any) from a locking script. */
+function readPlaceholder(scriptHex) {
+    const script = Script.fromHex(scriptHex);
+    const lastChunk = script.chunks[script.chunks.length - 1];
+    if (!lastChunk?.data || lastChunk.data.length === 0)
+        return null;
+    const text = Utils.toUTF8(Array.from(lastChunk.data));
+    if (!text.startsWith(P1SAT_PLACEHOLDER_PREFIX))
+        return null;
+    if (text === P1SAT_AIP_PLACEHOLDER)
+        return { kind: 'aip' };
+    if (text.startsWith(P1SAT_AIP_PLACEHOLDER_PREFIX)) {
+        const keyID = text.slice(P1SAT_AIP_PLACEHOLDER_PREFIX.length);
+        if (!keyID)
+            return { kind: 'aip' };
+        return { kind: 'aip', keyID };
+    }
+    if (text.startsWith(P1SAT_SIGMA_PLACEHOLDER_PREFIX)) {
+        const rest = text.slice(P1SAT_SIGMA_PLACEHOLDER_PREFIX.length);
+        const [voutStr, vinStr] = rest.split(':');
+        const targetVout = Number.parseInt(voutStr, 10);
+        const refVin = Number.parseInt(vinStr, 10);
+        if (Number.isNaN(targetVout) || Number.isNaN(refVin))
+            return null;
+        return { kind: 'sigma', targetVout, refVin };
+    }
+    return null;
+}
+/** Strip the trailing placeholder push from a script. */
+function stripPlaceholder(scriptHex) {
+    const script = Script.fromHex(scriptHex);
+    return new Script(script.chunks.slice(0, -1));
+}
+/**
+ * Inspect every output in `outputs` and substitute placeholder markers with
+ * real signatures. Mutation is returned via a fresh array; the caller writes
+ * it back into the createAction args before forwarding to the underlying
+ * wallet.
+ *
+ * For Sigma placeholders, the source-input outpoint is needed to compute
+ * the input hash. The caller supplies a `resolveSigmaInputOutpoint(refVin)`
+ * function that maps a vin index to `{ txid, vout }` (typically by reading
+ * `args.inputs[refVin].outpoint`).
+ */
+export async function substitutePlaceholders(outputs, wallet, resolveSigmaInputOutpoint) {
+    const ctx = { wallet, chain: 'main' };
+    const next = [];
+    for (const out of outputs) {
+        const info = readPlaceholder(out.lockingScript);
+        if (!info) {
+            next.push(out);
+            continue;
+        }
+        const stripped = stripPlaceholder(out.lockingScript);
+        let signed;
+        if (info.kind === 'aip') {
+            signed = await applyBapAip(ctx, stripped, info.keyID);
+        }
+        else {
+            const refVin = info.refVin ?? 0;
+            const targetVout = info.targetVout ?? next.length;
+            const outpoint = resolveSigmaInputOutpoint(refVin);
+            if (!outpoint) {
+                throw new Error(`1Sat permission module: cannot resolve input outpoint for Sigma placeholder (refVin=${refVin})`);
+            }
+            signed = await applySigma(ctx, stripped, outpoint, targetVout, refVin);
+        }
+        next.push({ ...out, lockingScript: signed.toHex() });
+    }
+    return next;
+}
+//# sourceMappingURL=placeholder.js.map

package/dist/placeholder.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"placeholder.js","sourceRoot":"","sources":["../src/placeholder.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,eAAe,CAAA;AAEvD,OAAO,EACN,qBAAqB,EACrB,4BAA4B,EAC5B,wBAAwB,EACxB,8BAA8B,GAC9B,MAAM,aAAa,CAAA;AAEpB,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAExC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,KAAc,EAAY,EAAE,CAC/D,KAAK,CAAC,OAAO,CACZ,KAAK,CAAC,CAAC,CAAC,GAAG,4BAA4B,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,qBAAqB,EACzE,MAAM,CACN,CAAA;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CACpC,UAAkB,EAClB,MAAc,EACH,EAAE,CACb,KAAK,CAAC,OAAO,CACZ,GAAG,8BAA8B,GAAG,UAAU,IAAI,MAAM,EAAE,EAC1D,MAAM,CACN,CAAA;AAYF,2EAA2E;AAC3E,SAAS,eAAe,CAAC,SAAiB;IACzC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACxC,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAA;IACzD,IAAI,CAAC,SAAS,EAAE,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAChE,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;IACrD,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,wBAAwB,CAAC;QAAE,OAAO,IAAI,CAAA;IAC3D,IAAI,IAAI,KAAK,qBAAqB;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;IAC1D,IAAI,IAAI,CAAC,UAAU,CAAC,4BAA4B,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,4BAA4B,CAAC,MAAM,CAAC,CAAA;QAC7D,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAA;QAClC,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAA;IAC9B,CAAC;IACD,IAAI,IAAI,CAAC,UAAU,CAAC,8BAA8B,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAA;QAC9D,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACzC,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;QAC1C,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAA;QACjE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,yDAAyD;AACzD,SAAS,gBAAgB,CAAC,SAAiB;IAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACxC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC3C,OAA6B,EAC7B,MAAuB,EACvB,yBAE0C;IAE1C,MAAM,GAAG,GAAkB,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAA;IACpD,MAAM,IAAI,GAAyB,EAAE,CAAA;IACrC,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACd,SAAQ;QACT,CAAC;QACD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QACpD,IAAI,MAAc,CAAA;QAClB,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;QACtD,CAAC;aAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC,CAAA;YAC/B,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,CAAA;YACjD,MAAM,QAAQ,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAA;YAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CACd,uFAAuF,MAAM,GAAG,CAChG,CAAA;YACF,CAAC;YACD,MAAM,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,GAAG,EAAE,aAAa,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;IACrD,CAAC;IACD,OAAO,IAAI,CAAA;AACZ,CAAC"}

