@1sat/wallet 0.0.40 → 0.0.42

package/dist/index.d.ts

@@ -8,4 +8,6 @@ export { FileBackupProvider, FileRestoreReader, Zip, ZipDeflate, unzip, type Bac
 export { ChromeCWI, CWIEventName, EventCWI, createChromeCWI, createCWI, createEventCWI, createSigmaCWI, createWebCWI, type CWIResponseDetail, type CWITransport, type SigmaCWIConfig, type SigmaCWIResult, type WebCWIConfig, type WebCWIResult, } from './cwi';
 export { parsePrivateKey } from './parsePrivateKey';
 export { createWalletCore, DEFAULT_FEE_MODEL, DEFAULT_CONNECTION_TIMEOUT, type Chain, type WalletCoreConfig, type WalletCoreResult, } from './factory';
+export { filterGroupedByMissing, InMemoryPermissionStore, isExpired, normalizeOriginator, PermissionLedgerAdapter, permissionKeyFromRequest, permissionKeysFromGroup, permissionKeyToString, } from './permissions';
+export type { CounterpartyPermissionPromptDecision, GroupedPermissionPromptDecision, IPermissionStore, ListGrantsFilter, PermissionKey, PermissionLedgerAdapterOptions, PermissionPromptDecision, PermissionPromptHandler, PermissionRecord, PermissionRecordSource, PermissionType, StoredGrant, } from './permissions';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,UAAU,GACV,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAGzD,OAAO,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,GACT,MAAM,cAAc,CAAA;AAGrB,OAAO,EACN,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,GAAG,GACR,MAAM,YAAY,CAAA;AAGnB,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,iBAAiB,GACtB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,UAAU,EACV,KAAK,EACL,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,QAAQ,GACb,MAAM,UAAU,CAAA;AAGjB,OAAO,EACN,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,GACjB,MAAM,OAAO,CAAA;AAMd,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACrB,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAC7C,YAAY,EACX,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,UAAU,EACV,aAAa,EACb,UAAU,GACV,MAAM,aAAa,CAAA;AAGpB,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAGzD,OAAO,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,GACT,MAAM,cAAc,CAAA;AAGrB,OAAO,EACN,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,EACZ,KAAK,KAAK,EACV,KAAK,UAAU,EACf,KAAK,IAAI,EACT,KAAK,SAAS,EACd,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,KAAK,EACV,KAAK,GAAG,GACR,MAAM,YAAY,CAAA;AAGnB,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,EACZ,KAAK,iBAAiB,GACtB,MAAM,gBAAgB,CAAA;AAGvB,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,UAAU,EACV,KAAK,EACL,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,KAAK,mBAAmB,EACxB,KAAK,QAAQ,GACb,MAAM,UAAU,CAAA;AAGjB,OAAO,EACN,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,EACZ,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,YAAY,GACjB,MAAM,OAAO,CAAA;AAMd,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,EAC1B,KAAK,KAAK,EACV,KAAK,gBAAgB,EACrB,KAAK,gBAAgB,GACrB,MAAM,WAAW,CAAA;AAGlB,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,eAAe,CAAA;AACtB,YAAY,EACX,oCAAoC,EACpC,+BAA+B,EAC/B,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,8BAA8B,EAC9B,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,WAAW,GACX,MAAM,eAAe,CAAA"}

package/dist/index.js

@@ -18,4 +18,6 @@ export { ChromeCWI, CWIEventName, EventCWI, createChromeCWI, createCWI, createEv
 export { parsePrivateKey } from './parsePrivateKey';
 // Factory core
 export { createWalletCore, DEFAULT_FEE_MODEL, DEFAULT_CONNECTION_TIMEOUT, } from './factory';
+// Permissions (BRC-100 permission ledger + adapter)
+export { filterGroupedByMissing, InMemoryPermissionStore, isExpired, normalizeOriginator, PermissionLedgerAdapter, permissionKeyFromRequest, permissionKeysFromGroup, permissionKeyToString, } from './permissions';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAU7C,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,cAAc;AACd,OAAO,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,GACT,MAAM,cAAc,CAAA;AAErB,WAAW;AACX,OAAO,EACN,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,GAYZ,MAAM,YAAY,CAAA;AAEnB,eAAe;AACf,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GAEZ,MAAM,gBAAgB,CAAA;AAEvB,SAAS;AACT,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,UAAU,EACV,KAAK,GAKL,MAAM,UAAU,CAAA;AAEjB,+BAA+B;AAC/B,OAAO,EACN,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,GAOZ,MAAM,OAAO,CAAA;AAEd,8EAA8E;AAC9E,sDAAsD;AAEtD,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,eAAe;AACf,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,GAI1B,MAAM,WAAW,CAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,WAAW;AACX,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAU7C,UAAU;AACV,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAA;AAEzD,cAAc;AACd,OAAO,EACN,YAAY,EACZ,UAAU,EACV,UAAU,EACV,WAAW,EACX,iBAAiB,EACjB,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,GACT,MAAM,cAAc,CAAA;AAErB,WAAW;AACX,OAAO,EACN,YAAY,EACZ,aAAa,EACb,iBAAiB,EACjB,WAAW,EACX,OAAO,EACP,kBAAkB,EAClB,WAAW,EACX,OAAO,EACP,UAAU,EACV,WAAW,EACX,cAAc,EACd,aAAa,EACb,QAAQ,EACR,YAAY,EACZ,YAAY,GAYZ,MAAM,YAAY,CAAA;AAEnB,eAAe;AACf,OAAO,EACN,cAAc,EACd,iBAAiB,EACjB,YAAY,GAEZ,MAAM,gBAAgB,CAAA;AAEvB,SAAS;AACT,OAAO,EACN,kBAAkB,EAClB,iBAAiB,EACjB,GAAG,EACH,UAAU,EACV,KAAK,GAKL,MAAM,UAAU,CAAA;AAEjB,+BAA+B;AAC/B,OAAO,EACN,SAAS,EACT,YAAY,EACZ,QAAQ,EACR,eAAe,EACf,SAAS,EACT,cAAc,EACd,cAAc,EACd,YAAY,GAOZ,MAAM,OAAO,CAAA;AAEd,8EAA8E;AAC9E,sDAAsD;AAEtD,oBAAoB;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,eAAe;AACf,OAAO,EACN,gBAAgB,EAChB,iBAAiB,EACjB,0BAA0B,GAI1B,MAAM,WAAW,CAAA;AAElB,oDAAoD;AACpD,OAAO,EACN,sBAAsB,EACtB,uBAAuB,EACvB,SAAS,EACT,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,eAAe,CAAA"}

