@1sat/wallet-toolbox 0.0.75 → 0.0.76

package/dist/api/broadcast/index.js

@@ -65,8 +65,9 @@ export const broadcast = {
             return { txid };
         }
         catch (error) {
+            console.error("[broadcast]", error);
             return {
-                error: error instanceof Error ? error.message : "Unknown error",
+                error: error instanceof Error ? error.message : "unknown-error",
             };
         }
     },

package/dist/api/inscriptions/index.js

@@ -101,6 +101,7 @@ export const inscribe = {
             };
         }
         catch (error) {
+            console.error("[inscribe]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/locks/index.js

@@ -143,6 +143,7 @@ export const lockBsv = {
             };
         }
         catch (error) {
+            console.error("[lockBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -280,6 +281,7 @@ export const unlockBsv = {
             };
         }
         catch (error) {
+            console.error("[unlockBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/ordinals/index.js

@@ -454,6 +454,7 @@ export const transferOrdinals = {
             };
         }
         catch (error) {
+            console.error("[transferOrdinals]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -523,6 +524,7 @@ export const listOrdinal = {
             };
         }
         catch (error) {
+            console.error("[listOrdinal]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -661,6 +663,7 @@ export const cancelListing = {
             };
         }
         catch (error) {
+            console.error("[cancelListing]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -827,6 +830,7 @@ export const purchaseOrdinal = {
             };
         }
         catch (error) {
+            console.error("[purchaseOrdinal]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/payments/index.js

@@ -126,6 +126,7 @@ export const sendBsv = {
             };
         }
         catch (error) {
+            console.error("[sendBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -178,6 +179,7 @@ export const sendAllBsv = {
             };
         }
         catch (error) {
+            console.error("[sendAllBsv]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/signing/index.js

@@ -67,6 +67,7 @@ export const signMessage = {
             };
         }
         catch (error) {
+            console.error("[signMessage]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/sweep/index.js

@@ -216,10 +216,11 @@ export const sweepBsv = {
             };
         }
         catch (error) {
+            console.error("[sweepBsv]", error);
             // Log detailed error info for WERR_REVIEW_ACTIONS
             if (error && typeof error === "object" && "sendWithResults" in error) {
                 const werr = error;
-                console.error("[sweep] WERR_REVIEW_ACTIONS details:", {
+                console.error("[sweepBsv] WERR_REVIEW_ACTIONS details:", {
                     message: werr.message,
                     txid: werr.txid,
                     sendWithResults: JSON.stringify(werr.sendWithResults, null, 2),
@@ -509,6 +510,7 @@ export const sweepOrdinals = {
             };
         }
         catch (error) {
+            console.error("[sweepOrdinals]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -588,6 +590,16 @@ export const sweepBsv21 = {
                 return { error: "token-not-active" };
             }
             const { fee_address, fee_per_output } = tokenDetails.status;
+            // Validate all input outpoints exist in the overlay
+            const candidateOutpoints = inputs.map((i) => i.outpoint);
+            const validated = await ctx.services.bsv21.validateOutputs(tokenId, candidateOutpoints, { unspent: true });
+            const validSet = new Set(validated.map((v) => v.outpoint));
+            const invalidInputs = inputs.filter((i) => !validSet.has(i.outpoint));
+            if (invalidInputs.length > 0) {
+                return {
+                    error: `unvalidated-inputs: ${invalidInputs.map((i) => i.outpoint).join(", ")}`,
+                };
+            }
             // Parse WIF
             const privateKey = PrivateKey.fromWif(wif);
             // Sum all input amounts
@@ -635,7 +647,15 @@ export const sweepBsv21 = {
                 satoshis: 1,
                 outputDescription: `Sweep ${totalAmount} tokens`,
                 basket: BSV21_BASKET,
-                tags: [`id:${tokenId}`, `amt:${totalAmount}`],
+                tags: [
+                    `id:${tokenId}`,
+                    `amt:${totalAmount}`,
+                    `dec:${tokenDetails.token.dec}`,
+                    ...(tokenDetails.token.sym ? [`sym:${tokenDetails.token.sym}`] : []),
+                    ...(tokenDetails.token.icon
+                        ? [`icon:${tokenDetails.token.icon}`]
+                        : []),
+                ],
                 customInstructions: JSON.stringify({
                     protocolID: BSV21_PROTOCOL,
                     keyID,
@@ -716,6 +736,7 @@ export const sweepBsv21 = {
             };
         }
         catch (error) {
+            console.error("[sweepBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/api/tokens/index.js