package/dist/sighashParser.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Parsed pieces of a BIP-143 sighash preimage that the module cares about.
+ */
+export interface ParsedPreimage {
+    /** `txid.vout` of the input being signed. */
+    outpoint: string;
+    /** 32-byte hashOutputs (hex). */
+    hashOutputs: string;
+}
+/**
+ * Minimum size for a BIP-143 preimage:
+ *   4 (version) + 32 (hashPrevouts) + 32 (hashSequence)
+ * + 36 (outpoint) + 1 (varint scriptCodeLen, min) + 0 (empty scriptCode allowed)
+ * + 8 (value) + 4 (nSequence) + 32 (hashOutputs) + 4 (nLockTime) + 4 (nHashType)
+ * = 157 bytes.
+ *
+ * Anything shorter cannot be a BIP-143 preimage; treat as standalone signing.
+ */
+export declare const MIN_BIP143_PREIMAGE_BYTES = 157;
+/**
+ * Parse a BIP-143 preimage and extract the input outpoint and hashOutputs.
+ *
+ * Returns null if the buffer is shorter than {@link MIN_BIP143_PREIMAGE_BYTES}
+ * or if varint decoding runs off the end. The caller treats null as
+ * "not a BIP-143 preimage; prompt the user."
+ */
+export declare function parsePreimage(data: number[] | Uint8Array): ParsedPreimage | null;
+//# sourceMappingURL=sighashParser.d.ts.map

package/dist/sighashParser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sighashParser.d.ts","sourceRoot":"","sources":["../src/sighashParser.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,WAAW,cAAc;IAC9B,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAA;IAChB,iCAAiC;IACjC,WAAW,EAAE,MAAM,CAAA;CACnB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,GAAG,cAAc,GAAG,IAAI,CA2BhF"}