package/dist/permissions/adapter.d.ts

@@ -0,0 +1,91 @@
+import type { WalletPermissionsManager } from '@bsv/wallet-toolbox';
+import type { IPermissionStore, PermissionKey, PermissionPromptHandler, PermissionRecord } from './types';
+export interface PermissionLedgerAdapterOptions {
+    /** The WPM instance to attach callbacks to. */
+    wallet: WalletPermissionsManager;
+    /** Persistent store for permission grants. */
+    store: IPermissionStore;
+    /** UI prompt callbacks. */
+    prompt: PermissionPromptHandler;
+}
+/**
+ * Bridges an {@link IPermissionStore} to a {@link WalletPermissionsManager}.
+ *
+ * The adapter owns WPM's permission callbacks. On every permission check:
+ *
+ *  1. It looks up a stored grant in the supplied store.
+ *  2. If a valid unexpired grant exists, it calls
+ *     `wallet.grantPermission({ ephemeral: true })` silently. WPM resolves
+ *     the pending dApp call without writing anything to the chain.
+ *  3. Otherwise it delegates to the host app's prompt handler. On approval,
+ *     it writes the grant to the store and calls `grantPermission` ephemerally.
+ *
+ * BRC-73 grouped permissions are handled via `dismissGroupedPermission` after
+ * writing each sub-permission to the store. WPM's downstream per-method checks
+ * then find the entries on their individual callback paths. When a site adds
+ * a new permission between visits, the prompt receives only the missing
+ * subset — already-granted permissions are not re-listed.
+ *
+ * DSAP (spending) cap enforcement reads actual confirmed spend from the
+ * wallet's action history via `WalletPermissionsManager.querySpentSince` —
+ * the same mechanism WPM uses natively. No ledger-side counter is
+ * maintained, so failed broadcasts cannot cause drift.
+ *
+ * Level-2 counterparty pacts (`onCounterpartyPermissionRequested`) remain
+ * on-chain: the adapter just routes the UI decision to WPM's native
+ * `grantCounterpartyPermission` / `denyCounterpartyPermission`. If the
+ * consumer omits `prompt.onCounterpartyPermissionRequested`, the adapter
+ * auto-denies counterparty requests so the dApp call fails cleanly instead
+ * of hanging forever.
+ *
+ * Call {@link dispose} to unbind callbacks when tearing down the wallet.
+ */
+export declare class PermissionLedgerAdapter {
+    private readonly wallet;
+    private readonly store;
+    private readonly prompt;
+    private boundCallbacks;
+    constructor(options: PermissionLedgerAdapterOptions);
+    private bindCallbacks;
+    /** Unbinds every callback this adapter registered on the wallet. */
+    dispose(): void;
+    private handleSingle;
+    private handleSpending;
+    private handleGrouped;
+    private handleCounterparty;
+    private safeDeny;
+    /**
+     * Return the full union of local (ledger) grants and on-chain WPM tokens.
+     *
+     * Under the default setup, the on-chain side contains only level-2
+     * counterparty pacts (and any pre-migration tokens that still exist).
+     * Records are tagged with `source: 'ledger' | 'onchain'` so the revoke
+     * handler can route correctly.
+     */
+    listAllPermissions(): Promise<PermissionRecord[]>;
+    /**
+     * Revoke a single ledger-backed grant.
+     *
+     * To revoke an on-chain (counterparty) token, call
+     * `wallet.revokePermission(token)` directly with the raw WPM token.
+     */
+    revokeLedgerGrant(key: PermissionKey): Promise<void>;
+    /**
+     * Revoke every grant for an originator across both stores.
+     *
+     * Returns counts of what was removed from each side.
+     */
+    revokeAllForOriginator(originator: string): Promise<{
+        ledger: number;
+        onchain: number;
+    }>;
+    /**
+     * Return the satoshi amount spent against the given DSAP grant in the
+     * current UTC month, read from the wallet's action history.
+     *
+     * Delegates to `WalletPermissionsManager.querySpentSince` for accuracy and
+     * cross-device consistency — the ledger does not track spend itself.
+     */
+    querySpent(key: PermissionKey): Promise<number>;
+}
+//# sourceMappingURL=adapter.d.ts.map

package/dist/permissions/adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../src/permissions/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAQX,wBAAwB,EAExB,MAAM,qBAAqB,CAAA;AAS5B,OAAO,KAAK,EACX,gBAAgB,EAChB,aAAa,EACb,uBAAuB,EACvB,gBAAgB,EAEhB,MAAM,SAAS,CAAA;AAEhB,MAAM,WAAW,8BAA8B;IAC9C,+CAA+C;IAC/C,MAAM,EAAE,wBAAwB,CAAA;IAChC,8CAA8C;IAC9C,KAAK,EAAE,gBAAgB,CAAA;IACvB,2BAA2B;IAC3B,MAAM,EAAE,uBAAuB,CAAA;CAC/B;AAQD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,qBAAa,uBAAuB;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0B;IACjD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IACxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,cAAc,CAAoC;gBAE9C,OAAO,EAAE,8BAA8B;IAOnD,OAAO,CAAC,aAAa;IAoBrB,oEAAoE;IACpE,OAAO,IAAI,IAAI;YAWD,YAAY;YAmCZ,cAAc;YAwDd,aAAa;YAgEb,kBAAkB;YA8BlB,QAAQ;IAQtB;;;;;;;OAOG;IACG,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;IAqCvD;;;;;OAKG;IACG,iBAAiB,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1D;;;;OAIG;IACG,sBAAsB,CAC3B,UAAU,EAAE,MAAM,GAChB,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAO/C;;;;;;OAMG;IACG,UAAU,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC;CAMrD"}