@@ -5,8 +5,7 @@
  */
 import { BSV21, OrdLock } from "@bopen-io/templates";
 import { BigNumber, LockingScript, OP, P2PKH, PublicKey, Transaction, TransactionSignature, UnlockingScript, Utils, } from "@bsv/sdk";
-import { deriveFundAddress } from "../../indexers";
-import { BSV21_BASKET, BSV21_FEE_SATS, BSV21_PROTOCOL } from "../constants";
+import { BSV21_BASKET, BSV21_PROTOCOL } from "../constants";
 // ============================================================================
 // Internal helpers
 // ============================================================================
@@ -105,31 +104,19 @@ export const getBsv21Balances = {
             const amtTag = o.tags?.find((t) => t.startsWith("amt:"))?.slice(4);
             if (!idTag || !amtTag)
                 continue;
-            const idContent = idTag.slice(3);
-            const lastColonIdx = idContent.lastIndexOf(":");
-            if (lastColonIdx === -1)
-                continue;
-            const tokenId = idContent.slice(0, lastColonIdx);
-            const status = idContent.slice(lastColonIdx + 1);
-            if (status === "invalid")
-                continue;
-            const isConfirmed = status === "valid";
+            const tokenId = idTag.slice(3);
             const amt = BigInt(amtTag);
             const dec = Number.parseInt(o.tags?.find((t) => t.startsWith("dec:"))?.slice(4) || "0", 10);
             const symTag = o.tags?.find((t) => t.startsWith("sym:"))?.slice(4);
             const iconTag = o.tags?.find((t) => t.startsWith("icon:"))?.slice(5);
             const existing = balanceMap.get(tokenId);
             if (existing) {
-                if (isConfirmed)
-                    existing.confirmed += amt;
-                else
-                    existing.pending += amt;
+                existing.amt += amt;
             }
             else {
                 balanceMap.set(tokenId, {
                     id: tokenId,
-                    confirmed: isConfirmed ? amt : 0n,
-                    pending: isConfirmed ? 0n : amt,
+                    amt,
                     sym: symTag,
                     icon: iconTag,
                     dec,
@@ -140,11 +127,11 @@ export const getBsv21Balances = {
             p: "bsv-20",
             op: "transfer",
             dec: b.dec,
-            amt: (b.confirmed + b.pending).toString(),
+            amt: b.amt.toString(),
             id: b.id,
             sym: b.sym,
             icon: b.icon,
-            all: { confirmed: b.confirmed, pending: b.pending },
+            all: { confirmed: b.amt, pending: 0n },
             listed: { confirmed: 0n, pending: 0n },
         }));
     },
@@ -191,6 +178,14 @@ export const sendBsv21 = {
                 !/^\d+$/.test(parts[1])) {
                 return { error: "invalid-token-id-format" };
             }
+            if (!ctx.services) {
+                return { error: "services-required" };
+            }
+            const tokenDetails = await ctx.services.bsv21.getTokenDetails(tokenId);
+            if (!tokenDetails.status.is_active) {
+                return { error: "token-not-active" };
+            }
+            const { fee_address, fee_per_output } = tokenDetails.status;
             const result = await ctx.wallet.listOutputs({
                 basket: BSV21_BASKET,
                 includeTags: true,
@@ -201,16 +196,24 @@ export const sendBsv21 = {
                 const idTag = o.tags?.find((t) => t.startsWith("id:"));
                 if (!idTag)
                     return false;
-                const idContent = idTag.slice(3);
-                const lastColonIdx = idContent.lastIndexOf(":");
-                if (lastColonIdx === -1)
-                    return false;
-                const id = idContent.slice(0, lastColonIdx);
-                const status = idContent.slice(lastColonIdx + 1);