package/dist/sighashParser.js

@@ -0,0 +1,85 @@
+import { Utils } from '@bsv/sdk';
+/**
+ * Minimum size for a BIP-143 preimage:
+ *   4 (version) + 32 (hashPrevouts) + 32 (hashSequence)
+ * + 36 (outpoint) + 1 (varint scriptCodeLen, min) + 0 (empty scriptCode allowed)
+ * + 8 (value) + 4 (nSequence) + 32 (hashOutputs) + 4 (nLockTime) + 4 (nHashType)
+ * = 157 bytes.
+ *
+ * Anything shorter cannot be a BIP-143 preimage; treat as standalone signing.
+ */
+export const MIN_BIP143_PREIMAGE_BYTES = 157;
+/**
+ * Parse a BIP-143 preimage and extract the input outpoint and hashOutputs.
+ *
+ * Returns null if the buffer is shorter than {@link MIN_BIP143_PREIMAGE_BYTES}
+ * or if varint decoding runs off the end. The caller treats null as
+ * "not a BIP-143 preimage; prompt the user."
+ */
+export function parsePreimage(data) {
+    const buf = data instanceof Uint8Array ? Array.from(data) : data;
+    if (buf.length < MIN_BIP143_PREIMAGE_BYTES)
+        return null;
+    // Outpoint at offset 68: 32-byte txid (LE) + 4-byte vout (LE).
+    const txidBytes = buf.slice(68, 100).reverse();
+    const txid = Utils.toHex(txidBytes);
+    const vout = buf[100] | (buf[101] << 8) | (buf[102] << 16) | (buf[103] << 24);
+    // Varint scriptCode length at offset 104.
+    const varint = readVarint(buf, 104);
+    if (!varint)
+        return null;
+    const scriptCodeStart = 104 + varint.size;
+    const scriptCodeEnd = scriptCodeStart + varint.value;
+    if (scriptCodeEnd > buf.length)
+        return null;
+    // After scriptCode: 8 bytes value, 4 bytes nSequence, 32 bytes hashOutputs.
+    const hashOutputsStart = scriptCodeEnd + 8 + 4;
+    const hashOutputsEnd = hashOutputsStart + 32;
+    if (hashOutputsEnd > buf.length)
+        return null;
+    const hashOutputs = Utils.toHex(buf.slice(hashOutputsStart, hashOutputsEnd));
+    return {
+        outpoint: `${txid}.${vout >>> 0}`,
+        hashOutputs,
+    };
+}
+function readVarint(buf, offset) {
+    if (offset >= buf.length)
+        return null;
+    const first = buf[offset];
+    if (first < 0xfd)
+        return { value: first, size: 1 };
+    if (first === 0xfd) {
+        if (offset + 2 >= buf.length)
+            return null;
+        return {
+            value: buf[offset + 1] | (buf[offset + 2] << 8),
+            size: 3,
+        };
+    }
+    if (first === 0xfe) {
+        if (offset + 4 >= buf.length)
+            return null;
+        return {
+            value: (buf[offset + 1] |
+                (buf[offset + 2] << 8) |
+                (buf[offset + 3] << 16) |
+                (buf[offset + 4] << 24)) >>>
+                0,
+            size: 5,
+        };
+    }
+    // 0xff — 8-byte varint. JS numbers safely represent up to 2^53. ScriptCode
+    // lengths in the wild won't approach that; reject if it would.
+    if (offset + 8 >= buf.length)
+        return null;
+    let value = 0;
+    for (let i = 0; i < 8; i++) {
+        const byte = buf[offset + 1 + i];
+        if (i >= 6 && byte !== 0)
+            return null;
+        value += byte * 2 ** (8 * i);
+    }
+    return { value, size: 9 };
+}
+//# sourceMappingURL=sighashParser.js.map