package/dist/permissions/adapter.js

@@ -0,0 +1,317 @@
+import { filterGroupedByMissing, isExpired, normalizeOriginator, permissionKeyFromRequest, permissionKeyToString, permissionKeysFromGroup, } from './key';
+/**
+ * Bridges an {@link IPermissionStore} to a {@link WalletPermissionsManager}.
+ *
+ * The adapter owns WPM's permission callbacks. On every permission check:
+ *
+ *  1. It looks up a stored grant in the supplied store.
+ *  2. If a valid unexpired grant exists, it calls
+ *     `wallet.grantPermission({ ephemeral: true })` silently. WPM resolves
+ *     the pending dApp call without writing anything to the chain.
+ *  3. Otherwise it delegates to the host app's prompt handler. On approval,
+ *     it writes the grant to the store and calls `grantPermission` ephemerally.
+ *
+ * BRC-73 grouped permissions are handled via `dismissGroupedPermission` after
+ * writing each sub-permission to the store. WPM's downstream per-method checks
+ * then find the entries on their individual callback paths. When a site adds
+ * a new permission between visits, the prompt receives only the missing
+ * subset — already-granted permissions are not re-listed.
+ *
+ * DSAP (spending) cap enforcement reads actual confirmed spend from the
+ * wallet's action history via `WalletPermissionsManager.querySpentSince` —
+ * the same mechanism WPM uses natively. No ledger-side counter is
+ * maintained, so failed broadcasts cannot cause drift.
+ *
+ * Level-2 counterparty pacts (`onCounterpartyPermissionRequested`) remain
+ * on-chain: the adapter just routes the UI decision to WPM's native
+ * `grantCounterpartyPermission` / `denyCounterpartyPermission`. If the
+ * consumer omits `prompt.onCounterpartyPermissionRequested`, the adapter
+ * auto-denies counterparty requests so the dApp call fails cleanly instead
+ * of hanging forever.
+ *
+ * Call {@link dispose} to unbind callbacks when tearing down the wallet.
+ */
+export class PermissionLedgerAdapter {
+    wallet;
+    store;
+    prompt;
+    boundCallbacks = [];
+    constructor(options) {
+        this.wallet = options.wallet;
+        this.store = options.store;
+        this.prompt = options.prompt;
+        this.bindCallbacks();
+    }
+    bindCallbacks() {
+        const bind = (name, handler) => {
+            const id = this.wallet.bindCallback(name, handler);
+            this.boundCallbacks.push([name, id]);
+        };
+        const single = (r) => this.handleSingle(r);
+        const spending = (r) => this.handleSpending(r);
+        const grouped = (r) => this.handleGrouped(r);
+        const counterparty = (r) => this.handleCounterparty(r);
+        bind('onProtocolPermissionRequested', single);
+        bind('onBasketAccessRequested', single);
+        bind('onCertificateAccessRequested', single);
+        bind('onSpendingAuthorizationRequested', spending);
+        bind('onGroupedPermissionRequested', grouped);
+        bind('onCounterpartyPermissionRequested', counterparty);
+    }
+    /** Unbinds every callback this adapter registered on the wallet. */
+    dispose() {
+        for (const [name, id] of this.boundCallbacks) {
+            this.wallet.unbindCallback(name, id);
+        }
+        this.boundCallbacks = [];
+    }
+    // ---------------------------------------------------------------------
+    // Handlers
+    // ---------------------------------------------------------------------
+    async handleSingle(request) {
+        try {
+            const key = permissionKeyFromRequest(request);
+            const existing = await this.store.findGrant(key);
+            if (existing && !isExpired(existing.expiry)) {
+                await this.wallet.grantPermission({
+                    requestID: request.requestID,
+                    ephemeral: true,
+                });
+                return;
+            }
+            const decision = await this.prompt.onPermissionRequested(request);
+            if (decision.approved) {
+                await this.store.putGrant({
+                    key,
+                    expiry: decision.expiry ?? 0,
+                    grantedAt: Date.now(),
+                    reason: request.reason,
+                });
+                await this.wallet.grantPermission({
+                    requestID: request.requestID,
+                    ephemeral: true,
+                });
+            }
+            else {
+                await this.wallet.denyPermission(request.requestID);
+            }
+        }
+        catch (err) {
+            await this.safeDeny(request.requestID);
+            throw err;
+        }
+    }
+    async handleSpending(request) {
+        try {
+            if (request.type !== 'spending' || !request.spending) {
+                await this.wallet.denyPermission(request.requestID);
+                return;
+            }
+            const key = permissionKeyFromRequest(request);
+            const needed = request.spending.satoshis;
+            const existing = await this.store.findGrant(key);
+            if (existing &&
+                !isExpired(existing.expiry) &&
+                existing.key.type === 'spending' &&
+                existing.authorizedAmount != null) {
+                // Read actual confirmed spend for this originator this month directly
+                // from the wallet's action history. WPM's own `querySpentSince` only
+                // reads `token.originator` + `token.rawOriginator`, so we can pass a
+                // minimal stub rather than reconstruct a full PermissionToken.
+                const spent = await this.wallet.querySpentSince({
+                    originator: existing.key.originator,
+                });
+                if (spent + needed <= existing.authorizedAmount) {
+                    await this.wallet.grantPermission({
+                        requestID: request.requestID,
+                        ephemeral: true,
+                    });
+                    return;
+                }
+            }
+            const decision = await this.prompt.onPermissionRequested(request);
+            if (decision.approved) {
+                await this.store.putGrant({
+                    key,
+                    expiry: decision.expiry ?? 0,
+                    grantedAt: Date.now(),
+                    reason: request.reason,
+                    authorizedAmount: decision.authorizedAmount ?? needed,
+                });
+                await this.wallet.grantPermission({
+                    requestID: request.requestID,
+                    ephemeral: true,
+                });
+            }
+            else {
+                await this.wallet.denyPermission(request.requestID);
+            }
+        }
+        catch (err) {
+            await this.safeDeny(request.requestID);
+            throw err;
+        }
+    }
+    async handleGrouped(request) {
+        try {
+            const neededKeys = permissionKeysFromGroup(request.originator, request.permissions);
+            const lookups = await Promise.all(neededKeys.map((k) => this.store.findGrant(k)));
+            const missingKeys = new Set();
+            for (let i = 0; i < neededKeys.length; i++) {
+                const g = lookups[i];
+                if (!g || isExpired(g.expiry)) {
+                    missingKeys.add(permissionKeyToString(neededKeys[i]));
+                }
+            }
+            if (missingKeys.size === 0) {
+                await this.wallet.dismissGroupedPermission(request.requestID);
+                return;
+            }
+            // Hand the prompt only the sub-permissions that still need approval.
+            // On first visit this equals the full bundle; on a revisit where the
+            // site has added one new permission, only that new one is shown.
+            const trimmedPermissions = filterGroupedByMissing(request.originator, request.permissions, missingKeys);
+            const decision = await this.prompt.onGroupedPermissionRequested({
+                ...request,
+                permissions: trimmedPermissions,
+            });
+            if (!decision.approved) {
+                await this.wallet.denyGroupedPermission(request.requestID);
+                return;
+            }
+            const normalized = normalizeOriginator(request.originator);
+            const grantedKeys = permissionKeysFromGroup(normalized, decision.granted);
+            const now = Date.now();
+            const expiry = decision.expiry ?? 0;
+            for (const key of grantedKeys) {
+                const grant = { key, expiry, grantedAt: now };
+                if (key.type === 'spending' && decision.granted.spendingAuthorization) {
+                    grant.authorizedAmount = decision.granted.spendingAuthorization.amount;
+                    grant.reason = decision.granted.spendingAuthorization.description;
+                }
+                await this.store.putGrant(grant);
+            }
+            await this.wallet.dismissGroupedPermission(request.requestID);
+        }
+        catch (err) {
+            await this.wallet
+                .denyGroupedPermission(request.requestID)
+                .catch(() => undefined);
+            throw err;
+        }
+    }
+    async handleCounterparty(request) {
+        // Level-2 counterparty pacts stay on-chain. The adapter does not consult
+        // the local store for these; it just routes the consumer's UI decision
+        // to WPM's native grant/deny (which writes the token to the chain).
+        const handler = this.prompt.onCounterpartyPermissionRequested;
+        if (!handler) {
+            await this.wallet.denyCounterpartyPermission(request.requestID);
+            return;
+        }
+        try {
+            const decision = await handler(request);
+            if (decision.approved) {
+                await this.wallet.grantCounterpartyPermission({
+                    requestID: request.requestID,
+                    granted: decision.granted,
+                    expiry: decision.expiry,
+                });
+            }
+            else {
+                await this.wallet.denyCounterpartyPermission(request.requestID);
+            }
+        }
+        catch (err) {
+            await this.wallet
+                .denyCounterpartyPermission(request.requestID)
+                .catch(() => undefined);
+            throw err;
+        }
+    }
+    async safeDeny(requestID) {
+        await this.wallet.denyPermission(requestID).catch(() => undefined);
+    }
+    // ---------------------------------------------------------------------
+    // Management helpers (for consumers to rebuild UIs)
+    // ---------------------------------------------------------------------
+    /**
+     * Return the full union of local (ledger) grants and on-chain WPM tokens.
+     *
+     * Under the default setup, the on-chain side contains only level-2
+     * counterparty pacts (and any pre-migration tokens that still exist).
+     * Records are tagged with `source: 'ledger' | 'onchain'` so the revoke
+     * handler can route correctly.
+     */
+    async listAllPermissions() {
+        const [ledger, protocols, baskets, spending, certs] = await Promise.all([
+            this.store.listGrants(),
+            this.wallet.listProtocolPermissions({}),
+            this.wallet.listBasketAccess({}),
+            this.wallet.listSpendingAuthorizations({}),
+            this.wallet.listCertificateAccess({}),
+        ]);
+        const ledgerRecords = ledger.map((g) => ({
+            source: 'ledger',
+            ...g,
+        }));
+        const onChain = [
+            ...protocols.map((t) => ({
+                source: 'onchain',
+                type: 'protocol',
+                token: t,
+            })),
+            ...baskets.map((t) => ({
+                source: 'onchain',
+                type: 'basket',
+                token: t,
+            })),
+            ...spending.map((t) => ({
+                source: 'onchain',
+                type: 'spending',
+                token: t,
+            })),
+            ...certs.map((t) => ({
+                source: 'onchain',
+                type: 'certificate',
+                token: t,
+            })),
+        ];
+        return [...ledgerRecords, ...onChain];
+    }
+    /**
+     * Revoke a single ledger-backed grant.
+     *
+     * To revoke an on-chain (counterparty) token, call
+     * `wallet.revokePermission(token)` directly with the raw WPM token.
+     */
+    async revokeLedgerGrant(key) {
+        await this.store.deleteGrant(key);
+    }
+    /**
+     * Revoke every grant for an originator across both stores.
+     *
+     * Returns counts of what was removed from each side.
+     */
+    async revokeAllForOriginator(originator) {
+        const normalized = normalizeOriginator(originator);
+        const ledgerCount = await this.store.deleteAllForOriginator(normalized);
+        const onchainRevoked = await this.wallet.revokeAllForOriginator(normalized);
+        return { ledger: ledgerCount, onchain: onchainRevoked.length };
+    }
+    /**
+     * Return the satoshi amount spent against the given DSAP grant in the
+     * current UTC month, read from the wallet's action history.
+     *
+     * Delegates to `WalletPermissionsManager.querySpentSince` for accuracy and
+     * cross-device consistency — the ledger does not track spend itself.
+     */
+    async querySpent(key) {
+        if (key.type !== 'spending')
+            return 0;
+        return this.wallet.querySpentSince({
+            originator: key.originator,
+        });
+    }
+}
+//# sourceMappingURL=adapter.js.map