-                return id === tokenId && status !== "invalid";
+                return idTag.slice(3) === tokenId;
             });
-            if (tokenUtxos.length === 0) {
-                return { error: "no-token-utxos-found" };
+            // Batch-validate all candidate outpoints against the overlay
+            const validOutpoints = new Set();
+            let overlayValidated = false;
+            if (ctx.services?.bsv21) {
+                const candidateOutpoints = tokenUtxos.map((o) => o.outpoint);
+                try {
+                    const validated = await ctx.services.bsv21.validateOutputs(tokenId, candidateOutpoints, { unspent: true });
+                    overlayValidated = true;
+                    for (const v of validated) {
+                        validOutpoints.add(v.outpoint);
+                    }
+                }
+                catch (e) {
+                    console.error("[sendBsv21] overlay validation error:", e);
+                    return { error: "overlay-validation-failed" };
+                }
             }
             const selected = [];
             let totalIn = 0n;
@@ -221,23 +224,15 @@ export const sendBsv21 = {
                 if (!amtTag)
                     continue;
                 const utxoAmount = BigInt(amtTag.slice(4));
-                if (ctx.services?.bsv21) {
-                    try {
-                        const [txid] = utxo.outpoint.split("_");
-                        const validation = await ctx.services.bsv21.getTokenByTxid(tokenId, txid);
-                        const outputData = validation.outputs.find((o) => `${validation.txid}_${o.vout}` === utxo.outpoint);
-                        if (!outputData)
-                            continue;
-                    }
-                    catch {
-                        continue;
-                    }
+                // Skip UTXOs not confirmed in the overlay
+                if (overlayValidated && !validOutpoints.has(utxo.outpoint)) {
+                    continue;
                 }
                 selected.push(utxo);
                 totalIn += utxoAmount;
             }
             if (totalIn < amount) {
-                return { error: "insufficient-validated-tokens" };
+                return { error: "insufficient-tokens" };
             }
             let recipientAddress;
             if (counterparty) {
@@ -267,16 +262,10 @@ export const sendBsv21 = {
                 satoshis: 1,
                 outputDescription: `Send ${amount} tokens`,
             });
-            // Fee output to overlay fund address
-            const fundAddress = deriveFundAddress(tokenId);
-            outputs.push({
-                lockingScript: p2pkh.lock(fundAddress).toHex(),
-                satoshis: BSV21_FEE_SATS,
-                outputDescription: "Overlay processing fee",
-                tags: [],
-            });
             const change = totalIn - amount;
+            let tokenOutputCount = 1;
             if (change > 0n) {
+                tokenOutputCount = 2;
                 const changeKeyID = `${tokenId}-${Date.now()}`;
                 const { publicKey } = await ctx.wallet.getPublicKey({
                     protocolID: BSV21_PROTOCOL,
@@ -292,15 +281,31 @@ export const sendBsv21 = {
                     satoshis: 1,
                     outputDescription: "Token change",
                     basket: BSV21_BASKET,
-                    tags: [`id:${tokenId}`, `amt:${change}`],
+                    tags: [
+                        `id:${tokenId}`,
+                        `amt:${change}`,
+                        `dec:${tokenDetails.token.dec}`,
+                        ...(tokenDetails.token.sym
+                            ? [`sym:${tokenDetails.token.sym}`]
+                            : []),
+                        ...(tokenDetails.token.icon