package/dist/sighashParser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sighashParser.js","sourceRoot":"","sources":["../src/sighashParser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,UAAU,CAAA;AAYhC;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,IAA2B;IACxD,MAAM,GAAG,GAAG,IAAI,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IAChE,IAAI,GAAG,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAA;IAEvD,+DAA+D;IAC/D,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,OAAO,EAAE,CAAA;IAC9C,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,IAAI,GACT,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAA;IAEjE,0CAA0C;IAC1C,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAA;IACnC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACxB,MAAM,eAAe,GAAG,GAAG,GAAG,MAAM,CAAC,IAAI,CAAA;IACzC,MAAM,aAAa,GAAG,eAAe,GAAG,MAAM,CAAC,KAAK,CAAA;IACpD,IAAI,aAAa,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAE3C,4EAA4E;IAC5E,MAAM,gBAAgB,GAAG,aAAa,GAAG,CAAC,GAAG,CAAC,CAAA;IAC9C,MAAM,cAAc,GAAG,gBAAgB,GAAG,EAAE,CAAA;IAC5C,IAAI,cAAc,GAAG,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAE5C,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAC,CAAA;IAC5E,OAAO;QACN,QAAQ,EAAE,GAAG,IAAI,IAAI,IAAI,KAAK,CAAC,EAAE;QACjC,WAAW;KACX,CAAA;AACF,CAAC;AAOD,SAAS,UAAU,CAAC,GAAa,EAAE,MAAc;IAChD,IAAI,MAAM,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACrC,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,CAAA;IACzB,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;IAClD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACzC,OAAO;YACN,KAAK,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;YAC/C,IAAI,EAAE,CAAC;SACP,CAAA;IACF,CAAC;IACD,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAA;QACzC,OAAO;YACN,KAAK,EACJ,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;gBACf,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;gBACtB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;gBACvB,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;gBACzB,CAAC;YACF,IAAI,EAAE,CAAC;SACP,CAAA;IACF,CAAC;IACD,2EAA2E;IAC3E,+DAA+D;IAC/D,IAAI,MAAM,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IACzC,IAAI,KAAK,GAAG,CAAC,CAAA;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QACrC,KAAK,IAAI,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC7B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAA;AAC1B,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,67 @@
+import type { WalletInterface } from '@bsv/sdk';
+/**
+ * Default commitment cache TTL (seconds). After this window the captured
+ * hashOutputs commitment expires and any subsequent createSignature for
+ * the same originator will be treated as standalone (re-prompt) instead
+ * of auto-granted.
+ *
+ * Configurable per-module-instance via factory args.
+ */
+export declare const DEFAULT_COMMITMENT_TTL_SECONDS = 60;
+/** A single captured commitment from a createAction approval. */
+export interface CapturedCommitment {
+    /** BIP-143 hashOutputs (32 bytes, hex) of the approved transaction. */
+    hashOutputs: string;
+    /** `txid.vout` strings for every input the user authorized. */
+    authorizedOutpoints: Set<string>;
+    /** Wall-clock ms when the user approved. */
+    approvedAt: number;
+    /** WalletPermissionsManager reference returned from createAction. */
+    reference: string;
+}
+/** Kinds of prompts the module asks the host wallet to show. */
+export type PromptKind = 'transaction' | 'signature';
+/**
+ * Structured request handed to the wallet's promptHandler.
+ *
+ * The host wallet renders this via `@1sat/permission-module-ui`'s component
+ * (or its own UI) and resolves the returned Promise with `true` (approve)
+ * or `false` (reject).
+ */
+export interface PromptRequest {
+    kind: PromptKind;
+    originator: string;
+    /**
+     * Free-form context payload describing the operation. Shape is
+     * intentionally permissive so the SDK actions can ride additional
+     * detail through to the prompt without locking the schema.
+     */
+    intent: Record<string, unknown>;
+    /** Short human-readable summary line. Filled in by the module. */
+    summary: string;
+}
+/**
+ * Callback the host wallet provides for showing prompts and awaiting
+ * the user's decision.
+ */
+export type PromptHandler = (request: PromptRequest) => Promise<boolean>;
+/** Args accepted by `createOneSatPermissionModule`. */
+export interface CreateOneSatPermissionModuleArgs {
+    /**
+     * The underlying wallet (NOT the WalletPermissionsManager wrapper).
+     * The module uses this for placeholder substitution and any internal
+     * derivations that should bypass the permission flow.
+     */
+    wallet: WalletInterface;
+    /** UI callback for prompting the user. */
+    promptHandler: PromptHandler;
+    /** Optional override for commitment cache TTL (seconds). */
+    commitmentTtlSeconds?: number;
+    /**
+     * Originator string treated as the wallet itself. Calls from this
+     * originator auto-grant. Defaults to the WalletPermissionsManager
+     * `adminOriginator` value if your wallet wires it through.
+     */
+    adminOriginator?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE/C;;;;;;;GAOG;AACH,eAAO,MAAM,8BAA8B,KAAK,CAAA;AAEhD,iEAAiE;AACjE,MAAM,WAAW,kBAAkB;IAClC,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAA;IACnB,+DAA+D;IAC/D,mBAAmB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAA;IAChC,4CAA4C;IAC5C,UAAU,EAAE,MAAM,CAAA;IAClB,qEAAqE;IACrE,SAAS,EAAE,MAAM,CAAA;CACjB;AAED,gEAAgE;AAChE,MAAM,MAAM,UAAU,GAAG,aAAa,GAAG,WAAW,CAAA;AAEpD;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB;;;;OAIG;IACH,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAA;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;AAExE,uDAAuD;AACvD,MAAM,WAAW,gCAAgC;IAChD;;;;OAIG;IACH,MAAM,EAAE,eAAe,CAAA;IACvB,0CAA0C;IAC1C,aAAa,EAAE,aAAa,CAAA;IAC5B,4DAA4D;IAC5D,oBAAoB,CAAC,EAAE,MAAM,CAAA;IAC7B;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;CACxB"}

package/dist/types.js

@@ -0,0 +1,10 @@
+/**
+ * Default commitment cache TTL (seconds). After this window the captured
+ * hashOutputs commitment expires and any subsequent createSignature for
+ * the same originator will be treated as standalone (re-prompt) instead
+ * of auto-granted.
+ *
+ * Configurable per-module-instance via factory args.
+ */
+export const DEFAULT_COMMITMENT_TTL_SECONDS = 60;
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,8BAA8B,GAAG,EAAE,CAAA"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "@1sat/permission-module",
+  "version": "0.0.1",
+  "description": "1Sat permission module for WalletPermissionsManager — gates createSignature with hashOutputs commitments captured at createAction time",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "clean": "rm -rf dist",
+    "test": "bun test"
+  },
+  "keywords": [
+    "1sat",
+    "bsv",
+    "wallet",
+    "permissions",
+    "brc-0098"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@1sat/types": "0.0.22",
+    "@1sat/actions": "0.0.133"
+  },
+  "peerDependencies": {
+    "@bsv/sdk": "^2.0.13",
+    "@bsv/wallet-toolbox": "npm:@bopen-io/wallet-toolbox@2.1.21-parity-fix.2"
+  },
+  "devDependencies": {
+    "@bsv/sdk": "^2.0.13",
+    "typescript": "^5.9.3"
+  }
+}