package/dist/permissions/adapter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../src/permissions/adapter.ts"],"names":[],"mappings":"AAWA,OAAO,EACN,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,wBAAwB,EACxB,qBAAqB,EACrB,uBAAuB,GACvB,MAAM,OAAO,CAAA;AAwBd;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,OAAO,uBAAuB;IAClB,MAAM,CAA0B;IAChC,KAAK,CAAkB;IACvB,MAAM,CAAyB;IACxC,cAAc,GAAkC,EAAE,CAAA;IAE1D,YAAY,OAAuC;QAClD,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAA;QAC1B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAA;QAC5B,IAAI,CAAC,aAAa,EAAE,CAAA;IACrB,CAAC;IAEO,aAAa;QACpB,MAAM,IAAI,GAAG,CAAC,IAAkB,EAAE,OAAkC,EAAE,EAAE;YACvE,MAAM,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;YAClD,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAA;QACrC,CAAC,CAAA;QAED,MAAM,MAAM,GAA2B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAA;QAClE,MAAM,QAAQ,GAA2B,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAA;QACtE,MAAM,OAAO,GAAkC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,YAAY,GAAuC,CAAC,CAAC,EAAE,EAAE,CAC9D,IAAI,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAA;QAE3B,IAAI,CAAC,+BAA+B,EAAE,MAAM,CAAC,CAAA;QAC7C,IAAI,CAAC,yBAAyB,EAAE,MAAM,CAAC,CAAA;QACvC,IAAI,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAA;QAC5C,IAAI,CAAC,kCAAkC,EAAE,QAAQ,CAAC,CAAA;QAClD,IAAI,CAAC,8BAA8B,EAAE,OAAO,CAAC,CAAA;QAC7C,IAAI,CAAC,mCAAmC,EAAE,YAAY,CAAC,CAAA;IACxD,CAAC;IAED,oEAAoE;IACpE,OAAO;QACN,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC9C,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrC,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,EAAE,CAAA;IACzB,CAAC;IAED,wEAAwE;IACxE,WAAW;IACX,wEAAwE;IAEhE,KAAK,CAAC,YAAY,CACzB,OAAkD;QAElD,IAAI,CAAC;YACJ,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;YAC7C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,QAAQ,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,SAAS,EAAE,IAAI;iBACf,CAAC,CAAA;gBACF,OAAM;YACP,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAA;YACjE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACzB,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC;oBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;iBACtB,CAAC,CAAA;gBACF,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,SAAS,EAAE,IAAI;iBACf,CAAC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACpD,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACtC,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,cAAc,CAC3B,OAAkD;QAElD,IAAI,CAAC;YACJ,IAAI,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACtD,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBACnD,OAAM;YACP,CAAC;YACD,MAAM,GAAG,GAAG,wBAAwB,CAAC,OAAO,CAAC,CAAA;YAC7C,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAA;YACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAA;YAEhD,IACC,QAAQ;gBACR,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAC3B,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,UAAU;gBAChC,QAAQ,CAAC,gBAAgB,IAAI,IAAI,EAChC,CAAC;gBACF,sEAAsE;gBACtE,qEAAqE;gBACrE,qEAAqE;gBACrE,+DAA+D;gBAC/D,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBAC/C,UAAU,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU;iBAChB,CAAC,CAAA;gBACrB,IAAI,KAAK,GAAG,MAAM,IAAI,QAAQ,CAAC,gBAAgB,EAAE,CAAC;oBACjD,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;wBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;wBAC5B,SAAS,EAAE,IAAI;qBACf,CAAC,CAAA;oBACF,OAAM;gBACP,CAAC;YACF,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAA;YACjE,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC;oBACzB,GAAG;oBACH,MAAM,EAAE,QAAQ,CAAC,MAAM,IAAI,CAAC;oBAC5B,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;oBACrB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB,IAAI,MAAM;iBACrD,CAAC,CAAA;gBACF,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;oBACjC,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,SAAS,EAAE,IAAI;iBACf,CAAC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACpD,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YACtC,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,aAAa,CAC1B,OAAiC;QAEjC,IAAI,CAAC;YACJ,MAAM,UAAU,GAAG,uBAAuB,CACzC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,WAAW,CACnB,CAAA;YACD,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,CAChC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAC9C,CAAA;YACD,MAAM,WAAW,GAAG,IAAI,GAAG,EAAU,CAAA;YACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC5C,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;gBACpB,IAAI,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC/B,WAAW,CAAC,GAAG,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;gBACtD,CAAC;YACF,CAAC;YAED,IAAI,WAAW,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBAC5B,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBAC7D,OAAM;YACP,CAAC;YAED,qEAAqE;YACrE,qEAAqE;YACrE,iEAAiE;YACjE,MAAM,kBAAkB,GAAG,sBAAsB,CAChD,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,WAAW,EACnB,WAAW,CACX,CAAA;YACD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,4BAA4B,CAAC;gBAC/D,GAAG,OAAO;gBACV,WAAW,EAAE,kBAAkB;aAC/B,CAAC,CAAA;YACF,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACxB,MAAM,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;gBAC1D,OAAM;YACP,CAAC;YAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;YAC1D,MAAM,WAAW,GAAG,uBAAuB,CAAC,UAAU,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;YACzE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;YACtB,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,CAAA;YAEnC,KAAK,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;gBAC/B,MAAM,KAAK,GAAgB,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAA;gBAC1D,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU,IAAI,QAAQ,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;oBACvE,KAAK,CAAC,gBAAgB,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,MAAM,CAAA;oBACtE,KAAK,CAAC,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAA;gBAClE,CAAC;gBACD,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;YACjC,CAAC;YAED,MAAM,IAAI,CAAC,MAAM,CAAC,wBAAwB,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC9D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,MAAM;iBACf,qBAAqB,CAAC,OAAO,CAAC,SAAS,CAAC;iBACxC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxB,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAC/B,OAAsC;QAEtC,yEAAyE;QACzE,uEAAuE;QACvE,oEAAoE;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,iCAAiC,CAAA;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAC/D,OAAM;QACP,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;YACvC,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACvB,MAAM,IAAI,CAAC,MAAM,CAAC,2BAA2B,CAAC;oBAC7C,SAAS,EAAE,OAAO,CAAC,SAAS;oBAC5B,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;iBACvB,CAAC,CAAA;YACH,CAAC;iBAAM,CAAC;gBACP,MAAM,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;YAChE,CAAC;QACF,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACd,MAAM,IAAI,CAAC,MAAM;iBACf,0BAA0B,CAAC,OAAO,CAAC,SAAS,CAAC;iBAC7C,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;YACxB,MAAM,GAAG,CAAA;QACV,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,SAAiB;QACvC,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAA;IACnE,CAAC;IAED,wEAAwE;IACxE,oDAAoD;IACpD,wEAAwE;IAExE;;;;;;;OAOG;IACH,KAAK,CAAC,kBAAkB;QACvB,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;YACvE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE;YACvB,IAAI,CAAC,MAAM,CAAC,uBAAuB,CAAC,EAAE,CAAC;YACvC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAChC,IAAI,CAAC,MAAM,CAAC,0BAA0B,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,MAAM,CAAC,qBAAqB,CAAC,EAAE,CAAC;SACrC,CAAC,CAAA;QACF,MAAM,aAAa,GAAuB,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5D,MAAM,EAAE,QAAQ;YAChB,GAAG,CAAC;SACJ,CAAC,CAAC,CAAA;QACH,MAAM,OAAO,GAAuB;YACnC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACxB,MAAM,EAAE,SAAkB;gBAC1B,IAAI,EAAE,UAAmB;gBACzB,KAAK,EAAE,CAAC;aACR,CAAC,CAAC;YACH,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACtB,MAAM,EAAE,SAAkB;gBAC1B,IAAI,EAAE,QAAiB;gBACvB,KAAK,EAAE,CAAC;aACR,CAAC,CAAC;YACH,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACvB,MAAM,EAAE,SAAkB;gBAC1B,IAAI,EAAE,UAAmB;gBACzB,KAAK,EAAE,CAAC;aACR,CAAC,CAAC;YACH,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpB,MAAM,EAAE,SAAkB;gBAC1B,IAAI,EAAE,aAAsB;gBAC5B,KAAK,EAAE,CAAC;aACR,CAAC,CAAC;SACH,CAAA;QACD,OAAO,CAAC,GAAG,aAAa,EAAE,GAAG,OAAO,CAAC,CAAA;IACtC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,GAAkB;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,sBAAsB,CAC3B,UAAkB;QAElB,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;QAClD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAA;QACvE,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,sBAAsB,CAAC,UAAU,CAAC,CAAA;QAC3E,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,EAAE,CAAA;IAC/D,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,UAAU,CAAC,GAAkB;QAClC,IAAI,GAAG,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,CAAC,CAAA;QACrC,OAAO,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;YAClC,UAAU,EAAE,GAAG,CAAC,UAAU;SACP,CAAC,CAAA;IACtB,CAAC;CACD"}

package/dist/permissions/in-memory-store.d.ts

@@ -0,0 +1,17 @@
+import type { IPermissionStore, ListGrantsFilter, PermissionKey, StoredGrant } from './types';
+/**
+ * Reference `IPermissionStore` that keeps grants in a JS `Map`.
+ *
+ * Useful for tests, Node/server environments, and as a template for custom
+ * backends. Browser apps should prefer `IndexedDbPermissionStore` from
+ * `@1sat/wallet-browser` — it's the default for `createWebWallet`.
+ */
+export declare class InMemoryPermissionStore implements IPermissionStore {
+    private grants;
+    findGrant(key: PermissionKey): Promise<StoredGrant | null>;
+    putGrant(grant: StoredGrant): Promise<void>;
+    deleteGrant(key: PermissionKey): Promise<void>;
+    deleteAllForOriginator(originator: string): Promise<number>;
+    listGrants(filter?: ListGrantsFilter): Promise<StoredGrant[]>;
+}
+//# sourceMappingURL=in-memory-store.d.ts.map