+                            ? [`icon:${tokenDetails.token.icon}`]
+                            : []),
+                    ],
                     customInstructions: JSON.stringify({
                         protocolID: BSV21_PROTOCOL,
                         keyID: changeKeyID,
                     }),
                 });
             }
-            const symTag = tokenUtxos[0]?.tags?.find((t) => t.startsWith("sym:"));
-            const symbol = symTag ? symTag.slice(4) : tokenId.slice(0, 8);
+            // Fee output to overlay fund address (per token output)
+            outputs.push({
+                lockingScript: p2pkh.lock(fee_address).toHex(),
+                satoshis: fee_per_output * tokenOutputCount,
+                outputDescription: "Overlay processing fee",
+                tags: [],
+            });
+            const symbol = tokenDetails.token.sym || tokenId.slice(0, 8);
             const createResult = await ctx.wallet.createAction({
                 description: `Send ${amount} ${symbol}`,
                 inputs: selected.map((o) => ({
@@ -340,6 +345,7 @@ export const sendBsv21 = {
             };
         }
         catch (error) {
+            console.error("[sendBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };
@@ -393,11 +399,13 @@ export const purchaseBsv21 = {
             const [txid, voutStr] = parts;
             const vout = Number.parseInt(voutStr, 10);
             try {
-                await ctx.services.bsv21.getTokenByTxid(tokenId, txid);
+                await ctx.services.bsv21.validateOutput(tokenId, outpoint);
             }
-            catch {
+            catch (e) {
+                console.error("[purchaseBsv21] overlay validation error:", e);
                 return { error: "listing-not-found-in-overlay" };
             }
+            const tokenDetails = await ctx.services.bsv21.getTokenDetails(tokenId);
             const beef = await ctx.services.getBeefForTxid(txid);
             const listingBeefTx = beef.findTxid(txid);
             if (!listingBeefTx?.tx) {
@@ -428,7 +436,15 @@ export const purchaseBsv21 = {
                 satoshis: 1,
                 outputDescription: "Purchased tokens",
                 basket: BSV21_BASKET,
-                tags: [`id:${tokenId}`, `amt:${tokenAmount}`],
+                tags: [
+                    `id:${tokenId}`,
+                    `amt:${tokenAmount}`,
+                    `dec:${tokenDetails.token.dec}`,
+                    ...(tokenDetails.token.sym ? [`sym:${tokenDetails.token.sym}`] : []),
+                    ...(tokenDetails.token.icon
+                        ? [`icon:${tokenDetails.token.icon}`]
+                        : []),
+                ],
                 customInstructions: JSON.stringify({
                     protocolID: BSV21_PROTOCOL,
                     keyID: bsv21KeyID,
@@ -456,6 +472,15 @@ export const purchaseBsv21 = {
                     });
                 }
             }
+            // Fee output to overlay fund address
+            if (tokenDetails.status.is_active) {
+                outputs.push({
+                    lockingScript: p2pkh.lock(tokenDetails.status.fee_address).toHex(),
+                    satoshis: tokenDetails.status.fee_per_output,
+                    outputDescription: "Overlay processing fee",
+                    tags: [],
+                });
+            }
             const createResult = await ctx.wallet.createAction({
                 description: `Purchase ${tokenAmount} tokens for ${payoutSatoshis} sats`,
                 inputBEEF: beef.toBinary(),
@@ -503,6 +528,7 @@ export const purchaseBsv21 = {
             };
         }
         catch (error) {
+            console.error("[purchaseBsv21]", error);
             return {
                 error: error instanceof Error ? error.message : "unknown-error",
             };