package/dist/permissions/in-memory-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.d.ts","sourceRoot":"","sources":["../../src/permissions/in-memory-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,WAAW,EACX,MAAM,SAAS,CAAA;AAEhB;;;;;;GAMG;AACH,qBAAa,uBAAwB,YAAW,gBAAgB;IAC/D,OAAO,CAAC,MAAM,CAAiC;IAEzC,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAI1D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC;IAI3C,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9C,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAW3D,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;CAUnE"}

package/dist/permissions/in-memory-store.js

@@ -0,0 +1,42 @@
+import { permissionKeyToString } from './key';
+/**
+ * Reference `IPermissionStore` that keeps grants in a JS `Map`.
+ *
+ * Useful for tests, Node/server environments, and as a template for custom
+ * backends. Browser apps should prefer `IndexedDbPermissionStore` from
+ * `@1sat/wallet-browser` — it's the default for `createWebWallet`.
+ */
+export class InMemoryPermissionStore {
+    grants = new Map();
+    async findGrant(key) {
+        return this.grants.get(permissionKeyToString(key)) ?? null;
+    }
+    async putGrant(grant) {
+        this.grants.set(permissionKeyToString(grant.key), grant);
+    }
+    async deleteGrant(key) {
+        this.grants.delete(permissionKeyToString(key));
+    }
+    async deleteAllForOriginator(originator) {
+        let removed = 0;
+        for (const [id, grant] of this.grants) {
+            if (grant.key.originator === originator) {
+                this.grants.delete(id);
+                removed++;
+            }
+        }
+        return removed;
+    }
+    async listGrants(filter) {
+        const out = [];
+        for (const grant of this.grants.values()) {
+            if (filter?.originator && grant.key.originator !== filter.originator)
+                continue;
+            if (filter?.type && grant.key.type !== filter.type)
+                continue;
+            out.push(grant);
+        }
+        return out;
+    }
+}
+//# sourceMappingURL=in-memory-store.js.map

package/dist/permissions/in-memory-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"in-memory-store.js","sourceRoot":"","sources":["../../src/permissions/in-memory-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,qBAAqB,EAAE,MAAM,OAAO,CAAA;AAQ7C;;;;;;GAMG;AACH,MAAM,OAAO,uBAAuB;IAC3B,MAAM,GAAG,IAAI,GAAG,EAAuB,CAAA;IAE/C,KAAK,CAAC,SAAS,CAAC,GAAkB;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,IAAI,IAAI,CAAA;IAC3D,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,KAAkB;QAChC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAA;IACzD,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,GAAkB;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,qBAAqB,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/C,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,UAAkB;QAC9C,IAAI,OAAO,GAAG,CAAC,CAAA;QACf,KAAK,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBACzC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;gBACtB,OAAO,EAAE,CAAA;YACV,CAAC;QACF,CAAC;QACD,OAAO,OAAO,CAAA;IACf,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAyB;QACzC,MAAM,GAAG,GAAkB,EAAE,CAAA;QAC7B,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1C,IAAI,MAAM,EAAE,UAAU,IAAI,KAAK,CAAC,GAAG,CAAC,UAAU,KAAK,MAAM,CAAC,UAAU;gBACnE,SAAQ;YACT,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;gBAAE,SAAQ;YAC5D,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAChB,CAAC;QACD,OAAO,GAAG,CAAA;IACX,CAAC;CACD"}

package/dist/permissions/index.d.ts

@@ -0,0 +1,6 @@
+export { PermissionLedgerAdapter } from './adapter';
+export type { PermissionLedgerAdapterOptions } from './adapter';
+export { InMemoryPermissionStore } from './in-memory-store';
+export { filterGroupedByMissing, isExpired, normalizeOriginator, permissionKeyFromRequest, permissionKeysFromGroup, permissionKeyToString, } from './key';
+export type { CounterpartyPermissionPromptDecision, GroupedPermissionPromptDecision, IPermissionStore, ListGrantsFilter, PermissionKey, PermissionPromptDecision, PermissionPromptHandler, PermissionRecord, PermissionRecordSource, PermissionType, StoredGrant, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/permissions/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AACnD,YAAY,EAAE,8BAA8B,EAAE,MAAM,WAAW,CAAA;AAC/D,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACN,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,OAAO,CAAA;AACd,YAAY,EACX,oCAAoC,EACpC,+BAA+B,EAC/B,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,wBAAwB,EACxB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,cAAc,EACd,WAAW,GACX,MAAM,SAAS,CAAA"}

package/dist/permissions/index.js

@@ -0,0 +1,4 @@
+export { PermissionLedgerAdapter } from './adapter';
+export { InMemoryPermissionStore } from './in-memory-store';
+export { filterGroupedByMissing, isExpired, normalizeOriginator, permissionKeyFromRequest, permissionKeysFromGroup, permissionKeyToString, } from './key';
+//# sourceMappingURL=index.js.map

package/dist/permissions/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/permissions/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,WAAW,CAAA;AAEnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EACN,sBAAsB,EACtB,SAAS,EACT,mBAAmB,EACnB,wBAAwB,EACxB,uBAAuB,EACvB,qBAAqB,GACrB,MAAM,OAAO,CAAA"}

package/dist/permissions/key.d.ts

@@ -0,0 +1,55 @@
+import type { GroupedPermissions, PermissionRequest } from '@bsv/wallet-toolbox';
+import type { PermissionKey } from './types';
+/**
+ * Normalize an originator to the same canonical form WPM uses internally.
+ *
+ *  - Lowercase hostname
+ *  - Strip default ports (80 for http, 443 for https)
+ *  - Preserve non-default ports
+ *  - Fall back to lowercase trim on URL-parse failure
+ *
+ * Kept in sync with `WalletPermissionsManager#normalizeOriginator`. See
+ * `WPM-COUPLINGS.md` in this package for the fragility contract.
+ */
+export declare function normalizeOriginator(originator: string | undefined | null): string;
+/**
+ * Build a normalized `PermissionKey` from a WPM `PermissionRequest`.
+ *
+ * Throws if the request is missing required fields for its type (this should
+ * not happen in practice — WPM always populates these before firing callbacks).
+ */
+export declare function permissionKeyFromRequest(request: PermissionRequest): PermissionKey;
+/**
+ * Produce a canonical string representation of a `PermissionKey`.
+ *
+ * Suitable for use as a `Map` key or a storage index. Keys round-trip
+ * through `permissionKeyToString` safely — two requests that share the same
+ * normalized originator + parameters produce the same string.
+ *
+ * Certificate fields are sorted before joining so that field order does
+ * not affect key identity.
+ */
+export declare function permissionKeyToString(key: PermissionKey): string;
+/**
+ * Build the list of `PermissionKey`s implied by a BRC-73 grouped-permission bundle.
+ *
+ * Used by the adapter to check whether every sub-permission in a grouped
+ * request is already present in the store before deciding whether to prompt.
+ *
+ * Counterparty-less (`counterparty: ''`) protocol entries are skipped —
+ * they belong to a separate counterparty-pact flow and should not be
+ * matched as regular grants.
+ */
+export declare function permissionKeysFromGroup(originator: string, permissions: GroupedPermissions): PermissionKey[];
+/** True if `expiry` (UNIX seconds, 0 = never) has passed. */
+export declare function isExpired(expiry: number, now?: number): boolean;
+/**
+ * Build a new `GroupedPermissions` bundle containing only the sub-permissions
+ * whose canonical key string is present in `missingKeys`.
+ *
+ * Used by the adapter to trim an already-partially-granted bundle before
+ * handing it to the consumer's prompt handler — the user should only see
+ * permissions that still need approval, not ones they've already granted.
+ */
+export declare function filterGroupedByMissing(originator: string, permissions: GroupedPermissions, missingKeys: Set<string>): GroupedPermissions;
+//# sourceMappingURL=key.d.ts.map

package/dist/permissions/key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.d.ts","sourceRoot":"","sources":["../../src/permissions/key.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAChF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAQ5C;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAClC,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACnC,MAAM,CAmBR;AAWD;;;;;GAKG;AACH,wBAAgB,wBAAwB,CACvC,OAAO,EAAE,iBAAiB,GACxB,aAAa,CA2Cf;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,aAAa,GAAG,MAAM,CAWhE;AAED;;;;;;;;;GASG;AACH,wBAAgB,uBAAuB,CACtC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,kBAAkB,GAC7B,aAAa,EAAE,CAsCjB;AAED,6DAA6D;AAC7D,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,GAAE,MAAmB,GAAG,OAAO,CAG3E;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACrC,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,kBAAkB,EAC/B,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,GACtB,kBAAkB,CA8DpB"}

package/dist/permissions/key.js

@@ -0,0 +1,234 @@
+/** Default ports stripped from normalized originators (mirrors WPM). */
+const DEFAULT_PORTS = {
+    'http:': '80',
+    'https:': '443',
+};
+/**
+ * Normalize an originator to the same canonical form WPM uses internally.
+ *
+ *  - Lowercase hostname
+ *  - Strip default ports (80 for http, 443 for https)
+ *  - Preserve non-default ports
+ *  - Fall back to lowercase trim on URL-parse failure
+ *
+ * Kept in sync with `WalletPermissionsManager#normalizeOriginator`. See
+ * `WPM-COUPLINGS.md` in this package for the fragility contract.
+ */
+export function normalizeOriginator(originator) {
+    if (!originator)
+        return '';
+    const trimmed = originator.trim();
+    if (!trimmed)
+        return '';
+    try {
+        const hasScheme = /^[a-zA-Z][a-zA-Z\d+\-.]*:\/\//.test(trimmed);
+        const candidate = hasScheme ? trimmed : `https://${trimmed}`;
+        const url = new URL(candidate);
+        if (!url.hostname)
+            return trimmed.toLowerCase();
+        const hostname = url.hostname.toLowerCase();
+        const needsBrackets = hostname.includes(':');
+        const baseHost = needsBrackets ? `[${hostname}]` : hostname;
+        const port = url.port;
+        const defaultPort = DEFAULT_PORTS[url.protocol];
+        if (port && defaultPort && port === defaultPort)
+            return baseHost;
+        return port ? `${baseHost}:${port}` : baseHost;
+    }
+    catch {
+        return trimmed.toLowerCase();
+    }
+}
+/** Default the counterparty per WPM's convention (level-1 protocols always use `''`). */
+function defaultCounterparty(protocolID, counterparty) {
+    if (protocolID[0] === 1)
+        return '';
+    return counterparty ?? 'self';
+}
+/**
+ * Build a normalized `PermissionKey` from a WPM `PermissionRequest`.
+ *
+ * Throws if the request is missing required fields for its type (this should
+ * not happen in practice — WPM always populates these before firing callbacks).
+ */
+export function permissionKeyFromRequest(request) {
+    const originator = normalizeOriginator(request.originator);
+    switch (request.type) {
+        case 'protocol': {
+            if (!request.protocolID) {
+                throw new Error('Protocol permission request missing protocolID');
+            }
+            return {
+                type: 'protocol',
+                originator,
+                privileged: !!request.privileged,
+                protocolLevel: request.protocolID[0],
+                protocolName: request.protocolID[1],
+                counterparty: defaultCounterparty(request.protocolID, request.counterparty),
+            };
+        }
+        case 'basket': {
+            if (!request.basket) {
+                throw new Error('Basket permission request missing basket');
+            }
+            return { type: 'basket', originator, basket: request.basket };
+        }
+        case 'certificate': {
+            if (!request.certificate) {
+                throw new Error('Certificate permission request missing certificate details');
+            }
+            return {
+                type: 'certificate',
+                originator,
+                privileged: !!request.privileged,
+                verifier: request.certificate.verifier,
+                certType: request.certificate.certType,
+                fields: [...request.certificate.fields].sort(),
+            };
+        }
+        case 'spending':
+            return { type: 'spending', originator };
+    }
+}
+/**
+ * Produce a canonical string representation of a `PermissionKey`.
+ *
+ * Suitable for use as a `Map` key or a storage index. Keys round-trip
+ * through `permissionKeyToString` safely — two requests that share the same
+ * normalized originator + parameters produce the same string.
+ *
+ * Certificate fields are sorted before joining so that field order does
+ * not affect key identity.
+ */
+export function permissionKeyToString(key) {
+    switch (key.type) {
+        case 'protocol':
+            return `proto:${key.originator}:${key.privileged}:${key.protocolLevel},${key.protocolName}:${key.counterparty}`;
+        case 'basket':
+            return `basket:${key.originator}:${key.basket}`;
+        case 'certificate':
+            return `cert:${key.originator}:${key.privileged}:${key.verifier}:${key.certType}:${[...key.fields].sort().join('|')}`;
+        case 'spending':
+            return `spend:${key.originator}`;
+    }
+}
+/**
+ * Build the list of `PermissionKey`s implied by a BRC-73 grouped-permission bundle.
+ *
+ * Used by the adapter to check whether every sub-permission in a grouped
+ * request is already present in the store before deciding whether to prompt.
+ *
+ * Counterparty-less (`counterparty: ''`) protocol entries are skipped —
+ * they belong to a separate counterparty-pact flow and should not be
+ * matched as regular grants.
+ */
+export function permissionKeysFromGroup(originator, permissions) {
+    const normalized = normalizeOriginator(originator);
+    const keys = [];
+    if (permissions.spendingAuthorization) {
+        keys.push({ type: 'spending', originator: normalized });
+    }
+    for (const p of permissions.protocolPermissions ?? []) {
+        if (p.counterparty === '')
+            continue;
+        const level = p.protocolID[0];
+        const counterparty = level === 1 ? '' : (p.counterparty ?? 'self');
+        keys.push({
+            type: 'protocol',
+            originator: normalized,
+            privileged: false,
+            protocolLevel: level,
+            protocolName: p.protocolID[1],
+            counterparty,
+        });
+    }
+    for (const b of permissions.basketAccess ?? []) {
+        keys.push({ type: 'basket', originator: normalized, basket: b.basket });
+    }
+    for (const c of permissions.certificateAccess ?? []) {
+        keys.push({
+            type: 'certificate',
+            originator: normalized,
+            privileged: false,
+            verifier: c.verifierPublicKey,
+            certType: c.type,
+            fields: [...c.fields].sort(),
+        });
+    }
+    return keys;
+}
+/** True if `expiry` (UNIX seconds, 0 = never) has passed. */
+export function isExpired(expiry, now = Date.now()) {
+    if (!expiry)
+        return false;
+    return expiry * 1000 < now;
+}
+/**
+ * Build a new `GroupedPermissions` bundle containing only the sub-permissions
+ * whose canonical key string is present in `missingKeys`.
+ *
+ * Used by the adapter to trim an already-partially-granted bundle before
+ * handing it to the consumer's prompt handler — the user should only see
+ * permissions that still need approval, not ones they've already granted.
+ */
+export function filterGroupedByMissing(originator, permissions, missingKeys) {
+    const normalized = normalizeOriginator(originator);
+    const out = { description: permissions.description };
+    if (permissions.spendingAuthorization) {
+        const key = permissionKeyToString({
+            type: 'spending',
+            originator: normalized,
+        });
+        if (missingKeys.has(key)) {
+            out.spendingAuthorization = permissions.spendingAuthorization;
+        }
+    }
+    const protocolPermissions = [];
+    for (const p of permissions.protocolPermissions ?? []) {
+        if (p.counterparty === '')
+            continue;
+        const level = p.protocolID[0];
+        const counterparty = level === 1 ? '' : (p.counterparty ?? 'self');
+        const key = permissionKeyToString({
+            type: 'protocol',
+            originator: normalized,
+            privileged: false,
+            protocolLevel: level,
+            protocolName: p.protocolID[1],
+            counterparty,
+        });
+        if (missingKeys.has(key))
+            protocolPermissions.push(p);
+    }
+    if (protocolPermissions.length > 0)
+        out.protocolPermissions = protocolPermissions;
+    const basketAccess = [];
+    for (const b of permissions.basketAccess ?? []) {
+        const key = permissionKeyToString({
+            type: 'basket',
+            originator: normalized,
+            basket: b.basket,
+        });
+        if (missingKeys.has(key))
+            basketAccess.push(b);
+    }
+    if (basketAccess.length > 0)
+        out.basketAccess = basketAccess;
+    const certificateAccess = [];
+    for (const c of permissions.certificateAccess ?? []) {
+        const key = permissionKeyToString({
+            type: 'certificate',
+            originator: normalized,
+            privileged: false,
+            verifier: c.verifierPublicKey,
+            certType: c.type,
+            fields: [...c.fields].sort(),
+        });
+        if (missingKeys.has(key))
+            certificateAccess.push(c);
+    }
+    if (certificateAccess.length > 0)
+        out.certificateAccess = certificateAccess;
+    return out;
+}
+//# sourceMappingURL=key.js.map