package/dist/indexers/Bsv21Indexer.js

@@ -77,8 +77,7 @@ export class Bsv21Indexer extends Indexer {
             return;
         const tags = [];
         if (txo.owner && this.owners.has(txo.owner)) {
-            // Use id:tokenId:status format for querying by token and status
-            tags.push(`id:${bsv21.id}:${bsv21.status}`);
+            tags.push(`id:${bsv21.id}`);
             tags.push(`amt:${bsv21.amt.toString()}`);
             // Add metadata tags for efficient querying
             if (bsv21.sym)

package/dist/services/client/Bsv21Client.d.ts

@@ -1,5 +1,23 @@
 import type { Bsv21TransactionData, ClientOptions, IndexedOutput, TokenDetailResponse } from "../types";
 import { BaseClient } from "./BaseClient";
+/**
+ * Query options for /outputs validation endpoints.
+ * All flags default to false on the server.
+ */
+export interface OutputQueryOptions {
+    /** Filter for unspent outputs only */
+    unspent?: boolean;
+    /** Include spend txid */
+    spend?: boolean;
+    /** Include satoshis */
+    sats?: boolean;
+    /** Include events array */
+    events?: boolean;
+    /** Include block info */
+    block?: boolean;
+    /** Comma-separated data tags to include (e.g. 'bsv21') */
+    tags?: string;
+}
 /**
  * Client for /1sat/bsv21/* routes.
  * Provides BSV21 token queries.
@@ -66,6 +84,24 @@ export declare class Bsv21Client extends BaseClient {
      * @param addresses - Array of addresses (max 100)
      */
     getHistoryMulti(tokenId: string, lockType: string, addresses: string[]): Promise<IndexedOutput[]>;
+    /**
+     * Validate specific outpoints against the token's overlay topic.
+     * Returns only those found in the overlay. By default returns minimal data
+     * (outpoint + score). Use opts to include additional fields.
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoints - Array of outpoints to validate (max 1000)
+     * @param opts - Optional query flags for additional data
+     */
+    validateOutputs(tokenId: string, outpoints: string[], opts?: OutputQueryOptions): Promise<IndexedOutput[]>;
+    /**
+     * Validate a single outpoint against the token's overlay topic.
+     * Returns 404 if not found. By default returns minimal data (outpoint + score).
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoint - Outpoint to validate (txid_vout or txid:vout)
+     * @param opts - Optional query flags for additional data
+     */
+    validateOutput(tokenId: string, outpoint: string, opts?: OutputQueryOptions): Promise<IndexedOutput>;
+    private buildOutputQuery;
     /**
      * Clear the token details cache
      */

package/dist/services/client/Bsv21Client.js

@@ -100,6 +100,51 @@ export class Bsv21Client extends BaseClient {
             body: JSON.stringify(addresses),
         });
     }
+    /**
+     * Validate specific outpoints against the token's overlay topic.
+     * Returns only those found in the overlay. By default returns minimal data
+     * (outpoint + score). Use opts to include additional fields.
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoints - Array of outpoints to validate (max 1000)
+     * @param opts - Optional query flags for additional data
+     */
+    async validateOutputs(tokenId, outpoints, opts) {
+        const params = this.buildOutputQuery(opts);
+        return this.request(`/${tokenId}/outputs${params}`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify(outpoints),
+        });
+    }
+    /**
+     * Validate a single outpoint against the token's overlay topic.
+     * Returns 404 if not found. By default returns minimal data (outpoint + score).
+     * @param tokenId - Token ID (txid_vout format)
+     * @param outpoint - Outpoint to validate (txid_vout or txid:vout)
+     * @param opts - Optional query flags for additional data
+     */
+    async validateOutput(tokenId, outpoint, opts) {
+        const params = this.buildOutputQuery(opts);
+        return this.request(`/${tokenId}/outputs/${outpoint}${params}`);
+    }
+    buildOutputQuery(opts) {
+        if (!opts)
+            return "";
+        const parts = [];
+        if (opts.unspent)
+            parts.push("unspent=true");
+        if (opts.spend)
+            parts.push("spend=true");
+        if (opts.sats)
+            parts.push("sats=true");
+        if (opts.events)
+            parts.push("events=true");
+        if (opts.block)
+            parts.push("block=true");
+        if (opts.tags)
+            parts.push(`tags=${encodeURIComponent(opts.tags)}`);
+        return parts.length > 0 ? `?${parts.join("&")}` : "";
+    }
     /**
      * Clear the token details cache
      */

package/dist/services/client/index.d.ts

@@ -5,5 +5,5 @@ export { ArcadeClient } from "./ArcadeClient";
 export { TxoClient } from "./TxoClient";
 export { OwnerClient } from "./OwnerClient";
 export { OrdfsClient } from "./OrdfsClient";
-export { Bsv21Client } from "./Bsv21Client";
+export { Bsv21Client, type OutputQueryOptions } from "./Bsv21Client";
 export { OverlayClient } from "./OverlayClient";

package/dist/wallet/factory.d.ts

@@ -5,7 +5,7 @@
  * (browser extension) and 1sat-website (React app).
  */
 import { PrivateKey } from "@bsv/sdk";
-import { Monitor, type PermissionsManagerConfig, StorageClient, Wallet, WalletPermissionsManager, WalletStorageManager } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
+import { Monitor, StorageClient, Wallet, WalletStorageManager } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
 import { OneSatServices } from "../services/OneSatServices";
 import { type FullSyncResult, type FullSyncStage } from "./fullSync";
 type Chain = "main" | "test";
@@ -17,10 +17,6 @@ export interface WebWalletConfig {
     privateKey: PrivateKey | string;
     /** Network: 'main' or 'test' */
     chain: Chain;
-    /** Admin originator that bypasses permission checks (e.g., chrome-extension://id or https://wallet.example.com) */
-    adminOriginator: string;
-    /** Permission configuration for WalletPermissionsManager */
-    permissionsConfig: PermissionsManagerConfig;
     /** Fee model. Default: { model: 'sat/kb', value: 100 } */
     feeModel?: {
         model: "sat/kb";
@@ -39,10 +35,8 @@ export interface WebWalletConfig {
  * Result of wallet creation.
  */
 export interface WebWalletResult {
-    /** Wallet instance with permission management */
-    wallet: WalletPermissionsManager;
-    /** Underlying wallet without permission checks (for trusted contexts like sweep-ui) */
-    rawWallet: Wallet;
+    /** Wallet instance */
+    wallet: Wallet;
     /** 1Sat services for API access */
     services: OneSatServices;
     /** Monitor for transaction lifecycle (not started - call monitor.startTasks() when ready) */
@@ -57,15 +51,14 @@ export interface WebWalletResult {
     remoteStorage?: StorageClient;
 }
 /**
- * Create a web wallet with storage, services, permissions, and monitor.
+ * Create a web wallet with storage, services, and monitor.
  *
  * @example
  * ```typescript
  * const { wallet, services, monitor, destroy } = await createWebWallet({
  *   privateKey: identityWif,
  *   chain: 'main',
- *   adminOriginator: 'https://wallet.example.com',
- *   permissionsConfig: DEFAULT_PERMISSIONS_CONFIG,
+ *   storageIdentityKey: 'device-unique-id',
  * });
  *
  * // Wire up monitor callbacks

package/dist/wallet/factory.js

@@ -5,7 +5,7 @@
  * (browser extension) and 1sat-website (React app).
  */
 import { KeyDeriver, PrivateKey } from "@bsv/sdk";
-import { Monitor, Services, StorageClient, StorageIdb, StorageProvider, Wallet, WalletPermissionsManager, WalletStorageManager, } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
+import { Monitor, Services, StorageClient, StorageIdb, StorageProvider, Wallet, WalletStorageManager, } from "@bsv/wallet-toolbox-mobile/out/src/index.client.js";
 import { OneSatServices } from "../services/OneSatServices";
 import { fullSync } from "./fullSync";
 // Default database name for IndexedDB storage
@@ -39,15 +39,14 @@ function parsePrivateKey(input) {
     }
 }
 /**
- * Create a web wallet with storage, services, permissions, and monitor.
+ * Create a web wallet with storage, services, and monitor.
  *
  * @example
  * ```typescript
  * const { wallet, services, monitor, destroy } = await createWebWallet({
  *   privateKey: identityWif,
  *   chain: 'main',
- *   adminOriginator: 'https://wallet.example.com',
- *   permissionsConfig: DEFAULT_PERMISSIONS_CONFIG,
+ *   storageIdentityKey: 'device-unique-id',
  * });
  *
  * // Wire up monitor callbacks
@@ -58,7 +57,7 @@ function parsePrivateKey(input) {
  * ```
  */
 export async function createWebWallet(config) {
-    const { chain, adminOriginator, permissionsConfig } = config;
+    const { chain } = config;
     const feeModel = config.feeModel ?? DEFAULT_FEE_MODEL;
     // 1. Parse private key and create KeyDeriver
     const privateKey = parsePrivateKey(config.privateKey);
@@ -75,8 +74,8 @@ export async function createWebWallet(config) {