package/dist/permissions/key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"key.js","sourceRoot":"","sources":["../../src/permissions/key.ts"],"names":[],"mappings":"AAIA,wEAAwE;AACxE,MAAM,aAAa,GAA2B;IAC7C,OAAO,EAAE,IAAI;IACb,QAAQ,EAAE,KAAK;CACf,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAClC,UAAqC;IAErC,IAAI,CAAC,UAAU;QAAE,OAAO,EAAE,CAAA;IAC1B,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAA;IACjC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,CAAA;IACvB,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,+BAA+B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QAC/D,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,OAAO,EAAE,CAAA;QAC5D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAA;QAC9B,IAAI,CAAC,GAAG,CAAC,QAAQ;YAAE,OAAO,OAAO,CAAC,WAAW,EAAE,CAAA;QAC/C,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;QAC3C,MAAM,aAAa,GAAG,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAA;QAC5C,MAAM,QAAQ,GAAG,aAAa,CAAC,CAAC,CAAC,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAA;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAA;QACrB,MAAM,WAAW,GAAG,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;QAC/C,IAAI,IAAI,IAAI,WAAW,IAAI,IAAI,KAAK,WAAW;YAAE,OAAO,QAAQ,CAAA;QAChE,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;IAC/C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,OAAO,CAAC,WAAW,EAAE,CAAA;IAC7B,CAAC;AACF,CAAC;AAED,yFAAyF;AACzF,SAAS,mBAAmB,CAC3B,UAA0B,EAC1B,YAAqB;IAErB,IAAI,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAA;IAClC,OAAO,YAAY,IAAI,MAAM,CAAA;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CACvC,OAA0B;IAE1B,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAC1D,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,UAAU,CAAC,CAAC,CAAC;YACjB,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;gBACzB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;YAClE,CAAC;YACD,OAAO;gBACN,IAAI,EAAE,UAAU;gBAChB,UAAU;gBACV,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU;gBAChC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAc;gBACjD,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;gBACnC,YAAY,EAAE,mBAAmB,CAChC,OAAO,CAAC,UAAU,EAClB,OAAO,CAAC,YAAY,CACpB;aACD,CAAA;QACF,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAA;YAC5D,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAA;QAC9D,CAAC;QACD,KAAK,aAAa,CAAC,CAAC,CAAC;YACpB,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;gBAC1B,MAAM,IAAI,KAAK,CACd,4DAA4D,CAC5D,CAAA;YACF,CAAC;YACD,OAAO;gBACN,IAAI,EAAE,aAAa;gBACnB,UAAU;gBACV,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU;gBAChC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;gBACtC,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,QAAQ;gBACtC,MAAM,EAAE,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;aAC9C,CAAA;QACF,CAAC;QACD,KAAK,UAAU;YACd,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,CAAA;IACzC,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAkB;IACvD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;QAClB,KAAK,UAAU;YACd,OAAO,SAAS,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,aAAa,IAAI,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,YAAY,EAAE,CAAA;QAChH,KAAK,QAAQ;YACZ,OAAO,UAAU,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,MAAM,EAAE,CAAA;QAChD,KAAK,aAAa;YACjB,OAAO,QAAQ,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAA;QACtH,KAAK,UAAU;YACd,OAAO,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;IAClC,CAAC;AACF,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,uBAAuB,CACtC,UAAkB,EAClB,WAA+B;IAE/B,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,IAAI,GAAoB,EAAE,CAAA;IAEhC,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;QACvC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE;YAAE,SAAQ;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAc,CAAA;QAC1C,MAAM,YAAY,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,CAAA;QAClE,IAAI,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7B,YAAY;SACZ,CAAC,CAAA;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,IAAI,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,CAAC,CAAC,iBAAiB;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;SAC5B,CAAC,CAAA;IACH,CAAC;IAED,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,SAAS,CAAC,MAAc,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IACzB,OAAO,MAAM,GAAG,IAAI,GAAG,GAAG,CAAA;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CACrC,UAAkB,EAClB,WAA+B,EAC/B,WAAwB;IAExB,MAAM,UAAU,GAAG,mBAAmB,CAAC,UAAU,CAAC,CAAA;IAClD,MAAM,GAAG,GAAuB,EAAE,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE,CAAA;IAExE,IAAI,WAAW,CAAC,qBAAqB,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,qBAAqB,CAAC;YACjC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,UAAU;SACtB,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,qBAAqB,GAAG,WAAW,CAAC,qBAAqB,CAAA;QAC9D,CAAC;IACF,CAAC;IAED,MAAM,mBAAmB,GAErB,EAAE,CAAA;IACN,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,mBAAmB,IAAI,EAAE,EAAE,CAAC;QACvD,IAAI,CAAC,CAAC,YAAY,KAAK,EAAE;YAAE,SAAQ;QACnC,MAAM,KAAK,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAc,CAAA;QAC1C,MAAM,YAAY,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,IAAI,MAAM,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC;YACjC,IAAI,EAAE,UAAU;YAChB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,aAAa,EAAE,KAAK;YACpB,YAAY,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;YAC7B,YAAY;SACZ,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACtD,CAAC;IACD,IAAI,mBAAmB,CAAC,MAAM,GAAG,CAAC;QACjC,GAAG,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAE9C,MAAM,YAAY,GAAoD,EAAE,CAAA;IACxE,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,YAAY,IAAI,EAAE,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,qBAAqB,CAAC;YACjC,IAAI,EAAE,QAAQ;YACd,UAAU,EAAE,UAAU;YACtB,MAAM,EAAE,CAAC,CAAC,MAAM;SAChB,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IAC/C,CAAC;IACD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,YAAY,GAAG,YAAY,CAAA;IAE5D,MAAM,iBAAiB,GAEnB,EAAE,CAAA;IACN,KAAK,MAAM,CAAC,IAAI,WAAW,CAAC,iBAAiB,IAAI,EAAE,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,qBAAqB,CAAC;YACjC,IAAI,EAAE,aAAa;YACnB,UAAU,EAAE,UAAU;YACtB,UAAU,EAAE,KAAK;YACjB,QAAQ,EAAE,CAAC,CAAC,iBAAiB;YAC7B,QAAQ,EAAE,CAAC,CAAC,IAAI;YAChB,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE;SAC5B,CAAC,CAAA;QACF,IAAI,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;IACpD,CAAC;IACD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,iBAAiB,GAAG,iBAAiB,CAAA;IAE3E,OAAO,GAAG,CAAA;AACX,CAAC"}

package/dist/permissions/types.d.ts

@@ -0,0 +1,132 @@
+import type { CounterpartyPermissionRequest, CounterpartyPermissions, GroupedPermissionRequest, GroupedPermissions, PermissionRequest, PermissionToken } from '@bsv/wallet-toolbox';
+/** The four BRC-100 permission categories. */
+export type PermissionType = 'protocol' | 'basket' | 'certificate' | 'spending';
+/** A normalized permission key, uniquely identifying a (originator, category, parameters) tuple. */
+export type PermissionKey = {
+    type: 'protocol';
+    originator: string;
+    privileged: boolean;
+    protocolLevel: 0 | 1 | 2;
+    protocolName: string;
+    counterparty: string;
+} | {
+    type: 'basket';
+    originator: string;
+    basket: string;
+} | {
+    type: 'certificate';
+    originator: string;
+    privileged: boolean;
+    verifier: string;
+    certType: string;
+    fields: string[];
+} | {
+    type: 'spending';
+    originator: string;
+};
+/**
+ * A persisted permission grant.
+ *
+ * For spending (DSAP) grants, the ledger only stores the user-authorized cap
+ * (`authorizedAmount`). Actual monthly spend is read from the wallet's
+ * action history on every cap check via `WalletPermissionsManager.querySpentSince`
+ * — the same mechanism WPM uses natively, so spent accounting remains exact
+ * and cross-device consistent.
+ */
+export interface StoredGrant {
+    key: PermissionKey;
+    /** UNIX seconds, 0 for never expires. */
+    expiry: number;
+    /** UNIX milliseconds when this grant was created. */
+    grantedAt: number;
+    /** Optional human-readable reason captured from the request. */
+    reason?: string;
+    /** DSAP only — monthly spending cap (in satoshis). */
+    authorizedAmount?: number;
+}
+/** Filter passed to `IPermissionStore.listGrants`. */
+export interface ListGrantsFilter {
+    originator?: string;
+    type?: PermissionType;
+}
+/**
+ * Storage backend for permission grants.
+ *
+ * Implementations should be keyed by the canonical string form of the
+ * `PermissionKey` (use `permissionKeyToString` from `./key`).
+ *
+ * All methods are async to allow implementations backed by persistent
+ * stores (IndexedDB, chrome.storage, file, etc.).
+ */
+export interface IPermissionStore {
+    findGrant(key: PermissionKey): Promise<StoredGrant | null>;
+    putGrant(grant: StoredGrant): Promise<void>;
+    deleteGrant(key: PermissionKey): Promise<void>;
+    deleteAllForOriginator(originator: string): Promise<number>;
+    listGrants(filter?: ListGrantsFilter): Promise<StoredGrant[]>;
+}
+/** User decision returned from a single-permission prompt. */
+export type PermissionPromptDecision = {
+    approved: true;
+    /** Optional override for the grant expiry in UNIX seconds. */
+    expiry?: number;
+    /** DSAP only — override the authorized amount (e.g. user chose a larger cap). */
+    authorizedAmount?: number;
+} | {
+    approved: false;
+};
+/** User decision returned from a BRC-73 grouped-permission prompt. */
+export type GroupedPermissionPromptDecision = {
+    approved: true;
+    /** Subset of the requested permissions that the user agreed to. */
+    granted: Partial<GroupedPermissions>;
+    expiry?: number;
+} | {
+    approved: false;
+};
+/**
+ * User decision returned from a level-2 counterparty pact prompt.
+ *
+ * `granted` is a `Partial<CounterpartyPermissions>` because users typically
+ * approve a subset of the requested protocols, matching WPM's
+ * `grantCounterpartyPermission` signature.
+ */
+export type CounterpartyPermissionPromptDecision = {
+    approved: true;
+    granted: Partial<CounterpartyPermissions>;
+    expiry?: number;
+} | {
+    approved: false;
+};
+/**
+ * Prompt callbacks supplied by the consumer (the host app).
+ *
+ * The adapter calls these when a grant is needed after the store lookup
+ * comes back empty. Counterparty prompts are optional — if omitted, the
+ * adapter auto-denies counterparty requests so the dApp call fails cleanly
+ * instead of hanging forever.
+ */
+export interface PermissionPromptHandler {
+    onPermissionRequested(request: PermissionRequest & {
+        requestID: string;
+    }): Promise<PermissionPromptDecision>;
+    onGroupedPermissionRequested(request: GroupedPermissionRequest): Promise<GroupedPermissionPromptDecision>;
+    onCounterpartyPermissionRequested?(request: CounterpartyPermissionRequest): Promise<CounterpartyPermissionPromptDecision>;
+}
+/** The source a permission record was loaded from when listing all permissions. */
+export type PermissionRecordSource = 'ledger' | 'onchain';
+/**
+ * Unified record returned by the adapter's `listAllPermissions` helper.
+ *
+ * `source: 'ledger'` records are local `StoredGrant`s; `source: 'onchain'`
+ * records are WPM `PermissionToken` shapes surfaced for level-2 counterparty
+ * pacts (and any pre-migration on-chain tokens that still exist).
+ */
+export type PermissionRecord = ({
+    source: 'ledger';
+} & StoredGrant) | {
+    source: 'onchain';
+    type: PermissionType;
+    token: PermissionToken;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/permissions/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,6BAA6B,EAC7B,uBAAuB,EACvB,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,eAAe,EACf,MAAM,qBAAqB,CAAA;AAE5B,8CAA8C;AAC9C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,aAAa,GAAG,UAAU,CAAA;AAE/E,oGAAoG;AACpG,MAAM,MAAM,aAAa,GACtB;IACA,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,OAAO,CAAA;IACnB,aAAa,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,YAAY,EAAE,MAAM,CAAA;CACnB,GACD;IACA,IAAI,EAAE,QAAQ,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;IAClB,MAAM,EAAE,MAAM,CAAA;CACb,GACD;IACA,IAAI,EAAE,aAAa,CAAA;IACnB,UAAU,EAAE,MAAM,CAAA;IAClB,UAAU,EAAE,OAAO,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,EAAE,CAAA;CACf,GACD;IACA,IAAI,EAAE,UAAU,CAAA;IAChB,UAAU,EAAE,MAAM,CAAA;CACjB,CAAA;AAEJ;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC3B,GAAG,EAAE,aAAa,CAAA;IAClB,yCAAyC;IACzC,MAAM,EAAE,MAAM,CAAA;IACd,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAA;IACjB,gEAAgE;IAChE,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACzB;AAED,sDAAsD;AACtD,MAAM,WAAW,gBAAgB;IAChC,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,IAAI,CAAC,EAAE,cAAc,CAAA;CACrB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAChC,SAAS,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IAC1D,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3C,WAAW,CAAC,GAAG,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9C,sBAAsB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IAC3D,UAAU,CAAC,MAAM,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;CAC7D;AAED,8DAA8D;AAC9D,MAAM,MAAM,wBAAwB,GACjC;IACA,QAAQ,EAAE,IAAI,CAAA;IACd,8DAA8D;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,iFAAiF;IACjF,gBAAgB,CAAC,EAAE,MAAM,CAAA;CACxB,GACD;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB,sEAAsE;AACtE,MAAM,MAAM,+BAA+B,GACxC;IACA,QAAQ,EAAE,IAAI,CAAA;IACd,mEAAmE;IACnE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,CAAA;IACpC,MAAM,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB;;;;;;GAMG;AACH,MAAM,MAAM,oCAAoC,GAC7C;IACA,QAAQ,EAAE,IAAI,CAAA;IACd,OAAO,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAA;IACzC,MAAM,CAAC,EAAE,MAAM,CAAA;CACd,GACD;IAAE,QAAQ,EAAE,KAAK,CAAA;CAAE,CAAA;AAEtB;;;;;;;GAOG;AACH,MAAM,WAAW,uBAAuB;IACvC,qBAAqB,CACpB,OAAO,EAAE,iBAAiB,GAAG;QAAE,SAAS,EAAE,MAAM,CAAA;KAAE,GAChD,OAAO,CAAC,wBAAwB,CAAC,CAAA;IACpC,4BAA4B,CAC3B,OAAO,EAAE,wBAAwB,GAC/B,OAAO,CAAC,+BAA+B,CAAC,CAAA;IAC3C,iCAAiC,CAAC,CACjC,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,oCAAoC,CAAC,CAAA;CAChD;AAED,mFAAmF;AACnF,MAAM,MAAM,sBAAsB,GAAG,QAAQ,GAAG,SAAS,CAAA;AAEzD;;;;;;GAMG;AACH,MAAM,MAAM,gBAAgB,GACzB,CAAC;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG,WAAW,CAAC,GACpC;IACA,MAAM,EAAE,SAAS,CAAA;IACjB,IAAI,EAAE,cAAc,CAAA;IACpB,KAAK,EAAE,eAAe,CAAA;CACrB,CAAA"}

package/dist/permissions/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/permissions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/permissions/types.ts"],"names":[],"mappings":""}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@1sat/wallet",
-  "version": "0.0.40",
+  "version": "0.0.42",
   "description": "BRC-100 wallet engine for 1Sat Ordinals SDK",
   "type": "module",
   "main": "./dist/index.js",
@@ -28,19 +28,19 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@1sat/client": "0.0.20",
-    "@1sat/types": "0.0.15",
-    "@1sat/templates": "0.0.6",
+    "@1sat/client": "0.0.21",
+    "@1sat/types": "0.0.17",
+    "@1sat/templates": "0.0.8",
     "@bopen-io/templates": "^1.2.3",
     "@msgpack/msgpack": "^3.1.3",
     "fflate": "^0.8.2"
   },
   "peerDependencies": {
-    "@bsv/sdk": "^2.0.6",
-    "@bsv/wallet-toolbox": "^2.1.8"
+    "@bsv/sdk": "^2.0.13",
+    "@bsv/wallet-toolbox": "^2.1.21"
   },
   "devDependencies": {
-    "@bsv/sdk": "^2.0.6",
+    "@bsv/sdk": "^2.0.13",
     "@types/chrome": "^0.1.32",
     "typescript": "^5.9.3"
   }