     // 4. Create storage manager with local-only storage initially (empty backups)
     const storage = new WalletStorageManager(identityPubKey, localStorage, []);
     await storage.makeAvailable();
-    // 5. Create the underlying Wallet FIRST (needed for StorageClient signing)
-    const underlyingWallet = new Wallet({
+    // 5. Create wallet (needed before StorageClient for signing)
+    const wallet = new Wallet({
         chain,
         keyDeriver,
         storage,
@@ -89,7 +88,7 @@ export async function createWebWallet(config) {
     if (config.remoteStorageUrl) {
         console.log(`[createWebWallet] Attempting remote storage connection to ${config.remoteStorageUrl}`);
         try {
-            remoteClient = new StorageClient(underlyingWallet, config.remoteStorageUrl);
+            remoteClient = new StorageClient(wallet, config.remoteStorageUrl);
             const timeoutPromise = new Promise((_, reject) => setTimeout(() => reject(new Error("Remote storage connection timeout")), DEFAULT_REMOTE_STORAGE_TIMEOUT));
             await Promise.race([remoteClient.makeAvailable(), timeoutPromise]);
             // Add remote to storage manager - it will partition as conflicting if another device is active
@@ -137,8 +136,8 @@ export async function createWebWallet(config) {
     // bypass the monitor's onTransactionBroadcasted callback. We detect broadcasts
     // by checking for txid in the result and sync to backup immediately.
     if (remoteClient) {
-        const originalCreateAction = underlyingWallet.createAction.bind(underlyingWallet);
-        underlyingWallet.createAction = async (args) => {
+        const originalCreateAction = wallet.createAction.bind(wallet);
+        wallet.createAction = async (args) => {
             const result = await originalCreateAction(args);
             if (result.txid) {
                 console.log("[createWebWallet] Broadcast detected in createAction:", result.txid);
@@ -148,8 +147,8 @@ export async function createWebWallet(config) {
             }
             return result;
         };
-        const originalSignAction = underlyingWallet.signAction.bind(underlyingWallet);
-        underlyingWallet.signAction = async (args) => {
+        const originalSignAction = wallet.signAction.bind(wallet);
+        wallet.signAction = async (args) => {
             const result = await originalSignAction(args);
             if (result.txid) {
                 console.log("[createWebWallet] Broadcast detected in signAction:", result.txid);
@@ -160,9 +159,7 @@ export async function createWebWallet(config) {
             return result;
         };
     }
-    // 9. Wrap with permissions manager
-    const wallet = new WalletPermissionsManager(underlyingWallet, adminOriginator, permissionsConfig);
-    // 10. Create monitor (not started - consumer calls startTasks() when ready)
+    // 9. Create monitor (not started - consumer calls startTasks() when ready)
     const monitor = new Monitor({
         chain,
         services: oneSatServices,
@@ -228,7 +225,7 @@ export async function createWebWallet(config) {
     const destroy = async () => {
         monitor.stopTasks();
         await monitor.destroy();
-        await underlyingWallet.destroy();
+        await wallet.destroy();
     };
     // 13. Create fullSync function if remote storage is connected
     const fullSyncFn = remoteClient
@@ -243,7 +240,6 @@ export async function createWebWallet(config) {
         : undefined;
     return {
         wallet,
-        rawWallet: underlyingWallet,
         services: oneSatServices,
         monitor,
         destroy,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/wallet-toolbox",
-  "version": "0.0.75",
+  "version": "0.0.76",
   "description": "BSV wallet library extending @bsv/wallet-toolbox with 1Sat Ordinals protocol support",
   "author": "1Sat Team",
   "license": "MIT",